decocms 4.393.2 → 4.394.0

package/dist/server/server.js

@@ -1218,7 +1218,7 @@ Caused by: ${Z.stack}`}};Bc=class Bc extends EY{constructor($,Z){super($,Z);this
 ${X}`:X}var Dj$,ev4;var u81=D(()=>{Dj$=/[\r\n<>]/,ev4=/^[^\s@<>]+@[^\s@<>]+\.[^\s@<>]+$/});var eP0=D(()=>{B8();u81()});function Zb4($){if($ instanceof TypeError)return!0;if($ instanceof Error&&!($ instanceof DOMException)&&typeof $.code==="string")return!0;if($ instanceof DOMException&&$.name==="AbortError")return!0;return!1}async function l81($,Z,Q,Y){try{return await f8(async()=>{let J=await fetch($,{...Z,signal:AbortSignal.timeout(Y)});return{status:J.status,ok:J.ok,body:await J.text()}},{maxAttempts:3,minTimeout:50,maxTimeout:500,multiplier:2,jitter:0.5,isRetriable:Zb4})}catch(X){let J=X instanceof Error?X.message:String(X);throw Error(`[SANDBOX_UNREACHABLE] sandbox daemon ${Q} request failed: ${J}`,{cause:X})}}async function $A0($){try{let Z=await fetch(`${$}/health`,{signal:AbortSignal.timeout(Qb4)});if(!Z.ok){try{await Z.text()}catch{}return null}let Q=await Z.json();if(typeof Q==="object"&&Q!==null&&typeof Q.bootId==="string"&&typeof Q.ready==="boolean"&&Q.setup&&typeof Q.setup.running==="boolean"&&typeof Q.setup.done==="boolean")return Q;return null}catch{return null}}async function m81($){for(let Z=0;Z<wj$;Z++){if(await $A0($)!==null)return;let Q=(Math.random()*2-1)*Yb4;await m$(jj$+Q)}throw Error(`sandbox daemon at ${$} did not respond on /health within ${wj$*jj$/1000}s`)}async function Fx($,Z,Q,Y,X){return Xb4($,Z,"POST",Q,Y,X)}async function Xb4($,Z,Q,Y,X,J){let G={...Y};if(X&&X.rotateToken!==void 0)G.auth=X;let W=await l81(`${$}/_sandbox/config`,{method:Q,headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:JSON.stringify(G)},"/_sandbox/config",J?.timeoutMs??c81);if(!W.ok)throw new Hx(W.status,W.body);return Pj$(W.body,"/_sandbox/config")}async function Ej$($,Z,Q){let Y=await l81(`${$}/_sandbox/setup/${Q}`,{method:"POST",headers:{Authorization:`Bearer ${Z}`}},`/_sandbox/setup/${Q}`,c81);if(!Y.ok)throw Error(`sandbox daemon /_sandbox/setup/${Q} returned ${Y.status}: ${Y.body}`)}async function zj$($,Z,Q){let Y=await l81(`${$}/_sandbox/orgfs-config`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:Q},"/_sandbox/orgfs-config",c81);if(!Y.ok)throw Error(`sandbox daemon /_sandbox/orgfs-config returned ${Y.status}: ${Y.body}`);return Pj$(Y.body,"/_sandbox/orgfs-config")}function Pj$($,Z){try{return JSON.parse($)}catch(Q){throw Error(`sandbox daemon ${Z} returned a malformed JSON body: ${$.slice(0,200)}`,{cause:Q})}}async function ye($,Z,Q,Y){let X=new Headers(Y.headers);for(let W of Jb4)X.delete(W);X.set("authorization",`Bearer ${Z}`);let J=Y.method!=="GET"&&Y.method!=="HEAD",G=`${$}${Q.startsWith("/")?Q:`/${Q}`}`;return fetch(G,{method:Y.method,headers:X,body:J?Y.body:void 0,redirect:"manual",signal:Y.signal,duplex:J?"half":void 0})}var Hx,Qb4=500,c81=30000,wj$=25,jj$=200,Yb4=50,Jb4;var d81=D(()=>{eP0();B8();Hx=class Hx extends Error{status;constructor($,Z){super(`sandbox daemon /_sandbox/config returned ${$}: ${Z}`);this.status=$;this.name="ConfigRequestError"}};Jb4=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length"]});class ZA0{counted=new Set;markCounted($){this.counted.add($)}consume($){return this.counted.delete($)}}class QA0{map=new Map;async run($,Z){let Q=this.map.get($);if(Q)return Q;let Y=Z();this.map.set($,Y);try{return await Y}finally{this.map.delete($)}}}function YA0($,Z,Q){if(!$)return Q(null);if(!$.withLock)return Q($);return $.withLock(Z,Q)}function ge($){if(!$.orgId||!$.virtualMcpId||!$.branch)throw Error("composeSandboxRef: orgId, virtualMcpId and branch are all required for agent refs");return`agent:${$.orgId}:${$.virtualMcpId}:${$.branch}`}function Aj$($){if(!$.startsWith("agent:"))return"";let Z=$.split(":");return Z.length>=4?Z.slice(3).join(":"):""}function Tj$($){return`${$.userId}:${$.projectRef}`}import{hash as Gb4}from"crypto";function Wb4($,Z=16){return Gb4("sha256",Tj$($),"hex").slice(0,Z)}function Ux($){let Z=Wb4($),Q=Kb4(Aj$($.projectRef));return Q?`${Q}-${Z}`:`s-${Z}`}function Kb4($){if(!$)return"";let Z=$.split("/").pop()??"",Q="",Y=!1;for(let X of Z.toLowerCase()){let J=X.charCodeAt(0),G=J>=97&&J<=122,W=J>=48&&J<=57;if(!G&&!W){Y||=Q.length>0;continue}if(Y){if(Q.length+1>=Rj$)break;Q+="-",Y=!1}if(Q+=X,Q.length===Rj$)break}return Q}var Rj$=24;var qj$=()=>{};function XA0($,Z){let Q=$.replace(/\/+$/,"");if(Q.includes("{handle}"))return`${Q.replace("{handle}",Z)}/`;try{let Y=new URL(Q);return Y.hostname=`${Z}.${Y.hostname}`,`${Y.toString()}/`}catch{return`${Q}/${Z}/`}}function JA0($){let Z=$.repo,Q=Z?{repository:{cloneUrl:Z.cloneUrl,repoName:Z.displayName??Hb4(Z.cloneUrl),...Z.branch?{branch:Z.branch}:{},submoduleCredentials:Z.submoduleCredentials??[]},repositories:($.extraRepos??[]).filter((K)=>!!K.directoryName).map((K)=>({cloneUrl:K.cloneUrl,repoName:K.directoryName,...K.branch?{branch:K.branch}:{},submoduleCredentials:K.submoduleCredentials??[]})),...Z.userName.trim()||Z.userEmail.trim()?{identity:{userName:Z.userName,userEmail:Z.userEmail}}:{}}:void 0,Y=$.tenant,X=Vc({userName:Y?.userName,userEmail:Y?.userEmail})??void 0,J=$.packageManager?{name:$.packageManager.name,...$.packageManager.path?{path:$.packageManager.path}:{}}:void 0,G=J?{packageManager:J,runtime:$.runtime,...$.port!==void 0?{port:$.port}:{}}:void 0,W=Y?.orgId;if(!Q&&!G&&!X&&$.cloneOnly===void 0&&!W)return null;return{...Q?{git:Q}:{},...X?{operator:X}:{},...W?{orgId:W}:{},...$.cloneOnly!==void 0?{cloneOnly:$.cloneOnly}:{},...G?{application:G}:{}}}function Hb4($){try{let Z=new URL($);return Z.pathname.replace(/^\/+/,"").replace(/\.git$/,"")||Z.hostname}catch{return $}}var Mj$=D(()=>{u81()});function Fb4($){try{return new URL($).username.length>0}catch{return!1}}function i81($){let Z=$.repo?.cloneUrl;if(!Z||!Fb4(Z))return null;return{git:{repository:{cloneUrl:Z}}}}var p81=D(()=>{qj$();Mj$()});async function*kj$($){let Z=$.now??(()=>Date.now()),Q=Z(),Y=$.schedulingTimeoutMs??Nb4,X={pod:{},sandbox:{},events:{hasPulling:!1,hasPulled:!1},startedAt:Q},J=[],G=null,W=!1,K=(E)=>{if(W)return;if(G){let z=G;G=null,z(E)}else J.push(E)},H=()=>{if(J.length>0)return Promise.resolve(J.shift());if(W)return Promise.resolve(null);return new Promise((E)=>{G=E})},F=()=>{if(W)return;if(W=!0,G){let E=G;G=null,E(null)}},U=new AbortController,N=()=>{U.abort(),F()};if($.signal)if($.signal.aborted)U.abort(),F();else $.signal.addEventListener("abort",N,{once:!0});let B=Math.max(0,Y-(Z()-Q)),O=setTimeout(()=>K("tick"),B+100),L,w=new Promise((E)=>{L=E}),j=Promise.allSettled([Ob4($.kc,$.namespace,$.claimName,U.signal,X,K,Z,L),Lb4($.kc,$.namespace,$.claimName,U.signal,X,K),wb4($.kc,$.namespace,$.claimName,w,U.signal,X,K,Z)]);try{let E=null,z=-1,T=Ij$(X,Y,Z);if(E=t81(T),!n81(T))z=Vj$(T);if(yield T,n81(T))return;while(!W){if(await H()===null)break;let A=Ij$(X,Y,Z);if(n81(A)){let _=t81(A);if(_!==E)E=_,yield A;return}let q=Vj$(A);if(q<z)continue;let x=t81(A);if(x!==E)E=x,z=q,yield A}}finally{if(clearTimeout(O),U.abort(),$.signal)$.signal.removeEventListener("abort",N);F(),await j.catch(()=>{})}}async function Sj$($,Z=Bb4){let Q=new AbortController,Y="claiming",X,J=()=>{clearTimeout(X),X=setTimeout(()=>Q.abort(),Z)};try{J();for await(let G of $(Q.signal)){if(G.kind==="ready")return;if(G.kind==="failed")throw new EY(G.message);Y=G.kind,J()}}finally{clearTimeout(X),Q.abort()}throw new Bc(`Sandbox did not become ready: no progress for ${Math.round(Z/1000)}s while ${Y}`)}function Ij$($,Z,Q){let{pod:Y,sandbox:X,events:J,startedAt:G}=$;if(X.ready)return{kind:"ready"};let W=Y.containerWaitingReason;if(W==="ImagePullBackOff"||W==="ErrImagePull")return{kind:"failed",reason:"image-pull-backoff",message:"Sandbox image failed to download. The cluster may be missing pull credentials or the image tag may not exist."};if(W==="CrashLoopBackOff")return{kind:"failed",reason:"crash-loop-backoff",message:"Sandbox crashed during startup and is now in CrashLoopBackOff. Check pod logs."};if(!Y.scheduled&&J.lastFailedSchedulingAt!==void 0&&Q()-G>Z)return{kind:"failed",reason:"scheduling-timeout",message:J.failedSchedulingMessage??`Pod could not be scheduled within ${Math.round(Z/1000)}s.`};if(Y.containerRunning&&!Y.containerReady)return{kind:"warming-daemon",since:G};if(J.hasPulling&&!J.hasPulled)return{kind:"pulling-image",since:G};if(W==="ContainerCreating"||W==="PodInitializing"||Y.scheduled&&!Y.containerRunning)return{kind:"starting-container",since:G};if(Y.scheduledFalseReason==="Unschedulable"||J.lastFailedSchedulingAt!==void 0&&!Y.scheduled)return{kind:"waiting-for-capacity",since:G,message:J.failedSchedulingMessage??Y.scheduledFalseMessage,nodeClaim:J.nominatedNodeClaim};return{kind:"claiming",since:G}}function n81($){return $.kind==="ready"||$.kind==="failed"}function Vj$($){switch($.kind){case"claiming":return 0;case"waiting-for-capacity":return 1;case"pulling-image":return 2;case"starting-container":return 3;case"warming-daemon":return 4;case"ready":case"failed":return 99}}function t81($){switch($.kind){case"claiming":case"pulling-image":case"starting-container":case"warming-daemon":return $.kind;case"waiting-for-capacity":return`waiting-for-capacity:${$.message??""}:${$.nodeClaim??""}`;case"ready":return"ready";case"failed":return`failed:${$.reason}:${$.message}`}}async function Ob4($,Z,Q,Y,X,J,G,W){let K=`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?watch=true&labelSelector=${encodeURIComponent(`${Ub4}=${Q}`)}`;return GA0({kc:$,path:K,signal:Y,label:`pod/${Q}`,onEvent:(H)=>{if(H.type!=="ADDED"&&H.type!=="MODIFIED")return;let F=H.object;if(F.metadata?.name)W(F.metadata.name);Db4(F,X,G),J("pod")}})}function Db4($,Z,Q){let X=($.status?.conditions??[]).find((G)=>G.type==="PodScheduled");if(X?.status==="True")Z.pod.scheduled=!0,Z.pod.scheduledFalseReason=void 0,Z.pod.scheduledFalseMessage=void 0;else if(X?.status==="False")Z.pod.scheduled=!1,Z.pod.scheduledFalseReason=X.reason,Z.pod.scheduledFalseMessage=X.message;let J=($.status?.containerStatuses??[]).find((G)=>G.name===d7.MAIN_CONTAINER_NAME);if(J)Z.pod.containerWaitingReason=J.state?.waiting?.reason,Z.pod.containerRunning=!!J.state?.running,Z.pod.containerReady=J.ready===!0}async function Lb4($,Z,Q,Y,X,J){let G=`/apis/${d7.CLAIM_API_GROUP}/${d7.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(Z)}/${d7.CLAIM_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${Q}`)}`;return GA0({kc:$,path:G,signal:Y,label:`sandboxclaim/${Q}`,onEvent:(W)=>{if(W.type!=="ADDED"&&W.type!=="MODIFIED")return;let H=W.object.status?.conditions?.find((F)=>F.type==="Ready");if(!H)return;if(H.status==="True")X.sandbox.ready=!0,X.sandbox.notReadyReason=void 0,X.sandbox.notReadyMessage=void 0;else X.sandbox.ready=!1,X.sandbox.notReadyReason=H.reason,X.sandbox.notReadyMessage=H.message;J("sandbox")}})}async function wb4($,Z,Q,Y,X,J,G,W){let K=await Promise.race([Y,new Promise((F)=>{if(X.aborted){F(Q);return}X.addEventListener("abort",()=>F(Q),{once:!0})})]);if(X.aborted)return;let H=`/api/v1/namespaces/${encodeURIComponent(Z)}/events?watch=true&fieldSelector=${encodeURIComponent(`involvedObject.name=${K},involvedObject.kind=Pod`)}`;return GA0({kc:$,path:H,signal:X,label:`events/${Q}`,onEvent:(F)=>{if(F.type!=="ADDED"&&F.type!=="MODIFIED")return;let U=F.object,N=U.reason;if(!N)return;switch(N){case"Pulling":J.events.hasPulling=!0;break;case"Pulled":J.events.hasPulling=!0,J.events.hasPulled=!0;break;case"FailedScheduling":J.events.lastFailedSchedulingAt=W(),J.events.failedSchedulingMessage=U.message;break;case"Nominated":{let B=U.message?.match(/nodeclaim\/([\w-]+)/);if(B)J.events.nominatedNodeClaim=B[1];break}default:return}G("event")}})}async function Cj$($){let{kc:Z,namespace:Q,labelSelector:Y,signal:X,onDelete:J}=$,G=`/apis/${d7.CLAIM_API_GROUP}/${d7.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(Q)}/${d7.CLAIM_PLURAL}?watch=true&labelSelector=${encodeURIComponent(Y)}`;return GA0({kc:Z,path:G,signal:X,label:"sandboxclaim-reaper",onEvent:(W)=>{if(W.type!=="DELETED")return;let K=W.object.metadata?.name;if(K)J(K)}})}async function GA0($){let{kc:Z,path:Q,signal:Y,label:X,onEvent:J}=$,G=0;while(!Y.aborted){try{let K=await FW(Z,{method:"GET",path:Q,signal:Y,headers:{accept:"application/json"},stream:!0});if(!K.ok||!K.body){try{await K.body?.cancel()}catch{}if(K.status===401||K.status===403){console.warn(`[lifecycle-watcher] ${X} stopped: watch denied (${K.status} ${K.statusText}). `+"The kubeconfig in use cannot watch SandboxClaims \u2014 if you are running locally, "+"this provider should not be active (check STUDIO_AGENT_SANDBOX_ENABLED).");return}throw Error(`watch handshake failed: ${K.status} ${K.statusText}`)}G=0;for await(let H of uU$(K.body)){if(Y.aborted)return;try{J(H)}catch(F){console.warn(`[lifecycle-watcher] ${X} onEvent threw: ${F instanceof Error?F.message:String(F)}`)}}}catch(K){if(Y.aborted)return;let H=K instanceof Error?K.message:String(K);console.warn(`[lifecycle-watcher] ${X} watch ended: ${H}`)}if(Y.aborted)return;let W=e7(5000,250,G,2,0);G+=1,await m$(W,{signal:Y}).catch(()=>{})}}var Ub4="studio.decocms.com/sandbox-handle",Nb4=300000,Bb4=600000;var _j$=D(()=>{B8();vW0();fW0()});import{z as NW}from"zod";function vj$($){if(!$||$.trim()==="")return[];let Z=NW.array(jb4).parse(JSON.parse($)),Q=new Set;for(let Y of Z){if(Q.has(Y.name))throw Error(`STUDIO_SANDBOX_TENANT_POOLS: duplicate pool name ${Y.name}`);Q.add(Y.name)}return Z}function Eb4($){try{let Z=new URL($);if(Z.hostname.toLowerCase()!=="github.com")return null;let[Q,Y]=Z.pathname.replace(/^\/+/,"").split("/"),X=Y?.replace(/\.git$/,"");return Q&&X?`${Q}/${X}`.toLowerCase():null}catch{return null}}function o81($,Z){let{orgId:Q,cloneUrl:Y}=Z;if(!Q||!Y)return null;let X=Eb4(Y);if(!X)return null;return $.find((J)=>J.orgId===Q&&J.repo.toLowerCase()===X)??null}function bj$($,Z,Q){return $?.name??(Z?Q:"none")}function zb4($,Z,Q,Y){let X=Y&&Y!=="default"?`-${Y}`:"";return`${Z}${X}${$==="harness-run"||Q?"-medium":""}`}async function r81($){let Z=zb4($.purpose,$.templateName,$.tenantPool,$.sandboxImage);if(Z===$.templateName)return{name:Z,probes:$.probes};let Q=$.probes[Z]??null,Y=Q!==null&&$.now-Q.checkedAt<$.ttlMs?Q:{checkedAt:$.now,present:await $.exists(Z)},X={...$.probes,[Z]:Y};if(Y.present)return{name:Z,probes:X};if(Q?.present!==!1)$.onAbsent?.(Z);if($.sandboxImage&&$.sandboxImage!=="default")return r81({...$,sandboxImage:void 0,probes:X});return{name:$.templateName,probes:X}}function xj$($,Z,Q){let Y=Q.replace(/^refs\/heads\//,"");return $.filter((X)=>X.repo.toLowerCase()===Z.toLowerCase()&&X.branch===Y)}function fj$($){return`https://github.com/${$.repo}.git`}var jb4;var a81=D(()=>{jb4=NW.object({name:NW.string().regex(/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/,"pool name must be a DNS label (lowercase alphanumeric and '-')"),orgId:NW.string().min(1),repo:NW.string().regex(/^[^/\s]+\/[^/\s]+$/,"repo must be `owner/name`"),connectionId:NW.string().min(1).optional(),branch:NW.string().min(1).default("main"),workload:NW.object({runtime:NW.enum(["node","bun","deno"]).default("node"),packageManager:NW.enum(["npm","pnpm","yarn","bun","deno"]).optional(),packageManagerPath:NW.string().optional(),devPort:NW.number().int().positive().optional()}).default({runtime:"node"})})});async function yj$($,Z,Q){let Y=new Map;for(let X of $){let J=Z(X);if(!J)continue;let G=Y.get(J);if(G)G.push(X);else Y.set(J,[X])}await Promise.allSettled([...Y.values()].map(async(X)=>{for(let J of X)await Q(J).catch(()=>{})}))}import{createHash as Pb4,randomBytes as Ab4,randomUUID as gj$}from"crypto";import*as dj$ from"net";import{PassThrough as Tb4}from"stream";function hj$($){if($ instanceof Error)return $.message;if($&&typeof $==="object"){let Z=$;if(Z.error instanceof Error)return Z.error.message;if(typeof Z.message==="string"&&Z.message)return Z.message}return String($)}class J41{records=new Map;inflight=new QA0;activeGauge=new ZA0;stateStore;previewUrlPattern;kubeConfig;capacityProbe;portForward;namespace;sandboxTemplateName;envName;tokenGenerator;idleTtlMs;metrics;previewGateway;sentinelToken;mintCloneUrl;mintOrgFsConfig;tenantPools;tenantPoolRefreshMs;poolPods=new Map;templateProbes={};dirtyPools=new Set;closed=!1;claimWatchAbort=new AbortController;constructor($={}){this.stateStore=$.stateStore??null,this.previewUrlPattern=$.previewUrlPattern??null,this.kubeConfig=$.kubeConfig??yb4(),this.portForward=new T81(this.kubeConfig),this.namespace=$.namespace??Rb4,this.sandboxTemplateName=$.sandboxTemplateName??qb4,this.envName=cb4($.envName),this.tokenGenerator=$.tokenGenerator??(()=>Ab4(Ib4).toString("hex")),this.idleTtlMs=$.idleTtlMs??kb4,this.metrics=$.meter?fb4($.meter):null,this.previewGateway=$.previewGateway&&$.previewUrlPattern?{...$.previewGateway}:null;let Z=$.sentinelToken?.trim()??"";if(this.sentinelToken=Z.length>0?Z:null,this.mintCloneUrl=$.mintCloneUrl,this.mintOrgFsConfig=$.mintOrgFsConfig,this.tenantPools=this.sentinelToken!==null?$.tenantPools??[]:[],this.sentinelToken===null&&($.tenantPools?.length??0)>0)console.warn(`[${E6}] tenant pools configured without a sentinel token \u2014 ignoring them (warm-pool mode is off)`);this.tenantPoolRefreshMs=$.tenantPoolRefreshMs??Cb4,this.startClaimReaper(),this.startCredentialRefresher(),this.startTenantPoolReconciler()}startClaimReaper(){let $=["app.kubernetes.io/managed-by=studio","app.kubernetes.io/name=studio-sandbox",...this.envName?[`${PX.env}=${this.envName}`]:[]].join(",");Cj$({kc:this.kubeConfig,namespace:this.namespace,labelSelector:$,signal:this.claimWatchAbort.signal,onDelete:(Z)=>this.invalidateRecord(Z)})}async ensure($,Z={}){let Q=Ux($);if(Q.startsWith("s-"))throw Error(`ensure: projectRef has no slug source: ${$.projectRef}`);return this.inflight.run(Q,()=>YA0(this.stateStore,$,(Y)=>this.ensureLocked($,Q,Z,Y)))}async delete($){let Z=await this.getRecord($);if(this.records.delete($),Z)this.dropRecord(Z);if(await this.deleteHttpRouteIfManaged($).catch((Q)=>{console.warn(`[${E6}] HTTPRoute delete failed for ${$}: ${Q instanceof Error?Q.message:String(Q)}`)}),await fA(this.kubeConfig,this.namespace,$),this.stateStore)if(Z)await this.stateStore.delete(Z.id);else await this.stateStore.deleteByHandle($)}lastTermination($){return CU$(this.kubeConfig,this.namespace,PX.sandboxHandle,$,d7.MAIN_CONTAINER_NAME)}async alive($){return await vB(this.kubeConfig,this.namespace,$)!==void 0}watchClaimLifecycle($,Z){return kj$({kc:this.kubeConfig,namespace:this.namespace,claimName:$,signal:Z})}hasSchedulableCapacity(){return this.capacityProbe??=cU$(this.kubeConfig,this.namespace),this.capacityProbe()}async getPreviewUrl($){let Z=await this.getRecord($);if(!Z)return null;return this.composePreviewUrl(Z)}async proxyDaemonRequest($,Z,Q){let Y=await this.getRecord($);if(!Y&&this.previewUrlPattern&&this.stateStore){let K=await this.stateStore.getByHandle($),H=K?.state,F=H?.token;if(K&&F){let N=`http://${H?.adoptedSandboxName??$}.${this.namespace}.svc.cluster.local:${uB}`;try{let B=await ye(N,F,Z,Q);if(B.status!==404)return B;try{await B.body?.cancel()}catch{}}catch{}}}if(!Y)Y=await this.resurrectByHandle($);if(!Y)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let X=Y,J=performance.now(),G=0,W=!(Q.body instanceof ReadableStream);try{let K=await ye(Y.daemonUrl,Y.token,Z,Q);if(K.status===401&&W){this.invalidateRecord($);let H=await this.getRecord($).catch(()=>null)??await this.resurrectByHandle($).catch(()=>null);if(H){try{await K.body?.cancel()}catch{}X=H,K=await ye(H.daemonUrl,H.token,Z,Q)}}return G=K.status,K}catch(K){if(!W)throw K;this.invalidateRecord($);let H=await this.resurrectByHandle($)??await this.getRecord($).catch(()=>null);if(!H)throw K;X=H;let F=await ye(H.daemonUrl,H.token,Z,Q);return G=F.status,F}finally{this.recordProxyDuration("daemon",G,X,performance.now()-J)}}async adoptLiveClaim($,Z){if(this.records.has(Z))return!0;let Q=await vB(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!Q||Q.metadata?.deletionTimestamp)return!1;return await this.inflight.run(Z,async()=>{let X=this.records.get(Z);if(X)return this.toSandbox(X);let J=await this.adopt($,Z,Q);if(!J)throw Error(`cannot adopt live claim ${Z}`);return YA0(this.stateStore,$,(G)=>this.finish(J,G,!0,!0,"adopt"))}).catch(()=>null)!=null}async resolvePreviewUpstreamUrl($){if(this.previewUrlPattern)return`http://${await this.resolveServiceNameForHandle($)}.${this.namespace}.svc.cluster.local:${uB}`;let Z=await this.getRecord($);if(Z)return Z.daemonUrl;let Q=await this.resurrectByHandle($);return Q?Q.daemonUrl:null}async resolveServiceNameForHandle($){let Z=this.records.get($);if(Z)return Z.adoptedSandboxName;if(this.stateStore){let Y=(await this.stateStore.getByHandle($).catch(()=>null))?.state?.adoptedSandboxName;if(Y)return Y}return $}async proxyPreviewRequest($,Z){let Q=performance.now(),Y=this.records.get($)??null,X=0;try{let J=await this.resolvePreviewUpstreamUrl($);if(!J){X=404;let O=$41(404,{error:"sandbox not found"});return O.headers.set(Bx,"1"),O}let G=new URL(Z.url);if((G.pathname==="/_sandbox"||G.pathname.startsWith("/_sandbox/"))&&Z.method!=="GET")return X=404,$41(404,{error:"not found"});let K=(O)=>`${O}${G.pathname}${G.search}`,H=new Headers(Z.headers);for(let O of bb4)H.delete(O);let F=Z.method!=="GET"&&Z.method!=="HEAD",U={method:Z.method,headers:H,body:F?Z.body:void 0,redirect:"manual",signal:Z.signal,duplex:F?"half":void 0},N;try{N=await fetch(K(J),U)}catch(O){let L=`${J}${G.pathname}`;if(console.warn(`[${E6}] preview fetch to ${L} failed: ${O instanceof Error?O.message:String(O)}`),Z.method==="GET"||Z.method==="HEAD"){if(this.invalidateRecord($),await this.resurrectByHandle($).catch(()=>null)){let E=await this.resolvePreviewUpstreamUrl($);if(E)try{N=await fetch(K(E),U);let z=new Headers;for(let[T,P]of N.headers.entries())if(!cj$.includes(T.toLowerCase()))z.set(T,P);return X=N.status,new Response(N.body,{status:N.status,statusText:N.statusText,headers:z})}catch(z){console.warn(`[${E6}] preview fetch retry to ${L} failed: ${z instanceof Error?z.message:String(z)}`)}}}else this.invalidateRecord($);X=502;let w=$41(502,{error:"sandbox daemon unreachable"});return w.headers.set(Bx,"1"),w}let B=new Headers;for(let[O,L]of N.headers.entries())if(!cj$.includes(O.toLowerCase()))B.set(O,L);return X=N.status,new Response(N.body,{status:N.status,statusText:N.statusText,headers:B})}finally{this.recordProxyDuration("preview",X,Y,performance.now()-Q,$)}}async ensureLocked($,Z,Q,Y){if(Q.image)console.warn(`[${E6}] opts.image ignored (template ${this.sandboxTemplateName} pins image): got ${Q.image}`);if(Y){let G=await Y.get($);if(G){let W=await this.rehydrate($,Z,G);if(W)return await this.refreshDaemonGitCredential(W,Q),await this.relayOrgFsConfig(W.daemonUrl,W.token,Q.orgFsConfigJson),this.finish(W,Y,!1,!0,"resume");await Y.delete($)}}let X=await vB(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(X)if(X.metadata?.deletionTimestamp)await je(this.kubeConfig,this.namespace,Z).catch((G)=>{console.warn(`[${E6}] wait for terminating claim ${Z} failed: ${G instanceof Error?G.message:String(G)}`)});else if(!s81(X)){let G=await this.join($,Z,Q,X).catch((W)=>{return console.warn(`[${E6}] join of starting claim ${Z} failed, recreating: ${W instanceof Error?W.message:String(W)}`),null});if(G)return this.finish(G,Y,!0,!0,"adopt");await fA(this.kubeConfig,this.namespace,Z).catch(()=>{}),await je(this.kubeConfig,this.namespace,Z).catch((W)=>{console.warn(`[${E6}] wait for deleted claim ${Z} failed: ${W instanceof Error?W.message:String(W)}`)})}else{let G=await this.adopt($,Z,X).catch((W)=>{return console.warn(`[${E6}] adopt ${Z} failed, recreating: ${W instanceof Error?W.message:String(W)}`),null});if(G)return await this.refreshDaemonGitCredential(G,Q),await this.relayOrgFsConfig(G.daemonUrl,G.token,Q.orgFsConfigJson),this.finish(G,Y,!0,!0,"adopt");await fA(this.kubeConfig,this.namespace,Z).catch(()=>{}),await je(this.kubeConfig,this.namespace,Z).catch((W)=>{console.warn(`[${E6}] wait for deleted claim ${Z} failed: ${W instanceof Error?W.message:String(W)}`)})}let J=await this.provision($,Z,Q);return this.finish(J,Y,!0,!1,"fresh")}async finish($,Z,Q,Y,X){let J=this.records.get($.handle),G=J!==void 0;if(J&&J.daemonForward!==$.daemonForward)this.closeForwarder(J.daemonForward);if(this.records.set($.handle,$),Q)await this.persist(Z,$);if(Y)await xW0(this.kubeConfig,this.namespace,$.handle,this.computeShutdownTime()).catch((W)=>console.warn(`[${E6}] TTL refresh failed for ${$.handle}: ${W instanceof Error?W.message:String(W)}`));if(this.metrics){let W=Q41($.tenant);if(this.metrics.ensureOutcome.add(1,{...W,outcome:X}),!G)this.metrics.active.add(1,W),this.activeGauge.markCounted($.handle)}return this.toSandbox($)}buildEnvMap($,Z){let Q={},Y=[];for(let[X,J]of Object.entries($.env??{}))if(Vb4.has(X))Y.push(X);else Q[X]=J;if(Y.length>0)console.warn(`[${E6}] opts.env keys overlap reserved bootstrap names and were dropped: ${Y.join(",")}`);return{...Q,DAEMON_TOKEN:Z.token,DAEMON_BOOT_ID:Z.daemonBootId,APP_ROOT:Z.workdir,PROXY_PORT:String(uB)}}async resolveTemplateName($,Z,Q){let{name:Y,probes:X}=await r81({purpose:$,tenantPool:Z,...Q?{sandboxImage:Q}:{},templateName:this.sandboxTemplateName,probes:this.templateProbes,now:Date.now(),ttlMs:Mb4,exists:(J)=>IU$(this.kubeConfig,this.namespace,J),onAbsent:(J)=>console.warn(`[${E6}] SandboxTemplate ${J} not found (or not readable) \u2014 this claim falls back to a template without that suffix. Upgrade the sandbox-env chart to the version that renders it.`)});return this.templateProbes=X,Y}buildClaim($,Z,Q,Y){let X=this.sentinelToken!==null,J=o81(this.tenantPools,{orgId:Z.tenant?.orgId,cloneUrl:Z.repo?.cloneUrl}),G=X?[]:Object.entries(this.buildEnvMap(Z,Q)).sort(([H],[F])=>H<F?-1:H>F?1:0).map(([H,F])=>({name:H,value:F})),W=ib4(Z),K=Object.keys(W).length>0;return{apiVersion:`${d7.CLAIM_API_GROUP}/${d7.CLAIM_API_VERSION}`,kind:"SandboxClaim",metadata:{name:$,namespace:this.namespace,labels:{"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[PX.env]:this.envName}:{},...Z41(Z.tenant)},...K?{annotations:W}:{}},spec:{sandboxTemplateRef:{name:Y},additionalPodMetadata:{labels:Z41(Z.tenant,{[PX.role]:"claimed",[PX.sandboxHandle]:$,...this.envName?{[PX.env]:this.envName}:{}}),...K?{annotations:W}:{}},env:G,warmpool:bj$(J,X,Y),lifecycle:{shutdownPolicy:"Delete",shutdownTime:this.computeShutdownTime()}}}}async provision($,Z,Q){let Y=this.tokenGenerator(),X=gj$(),J=WA0,G=this.claimTenantPool(Q),W=this.buildClaim(Z,Q,{token:Y,daemonBootId:X,workdir:J},await this.resolveTemplateName(Q.purpose,G,Q.sandboxImage));try{await d11(this.kubeConfig,this.namespace,W)}catch(K){if(K instanceof De)await je(this.kubeConfig,this.namespace,Z),await d11(this.kubeConfig,this.namespace,W);else throw K}return this.bind($,Z,Q,G,{token:Y,daemonBootId:X,workdir:J})}claimTenantPool($){return!$.sandboxImage||$.sandboxImage==="default"?o81(this.tenantPools,{orgId:$.tenant?.orgId,cloneUrl:$.repo?.cloneUrl}):null}async bind($,Z,Q,Y,{token:X,daemonBootId:J,workdir:G}){let W;try{W=await VU$(this.kubeConfig,this.namespace,Z),await Sj$((B)=>this.watchClaimLifecycle(Z,B))}catch(B){throw await fA(this.kubeConfig,this.namespace,Z).catch(()=>{}),B}try{await this.ensureServicePortForAdoptedSandbox(W),await this.ensureHttpRouteForHandle(Z,W,Q.tenant??null)}catch(B){throw await fA(this.kubeConfig,this.namespace,Z).catch(()=>{}),B}let K=await this.openForwarder(W,uB,Z),H=`http://127.0.0.1:${K.localPort}`,F=Y!==null&&W!==Z,U=this.workloadConfigPayload(Q,F),N=J;try{if(await m81(H),this.sentinelToken!==null){let B=await $A0(H);if(B)N=B.bootId;try{await Fx(H,this.sentinelToken,U??{},{rotateToken:X})}catch(O){if(O instanceof Hx&&O.status===401)console.warn(`[${E6}] sentinel rejected by adopted pod (handle=${Z}, sandbox=${W}): pod belongs to another claim; tearing down and reprovisioning`);throw O}}else if(U)await Fx(H,X,U);await this.relayOrgFsConfig(H,X,Q.orgFsConfigJson)}catch(B){throw this.closeForwarder(K),await this.deleteHttpRouteIfManaged(Z).catch(()=>{}),await fA(this.kubeConfig,this.namespace,Z).catch(()=>{}),B}return{id:$,handle:Z,adoptedSandboxName:W,token:X,workdir:G,daemonUrl:H,daemonForward:K,workload:Q.workload??null,daemonBootId:N,tenant:Q.tenant??null,tenantPoolPodBound:F,ensureOpts:rb4(Q)}}workloadConfigPayload($,Z){return JA0({runtime:$?.workload?.runtime??"node",packageManager:$?.workload?.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:$?.repo??null,extraRepos:$?.extraRepos??[],port:$?.workload?.devPort??uj$,tenant:$?.tenant??void 0,...$?{cloneOnly:$.cloneOnly===!0&&!Z}:{}})}async relayOrgFsConfig($,Z,Q){if(!Q)return;await zj$($,Z,Q).catch((Y)=>console.warn("[org-fs] sidecar config relay failed",Y))}async refreshDaemonGitCredential($,Z){let Q=i81(Z);if(!Q)return;try{await Fx($.daemonUrl,$.token,Q)}catch(Y){console.warn(`[${E6}] git credential refresh failed for ${$.handle}: ${Y instanceof Error?Y.message:String(Y)}`)}}async withFreshCloneUrl($,Z){if(!this.mintCloneUrl)return $;try{let Q=await this.mintCloneUrl($,Z!==void 0?{bufferMs:Z}:void 0);return Q?{...$,cloneUrl:Q}:$}catch(Q){return console.warn(`[${E6}] clone credential re-mint failed: ${Q instanceof Error?Q.message:String(Q)}`),$}}async withFreshCredentials($){return{...$,...$.repo?{repo:await this.withFreshCloneUrl($.repo)}:{},...$.orgFsConfigJson?{orgFsConfigJson:await ob4($,this.mintOrgFsConfig)}:{}}}startCredentialRefresher(){if(!this.mintCloneUrl)return;let{signal:$}=this.claimWatchAbort;(async()=>{while(!$.aborted){if(await m$(_b4,{signal:$}).catch(()=>{}),$.aborted)break;try{await this.refreshAllGitCredentials()}catch(Z){console.warn(`[${E6}] periodic credential refresh failed: ${Z instanceof Error?Z.message:String(Z)}`)}}})()}startTenantPoolReconciler(){if(this.tenantPools.length===0)return;let{signal:$}=this.claimWatchAbort;(async()=>{while(!$.aborted){try{await this.reconcileTenantPools()}catch(Z){console.warn(`[${E6}] tenant pool reconcile failed: ${Z instanceof Error?Z.message:String(Z)}`)}await m$(Sb4,{signal:$}).catch(()=>{})}})()}markTenantPoolsDirty($,Z){let Q=xj$(this.tenantPools,$,Z);for(let Y of Q)this.dirtyPools.add(Y.name);return Q.map((Y)=>Y.name)}async reconcileTenantPools(){for(let $ of this.tenantPools){let Z=await kU$(this.kubeConfig,this.namespace,$.name);if(Z===null){console.warn(`[${E6}] tenant pool ${$.name}: no SandboxWarmPool (or no selector yet) in ${this.namespace}`);continue}let Q=this.dirtyPools.delete($.name),Y=Z.filter((X)=>!X.labels[PX.sandboxHandle]);for(let[X]of this.poolPods)if(!Z.some((J)=>J.uid===X))this.poolPods.delete(X);for(let X of Y){if(this.claimWatchAbort.signal.aborted)return;await this.warmPoolPod($,X,Q)}this.recordPoolDepth($,Z,Y)}}recordPoolDepth($,Z,Q){let Y=this.metrics?.poolPods;if(!Y)return;let X=0,J=0;for(let W of Q){let K=this.poolPods.get(W.uid);if(!K)continue;if(K.failures>=KA0)J++;else if(K.lastConfigAt>0)X++}let G={pool:$.name,org:$.orgId};Y.record(X,{...G,state:"ready"}),Y.record(Z.length-Q.length,{...G,state:"bound"}),Y.record(Q.length-X-J,{...G,state:"pending"}),Y.record(J,{...G,state:"failed"})}async warmPoolPod($,Z,Q){let Y=this.poolPods.get(Z.uid);if(Y&&Y.failures>=KA0){if(Date.now()-Y.lastFailureAt<lj$)return;this.poolPods.set(Z.uid,{...Y,failures:0})}let X=Q||Y!==void 0&&Date.now()-Y.lastConfigAt>=this.tenantPoolRefreshMs;if(Y&&!X)return;let J={cloneUrl:fj$($),connectionId:$.connectionId,branch:$.branch,userName:"",userEmail:""},G=await this.withFreshCloneUrl(J);if($.connectionId&&G.cloneUrl===J.cloneUrl){this.recordPoolFailure(Z,$,"clone credential mint failed");return}let W=await this.openForwarder(Z.name,uB,Z.name).catch(()=>null);if(!W){this.recordPoolFailure(Z,$,"port-forward failed");return}let K=`http://127.0.0.1:${W.localPort}`;try{await m81(K);let H=this.sentinelToken;if(!H)return;if(!await this.isPoolPodUnbound(Z))return;let F=JA0({runtime:$.workload.runtime,packageManager:$.workload.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:G,port:$.workload.devPort??uj$})??{},{transition:U}=await Fx(K,H,F);if(X&&U!=="bootstrap"&&await this.isPoolPodUnbound(Z))await Ej$(K,H,"clone");this.poolPods.set(Z.uid,{lastConfigAt:Date.now(),lastFailureAt:0,failures:0}),console.log(`[${E6}] tenant pool ${$.name}: warmed ${Z.name} (${U})`)}catch(H){this.recordPoolFailure(Z,$,H instanceof Error?H.message:String(H))}finally{this.closeForwarder(W)}}isPoolPodUnbound($){return SU$(this.kubeConfig,this.namespace,$.name,PX.sandboxHandle)}recordPoolFailure($,Z,Q){let Y=this.poolPods.get($.uid),X=(Y?.failures??0)+1;this.poolPods.set($.uid,{lastConfigAt:Y?.lastConfigAt??0,lastFailureAt:Date.now(),failures:X});let J=X>=KA0?` \u2014 backing off ${lj$/60000}min`:"";console.warn(`[${E6}] tenant pool ${Z.name}: warming ${$.name} failed (${X}/${KA0})${J}: ${Q}`)}async refreshAllGitCredentials(){await yj$(this.records.values(),($)=>$.ensureOpts?.repo?.connectionId,async($)=>{if(this.claimWatchAbort.signal.aborted)return;let Z=$.ensureOpts?.repo;if(!Z)return;let Q=await this.withFreshCloneUrl(Z,vb4);await this.refreshDaemonGitCredential($,{...$.ensureOpts,repo:Q}),$.ensureOpts={...$.ensureOpts,repo:Q}})}async rebootstrapDaemon($,Z,Q){if(this.sentinelToken===null)return!1;let Y=this.workloadConfigPayload(Q,!1)??{};try{return await Fx($,this.sentinelToken,Y,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,Q?.orgFsConfigJson),!0}catch(X){if(X instanceof Hx&&X.status===401)try{return await Fx($,Z,Y,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,Q?.orgFsConfigJson),!0}catch(J){return console.warn(`[${E6}] re-bootstrap retry with claim token failed: ${J instanceof Error?J.message:String(J)}`),!1}return console.warn(`[${E6}] re-bootstrap failed: ${X instanceof Error?X.message:String(X)}`),!1}}async ensureServicePortForAdoptedSandbox($){if(!this.previewGateway||!this.previewUrlPattern)return;await hU$(this.kubeConfig,this.namespace,$,{name:"daemon",port:uB,targetPort:uB})}async ensureHttpRouteForHandle($,Z,Q){if(!this.previewGateway||!this.previewUrlPattern)return;let Y=ab4(this.previewUrlPattern,$);if(!Y)throw new EY(`Unable to derive preview hostname for ${$} from pattern: ${this.previewUrlPattern}`);let X={apiVersion:`${p11.API_GROUP}/${p11.API_VERSION}`,kind:"HTTPRoute",metadata:{name:$,namespace:this.namespace,labels:Z41(Q??void 0,{[PX.role]:"claimed",[PX.sandboxHandle]:$,"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[PX.env]:this.envName}:{}})},spec:{parentRefs:[{kind:"Gateway",group:"gateway.networking.k8s.io",name:this.previewGateway.name,namespace:this.previewGateway.namespace}],hostnames:[Y],rules:[{backendRefs:[{group:"",kind:"Service",name:Z,port:uB}]}]}};await fU$(this.kubeConfig,this.namespace,X)}async deleteHttpRouteIfManaged($){if(!this.previewGateway)return;await yU$(this.kubeConfig,this.namespace,$)}async rehydrate($,Z,Q){let Y=Q.state;if(!Y.adoptedSandboxName&&!Y.podName||!Y.token)return null;let X=await vB(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!X||!s81(X))return null;let J=X.status?.sandbox?.name??Y.adoptedSandboxName??Y.podName??Z,G=await this.openAndProbeDaemon(J,Z);if(!G)return null;if(Y.daemonBootId&&Y.daemonBootId!==G.bootId){if(this.sentinelToken!==null){let W=Y.ensureOpts?await this.withFreshCredentials(Y.ensureOpts):null;if(!await this.rebootstrapDaemon(G.daemonUrl,Y.token,W))return this.closeForwarder(G.daemonForward),null}else console.warn(`[${E6}] daemon restart detected (handle=${Z}): stored bootId=${Y.daemonBootId} live bootId=${G.bootId}`);await this.stateStore?.put($,{handle:Z,state:{...Y,daemonBootId:G.bootId}}).catch((W)=>console.warn(`[${E6}] bootId persist failed for ${Z}: ${W instanceof Error?W.message:String(W)}`))}return{id:$,handle:Z,adoptedSandboxName:J,tenantPoolPodBound:!1,token:Y.token,workdir:Y.workdir??WA0,daemonUrl:G.daemonUrl,daemonForward:G.daemonForward,workload:Y.workload??null,daemonBootId:G.bootId,tenant:Y.tenant??null,ensureOpts:Y.ensureOpts??null}}join($,Z,Q,Y){let X=this.sentinelToken!==null,J=X?this.tokenGenerator():e81(Y,"DAEMON_TOKEN"),G=X?gj$():e81(Y,"DAEMON_BOOT_ID");if(!J||!G)throw new EY(`claim ${Z} carries no daemon token`);return this.bind($,Z,Q,this.claimTenantPool(Q),{token:J,daemonBootId:G,workdir:WA0})}async adopt($,Z,Q){if(!s81(Q))return null;let Y=Q.status?.sandbox?.name??Z;if(this.sentinelToken!==null)return null;let X=e81(Q,"DAEMON_TOKEN");if(!X)return null;let J=await this.openAndProbeDaemon(Y,Z);if(!J)return null;let G=pb4(Q);if(this.previewGateway)await this.ensureServicePortForAdoptedSandbox(Y).catch((W)=>{console.warn(`[${E6}] Service port backfill failed for ${Z}: ${W instanceof Error?W.message:String(W)}`)}),await this.ensureHttpRouteForHandle(Z,Y,G).catch((W)=>{console.warn(`[${E6}] HTTPRoute backfill failed for ${Z}: ${W instanceof Error?W.message:String(W)}`)});return{id:$,handle:Z,adoptedSandboxName:Y,tenantPoolPodBound:!1,token:X,workdir:WA0,daemonUrl:J.daemonUrl,daemonForward:J.daemonForward,workload:null,daemonBootId:J.bootId,tenant:G,ensureOpts:null}}async openAndProbeDaemon($,Z){let Q=await this.openForwarder($,uB,Z).catch(()=>null);if(!Q)return null;let Y=`http://127.0.0.1:${Q.localPort}`,X=await $A0(Y);if(!X)return this.closeForwarder(Q),null;return{daemonForward:Q,daemonUrl:Y,bootId:X.bootId}}async getRecord($){let Z=this.records.get($);if(Z)return Z;if(!this.stateStore)return null;let Q=await this.stateStore.getByHandle($);if(!Q)return null;let Y=await this.rehydrate(Q.id,$,Q);if(Y)this.records.set($,Y);return Y}async resurrectByHandle($){if(!this.stateStore)return null;let Z=await this.stateStore.getByHandle($);if(!Z)return null;let Q=Z.state.ensureOpts;if(!Q)return null;let Y=await this.withFreshCredentials(Q);if(Ux(Z.id)!==$)return null;return await this.ensure(Z.id,Y),this.records.get($)??null}invalidateRecord($){let Z=this.records.get($);if(!Z)return;this.records.delete($),this.dropRecord(Z)}dropRecord($){if(this.closeForwarder($.daemonForward),this.metrics&&this.activeGauge.consume($.handle))this.metrics.active.add(-1,Q41($.tenant))}recordProxyDuration($,Z,Q,Y,X){if(!this.metrics)return;this.metrics.proxyDurationMs.record(Y,{...Q41(Q?.tenant??null),source:$,sandbox_handle:Q?.handle??X??"",status_code:Z||0})}composePreviewUrl($){if(this.previewUrlPattern)return XA0(this.previewUrlPattern,$.handle);return`http://127.0.0.1:${$.daemonForward.localPort}/`}toSandbox($){return{handle:$.handle,workdir:$.workdir,previewUrl:this.composePreviewUrl($),warmPoolAdopted:$.tenantPoolPodBound===!0}}async persist($,Z){if(!$)return;let Q={adoptedSandboxName:Z.adoptedSandboxName,token:Z.token,workdir:Z.workdir,workload:Z.workload,daemonBootId:Z.daemonBootId,tenant:Z.tenant,...Z.ensureOpts?{ensureOpts:Z.ensureOpts}:{}};await $.put(Z.id,{handle:Z.handle,state:Q})}computeShutdownTime(){return new Date(Date.now()+this.idleTtlMs).toISOString()}async releaseAfter($,Z){let Q=await vB(this.kubeConfig,this.namespace,$);if(!Q)return;let Y=nb4(Q.spec?.lifecycle?.shutdownTime,new Date(Date.now()+Z));if(!Y)return;await xW0(this.kubeConfig,this.namespace,$,Y).catch((X)=>console.warn(`[${E6}] release failed for ${$}: ${X instanceof Error?X.message:String(X)}`))}async renewTtl($){let Z=await vB(this.kubeConfig,this.namespace,$);if(!Z)return;let Q=tb4(Z.spec?.lifecycle?.shutdownTime,new Date(Date.now()+this.idleTtlMs));if(!Q)return;await xW0(this.kubeConfig,this.namespace,$,Q).catch((Y)=>console.warn(`[${E6}] TTL renew failed for ${$}: ${Y instanceof Error?Y.message:String(Y)}`))}openForwarder($,Z,Q=$){let Y=gb4(Q,Z);return new Promise((X,J)=>{let G=(W,K)=>{let H=dj$.createServer((F)=>this.handleForwardedConnection(F,$,Z,Q));H.once("error",(F)=>{if(F.code==="EADDRINUSE"&&K<xb4){try{H.close()}catch{}let U=Y41+(W-Y41+1)%ij$;G(U,K+1);return}J(F)}),H.listen(W,"127.0.0.1",()=>{let F=H.address();if(!F||typeof F==="string"){H.close(),J(Error("port-forward listener failed to bind"));return}X({server:H,localPort:F.port})})};G(Y,0)})}handleForwardedConnection($,Z,Q,Y){let X=new Tb4,J=null,G=!1,W=()=>{if(G)return;if(G=!0,X.destroy(),J)try{J.close()}catch{}if(!$.destroyed)$.destroy()};$.pipe(X),$.on("error",W),$.on("close",W),this.portForward.portForward(this.namespace,Z,[Q],$,null,X).then((K)=>{let H=typeof K==="function"?K():K;if(!H){W();return}if(J=H,J.on("close",W),J.on("error",(F)=>{console.warn(`[${E6}] port-forward to ${Z}:${Q} dropped mid-connection: ${hj$(F)}`,JSON.stringify(X41(F))),this.invalidateRecord(Y),W()}),G)try{J.close()}catch{}}).catch((K)=>{console.warn(`[${E6}] port-forward to ${Z}:${Q} failed: ${hj$(K)}`,JSON.stringify(X41(K))),this.invalidateRecord(Y),W()})}closeForwarder($){$.server.close((Z)=>{if(Z)console.warn(`[${E6}] port-forward close on :${$.localPort} errored: ${Z instanceof Error?Z.message:String(Z)}`)})}close(){if(this.closed)return;this.closed=!0,this.claimWatchAbort.abort();for(let $ of this.records.values())this.dropRecord($);this.records.clear()}}function fb4($){return{active:$.createUpDownCounter("studio.sandbox.active",{description:"Active sandbox count, by runner kind, owning org, and daemon impl. Cross-checks the cAdvisor-derived count from the cluster \u2014 divergence between the two indicates orphaned claims (studio deleted but K8s didn't reap) or unattributed pods.",unit:"{sandbox}"}),ensureOutcome:$.createCounter("studio.sandbox.ensure.outcome",{description:"Outcome of each ensure() call: fresh provision, resume from state-store after restart, or adopt of a cluster-side claim studio didn't know about. Cold-start ratio is the primary input for warm-pool sizing.",unit:"{call}"}),proxyDurationMs:$.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of studio-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"}),poolPods:$.createGauge("studio.sandbox.pool.pods",{description:"Tenant warm pool depth by pool and state: ready (warmed and unbound \u2014 what a claim can actually bind instantly), bound (serving a user), pending (unbound, not yet warmed), failed (gave up after repeated bootstrap failures). Alert on sustained ready=0: a pool that is always empty is doing nothing while costing N pods.",unit:"{pod}"})}}function X41($){let Z=[],Q=$;for(let Y=0;Y<5&&Q instanceof Error;Y++){let X=Q;if(Z.push({name:X.name,message:X.message,...X.code!==void 0?{code:X.code}:{},...X.errno!==void 0?{errno:X.errno}:{}}),X.cause===Q)break;Q=X.cause}if(Q!==void 0&&!(Q instanceof Error)&&Q!==null){let Y=Q,X=Y.error instanceof Error?X41(Y.error).chain:void 0;Z.push({nonError:String(Q),...typeof Y.type==="string"?{type:Y.type}:{},...typeof Y.message==="string"?{message:Y.message}:{},...Y.code!==void 0?{code:Y.code}:{},...typeof Y.reason==="string"?{reason:Y.reason}:{},...X?{error:X}:{},...X===void 0&&Y.error!==void 0?{rawError:String(Y.error)}:{},keys:Object.keys(Y)})}return{chain:Z}}function yb4(){let $=new fP0;return $.loadFromDefault(),$}function s81($){return Boolean($.status?.conditions?.some((Z)=>Z.type==="Ready"&&Z.status==="True"))}function e81($,Z){let Q=$.spec?.env;if(!Q)return null;for(let Y of Q)if(Y.name===Z&&Y.value)return Y.value;return null}function gb4($,Z){let Q=Pb4("sha256").update(`${$}:${Z}`).digest();return Y41+Q.readUInt32BE(0)%ij$}function $41($,Z){return new Response(JSON.stringify(Z),{status:$,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function mj$($){let Z=$.slice(0,ub4);return hb4.test(Z)?Z:""}function cb4($){if($===void 0)return null;let Z=$.trim();if(Z==="")return null;if(!lb4.test(Z))throw Error(`AgentSandboxProvider: envName=${JSON.stringify(Z)} is not a valid DNS-label-safe environment name (lowercase alphanumeric or '-', starts with a letter, ends alphanumeric, \u226432 chars). Studio sets this from STUDIO_ENV; check the studio chart's configMap.`);return Z}function Z41($,Z={}){let Q={...Z};if($){let Y=mj$($.orgId),X=mj$($.userId);if(Y)Q[PX.orgId]=Y;if(X)Q[PX.userId]=X}return Q}function Nx($){let Z="";for(let Q of $){let Y=Q.codePointAt(0)??0;Z+=Y<32||Y===127?" ":Q}return Z.slice(0,mb4)}function db4($){try{let Z=new URL($);return Z.username="",Z.password="",Z.toString()}catch{return""}}function ib4($){let Z={},Q=$.tenant;if(Q?.orgSlug)Z[rK.orgSlug]=Nx(Q.orgSlug);if(Q?.orgName)Z[rK.orgName]=Nx(Q.orgName);if(Q?.userEmail)Z[rK.userEmail]=Nx(Q.userEmail);if(Q?.userName)Z[rK.userName]=Nx(Q.userName);let Y=$.repo;if(Y){if(Y.displayName)Z[rK.gitRepo]=Nx(Y.displayName);let X=db4(Y.cloneUrl);if(X)Z[rK.gitRepoUrl]=Nx(X);let J=$.branch??Y.branch;if(J)Z[rK.gitBranch]=Nx(J)}return Z}function pb4($){let Z=$.metadata?.labels;if(!Z)return null;let Q=Z[PX.orgId],Y=Z[PX.userId];if(!Q||!Y)return null;let X=$.metadata?.annotations??{};return{orgId:Q,userId:Y,orgSlug:X[rK.orgSlug],orgName:X[rK.orgName],userEmail:X[rK.userEmail],userName:X[rK.userName]}}function nb4($,Z){if($){let Q=new Date($).getTime();if(Number.isFinite(Q)&&Q<=Z.getTime())return null}return Z.toISOString()}function tb4($,Z){if($){let Q=new Date($).getTime();if(Number.isFinite(Q)&&Q>=Z.getTime())return null}return Z.toISOString()}function Q41($){return{org_id:$?.orgId??"",user_id:$?.userId??"",runner_kind:"agent-sandbox"}}async function ob4($,Z){if(!Z||!$.tenant)return $.orgFsConfigJson;try{return await Z($.tenant)??$.orgFsConfigJson}catch(Q){return console.warn(`[${E6}] org-fs credential re-mint failed: ${Q instanceof Error?Q.message:String(Q)}`),$.orgFsConfigJson}}function rb4($){let Z={};if($.branch)Z.branch=$.branch;if($.repo)Z.repo=$.repo;if($.workload)Z.workload=$.workload;if($.env&&Object.keys($.env).length>0)Z.env=$.env;if($.tenant)Z.tenant=$.tenant;if($.cloneOnly)Z.cloneOnly=!0;if($.purpose)Z.purpose=$.purpose;if($.sandboxImage)Z.sandboxImage=$.sandboxImage;if($.orgFsConfigJson)Z.orgFsConfigJson=$.orgFsConfigJson;return Object.keys(Z).length>0?Z:null}function ab4($,Z){try{return new URL(XA0($,Z)).hostname||null}catch{return null}}var E6="AgentSandboxProvider",Bx="x-sandbox-preview-not-ready",Rb4="agent-sandbox-system",qb4="studio-sandbox",Mb4=300000,uB=9000,uj$=3000,WA0="/app",Ib4=32,Vb4,kb4=900000,Sb4=60000,Cb4=1800000,KA0=3,lj$=1800000,_b4=900000,vb4=1800000,bb4,cj$,Y41=40000,ij$=1e4,xb4=256,PX,rK,hb4,ub4=63,lb4,mb4=253;var pj$=D(()=>{B8();mU$();Oj$();d81();p81();fW0();vW0();_j$();a81();Vb4=new Set(["DAEMON_TOKEN","DAEMON_BOOT_ID","APP_ROOT","PROXY_PORT"]),bb4=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length","upgrade"],cj$=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];PX={role:"studio.decocms.com/role",sandboxHandle:"studio.decocms.com/sandbox-handle",orgId:"studio.decocms.com/org-id",userId:"studio.decocms.com/user-id",env:"studio.decocms.com/env"},rK={orgSlug:"studio.decocms.com/org-slug",orgName:"studio.decocms.com/org-name",userEmail:"studio.decocms.com/user-email",userName:"studio.decocms.com/user-name",gitRepo:"studio.decocms.com/git-repo",gitRepoUrl:"studio.decocms.com/git-repo-url",gitBranch:"studio.decocms.com/git-branch"},hb4=/^([A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?)?$/;lb4=/^[a-z]([a-z0-9-]{0,30}[a-z0-9])?$/});var nj$={};A6(nj$,{parseTenantPools:()=>vj$,PREVIEW_NOT_READY_HEADER:()=>Bx,AgentSandboxProvider:()=>J41});var G41=D(()=>{pj$();a81()});var rj$={};A6(rj$,{subscribeLifecycle:()=>N41,getOrInitSharedRunner:()=>U41,getAgentSandboxProviderForTeardown:()=>F41,getAgentSandboxProvider:()=>AX,__resetSharedLifecyclesForTesting:()=>Wx4});function K41($){let Z=he[tj$];if(Z)return Promise.resolve(Z);let Q=he[W41];if(Q)return Q;let Y=$().then((X)=>{return he[tj$]=X,X}).finally(()=>{delete he[W41]});return he[W41]=Y,Y}function sb4(){let $=process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN;return $&&$.trim()!==""?$:void 0}function eb4(){let $=process.env.STUDIO_SANDBOX_TEMPLATE_NAME;return $&&$.trim()!==""?$:void 0}function $x4(){let $=process.env.STUDIO_ENV;return $&&$.trim()!==""?$:void 0}function Zx4(){let $=process.env.STUDIO_SANDBOX_SENTINEL_TOKEN;return $&&$.trim()!==""?$:void 0}function Qx4(){let $=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME?.trim(),Z=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE?.trim();if(!$&&!Z)return;if(!$||!Z)throw Error("STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME and STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE must both be set, or both unset. Half-configured per-claim HTTPRoute routing would silently fail to attach.");return{name:$,namespace:Z}}async function H41($){let Z=new Ue($),Q=sb4(),{AgentSandboxProvider:Y,parseTenantPools:X}=await Promise.resolve().then(() => (G41(),nj$)),J=new JG(E0().encryptionKey);return new Y({stateStore:Z,previewUrlPattern:Q,sandboxTemplateName:eb4(),envName:$x4(),previewGateway:Qx4(),sentinelToken:Zx4(),tenantPools:X(process.env.STUDIO_SANDBOX_TENANT_POOLS),meter:z$,mintCloneUrl:async(G,W)=>{if(G.repositoryId){let F=await new ns($).getUnscoped(G.repositoryId);if(!F)return null;let{cloneUrl:U}=await tF({db:$,vault:J},F,{bufferMs:W?.bufferMs});return U}if(!G.connectionId)return null;let K=AU$(G.cloneUrl);if(!K)return null;let{cloneUrl:H}=await oF(G.connectionId,K.owner,K.name,$,J,{bufferMs:W?.bufferMs});return H},mintOrgFsConfig:async(G)=>{if(!G.orgSlug)return null;return await _W0({boundAuth:{apiKey:{create:(K)=>k8.api.createApiKey({body:{...K,userId:G.userId}})}},storage:{orgRepoSyncs:new xA($)}},{orgSlug:G.orgSlug,orgId:G.orgId,baseUrl:_5()})??null}})}function AX($){if(!E0().agentSandboxEnabled)throw Error("Agent sandbox is disabled. Set STUDIO_AGENT_SANDBOX_ENABLED=true to enable it.");return K41(()=>H41($.db))}function F41($){return K41(()=>H41($.db))}async function U41(){if(!E0().agentSandboxEnabled)return null;return K41(()=>H41(V8().db))}function N41($,Z,Q){let Y=Qj.get(Z);if(Y){if(Y.terminated){if(Y.lastPhase)try{Q(Y.lastPhase)}catch{}return{unsubscribe:Jx4}}if(Y.listeners.add(Q),Y.lastPhase)try{Q(Y.lastPhase)}catch{}return oj$(Z,Y,Q)}let X=new AbortController,J={lastPhase:null,terminated:!1,listeners:new Set([Q]),abort:X};return Qj.set(Z,J),Gx4($,Z,J),oj$(Z,J,Q)}function Jx4(){}function oj$($,Z,Q){return{unsubscribe(){if(Qj.get($)!==Z)return;if(Z.listeners.delete(Q),Z.listeners.size===0)Qj.delete($),Z.abort.abort()}}}async function Gx4($,Z,Q){let Y=null;try{for await(let X of $.watchClaimLifecycle(Z,Q.abort.signal)){if(Q.abort.signal.aborted)break;Q.lastPhase=X;let J=X.kind==="ready"||X.kind==="failed";if(J)Q.terminated=!0;let G=Array.from(Q.listeners);for(let W of G)try{W(X)}catch{}if(J)break}}catch(X){Y=X}finally{if(!Q.terminated&&!Q.abort.signal.aborted&&Q.listeners.size>0){let X={kind:"failed",reason:"unknown",message:Y instanceof Error?Y.message:"Lifecycle watcher ended unexpectedly"};Q.lastPhase=X,Q.terminated=!0;for(let J of Array.from(Q.listeners))try{J(X)}catch{}}if(Qj.get(Z)===Q)Qj.delete(Z)}}function Wx4(){for(let $ of Qj.values())$.abort.abort();Qj.clear()}var tj$,W41,he,Yx4,Xx4,Qj;var aK=D(()=>{g3();I6();u11();Be();uZ();Zc();jz();U$();bA();vG();w9();tj$=Symbol.for("decocms.sandbox.lifecycle.agent-sandbox-runner"),W41=Symbol.for("decocms.sandbox.lifecycle.agent-sandbox-inflight"),he=globalThis;Yx4=Symbol.for("decocms.sandbox.lifecycle.shared-lifecycles"),Xx4=globalThis,Qj=Xx4[Yx4]??=new Map});import{sql as Kx4}from"kysely";function aj$($){return $ instanceof Date?$.toISOString():String($)}class B41{db;vault;constructor($,Z){this.db=$;this.vault=Z}rowToInfo($){return{id:$.id,organizationId:$.organization_id,scope:$.scope,userId:$.user_id,name:$.name,description:$.description,createdBy:$.created_by,createdAt:aj$($.created_at),updatedBy:$.updated_by,updatedAt:aj$($.updated_at)}}assertVisible($,Z){if($.scope==="user"&&$.user_id!==Z)throw new Yj($.id)}async create($){let Z=r8("sec"),Q=await this.vault.encrypt($.value),Y=new Date,X=await this.db.insertInto("secrets").values({id:Z,organization_id:$.organizationId,scope:$.scope.kind,user_id:$.scope.kind==="user"?$.scope.userId:null,name:$.name,encrypted_value:Q,description:$.description??null,created_by:$.createdBy,created_at:Y,updated_by:$.createdBy,updated_at:Y}).returning(HA0).executeTakeFirstOrThrow();return this.rowToInfo(X)}async update($){let Z=await this.db.selectFrom("secrets").where("id","=",$.id).where("organization_id","=",$.organizationId).select(["id","scope","user_id"]).executeTakeFirst();if(!Z)throw new BW($.id);this.assertVisible(Z,$.callerUserId);let Q={updated_by:$.updatedBy,updated_at:new Date};if($.value!==void 0)Q.encrypted_value=await this.vault.encrypt($.value);if($.description!==void 0)Q.description=$.description;let Y=await this.db.updateTable("secrets").set(Q).where("id","=",$.id).where("organization_id","=",$.organizationId).returning(HA0).executeTakeFirstOrThrow();return this.rowToInfo(Y)}async delete($,Z,Q){let Y=await this.db.selectFrom("secrets").where("id","=",$).where("organization_id","=",Z).select(["id","scope","user_id"]).executeTakeFirst();if(!Y)throw new BW($);this.assertVisible(Y,Q),await this.db.deleteFrom("secrets").where("id","=",$).where("organization_id","=",Z).execute()}async list($){let Z=this.db.selectFrom("secrets").where("organization_id","=",$.organizationId).select(HA0);if($.scope?.kind==="user")Z=Z.where("scope","=","user").where("user_id","=",$.scope.userId);else if($.scope?.kind==="organization")Z=Z.where("scope","=","organization");else Z=Z.where((Y)=>Y.or([Y("scope","=","organization"),Y.and([Y("scope","=","user"),Y("user_id","=",$.callerUserId)])]));return(await Z.orderBy("created_at","desc").execute()).map((Y)=>this.rowToInfo(Y))}async findById($,Z,Q){let Y=await this.db.selectFrom("secrets").where("id","=",$).where("organization_id","=",Z).select(HA0).executeTakeFirst();if(!Y)throw new BW($);return this.assertVisible(Y,Q),this.rowToInfo(Y)}async resolveById($,Z,Q){let Y=await this.db.selectFrom("secrets").where("id","=",$).where("organization_id","=",Z).selectAll().executeTakeFirst();if(!Y)throw new BW($);this.assertVisible(Y,Q);let X=await this.vault.decrypt(Y.encrypted_value);return{info:this.rowToInfo(Y),value:X}}async resolveByName($){let Z=this.db.selectFrom("secrets").where("organization_id","=",$.organizationId).where("scope","=",$.scope.kind).where(Kx4`lower(name) = lower(${$.name})`).selectAll();if($.scope.kind==="user")Z=Z.where("user_id","=",$.scope.userId);let Q=await Z.executeTakeFirst();if(!Q)throw new BW(`${$.scope.kind}:${$.name}`);let Y=await this.vault.decrypt(Q.encrypted_value);return{info:this.rowToInfo(Q),value:Y}}}var HA0,BW,Yj;var ue=D(()=>{aQ();HA0=["id","organization_id","scope","user_id","name","description","created_by","created_at","updated_by","updated_at"];BW=class BW extends Error{constructor($){super(`Secret ${$} not found`);this.name="SecretNotFoundError"}};Yj=class Yj extends Error{constructor($){super(`Access denied for secret ${$}`);this.name="SecretAccessDeniedError"}}});async function FA0({ctx:$,orgId:Z,userId:Q,entries:Y}){if(!Y||Y.length===0)return[];let X=[];for(let J of Y)try{let{value:G}=await $.storage.secrets.resolveById(J.secretId,Z,Q);X.push({host:J.host,token:G})}catch(G){if(G instanceof BW||G instanceof Yj){console.warn(`[SANDBOX_START] skipping submodule credential for ${J.host}: ${G.message}. Re-link or recreate the secret to restore.`);continue}throw G}return X}var O41=D(()=>{ue()});function kZ($){if(!$||typeof $!=="object")return{};let Z=$.sandboxMap;if(!Z||typeof Z!=="object")return{};return Z}function QU($,Z,Q){let Y=$[Z]?.[Q];if(!Y)return null;return CN(Y)[VQ]??null}function le($,Z,Q,Y){let J={...CN($[Z]?.[Q]),[VQ]:Y};return{...$,[Z]:{...$[Z]??{},[Q]:J}}}async function sj$($,Z,Q,Y,X,J){let G=await $.findById(Z);if(!G)return;let W=G.metadata??{},K=le(kZ(W),Y,X,J);await $.update(Z,Q,{metadata:{...W,sandboxMap:K}})}function D41($,Z,Q){let Y=CN($[Z]?.[Q]);if(!Y[VQ])return null;let X={...Y};delete X[VQ];let J={...$[Z]??{}};if(Object.keys(X).length===0)delete J[Q];else J[Q]=X;let G={...$};if(Object.keys(J).length===0)delete G[Z];else G[Z]=J;return G}async function Xj($,Z,Q,Y,X){let J=await $.findById(Z);if(!J)return;let G=J.metadata??{},W=D41(kZ(G),Y,X);if(!W)return;await $.update(Z,Q,{metadata:{...G,sandboxMap:W}})}var VQ="agent-sandbox";var PJ=D(()=>{a8()});function lB($,Z){return Z?`thread:${$}/${Z}`:`thread:${$}`}function sK($){return`sandbox/thread-${$.replace(/^thread:/,"").replace(/\//g,"-")}`}function YU($){if(!$||!$.startsWith("thread:"))return null;return $.slice(7).split("/")[0]||null}async function Ox($,Z,Q){return w41(await L41($,Z),Q)}async function L41($,Z){let Q=YU(Z);if(!Q)return null;return await $.storage.threads.get(Q).catch(()=>null)}function w41($,Z){return $?.created_by??Z}async function Jj($,Z){if(!Z)return null;let Q=await $.storage.threads.get(Z).catch(()=>null);if(!Q)return null;return Q.metadata??{}}async function UA0($,Z){let Y=(await Jj($,Z))?.headRef;return typeof Y==="string"&&Y.length>0?Y:null}async function ej$($,Z,Q){let Y=await Jj($,Z);if(!Y)return;if(Y.headRef===Q)return;await $.storage.threads.update(Z,{metadata:{...Y,headRef:Q}}).catch((X)=>console.warn("[thread-repo] setThreadHeadRef failed",X))}function Hx4($,Z){let Q=l30(Z,$.owner,$.name);if(!Q||Q.id===$.connectionId)return null;let Y=y9(Q);return{...$,connectionId:Q.id,...Y?.installationId?{installationId:Y.installationId}:{}}}async function j41($,Z){let Y=(await Jj($,Z))?.githubRepos;return Array.isArray(Y)?Y.filter((X)=>X?.owner&&X?.name):[]}async function XU($,Z){let Q=await Jj($,Z),Y=Q?.githubRepo??null;if(!Z||!Q||!Y?.connectionId)return Y;try{let X=$.storage.threads.getOrganizationId();if(!X)return Y;if(await $.storage.connections.findById(Y.connectionId,X))return Y;let{items:J}=await $.storage.connections.list(X),G=Hx4(Y,J);if(!G)return Y;return await $.storage.threads.update(Z,{metadata:{...Q,githubRepo:G}}),console.warn("[thread-repo] re-pointed thread at a live repo connection",{threadId:Z,from:Y.connectionId,to:G.connectionId}),G}catch(X){return console.warn("[thread-repo] repoint check failed",X),Y}}function E41($){if($.pinnedRef)return $.pinnedRef;if($.runBranch&&$.runBranch===lB($.threadId))return $.runBranch;if($.threadRepo)return lB($.threadId,$.threadRepo.connectionId);if(!$.agentRepo)return"ephemeral";return $.runBranch??`thread:${$.threadId}`}async function z41($,Z){let Y=(await Jj($,Z))?.pinnedRef;return typeof Y==="string"&&Y.length>0?Y:null}async function kc($,Z){let[Q,Y]=await Promise.all([XU($,Z.threadId),z41($,Z.threadId)]);return E41({...Z,threadRepo:Q,pinnedRef:Y})}async function $E$($,Z,Q,Y,X){let J=await Jj($,Z);if(!J)return;let G=le(kZ(J),Q,Y,X);await $.storage.threads.update(Z,{metadata:{...J,sandboxMap:G}}).catch((W)=>console.warn("[thread-repo] setThreadSandboxMapEntry failed",W))}async function NA0($,Z){return kZ(await Jj($,Z))}async function ZE$($,Z,Q,Y){let X=await Jj($,Z);if(!X)return;let J=D41(kZ(X),Q,Y);if(!J)return;await $.storage.threads.update(Z,{metadata:{...X,sandboxMap:J}}).catch((G)=>console.warn("[thread-repo] removeThreadSandboxMapEntry failed",G))}var OW=D(()=>{NJ();PJ()});function ce($){let Z=new Set($.map((X)=>X.name.toLowerCase()).filter((X,J,G)=>G.indexOf(X)!==J)),Q=$.map((X)=>Z.has(X.name.toLowerCase())),Y=(X)=>{let J=$[X];return QE$(Q[X]?`${J.owner}-${J.name}`:J.name).toLowerCase()};for(let X=0;X<$.length;X++){let J=new Map,G=!1;for(let W=0;W<$.length;W++){let K=Y(W),H=J.get(K);if(H!==void 0){if(!Q[W])Q[W]=!0,G=!0;if(!Q[H])Q[H]=!0,G=!0}J.set(K,W)}if(!G)break}return $.map((X,J)=>QE$(Q[J]?`${X.owner}-${X.name}`:X.name))}function YE$($,Z){let Q=`${Z.owner}/${Z.name}`.toLowerCase(),Y=$.findIndex((X)=>`${X.owner}/${X.name}`.toLowerCase()===Q);return Y===-1?null:ce($)[Y]??null}function QE$($){return $.replace(/[^A-Za-z0-9._-]/g,"-").replace(/^[^A-Za-z0-9]+/,"")||"repo"}import{AsyncLocalStorage as Fx4}from"async_hooks";function BA0(){let $=lG.getStore();if(!$)throw Error("This tool is only available on a task run's MCP endpoint (/api/<org>/mcp/task-run/<threadId>).");return $}function OA0($){if($?.metadata?.source==="jira")return Nx4;return JW.some((Q)=>Mw($?.title,Q))?Ux4:XE$}var lG,XE$,Ux4,Nx4;var cB=D(()=>{k4();lG=new Fx4;XE$=["TASK_ADD_REPO","TASK_BOARD_ITEM_LIST","TASK_BOARD_ITEM_UPDATE","TASK_BOARD_ACTIVITY_LIST","TASK_BOARD_COMMENT_LIST","TASK_BOARD_COMMENT_CREATE","TASK_BOARD_COMMENT_UPDATE"],Ux4=[...XE$,"TASK_BOARD_ITEM_PRS_GET","TASK_BOARD_REVIEW_DECISION"],Nx4=["TASK_ADD_REPO","JIRA_ISSUE_GET","JIRA_COMMENT_ADD","JIRA_ISSUE_TRANSITION","JIRA_ATTACHMENT_DOWNLOAD","JIRA_REMOTE_LINK_ADD"]});import{z as cG}from"zod";async function Lx4($,Z,Q,Y){return f8(async()=>{let X=QU(await NA0($,Z),Q,Y);if(!X)throw Error("sandbox record not written yet");return X},{maxAttempts:Bx4,minTimeout:Ox4,maxTimeout:Dx4,jitter:0}).catch(()=>null)}function jx4($,Z,Q=KE$){let Y=(J)=>`${J.owner}/${J.name}`.toLowerCase(),X=Y(Z);if($.some((J)=>Y(J)===X))return!1;return $.length>=Q}async function WE$($,Z,Q,Y){let X=await $.proxyDaemonRequest(Z,"/_sandbox/bash",{method:"POST",headers:new Headers({"content-type":"application/json","x-thread-id":Q}),body:JSON.stringify({command:Y})});if(!X.ok)throw Error(`sandbox bash failed (${X.status} ${X.statusText})`);let J=await X.json();return{stdout:J.stdout??"",exitCode:J.exitCode??0}}function Ex4($){let Z=$.split(`
 `).map((X)=>X.trim()),Q=Z.includes("__CLONED__"),Y=Z.filter((X)=>X&&X!==".git"&&X!=="__CLONED__");return{cloned:Q,listing:Y.join(`
 `)}}function zx4($){return[...$?[`cd ${JSON.stringify($)} || exit 0`]:[],...Px4].join(`
-`)}async function Ax4($,Z,Q){if(Q.repository)return tF($,Q.repository,{bufferMs:DA0});return await Nc({ctx:$,connectionId:Q.connectionId,organizationId:Z,forceRefresh:!0,onLegacyMintError:(Y)=>console.error("[TASK_ADD_REPO] legacy repo-scoped mint failed",{connectionId:Q.connectionId,error:Y.message})}),oF(Q.connectionId,Q.owner,Q.name,$.db,$.vault,{bufferMs:DA0})}async function Tx4($,Z,Q){let Y=await $.storage.organizationSettings.get(Z);return FA0({ctx:$,orgId:Z,userId:Q,entries:Y?.submodule_credentials})}function Rx4($){return{git:{...$.primary?{repository:{...$.primary,submoduleCredentials:$.submoduleCredentials}}:{repositories:$.secondaries??[]},identity:{userName:$.gitUserName,userEmail:$.gitUserEmail}}}}async function qx4($,Z,Q,Y){let X=ce(Q);return(await Promise.all(Q.map(async(G,W)=>{let K=await dw($.storage,Z,G),H=K&&await _B($.storage,K)?K:null;if(!H&&!G.connectionId)return null;try{let{cloneUrl:F}=H?await tF($,H,{bufferMs:DA0}):await oF(G.connectionId,G.owner,G.name,$.db,$.vault,{bufferMs:DA0});return{cloneUrl:F,repoName:X[W],submoduleCredentials:Y}}catch(F){return console.warn(`[TASK_ADD_REPO] skipping secondary ${G.owner}/${G.name}:`,F instanceof Error?F.message:F),null}}))).filter((G)=>G!==null)}var DA0=3300000,Bx4=4,Ox4=250,Dx4=2000,JE$=45000,GE$=1500,wx4=5,KE$=20,Px4,P41;var HE$=D(()=>{_0();uZ();Fe();qW0();aK();Be();O41();PJ();OW();B8();cB();Px4=["origin=$(git remote get-url origin)",'token=$(printf %s "$origin" | sed -n "s|.*://[^:]*:\\([^@]*\\)@.*|\\1|p")','[ -n "$token" ] || exit 0','user=$(printf %s "$origin" | sed -n "s|.*://\\([^:]*\\):.*|\\1|p")','host=$(printf %s "$origin" | sed -n "s|.*@\\([^/]*\\)/.*|\\1|p")','[ -n "$host" ] || exit 0',"umask 077",'if [ "$user" = "oauth2" ]; then','  mkdir -p "${HOME:-/root}/.config/glab-cli"','  printf "hosts:\\n  %s:\\n    token: %s\\n    api_host: %s\\n    api_protocol: https\\n    is_oauth2: true\\n" "$host" "$token" "$host" > "${HOME:-/root}/.config/glab-cli/config.yml"','  chmod 600 "${HOME:-/root}/.config/glab-cli/config.yml"','elif [ "$user" = "x-access-token" ]; then','  mkdir -p "${HOME:-/root}/.config/gh"','  printf "%s:\\n  oauth_token: %s\\n  git_protocol: https\\n" "$host" "$token" > "${HOME:-/root}/.config/gh/hosts.yml"',"fi"];P41=d({name:"TASK_ADD_REPO",description:"Clone one of this organization's repositories into your working directory. "+"Your working directory is EMPTY until you call this \u2014 do not look for "+"files, and do not run git, before it returns. Call it once, with the repository the task is about; it waits for the checkout and returns the repository root listing, so you can start reading files immediately after. `git` and the repository's CLI (`gh` for GitHub, `glab` for GitLab; Bitbucket has "+"no CLI \u2014 its token is the password in `git remote get-url origin`, for `curl` "+"against api.bitbucket.org) are authenticated once it returns. Call TASK_ADD_REPO with no arguments to list the repositories available.",annotations:{title:"Add Repository",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:cG.object({id:cG.string().optional().describe("id of the repository to clone, as returned by the listing. Omit to list the available repositories."),connectionId:cG.string().optional().describe("Deprecated alias for `id`.")}),outputSchema:cG.object({success:cG.boolean(),repositories:cG.array(cG.object({id:cG.string(),repo:cG.string()})).optional(),repo:cG.string().optional(),cloned:cG.boolean().optional(),files:cG.string().optional(),message:cG.string()}),handler:async($,Z)=>{s(Z),await Z.access.check();let Q=K0(Z),Y=p0(Z);if(!Y)throw Error("User ID required");let{threadId:X}=BA0(),J=await iw(Z,Q.id),G=$.id??$.connectionId,W=G?J.find((F0)=>F0.id===G):void 0;if(!W){let F0=J.map((V0)=>({id:V0.id,repo:V0.label}));return{success:!1,repositories:F0,message:G?`No repository for id "${G}". Pick one of the repositories listed.`:F0.length===0?"This organization has no repositories linked, so none can be cloned.":"Pick a repository and call TASK_ADD_REPO again with its id."}}let K=await Z.storage.threads.get(X);if(!K)throw Error(`Thread not found: ${X}`);let H=await kc(Z,{threadId:X,runBranch:K.branch}),F=await Ox(Z,H,Y),U=await AX(Z),N=await Lx4(Z,X,F,H);if(!N)throw Error(`No sandbox is registered for this run (thread ${X}), so there is nowhere to clone into.`);let B=K.metadata?.githubRepo,O=K.metadata?.githubRepos??[],L=B&&B.owner===W.owner&&B.name?.toLowerCase()===W.name.toLowerCase();if(B&&(L||jx4(O,{owner:W.owner,name:W.name})))return{success:!1,repo:`${W.owner}/${W.name}`,cloned:!1,message:L?`${W.label} is already checked out at your working directory.`:`This run already has ${KE$} additional repositories checked out, which is the limit. Work with what's already checked out instead of adding another.`};let{cloneUrl:w,gitUserName:j,gitUserEmail:E}=await Ax4(Z,Q.id,W),z={url:W.webUrl,owner:W.owner,name:W.name,...W.installationId!==void 0?{installationId:W.installationId}:{},...W.connectionId?{connectionId:W.connectionId}:{},...W.repository?{repositoryId:W.repository.id}:{}},T=!B,P=T?[]:await Z.storage.threads.appendThreadGithubRepo(X,z);if(T)await Z.storage.threads.update(X,{metadata:{...K.metadata??{},githubRepo:z},updated_by:Y});let A=RW0({branch:H,derivedRef:sK(H),recordedHeadRef:null,sticky:!1}),q=await Tx4(Z,Q.id,Y),x=await U.proxyDaemonRequest(N.sandboxHandle,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify(Rx4({...T?{primary:{cloneUrl:w,branch:A,repoName:`${W.owner}/${W.name}`}}:{secondaries:await qx4(Z,Q.id,P,q)},submoduleCredentials:q,gitUserName:j,gitUserEmail:E}))});if(!x.ok)throw Error(`the sandbox rejected the repository (${x.status} ${x.statusText})`);await U.proxyDaemonRequest(N.sandboxHandle,"/_sandbox/setup/clone",{method:"POST",headers:new Headers({"content-type":"application/json"}),body:"{}"}).catch((F0)=>{console.warn("[TASK_ADD_REPO] explicit clone kick failed",F0)});let _=T?null:YE$(P,{owner:W.owner,name:W.name}),V=T||!_?".":`"$(dirname "$PWD")/repos/${_}"`,y=Date.now()+JE$,g=!1,l="",n=0,p=null;while(Date.now()<y){let F0=await WE$(U,N.sandboxHandle,X,`cd ${V} 2>/dev/null || exit 1; if [ -n "$(git ls-files 2>/dev/null | head -1)" ]; then echo __CLONED__; fi; ls -A 2>/dev/null`).catch(()=>null);if(!F0){if(++n>=wx4)break;await m$(GE$);continue}n=0;let V0=Ex4(F0.stdout);if(V0.cloned&&V0.listing===p){g=!0,l=V0.listing;break}p=V0.cloned?V0.listing:null,await m$(GE$)}if(g)await WE$(U,N.sandboxHandle,X,zx4(T?null:`../repos/${_}`)).catch((F0)=>console.warn("[TASK_ADD_REPO] CLI auth setup failed",F0));return{success:g,repo:`${W.owner}/${W.name}`,cloned:g,files:l,message:g?T?`${W.label} is checked out at your working directory on branch ${A}. \`git\` and its CLI are authenticated. Start working.`:`${W.label} is checked out at ../repos/${_}, beside your working directory, on its default branch. \`git\` and its CLI are authenticated there too. Your first checkout is untouched \u2014 commit and open a change request in each repository you change.`:`The clone of ${W.owner}/${W.name} did not finish within ${Math.round(JE$/1000)}s. It may still be in progress \u2014 check your working directory before calling this again.`}}})});import{z as _1}from"zod";var Sc=50000,Cc=500,LA0=200,_c=50000,mB,me,Dx,Mx4,Ix4,Vx4,FE$,vc,kx4,Sx4,UE$;var AJ=D(()=>{k4();k4();mB=_1.enum(dK),me=_1.enum(["bug","feature","chore","spike","security"]),Dx=_1.enum(["none","low","medium","high","urgent"]),Mx4=_1.object({threadId:_1.string(),virtualMcpId:_1.string().nullable(),status:_1.enum(["in_progress","requires_action","failed","completed","expired"]).nullable(),title:_1.string().nullable(),lastMessage:_1.string().nullable(),hasPreview:_1.boolean(),failureKind:_1.string().nullable(),hasMessages:_1.boolean(),costUsd:_1.number().nullable(),costProvider:_1.string().nullable(),createdAt:_1.string(),lastActiveAt:_1.string()}),Ix4=_1.object({reviewer:_1.enum(JW),verdict:_1.enum(["approved","changes_requested"]),verified:_1.boolean()}),Vx4=_1.object({id:_1.string(),name:_1.string(),color:_1.string().nullable().describe('Hex color, e.g. "#3b82f6"'),createdBy:_1.string(),createdAt:_1.string().datetime()}),FE$=_1.object({url:_1.string(),number:_1.number(),repoOwner:_1.string(),repoName:_1.string(),createdAt:_1.string(),updatedAt:_1.string().nullable(),title:_1.string().nullable(),body:_1.string().nullable(),state:_1.enum(["open","closed"]).nullable(),draft:_1.boolean().nullable(),merged:_1.boolean().nullable(),mergeable:_1.boolean().nullable(),checksStatus:_1.enum(["pending","passing","failing"]).nullable(),checks:_1.array(_1.object({name:_1.string(),status:_1.string(),conclusion:_1.string().nullable(),detailsUrl:_1.string().nullable(),summary:_1.string().nullable()})),previewUrl:_1.string().nullable()}),vc=_1.object({id:_1.string(),organizationId:_1.string(),title:_1.string(),description:_1.string().nullable(),status:mB,priority:Dx,type:me,assigneeId:_1.string().nullable(),assignedBy:_1.string().nullable(),repo:_1.string().nullable(),repositoryId:_1.string().nullable(),dueDate:_1.string().datetime().nullable(),sortOrder:_1.number(),keySeq:_1.number().nullable(),externalUrl:_1.string().nullable(),previewRoutes:_1.array(_1.string()),source:_1.enum(["jira"]).nullable(),retryAttempts:_1.number(),reviewCycleStartedAt:_1.string().datetime().nullable(),threads:_1.array(Mx4),tags:_1.array(Vx4),reviewVerdicts:_1.array(Ix4),createdBy:_1.string(),createdAt:_1.string().datetime(),updatedBy:_1.string(),updatedAt:_1.string().datetime()}),kx4=["created","status_changed","assignee_changed","priority_changed","due_date_changed","title_changed","description_changed","tags_changed","review_requested","review_approved","review_changes_requested","review_verdict_requested","merge_conflict_resolution","merge_failed","type_changed","duplicate_reported"],Sx4=_1.enum(kx4),UE$=_1.object({id:_1.string(),taskBoardItemId:_1.string(),action:Sx4,actorId:_1.string().nullable(),data:_1.record(_1.string(),_1.unknown()),occurredAt:_1.string().datetime()})});async function wA0($,Z,Q){if(Q===A8)return;let{members:Y}=await $.boundAuth.organization.listMembers({organizationId:Z,filterField:"userId",filterValue:Q});if(!Y.some((X)=>X.userId===Q))throw Error("assigneeId is not a member of the organization")}var A41=D(()=>{AJ()});function OE$($){let Z={};for(let[Q,Y]of Object.entries($)){if(Q.startsWith(Cx4))continue;Z[Q]=Y}return Z}function jA0($){return{taskBoardItemId:$.id,...LY($)&&{[NE$]:BE$}}}function _x4($){return $?.[NE$]===BE$}function vx4($){if(/[:\s]/.test($))throw Error("organization id unsuitable for the subsidy key scheme");return`subsidy:${$}`}async function bx4($,Z){let Q=E0();try{let Y=await $.storage.subsidizedGatewayKeys.get(Z);if(Y)return Y;let X=$.auth?.user?.id;if(X&&Q.aiGatewayEnabled&&Q.studioProvisionSecretKey&&_L.provisionKey){let J=await HQ(X,$.auth?.user?.email),G=await _L.provisionKey(J,vx4(Z));return await $.storage.subsidizedGatewayKeys.put(Z,G),G}}catch(Y){console.error("[subsidized-runs] subsidy key unavailable \u2014 run stays on the org's key:",Y)}return}async function DE$($,Z,Q){if(!E0().taskQuotaEnforced)return;if(!_x4(Q))return;let Y=Q?.taskBoardItemId;if(!Y)return;let X=await $.storage.taskBoard.getById(Y,Z);if(!X||!LY(X))return;if(!await yH$($,Y))return;return await bx4($,Z)}function LE$($,Z){if(!Z)return $;if($.providerId!=="deco")return $;return{...$,apiKey:Z}}var Cx4="srv.",NE$="srv.billing",BE$="subscription";var de=D(()=>{cu();QK();U$();GW()});function ie($){let Z=$?.runClass;return Z&&Z in T41?T41[Z]:T41.interactive}var T41,bc="runClass";var xc=D(()=>{T41={interactive:10,reviewer:20,retry:30,new_task:40}});async function EA0($,Z,Q){let Y;try{return await Promise.race([$.aiProviders.listModels(Z,Q),new Promise((J,G)=>{Y=setTimeout(()=>G(Error("listModels timeout")),xx4)})])}finally{if(Y)clearTimeout(Y)}}function fx4($,Z){switch($){case"fast":return Z.chat.fast;case"smart":return Z.chat.smart;case"thinking":return Z.chat.thinking;case"image":return Z.image;case"web_search":return Z.webSearch;case"deep_research":return Z.deepResearch}}function zA0($,Z,Q){let Y=$.find((X)=>X.modelId===Z);return{title:Y?.title??Q??Z,providerId:Y?.providerId,capabilities:Y?.capabilities,limits:Y?.limits??null}}async function z6($,Z,Q){let Y=$.organization?.id;if(!Y)throw Error("resolveTier called without an organization");let J=(await $.storage.organizationSettings.get(Y))?.simple_mode?.tiers?.[Z]??null,G=$.auth?.user?.id,W=Ew.safeParse(Z),K=Q?.applyUserPrefs&&W.success&&G?(await $.storage.userModelPreferences.get(G,Y))?.tiers?.[W.data]??null:null,H=(await $.storage.aiProviderKeys.list({organizationId:Y})).filter((w)=>zz(w.providerId)),F=await cG$($,Y,Z),U=F?H.find((w)=>w.providerId==="deco"):void 0;if(F&&U){let w=await EA0($,U.id,Y).catch(()=>[]);return{credentialId:U.id,modelId:F,modelMeta:zA0(w,F)}}for(let w of[K,J])if(w&&H.some((j)=>j.id===w.keyId)){let j=await EA0($,w.keyId,Y).catch(()=>[]);return{credentialId:w.keyId,modelId:w.modelId,modelMeta:zA0(j,w.modelId,w.title)}}if(H.length===0)throw new fc(Z);let N={};await Promise.all(H.map(async(w)=>{N[w.id]=await EA0($,w.id,Y).catch(()=>[])}));let B=H.map((w)=>({id:w.id,providerId:w.providerId,label:w.label,presetId:w.presetId,createdBy:w.createdBy,createdAt:w.createdAt})),O=wm1(B,N),L=fx4(Z,O);if(!L)throw new fc(Z);return{credentialId:L.keyId,modelId:L.modelId,modelMeta:zA0(N[L.keyId]??[],L.modelId,L.title)}}async function wE$($,Z,Q){let Y=$.organization?.id;if(!Y)throw Error("resolveSpecificModel called without an organization");let X=await $.storage.aiProviderKeys.findById(Z,Y).catch((G)=>{if(G instanceof Error&&G.message==="Provider key not found")throw new pe(`AI provider credential "${Z}" was not found`,{cause:G});throw G});if(!zz(X.providerId))throw new pe(`AI provider credential "${Z}" uses native-only provider "${X.providerId}" and cannot run a hosted model`);let J=await EA0($,Z,Y).catch(()=>[]);return{credentialId:Z,modelId:Q,modelMeta:zA0(J,Q)}}async function AY($,Z){try{return await z6($,Z)}catch(Q){if(Q instanceof fc)return null;return console.warn(`[resolveTier] tier "${Z}" resolution failed:`,Q),null}}var fc,pe,xx4=5000;var TY=D(()=>{vF();AZ();a8();fc=class fc extends Error{tier;constructor($){super(`No model available for tier "${$}". Connect a provider or configure the tier in organization settings.`);this.tier=$;this.name="TierUnavailableError"}};pe=class pe extends Error{constructor($,Z){super($,Z);this.name="SpecificModelCredentialUnavailableError"}}});function jE$($){return $ instanceof eK||typeof $==="object"&&$!==null&&$.permanent===!0}var eK;var R41=D(()=>{eK=class eK extends Error{permanent=!0;code;constructor($,Z){super(Z);this.name="PermanentRunError",this.code=$}}});function zE$($){if($==="reviewer")return"reviewer";if($==="conflict")return"conflict";return"default"}function AE$($,Z="default"){let{providerId:Q,apiKey:Y,baseUrl:X}=$,J=gx4[Z],G={CLAUDE_CODE_MAX_OUTPUT_TOKENS:`${yx4}`,CLAUDE_CODE_MAX_TURNS:J===null?null:`${J}`,ENABLE_TOOL_SEARCH:hx4};if(Q==="anthropic")return{...G,CLAUDE_CODE_MODEL:q41.anthropic[Z],ANTHROPIC_API_KEY:Y,ANTHROPIC_AUTH_TOKEN:null,CLAUDE_CODE_OAUTH_TOKEN:null,ANTHROPIC_BASE_URL:X??null};if(Q==="claude-subscription")return{...G,CLAUDE_CODE_MODEL:q41.anthropic[Z],CLAUDE_CODE_OAUTH_TOKEN:Y,ANTHROPIC_API_KEY:null,ANTHROPIC_AUTH_TOKEN:null,ANTHROPIC_BASE_URL:null};if(Q==="openrouter"||Q==="deco")return{...G,CLAUDE_CODE_MODEL:q41.openrouter[Z],ANTHROPIC_API_KEY:"",ANTHROPIC_AUTH_TOKEN:Y,CLAUDE_CODE_OAUTH_TOKEN:null,ANTHROPIC_BASE_URL:X??"https://openrouter.ai/api"};throw new PE$(Q)}var EE$="claude-subscription",q41,PA0="claudeCodeModelClass",yx4=32000,gx4,hx4="1",PE$;var AA0=D(()=>{q41={anthropic:{default:"claude-opus-5",reviewer:"claude-sonnet-5",conflict:"claude-sonnet-5"},openrouter:{default:"anthropic/claude-opus-5",reviewer:"anthropic/claude-sonnet-5",conflict:"anthropic/claude-sonnet-5"}};gx4={default:null,reviewer:60,conflict:60};PE$=class PE$ extends Error{constructor($){super(`the claude-code harness needs an Anthropic, OpenRouter or Deco model credential; this run's model resolves to "${$}". Point the agent's thinking model at one of those, or run it with Decopilot.`);this.name="UnsupportedClaudeCodeProviderError"}}});import{z as Y$}from"zod";var TE$,ux4,ne,lx4,cx4,vXZ;var RE$=D(()=>{TE$=Y$.object({chunks:Y$.array(Y$.unknown()),done:Y$.boolean().nullish().transform(($)=>$??!1),error:Y$.object({code:Y$.string(),message:Y$.string()}).nullish().transform(($)=>$??null)}),ux4=Y$.record(Y$.string(),Y$.unknown()),ne=Y$.object({id:Y$.string(),title:Y$.string().optional(),provider:Y$.string().nullable().optional(),credentialId:Y$.string(),limits:Y$.object({contextWindow:Y$.number().int().positive().optional(),maxOutputTokens:Y$.number().int().positive().optional()}).optional(),capabilities:Y$.object({vision:Y$.boolean().optional(),text:Y$.boolean().optional(),reasoning:Y$.boolean().optional()}).optional()}).strict(),lx4=Y$.object({thinking:ne.extend({title:Y$.string()}),fast:ne.optional(),smart:ne.optional(),image:ne.optional(),deepResearch:ne.optional()}).strict(),cx4=Y$.discriminatedUnion("cwd",[Y$.object({cwd:Y$.literal("/repo"),repo:Y$.object({owner:Y$.string(),name:Y$.string(),connectedGithub:Y$.boolean()}).strict().optional(),branch:Y$.string().nullable()}).strict(),Y$.object({cwd:Y$.null()}).strict()]),vXZ=Y$.object({threadId:Y$.string(),userMessage:ux4,harness:Y$.object({sessionId:Y$.string().optional()}).strict(),workspace:cx4,models:lx4,mcp:Y$.object({url:Y$.string().url(),headers:Y$.record(Y$.string(),Y$.string()),expiresAt:Y$.number().int().positive()}).strict(),orgMcps:Y$.array(Y$.object({name:Y$.string(),url:Y$.string().url(),headers:Y$.record(Y$.string(),Y$.string())}).strict()).optional(),mode:Y$.enum(["default","plan","web-search","gen-image"]),temperature:Y$.number(),toolApprovalLevel:Y$.enum(["auto","readonly"]),toolAllowlist:Y$.array(Y$.string()).nullable().optional(),maxAgentSteps:Y$.number().int().optional(),user:Y$.object({id:Y$.string(),email:Y$.string()}).strict(),organizationId:Y$.string(),agent:Y$.object({id:Y$.string(),instructions:Y$.string().optional(),disallowedTools:Y$.array(Y$.string()).optional()}).strict(),currentThreadTitle:Y$.string().optional(),resume:Y$.object({reason:Y$.string()}).strict().optional()}).strict()});var qE$="sandbox_gone",ME$="superseded",TA0="[SANDBOX_UNREACHABLE]";function mx4($){let Z=[$.contentType??"file"];if($.size!=null)Z.push(`${$.size} bytes`);return Z.join(", ")}function dx4($){let Z=($??[]).filter((Y)=>Y.kind!=="skill");if(Z.length===0)return null;return["<knowledge>","The following files are attached to you as reference knowledge. They are mounted in your sandbox at the paths below; read them with your file tools when relevant to the task, and treat them as authoritative reference material.","","Attached files:",Z.map((Y)=>`- ${Y.name} (${mx4(Y)}), read it at \`${rF(Y.volume,Y.path)}\``).join(`
+`)}async function Ax4($,Z,Q){if(Q.repository)return tF($,Q.repository,{bufferMs:DA0});return await Nc({ctx:$,connectionId:Q.connectionId,organizationId:Z,forceRefresh:!0,onLegacyMintError:(Y)=>console.error("[TASK_ADD_REPO] legacy repo-scoped mint failed",{connectionId:Q.connectionId,error:Y.message})}),oF(Q.connectionId,Q.owner,Q.name,$.db,$.vault,{bufferMs:DA0})}async function Tx4($,Z,Q){let Y=await $.storage.organizationSettings.get(Z);return FA0({ctx:$,orgId:Z,userId:Q,entries:Y?.submodule_credentials})}function Rx4($){return{git:{...$.primary?{repository:{...$.primary,submoduleCredentials:$.submoduleCredentials}}:{repositories:$.secondaries??[]},identity:{userName:$.gitUserName,userEmail:$.gitUserEmail}}}}async function qx4($,Z,Q,Y){let X=ce(Q);return(await Promise.all(Q.map(async(G,W)=>{let K=await dw($.storage,Z,G),H=K&&await _B($.storage,K)?K:null;if(!H&&!G.connectionId)return null;try{let{cloneUrl:F}=H?await tF($,H,{bufferMs:DA0}):await oF(G.connectionId,G.owner,G.name,$.db,$.vault,{bufferMs:DA0});return{cloneUrl:F,repoName:X[W],submoduleCredentials:Y}}catch(F){return console.warn(`[TASK_ADD_REPO] skipping secondary ${G.owner}/${G.name}:`,F instanceof Error?F.message:F),null}}))).filter((G)=>G!==null)}var DA0=3300000,Bx4=4,Ox4=250,Dx4=2000,JE$=45000,GE$=1500,wx4=5,KE$=20,Px4,P41;var HE$=D(()=>{_0();uZ();Fe();qW0();aK();Be();O41();PJ();OW();B8();cB();Px4=["origin=$(git remote get-url origin)",'token=$(printf %s "$origin" | sed -n "s|.*://[^:]*:\\([^@]*\\)@.*|\\1|p")','[ -n "$token" ] || exit 0','user=$(printf %s "$origin" | sed -n "s|.*://\\([^:]*\\):.*|\\1|p")','host=$(printf %s "$origin" | sed -n "s|.*@\\([^/]*\\)/.*|\\1|p")','[ -n "$host" ] || exit 0',"umask 077",'if [ "$user" = "oauth2" ]; then','  mkdir -p "${HOME:-/root}/.config/glab-cli"','  printf "hosts:\\n  %s:\\n    token: %s\\n    api_host: %s\\n    api_protocol: https\\n    is_oauth2: true\\n" "$host" "$token" "$host" > "${HOME:-/root}/.config/glab-cli/config.yml"','  chmod 600 "${HOME:-/root}/.config/glab-cli/config.yml"','elif [ "$user" = "x-access-token" ]; then','  mkdir -p "${HOME:-/root}/.config/gh"','  printf "%s:\\n  oauth_token: %s\\n  git_protocol: https\\n" "$host" "$token" > "${HOME:-/root}/.config/gh/hosts.yml"',"fi"];P41=d({name:"TASK_ADD_REPO",description:"Clone one of this organization's repositories into your working directory. "+"Your working directory is EMPTY until you call this \u2014 do not look for "+"files, and do not run git, before it returns. Call it once, with the repository the task is about; it waits for the checkout and returns the repository root listing, so you can start reading files immediately after. `git` and the repository's CLI (`gh` for GitHub, `glab` for GitLab; Bitbucket has "+"no CLI \u2014 its token is the password in `git remote get-url origin`, for `curl` "+"against api.bitbucket.org) are authenticated once it returns. Call TASK_ADD_REPO with no arguments to list the repositories available.",annotations:{title:"Add Repository",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:cG.object({id:cG.string().optional().describe("id of the repository to clone, as returned by the listing. Omit to list the available repositories."),connectionId:cG.string().optional().describe("Deprecated alias for `id`.")}),outputSchema:cG.object({success:cG.boolean(),repositories:cG.array(cG.object({id:cG.string(),repo:cG.string()})).optional(),repo:cG.string().optional(),cloned:cG.boolean().optional(),files:cG.string().optional(),message:cG.string()}),handler:async($,Z)=>{s(Z),await Z.access.check();let Q=K0(Z),Y=p0(Z);if(!Y)throw Error("User ID required");let{threadId:X}=BA0(),J=await iw(Z,Q.id),G=$.id??$.connectionId,W=G?J.find((F0)=>F0.id===G):void 0;if(!W){let F0=J.map((V0)=>({id:V0.id,repo:V0.label}));return{success:!1,repositories:F0,message:G?`No repository for id "${G}". Pick one of the repositories listed.`:F0.length===0?"This organization has no repositories linked, so none can be cloned.":"Pick a repository and call TASK_ADD_REPO again with its id."}}let K=await Z.storage.threads.get(X);if(!K)throw Error(`Thread not found: ${X}`);let H=await kc(Z,{threadId:X,runBranch:K.branch}),F=await Ox(Z,H,Y),U=await AX(Z),N=await Lx4(Z,X,F,H);if(!N)throw Error(`No sandbox is registered for this run (thread ${X}), so there is nowhere to clone into.`);let B=K.metadata?.githubRepo,O=K.metadata?.githubRepos??[],L=B&&B.owner===W.owner&&B.name?.toLowerCase()===W.name.toLowerCase();if(B&&(L||jx4(O,{owner:W.owner,name:W.name})))return{success:!1,repo:`${W.owner}/${W.name}`,cloned:!1,message:L?`${W.label} is already checked out at your working directory.`:`This run already has ${KE$} additional repositories checked out, which is the limit. Work with what's already checked out instead of adding another.`};let{cloneUrl:w,gitUserName:j,gitUserEmail:E}=await Ax4(Z,Q.id,W),z={url:W.webUrl,owner:W.owner,name:W.name,...W.installationId!==void 0?{installationId:W.installationId}:{},...W.connectionId?{connectionId:W.connectionId}:{},...W.repository?{repositoryId:W.repository.id}:{}},T=!B,P=T?[]:await Z.storage.threads.appendThreadGithubRepo(X,z);if(T)await Z.storage.threads.update(X,{metadata:{...K.metadata??{},githubRepo:z},updated_by:Y});let A=RW0({branch:H,derivedRef:sK(H),recordedHeadRef:null,sticky:!1}),q=await Tx4(Z,Q.id,Y),x=await U.proxyDaemonRequest(N.sandboxHandle,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify(Rx4({...T?{primary:{cloneUrl:w,branch:A,repoName:`${W.owner}/${W.name}`}}:{secondaries:await qx4(Z,Q.id,P,q)},submoduleCredentials:q,gitUserName:j,gitUserEmail:E}))});if(!x.ok)throw Error(`the sandbox rejected the repository (${x.status} ${x.statusText})`);await U.proxyDaemonRequest(N.sandboxHandle,"/_sandbox/setup/clone",{method:"POST",headers:new Headers({"content-type":"application/json"}),body:"{}"}).catch((F0)=>{console.warn("[TASK_ADD_REPO] explicit clone kick failed",F0)});let _=T?null:YE$(P,{owner:W.owner,name:W.name}),V=T||!_?".":`"$(dirname "$PWD")/repos/${_}"`,y=Date.now()+JE$,g=!1,l="",n=0,p=null;while(Date.now()<y){let F0=await WE$(U,N.sandboxHandle,X,`cd ${V} 2>/dev/null || exit 1; if [ -n "$(git ls-files 2>/dev/null | head -1)" ]; then echo __CLONED__; fi; ls -A 2>/dev/null`).catch(()=>null);if(!F0){if(++n>=wx4)break;await m$(GE$);continue}n=0;let V0=Ex4(F0.stdout);if(V0.cloned&&V0.listing===p){g=!0,l=V0.listing;break}p=V0.cloned?V0.listing:null,await m$(GE$)}if(g)await WE$(U,N.sandboxHandle,X,zx4(T?null:`../repos/${_}`)).catch((F0)=>console.warn("[TASK_ADD_REPO] CLI auth setup failed",F0));return{success:g,repo:`${W.owner}/${W.name}`,cloned:g,files:l,message:g?T?`${W.label} is checked out at your working directory on branch ${A}. \`git\` and its CLI are authenticated. Start working.`:`${W.label} is checked out at ../repos/${_}, beside your working directory, on its default branch. \`git\` and its CLI are authenticated there too. Your first checkout is untouched \u2014 commit and open a change request in each repository you change.`:`The clone of ${W.owner}/${W.name} did not finish within ${Math.round(JE$/1000)}s. It may still be in progress \u2014 check your working directory before calling this again.`}}})});import{z as _1}from"zod";var Sc=50000,Cc=500,LA0=200,_c=50000,mB,me,Dx,Mx4,Ix4,Vx4,FE$,vc,kx4,Sx4,UE$;var AJ=D(()=>{k4();k4();mB=_1.enum(dK),me=_1.enum(["bug","feature","chore","spike","security"]),Dx=_1.enum(["none","low","medium","high","urgent"]),Mx4=_1.object({threadId:_1.string(),virtualMcpId:_1.string().nullable(),status:_1.enum(["in_progress","requires_action","failed","completed","expired"]).nullable(),title:_1.string().nullable(),lastMessage:_1.string().nullable(),hasPreview:_1.boolean(),failureKind:_1.string().nullable(),hasMessages:_1.boolean(),costUsd:_1.number().nullable(),costProvider:_1.string().nullable(),createdAt:_1.string(),lastActiveAt:_1.string()}),Ix4=_1.object({reviewer:_1.enum(JW),verdict:_1.enum(["approved","changes_requested"]),verified:_1.boolean()}),Vx4=_1.object({id:_1.string(),name:_1.string(),color:_1.string().nullable().describe('Hex color, e.g. "#3b82f6"'),createdBy:_1.string(),createdAt:_1.string().datetime()}),FE$=_1.object({url:_1.string(),number:_1.number(),repoOwner:_1.string(),repoName:_1.string(),createdAt:_1.string(),updatedAt:_1.string().nullable(),title:_1.string().nullable(),body:_1.string().nullable(),state:_1.enum(["open","closed"]).nullable(),draft:_1.boolean().nullable(),merged:_1.boolean().nullable(),mergeable:_1.boolean().nullable(),checksStatus:_1.enum(["pending","passing","failing"]).nullable(),checks:_1.array(_1.object({name:_1.string(),status:_1.string(),conclusion:_1.string().nullable(),detailsUrl:_1.string().nullable(),summary:_1.string().nullable()})),previewUrl:_1.string().nullable()}),vc=_1.object({id:_1.string(),organizationId:_1.string(),title:_1.string(),description:_1.string().nullable(),status:mB,priority:Dx,type:me,assigneeId:_1.string().nullable(),assignedBy:_1.string().nullable(),repo:_1.string().nullable(),repositoryId:_1.string().nullable(),dueDate:_1.string().datetime().nullable(),sortOrder:_1.number(),keySeq:_1.number().nullable(),externalUrl:_1.string().nullable(),previewRoutes:_1.array(_1.string()),source:_1.enum(["jira"]).nullable(),retryAttempts:_1.number(),reviewCycleStartedAt:_1.string().datetime().nullable(),threads:_1.array(Mx4),tags:_1.array(Vx4),reviewVerdicts:_1.array(Ix4),createdBy:_1.string(),createdAt:_1.string().datetime(),updatedBy:_1.string(),updatedAt:_1.string().datetime()}),kx4=["created","status_changed","assignee_changed","priority_changed","due_date_changed","title_changed","description_changed","tags_changed","review_requested","review_approved","review_changes_requested","review_verdict_requested","merge_conflict_resolution","merge_failed","type_changed","duplicate_reported"],Sx4=_1.enum(kx4),UE$=_1.object({id:_1.string(),taskBoardItemId:_1.string(),action:Sx4,actorId:_1.string().nullable(),data:_1.record(_1.string(),_1.unknown()),occurredAt:_1.string().datetime()})});async function wA0($,Z,Q){if(Q===A8)return;let{members:Y}=await $.boundAuth.organization.listMembers({organizationId:Z,filterField:"userId",filterValue:Q});if(!Y.some((X)=>X.userId===Q))throw Error("assigneeId is not a member of the organization")}var A41=D(()=>{AJ()});function OE$($){let Z={};for(let[Q,Y]of Object.entries($)){if(Q.startsWith(Cx4))continue;Z[Q]=Y}return Z}function jA0($){return{taskBoardItemId:$.id,...LY($)&&{[NE$]:BE$}}}function _x4($){return $?.[NE$]===BE$}function vx4($){if(/[:\s]/.test($))throw Error("organization id unsuitable for the subsidy key scheme");return`subsidy:${$}`}async function bx4($,Z){let Q=E0();try{let Y=await $.storage.subsidizedGatewayKeys.get(Z);if(Y)return Y;let X=$.auth?.user?.id;if(X&&Q.aiGatewayEnabled&&Q.studioProvisionSecretKey&&_L.provisionKey){let J=await HQ(X,$.auth?.user?.email),G=await _L.provisionKey(J,vx4(Z));return await $.storage.subsidizedGatewayKeys.put(Z,G),G}}catch(Y){console.error("[subsidized-runs] subsidy key unavailable \u2014 run stays on the org's key:",Y)}return}async function DE$($,Z,Q){if(!E0().taskQuotaEnforced)return;if(!_x4(Q))return;let Y=Q?.taskBoardItemId;if(!Y)return;let X=await $.storage.taskBoard.getById(Y,Z);if(!X||!LY(X))return;if(!await yH$($,Y))return;return await bx4($,Z)}function LE$($,Z){if(!Z)return $;if($.providerId!=="deco")return $;return{...$,apiKey:Z}}var Cx4="srv.",NE$="srv.billing",BE$="subscription";var de=D(()=>{cu();QK();U$();GW()});function ie($){let Z=$?.runClass;return Z&&Z in T41?T41[Z]:T41.interactive}var T41,bc="runClass";var xc=D(()=>{T41={interactive:10,reviewer:20,retry:30,new_task:40}});async function EA0($,Z,Q){let Y;try{return await Promise.race([$.aiProviders.listModels(Z,Q),new Promise((J,G)=>{Y=setTimeout(()=>G(Error("listModels timeout")),xx4)})])}finally{if(Y)clearTimeout(Y)}}function fx4($,Z){switch($){case"fast":return Z.chat.fast;case"smart":return Z.chat.smart;case"thinking":return Z.chat.thinking;case"image":return Z.image;case"web_search":return Z.webSearch;case"deep_research":return Z.deepResearch}}function zA0($,Z,Q){let Y=$.find((X)=>X.modelId===Z);return{title:Y?.title??Q??Z,providerId:Y?.providerId,capabilities:Y?.capabilities,limits:Y?.limits??null}}async function z6($,Z,Q){let Y=$.organization?.id;if(!Y)throw Error("resolveTier called without an organization");let J=(await $.storage.organizationSettings.get(Y))?.simple_mode?.tiers?.[Z]??null,G=$.auth?.user?.id,W=Ew.safeParse(Z),K=Q?.applyUserPrefs&&W.success&&G?(await $.storage.userModelPreferences.get(G,Y))?.tiers?.[W.data]??null:null,H=(await $.storage.aiProviderKeys.list({organizationId:Y})).filter((w)=>zz(w.providerId)),F=await cG$($,Y,Z),U=F?H.find((w)=>w.providerId==="deco"):void 0;if(F&&U){let w=await EA0($,U.id,Y).catch(()=>[]);return{credentialId:U.id,modelId:F,modelMeta:zA0(w,F)}}for(let w of[K,J])if(w&&H.some((j)=>j.id===w.keyId)){let j=await EA0($,w.keyId,Y).catch(()=>[]);return{credentialId:w.keyId,modelId:w.modelId,modelMeta:zA0(j,w.modelId,w.title)}}if(H.length===0)throw new fc(Z);let N={};await Promise.all(H.map(async(w)=>{N[w.id]=await EA0($,w.id,Y).catch(()=>[])}));let B=H.map((w)=>({id:w.id,providerId:w.providerId,label:w.label,presetId:w.presetId,createdBy:w.createdBy,createdAt:w.createdAt})),O=wm1(B,N),L=fx4(Z,O);if(!L)throw new fc(Z);return{credentialId:L.keyId,modelId:L.modelId,modelMeta:zA0(N[L.keyId]??[],L.modelId,L.title)}}async function wE$($,Z,Q){let Y=$.organization?.id;if(!Y)throw Error("resolveSpecificModel called without an organization");let X=await $.storage.aiProviderKeys.findById(Z,Y).catch((G)=>{if(G instanceof Error&&G.message==="Provider key not found")throw new pe(`AI provider credential "${Z}" was not found`,{cause:G});throw G});if(!zz(X.providerId))throw new pe(`AI provider credential "${Z}" uses native-only provider "${X.providerId}" and cannot run a hosted model`);let J=await EA0($,Z,Y).catch(()=>[]);return{credentialId:Z,modelId:Q,modelMeta:zA0(J,Q)}}async function AY($,Z){try{return await z6($,Z)}catch(Q){if(Q instanceof fc)return null;return console.warn(`[resolveTier] tier "${Z}" resolution failed:`,Q),null}}var fc,pe,xx4=5000;var TY=D(()=>{vF();AZ();a8();fc=class fc extends Error{tier;constructor($){super(`No model available for tier "${$}". Connect a provider or configure the tier in organization settings.`);this.tier=$;this.name="TierUnavailableError"}};pe=class pe extends Error{constructor($,Z){super($,Z);this.name="SpecificModelCredentialUnavailableError"}}});function jE$($){return $ instanceof eK||typeof $==="object"&&$!==null&&$.permanent===!0}var eK;var R41=D(()=>{eK=class eK extends Error{permanent=!0;code;constructor($,Z){super(Z);this.name="PermanentRunError",this.code=$}}});function zE$($){if($==="reviewer")return"reviewer";if($==="conflict")return"conflict";return"default"}function AE$($,Z="default"){let{providerId:Q,apiKey:Y,baseUrl:X}=$,J=gx4[Z],G={CLAUDE_CODE_MAX_OUTPUT_TOKENS:`${yx4}`,CLAUDE_CODE_MAX_TURNS:J===null?null:`${J}`,ENABLE_TOOL_SEARCH:hx4};if(Q==="anthropic")return{...G,CLAUDE_CODE_MODEL:q41.anthropic[Z],ANTHROPIC_API_KEY:Y,ANTHROPIC_AUTH_TOKEN:null,CLAUDE_CODE_OAUTH_TOKEN:null,ANTHROPIC_BASE_URL:X??null};if(Q==="claude-subscription")return{...G,CLAUDE_CODE_MODEL:q41.anthropic[Z],CLAUDE_CODE_OAUTH_TOKEN:Y,ANTHROPIC_API_KEY:null,ANTHROPIC_AUTH_TOKEN:null,ANTHROPIC_BASE_URL:null};if(Q==="openrouter"||Q==="deco")return{...G,CLAUDE_CODE_MODEL:q41.openrouter[Z],ANTHROPIC_API_KEY:"",ANTHROPIC_AUTH_TOKEN:Y,CLAUDE_CODE_OAUTH_TOKEN:null,ANTHROPIC_BASE_URL:X??"https://openrouter.ai/api"};throw new PE$(Q)}var EE$="claude-subscription",q41,PA0="claudeCodeModelClass",yx4=32000,gx4,hx4="1",PE$;var AA0=D(()=>{q41={anthropic:{default:"claude-opus-5-5",reviewer:"claude-sonnet-5",conflict:"claude-sonnet-5"},openrouter:{default:"anthropic/claude-opus-5.5",reviewer:"anthropic/claude-sonnet-5",conflict:"anthropic/claude-sonnet-5"}};gx4={default:null,reviewer:60,conflict:60};PE$=class PE$ extends Error{constructor($){super(`the claude-code harness needs an Anthropic, OpenRouter or Deco model credential; this run's model resolves to "${$}". Point the agent's thinking model at one of those, or run it with Decopilot.`);this.name="UnsupportedClaudeCodeProviderError"}}});import{z as Y$}from"zod";var TE$,ux4,ne,lx4,cx4,vXZ;var RE$=D(()=>{TE$=Y$.object({chunks:Y$.array(Y$.unknown()),done:Y$.boolean().nullish().transform(($)=>$??!1),error:Y$.object({code:Y$.string(),message:Y$.string()}).nullish().transform(($)=>$??null)}),ux4=Y$.record(Y$.string(),Y$.unknown()),ne=Y$.object({id:Y$.string(),title:Y$.string().optional(),provider:Y$.string().nullable().optional(),credentialId:Y$.string(),limits:Y$.object({contextWindow:Y$.number().int().positive().optional(),maxOutputTokens:Y$.number().int().positive().optional()}).optional(),capabilities:Y$.object({vision:Y$.boolean().optional(),text:Y$.boolean().optional(),reasoning:Y$.boolean().optional()}).optional()}).strict(),lx4=Y$.object({thinking:ne.extend({title:Y$.string()}),fast:ne.optional(),smart:ne.optional(),image:ne.optional(),deepResearch:ne.optional()}).strict(),cx4=Y$.discriminatedUnion("cwd",[Y$.object({cwd:Y$.literal("/repo"),repo:Y$.object({owner:Y$.string(),name:Y$.string(),connectedGithub:Y$.boolean()}).strict().optional(),branch:Y$.string().nullable()}).strict(),Y$.object({cwd:Y$.null()}).strict()]),vXZ=Y$.object({threadId:Y$.string(),userMessage:ux4,harness:Y$.object({sessionId:Y$.string().optional()}).strict(),workspace:cx4,models:lx4,mcp:Y$.object({url:Y$.string().url(),headers:Y$.record(Y$.string(),Y$.string()),expiresAt:Y$.number().int().positive()}).strict(),orgMcps:Y$.array(Y$.object({name:Y$.string(),url:Y$.string().url(),headers:Y$.record(Y$.string(),Y$.string())}).strict()).optional(),mode:Y$.enum(["default","plan","web-search","gen-image"]),temperature:Y$.number(),toolApprovalLevel:Y$.enum(["auto","readonly"]),toolAllowlist:Y$.array(Y$.string()).nullable().optional(),maxAgentSteps:Y$.number().int().optional(),user:Y$.object({id:Y$.string(),email:Y$.string()}).strict(),organizationId:Y$.string(),agent:Y$.object({id:Y$.string(),instructions:Y$.string().optional(),disallowedTools:Y$.array(Y$.string()).optional()}).strict(),currentThreadTitle:Y$.string().optional(),resume:Y$.object({reason:Y$.string()}).strict().optional()}).strict()});var qE$="sandbox_gone",ME$="superseded",TA0="[SANDBOX_UNREACHABLE]";function mx4($){let Z=[$.contentType??"file"];if($.size!=null)Z.push(`${$.size} bytes`);return Z.join(", ")}function dx4($){let Z=($??[]).filter((Y)=>Y.kind!=="skill");if(Z.length===0)return null;return["<knowledge>","The following files are attached to you as reference knowledge. They are mounted in your sandbox at the paths below; read them with your file tools when relevant to the task, and treat them as authoritative reference material.","","Attached files:",Z.map((Y)=>`- ${Y.name} (${mx4(Y)}), read it at \`${rF(Y.volume,Y.path)}\``).join(`
 `),"</knowledge>"].join(`
 `)}function IE$($,Z){let Q=dx4(Z);if(!Q)return $;return $?`${$}
 
@@ -3517,7 +3517,7 @@ Respond with ONLY a JSON object of this shape, and nothing else:
 ${J.join(`
 `)}`:X}function Rg6($){let Z=new Set;for(let Q of $)for(let Y of Q.split(`
 `)){let X=Y.trim();if(/^Co-authored-by:\s/i.test(X))Z.add(X)}return[...Z]}var y88=200,Og6=12,Lg6,jg6=300,Ck0=3;var VF1=D(()=>{uZ();B8();Sk0();Lg6={aheadBy:0,behindBy:0,files:[]}});function Mg6($){if(!$||$.includes(".."))return!1;return qg6.test($)}function h88($){return Ig6.includes($)}function kF1($){let Z=typeof $.__resolveType==="string"?$.__resolveType:null;if(!Z||!Mg6(Z))return null;let{__resolveType:Q,...Y}=$;return{resolveType:Z,payload:Y}}function SF1($,Z){return`${$.replace(/\/+$/,"")}/deco/invoke/${Z}`}var qg6,Ig6;var u88=D(()=>{qg6=/^[\w./@-]+$/;Ig6=["vtex/loaders/intelligentSearch/productList.ts","vtex/loaders/categories/tree.ts"]});function m80($,Z){let Q=$?.githubRepo;if(!Q?.owner||!Q?.name)return null;if(!Q.connectionId)return Q;if(!Z.includes(Q.connectionId))return null;return Q}async function c88($,Z,Q,Y){let X=$.organization?.id;if(!X)throw new JE(O7);let J=await dw($.storage,X,Y);if(J&&await _B($.storage,J)){let F=await tF($,J,{forceRefresh:!0}).catch((U)=>{throw new JE(U instanceof Error?U.message:O7)});await l88($,Z,Q,F);return}let G=Y.connectionId??J?.legacyConnectionId;if(!G)throw new JE("Push requires a connected git account. Connect the repository's provider for this project and restart the sandbox.");await Nc({ctx:$,connectionId:G,organizationId:X,forceRefresh:!0,onLegacyMintError:(F)=>{let U=F instanceof Error?F.message:O7;throw new JE(U)}});let{cloneUrl:W,gitUserName:K,gitUserEmail:H}=await oF(G,Y.owner,Y.name,$.db,$.vault).catch((F)=>{let{code:U,message:N}=zU$(F instanceof Error?F.message:String(F));throw U?new JE(N):F});await l88($,Z,Q,{cloneUrl:W,gitUserName:K,gitUserEmail:H})}async function l88($,Z,Q,Y){let{cloneUrl:X,gitUserName:J,gitUserEmail:G}=Y,W=Gi($),K=await Z.proxyDaemonRequest(Q,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({git:{repository:{cloneUrl:X},identity:{userName:J,userEmail:G}},...W?{operator:W}:{}})});if(!K.ok){let H=await Bj(K,Vg6).catch(()=>K.statusText);throw Error(`Failed to refresh sandbox git credentials (${K.status}): ${H}`)}}var Vg6=10485760,JE;var CF1=D(()=>{QW();Pk0();E00();IW0();Be();uZ();JE=class JE extends Error{constructor($){super($);this.name="GitPushAuthError"}}});function Sg6($){let Z=$.startsWith("thread:")?$.slice(7):$;if(!Z||Z.length>255||Z.includes("..")||Z.startsWith("/")||Z.endsWith("/")||Z.endsWith(".lock")||!kg6.test(Z))throw Error(`Invalid branch name: ${$}`)}function $y($){return AbortSignal.any([$.req.raw.signal,AbortSignal.timeout(Cg6)])}async function vg6($,Z){let Q=$.var.studioContext,Y=YU(Z.branch),X=$.req.query("thread")??Y,J=X&&X===Y?Z.branchThread:X?await Q.storage.threads.get(X).catch(()=>null):null,G=J?.virtual_mcp_id===Z.virtualMcpId?J:null,W=Ax(G?.metadata?.runtime);if(W)return W;let K=L20(Z.virtualMcpMetadata),H=K==="cms"?await KF1(Q,{claimName:Z.claimName}):"alive",F=K==="cms"&&H!=="alive"?"cms":"sandbox",U=!!G&&(H==="gone"||H==="alive"&&K==="cms");if(U&&G)z00(Q,G.id,F);if(K==="cms")console.log("sandbox proxy: no runtime stamp",{route:$.req.path,method:$.req.method,reason:G?"unstamped":"threadless",liveness:H,resolved:F,stamped:U});return F}async function bg6($){let Z=$.get("vmClaim");if(Z.runner)return Z.runner;try{return await AX($.var.studioContext)}catch{return null}}function Zy($){let{runner:Z}=$.get("vmClaim");if(!Z)return $.json({error:"No sandbox runner configured"},503);return Z}async function Ui($){let{virtualMcpMetadata:Z,connectionIds:Q}=$.get("vmClaim"),Y=$.var.studioContext,X=m80(Z,Q);if(!X)throw new y0({provider:"github",status:404,message:"Project has no GitHub repository"});let J=K0(Y);return Hc(Y,J.id,X)}function vF1($,Z){let Q=Z instanceof Error?Z.message:String(Z),Y=lH$(Z);if(Y!==void 0)return $.json({error:Q},429,{...a5,...Y===null?{}:{"Retry-After":String(Math.ceil(Y/1000))}});if(Z instanceof m6)return $.json({error:Q},409,a5);let X=WW(Z);if(X!==null){let J=X===404?404:X===409||X===422?409:502;return $.json({error:Q},J,a5)}return $.json({error:Q},502,a5)}async function _F1($,Z,Q){let Y;try{Y=await fetch(Z,Q)}catch{return $.json({error:"Preview unreachable"},502)}let X;try{X=await Y.text()}catch{return $.json({error:"Preview unreachable"},502)}return new Response(X,{status:Y.status,headers:{"content-type":Y.headers.get("content-type")??"application/json"}})}async function p88($){try{let Z=await Ui($),Q=await _k0(Z,$.get("vmClaim").branch);return $.json(Q,200,a5)}catch(Z){return vF1($,Z)}}function d80($,Z){let Y=(xk0.get($)??Promise.resolve()).catch(()=>{}).then(Z),X=Y.catch(()=>{});return xk0.set($,X),X.finally(()=>{if(xk0.get($)===X)xk0.delete($)}),Y}async function a7($,Z,Q){if(!Q?.runner&&$.get("vmClaim").runtime==="cms")return $.json({error:"sandbox not found: this session is sandbox-less"},404,a5);let Y=Q?.runner??Zy($);if(Y instanceof Response)return Y;let{claimName:X,userId:J,projectRef:G}=$.get("vmClaim"),W=Q?.method??"POST",K=null,H=new Headers;if(Q?.jsonBody!==void 0)K=Q.jsonBody,H.set("content-type","application/json");else if(Q?.forwardJsonBody)K=await $.req.text(),H.set("content-type","application/json");let F=Q?.signal,U={method:W,headers:H,body:K,...F?{signal:F}:{}},N=async()=>{let B=await Y.proxyDaemonRequest(X,Z,U);if(Q?.map404to410&&B.status===404){try{await B.body?.cancel()}catch{}if(await Y.adoptLiveClaim({userId:J,projectRef:G},X))B=await Y.proxyDaemonRequest(X,Z,U);if(B.status===404){try{await B.body?.cancel()}catch{}return new Response(JSON.stringify({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."}),{status:410,headers:{"content-type":"application/json",...a5}})}}let O=await B.text(),L=Q?.redactRepoDir?xg6(O):O,w=B.headers.get("content-type")??"application/json";return new Response(L,{status:B.status,headers:{"content-type":w,...a5}})};try{if(F){let B=N();return B.catch(()=>{}),await Promise.race([B,new Promise((L,w)=>{if(F.aborted)return w(F.reason);F.addEventListener("abort",()=>w(F.reason),{once:!0})})])}return await N()}catch(B){let O=B instanceof Error?B.message:String(B);return $.json({error:`Daemon unreachable: ${O}`},502)}}function xg6($){try{let Z=JSON.parse($);if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&"repoDir"in Z)return JSON.stringify({...Z,repoDir:null})}catch{}return $}async function fk0($,Z,Q,Y="GET",X){let J=await $.proxyDaemonRequest(Z,Q,{method:Y,headers:new Headers,body:null});if(J.status===404&&X){try{await J.body?.cancel()}catch{}if(await $.adoptLiveClaim(X,Z))J=await $.proxyDaemonRequest(Z,Q,{method:Y,headers:new Headers,body:null})}if(J.status===404){try{await J.body?.cancel()}catch{}throw Error("SANDBOX_GONE")}let G=await J.text();if(!J.ok){let W=`Daemon error (${J.status})`;try{W=JSON.parse(G).error??W}catch{}throw Error(W)}return JSON.parse(G)}function fg6($){return n88.includes($)}var kg6,m88=524288,d88=65536,Cg6=1e4,i88=2000,_g6,xk0,a5,n88,t88=()=>{let $=new Y1;$.use("/:virtualMcpId/:branch/*",_g6),$.post("/:virtualMcpId/:branch/write",(Q)=>a7(Q,"/_sandbox/write",{forwardJsonBody:!0,signal:$y(Q)})),$.post("/:virtualMcpId/:branch/unlink",(Q)=>a7(Q,"/_sandbox/unlink",{forwardJsonBody:!0,signal:$y(Q)})),$.post("/:virtualMcpId/:branch/mkdir",(Q)=>a7(Q,"/_sandbox/mkdir",{forwardJsonBody:!0,signal:$y(Q)})),$.post("/:virtualMcpId/:branch/rename",(Q)=>a7(Q,"/_sandbox/rename",{forwardJsonBody:!0,signal:$y(Q)})),$.post("/:virtualMcpId/:branch/read",(Q)=>a7(Q,"/_sandbox/read",{forwardJsonBody:!0,signal:$y(Q)})),$.post("/:virtualMcpId/:branch/glob",(Q)=>a7(Q,"/_sandbox/glob",{forwardJsonBody:!0,signal:$y(Q)})),$.post("/:virtualMcpId/:branch/grep",(Q)=>a7(Q,"/_sandbox/grep",{forwardJsonBody:!0,signal:$y(Q)})),$.post("/:virtualMcpId/:branch/exec/:script",async(Q)=>{let Y=Q.req.param("script");if(!Y)return Q.json({error:"missing script name"},400);return a7(Q,`/_sandbox/exec/${encodeURIComponent(Y)}`)}),$.post("/:virtualMcpId/:branch/exec/:script/kill",async(Q)=>{let Y=Q.req.param("script");if(!Y)return Q.json({error:"missing script name"},400);return a7(Q,`/_sandbox/exec/${encodeURIComponent(Y)}/kill`)}),$.get("/:virtualMcpId/:branch/config",(Q)=>a7(Q,"/_sandbox/config",{method:"GET",map404to410:!0,redactRepoDir:!0})),$.put("/:virtualMcpId/:branch/config",(Q)=>a7(Q,"/_sandbox/config",{method:"PUT",forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/setup/:step",async(Q)=>{let Y=Q.req.param("step");if(!Y||!fg6(Y))return Q.json({error:`step must be one of: ${n88.join(", ")}`},400);let X=Q.get("vmClaim"),J=await KF1(Q.var.studioContext,{claimName:X.claimName})==="gone"?null:await bg6(Q);if(!J)return Q.json({error:"sandbox not found: nothing is running at this ref"},404,a5);if(Y==="start"){let G=K0(Q.var.studioContext),W=pc(X.virtualMcpMetadata);try{await N20({ctx:Q.var.studioContext,runner:J,handle:X.claimName,orgId:G.id,userId:X.callerUserId,entries:W})}catch(K){let H=K instanceof Error?K.message:String(K);return Q.json({error:`Failed to push env to daemon: ${H}`},502)}}return a7(Q,`/_sandbox/setup/${Y}`,{signal:Q.req.raw.signal,map404to410:!0,runner:J})}),$.get("/:virtualMcpId/:branch/events",(Q)=>{let Y=Q.get("vmClaim");if(!Y.runner)return RO(Q,async(X)=>{await X.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:"No sandbox runner configured on this studio instance."})})});return t$8(Q,{ctx:Q.var.studioContext,claimName:Y.claimName,runner:Y.runner,virtualMcpId:Y.virtualMcpId,branch:Y.branch,userId:Y.userId,projectRef:Y.projectRef,virtualMcpMetadata:Y.virtualMcpMetadata})}),$.get("/:virtualMcpId/:branch/git/status",(Q)=>{if(Q.get("vmClaim").runtime==="cms")return p88(Q);return Z(Q)});let Z=(Q)=>a7(Q,"/_sandbox/git/status",{method:"GET",map404to410:!0,signal:AbortSignal.any([Q.req.raw.signal,AbortSignal.timeout(i88)])});return $.post("/:virtualMcpId/:branch/git/status",(Q)=>{if(Q.get("vmClaim").runtime==="cms")return p88(Q);return a7(Q,"/_sandbox/git/status",{map404to410:!0,signal:AbortSignal.any([Q.req.raw.signal,AbortSignal.timeout(i88)])})}),$.post("/:virtualMcpId/:branch/git/diff",async(Q)=>{let Y=Q.get("vmClaim");if(Y.runtime==="cms")try{let X=await Q.req.json().catch(()=>({})),J=await Ui(Q),G=await vk0(J,Y.branch,X.base);return Q.json(G,200,a5)}catch(X){return vF1(Q,X)}return a7(Q,"/_sandbox/git/diff",{forwardJsonBody:!0,map404to410:!0})}),$.post("/:virtualMcpId/:branch/git/publish",async(Q)=>{if(Q.get("vmClaim").runtime==="cms")return Q.json({ok:!0},200,a5);let Y=Zy(Q);if(Y instanceof Response)return Y;let{claimName:X,virtualMcpMetadata:J,connectionIds:G}=Q.get("vmClaim"),W=Q.var.studioContext;return d80(X,async()=>{try{await HF1(W,Y,X);let K=m80(J,G);if(K)await c88(W,Y,X,K)}catch(K){if(K instanceof JE)return Q.json({error:K.message},403,a5);let H=K instanceof Error?K.message:String(K);return Q.json({error:H},502,a5)}return a7(Q,"/_sandbox/git/publish",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/discard",async(Q)=>{let Y=Q.get("vmClaim");if(Y.runtime==="cms")return d80(Y.claimName,async()=>{let X=await Q.req.json().catch(()=>({})),J=Array.isArray(X.filepaths)?X.filepaths.filter((G)=>typeof G==="string"):[];if(J.length===0)return Q.json({error:"filepaths is required"},400,a5);try{let G=await Ui(Q);return await g88(G,Y.branch,J),Q.json({ok:!0},200,a5)}catch(G){let W=WW(G)===409||G instanceof m6?409:502,K=G instanceof Error?G.message:String(G);return Q.json({error:K},W,a5)}});return d80(Y.claimName,()=>a7(Q,"/_sandbox/git/discard",{forwardJsonBody:!0,map404to410:!0}))}),$.post("/:virtualMcpId/:branch/git/rebase",async(Q)=>{let Y=Q.get("vmClaim");if(Y.runtime==="cms")return d80(Y.claimName,async()=>{try{let W=await Q.req.json().catch(()=>({})),K=await Ui(Q),H=W.base??await K.getDefaultBranch();return await bk0(K,Y.branch,H),Q.json({ok:!0},200,a5)}catch(W){return vF1(Q,W)}});let X=Zy(Q);if(X instanceof Response)return X;let{claimName:J}=Q.get("vmClaim"),G=Q.var.studioContext;return d80(J,async()=>{try{await HF1(G,X,J)}catch(W){let K=W instanceof Error?W.message:String(W);return Q.json({error:K},502,a5)}return a7(Q,"/_sandbox/git/rebase",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/suggest-commit",r5({maxSize:m88,onError:(Q)=>Q.json({error:"Payload too large"},413,a5)}),async(Q)=>{let Y=Q.get("vmClaim"),X=null;if(Y.runtime!=="cms"){let H=Zy(Q);if(H instanceof Response)return H;X=H}let{claimName:J,userId:G,projectRef:W}=Y,K=Q.var.studioContext;try{let H=await Q.req.json().catch(()=>({})),F=H.status,U=H.diff,N=U!=null&&typeof U.diffs==="object"&&U.diffs!==null,[B,O]=NF1(F)&&N?[F,U]:X?await Promise.all([fk0(X,J,"/_sandbox/git/status","GET",{userId:G,projectRef:W}),fk0(X,J,"/_sandbox/git/diff","GET",{userId:G,projectRef:W})]):await(async()=>{let w=await Ui(Q);return Promise.all([_k0(w,Y.branch),vk0(w,Y.branch)])})();await xK(K,K0(K).id,"suggesting a commit message");let L=await e$8(K,B,O);return Q.json(L,200,a5)}catch(H){let F=H instanceof Error?H.message:String(H);if(F==="SANDBOX_GONE")return Q.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,a5);return Q.json({error:F},502,a5)}}),$.post("/:virtualMcpId/:branch/git/judge-review",r5({maxSize:m88,onError:(Q)=>Q.json({error:"Payload too large"},413,a5)}),async(Q)=>{let Y=Q.get("vmClaim"),X=null;if(Y.runtime!=="cms"){let H=Zy(Q);if(H instanceof Response)return H;X=H}let{claimName:J,userId:G,projectRef:W}=Y,K=Q.var.studioContext;try{let H=await Q.req.json().catch(()=>({})),F=H.status,U=H.diff,N=U!=null&&typeof U.diffs==="object"&&U.diffs!==null,[B,O]=NF1(F)&&N?[F,U]:X?await Promise.all([fk0(X,J,"/_sandbox/git/status","GET",{userId:G,projectRef:W}),fk0(X,J,"/_sandbox/git/diff","GET",{userId:G,projectRef:W})]):await(async()=>{let w=await Ui(Q);return Promise.all([_k0(w,Y.branch),vk0(w,Y.branch)])})();await xK(K,K0(K).id,"judging whether a change needs review");let L=await Z88(K,B,O,typeof H.language==="string"?H.language:void 0);return Q.json(L,200,a5)}catch(H){let F=H instanceof Error?H.message:String(H);if(F==="SANDBOX_GONE")return Q.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,a5);return Q.json({error:F},502,a5)}}),$.get("/:virtualMcpId/:branch/preview-fetch",async(Q)=>{let Y=Zy(Q);if(Y instanceof Response)return Y;let{claimName:X}=Q.get("vmClaim"),J=Q.req.query("path");if(!J||!J.startsWith("/")||J.startsWith("//")||J.includes("..")||J.includes("\\"))return Q.json({error:"Path not allowed"},403);let G;try{G=await Y.getPreviewUrl(X)}catch{return Q.json({error:"Preview not available"},502)}if(!G)return Q.json({error:"Preview not available"},502);let W=G.replace(/\/+$/,"");return _F1(Q,`${W}${J}`)}),$.post("/:virtualMcpId/:branch/preview-invoke",r5({maxSize:d88,onError:(Q)=>Q.json({error:"Payload too large"},413)}),async(Q)=>{let Y=Zy(Q);if(Y instanceof Response)return Y;let{claimName:X}=Q.get("vmClaim"),J;try{J=await Y.getPreviewUrl(X)}catch{return Q.json({error:"Preview not available"},502)}if(!J)return Q.json({error:"Preview not available"},502);let G;try{G=await Q.req.json()}catch{return Q.json({error:"Invalid JSON body"},400)}if(!G||typeof G!=="object"||Array.isArray(G))return Q.json({error:"Invalid JSON body"},400);let W=kF1(G);if(!W)return Q.json({error:"Invalid or missing __resolveType"},400);let K=SF1(J,W.resolveType);return _F1(Q,K,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(W.payload),signal:AbortSignal.timeout(30000)})}),$.post("/:virtualMcpId/:branch/catalog-invoke",r5({maxSize:d88,onError:(Q)=>Q.json({error:"Payload too large"},413)}),async(Q)=>{let{runner:Y,claimName:X,virtualMcpMetadata:J}=Q.get("vmClaim"),G;try{G=Y?await Y.getPreviewUrl(X):nc(J)}catch{return Q.json({error:"Preview not available"},502)}if(!G)return Q.json({error:"Preview not available"},502);let W;try{W=await Q.req.json()}catch{return Q.json({error:"Invalid JSON body"},400)}if(!W||typeof W!=="object"||Array.isArray(W))return Q.json({error:"Invalid JSON body"},400);let K=kF1(W);if(!K)return Q.json({error:"Invalid or missing __resolveType"},400);if(!h88(K.resolveType))return Q.json({error:"resolveType not allowed"},403);let H=SF1(G,K.resolveType);return _F1(Q,H,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(K.payload),signal:AbortSignal.timeout(30000)})}),$};var o88=D(()=>{X8();EH();Ji();WF1();L00();i$8();OW();tc();p$8();aK();vF();n$8();o$8();d61();j00();DF1();Q88();uZ();O5();VF1();u88();D20();CF1();kg6=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;_g6=zk0(async($,Z)=>{let Q=$.var.studioContext;try{s(Q)}catch{return $.json({error:"Unauthorized"},401)}let Y=p0(Q);if(!Y)return $.json({error:"Unauthorized"},401);let X;try{X=K0(Q)}catch{return $.json({error:"Organization scope required"},403)}let J=$.req.param("virtualMcpId"),G=$.req.param("branch");if(!J||!G)return $.json({error:"virtualMcpId and branch are required"},400);try{Sg6(G)}catch(L){let w=L instanceof Error?L.message:String(L);return $.json({error:w},400)}let W=await Q.storage.virtualMcps.findById(J);if(!W||W.organization_id!==X.id)return $.json({error:"Virtual MCP not found"},404);let K=ge({orgId:X.id,virtualMcpId:J,branch:G}),H=await L41(Q,G),F=w41(H,Y),U=d$8({userId:F,projectRef:K}),N=W.metadata??null,B=await vg6($,{claimName:U,branch:G,virtualMcpId:J,sandboxUserId:F,virtualMcpMetadata:N,branchThread:H});if(B==="cms")return $.set("vmClaim",{claimName:U,callerUserId:Y,runner:null,virtualMcpId:J,branch:G,userId:F,projectRef:K,virtualMcpMetadata:N,connectionIds:W.connections?.map((L)=>L.connection_id)??[],runtime:B}),Z();let O;try{O=await AX(Q)}catch{O=null}if(!O)return $.json({error:"No sandbox runner found"},404);return $.set("vmClaim",{claimName:U,callerUserId:Y,runner:O,virtualMcpId:J,branch:G,userId:F,projectRef:K,virtualMcpMetadata:N,connectionIds:W.connections?.map((L)=>L.connection_id)??[],runtime:B}),Z()});xk0=new Map;a5={"Cache-Control":"no-store, no-cache, must-revalidate",Pragma:"no-cache"};n88=["clone","install","start"]});function r88($,Z,Q){let Y=bF1.get($);if(!Y)Y={pending:null,running:!1},bF1.set($,Y);if(!Y.pending)Y.pending={set:new Map,del:new Set,deps:Z,resolvers:[],rejecters:[]};let X=Y.pending;X.deps=Z;for(let[G,W]of Object.entries(Q.set??{}))X.set.set(G,W),X.del.delete(G);for(let G of Q.delete??[])X.del.add(G),X.set.delete(G);let J=new Promise((G,W)=>{X.resolvers.push(G),X.rejecters.push(W)});if(!Y.running)gg6($,Y);return J}async function gg6($,Z){Z.running=!0;try{while(Z.pending){let Q=Z.pending;Z.pending=null;try{let Y=await hg6(Q);for(let X of Q.resolvers)X(Y)}catch(Y){for(let X of Q.rejecters)X(Y)}}}finally{if(Z.running=!1,!Z.pending)bF1.delete($)}}async function hg6($){let{client:Z,branch:Q,packagePath:Y}=$.deps,X=new Map;for(let J=0;;J++){let G=await Fi(Z,Q),W=await Z.listDecofileEntries(G,Y),K=qF1(W,Y),H=[],F=new Map(K.map((N)=>[N.path,{stem:N.stem,sha:N.sha}]));for(let[N,B]of $.set){let O=MF1(K,N),L=`${JSON.stringify(B,null,2)}
-`;await v88(Z.repo,L);let w=O[0]??`${kk0(Y)}/${jF1(N)}.json`;H.push({path:w,content:L});let j=w.slice(w.lastIndexOf("/")+1,-5);F.set(w,{stem:j,content:L});for(let E of O.slice(1))H.push({path:E,deleted:!0}),F.delete(E)}for(let N of $.del)for(let B of MF1(K,N))H.push({path:B,deleted:!0}),F.delete(B);if(H.length===0)return G;let U=Y?`${Y}/.deco/blocks.gen.json`:".deco/blocks.gen.json";if(W.some((N)=>N.type==="blob"&&N.path===U)){let N=await b88(Z,F.values(),X),{decofile:B,skipped:O}=g80(N);if(O.length>0)console.warn("decofile gen: dropped blocks that were not valid JSON",{repo:yK(Z.repo),branch:Q,packagePath:Y,blocks:O.map((L)=>L.key)});H.push({path:U,content:B})}try{let{sha:N}=await Z.commitFiles({branch:Q,message:ug6($),expectedHead:G,changes:H});return N}catch(N){if(!(N instanceof m6)||J>=yg6-1)throw N;await m$(e7(2000,200,J,2,0.5))}}}function ug6($){let Z=(X)=>{let J=X.slice(0,3).join(", ");return X.length>3?`${J} (+${X.length-3} more)`:J},Q=[];if($.set.size>0)Q.push(`update ${Z([...$.set.keys()])}`);if($.del.size>0)Q.push(`delete ${Z([...$.del])}`);let Y=`chore(decofile): ${Q.join("; ")}`;return h81(Y,$.deps.coAuthor)}var yg6=3,bF1;var a88=D(()=>{eP0();Tk0();j6();B8();uZ();Sk0();bF1=new Map});import{createHmac as s88,randomBytes as lg6,timingSafeEqual as cg6}from"crypto";function e88(){if(yk0)return yk0;let $;try{let Z=E0();$=Z.studioJwtSecret??Z.betterAuthSecret}catch{$=void 0}return yk0=$?Buffer.from($):lg6(32),yk0}function xF1($){let Z=$.nowMs??Date.now(),Q={o:$.organizationId,m:$.virtualMcpId,b:$.branch,e:Math.floor((Z+mg6)/1000)},Y=Buffer.from(JSON.stringify(Q)).toString("base64url"),X=s88("sha256",e88()).update(Y).digest("base64url");return`${Y}.${X}`}function $48($,Z){let Q=$.indexOf(".");if(Q<0)return!1;let Y=$.slice(0,Q),X=Buffer.from($.slice(Q+1)),J=Buffer.from(s88("sha256",e88()).update(Y).digest("base64url"));if(X.length!==J.length||!cg6(X,J))return!1;let G;try{G=JSON.parse(Buffer.from(Y,"base64url").toString())}catch{return!1}let W=Math.floor((Z.nowMs??Date.now())/1000);return G.o===Z.organizationId&&G.m===Z.virtualMcpId&&G.b===Z.branch&&typeof G.e==="number"&&G.e>=W}var mg6=21600000,yk0=null;var Z48=D(()=>{U$()});function gk0($){return $&&typeof $==="object"&&!Array.isArray($)?$:null}function dg6($){for(let[Z,Q]of Object.entries($)){if(!Z.startsWith("collections/blog/posts/"))continue;let Y=gk0(Q)?.__resolveType;if(typeof Y==="string"&&Y)return Y}return"blog/loaders/Blogpost.ts"}function Q48($){let Z;try{Z=gk0(JSON.parse($))}catch{return $}if(!Z)return $;let Q=dg6(Z),Y={...Z},X=0;for(let[J,G]of Object.entries(Z)){if(!J.startsWith("blog-manager/posts/"))continue;let W=gk0(G),K=W&&gk0(W.post);if(!K)continue;if(K.status==="archived")continue;if(typeof K.slug!=="string"||!K.slug)continue;let F=`collections/blog/posts/${J.slice(19)}`;if(Object.hasOwn(Y,F))continue;Y[F]={name:F,__resolveType:Q,["post"]:{...K,status:"published"}},X++}return X>0?JSON.stringify(Y):$}import{z as Ni}from"zod";function pg6($){return $.length>0&&$.length<=255&&!$.includes("..")&&!$.endsWith("/")&&!$.endsWith(".lock")&&ig6.test($)}function W48($){return $.req.header("x-forwarded-host")??new URL($.req.url).host}async function i80($){let Z=$.get("decofileScope");return Hc($.var.studioContext,Z.organizationId,Z.githubRepo)}function p80($,Z){let Q=Z instanceof Error?Z.message:String(Z);if(Z instanceof m6)return $.json({error:Q},409);let Y=WW(Z);if(Y!==null){let X=Y===404?404:Y===409||Y===422?409:502;return $.json({error:Q},X)}return $.json({error:Q},500)}function K48(){let $=new Y1;return $.use("/:virtualMcpId/:branch",G48),$.use("/:virtualMcpId/:branch/*",G48),$.get("/:virtualMcpId/:branch",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await i80(Z),X=await x88(Y,Q.branch,Q.packagePath,{createBranchIfMissing:!!Q.userId}),J={ETag:`"${X.sha}"`,"Cache-Control":"no-store","Access-Control-Allow-Origin":"*"};if(Z.req.header("if-none-match")===`"${X.sha}"`)return Z.body(null,304,J);if(!Q.userId)return Z.body(Q48(X.decofile),200,{...J,"content-type":"application/json"});let G=xF1({organizationId:Q.organizationId,virtualMcpId:Q.virtualMcpId,branch:Q.branch});return Z.body(`{"version":${JSON.stringify(X.sha)},"token":${JSON.stringify(G)},"apiHost":${JSON.stringify(W48(Z))},"decofile":${X.decofile}}`,200,{...J,"content-type":"application/json"})}catch(Y){return p80(Z,Y)}}),$.get("/:virtualMcpId/:branch/meta",async(Z)=>{let Q=Z.get("decofileScope"),Y=Q.packagePath?`${Q.packagePath}/.deco/meta.gen.json`:".deco/meta.gen.json";try{let X=await i80(Z),J=await X.readFileAtRef(Q.branch,Y);if(J===null){let G=await X.getDefaultBranch();if(G!==Q.branch)J=await X.readFileAtRef(G,Y)}if(J===null)return Z.json({error:"meta.gen.json not committed"},404);return Z.body(J,200,{"content-type":"application/json","Cache-Control":"no-store","Access-Control-Allow-Origin":"*"})}catch(X){return p80(Z,X)}}),$.patch("/:virtualMcpId/:branch",tg6,async(Z)=>{let Q=Z.get("decofileScope"),Y=Z.var.studioContext,X=og6.safeParse(await Z.req.json().catch(()=>null));if(!X.success)return Z.json({error:"Invalid body",details:X.error.issues},400);let J=X.data;for(let G of[...Object.keys(J.set??{}),...J.delete??[]])try{Ak0(G)}catch(W){let K=W instanceof Error?W.message:String(W);return Z.json({error:K},400)}for(let[G,W]of Object.entries(J.set??{})){if(typeof W!=="object"||W===null||Array.isArray(W))return Z.json({error:`Block "${G}" must be a JSON object`},400);if(wF1(G))return Z.json({error:`Block key "${G}" collides with a framework resolver module and cannot be written`},400)}try{let G=await i80(Z),W=await r88(`${Q.organizationId}/${Q.virtualMcpId}/${Q.branch}`,{client:G,branch:Q.branch,packagePath:Q.packagePath,coAuthor:Gi(Y)},J),K=xF1({organizationId:Q.organizationId,virtualMcpId:Q.virtualMcpId,branch:Q.branch});return Z.json({version:W,token:K,apiHost:W48(Z)})}catch(G){return p80(Z,G)}}),$.post("/:virtualMcpId/:branch/publish",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await i80(Z),X=await Y.getDefaultBranch();if(X===Q.branch)return Z.json({error:"Branch is already the default branch"},400);let J=`chore(decofile): publish ${Q.branch}`;try{let G;try{G=await Y.mergeBranches(X,Q.branch,J)}catch(W){if(WW(W)!==409)throw W;await bk0(Y,Q.branch,X),G=await Y.mergeBranches(X,Q.branch,J)}return G?Z.json({result:"merged",sha:G}):Z.json({result:"up-to-date"})}catch(G){if(WW(G)===409)return Z.json({error:"merge-conflict"},409);if(WW(G)===405){let K=await Y.findOpenChangeRequest(X,Q.branch)??await Y.createChangeRequest({base:X,head:Q.branch,title:`Publish ${Q.branch}`});return Z.json({result:"pull-request",number:K.number,url:K.url})}throw G}}catch(Y){return p80(Z,Y)}}),$.get("/:virtualMcpId/:branch/status",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await i80(Z),X=await Y.getDefaultBranch();if(X===Q.branch)return Z.json({baseBranch:X,aheadBy:0,behindBy:0,lastCommitAt:null});try{let[{aheadBy:J,behindBy:G},W]=await Promise.all([Y.compare(X,Q.branch),Y.getBranch(Q.branch)]);return Z.json({baseBranch:X,aheadBy:J,behindBy:G,lastCommitAt:W?.committedAt??null})}catch(J){if(WW(J)===404)return Z.json({baseBranch:X,aheadBy:0,behindBy:0,lastCommitAt:null});throw J}}catch(Y){return p80(Z,Y)}}),$}var ig6,Y48=500,X48=1048576,J48=1024,ng6=8388608,tg6,og6,G48;var H48=D(()=>{D20();Tk0();X8();EH();WF1();Pk0();CF1();uZ();a88();Z48();VF1();Sk0();vF();ig6=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;tg6=r5({maxSize:ng6,onError:($)=>$.json({error:"Payload too large"},413)}),og6=Ni.object({set:Ni.record(Ni.string(),Ni.unknown()).optional(),delete:Ni.array(Ni.string()).optional()}).refine(($)=>Object.keys($.set??{}).length>0||($.delete?.length??0)>0,{message:"Patch must set or delete at least one block"}).refine(($)=>Object.keys($.set??{}).length+($.delete?.length??0)<=Y48,{message:`Patch cannot touch more than ${Y48} blocks`}).refine(($)=>Object.values($.set??{}).every((Z)=>JSON.stringify(Z).length<=X48),{message:`Each block must be at most ${X48} bytes`}).refine(($)=>[...Object.keys($.set??{}),...$.delete??[]].every((Z)=>Z.length<=J48),{message:`Each block key must be at most ${J48} characters`}),G48=zk0(async($,Z)=>{let Q=$.var.studioContext,Y=Q.organization;if(!Y)return $.json({error:"Organization scope required"},500);let X=$.req.param("virtualMcpId"),J=$.req.param("branch");if(!X||!J)return $.json({error:"virtualMcpId and branch are required"},400);if(!pg6(J))return $.json({error:`Invalid branch name: ${J}`},400);let G=Q.auth?.user?.id??null;if(!G){let B=$.req.query("token");if(!($.req.method==="GET"&&!$.req.path.match(/\/(publish|status)$/)))return $.json({error:"Unauthorized"},401);if(!B||!$48(B,{organizationId:Y.id,virtualMcpId:X,branch:J}))return $.json({error:"Unauthorized"},401)}if(!await a3(Q,Y.id,"cms"))return $.json({error:"This organization's plan does not include the CMS",code:"feature_not_in_plan"},403);let W=await Q.storage.virtualMcps.findById(X);if(!W||W.organization_id!==Y.id)return $.json({error:"Virtual MCP not found"},404);let K=W.metadata??null;if(!nc(K))return $.json({error:"Project has no preview server configured"},404);let F=W.connections?.map((B)=>B.connection_id)??[],U=m80(K,F);if(!U)return $.json({error:"Project has no GitHub repository"},404);let N=K?.runtime;return $.set("decofileScope",{organizationId:Y.id,virtualMcpId:X,branch:J,packagePath:N?.path?.replace(/^\/+|\/+$/g,"")||null,githubRepo:U,userId:G}),Z()})});var F48=($)=>{let Z=new Y1;if(Z.use("*",yd),Z.use("*",us$),Z.route("/",kV0()),Z.route("/",Ae$()),Z.route("/",Ke$()),Z.route("/",C$8()),Z.route("/",T$8()),Z.route("/",k$8()),Z.route("/",q$8()),Z.route("/",wk0()),Z.route("/tools",g$8()),Z.route("/",x$8()),Z.route("/",Z$8({kvStorage:$.kvStorage})),Z.route("/",e18()),Z.route("/fs",O$8({getConnection:$.getNatsConnection})),Z.route("/sandbox",t88()),Z.route("/decofile",K48()),Z.route("/",z$8()),Z.route("/",L$8()),Z.route("/deco-sites",CV0()),Z.route("/hosting",as$()),Z.route("/monitor",Xe$()),Z.route("/sso",RV0()),Z.route("/",jk0({tokenStorage:$.tokenStorage,automationEventDispatcher:$.automationEventDispatcher})),Z.route("/webhooks",ps$()),$.mountDevAssets)Z.route("/dev-assets",xV0({orgFromPath:!0}));return Z.use("/mcp/:connectionId?",$.mcpAuth),Z.use("/mcp/:connectionId/ui-resource",$.mcpAuth),Z.use("/mcp/gateway/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/virtual-mcp/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/self",$.mcpAuth),Z.use("/mcp/task-run/:threadId",$.mcpAuth),Z.route("/",ro$()),Z.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",$.betterAuthProtectedResourceHandler),Z.get("/mcp/.well-known/oauth-protected-resource",$.betterAuthProtectedResourceHandler),Z.route("/mcp/task-run",j$8()),Z.route("/mcp",PR0()),Z.route("/mcp/self",Bk0()),Z.route("/mcp",RR0()),Z.all("/oauth-proxy/:connectionId/*",$.oauthProxyHandler),Z.get("/watch",$.watchHandler),Z};var U48=D(()=>{X8();ls$();BV0();ns$();VK1();ss$();Je$();fV0();lf();TK1();vK1();$$8();Q$8();D$8();w$8();k10();wK1();qR0();sH1();E$8();P$8();R$8();M$8();ZF1();_$8();f$8();QF1();h$8();YF1();AR0();o88();H48()});function rg6($){return $.filter((Z)=>Z.vendors?.alias).map((Z)=>({name:Z.name,title:Z.title,description:Z.description,logo:Z.logo,category:Z.category,vendor:{alias:Z.vendors.alias,url:Z.vendors.url}}))}var ag6=async($,Z)=>{if(!$.get("studioContext").auth.user?.id)return $.json({error:"Unauthorized"},401);return Z()},N48=()=>{let $=new Y1;return $.use("*",ag6),$.get("/",async(Z)=>{let Q=E0(),Y=Q.decoSupabaseUrl,X=Q.decoSupabaseServiceKey;if(!Y||!X)return Z.json({apps:[]});try{let J=await yJ(Y,X,"apps?select=name,title,description,logo,category,vendors(alias,url)");return Z.json({apps:rg6(J)})}catch(J){return console.error("[deco-apps] GET error:",J),Z.json({error:"Failed to fetch apps"},502)}}),$};var B48=D(()=>{X8();U$();wI0()});import{z as b1}from"zod";function hU($,Z="invalid_request_error",Q=null,Y=null){return{error:{message:$,type:Z,param:Q,code:Y}}}function Wh6($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let Q=$.substring(0,Z),Y=$.substring(Z+1);if(!Q||!Y)return null;return{credentialId:Q,modelId:Y}}function Kh6($,Z,Q){try{return JSON.parse($)}catch{throw new L48(`Invalid JSON in tool call arguments for function '${Q}' (tool_call_id: ${Z}): ${$}`)}}function Hh6($){let Z={};for(let Q of $)if(Q.role==="assistant"&&Q.tool_calls)for(let Y of Q.tool_calls)Z[Y.id]=Y.function.name;return $.map((Q)=>{switch(Q.role){case"system":return{role:"system",content:Q.content};case"user":if(typeof Q.content==="string")return{role:"user",content:Q.content};return{role:"user",content:Q.content.map((X)=>{if(X.type==="text")return{type:"text",text:X.text};return{type:"image",image:X.image_url.url}})};case"assistant":if(Q.tool_calls&&Q.tool_calls.length>0)return{role:"assistant",content:Q.tool_calls.map((X)=>({type:"tool-call",toolCallId:X.id,toolName:X.function.name,input:Kh6(X.function.arguments,X.id,X.function.name)}))};return{role:"assistant",content:Q.content??""};case"tool":let Y=Z[Q.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:Q.tool_call_id,toolName:Y,output:{type:"text",value:Q.content}}]}}})}function Fh6($){let Z=$.map((Q)=>{let Y=Q.function.parameters?wF(Q.function.parameters):wF({type:"object",properties:{}});return[Q.function.name,l$({description:Q.function.description,inputSchema:Y})]});return Object.fromEntries(Z)}function Uh6($){if(!$)return;return{openai:{response_format:$}}}function Nh6(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function O48($,Z,Q,Y,X,J){let G={model:$,instructions:Z.filter((W)=>W.role==="system"),messages:Z.filter((W)=>W.role!=="system"),tools:Q,temperature:Y.temperature,maxOutputTokens:Y.max_tokens,topP:Y.top_p,frequencyPenalty:Y.frequency_penalty,presencePenalty:Y.presence_penalty,stopSequences:Y.stop?Array.isArray(Y.stop)?Y.stop:[Y.stop]:void 0,abortSignal:J};return X?{...G,providerOptions:X}:G}function D48($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var sg6=256,eg6,$h6,Zh6,Qh6,Yh6,Xh6,Jh6,Gh6,L48,w48,j48;var E48=D(()=>{C4();X8();Ji();GH();eg6=b1.object({type:b1.literal("function"),function:b1.object({name:b1.string(),description:b1.string().optional(),parameters:b1.record(b1.string(),b1.unknown()).optional()})}),$h6=b1.object({id:b1.string(),type:b1.literal("function"),function:b1.object({name:b1.string(),arguments:b1.string()})}),Zh6=b1.discriminatedUnion("role",[b1.object({role:b1.literal("system"),content:b1.string(),name:b1.string().optional()}),b1.object({role:b1.literal("user"),content:b1.union([b1.string(),b1.array(b1.union([b1.object({type:b1.literal("text"),text:b1.string()}),b1.object({type:b1.literal("image_url"),image_url:b1.object({url:b1.string(),detail:b1.string().optional()})})]))]),name:b1.string().optional()}),b1.object({role:b1.literal("assistant"),content:b1.string().nullable().optional(),name:b1.string().optional(),tool_calls:b1.array($h6).optional()}),b1.object({role:b1.literal("tool"),content:b1.string(),tool_call_id:b1.string()})]),Qh6=b1.object({type:b1.literal("text")}),Yh6=b1.object({type:b1.literal("json_object")}),Xh6=b1.object({type:b1.literal("json_schema"),json_schema:b1.object({name:b1.string(),description:b1.string().optional(),schema:b1.record(b1.string(),b1.unknown()),strict:b1.boolean().optional()})}),Jh6=b1.union([Qh6,Yh6,Xh6]),Gh6=b1.object({model:b1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:b1.array(Zh6),stream:b1.boolean().optional().default(!1),temperature:b1.number().min(0).max(2).optional(),max_tokens:b1.number().positive().optional(),top_p:b1.number().min(0).max(1).optional(),frequency_penalty:b1.number().min(-2).max(2).optional(),presence_penalty:b1.number().min(-2).max(2).optional(),stop:b1.union([b1.string(),b1.array(b1.string())]).optional(),tools:b1.array(eg6).optional(),tool_choice:b1.union([b1.literal("auto"),b1.literal("none"),b1.literal("required"),b1.object({type:b1.literal("function"),function:b1.object({name:b1.string()})})]).optional(),response_format:Jh6.optional(),user:b1.string().optional()});L48=class L48 extends Error{constructor($){super($);this.name="MessageConversionError"}};w48=new Y1;w48.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("studioContext"),Q=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(hU("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(hU("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==Q)return $.json(hU("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let Y=await $.req.json(),X=Gh6.safeParse(Y);if(!X.success){let w=X.error.issues[0]??{message:"Invalid request",path:[]};return $.json(hU(`Invalid request: ${w.message}`,"invalid_request_error",w.path.length>0?w.path.join("."):null),400)}let J=X.data,G=Wh6(J.model);if(!G)return $.json(hU("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=G,{modelId:K}=G;if(!W){let j=(await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id})).find((E)=>zz(E.providerId));if(!j)return $.json(hU("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=j.id}let H;try{H=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(hU(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let F=H.aiSdk.languageModel(K),U=Hh6(J.messages),N=J.tools?Fh6(J.tools):void 0,B=Uh6(J.response_format),O=Nh6(),L=Math.floor(Date.now()/1000);if(J.stream)return RO($,async(w)=>{let j=O48(F,U,N,J,B,$.req.raw.signal);try{let E=ic(j),z=!1,T=0,P="",A=async()=>{if(P.length===0)return;let q=P;P="",await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{content:q},finish_reason:null}]})})};for await(let q of E.stream){if(!z&&(q.type==="text-delta"||q.type==="tool-call"))await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),z=!0;if(q.type==="text-delta"){if(P+=q.text,P.length>=sg6)await A()}else if(q.type==="tool-call"){await A();let x=T++;await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{tool_calls:[{index:x,id:q.toolCallId,type:"function",function:{name:q.toolName,arguments:JSON.stringify(q.input)}}]},finish_reason:null}]})})}else if(q.type==="finish")await A(),await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{},finish_reason:D48(q.finishReason)}],usage:q.totalUsage?{prompt_tokens:q.totalUsage.inputTokens??0,completion_tokens:q.totalUsage.outputTokens??0,total_tokens:q.totalUsage.totalTokens??0}:void 0})})}await A(),await w.writeSSE({data:"[DONE]"})}catch(E){let z=E;console.error("[openai-compat:stream] Error:",z.message),await w.writeSSE({data:JSON.stringify({error:{message:z.message,type:"server_error"}})})}});else{let w=O48(F,U,N,J,B,$.req.raw.signal),j=await GU(w),E={role:"assistant",content:j.text||null};if(j.toolCalls&&j.toolCalls.length>0)E.tool_calls=j.toolCalls.map((z)=>({id:z.toolCallId,type:"function",function:{name:z.toolName,arguments:JSON.stringify("input"in z?z.input:{})}})),E.content=null;return $.json({id:O,object:"chat.completion",created:L,model:J.model,choices:[{index:0,message:E,finish_reason:D48(j.finishReason)}],usage:{prompt_tokens:j.usage?.inputTokens??0,completion_tokens:j.usage?.outputTokens??0,total_tokens:j.usage?.totalTokens??0}})}}catch(Y){let X=Y;if(X.name==="AbortError")return $.json(hU("Request aborted","invalid_request_error"),400);if(X.name==="MessageConversionError")return $.json(hU(X.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",X.message,X.stack),$.json(hU(X.message,"server_error"),500)}});j48=w48});function Bh6($){if(typeof $!=="object"||$===null)return!1;let Q=$.githubRepo?.url;return typeof Q==="string"&&Q.length>0}function z48(){let $=new Y1;return $.use("*",async(Z,Q)=>{await Q(),Z.header("Cache-Control","private, no-store"),Z.header("Vary","Cookie")}),$.get("/",async(Z)=>{let Q=Z.get("studioContext"),Y=p0(Q);if(!Y)return Z.json({error:"Authentication required"},401);let J=(Z.req.query("site")??"").trim().toLowerCase();if(!B7(J))return Z.json({error:"Invalid site slug"},400);let G=await Q.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.id as id","organization.slug as slug","organization.name as name","organization.metadata as metadata"]).where("member.userId","=",Y).execute(),W=[];for(let H of G){if(!H.slug||E9(H))continue;let F=await Q.storage.virtualMcps.list(H.id);for(let U of F){if(h30(U)!==J)continue;if(!Bh6(U.metadata))continue;W.push({orgSlug:H.slug,orgName:H.name??H.slug,project:{id:U.id,title:U.title,icon:U.icon??null}})}}let K={matches:W};return Z.json(K)}),$}var P48=D(()=>{X8();YW()});var T48;var A48=D(()=>{T48={name:"decocms",version:"4.393.2",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js","db:migrate:dbos":"bun run ./dist/server/migrate-dbos.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts","migrate:dbos":"bun run src/database/migrate-dbos.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^4.0.58","@ai-sdk/google":"^4.0.76","@ai-sdk/openai":"^4.0.71","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^3.1.0","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^4.0.17","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^7.0.107","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});function Lh6(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??Dh6}}var R48,Dh6="https://ph.studio.decocms.com",q48;var M48=D(()=>{X8();eo();cx();w9();U$();YK1();A48();R48=new Y1;R48.get("/",($)=>{let Z={version:T48.version,theme:b1$(),...zK().logo&&{logo:zK().logo},...eB()&&{internalUrl:Nc1()},...E0().enableDecoImport&&{enableDecoImport:!0},brandExtractEnabled:!!E0().firecrawlApiKey,hostingEnabled:!!E0().controlplaneRestUrl&&!!E0().controlplaneServiceToken,hostingControlPlaneGa:E0().hostingControlPlaneGa,monitorEnabled:!!E0().clickhouseAnalyticsUrl&&!!E0().clickhouseAnalyticsPassword,monitorGa:E0().monitorGa,plansEnabled:E0().plansEnabled,auth:la$(),posthog:Lh6(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:fO()}};return $.header("Cache-Control","no-store"),$.json({success:!0,config:Z})});q48=R48});function Bi($){let Z=($??"").trim().toLowerCase();return Z=Z.replace(/^https?:\/\//,""),Z=Z.replace(/^www\./,""),Z=Z.split(/[/?#]/)[0]??"",Z.replace(/\/+$/,"")}function fF1($){return(Bi($).split(".")[0]||$).replace(/[-_]/g," ").split(" ").filter(Boolean).map((Q)=>Q.charAt(0).toUpperCase()+Q.slice(1)).join(" ")}function V48($,Z=64){return`https://www.google.com/s2/favicons?domain=${encodeURIComponent(Bi($))}&sz=${Z}`}function I48($,Z){let Q=$.trim();if(Q.length<=Z)return Q;let Y=Q.slice(0,Z-1),X=Y.lastIndexOf(" ");return`${(X>Z*0.6?Y.slice(0,X):Y).trimEnd()}\u2026`}function k48($){let{brand:Z,domain:Q,score:Y,verdict:X}=$,J=typeof Y==="number"?`${Z} commerce report \u2014 ${Math.round(Y)}/100 \xB7 decocms`:`${Z} commerce report \xB7 decocms`,G=`See the full ${Z} scorecard \u2014 SEO, performance, conversion & AEO signals scored by decocms.`,W=X?.trim()?I48(`${X.trim().replace(/\s+/g," ")} \u2014 ${G}`,200):I48(`How does ${Q} really perform? ${G}`,200);return{title:J,description:W}}import{z as n0}from"zod";var Qy,wh6,jh6,Eh6,zh6,S48;var C48=D(()=>{Qy=n0.enum(["good","bad","neutral"]),wh6=n0.preprocess(($)=>{if(Array.isArray($))return{kind:"text",value:$.find((Q)=>Q!==null&&typeof Q!=="object")??""};return $!==null&&typeof $==="object"?$:{kind:"text",value:$}},n0.object({kind:n0.enum(["text","number","sparkline","badge","score"]).catch("text"),value:n0.coerce.string().optional(),tone:Qy.optional(),muted:n0.boolean().optional(),delta:n0.coerce.string().optional(),deltaDir:n0.enum(["up","down","neutral"]).optional(),points:n0.array(n0.coerce.number()).optional(),label:n0.coerce.string().optional()}).transform(($)=>{if($.kind==="badge"&&$.label==null)$.label=$.value??"";if($.kind==="score"){let Z=Number($.value);if(Number.isNaN(Z))return{...$,kind:"text"}}return $})),jh6=n0.preprocess(($)=>{let Z=$;if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&Array.isArray(Z.cells))Z=Z.cells;if(Array.isArray(Z)&&Z.length===1&&Array.isArray(Z[0]))Z=Z[0];if(Array.isArray(Z))return Z;if(Z&&typeof Z==="object")return Object.values(Z);return Z},n0.array(wh6)),Eh6={key:n0.coerce.string(),title:n0.coerce.string(),eyebrow:n0.coerce.string().optional(),headline:n0.coerce.string(),annotation:n0.coerce.string().optional(),methodology:n0.coerce.string().optional(),sources:n0.array(n0.object({name:n0.coerce.string(),logoUrl:n0.coerce.string()})).optional()},zh6=n0.discriminatedUnion("template",[n0.object({template:n0.literal("cover"),score:n0.object({value:n0.coerce.number(),max:n0.coerce.number().optional(),grade:n0.coerce.string().optional(),label:n0.coerce.string().optional()}).optional(),brandImage:n0.coerce.string().optional(),screenshot:n0.coerce.string().optional(),mobileScreenshot:n0.coerce.string().optional()}),n0.object({template:n0.literal("cta"),ctaUrl:n0.coerce.string().optional(),ctaLabel:n0.coerce.string().optional(),bullets:n0.array(n0.coerce.string()).optional()}),n0.object({template:n0.literal("series"),points:n0.array(n0.coerce.number()).min(2),xLabels:n0.array(n0.coerce.string()).min(1),unit:n0.coerce.string().optional(),callout:n0.object({index:n0.coerce.number(),value:n0.coerce.string(),tone:Qy.optional()})}),n0.object({template:n0.literal("threshold"),value:n0.coerce.string().default(""),metricLabel:n0.coerce.string().optional(),ratio:n0.coerce.number(),thresholdRatio:n0.coerce.number().optional(),thresholdLabel:n0.coerce.string().default(""),tone:Qy.optional()}),n0.object({template:n0.literal("stats"),stats:n0.array(n0.object({value:n0.coerce.string(),label:n0.coerce.string(),tone:Qy.optional()})).min(1)}),n0.object({template:n0.literal("bars"),items:n0.array(n0.object({value:n0.coerce.string(),label:n0.coerce.string(),ratio:n0.coerce.number(),tone:Qy.optional()})).min(1)}),n0.object({template:n0.literal("gauges"),gauges:n0.array(n0.object({label:n0.coerce.string(),value:n0.coerce.string(),status:n0.enum(["good","warn","bad"]).catch("warn"),caption:n0.coerce.string().optional(),ratio:n0.coerce.number().optional()})).min(1)}),n0.object({template:n0.literal("checklist"),checks:n0.array(n0.object({label:n0.coerce.string(),status:n0.enum(["pass","fail","warn"]).catch("fail"),value:n0.coerce.string().optional()})).min(1)}),n0.object({template:n0.literal("table"),columns:n0.array(n0.object({label:n0.coerce.string(),align:n0.enum(["left","right"]).optional()})).min(1),rows:n0.array(jh6).min(1),highlightRow:n0.coerce.number().optional()}),n0.object({template:n0.literal("products"),products:n0.array(n0.object({name:n0.coerce.string(),price:n0.coerce.string().optional(),image:n0.coerce.string().optional(),url:n0.coerce.string().optional()})).min(1)}),n0.object({template:n0.literal("list"),entries:n0.array(n0.object({label:n0.coerce.string(),severity:n0.enum(["error","warning","notice"]).catch("notice")})).min(1),moreCount:n0.coerce.number().optional()}),n0.object({template:n0.literal("keywords"),volumeLabel:n0.coerce.string().optional(),keywords:n0.array(n0.object({term:n0.coerce.string(),volume:n0.coerce.string(),position:n0.coerce.number().catch(0)})).min(1)}),n0.object({template:n0.literal("competitor"),metricLabel:n0.coerce.string().optional(),competitors:n0.array(n0.object({name:n0.coerce.string(),value:n0.coerce.string(),tone:Qy.optional(),isYou:n0.boolean().optional()})).min(1)}),n0.object({template:n0.literal("scorecard"),rivalLabel:n0.coerce.string().optional(),dimensions:n0.array(n0.object({label:n0.coerce.string(),you:n0.coerce.string(),rival:n0.coerce.string().optional(),rivalName:n0.coerce.string().optional(),tone:Qy.optional()})).min(1)})]),S48=n0.object({...Eh6,template:zh6})});function hk0($){let Z=[],Q=[...$.sections].sort((X,J)=>X.position-J.position).map((X)=>{let J=S48.safeParse(X.props);if(J.success)return J.data;let G=J.error.issues[0];return Z.push({section_type:X.section_type,position:X.position,reason:G?`${G.path.join(".")||"(root)"}: ${G.message}`:"contract violation"}),null}).filter((X)=>X!==null),Y=Q.filter((X)=>X.template.template!=="cover"&&X.template.template!=="cta").map((X)=>({key:X.key,title:X.title}));return{deck:{meta:{...$.meta,scores:$.summary?.scores,scannedAt:$.scanned_at,toc:Y},slides:Q},drops:Z}}var yF1=D(()=>{C48()});import{join as _48}from"path";async function Ah6($){try{let Z=await fetch(`${bF({})}/api/v2/public/diagnostics/${encodeURIComponent($)}`,{headers:{Accept:"application/json"},signal:AbortSignal.timeout(Ph6)});if(!Z.ok)return null;let Q=await Z.json(),{deck:Y}=hk0(Q);if(!Y.slides.length)return null;let X=Y.slides.find((W)=>W.template.template==="cover"),J=X?.template,G=J&&J.template==="cover"?J:void 0;return{brand:Y.meta.brand?.trim()||fF1($),score:Y.meta.scores?.cover??G?.score?.value,verdict:X?.annotation?.trim()||X?.headline?.trim()||void 0}}catch{return null}}function J3($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function Th6($,Z){let Q=Bi($),Y=Z?.brand?.trim()||fF1(Q),X=V48(Q,128),G=`${(E0().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(Q)}`,{title:W,description:K}=k48({brand:Y,domain:Q,score:Z?.score,verdict:Z?.verdict}),H=`${G}/og.png`,F=`${Y} commerce report by decocms`;return[`<title>${J3(W)}</title>`,`<meta name="description" content="${J3(K)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${J3(W)}" />`,`<meta property="og:description" content="${J3(K)}" />`,`<meta property="og:url" content="${J3(G)}" />`,`<meta property="og:image" content="${J3(H)}" />`,'<meta property="og:image:width" content="1200" />','<meta property="og:image:height" content="630" />',`<meta property="og:image:alt" content="${J3(F)}" />`,'<meta name="twitter:card" content="summary_large_image" />',`<meta name="twitter:title" content="${J3(W)}" />`,`<meta name="twitter:description" content="${J3(K)}" />`,`<meta name="twitter:image" content="${J3(H)}" />`,`<meta name="twitter:image:alt" content="${J3(F)}" />`,`<link rel="canonical" href="${J3(G)}" />`,`<link rel="icon" href="${J3(X)}" sizes="any" />`].join(`
+`;await v88(Z.repo,L);let w=O[0]??`${kk0(Y)}/${jF1(N)}.json`;H.push({path:w,content:L});let j=w.slice(w.lastIndexOf("/")+1,-5);F.set(w,{stem:j,content:L});for(let E of O.slice(1))H.push({path:E,deleted:!0}),F.delete(E)}for(let N of $.del)for(let B of MF1(K,N))H.push({path:B,deleted:!0}),F.delete(B);if(H.length===0)return G;let U=Y?`${Y}/.deco/blocks.gen.json`:".deco/blocks.gen.json";if(W.some((N)=>N.type==="blob"&&N.path===U)){let N=await b88(Z,F.values(),X),{decofile:B,skipped:O}=g80(N);if(O.length>0)console.warn("decofile gen: dropped blocks that were not valid JSON",{repo:yK(Z.repo),branch:Q,packagePath:Y,blocks:O.map((L)=>L.key)});H.push({path:U,content:B})}try{let{sha:N}=await Z.commitFiles({branch:Q,message:ug6($),expectedHead:G,changes:H});return N}catch(N){if(!(N instanceof m6)||J>=yg6-1)throw N;await m$(e7(2000,200,J,2,0.5))}}}function ug6($){let Z=(X)=>{let J=X.slice(0,3).join(", ");return X.length>3?`${J} (+${X.length-3} more)`:J},Q=[];if($.set.size>0)Q.push(`update ${Z([...$.set.keys()])}`);if($.del.size>0)Q.push(`delete ${Z([...$.del])}`);let Y=`chore(decofile): ${Q.join("; ")}`;return h81(Y,$.deps.coAuthor)}var yg6=3,bF1;var a88=D(()=>{eP0();Tk0();j6();B8();uZ();Sk0();bF1=new Map});import{createHmac as s88,randomBytes as lg6,timingSafeEqual as cg6}from"crypto";function e88(){if(yk0)return yk0;let $;try{let Z=E0();$=Z.studioJwtSecret??Z.betterAuthSecret}catch{$=void 0}return yk0=$?Buffer.from($):lg6(32),yk0}function xF1($){let Z=$.nowMs??Date.now(),Q={o:$.organizationId,m:$.virtualMcpId,b:$.branch,e:Math.floor((Z+mg6)/1000)},Y=Buffer.from(JSON.stringify(Q)).toString("base64url"),X=s88("sha256",e88()).update(Y).digest("base64url");return`${Y}.${X}`}function $48($,Z){let Q=$.indexOf(".");if(Q<0)return!1;let Y=$.slice(0,Q),X=Buffer.from($.slice(Q+1)),J=Buffer.from(s88("sha256",e88()).update(Y).digest("base64url"));if(X.length!==J.length||!cg6(X,J))return!1;let G;try{G=JSON.parse(Buffer.from(Y,"base64url").toString())}catch{return!1}let W=Math.floor((Z.nowMs??Date.now())/1000);return G.o===Z.organizationId&&G.m===Z.virtualMcpId&&G.b===Z.branch&&typeof G.e==="number"&&G.e>=W}var mg6=21600000,yk0=null;var Z48=D(()=>{U$()});function gk0($){return $&&typeof $==="object"&&!Array.isArray($)?$:null}function dg6($){for(let[Z,Q]of Object.entries($)){if(!Z.startsWith("collections/blog/posts/"))continue;let Y=gk0(Q)?.__resolveType;if(typeof Y==="string"&&Y)return Y}return"blog/loaders/Blogpost.ts"}function Q48($){let Z;try{Z=gk0(JSON.parse($))}catch{return $}if(!Z)return $;let Q=dg6(Z),Y={...Z},X=0;for(let[J,G]of Object.entries(Z)){if(!J.startsWith("blog-manager/posts/"))continue;let W=gk0(G),K=W&&gk0(W.post);if(!K)continue;if(K.status==="archived")continue;if(typeof K.slug!=="string"||!K.slug)continue;let F=`collections/blog/posts/${J.slice(19)}`;if(Object.hasOwn(Y,F))continue;Y[F]={name:F,__resolveType:Q,["post"]:{...K,status:"published"}},X++}return X>0?JSON.stringify(Y):$}import{z as Ni}from"zod";function pg6($){return $.length>0&&$.length<=255&&!$.includes("..")&&!$.endsWith("/")&&!$.endsWith(".lock")&&ig6.test($)}function W48($){return $.req.header("x-forwarded-host")??new URL($.req.url).host}async function i80($){let Z=$.get("decofileScope");return Hc($.var.studioContext,Z.organizationId,Z.githubRepo)}function p80($,Z){let Q=Z instanceof Error?Z.message:String(Z);if(Z instanceof m6)return $.json({error:Q},409);let Y=WW(Z);if(Y!==null){let X=Y===404?404:Y===409||Y===422?409:502;return $.json({error:Q},X)}return $.json({error:Q},500)}function K48(){let $=new Y1;return $.use("/:virtualMcpId/:branch",G48),$.use("/:virtualMcpId/:branch/*",G48),$.get("/:virtualMcpId/:branch",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await i80(Z),X=await x88(Y,Q.branch,Q.packagePath,{createBranchIfMissing:!!Q.userId}),J={ETag:`"${X.sha}"`,"Cache-Control":"no-store","Access-Control-Allow-Origin":"*"};if(Z.req.header("if-none-match")===`"${X.sha}"`)return Z.body(null,304,J);if(!Q.userId)return Z.body(Q48(X.decofile),200,{...J,"content-type":"application/json"});let G=xF1({organizationId:Q.organizationId,virtualMcpId:Q.virtualMcpId,branch:Q.branch});return Z.body(`{"version":${JSON.stringify(X.sha)},"token":${JSON.stringify(G)},"apiHost":${JSON.stringify(W48(Z))},"decofile":${X.decofile}}`,200,{...J,"content-type":"application/json"})}catch(Y){return p80(Z,Y)}}),$.get("/:virtualMcpId/:branch/meta",async(Z)=>{let Q=Z.get("decofileScope"),Y=Q.packagePath?`${Q.packagePath}/.deco/meta.gen.json`:".deco/meta.gen.json";try{let X=await i80(Z),J=await X.readFileAtRef(Q.branch,Y);if(J===null){let G=await X.getDefaultBranch();if(G!==Q.branch)J=await X.readFileAtRef(G,Y)}if(J===null)return Z.json({error:"meta.gen.json not committed"},404);return Z.body(J,200,{"content-type":"application/json","Cache-Control":"no-store","Access-Control-Allow-Origin":"*"})}catch(X){return p80(Z,X)}}),$.patch("/:virtualMcpId/:branch",tg6,async(Z)=>{let Q=Z.get("decofileScope"),Y=Z.var.studioContext,X=og6.safeParse(await Z.req.json().catch(()=>null));if(!X.success)return Z.json({error:"Invalid body",details:X.error.issues},400);let J=X.data;for(let G of[...Object.keys(J.set??{}),...J.delete??[]])try{Ak0(G)}catch(W){let K=W instanceof Error?W.message:String(W);return Z.json({error:K},400)}for(let[G,W]of Object.entries(J.set??{})){if(typeof W!=="object"||W===null||Array.isArray(W))return Z.json({error:`Block "${G}" must be a JSON object`},400);if(wF1(G))return Z.json({error:`Block key "${G}" collides with a framework resolver module and cannot be written`},400)}try{let G=await i80(Z),W=await r88(`${Q.organizationId}/${Q.virtualMcpId}/${Q.branch}`,{client:G,branch:Q.branch,packagePath:Q.packagePath,coAuthor:Gi(Y)},J),K=xF1({organizationId:Q.organizationId,virtualMcpId:Q.virtualMcpId,branch:Q.branch});return Z.json({version:W,token:K,apiHost:W48(Z)})}catch(G){return p80(Z,G)}}),$.post("/:virtualMcpId/:branch/publish",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await i80(Z),X=await Y.getDefaultBranch();if(X===Q.branch)return Z.json({error:"Branch is already the default branch"},400);let J=`chore(decofile): publish ${Q.branch}`;try{let G;try{G=await Y.mergeBranches(X,Q.branch,J)}catch(W){if(WW(W)!==409)throw W;await bk0(Y,Q.branch,X),G=await Y.mergeBranches(X,Q.branch,J)}return G?Z.json({result:"merged",sha:G}):Z.json({result:"up-to-date"})}catch(G){if(WW(G)===409)return Z.json({error:"merge-conflict"},409);if(WW(G)===405){let K=await Y.findOpenChangeRequest(X,Q.branch)??await Y.createChangeRequest({base:X,head:Q.branch,title:`Publish ${Q.branch}`});return Z.json({result:"pull-request",number:K.number,url:K.url})}throw G}}catch(Y){return p80(Z,Y)}}),$.get("/:virtualMcpId/:branch/status",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await i80(Z),X=await Y.getDefaultBranch();if(X===Q.branch)return Z.json({baseBranch:X,aheadBy:0,behindBy:0,lastCommitAt:null});try{let[{aheadBy:J,behindBy:G},W]=await Promise.all([Y.compare(X,Q.branch),Y.getBranch(Q.branch)]);return Z.json({baseBranch:X,aheadBy:J,behindBy:G,lastCommitAt:W?.committedAt??null})}catch(J){if(WW(J)===404)return Z.json({baseBranch:X,aheadBy:0,behindBy:0,lastCommitAt:null});throw J}}catch(Y){return p80(Z,Y)}}),$}var ig6,Y48=500,X48=1048576,J48=1024,ng6=8388608,tg6,og6,G48;var H48=D(()=>{D20();Tk0();X8();EH();WF1();Pk0();CF1();uZ();a88();Z48();VF1();Sk0();vF();ig6=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;tg6=r5({maxSize:ng6,onError:($)=>$.json({error:"Payload too large"},413)}),og6=Ni.object({set:Ni.record(Ni.string(),Ni.unknown()).optional(),delete:Ni.array(Ni.string()).optional()}).refine(($)=>Object.keys($.set??{}).length>0||($.delete?.length??0)>0,{message:"Patch must set or delete at least one block"}).refine(($)=>Object.keys($.set??{}).length+($.delete?.length??0)<=Y48,{message:`Patch cannot touch more than ${Y48} blocks`}).refine(($)=>Object.values($.set??{}).every((Z)=>JSON.stringify(Z).length<=X48),{message:`Each block must be at most ${X48} bytes`}).refine(($)=>[...Object.keys($.set??{}),...$.delete??[]].every((Z)=>Z.length<=J48),{message:`Each block key must be at most ${J48} characters`}),G48=zk0(async($,Z)=>{let Q=$.var.studioContext,Y=Q.organization;if(!Y)return $.json({error:"Organization scope required"},500);let X=$.req.param("virtualMcpId"),J=$.req.param("branch");if(!X||!J)return $.json({error:"virtualMcpId and branch are required"},400);if(!pg6(J))return $.json({error:`Invalid branch name: ${J}`},400);let G=Q.auth?.user?.id??null;if(!G){let B=$.req.query("token");if(!($.req.method==="GET"&&!$.req.path.match(/\/(publish|status)$/)))return $.json({error:"Unauthorized"},401);if(!B||!$48(B,{organizationId:Y.id,virtualMcpId:X,branch:J}))return $.json({error:"Unauthorized"},401)}if(!await a3(Q,Y.id,"cms"))return $.json({error:"This organization's plan does not include the CMS",code:"feature_not_in_plan"},403);let W=await Q.storage.virtualMcps.findById(X);if(!W||W.organization_id!==Y.id)return $.json({error:"Virtual MCP not found"},404);let K=W.metadata??null;if(!nc(K))return $.json({error:"Project has no preview server configured"},404);let F=W.connections?.map((B)=>B.connection_id)??[],U=m80(K,F);if(!U)return $.json({error:"Project has no GitHub repository"},404);let N=K?.runtime;return $.set("decofileScope",{organizationId:Y.id,virtualMcpId:X,branch:J,packagePath:N?.path?.replace(/^\/+|\/+$/g,"")||null,githubRepo:U,userId:G}),Z()})});var F48=($)=>{let Z=new Y1;if(Z.use("*",yd),Z.use("*",us$),Z.route("/",kV0()),Z.route("/",Ae$()),Z.route("/",Ke$()),Z.route("/",C$8()),Z.route("/",T$8()),Z.route("/",k$8()),Z.route("/",q$8()),Z.route("/",wk0()),Z.route("/tools",g$8()),Z.route("/",x$8()),Z.route("/",Z$8({kvStorage:$.kvStorage})),Z.route("/",e18()),Z.route("/fs",O$8({getConnection:$.getNatsConnection})),Z.route("/sandbox",t88()),Z.route("/decofile",K48()),Z.route("/",z$8()),Z.route("/",L$8()),Z.route("/deco-sites",CV0()),Z.route("/hosting",as$()),Z.route("/monitor",Xe$()),Z.route("/sso",RV0()),Z.route("/",jk0({tokenStorage:$.tokenStorage,automationEventDispatcher:$.automationEventDispatcher})),Z.route("/webhooks",ps$()),$.mountDevAssets)Z.route("/dev-assets",xV0({orgFromPath:!0}));return Z.use("/mcp/:connectionId?",$.mcpAuth),Z.use("/mcp/:connectionId/ui-resource",$.mcpAuth),Z.use("/mcp/gateway/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/virtual-mcp/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/self",$.mcpAuth),Z.use("/mcp/task-run/:threadId",$.mcpAuth),Z.route("/",ro$()),Z.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",$.betterAuthProtectedResourceHandler),Z.get("/mcp/.well-known/oauth-protected-resource",$.betterAuthProtectedResourceHandler),Z.route("/mcp/task-run",j$8()),Z.route("/mcp",PR0()),Z.route("/mcp/self",Bk0()),Z.route("/mcp",RR0()),Z.all("/oauth-proxy/:connectionId/*",$.oauthProxyHandler),Z.get("/watch",$.watchHandler),Z};var U48=D(()=>{X8();ls$();BV0();ns$();VK1();ss$();Je$();fV0();lf();TK1();vK1();$$8();Q$8();D$8();w$8();k10();wK1();qR0();sH1();E$8();P$8();R$8();M$8();ZF1();_$8();f$8();QF1();h$8();YF1();AR0();o88();H48()});function rg6($){return $.filter((Z)=>Z.vendors?.alias).map((Z)=>({name:Z.name,title:Z.title,description:Z.description,logo:Z.logo,category:Z.category,vendor:{alias:Z.vendors.alias,url:Z.vendors.url}}))}var ag6=async($,Z)=>{if(!$.get("studioContext").auth.user?.id)return $.json({error:"Unauthorized"},401);return Z()},N48=()=>{let $=new Y1;return $.use("*",ag6),$.get("/",async(Z)=>{let Q=E0(),Y=Q.decoSupabaseUrl,X=Q.decoSupabaseServiceKey;if(!Y||!X)return Z.json({apps:[]});try{let J=await yJ(Y,X,"apps?select=name,title,description,logo,category,vendors(alias,url)");return Z.json({apps:rg6(J)})}catch(J){return console.error("[deco-apps] GET error:",J),Z.json({error:"Failed to fetch apps"},502)}}),$};var B48=D(()=>{X8();U$();wI0()});import{z as b1}from"zod";function hU($,Z="invalid_request_error",Q=null,Y=null){return{error:{message:$,type:Z,param:Q,code:Y}}}function Wh6($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let Q=$.substring(0,Z),Y=$.substring(Z+1);if(!Q||!Y)return null;return{credentialId:Q,modelId:Y}}function Kh6($,Z,Q){try{return JSON.parse($)}catch{throw new L48(`Invalid JSON in tool call arguments for function '${Q}' (tool_call_id: ${Z}): ${$}`)}}function Hh6($){let Z={};for(let Q of $)if(Q.role==="assistant"&&Q.tool_calls)for(let Y of Q.tool_calls)Z[Y.id]=Y.function.name;return $.map((Q)=>{switch(Q.role){case"system":return{role:"system",content:Q.content};case"user":if(typeof Q.content==="string")return{role:"user",content:Q.content};return{role:"user",content:Q.content.map((X)=>{if(X.type==="text")return{type:"text",text:X.text};return{type:"image",image:X.image_url.url}})};case"assistant":if(Q.tool_calls&&Q.tool_calls.length>0)return{role:"assistant",content:Q.tool_calls.map((X)=>({type:"tool-call",toolCallId:X.id,toolName:X.function.name,input:Kh6(X.function.arguments,X.id,X.function.name)}))};return{role:"assistant",content:Q.content??""};case"tool":let Y=Z[Q.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:Q.tool_call_id,toolName:Y,output:{type:"text",value:Q.content}}]}}})}function Fh6($){let Z=$.map((Q)=>{let Y=Q.function.parameters?wF(Q.function.parameters):wF({type:"object",properties:{}});return[Q.function.name,l$({description:Q.function.description,inputSchema:Y})]});return Object.fromEntries(Z)}function Uh6($){if(!$)return;return{openai:{response_format:$}}}function Nh6(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function O48($,Z,Q,Y,X,J){let G={model:$,instructions:Z.filter((W)=>W.role==="system"),messages:Z.filter((W)=>W.role!=="system"),tools:Q,temperature:Y.temperature,maxOutputTokens:Y.max_tokens,topP:Y.top_p,frequencyPenalty:Y.frequency_penalty,presencePenalty:Y.presence_penalty,stopSequences:Y.stop?Array.isArray(Y.stop)?Y.stop:[Y.stop]:void 0,abortSignal:J};return X?{...G,providerOptions:X}:G}function D48($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var sg6=256,eg6,$h6,Zh6,Qh6,Yh6,Xh6,Jh6,Gh6,L48,w48,j48;var E48=D(()=>{C4();X8();Ji();GH();eg6=b1.object({type:b1.literal("function"),function:b1.object({name:b1.string(),description:b1.string().optional(),parameters:b1.record(b1.string(),b1.unknown()).optional()})}),$h6=b1.object({id:b1.string(),type:b1.literal("function"),function:b1.object({name:b1.string(),arguments:b1.string()})}),Zh6=b1.discriminatedUnion("role",[b1.object({role:b1.literal("system"),content:b1.string(),name:b1.string().optional()}),b1.object({role:b1.literal("user"),content:b1.union([b1.string(),b1.array(b1.union([b1.object({type:b1.literal("text"),text:b1.string()}),b1.object({type:b1.literal("image_url"),image_url:b1.object({url:b1.string(),detail:b1.string().optional()})})]))]),name:b1.string().optional()}),b1.object({role:b1.literal("assistant"),content:b1.string().nullable().optional(),name:b1.string().optional(),tool_calls:b1.array($h6).optional()}),b1.object({role:b1.literal("tool"),content:b1.string(),tool_call_id:b1.string()})]),Qh6=b1.object({type:b1.literal("text")}),Yh6=b1.object({type:b1.literal("json_object")}),Xh6=b1.object({type:b1.literal("json_schema"),json_schema:b1.object({name:b1.string(),description:b1.string().optional(),schema:b1.record(b1.string(),b1.unknown()),strict:b1.boolean().optional()})}),Jh6=b1.union([Qh6,Yh6,Xh6]),Gh6=b1.object({model:b1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:b1.array(Zh6),stream:b1.boolean().optional().default(!1),temperature:b1.number().min(0).max(2).optional(),max_tokens:b1.number().positive().optional(),top_p:b1.number().min(0).max(1).optional(),frequency_penalty:b1.number().min(-2).max(2).optional(),presence_penalty:b1.number().min(-2).max(2).optional(),stop:b1.union([b1.string(),b1.array(b1.string())]).optional(),tools:b1.array(eg6).optional(),tool_choice:b1.union([b1.literal("auto"),b1.literal("none"),b1.literal("required"),b1.object({type:b1.literal("function"),function:b1.object({name:b1.string()})})]).optional(),response_format:Jh6.optional(),user:b1.string().optional()});L48=class L48 extends Error{constructor($){super($);this.name="MessageConversionError"}};w48=new Y1;w48.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("studioContext"),Q=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(hU("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(hU("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==Q)return $.json(hU("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let Y=await $.req.json(),X=Gh6.safeParse(Y);if(!X.success){let w=X.error.issues[0]??{message:"Invalid request",path:[]};return $.json(hU(`Invalid request: ${w.message}`,"invalid_request_error",w.path.length>0?w.path.join("."):null),400)}let J=X.data,G=Wh6(J.model);if(!G)return $.json(hU("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=G,{modelId:K}=G;if(!W){let j=(await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id})).find((E)=>zz(E.providerId));if(!j)return $.json(hU("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=j.id}let H;try{H=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(hU(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let F=H.aiSdk.languageModel(K),U=Hh6(J.messages),N=J.tools?Fh6(J.tools):void 0,B=Uh6(J.response_format),O=Nh6(),L=Math.floor(Date.now()/1000);if(J.stream)return RO($,async(w)=>{let j=O48(F,U,N,J,B,$.req.raw.signal);try{let E=ic(j),z=!1,T=0,P="",A=async()=>{if(P.length===0)return;let q=P;P="",await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{content:q},finish_reason:null}]})})};for await(let q of E.stream){if(!z&&(q.type==="text-delta"||q.type==="tool-call"))await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),z=!0;if(q.type==="text-delta"){if(P+=q.text,P.length>=sg6)await A()}else if(q.type==="tool-call"){await A();let x=T++;await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{tool_calls:[{index:x,id:q.toolCallId,type:"function",function:{name:q.toolName,arguments:JSON.stringify(q.input)}}]},finish_reason:null}]})})}else if(q.type==="finish")await A(),await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{},finish_reason:D48(q.finishReason)}],usage:q.totalUsage?{prompt_tokens:q.totalUsage.inputTokens??0,completion_tokens:q.totalUsage.outputTokens??0,total_tokens:q.totalUsage.totalTokens??0}:void 0})})}await A(),await w.writeSSE({data:"[DONE]"})}catch(E){let z=E;console.error("[openai-compat:stream] Error:",z.message),await w.writeSSE({data:JSON.stringify({error:{message:z.message,type:"server_error"}})})}});else{let w=O48(F,U,N,J,B,$.req.raw.signal),j=await GU(w),E={role:"assistant",content:j.text||null};if(j.toolCalls&&j.toolCalls.length>0)E.tool_calls=j.toolCalls.map((z)=>({id:z.toolCallId,type:"function",function:{name:z.toolName,arguments:JSON.stringify("input"in z?z.input:{})}})),E.content=null;return $.json({id:O,object:"chat.completion",created:L,model:J.model,choices:[{index:0,message:E,finish_reason:D48(j.finishReason)}],usage:{prompt_tokens:j.usage?.inputTokens??0,completion_tokens:j.usage?.outputTokens??0,total_tokens:j.usage?.totalTokens??0}})}}catch(Y){let X=Y;if(X.name==="AbortError")return $.json(hU("Request aborted","invalid_request_error"),400);if(X.name==="MessageConversionError")return $.json(hU(X.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",X.message,X.stack),$.json(hU(X.message,"server_error"),500)}});j48=w48});function Bh6($){if(typeof $!=="object"||$===null)return!1;let Q=$.githubRepo?.url;return typeof Q==="string"&&Q.length>0}function z48(){let $=new Y1;return $.use("*",async(Z,Q)=>{await Q(),Z.header("Cache-Control","private, no-store"),Z.header("Vary","Cookie")}),$.get("/",async(Z)=>{let Q=Z.get("studioContext"),Y=p0(Q);if(!Y)return Z.json({error:"Authentication required"},401);let J=(Z.req.query("site")??"").trim().toLowerCase();if(!B7(J))return Z.json({error:"Invalid site slug"},400);let G=await Q.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.id as id","organization.slug as slug","organization.name as name","organization.metadata as metadata"]).where("member.userId","=",Y).execute(),W=[];for(let H of G){if(!H.slug||E9(H))continue;let F=await Q.storage.virtualMcps.list(H.id);for(let U of F){if(h30(U)!==J)continue;if(!Bh6(U.metadata))continue;W.push({orgSlug:H.slug,orgName:H.name??H.slug,project:{id:U.id,title:U.title,icon:U.icon??null}})}}let K={matches:W};return Z.json(K)}),$}var P48=D(()=>{X8();YW()});var T48;var A48=D(()=>{T48={name:"decocms",version:"4.394.0",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js","db:migrate:dbos":"bun run ./dist/server/migrate-dbos.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts","migrate:dbos":"bun run src/database/migrate-dbos.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^4.0.58","@ai-sdk/google":"^4.0.76","@ai-sdk/openai":"^4.0.71","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^3.1.0","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^4.0.17","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^7.0.107","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});function Lh6(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??Dh6}}var R48,Dh6="https://ph.studio.decocms.com",q48;var M48=D(()=>{X8();eo();cx();w9();U$();YK1();A48();R48=new Y1;R48.get("/",($)=>{let Z={version:T48.version,theme:b1$(),...zK().logo&&{logo:zK().logo},...eB()&&{internalUrl:Nc1()},...E0().enableDecoImport&&{enableDecoImport:!0},brandExtractEnabled:!!E0().firecrawlApiKey,hostingEnabled:!!E0().controlplaneRestUrl&&!!E0().controlplaneServiceToken,hostingControlPlaneGa:E0().hostingControlPlaneGa,monitorEnabled:!!E0().clickhouseAnalyticsUrl&&!!E0().clickhouseAnalyticsPassword,monitorGa:E0().monitorGa,plansEnabled:E0().plansEnabled,auth:la$(),posthog:Lh6(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:fO()}};return $.header("Cache-Control","no-store"),$.json({success:!0,config:Z})});q48=R48});function Bi($){let Z=($??"").trim().toLowerCase();return Z=Z.replace(/^https?:\/\//,""),Z=Z.replace(/^www\./,""),Z=Z.split(/[/?#]/)[0]??"",Z.replace(/\/+$/,"")}function fF1($){return(Bi($).split(".")[0]||$).replace(/[-_]/g," ").split(" ").filter(Boolean).map((Q)=>Q.charAt(0).toUpperCase()+Q.slice(1)).join(" ")}function V48($,Z=64){return`https://www.google.com/s2/favicons?domain=${encodeURIComponent(Bi($))}&sz=${Z}`}function I48($,Z){let Q=$.trim();if(Q.length<=Z)return Q;let Y=Q.slice(0,Z-1),X=Y.lastIndexOf(" ");return`${(X>Z*0.6?Y.slice(0,X):Y).trimEnd()}\u2026`}function k48($){let{brand:Z,domain:Q,score:Y,verdict:X}=$,J=typeof Y==="number"?`${Z} commerce report \u2014 ${Math.round(Y)}/100 \xB7 decocms`:`${Z} commerce report \xB7 decocms`,G=`See the full ${Z} scorecard \u2014 SEO, performance, conversion & AEO signals scored by decocms.`,W=X?.trim()?I48(`${X.trim().replace(/\s+/g," ")} \u2014 ${G}`,200):I48(`How does ${Q} really perform? ${G}`,200);return{title:J,description:W}}import{z as n0}from"zod";var Qy,wh6,jh6,Eh6,zh6,S48;var C48=D(()=>{Qy=n0.enum(["good","bad","neutral"]),wh6=n0.preprocess(($)=>{if(Array.isArray($))return{kind:"text",value:$.find((Q)=>Q!==null&&typeof Q!=="object")??""};return $!==null&&typeof $==="object"?$:{kind:"text",value:$}},n0.object({kind:n0.enum(["text","number","sparkline","badge","score"]).catch("text"),value:n0.coerce.string().optional(),tone:Qy.optional(),muted:n0.boolean().optional(),delta:n0.coerce.string().optional(),deltaDir:n0.enum(["up","down","neutral"]).optional(),points:n0.array(n0.coerce.number()).optional(),label:n0.coerce.string().optional()}).transform(($)=>{if($.kind==="badge"&&$.label==null)$.label=$.value??"";if($.kind==="score"){let Z=Number($.value);if(Number.isNaN(Z))return{...$,kind:"text"}}return $})),jh6=n0.preprocess(($)=>{let Z=$;if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&Array.isArray(Z.cells))Z=Z.cells;if(Array.isArray(Z)&&Z.length===1&&Array.isArray(Z[0]))Z=Z[0];if(Array.isArray(Z))return Z;if(Z&&typeof Z==="object")return Object.values(Z);return Z},n0.array(wh6)),Eh6={key:n0.coerce.string(),title:n0.coerce.string(),eyebrow:n0.coerce.string().optional(),headline:n0.coerce.string(),annotation:n0.coerce.string().optional(),methodology:n0.coerce.string().optional(),sources:n0.array(n0.object({name:n0.coerce.string(),logoUrl:n0.coerce.string()})).optional()},zh6=n0.discriminatedUnion("template",[n0.object({template:n0.literal("cover"),score:n0.object({value:n0.coerce.number(),max:n0.coerce.number().optional(),grade:n0.coerce.string().optional(),label:n0.coerce.string().optional()}).optional(),brandImage:n0.coerce.string().optional(),screenshot:n0.coerce.string().optional(),mobileScreenshot:n0.coerce.string().optional()}),n0.object({template:n0.literal("cta"),ctaUrl:n0.coerce.string().optional(),ctaLabel:n0.coerce.string().optional(),bullets:n0.array(n0.coerce.string()).optional()}),n0.object({template:n0.literal("series"),points:n0.array(n0.coerce.number()).min(2),xLabels:n0.array(n0.coerce.string()).min(1),unit:n0.coerce.string().optional(),callout:n0.object({index:n0.coerce.number(),value:n0.coerce.string(),tone:Qy.optional()})}),n0.object({template:n0.literal("threshold"),value:n0.coerce.string().default(""),metricLabel:n0.coerce.string().optional(),ratio:n0.coerce.number(),thresholdRatio:n0.coerce.number().optional(),thresholdLabel:n0.coerce.string().default(""),tone:Qy.optional()}),n0.object({template:n0.literal("stats"),stats:n0.array(n0.object({value:n0.coerce.string(),label:n0.coerce.string(),tone:Qy.optional()})).min(1)}),n0.object({template:n0.literal("bars"),items:n0.array(n0.object({value:n0.coerce.string(),label:n0.coerce.string(),ratio:n0.coerce.number(),tone:Qy.optional()})).min(1)}),n0.object({template:n0.literal("gauges"),gauges:n0.array(n0.object({label:n0.coerce.string(),value:n0.coerce.string(),status:n0.enum(["good","warn","bad"]).catch("warn"),caption:n0.coerce.string().optional(),ratio:n0.coerce.number().optional()})).min(1)}),n0.object({template:n0.literal("checklist"),checks:n0.array(n0.object({label:n0.coerce.string(),status:n0.enum(["pass","fail","warn"]).catch("fail"),value:n0.coerce.string().optional()})).min(1)}),n0.object({template:n0.literal("table"),columns:n0.array(n0.object({label:n0.coerce.string(),align:n0.enum(["left","right"]).optional()})).min(1),rows:n0.array(jh6).min(1),highlightRow:n0.coerce.number().optional()}),n0.object({template:n0.literal("products"),products:n0.array(n0.object({name:n0.coerce.string(),price:n0.coerce.string().optional(),image:n0.coerce.string().optional(),url:n0.coerce.string().optional()})).min(1)}),n0.object({template:n0.literal("list"),entries:n0.array(n0.object({label:n0.coerce.string(),severity:n0.enum(["error","warning","notice"]).catch("notice")})).min(1),moreCount:n0.coerce.number().optional()}),n0.object({template:n0.literal("keywords"),volumeLabel:n0.coerce.string().optional(),keywords:n0.array(n0.object({term:n0.coerce.string(),volume:n0.coerce.string(),position:n0.coerce.number().catch(0)})).min(1)}),n0.object({template:n0.literal("competitor"),metricLabel:n0.coerce.string().optional(),competitors:n0.array(n0.object({name:n0.coerce.string(),value:n0.coerce.string(),tone:Qy.optional(),isYou:n0.boolean().optional()})).min(1)}),n0.object({template:n0.literal("scorecard"),rivalLabel:n0.coerce.string().optional(),dimensions:n0.array(n0.object({label:n0.coerce.string(),you:n0.coerce.string(),rival:n0.coerce.string().optional(),rivalName:n0.coerce.string().optional(),tone:Qy.optional()})).min(1)})]),S48=n0.object({...Eh6,template:zh6})});function hk0($){let Z=[],Q=[...$.sections].sort((X,J)=>X.position-J.position).map((X)=>{let J=S48.safeParse(X.props);if(J.success)return J.data;let G=J.error.issues[0];return Z.push({section_type:X.section_type,position:X.position,reason:G?`${G.path.join(".")||"(root)"}: ${G.message}`:"contract violation"}),null}).filter((X)=>X!==null),Y=Q.filter((X)=>X.template.template!=="cover"&&X.template.template!=="cta").map((X)=>({key:X.key,title:X.title}));return{deck:{meta:{...$.meta,scores:$.summary?.scores,scannedAt:$.scanned_at,toc:Y},slides:Q},drops:Z}}var yF1=D(()=>{C48()});import{join as _48}from"path";async function Ah6($){try{let Z=await fetch(`${bF({})}/api/v2/public/diagnostics/${encodeURIComponent($)}`,{headers:{Accept:"application/json"},signal:AbortSignal.timeout(Ph6)});if(!Z.ok)return null;let Q=await Z.json(),{deck:Y}=hk0(Q);if(!Y.slides.length)return null;let X=Y.slides.find((W)=>W.template.template==="cover"),J=X?.template,G=J&&J.template==="cover"?J:void 0;return{brand:Y.meta.brand?.trim()||fF1($),score:Y.meta.scores?.cover??G?.score?.value,verdict:X?.annotation?.trim()||X?.headline?.trim()||void 0}}catch{return null}}function J3($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function Th6($,Z){let Q=Bi($),Y=Z?.brand?.trim()||fF1(Q),X=V48(Q,128),G=`${(E0().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(Q)}`,{title:W,description:K}=k48({brand:Y,domain:Q,score:Z?.score,verdict:Z?.verdict}),H=`${G}/og.png`,F=`${Y} commerce report by decocms`;return[`<title>${J3(W)}</title>`,`<meta name="description" content="${J3(K)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${J3(W)}" />`,`<meta property="og:description" content="${J3(K)}" />`,`<meta property="og:url" content="${J3(G)}" />`,`<meta property="og:image" content="${J3(H)}" />`,'<meta property="og:image:width" content="1200" />','<meta property="og:image:height" content="630" />',`<meta property="og:image:alt" content="${J3(F)}" />`,'<meta name="twitter:card" content="summary_large_image" />',`<meta name="twitter:title" content="${J3(W)}" />`,`<meta name="twitter:description" content="${J3(K)}" />`,`<meta name="twitter:image" content="${J3(H)}" />`,`<meta name="twitter:image:alt" content="${J3(F)}" />`,`<link rel="canonical" href="${J3(G)}" />`,`<link rel="icon" href="${J3(X)}" sizes="any" />`].join(`
     `)}function Rh6($,Z){return $.replace(/<title>[\s\S]*?<\/title>\s*/i,"").replace(/<meta\s+name="(?:description|twitter:[^"]*)"[^>]*>\s*/gi,"").replace(/<meta\s+property="og:[^"]*"[^>]*>\s*/gi,"").replace(/<link\s+rel="icon"[^>]*>\s*/gi,"").replace("</head>",`    ${Z}
   </head>`)}function v48($){let Z=new Y1;return Z.get("/:domain/og.png",async(Q)=>{let Y=Bi(Q.req.param("domain")),X=async()=>{let J=$?Bun.file(_48($,"report-og-fallback.png")):null;if(!J||!await J.exists())return Q.notFound();return Q.body(new Uint8Array(await J.arrayBuffer()),200,{"Content-Type":"image/png","Cache-Control":"public, max-age=0, s-maxage=3600"})};try{let J=await fetch(`${bF({})}/api/v2/public/diagnostics/${encodeURIComponent(Y)}/og.png`,{signal:AbortSignal.timeout(qh6)}),G=J.headers.get("content-type")??"";if(!J.ok||!G.startsWith("image/")||!J.body)return X();return Q.body(J.body,200,{"Content-Type":G,"Cache-Control":"public, max-age=0, s-maxage=604800"})}catch{return X()}}),Z.get("/:domain",async(Q)=>{let Y=Q.req.param("domain"),X=$?_48($,"index.html"):null,J=X?Bun.file(X):null;if(!J||!await J.exists())return Q.notFound();let G=await J.text();try{let W=await Ah6(Bi(Y)),K=Th6(Y,W);return Q.html(Rh6(G,K),200,{"Cache-Control":"public, max-age=0, s-maxage=300"})}catch{return Q.html(G)}}),Z}var Ph6=2500,qh6=1e4;var b48=D(()=>{X8();yF1();JA();U$()});function n80($,Z){return fetch(`${bF({})}${$}`,Z)}async function Mh6($,Z,Q){let Y=new URLSearchParams;if(Z)Y.set("pw",Z);if(Q)Y.set("lang",Q);let X=Y.toString()?`?${Y.toString()}`:"",J=await n80(`/api/v2/public/diagnostics/${encodeURIComponent($)}${X}`,{headers:{Accept:"application/json"}});if(J.status===404)return{status:"not_found",deck:null,scanned_at:null,drops:[]};if(!J.ok)throw Error(`report read HTTP ${J.status}`);let G=await J.json(),{deck:W,drops:K}=hk0(G);return{status:W.slides.length?"ready":"empty",deck:W,scanned_at:G.scanned_at,drops:K}}var Ih6,MO,x48=async($,Z)=>{if(!$.get("reportUser"))return $.json({error:"Authentication required"},401);await Z();return},f48;var y48=D(()=>{X8();vG();JA();yF1();Ih6=new Set(["complete","errored","terminated","unknown"]),MO=new Y1;MO.use("*",async($,Z)=>{let Q=await k8.api.getSession({headers:$.req.raw.headers});$.set("reportUser",Q?.user?.id?{email:Q.user.email}:void 0),await Z(),$.header("Cache-Control","private, no-store"),$.header("Vary","Cookie");return});MO.use("/link-token/*",x48);MO.use("/suggest",x48);MO.get("/site/:domain",async($)=>{let Z=$.req.param("domain").trim();if(!Z)return $.json({error:"domain is required"},400);let Q=$.get("reportUser"),Y=$.req.query("key")?.trim()||void 0,X=$.req.query("lang")?.trim()||void 0;try{let J=await Mh6(Z,Y,X);if($.header("Cache-Control","private, no-store"),Q||!J.deck)return $.json(J);return $.json({...J,deck:{...J.deck,slides:J.deck.slides.slice(0,1)},truncated:J.status==="ready"})}catch{return $.json({error:"report read failed"},502)}});MO.post("/run",async($)=>{let Z=$.get("reportUser"),Q;try{Q=await $.req.json()}catch{return $.json({error:"invalid JSON"},400)}let Y=typeof Q.domain==="string"?Q.domain.trim():"";if(!Y)return $.json({error:"domain is required"},400);let X=Z?.email,J=typeof Q.distinctId==="string"&&Q.distinctId.trim()&&Q.distinctId.length<=200?Q.distinctId.trim():void 0;try{let G=await n80("/api/v2/diagnostics/run",{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${XA({})}`},body:JSON.stringify({url:Y,...X?{email:X}:{},distinct_id:J})});if(!G.ok)return $.json({error:`run HTTP ${G.status}`},502);let W=await G.json(),K=W.blocked?{state:"blocked"}:W.status==="fresh"?{state:"fresh"}:W.mode==="sync"?{state:"sync"}:{state:"running",id:W.id??null};return $.json(K)}catch{return $.json({error:"run failed"},502)}});MO.get("/status",async($)=>{let Z=$.req.query("id");if(!Z)return $.json({error:"id is required"},400);try{let Q=await n80(`/api/v2/diagnostics/status?id=${encodeURIComponent(Z)}`,{headers:{Authorization:`Bearer ${XA({})}`}});if(!Q.ok)return $.json({error:`status HTTP ${Q.status}`},502);let X=(await Q.json()).status??"unknown",J={done:Ih6.has(X),status:X};return $.json(J)}catch{return $.json({error:"status failed"},502)}});MO.get("/link-token/:id",async($)=>{let Z=$.req.param("id");try{let Q=await n80(`/api/v2/public/link-tokens/${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(Q.status===404)return $.json(null);if(!Q.ok)return $.json({error:`link token HTTP ${Q.status}`},502);return $.json(await Q.json())}catch{return $.json({error:"link token resolve failed"},502)}});MO.get("/suggest",async($)=>{let Z=($.req.query("q")??"").trim().slice(0,64);if(Z.length<2)return $.json({suggestions:[]});try{let Q=await n80(`/api/v2/public/suggest?q=${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(!Q.ok)return $.json({suggestions:[]});let Y=await Q.json();return $.json({suggestions:Array.isArray(Y.suggestions)?Y.suggestions:[]})}catch{return $.json({suggestions:[]})}});f48=MO});var Vh6=1048576,gF1;var g48=D(()=>{X8();EH();U$();cW1();gF1=new Y1;gF1.post("/webhook",r5({maxSize:Vh6,onError:($)=>$.json({error:"payload too large"},413)}),async($)=>{let Z=E0().stripeWebhookSecret;if(!Z)return $.json({error:"stripe billing not configured"},503);let Q=await $.req.text();if(!$a$(Q,$.req.header("stripe-signature"),Z))return $.json({error:"invalid signature"},400);let X=Za$(Q);if(!X)return $.json({error:"invalid payload"},400);let J=await Qa$(X);return console.log("stripe webhook",{eventId:X.id,type:X.type,livemode:X.livemode,...J}),$.json({received:!0})})});import{timingSafeEqual as kh6}from"crypto";function _h6($,Z,Q){if(!Z?.startsWith("sha256="))return!1;let Y=new Bun.CryptoHasher("sha256",Q).update($).digest("hex"),X=Z.slice(7);if(X.length!==Y.length)return!1;return kh6(Buffer.from(X),Buffer.from(Y))}function vh6($,Z){let Q=Z,Y=Q?.repository?.name,X=Q?.repository?.owner?.login;if(typeof Y!=="string"||typeof X!=="string")return[];let J=[];if($==="check_suite"){if(Q.action!=="completed")return[];let G=Q.check_suite?.pull_requests;for(let W of Array.isArray(G)?G:[]){let K=W?.number;if(typeof K==="number")J.push(K)}}else if($==="issue_comment"&&Q.issue?.pull_request){let G=Q.issue.number;if(typeof G==="number")J.push(G)}return[...new Set(J)].map((G)=>({repoOwner:X,repoName:Y,number:G}))}function h48($){let Z=new Y1;return Z.post("/webhook",r5({maxSize:Sh6,onError:(Q)=>Q.json({error:"payload too large"},413)}),async(Q)=>{let Y=process.env.GITHUB_WEBHOOK_SECRET;if(!Y)return Q.json({error:"github webhook not configured"},503);let X=await Q.req.text();if(!_h6(X,Q.req.header("x-hub-signature-256"),Y))return Q.json({error:"invalid signature"},400);let J=Q.req.header("x-github-event");if(J!=="push"&&!Ch6.has(J??""))return Q.json({ok:!0,ignored:"event"});let G;try{G=JSON.parse(X)}catch{return Q.json({error:"invalid payload"},400)}if(J==="push"){let H=G.ref,F=G.repository?.full_name;if(!H||!F)return Q.json({ok:!0,ignored:"shape"});let N=(await U41())?.markTenantPoolsDirty(F,H)??[];return Q.json({ok:!0,pools:N})}let W=vh6(J??"",G);if(W.length===0)return Q.json({ok:!0,ignored:"no-pr"});let K=await bh6($,W);return Q.json({ok:!0,refreshed:K})}),Z}async function bh6($,Z){let Q=0;for(let Y of Z){let X=$.taskBoard(),J;try{J=await X.findPrLinks(Y)}catch(G){console.error("[github-webhook] pr link lookup failed:",G);continue}for(let G of J)try{let W=await X.getById(G.taskBoardItemId,G.organizationId),K=W?await $.contextFactory()(G.organizationId,W.assignedBy??W.createdBy):null;if(!K)continue;if(await aI$(K,G.organizationId,G.taskBoardItemId)!==null)Q++}catch(W){console.error(`[github-webhook] pr card refresh failed for ${G.taskBoardItemId}:`,W)}}return Q}var Sh6=5242880,Ch6;var u48=D(()=>{X8();EH();aK();L7();Ch6=new Set(["check_suite","issue_comment"])});function l48($){let Z=new OO($.db,new JG($.encryptionKey)),Q=new Y1;return Q.get("/attachments/:token",async(Y)=>{let X=DM$(Y.req.param("token"));if(!X)return Y.json({error:"Invalid or expired link"},404);let J=await Z.getByOrg(X.organizationId);if(!J)return Y.json({error:"Jira is not connected"},404);let W=await new TX(J.siteUrl,J.email,J.apiToken).downloadAttachment(X.attachmentId);if(!W.ok||!W.body)return Y.json({error:"Jira refused the download"},502);let K=new Headers;for(let H of["content-type","content-length","content-disposition"]){let F=W.headers.get(H);if(F)K.set(H,F)}return K.set("cache-control","no-store"),new Response(W.body,{status:200,headers:K})}),Q}var c48=D(()=>{X8();jz();L51();wj()});function m48($){let Z=new OO($.db,new JG($.encryptionKey));async function Q(X,J){let G=Vp$(J);if(!G)return;let W=await Z.getByWebhookSecret(X);if(!W?.enabled)return;let K=await wW($.db,W.organizationId);if(!K)return;if(await zI0(K,W,G)==="started")console.log(`[jira-webhook] started a run for ${G.issueKey} entering "${G.toStatus}"`)}let Y=new Y1;return Y.post("/webhook/:secret",r5({maxSize:xh6}),async(X)=>{let J=X.req.param("secret");if(!await Z.getByWebhookSecret(J))return X.json({error:"Unknown webhook"},404);let W;try{W=await X.req.json()}catch{return X.json({error:"Body must be JSON"},400)}return Q(J,W).catch((K)=>{console.error("[jira-webhook] trigger failed",K)}),X.body(null,202)}),Y}var xh6=1048576;var d48=D(()=>{X8();EH();jz();PI0();fx()});import{DBOS as uk0,SchedulerMode as fh6}from"@dbos-inc/dbos-sdk";function p48($){uF1=$}function n48(){if(!uF1)throw Error("[jira-trigger] runtime not initialized \u2014 setJiraTriggerSweepRuntime() must run before the workflow fires");return uF1}function t48(){let $=n48();return new OO($.db,new JG($.encryptionKey))}async function hh6($,Z){try{let Q=await t48().getById($);if(!Q?.enabled||!Q.boardId)return{integrationId:$,started:0};let Y=await wW(n48().db,Q.organizationId);if(!Y)return{integrationId:$,started:0};if((await Y.storage.jiraIntegrations.listAutomations(Q.organizationId)).length===0)return{integrationId:$,started:0};let J=new TX(Q.siteUrl,Q.email,Q.apiToken),W=`(${await J.getBoardScopeJql(Q.boardId)}) AND status CHANGED AFTER "-${i48}m"`,K=0,H;for(let F=0;F<gh6;F++){let U=await J.searchIssues({jql:W,nextPageToken:H,expandChangelog:!0});for(let N of U.issues){let B=kp$(N,N.changelog?.histories??[],Z);for(let O of B)if(await zI0(Y,Q,O)==="started")K++}if(H=U.nextPageToken??void 0,!H)break}return{integrationId:$,started:K}}catch(Q){return{integrationId:$,started:0,error:Q instanceof Error?Q.message:String(Q)}}}async function uh6($,Z){let Q=new Date($.getTime()-i48*60000),Y=await uk0.runStep(()=>t48().listEnabledIds(),{name:"loadJiraIntegrations"});if(Y.length===0)return;let X=await Promise.all(Y.map((J)=>uk0.runStep(()=>hh6(J,Q),{name:`sweepJira:${J}`})));for(let J of X)if(J.error)console.warn(`[jira-trigger] integration ${J.integrationId} failed: ${J.error}`);else if(J.started>0)console.log(`[jira-trigger] integration ${J.integrationId} started ${J.started} run(s) the webhook missed`)}function o48(){if(hF1)return;hF1=uk0.registerWorkflow(uh6,{name:"jiraTriggerSweepWorkflow"}),uk0.registerScheduled(hF1,{name:"jiraTriggerSweepWorkflow",crontab:yh6,mode:fh6.ExactlyOncePerIntervalWhenActive})}var yh6="7-59/10 * * * *",i48=35,gh6=5,uF1=null,hF1=null;var r48=D(()=>{jz();fx();wj();PI0()});function a48($,Z){if(Z.startsWith("text/html")||Z.startsWith("image/svg"))$.set("Content-Security-Policy","sandbox allow-scripts allow-modals allow-same-origin")}var s48,lh6,ch6,e48;var $68=D(()=>{X8();EK();Bm();ml();s48=new Y1,lh6=["range","if-none-match","if-modified-since"],ch6=["content-type","content-length","content-range","accept-ranges","etag","last-modified"];s48.get("/:org/files/*",async($)=>{let Z=$.get("studioContext"),Q=Z.organization?.id;if(!Z.auth?.user?.id){if(fd($))return $.redirect(`/login?next=${encodeURIComponent($.req.path)}`,302);throw new A$(401,{message:"Authentication required"})}if(!Q)throw new A$(401,{message:"Organization context required"});let Y=$.req.path.replace(/^.*\/files\//,"");if(!Y)throw new A$(400,{message:"Missing file key"});let X=await K10(Y,Z);if(!X)throw new A$(503,{message:"Object storage not configured"});if(X.startsWith("data:")&&$W()){let K=X.match(/^data:([^;]+);base64,(.+)$/s);if(!K)throw new A$(500,{message:"Invalid data URL from storage"});let[,H,F]=K,U=Buffer.from(F,"base64"),N=new Headers({"Content-Type":H,"Cache-Control":"private, max-age=86400"});return a48(N,H),new Response(U,{status:200,headers:N})}let J=new Headers;for(let K of lh6){let H=$.req.header(K);if(H)J.set(K,H)}let G=await fetch(X,{headers:J});if(G.status===403||G.status===404)throw new A$(404,{message:"File not found"});if(!G.ok&&G.status!==304&&G.status!==416)throw console.error(`[files] upstream storage error ${G.status} for key:`,Y),new A$(502,{message:"Upstream storage error"});let W=new Headers;for(let K of ch6){let H=G.headers.get(K);if(H)W.set(K,H)}return W.set("Cache-Control","private, max-age=86400"),a48(W,W.get("content-type")??""),new Response(G.body,{status:G.status,headers:W})});e48=s48});var t80=b((Yy)=>{var mh6=Yy&&Yy.__createBinding||(Object.create?function($,Z,Q,Y){if(Y===void 0)Y=Q;var X=Object.getOwnPropertyDescriptor(Z,Q);if(!X||("get"in X?!Z.__esModule:X.writable||X.configurable))X={enumerable:!0,get:function(){return Z[Q]}};Object.defineProperty($,Y,X)}:function($,Z,Q,Y){if(Y===void 0)Y=Q;$[Y]=Z[Q]}),dh6=Yy&&Yy.__exportStar||function($,Z){for(var Q in $)if(Q!=="default"&&!Object.prototype.hasOwnProperty.call(Z,Q))mh6(Z,$,Q)};Object.defineProperty(Yy,"__esModule",{value:!0});dh6(oJ(),Yy)});var Y68=b((Z68)=>{Object.defineProperty(Z68,"__esModule",{value:!0});Z68.version=void 0;Z68.version="3.4.0"});var G68=b((uU)=>{var ih6=uU&&uU.__importDefault||function($){return $&&$.__esModule?$:{default:$}};Object.defineProperty(uU,"__esModule",{value:!0});uU.NodeTransport=uU.VERSION=void 0;uU.nodeResolveHost=ah6;var u5=t80(),ph6=q0("net"),lF1=q0("tls"),nh6=q0("path"),X68=q0("fs"),th6=ih6(q0("dns")),oh6=Y68();uU.VERSION=oh6.version;var rh6="nats.js";class J68{socket;version;lang;yields=[];signal=(0,u5.deferred)();closedNotification=(0,u5.deferred)();options;connected=!1;tlsName="";done=!1;closeError;constructor(){this.lang=rh6,this.version=uU.VERSION}async connect($,Z){this.tlsName=$.tlsName,this.options=Z;let{tls:Q}=this.options,{handshakeFirst:Y}=Q||{};try{if(Y===!0)this.socket=await this.tlsFirst($);else this.socket=await this.dial($);if(this.done)this.socket?.destroy();let X=await this.peekInfo();(0,u5.checkOptions)(X,Z);let{tls_required:J,tls_available:G}=X,W=G===!0&&Z.tls!==null;if(!Y&&(J||W))this.socket=await this.startTLS();if(this.done)this.socket?.destroy();if(J&&this.socket.encrypted!==!0)throw u5.errors.InvalidArgumentError.format("tls","is not available on this server");return this.connected=!0,this.setupHandlers(),this.signal.resolve(),Promise.resolve()}catch(X){let J=X;if(!J)J=new u5.errors.ConnectionError("error connecting - node provided an undefined error");let{code:G}=J,W=G==="ECONNREFUSED"?new u5.errors.ConnectionError("connection refused",{cause:J}):J;throw this.socket?.destroy(),W}}dial($){let Z=(0,u5.deferred)(),Q,Y=(0,ph6.createConnection)($.port,$.hostname,()=>{Z.resolve(Y),Y.removeAllListeners()});return Y.on("error",(X)=>{Q=X}),Y.on("close",()=>{Y.removeAllListeners(),Z.reject(Q)}),Y.setNoDelay(!0),Z}get isClosed(){return this.done}close($){return this._closed($,!1)}peekInfo(){let $=(0,u5.deferred)(),Z;return this.socket.on("data",(Q)=>{this.yields.push(Q);let Y=u5.DataBuffer.concat(...this.yields),X=(0,u5.extractProtocolMessage)(Y);if(X!=="")try{let J=u5.INFO.exec(X);if(!J)throw Error("unexpected response from server");let G=JSON.parse(J[1]);$.resolve(G)}catch(J){$.reject(J)}finally{this.socket.removeAllListeners()}}),this.socket.on("error",(Q)=>{Z=Q}),this.socket.on("close",()=>{this.socket.removeAllListeners(),$.reject(Z)}),$}loadFile($){if(!$)return Promise.resolve();let Z=(0,u5.deferred)();try{if($=(0,nh6.resolve)($),!(0,X68.existsSync)($))Z.reject(Error(`${$} doesn't exist`));(0,X68.readFile)($,(Q,Y)=>{if(Q)return Z.reject(Q);Z.resolve(Y)})}catch(Q){Z.reject(Q)}return Z}async loadClientCerts(){let $={},{certFile:Z,cert:Q,caFile:Y,ca:X,keyFile:J,key:G}=this.options.tls;try{if(Z){let W=await this.loadFile(Z);if(W)$.cert=W}else if(Q)$.cert=Q;if(J){let W=await this.loadFile(J);if(W)$.key=W}else if(G)$.key=G;if(Y){let W=await this.loadFile(Y);if(W)$.ca=[W]}else if(X)$.ca=X;return Promise.resolve($)}catch(W){return Promise.reject(W)}}async tlsFirst($){let Z,Q={servername:this.tlsName,rejectUnauthorized:!0};if(this.socket)Q.socket=this.socket;if(typeof this.options.tls==="object")try{let X=await this.loadClientCerts()||{};Q=(0,u5.extend)(Q,this.options.tls,X)}catch(X){return Promise.reject(new u5.errors.ConnectionError(X.message,{cause:X}))}let Y=(0,u5.deferred)();try{let X=(0,lF1.connect)($.port,$.hostname,Q,()=>{X.removeAllListeners(),Y.resolve(X)});X.on("error",(J)=>{Z=J}),X.on("secureConnect",()=>{if(Q.rejectUnauthorized===!1)return;if(!X.authorized)throw X.authorizationError}),X.on("close",()=>{Y.reject(Z),X.removeAllListeners()}),X.setNoDelay(!0)}catch(X){Y.reject(new u5.errors.ConnectionError(X.message,{cause:X}))}return Y}async startTLS(){let $,Z={socket:this.socket,servername:this.tlsName,rejectUnauthorized:!0};if(typeof this.options.tls==="object")try{let Y=await this.loadClientCerts()||{};Z=(0,u5.extend)(Z,this.options.tls,Y)}catch(Y){return Promise.reject(new u5.errors.ConnectionError(Y.message,{cause:Y}))}let Q=(0,u5.deferred)();try{let Y=(0,lF1.connect)(Z,()=>{Y.removeAllListeners(),Q.resolve(Y)});Y.on("error",(X)=>{$=X}),Y.on("secureConnect",()=>{if(Z.rejectUnauthorized===!1)return;if(!Y.authorized)throw Y.authorizationError}),Y.on("close",()=>{Q.reject($),Y.removeAllListeners()})}catch(Y){Q.reject(new u5.errors.ConnectionError(Y.message,{cause:Y}))}return Q}setupHandlers(){let $;this.socket.on("data",(Z)=>{return this.yields.push(Z),this.signal.resolve()}),this.socket.on("error",(Z)=>{$=Z}),this.socket.on("end",()=>{if(this.socket?.destroyed)return;this.socket?.write(new Uint8Array(0),()=>{this.socket?.end()})}),this.socket.on("close",()=>{this._closed($,!1)})}[Symbol.asyncIterator](){return this.iterate()}async*iterate(){while(!0){if(this.yields.length===0)await this.signal;let $=this.yields;this.yields=[];for(let Z=0;Z<$.length;Z++){if(this.options.debug)console.info(`> ${(0,u5.render)($[Z])}`);yield $[Z]}if(this.done)break;else if(this.yields.length===0)$.length=0,this.yields=$,this.signal=(0,u5.deferred)()}}discard(){if(this.done=!0,this.socket)try{this.socket.removeAllListeners(),this.socket.destroy()}catch{}}disconnect(){this._closed(void 0,!0).then().catch()}isEncrypted(){return this.socket instanceof lF1.TLSSocket}_send($){if(this.isClosed||this.socket===void 0)return Promise.resolve();if(this.options.debug)console.info(`< ${(0,u5.render)($)}`);let Z=(0,u5.deferred)();try{this.socket.write($,(Q)=>{if(Q){if(this.options.debug)console.error(`!!! ${(0,u5.render)($)}: ${Q}`);return Z.reject(Q)}return Z.resolve()})}catch(Q){if(this.options.debug)console.error(`!!! ${(0,u5.render)($)}: ${Q}`);Z.reject(Q)}return Z}send($){this._send($).catch((Q)=>{})}async _closed($,Z=!0){if(!this.connected)return;if(this.done){this.socket?.destroy();return}if(this.closeError=$,!$&&this.socket&&Z)try{await this._send(new TextEncoder().encode(""))}catch(Q){if(this.options.debug)console.log("transport close terminated with an error",Q)}try{if(this.socket)this.socket.removeAllListeners(),this.socket?.destroy(),this.socket=void 0}catch(Q){console.log(Q)}this.done=!0,this.closedNotification.resolve(this.closeError)}closed(){return this.closedNotification}}uU.NodeTransport=J68;function ah6($){let Z=(0,u5.deferred)();return th6.default.lookup($,{all:!0},(Q,Y)=>{if(Q){Z.reject(Q);return}let X=[];for(let J of Y)X.push(J.address);if(X.length===0)X.push($);Z.resolve(X)}),Z}});var U68=b((F68)=>{Object.defineProperty(F68,"__esModule",{value:!0});F68.connect=sh6;var W68=G68(),K68=t80(),H68=t80();function sh6($={}){if((0,H68.hasWsProtocol)($))return Promise.reject(H68.errors.InvalidArgumentError.format("servers","node client doesn't support websockets, use the 'wsconnect' function instead"));return(0,K68.setTransportFactory)({factory:()=>{return new W68.NodeTransport},dnsResolveFn:W68.nodeResolveHost}),K68.NatsConnectionImpl.connect($)}});var N68=b((IO)=>{var $u6=IO&&IO.__createBinding||(Object.create?function($,Z,Q,Y){if(Y===void 0)Y=Q;var X=Object.getOwnPropertyDescriptor(Z,Q);if(!X||("get"in X?!Z.__esModule:X.writable||X.configurable))X={enumerable:!0,get:function(){return Z[Q]}};Object.defineProperty($,Y,X)}:function($,Z,Q,Y){if(Y===void 0)Y=Q;$[Y]=Z[Q]}),Zu6=IO&&IO.__exportStar||function($,Z){for(var Q in $)if(Q!=="default"&&!Object.prototype.hasOwnProperty.call(Z,Q))$u6(Z,$,Q)};Object.defineProperty(IO,"__esModule",{value:!0});IO.connect=void 0;var Qu6=U68();Object.defineProperty(IO,"connect",{enumerable:!0,get:function(){return Qu6.connect}});Zu6(t80(),IO)});function L68($){let Z=$?.connectFn??Gu6,Q=null,Y=null,X=!1,J=!1,G=!1,W=[];function K(){return Q!==null&&!Q.isClosed()&&!Q.isDraining()&&!G}function H(){console.log(`[NatsProvider] fireReady: ${W.length} callbacks`);for(let N of W)try{N()}catch{}}function F(N){(async()=>{for await(let B of N.status())if(B.type==="disconnect")console.log("[NatsProvider] Disconnected"),G=!0;else if(B.type==="reconnect")console.log("[NatsProvider] Reconnected, re-firing ready callbacks"),G=!1,Y=null,H()})().catch(()=>{})}async function U(N,B){let O=0;while(!J)try{Q=await Z({servers:N,timeout:Ju6,reconnect:!0,maxReconnectAttempts:-1,...B?{authenticator:B}:{}}),console.log(`[NatsProvider] Connected to ${Q.getServer()} after ${O} attempt(s)`),Y=null,G=!1,F(Q),H();return}catch{O++;let L=e7(Xu6,Yu6,O-1,2,0.5);await m$(L)}}return{init(N,B){if(X)return;X=!0,J=!1;let O=B?.creds?B68.credsAuthenticator(new TextEncoder().encode(B.creds)):void 0;U(N,O).catch(()=>{})},isConnected(){return K()},getConnection(){return K()?Q:null},getJetStream(){if(!K())return null;if(!Y)Y=D68.jetstream(Q);return Y},onReady(N){if(W.push(N),K())try{N()}catch{}},async drain(){if(J=!0,X=!1,Y=null,G=!1,Q){let N=Q;Q=null,await N.drain().catch(()=>{})}}}}function Gu6($){return O68.connect($)}var B68,O68,D68,Yu6=100,Xu6=3000,Ju6=3000;var w68=D(()=>{B8();B68=C(mi(),1),O68=C(N68(),1),D68=C($N(),1)});function lk0($){let Z=$?.ttlMs??60000,Q=$?.maxSize??1e4,Y=$?.updateRecencyOnGet??!1,X=new Map;function J(){if(X.size<=Q)return;let G=Date.now();for(let[W,K]of X)if(K.expiresAt<=G)X.delete(W);while(X.size>Q){let W=X.keys().next().value;if(W===void 0)break;X.delete(W)}}return{get(G){let W=X.get(G);if(!W)return;if(W.expiresAt<=Date.now()){X.delete(G);return}if(Y)X.delete(G),X.set(G,W);return W.value},set(G,W){X.delete(G),X.set(G,{value:W,expiresAt:Date.now()+Z}),J()},delete(G){X.delete(G)},clear(){X.clear()},size(){return X.size}}}function ck0($,Z){return`${$}.${Z}`}class cF1{cache;constructor($){this.cache=lk0({ttlMs:$?.ttlMs??Wu6,maxSize:$?.maxSize??Ku6})}async get($,Z){return this.cache.get(ck0($,Z))??null}async set($,Z,Q){this.cache.set(ck0($,Z),Q)}async invalidate($,Z){this.cache.delete(ck0($,Z)),this.cache.delete(ck0($,`${Z}:decisions`))}teardown(){this.cache.clear()}}var Wu6=600000,Ku6=5000;var j68=()=>{};function mk0($,Z){return`${$}:${Z}`}function mF1($){let Z=lk0({ttlMs:$?.ttlMs??Hu6,maxSize:$?.maxSize??Fu6}),Q=$?.getConnection,Y=crypto.randomUUID(),X=new TextEncoder,J=new TextDecoder,G=null;function W(K,H){let F=Q?.();if(!F)return;try{F.publish(E68,X.encode(JSON.stringify({organizationId:K,keyId:H,originId:Y})))}catch(U){console.warn("[ProviderKeyCache] Publish failed (non-critical):",U)}}return{get(K,H){return Z.get(mk0(K,H))},set(K,H,F){Z.set(mk0(K,H),F)},invalidate(K,H){Z.delete(mk0(K,H)),W(K,H)},start(){if(G)return;let K=Q?.();if(!K)return;G=K.subscribe(E68),(async()=>{for await(let H of G)try{let F=JSON.parse(J.decode(H.data));if(F.originId===Y)continue;Z.delete(mk0(F.organizationId,F.keyId))}catch{}})().catch(console.error)},teardown(){G?.unsubscribe(),G=null,Z.clear()}}}var E68="studio.ai-provider-keys.invalidate",Hu6=30000,Fu6=5000;var z68=()=>{};class dF1{options;subscription=null;onCancel=null;encoder=new TextEncoder;originId=crypto.randomUUID();constructor($){this.options=$}async start($){if($)this.onCancel=$;if(this.subscription)return;if(!this.onCancel)return;let Z=this.options.getConnection();if(!Z)return;let Q=new TextDecoder,Y=Z.subscribe("studio.decopilot.cancel");this.subscription=Y,(async()=>{for await(let X of Y)try{let J=JSON.parse(Q.decode(X.data));if(J.originId===this.originId)continue;this.onCancel?.(J.taskId)}catch{}})().catch(console.error)}broadcast($){if(/[.*>\s]/.test($)){console.warn("[NatsCancelBroadcast] Invalid threadId, skipping broadcast");return}this.onCancel?.($);try{let Z=this.options.getConnection();if(!Z)return;let Q=this.encoder.encode(JSON.stringify({taskId:$,originId:this.originId}));Z.publish("studio.decopilot.cancel",Q)}catch(Z){console.warn("[NatsCancelBroadcast] Publish failed (non-critical):",Z)}}async stop(){this.subscription?.unsubscribe(),this.subscription=null,this.onCancel=null}}var P68=($)=>{let Z;return()=>Z??=$()},iF1,pF1;var A68=D(()=>{I6();iF1=P68(()=>z$.createHistogram("decopilot.stream.encode_ms",{description:"Per-chunk JSON.stringify+encode time for decopilot stream",unit:"ms"})),pF1=P68(()=>z$.createCounter("decopilot.stream.published_chunks",{description:"Logical decopilot stream chunks published to JetStream",unit:"{chunks}"}))});function wu6($=q68){return{name:OU,subjects:[`${OZ1}.>`],storage:AH.StorageType.File,max_age:Bu6,max_bytes:Du6,max_msgs_per_subject:Lu6,discard:AH.DiscardPolicy.Old,retention:AH.RetentionPolicy.Limits,duplicate_window:Ou6,num_replicas:$}}class M68{chunks=0;encodeMs=0;maxMs=0;bytes=0;windowStart=performance.now();constructor(){setInterval(()=>this.flush(),1e4).unref?.()}record($,Z){if(this.chunks++,this.encodeMs+=$,$>this.maxMs)this.maxMs=$;this.bytes+=Z}flush(){let $=performance.now(),Z=$-this.windowStart;if(this.chunks>0&&Z>0)console.warn(JSON.stringify({msg:"stream-encode-trace",windowMs:Math.round(Z),chunks:this.chunks,encodeMs:Math.round(this.encodeMs),pctOfLoop:+(this.encodeMs/Z*100).toFixed(1),maxChunkMs:+this.maxMs.toFixed(2),mbEncoded:+(this.bytes/1048576).toFixed(2)}));this.chunks=0,this.encodeMs=0,this.maxMs=0,this.bytes=0,this.windowStart=$}}function T68($){let Z=R68.headers();for(let[Q,Y]of Object.entries($))Z.set(Q,Y);return Z}function Pu6($,Z){let Q=0;return{publish(Y,X,J,G){Y.publish(X,J,G?{headers:G}:void 0).catch((W)=>{if(Q++,Nu6().add(1,{"org.id":Z??"unknown"}),Q===1||Q%100===0)console.warn(`[Decopilot] JetStream publish failed for thread ${$} (${Q} total):`,W)})},get errorCount(){return Q}}}function Au6($,Z){return $.info?.cluster?Z:1}function Tu6($){if(!($ instanceof Error))return!1;if(/non-clustered/i.test($.message))return!0;return/replicas?\b/i.test($.message)&&/not supported|can ?not|exceed|insufficient|greater than/i.test($.message)}class nF1{options;js=null;jsm=null;constructor($){this.options=$}async init(){let $=this.options.getConnection();if(!$){console.log("[Decopilot] StreamBuffer.init skipped: NATS not connected yet");return}let Z=async(Y,X)=>{let J=wu6(X);try{await Y.streams.info(OU),await Y.streams.update(OU,J)}catch(G){if(G instanceof Error&&G.message.includes("stream not found"))await Y.streams.add(J),await Y.streams.update(OU,J);else if(G instanceof Error&&/can ?not change.*storage|storage type/i.test(G.message))await Y.streams.delete(OU),await Y.streams.add(J);else throw G}},Q=await f8(async()=>{let Y=this.options.getJetStreamManager?await this.options.getJetStreamManager():await AH.jetstreamManager($),X=Au6($,q68);try{await Z(Y,X)}catch(J){if(X<=1||!Tu6(J))throw J;console.warn(`[Decopilot] StreamBuffer: NATS rejected num_replicas=${X} (${J.message}); falling back to an unreplicated stream`),await Z(Y,1)}return Y},{maxAttempts:5,minTimeout:250,maxTimeout:4000,jitter:0.5,isRetriable:Am});this.js=this.options.getJetStream(),this.jsm=Q,console.log(`[Decopilot] StreamBuffer.init ${this.js?"ready":"degraded (js=null)"}`)}pump($,Z,Q,Y){let X=this.js;if(!X)return console.warn(`[Decopilot] pump: JetStream client unavailable for thread ${Z}; chunks NOT published to NATS`),Promise.resolve();let J=Pu6(Z,Y),G=!1,W=()=>{if(G)return;G=!0;let H=xS$(Z);X.publish(H.subject,H.data).catch(()=>{})};Q.addEventListener("abort",W,{once:!0});let K=(H)=>{let F=performance.now(),U=LZ1(H,{runId:Z}),N=performance.now()-F;iF1().record(N),pF1().add(1,{"org.id":Y??"unknown"}),zu6?.record(N,U.reduce((B,O)=>B+O.data.length,0));for(let B of U)J.publish(X,B.subject,B.data,B.headers?T68(B.headers):void 0)};return(async()=>{let H=$.getReader(),F=0,U=0,N;try{while(!0){let{done:B,value:O}=await H.read();if(B)break;if(K(O),U++,++F>=64)F=0,await new Promise((L)=>setImmediate(L))}}catch(B){N=B,console.warn(`[Decopilot] stream pump error for thread ${Z}:`,B?.message??B)}finally{if(H.releaseLock(),W(),Eu6)console.warn(JSON.stringify({msg:"decopilot-stream-diag",event:"pump-done",taskId:Z,publishedChunks:U,publishErrors:J.errorCount}))}if(N!==void 0)throw N})()}async publishSerialized($,Z){try{return await f8(()=>$.publish(Z.subject,Z.data,{...Z.headers?{headers:T68(Z.headers)}:{},...Z.msgId?{msgID:Z.msgId}:{}}),{maxAttempts:6,minTimeout:250,maxTimeout:5000,jitter:0.5,isRetriable:Am}),!0}catch(Q){return console.error(`[Decopilot] publish failed after retries subject=${Z.subject}`,Q),!1}}async publishRawChunk($,Z,Q){let Y=this.js;if(!Y)return!1;let X=performance.now(),J=LZ1(Z,{runId:$,dedup:Q});iF1().record(performance.now()-X),pF1().add(1);for(let G of J)if(!await this.publishSerialized(Y,G))return!1;return!0}async publishDone($,Z,Q){let Y=this.js;if(!Y)return!1;let X=bS$({runId:$,fenceToken:Z,finalSeq:Q});return await this.publishSerialized(Y,X)}async createTailStream($,Z,Q){let Y=this.js;if(!Y)return console.warn(`[Decopilot] createTailStream: JetStream client unavailable for thread ${$}; no live tail`),null;let X=Q?.deliverPolicy==="new"?AH.DeliverPolicy.New:AH.DeliverPolicy.All,J=Q?.closeOnDone??!1,G=qj($),W;try{W=await f8(async()=>{return(await Y.consumers.get(OU,{filter_subjects:G,deliver_policy:X})).consume()},{maxAttempts:6,minTimeout:250,maxTimeout:5000,jitter:0.5,isRetriable:Am})}catch(L){return console.warn("[Decopilot] JetStream tail unavailable (non-critical):",L?.message??L),null}let F=pT0({messages:async function*(){try{for await(let L of W)yield{subject:L.subject,data:L.data,headers:L.headers}}finally{W.stop()}}(),onCancel:()=>W.stop()}).pipeThrough(cT0()).pipeThrough(mT0()).getReader(),U=!1,N=()=>{if(U)return;U=!0;try{F.releaseLock()}catch{}},B=!1,O=()=>{if(B)return;B=!0,W.stop(),F.cancel().catch(()=>{}),N()};return Z?.addEventListener("abort",O,{once:!0}),new ReadableStream({async pull(L){for(;;){let{done:w,value:j}=await F.read();if(w){O(),L.close();return}let E=j;if(E.kind==="done"){if(J){O(),L.close();return}continue}L.enqueue(E.chunk);return}},cancel(){O()}})}purge($){if(!this.jsm)return;this.jsm.streams.purge(OU,{filter:qj($)}).catch(()=>{})}teardown(){this.js=null,this.jsm=null}}var AH,R68,Uu6=($)=>{let Z;return()=>Z??=$()},Nu6,Bu6=86400000000000,Ou6=120000000000,Du6=4294967296,q68,Lu6=500000,ju6,Eu6,zu6;var I68=D(()=>{B8();wZ1();nT0();dT0();I6();A68();AH=C($N(),1),R68=C(mi(),1),Nu6=Uu6(()=>z$.createCounter("decopilot.stream.publish_errors",{description:"Number of JetStream publish failures for decopilot stream chunks",unit:"{errors}"})),q68=Math.max(1,Number(process.env.DECOPILOT_STREAM_REPLICAS??3)||3);ju6=process.env.STREAM_ENCODE_TRACE==="1",Eu6=process.env.DECOPILOT_STREAM_TRACE==="1";zu6=ju6?new M68:null});function dk0($,Z,Q,Y){if(!Y)return!1;return $.emit(Z,mH(Q,Y.status,{title:Y.title??void 0,virtualMcpId:Y.virtual_mcp_id??void 0,createdBy:Y.created_by??void 0,triggerId:Y.trigger_id??null,branch:Y.branch??null,harnessId:Y.harness_id??void 0,createdAt:Y.created_at,updatedAt:Y.updated_at})),!0}var V68=D(()=>{a8()});class tF1{storage;options;timer=null;constructor($,Z={}){this.storage=$;this.options=Z}start(){if(this.timer)return;let $=this.options.intervalMs??300000;this.timer=setInterval(()=>{this.runOnce()},$)}async runOnce(){let $=this.options.staleAfterMs??3600000;try{let Z=await this.storage.sweepAbandoned($);if(Z>0)console.log(`[async-research-sweeper] marked ${Z} stale jobs as abandoned`);return Z}catch(Z){return console.error("[async-research-sweeper] sweep failed",Z),0}}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}function Ru6($,Z){let Q=$.startsWith("thread:")?sK($):$;return[...new Set([Z,Q].filter((Y)=>!!Y))]}async function k68($,Z){let Q=Z.organizationId;try{let Y=await $.storage.taskBoard.linkedThreadIds(Z.id,Q);for(let X of Y){let J=await XU($,X);if(!J?.owner||!J?.name)continue;let G=await $.storage.threads.get(X),W=await kc($,{threadId:X,runBranch:G?.branch}),K=Ru6(W,await UA0($,X)),H=await He($,Q,h11(J)).catch(()=>null);if(!H){console.warn(`[task-board] no credential for ${J.owner}/${J.name} \u2014 `+`cannot look up ${Z.id}'s change request by branch`);continue}for(let F of K){let U=await H.readForBranch(F).catch(()=>null);if(!U)continue;return await $.storage.taskBoard.linkPr({taskBoardItemId:Z.id,organizationId:Q,url:U.url,prNumber:U.number,repo:H.repo}),await $.storage.taskBoard.openReviewCycleIfInProgress(Z.id,Q),await iG(Q).catch(()=>{}),console.log(`[task-board] ${Z.id}: linked ${U.url} found on branch ${F}`),!0}}}catch(Y){console.error("[task-board] PR lookup by branch failed",Y)}return!1}var S68=D(()=>{uZ();OW();L7()});async function C68($,Z,Q){let Y=Z.organizationId;if(!MJ(Z))return!1;if(!yx(Q))return!1;if(await $.storage.taskBoard.hasHumanRejectedDone(Z.id,Y))return!1;let X=await $.storage.organizationSettings.get(Y),J=iF(X?.flags),G=await $.storage.taskBoard.update(Z.id,Y,{status:J},Z.updatedBy);return await d6($,{taskBoardItemId:Z.id,action:"status_changed",actorId:null,data:{from:Z.status,to:J,reason:"pr_merged"}}),w8(Y,G),console.log(`[task-board-review-sweeper] ${Z.id}: linked PR already merged \u2014 moved to ${J}`),!0}var _68=D(()=>{k4();IY();Gm();YH();M9()});function Cu6($){return $ instanceof DX}function _u6($,Z){return Z-$>=ku6}class oF1{taskBoard;contextFactory;billing;options;timer=null;running=!1;cursor=null;constructor($,Z,Q,Y={}){this.taskBoard=$;this.contextFactory=Z;this.billing=Q;this.options=Y}start(){if(this.timer)return;let $=this.options.intervalMs??qu6;this.timer=setInterval(()=>{this.runOnce()},$),this.timer.unref()}async runOnce(){if(this.running)return 0;this.running=!0;let $=0;try{let Z=this.options.batchSize??Iu6,Q=this.options.itemIntervalMs??Mu6,Y=new Date(Date.now()-Q),X=await this.taskBoard.listItemsPendingReview(Z,this.cursor,Y),J=X.at(-1);this.cursor=X.length===Z&&J?{updatedAt:J.updatedAt,id:J.id}:null;for(let{id:G,organizationId:W}of X)try{if(await this.reconcileItem(G,W,Y))$++}catch(K){console.error(`[task-board-review-sweeper] ${G} failed`,K)}await this.reapNeverStartedThreads(Z),$+=await this.dispatchDueRetries(Z),await this.reactToUnhandledFailures(Z)}catch(Z){console.error("[task-board-review-sweeper] sweep failed",Z)}finally{this.running=!1}return $}async reapNeverStartedThreads($){try{let Z=await this.taskBoard.failNeverStartedLinkedThreads($,new Date(Date.now()-F51),T91);for(let Q of Z)console.warn(`[task-board-review-sweeper] failed never-started thread ${Q.threadId} on ${Q.itemId}`)}catch(Z){console.error("[task-board-review-sweeper] reaping failed",Z)}}async reactToUnhandledFailures($){let Z=await this.taskBoard.listItemsStuckAfterFailure($,new Date(Date.now()-Su6));for(let{id:Q,organizationId:Y,threadId:X}of Z)try{console.warn(`[task-board-review-sweeper] reacting to an unhandled failure on ${Q}`),await z91(this.taskBoard,X,Y),await P91(this.taskBoard,this.billing,X,Y)}catch(J){console.error(`[task-board-review-sweeper] unhandled-failure reaction for ${Q} failed`,J)}}async dispatchDueRetries($){let Z=0,Q=await this.taskBoard.listItemsDueForRetry($,new Date);for(let{id:Y,organizationId:X,attempts:J}of Q)try{if(!await this.taskBoard.claimDueRetry(Y,X,new Date))continue;let G=await this.taskBoard.getById(Y,X);if(!G||G.status!==f$.progress||G.assigneeId!==A8)continue;let W=await this.contextFactory(X,G.assignedBy??G.createdBy);if(!W)continue;await XH(W,G,{runClass:"retry"}),Z++,console.warn(`[task-board-review-sweeper] re-dispatched ${Y} after a failure (attempt ${J})`)}catch(G){if(console.error(`[task-board-review-sweeper] retry dispatch for ${Y} failed`,G),Cu6(G)){await this.returnToTodo(Y,X,G instanceof Error?G.message:String(G));continue}await this.taskBoard.scheduleRunRetry(Y,X,J,new Date(Date.now()+Vu6)).catch((W)=>console.error(`[task-board-review-sweeper] re-arming ${Y} failed`,W))}return Z}async returnToTodo($,Z,Q){try{let Y=await this.taskBoard.getById($,Z);if(!Y||Y.status!==f$.progress)return;let X=await this.taskBoard.returnToTodoAfterFailure($,Z,Y.updatedBy);if(!X)return;await this.taskBoard.recordActivity({taskBoardItemId:$,action:"status_changed",actorId:null,data:{from:"in_progress",to:"todo",reason:Q}}).catch(()=>{}),w8(Z,X)}catch(Y){console.error(`[task-board-review-sweeper] returning ${$} to todo failed`,Y)}}async handOffReviewWithoutPr($,Z){let Q=await this.taskBoard.listActivity(Z.id,Z.organizationId);if(!_u6(RB(Q,Z.reviewCycleStartedAt),Date.now()))return;await UU($,Z,"no pull request is linked to this task \u2014 there is nothing for a "+"reviewer to review")}async reconcileItem($,Z,Q){if(!await this.taskBoard.claimSweep($,Z,Q))return!1;let Y=await this.taskBoard.getById($,Z);if(!Y)return!1;if(!MJ(Y))return!1;let X=Y.assigneeId===A8,J=await this.taskBoard.listPrs($,Z),G=await this.contextFactory(Z,Y.assignedBy??Y.createdBy);if(!G)return!1;if(J.length===0){if(await k68(G,Y))J=await this.taskBoard.listPrs($,Z);if(J.length===0){if(X)await this.handOffReviewWithoutPr(G,Y);return!1}}let W=await Promise.all(J.map(async(K)=>({...K,...await Hm(Z,K)})));if(W.every((K)=>K.state===null))console.warn(`[task-board-review-sweeper] ${$}: no live PR state from GitHub (${W.length} PR(s)) \u2014 proceeding on unknown`);if(await C68(G,Y,W))return!0;if(await hC$(G,Y))return!0;if(await this.resolveConflictFromSweep(G,Y,W))return!0;if(!X)return!1;if(!L91(W))return!1;return await Wm(G,Y,{previewMatchesHead:w91(W)}),!0}async resolveConflictFromSweep($,Z,Q){let Y=Q.find((X)=>X.state!=="closed"&&X.conflict===!0);if(!Y)return!1;return await Pj($,Z.organizationId,Z,{pr:{number:Y.number,url:Y.url},conflict:!0}).catch((X)=>{return console.error("[task-board-review-sweeper] conflict resolve failed",X),!1})}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}var qu6=60000,Mu6=300000,Iu6=50,Vu6=60000,ku6=900000,Su6=120000;var v68=D(()=>{k4();JT0();S68();NU();E10();YH();_68();M9();GW();R91();L7();i00();Km()});import{readdir as vu6,rm as ik0}from"fs/promises";import{join as pk0}from"path";async function nk0($){let Z=new Date;Z.setUTCDate(Z.getUTCDate()-bu6),Z.setUTCHours(0,0,0,0);let Q=0;try{let Y=await Xy($);for(let X of Y)if(/^\d{4}$/.test(X))Q+=await b68($,X,Z);else if(!X.startsWith(".")){let J=pk0($,X),G=await Xy(J);for(let K of G){if(!/^\d{4}$/.test(K))continue;Q+=await b68(J,K,Z)}if((await Xy(J)).length===0)await ik0(J,{recursive:!0,force:!0})}}catch(Y){console.warn("monitoring retention cleanup failed:",Y)}return Q}async function b68($,Z,Q){let Y=0,X=pk0($,Z),J=await Xy(X);for(let W of J){if(!/^\d{2}$/.test(W))continue;let K=pk0(X,W),H=await Xy(K);for(let U of H){if(!/^\d{2}$/.test(U))continue;let N=new Date(`${Z}-${W}-${U}T00:00:00Z`);if(isNaN(N.getTime()))continue;if(N<Q){let B=pk0(K,U);await ik0(B,{recursive:!0,force:!0}),Y++}}if((await Xy(K)).length===0)await ik0(K,{recursive:!0,force:!0})}if((await Xy(X)).length===0)await ik0(X,{recursive:!0,force:!0});return Y}async function Xy($){try{return(await vu6($)).filter((Q)=>!Q.startsWith("."))}catch{return[]}}var bu6=30;var rF1=()=>{};import{DBOS as aF1,SchedulerMode as xu6}from"@dbos-inc/dbos-sdk";async function yu6(){let $=[fW(),By(),nU()],Z=0;for(let Q of $)try{Z+=await nk0(Q)}catch(Y){console.error("[monitoring-retention] cleanup failed:",Y)}return console.log(`[monitoring-retention] deleted ${Z} day-dir(s) across ${$.length} signal dir(s)`),{deleted:Z,dirs:$.length}}async function gu6($,Z){await aF1.runStep(()=>yu6(),{name:"monitoringRetention"})}function f68(){if(x68)return;x68=!0;let $=aF1.registerWorkflow(gu6,{name:"monitoringRetentionWorkflow"});aF1.registerScheduled($,{name:"monitoringRetentionWorkflow",crontab:fu6,mode:xu6.ExactlyOncePerIntervalWhenActive})}var fu6="23 4 * * *",x68=!1;var y68=D(()=>{H3();rF1()});function g68($){return async(Z,Q)=>{let Y=await $.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.role","organization.id as orgId","organization.slug as orgSlug","organization.name as orgName"]).where("member.userId","=",Q).where("member.organizationId","=",Z).executeTakeFirst();if(!Y)return console.warn(`[automationContextFactory] User ${Q} not found in org ${Z} \u2014 returning null`),null;let X=await kQ.create();X.auth.user={id:Q,role:Y.role},X.organization={id:Y.orgId,slug:Y.orgSlug,name:Y.orgName};let J=await DA($.db,Z,Y.role);return X.boundAuth=bW1({auth:X.authInstance,headers:new Headers,role:Y.role,permissions:J,userId:Q}),X.access=new ez(Q,void 0,X.boundAuth,Y.role,"self"),zj(X,{id:Y.orgId,slug:Y.orgSlug}),X}}var h68=D(()=>{HK();cF()});function hu6(){return[{name:"Postgres",status:"pending",port:0},{name:"NATS",status:"pending",port:0}]}function uu6(){return{services:hu6(),migrationsStatus:"pending",serverUrl:null,logs:[]}}function cu6(){for(let $ of lu6)$()}function u68($){let Z=[...sF1.logs,$];sF1={...sF1,logs:Z.length>500?Z.slice(-500):Z},cu6()}function eF1(){return mu6}var sF1,lu6,mu6=!1;var $U1=D(()=>{sF1=uu6(),lu6=new Set});import{EventEmitter as du6}from"events";var ZU1;var l68=D(()=>{$U1();ZU1=new du6;ZU1.on("request",($)=>{u68($)})});function c68(){return async($,Z)=>{let Q=Date.now(),Y=$.req.method,X=$.req.path;if(X==="/api/auth/get-session"||X.includes("favicon")){await Z();return}let J="",G=!1;if(X.startsWith("/mcp")&&Y==="POST"){G=!0;try{if($.req.header("Content-Type")?.includes("application/json")){let N=await $.req.raw.clone().json();if(N.method==="tools/call"&&N.params?.name){let B=Oi(N.params.name),O=N.params.arguments||{},L=Object.keys(O).map((j)=>Oi(j)),w=L.length>0?L.slice(0,3).join(",")+(L.length>3?"\u2026":""):"";J=`${s5.tool}${B}${s5.dim}(${w})${s5.reset}`}else if(N.method)J=`${s5.dim}${Oi(N.method)}${s5.reset}`}}catch{}}let W=Oi(X);if(X.startsWith("/mcp/conn_")){let F=X.split("/")[2]??"";W=`/mcp/${s5.mcp}${Oi(F.slice(0,12))}\u2026${s5.reset}`}else if(X==="/mcp")W=`${s5.mcp}/mcp${s5.reset}`;else if(X==="/mcp/registry")W=`${s5.mcp}/mcp/registry${s5.reset}`;let K=pu6(Y),H=G?"\u25C0":"\u2190";if(!eF1())console.log(`${s5.dim}${H}${s5.reset} ${K}${Y}${s5.reset} ${W}${J?` ${J}`:""}`);try{await Z()}finally{let F=Date.now()-Q,U=$.res.status,N=iu6(U),B=F<1000?`${F}ms`:`${(F/1000).toFixed(1)}s`,O=G?"\u25B6":"\u2192";if(!eF1())console.log(`${s5.dim}${O}${s5.reset} ${K}${Y}${s5.reset} ${W}${J?` ${J}`:""} ${N}${U}${s5.reset} ${s5.duration}${B}${s5.reset}`);ZU1.emit("request",{method:Y,path:Oi(X),status:U,duration:F,timestamp:new Date})}}}var s5,iu6=($)=>{if($>=500)return s5.serverError;if($>=400)return s5.clientError;if($>=300)return s5.redirect;return s5.ok},pu6=($)=>{return s5[$]||s5.reset},Oi=($)=>{return $.replace(/\r/g,"").replace(/\n/g,"").replace(/\x1b\[[0-9;]*m/g,"").replace(/[\x00-\x1f\x7f-\x9f]/g,"")};var m68=D(()=>{$U1();l68();s5={reset:"\x1B[0m",dim:"\x1B[2m",bold:"\x1B[1m",GET:"\x1B[36m",POST:"\x1B[33m",PUT:"\x1B[35m",DELETE:"\x1B[31m",ok:"\x1B[32m",redirect:"\x1B[36m",clientError:"\x1B[33m",serverError:"\x1B[31m",mcp:"\x1B[35m",tool:"\x1B[96m",duration:"\x1B[90m"}});import{createHmac as n68}from"crypto";import{mkdir as nu6,readdir as tu6,rm as d68,stat as t68}from"fs/promises";import{join as YU1,relative as ou6}from"path";import{z as o$}from"zod";function r68($){let Z=$.replace(/[^a-zA-Z0-9_-]/g,"_");return YU1(ru6,Z)}function a68($){return $.replace(/^\/+/,"").replace(/\.\./g,"")}function QU1($,Z){let Q=r68($),Y=a68(Z);return YU1(Q,Y)}function au6($,Z,Q,Y){let X=E0().encryptionKey||"dev-secret",J=`${$}:${Z}:${Q}:${Y}`;return n68("sha256",X).update(J).digest("hex")}function p68($,Z,Q,Y,X){let J=Math.floor(Date.now()/1000)+Y,G=au6(Z,Q,J,X),W=new URL(`/api/dev-assets/${Z}/${a68(Q)}`,$);return W.searchParams.set("expires",J.toString()),W.searchParams.set("signature",G),W.searchParams.set("method",X),W.toString()}function s68($,Z,Q){let Y=`${$}:${Z.getTime()}:${Q}`;return`"${n68("md5","etag").update(Y).digest("hex")}"`}async function e68($,Z,Q,Y,X){try{let J=await tu6($,{withFileTypes:!0});for(let G of J){let W=YU1($,G.name),H=ou6(Z,W).replace(/\\/g,"/");if(Q&&!H.startsWith(Q))continue;if(G.isDirectory())if(Y){let F=H+"/";if(!Q||F.startsWith(Q)){if(!(Q?H.slice(Q.length):H).includes("/"))X.commonPrefixes.add(F)}}else await e68(W,Z,Q,Y,X);else if(G.isFile()){if(Y&&Q){let F=H.slice(Q.length);if(F.includes(Y)){let U=F.indexOf(Y),N=Q+F.slice(0,U+1);X.commonPrefixes.add(N);continue}}try{let F=await t68(W);X.objects.push({key:H,size:F.size,lastModified:F.mtime.toISOString(),etag:s68(W,F.mtime,F.size)})}catch{}}}}catch{}}function $58($,Z){let Y=K0($).id;return[{name:"LIST_OBJECTS",description:"List objects in the local assets directory with pagination support",inputSchema:o$.object({prefix:o$.string().optional(),maxKeys:o$.number().optional().default(1000),continuationToken:o$.string().optional(),delimiter:o$.string().optional()}),outputSchema:o$.object({objects:o$.array(o$.object({key:o$.string(),size:o$.number(),lastModified:o$.string(),etag:o$.string()})),nextContinuationToken:o$.string().optional(),isTruncated:o$.boolean(),commonPrefixes:o$.array(o$.string()).optional()}),handler:async(X)=>{let J=X,G=J.prefix||"",W=J.maxKeys??1000,K=J.delimiter,H=J.continuationToken,F=r68(Y);await nu6(F,{recursive:!0});let U={objects:[],commonPrefixes:new Set};await e68(F,F,G,K,U),U.objects.sort((w,j)=>w.key.localeCompare(j.key));let N=0;if(H){if(N=U.objects.findIndex((w)=>w.key>H),N===-1)N=U.objects.length}let B=U.objects.slice(N,N+W),O=N+W<U.objects.length,L=O?B[B.length-1]?.key:void 0;return{objects:B,isTruncated:O,nextContinuationToken:L,commonPrefixes:Array.from(U.commonPrefixes).sort()}}},{name:"GET_OBJECT_METADATA",description:"Get metadata for a file in the local assets directory",inputSchema:o$.object({key:o$.string()}),outputSchema:o$.object({contentType:o$.string().optional(),contentLength:o$.number(),lastModified:o$.string(),etag:o$.string(),metadata:o$.record(o$.string(),o$.string()).optional()}),handler:async(X)=>{let J=X,G=QU1(Y,J.key),W=await t68(G);return{contentType:CK1(J.key),contentLength:W.size,lastModified:W.mtime.toISOString(),etag:s68(G,W.mtime,W.size)}}},{name:"GET_PRESIGNED_URL",description:"Generate a presigned URL for downloading a file from local storage",inputSchema:o$.object({key:o$.string(),expiresIn:o$.number().optional()}),outputSchema:o$.object({url:o$.string(),expiresIn:o$.number()}),handler:async(X)=>{let J=X,G=J.expiresIn??i68;return{url:p68(Z,Y,J.key,G,"GET"),expiresIn:G}}},{name:"PUT_PRESIGNED_URL",description:"Generate a presigned URL for uploading a file to local storage",inputSchema:o$.object({key:o$.string(),expiresIn:o$.number().optional(),contentType:o$.string().optional()}),outputSchema:o$.object({url:o$.string(),expiresIn:o$.number()}),handler:async(X)=>{let J=X,G=J.expiresIn??i68;return{url:p68(Z,Y,J.key,G,"PUT"),expiresIn:G}}},{name:"DELETE_OBJECT",description:"Delete a single file from local storage",inputSchema:o$.object({key:o$.string()}),outputSchema:o$.object({success:o$.boolean(),key:o$.string()}),handler:async(X)=>{let J=X,G=QU1(Y,J.key);try{return await d68(G),{success:!0,key:J.key}}catch{return{success:!1,key:J.key}}}},{name:"DELETE_OBJECTS",description:"Delete multiple files from local storage",inputSchema:o$.object({keys:o$.array(o$.string()).max(1000)}),outputSchema:o$.object({deleted:o$.array(o$.string()),errors:o$.array(o$.object({key:o$.string(),message:o$.string()}))}),handler:async(X)=>{let J=X,G=[],W=[];return await Promise.all(J.keys.map(async(K)=>{let H=QU1(Y,K);try{await d68(H),G.push(K)}catch(F){W.push({key:K,message:F instanceof Error?F.message:"Unknown error"})}})),{deleted:G,errors:W}}}]}async function XU1($,Z,Q){let Y=$58(Z,Q),X=new LL({name:"dev-assets-mcp",version:"1.0.0"},{capabilities:{tools:{}},jsonSchemaValidator:LZ});for(let G of Y){let W="shape"in G.inputSchema?G.inputSchema.shape:o$.object({}).shape,K=G.outputSchema&&"shape"in G.outputSchema?G.outputSchema.shape:o$.object({}).shape;X.registerTool(G.name,{description:G.description??"",inputSchema:W,outputSchema:K,annotations:G.annotations,_meta:G._meta},async(H)=>{try{let F=await G.handler(H);return{content:[{type:"text",text:JSON.stringify(F)}],structuredContent:F}}catch(F){return{content:[{type:"text",text:`Error: ${F.message}`}],isError:!0}}})}let J=new rG({enableJsonResponse:$.headers.get("Accept")?.includes("application/json")??!1});return await X.connect(J),TW(X,J,$,"mcp:dev-assets")}async function Z58($,Z,Q,Y){let J=$58(Q,Y).find((G)=>G.name===$);if(!J)return{content:[{type:"text",text:`Tool not found: ${$}`}],isError:!0};try{let G=await J.handler(Z);return{content:[{type:"text",text:JSON.stringify(G)}]}}catch(G){return{content:[{type:"text",text:G instanceof Error?G.message:String(G)}],isError:!0}}}var ru6="./data/assets",i68=3600,o68,Q58;var Y58=D(()=>{U$();km();X8();CY0();Vm();nX();fV0();o68=new Y1;o68.all("/",async($)=>{let Z=$.get("studioContext"),Q=new URL($.req.url),Y=`${Q.protocol}//${Q.host}`;return XU1($.req.raw,Z,Y)});Q58=o68});var X58={};A6(X58,{mountDevRoutes:()=>su6});function su6($,Z){$.all("/mcp/:connectionId{.*_dev-assets$}",Z,async(Y)=>{let X=Y.get("studioContext"),J=new URL(Y.req.url),G=`${J.protocol}//${J.host}`;return XU1(Y.req.raw,X,G)}),$.all("/mcp/:connectionId{.*_dev-assets$}/call-tool/:toolName",Z,async(Y)=>{let X=Y.get("studioContext"),J=new URL(Y.req.url),G=`${J.protocol}//${J.host}`,W=Y.req.param("toolName");if(!W)return Y.json({error:"Missing tool name"},400);let K=await Y.req.json(),H=await Z58(W,K,X,G);if(H.isError)return Y.json(H.content,500);return Y.json(H.content)}),$.use("/mcp/dev-assets",Z),$.route("/mcp/dev-assets",Q58);let Q=new Y1;Q.use("*",zH({mountPath:"/api/dev-assets"})),Q.route("/",xV0({orgFromPath:!1})),$.route("/api/dev-assets",Q)}var J58=D(()=>{X8();RK1();fV0();Y58()});var D58={};A6(D58,{watchHandler:()=>O58,resolveCorsOrigin:()=>N58,isSsoExemptPath:()=>F58,isAllowedOAuthRedirectUri:()=>B58,createApp:()=>Kl6});import{readFileSync as eu6}from"fs";import{PrometheusSerializer as $l6}from"@opentelemetry/exporter-prometheus";import{DBOS as VO}from"@dbos-inc/dbos-sdk";import{oAuthDiscoveryMetadata as Yl6,oAuthProtectedResourceMetadata as Xl6}from"better-auth/plugins";async function Zl6($){let Z=$.connect(),Q;try{Q=await Promise.race([Z,W58(G58)])}catch{return Z.then((Y)=>Y.release(!0)).catch(()=>{}),!1}try{return await Promise.race([Q.query("SELECT 1"),W58(G58)]),Q.release(),!0}catch{return Q.release(!0),!1}}function W58($){return new Promise((Z,Q)=>setTimeout(()=>Q(Error("pg health-check timeout")),$))}function F58($){return $.startsWith("/api/org-sso/")||/^\/api\/[^/]+\/sso\//.test($)||$.startsWith("/api/auth/")||$.startsWith("/api/tools/management")||$.startsWith("/oauth-proxy/")||/^\/api\/[^/]+\/oauth-proxy\//.test($)||$.startsWith(`${PV0}/`)||$.startsWith(`${LV0}/`)}function U58($){return $==="local.studio.decocms.com"}function N58($,{baseUrl:Z,requestOrigin:Q}){let Y;try{Y=new URL($).hostname}catch{return null}if(Y==="localhost"||Y==="127.0.0.1")return $;if(U58(Y))return $;let X=Z??Q;try{if(new URL(X).origin===$)return $}catch{}return null}function B58($,Z){return $.origin===new URL(Z).origin||$.hostname==="localhost"||U58($.hostname)}async function Kl6($={}){let Z=$.database??V8(),Q=!1;U9.stop().catch((Q0)=>{console.error("[SSEHub] Error stopping previous broadcast (HMR cleanup):",Q0)});let Y,X,J,G,W=new cF1,K,H,F,U=null;if($.disableNats)K=mF1(),Y={get:async()=>null,set:async()=>{},invalidate:async()=>{},teardown:()=>{}},X=null,J=null,G=new V10,H={start:async()=>{},broadcast:()=>{},stop:async()=>{}},F={init:async()=>{},pump:(Q0)=>{return(async()=>{let w0=Q0.getReader();try{while(!0){let{done:e}=await w0.read();if(e)break}}catch{}finally{w0.releaseLock()}})()},publishRawChunk:async()=>!1,publishDone:async()=>!1,createTailStream:async()=>null,purge:()=>{},teardown:()=>{}};else{U=L68();let Q0=E0().natsCredsPath,w0;if(Q0)try{w0=eu6(Q0,"utf8")}catch(f0){console.error(`[app] failed to read NATS_CREDS at ${Q0}; connecting anonymously`,f0)}U.init(E0().natsUrls,w0?{creds:w0}:void 0);let e=Ce0()?new Oe0({getJetStream:()=>U.getJetStream()}):null;e?.init().catch(()=>{}),Y=e;let i=new M41({getJetStream:()=>U.getJetStream()});i.init().catch(()=>{}),X=i;let m0=new hx(F91,{getJetStream:()=>U.getJetStream()}),I0=new hx(p00,{getJetStream:()=>U.getJetStream()});m0.init().catch(()=>{}),I0.init().catch(()=>{}),J={reads:m0,cards:I0};let o0=new l71({getJetStream:()=>U.getJetStream()});o0.init().catch(()=>{}),G=o0,K=mF1({getConnection:()=>U.getConnection()}),H=new dF1({getConnection:()=>U.getConnection()}),F=new nF1({getConnection:()=>U.getConnection(),getJetStream:()=>U.getJetStream()}),Aa$(U),U.onReady(()=>{e?.init().catch((f0)=>{console.error("[McpListCache] Deferred init failed:",f0)}),i.init().catch((f0)=>{console.error("[SkillCatalogCache] Deferred init failed:",f0)}),m0.init().catch((f0)=>{console.error("[PrReadCache] Deferred init failed:",f0)}),I0.init().catch((f0)=>{console.error("[PrCardCache] Deferred init failed:",f0)}),o0.init().catch((f0)=>{console.error("[ConnectionCircuitStore] Deferred init failed:",f0)}),K.start(),WK$(()=>U.getConnection()),F.init().catch((f0)=>{console.warn("[Decopilot] StreamBuffer init failed (late-join disabled):",f0)})})}if(GE)await GE();De0(Y),V41(X),U91(J),c71(G);let B={storage:new eg(Z.db),sseHub:U9,onThreadFinished:async(Q0,w0)=>Um(new dG(Z.db),Q0,w0,new FG(Z.db))},O=new TZ1(B),L=new t$0(Z.db),w=new tF1(L);w.start(),yC$(H),H.start((Q0)=>{CT0(Q0),O.execute({type:"CANCEL",taskId:Q0}).catch((w0)=>{console.error("[Decopilot] CancelBroadcast execute failed:",w0)})}).catch((Q0)=>{console.error("[Decopilot] CancelBroadcast start failed:",Q0)}),U?.onReady(()=>{H.start().catch((Q0)=>{console.error("[CancelBroadcast] Deferred start failed:",Q0)})});let j=()=>U?.getConnection()??null;zK1(j),U?.onReady(()=>zK1(j)),zQ1(j),U?.onReady(()=>zQ1(j)),F.init().catch((Q0)=>{console.warn("[Decopilot] StreamBuffer init failed, attach/late-join disabled:",Q0)}),GE=async()=>{await O.stopAll(),O.dispose(),w.dispose(),H.stop().catch(()=>{}),vs$(),F.teardown(),Y?.teardown(),X?.teardown(),J?.reads.teardown(),J?.cards.teardown(),W.teardown(),K.teardown(),KK$(),G.teardown(),De0(null),V41(null),U91(null),c71(null)};let E=new Y1;if(E.use("*",g71({enabled:(Q0)=>xd(Q0,"debug")==="1"})),E.use("*",DS0),E.use("/*",wa$({origin:(Q0,w0)=>N58(Q0,{baseUrl:E0().baseUrl,requestOrigin:new URL(w0.req.url).origin}),credentials:!0,allowMethods:["GET","POST","PUT","DELETE","OPTIONS"],allowHeaders:["Content-Type","Authorization","mcp-protocol-version"],exposeHeaders:["WWW-Authenticate"]})),E.use("*",async(Q0,w0)=>{if(await w0(),Q0.req.path.includes("/files/"))return;if(Q0.req.path.includes("/fs/")&&Q0.req.path.endsWith("/read"))return;Q0.header("X-Frame-Options","DENY"),Q0.header("Content-Security-Policy","frame-ancestors 'none'")}),!E0().noTui)E.use("*",c68());E.use("*",async(Q0,w0)=>{if(await w0(),Ri(Q0.req.path))return;if(Q0.res.status>=500){let i=await Q0.res.clone().text();console.error(`[5xx Response] ${Q0.req.method} ${Q0.req.path} - ${Q0.res.status}:`,i)}}),E.get(gY.HEALTH,(Q0)=>{if(Q)return Q0.json({status:"shutting_down"},503);return Q0.json({status:"ok"})}),E.get(gY.HEALTH_LIVE,(Q0)=>{return Q0.json({status:"ok"})}),E.get(gY.HEALTH_READY,async(Q0)=>{if(Q)return Q0.json({status:"shutting_down"},503);let w0={};if(w0.postgres={status:await Zl6(Z.pool)?"up":"down"},U)w0.nats=U.isConnected()?{status:"up"}:{status:"down"};else w0.nats={status:"down"};let e=w0.postgres.status==="up",i=e?200:503;return Q0.json({status:e?"ready":"not_ready",services:w0},i)}),E.get(gY.METRICS,async(Q0)=>{try{let w0=await ES0.collect(),e=Ql6.serialize(w0.resourceMetrics);return Q0.text(e,200,{"Content-Type":"text/plain; version=0.0.4; charset=utf-8"})}catch(w0){return console.error("Failed to collect metrics:",w0),Q0.text("# Error collecting metrics",500)}});let z=1800000;E.get(`${gY.DBOS_QUEUE_DEPTH_PREFIX}:queueName`,async(Q0)=>{let w0=Q0.req.param("queueName");if(!Jl6.has(w0))return Q0.json({error:`Unknown queue: ${w0}`},404);let[e,i]=await Promise.all([VO.listQueuedWorkflows({queueName:w0,status:"ENQUEUED",loadInput:!1,loadOutput:!1}),VO.listQueuedWorkflows({queueName:w0,status:"PENDING",loadInput:!1,loadOutput:!1,dequeuedAfter:new Date(Date.now()-z).toISOString()})]);return Q0.json({queue_length:e.length,in_flight:i.length})}),E.route("/api/config",q48),E.route("/api/_reports",f48),E.route("/api/_stripe",gF1),E.route("/api/_github",h48({taskBoard:()=>n,contextFactory:()=>g})),E.route("/api/_git",md);let T={db:Z.db,encryptionKey:E0().encryptionKey};E.route("/api/_jira",m48(T)),E.route("/api/_jira",l48(T)),E.route("/report",v48($.clientDir)),E.route("/api/auth/custom",ca$),E.route("/api/auth/desktop",pa$),E.all("/api/auth/admin/*",Es$),E.all("/api/auth/*",async(Q0)=>{return await k8.handler(Q0.req.raw)});let P=oo$();P.use("/.well-known/oauth-protected-resource/mcp/:connectionId",K80),P.use("/mcp/:connectionId/.well-known/oauth-protected-resource",K80),E.route("/",P),E.get("/.well-known/oauth-protected-resource/api/:org/mcp/:connectionId",d$0),E.route("/",$r$()),E.use("/oauth-proxy/:connectionId/*",K80),E.all("/oauth-proxy/:connectionId/*",K58);let A=async(Q0)=>{let e=await Gl6()(Q0.req.raw),i=await e.json();return Response.json(i,e)};E.use("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",K80),E.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",A);let q=async(Q0)=>{let e=await Wl6()(Q0.req.raw),i=await e.json();return Response.json(i,e)};E.get("/.well-known/oauth-authorization-server/*/:gateway?/:connectionId?",q);let x=Ea$({ttlMs:120000}),_=await dr$({db:Z.db,auth:k8,encryption:{key:E0().encryptionKey},observability:{tracer:yO,meter:z$},modelListCache:W,providerKeyCache:K,memberRoleCache:x});kQ.set(_),Zc1({db:Z.db,baseUrl:_5()}),ir$({db:Z.db}),or$({db:Z.db}),Ya$({db:Z.db}),p48({db:Z.db,encryptionKey:E0().encryptionKey}),OI$({db:Z.db}),Ha$({db:Z.db}),yI$({db:Z.db});let V=zQ0(Z.db),y=new Zo(Z.db),g=g68({db:Z.db});b71({storage:V,studioContextFactory:g}),vZ1({systemDatabaseUrl:xt0(E0().databaseUrl,E0().databasePgSsl),studioContextFactory:g,deps:{runRegistry:O,cancelBroadcast:H,streamBuffer:F,sseHub:U9}}),MZ1({dispatchRunFn:IS$,studioContextFactory:g,deps:{runRegistry:O,cancelBroadcast:H,streamBuffer:F,sseHub:U9}});let l=new eg(Z.db),n=new dG(Z.db),p=new FG(Z.db),F0=new oF1(n,g,p);if(E0().taskBoardReviewSweeperEnabled){F0.start();let Q0=GE;GE=async()=>{await Q0?.(),F0.dispose()}}tS$({getJetStream:()=>U?.getJetStream()??null,getJetStreamManager:async()=>{let Q0=U?.getConnection();return Q0?await H58.jetstreamManager(Q0):null},messageParts:l.messageParts(),resolveRun:async(Q0)=>{let w0=await Z.db.selectFrom("threads").select(["organization_id","created_by","message_storage_version","status","run_fence_token","title"]).where("id","=",Q0).executeTakeFirst();return w0?{orgId:w0.organization_id,createdBy:w0.created_by,version:w0.message_storage_version??1,status:w0.status,runFenceToken:w0.run_fence_token,title:w0.title??null}:null},completeRunIfNotCompleted:async(Q0,w0)=>{let e=await l.completeRunIfNotCompleted(Q0,w0);if(dk0(U9,w0,Q0,e),e)await Um(n,Q0,w0,p);return e},markRunRequiresAction:async(Q0,w0)=>{let e=await l.requiresActionIfInProgress(Q0,w0);return dk0(U9,w0,Q0,e),e},markRunFailed:async(Q0,w0,e,i)=>{let m0=await l.markRunFailed(Q0,w0,e,i);if(dk0(U9,w0,Q0,m0),m0)await Um(n,Q0,w0,p);return m0},clearSynthesizedError:async(Q0,w0)=>{await l.messageParts().replaceMessageParts(Q0,Rj(Q0,w0),[])},persistTitle:(Q0,w0,e)=>l.update(Q0,w0,{title:e}),onTitleUpdated:async({runId:Q0,orgId:w0,title:e})=>{let i=await l.get(Q0,w0).catch(()=>null);U9.emit(w0,mH(Q0,i?.status??"in_progress",{title:e,virtualMcpId:i?.virtual_mcp_id??void 0,createdBy:i?.created_by,triggerId:i?.trigger_id,branch:i?.branch??null,harnessId:i?.harness_id??void 0,createdAt:i?.created_at,updatedAt:i?.updated_at}))},bumpProgress:async({runId:Q0,orgId:w0})=>{await l.bumpProgress(Q0,w0)},recordCompleted:async({runId:Q0,orgId:w0,distinctId:e,usage:i})=>{y1.capture({distinctId:e,event:"chat_message_completed",groups:{organization:w0},properties:{organization_id:w0,thread_id:Q0,transport:"projector",input_tokens:i.inputTokens,output_tokens:i.outputTokens,total_tokens:i.totalTokens}})},recordFailed:async({runId:Q0,orgId:w0,distinctId:e,reason:i,kind:m0})=>{y1.capture({distinctId:e,event:"chat_message_failed",groups:{organization:w0},properties:{organization_id:w0,thread_id:Q0,transport:"projector",error_category:m0,error_message:i}})},purgeRun:async(Q0)=>{F.purge(Q0)}}),ek$({studioContextFactory:g,systemDatabaseUrl:xt0(E0().databaseUrl,E0().databasePgSsl),streamBuffer:F}),f68(),Qc1(),nr$(),ar$(),Ja$(),o48(),EI$(),Ua$(),gI$();let V0=async(Q0,w0,e)=>{let i=await V.findById(Q0,w0);if(!i)throw Error("Automation not found");return y71({automationId:i.id,organizationId:i.organization_id,triggerId:null})},G0=new ld(V,({automation:Q0,trigger:w0,contextMessages:e,idempotencyKey:i})=>I10({automationId:Q0.id,organizationId:Q0.organization_id,triggerId:w0.id,contextMessages:e},{idempotencyKey:i})),H0=[fW(),By(),nU()];for(let Q0 of H0)nk0(Q0).then(()=>{}).catch((w0)=>console.error("[monitoring] Retention cleanup failed:",w0));let X0=()=>k8.api.deleteAllExpiredApiKeys().catch((Q0)=>console.error("[auth] Expired API key cleanup failed:",Q0));X0(),setInterval(X0,86400000).unref(),E.use("*",async(Q0,w0)=>{if(BS0(Q0.req.path))return w0();let e={measure:async(m0,I0)=>{AW(Q0,m0);try{return await I0()}finally{aG(Q0,m0)}}},i=await kQ.create(Q0.req.raw,{timings:e});i.automationRunner=V0,Q0.set("studioContext",i);try{await w0()}finally{let m0=i.pendingRevalidations;if(m0.length>0)Promise.race([Promise.allSettled(m0),m$(30000)]).catch((o0)=>console.error("[studio] revalidation cleanup error:",o0))}}),E.use("/api/:org/decopilot/*",yd),E.use("/api/:org/v1/*",yd),E.use("/api/:org/files/*",yd),E.use("*",async(Q0,w0)=>{if(F58(Q0.req.path))return w0();let e=Q0.get("studioContext");if(!e?.organization?.id||!e?.auth?.user?.id)return w0();if(!(await e.storage.orgSsoConfig.getByOrgId(e.organization.id))?.enforced)return w0();if(!await e.storage.orgSsoSessions.isValid(e.auth.user.id,e.organization.id))return Q0.json({error:"SSO authentication required for this organization"},403);return w0()});let Z0=new Y1;Z0.use("*",zH({mountPath:"/api/org-sso"})),Z0.route("/",RV0()),E.route("/api/org-sso",Z0),E.get("/api/tools/management",(Q0)=>{return Q0.json({tools:Li0,grouped:sz()})}),E.use("/mcp/*",async(Q0,w0)=>{AW(Q0,"mcp");try{return await w0()}finally{aG(Q0,"mcp")}});let Y0=async(Q0,w0)=>{let e=Q0.var.studioContext;if(!e.auth.user?.id&&!e.auth.apiKey?.id){let i=new URL(Q0.req.url),m0=Q0.req.header("x-forwarded-proto")?.split(",")[0]?.trim(),I0=m0?`${m0}://${i.host}`:i.origin;return Q0.res=new Response(null,{status:401,headers:{"WWW-Authenticate":`Bearer realm="mcp",resource_metadata="${I0}${i.pathname}/.well-known/oauth-protected-resource"`}})}return await w0()};if(E.use("/mcp/:connectionId?",Y0),E.use("/mcp/gateway/:virtualMcpId?",Y0),E.use("/mcp/virtual-mcp/:virtualMcpId?",Y0),E.use("/mcp/self",Y0),$W()){let{mountDevRoutes:Q0}=(J58(),ZS0(X58));Q0(E,Y0)}let o=new Y1;o.use("*",zH({mountPath:"/mcp"})),o.route("/",PR0()),E.route("/mcp",o);let J0=new Y1;J0.use("*",zH({mountPath:"/mcp/self"})),J0.route("/",Bk0()),E.route("/mcp/self",J0);let c0=new Y1;c0.use("*",zH({mountPath:"/mcp"})),c0.route("/",RR0()),E.route("/mcp",c0),E.use("/api/:org/models/*",async(Q0,w0)=>{AW(Q0,"llm_models");try{return await w0()}finally{aG(Q0,"llm_models")}});let k0=xs$({cancelBroadcast:H,streamBuffer:F,runRegistry:O});E.route("/api",k0),E.route("/api",e48);let E1=new Y1;E1.use("*",zH({mountPath:"/api"})),E1.route("/",wk0()),E.route("/api",E1),E.route("/api",j48);let d0=new Y1;d0.use("*",zH({mountPath:"/api"})),d0.route("/",jk0({tokenStorage:y,automationEventDispatcher:G0})),E.route("/api",d0);let L0=new Yo(Z.db),j0=new Y1;j0.use("*",zH({mountPath:"/api"})),j0.route("/",kV0()),E.route("/api",j0),E.route("/api/deco-sites",os$()),E.route("/api/deco-apps",N48());let e0=new Y1;e0.use("*",zH({mountPath:"/api/deco-sites"})),e0.route("/",CV0()),E.route("/api/deco-sites",e0),E.route(PV0,zs$()),E.route(I$8,S$8()),E.route("/api/_editor-resolve",z48()),E.route(ta$,oa$()),E.route(LV0,Js$());let A1=F48({kvStorage:L0,runRegistry:O,streamBuffer:F,sseHub:U9,cancelBroadcast:H,tokenStorage:y,automationEventDispatcher:G0,mountDevAssets:$W(),mcpAuth:Y0,oauthProxyHandler:K58,watchHandler:O58,betterAuthProtectedResourceHandler:A,getNatsConnection:()=>U?.getConnection()??null});return E.route("/api/:org",A1),E.notFound((Q0)=>{return Q0.json({error:"Not Found",path:Q0.req.path},404)}),E.onError(gs$),Object.assign(E,{markShuttingDown:()=>{Q=!0},shutdown:async()=>{if(console.log("[shutdown] Stopping workers..."),await Promise.allSettled([U9.stop(),GE?Promise.resolve(GE()).finally(()=>{GE=null}):Promise.resolve()]),U)await U.drain().catch((Q0)=>console.error("[shutdown] NATS drain error:",Q0));console.log("[shutdown] Flushing telemetry..."),await CX().catch((Q0)=>console.error("[shutdown] Telemetry flush error:",Q0)),console.log("[shutdown] Closing database..."),await r8$(Z).catch((Q0)=>console.error("[shutdown] Database close error:",Q0)),console.log("[shutdown] Cleanup complete.")},initDbos:async()=>{await VO.registerQueue(K3,{partitionQueue:!0,concurrency:C71,minPollingIntervalMs:_71}),await VO.registerQueue(W3,{partitionQueue:!0,concurrency:CZ1,priorityEnabled:!0}),await VO.registerQueue(iU,{workerConcurrency:E0().decopilotMaxConcurrentHostedRuns,priorityEnabled:!0}),await VO.registerQueue(pU,{workerConcurrency:E0().sandboxMaxConcurrentHostedRuns,priorityEnabled:!0}),await VO.registerQueue(xO,{partitionQueue:!0,concurrency:sk$}),await VO.registerQueue(UE,fI$),await qK1(V),await Promise.allSettled(["automations-gate","automations-global","jira-push"].map((Q0)=>VO.deleteQueue(Q0))),await v71(Z.pool),L9$().catch((Q0)=>{console.error("[studio-pack-backfill] failed:",Q0)}),Yc1().catch((Q0)=>{console.error("[org-fs] public-sets boot sync kick failed:",Q0)})}})}var H58,G58=5000,GE=null,K58=async($)=>{let Z=$.req.param("connectionId");if(!Z)return $.json({error:"Missing connectionId"},400);let Q=$.req.path.split("/").filter(Boolean),Y=Q[Q.length-1],X=$.get("studioContext");if(!X)X=await kQ.create($.req.raw),$.set("studioContext",X);let J=$.req.param("org")?X.organization?.id:void 0,G=await X.storage.connections.findById(Z,J);if(!G?.connection_url)return $.json({error:"Connection not found"},404);if(Y==="register"&&G.oauth_config?.clientId){let y=await $.req.json().catch(()=>({}));return $.json({...typeof y==="object"&&y!==null?y:{},client_id:G.oauth_config.clientId,...G.oauth_config.clientSecret?{client_secret:G.oauth_config.clientSecret}:{},client_secret_expires_at:0})}let W=await Cd(G.connection_url),K,H=new URL(G.connection_url),U=(typeof G.metadata?.oauthResource==="string"&&G.metadata.oauthResource.length>0?G.metadata.oauthResource:void 0)??G.connection_url;if(W.ok)K=(await W.json()).authorization_servers?.[0];if(!K)K=H.origin;let N=await i$0(K);if(!N.ok)return $.json({error:"Failed to get auth server metadata"},502);let B=await N.json(),O;if(Y==="authorize")O=B.authorization_endpoint;else if(Y==="token")O=B.token_endpoint;else if(Y==="register")O=B.registration_endpoint;if(!O)return $.json({error:`Unknown OAuth endpoint: ${Y}`},404);let L=eo$(O);if(L)return L;let w=new URL(O),j=new URL($.req.url);if(w.search=j.search,Y==="authorize"){let y=w.searchParams.get("redirect_uri");if(y){let g=E0().baseUrl??j.origin;try{if(!B58(new URL(y),g))return $.json({error:"invalid_request",error_description:"redirect_uri is not allowed"},400)}catch{return $.json({error:"invalid_request",error_description:"redirect_uri is malformed"},400)}w.searchParams.set("redirect_uri",y)}if(w.searchParams.has("resource"))w.searchParams.set("resource",U);if(Ba$(G.connection_url))w.searchParams.set("auto_personal","true"),w.searchParams.set("force_new","true");return $.redirect(w.toString(),302)}let E={Accept:$.req.header("Accept")||"application/json"},z=$.req.header("Content-Type");if(z)E["Content-Type"]=z;let T=$.req.header("Authorization");if(T)E.Authorization=T;let P,A=null,q=null;if($.req.method!=="GET"&&$.req.method!=="HEAD")if(Y==="token"&&z?.includes("application/x-www-form-urlencoded")){if(T?.toLowerCase().startsWith("basic "))try{let p=atob(T.slice(6).trim()),F0=p.indexOf(":");if(F0!==-1){let V0=decodeURIComponent(p.slice(0,F0)),G0=decodeURIComponent(p.slice(F0+1));A=V0||null,q=G0||null}}catch{}let y=await $.req.formData();if(y.has("resource"))y.set("resource",U);let g=y.get("client_id"),l=y.get("client_secret");if(typeof g==="string"&&g)A=g;if(typeof l==="string"&&l)q=l;let n=new URLSearchParams;for(let[p,F0]of y.entries())n.append(p,F0.toString());P=n.toString()}else if(Y==="register"&&z?.toLowerCase().includes("application/json")){let y=await X.db.selectFrom("organization").select(["id","slug","name"]).where("id","=",G.organization_id).executeTakeFirst(),g=await $.req.text(),l={};try{l=g?JSON.parse(g):{}}catch{P=g}let n=typeof l==="object"&&l!==null&&!Array.isArray(l);if(P===void 0&&!n)P=g;if(P===void 0){let p=l,F0=p.metadata&&typeof p.metadata==="object"?p.metadata:{};p.metadata={...F0,organization_id:G.organization_id,...y?.slug?{organization_slug:y.slug}:{},...y?.name?{organization_name:y.name}:{}},P=JSON.stringify(p),E["Content-Type"]="application/json"}}else P=$.req.raw.body??void 0;let x=await fetch(w.toString(),{method:$.req.method,headers:E,body:P,duplex:"half",redirect:"manual"}),_=new Headers,V=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];for(let[y,g]of x.headers.entries())if(!V.includes(y.toLowerCase()))_.set(y,g);if(Y==="token"&&x.ok){let y=await x.text();try{let g=JSON.parse(y);if(typeof g.access_token==="string"&&g.access_token){let l=typeof g.expires_in==="number"?new Date(Date.now()+g.expires_in*1000):null,n=null;try{n=await _d(G.connection_url)??O}catch{n=O}let p={connectionId:Z,accessToken:g.access_token,refreshToken:typeof g.refresh_token==="string"?g.refresh_token:null,scope:typeof g.scope==="string"?g.scope:null,expiresAt:l,clientId:A,clientSecret:q,tokenEndpoint:n};await new W9(X.db,X.vault).upsert(p)}}catch(g){console.error("[oauth-proxy] failed to persist downstream token:",g)}return new Response(y,{status:x.status,statusText:x.statusText,headers:_})}return new Response(x.body,{status:x.status,statusText:x.statusText,headers:_})},O58=async($)=>{let Z=$.var.studioContext;if(!(Z.auth.user?.id??Z.auth.apiKey?.userId))return $.json({error:"Unauthorized"},401);let Y=Z.organization?.id;if(!Y)return $.json({error:"organization id missing"},400);let X=$.req.query("types"),J=X?X.split(",").map((W)=>W.trim()).filter(Boolean):null,G=crypto.randomUUID();return RO($,async(W)=>{if(await W.writeSSE({event:"connected",data:JSON.stringify({listenerId:G,organizationId:Y,typePatterns:J,connectedAt:new Date().toISOString()})}),!U9.add({id:G,organizationId:Y,typePatterns:J?.length?J:null,push:(F)=>{W.writeSSE({id:F.id,event:F.type,data:JSON.stringify(F)}).catch(()=>{U9.remove(Y,G)})}})){await W.writeSSE({event:"error",data:JSON.stringify({error:"Too many connections",message:"SSE connection limit reached. Try again later."})});return}let H=setInterval(()=>{W.writeSSE({event:"keepalive",data:""}).catch(()=>{clearInterval(H)})},30000);await new Promise((F)=>{W.onAbort(()=>{clearInterval(H),U9.remove(Y,G),F()})})})},Ql6,Jl6,Gl6=()=>Xl6(k8),Wl6=()=>Yl6(k8);var L58=D(()=>{B8();U$();Xc1();tr$();sr$();Ga$();v10();n51();Na$();i00();w9();ml();a8();X8();UV0();ja$();h71();vG();cF();rW1();g3();I6();K6();YK1();na$();ra$();Gs$();HK1();Ps$();wK1();fs$();TK1();uK();tI0();RK1();hs$();BV0();U48();VK1();B48();AR0();k10();E48();qR0();YF1();P48();ZF1();M48();b48();y48();g48();u48();c48();d48();r48();vK1();$68();QF1();sH1();F40();w68();FJ();qA0();B91();Ms();Vs();d71();j68();z68();PK1();I68();RZ1();V68();gn();Jo();aB();M9();LW1();v68();y68();XJ0();rF1();H3();MK1();rB();PZ1();XJ0();lT0();Xi0();Ji0();h68();$u();m68();Ji();rW1();zm();_T0();H58=C($N(),1);Ql6=new $l6,Jl6=new Set([K3,W3,iU,pU,xO,UE])});var z58={};A6(z58,{resolveClientDir:()=>Dl6,resolveAssetPathWithTraversalCheck:()=>E58,isPathWithinDirectory:()=>j58,createAssetHandler:()=>Ll6});import{resolve as o80,dirname as Hl6,join as Fl6,extname as Ul6,basename as Nl6,sep as w58}from"path";function Bl6($,Z){if($===Z||Nl6($)==="index.html")return{"Cache-Control":"no-cache"};if($.includes(`${w58}assets${w58}`))return{"Cache-Control":"public, max-age=31536000, immutable"};return{}}function j58($,Z){let Q=o80(Z),Y=o80($);return Y===Q||Y.startsWith(Q+"/")}function E58({requestPath:$,clientDir:Z}){let Q=$.startsWith("/")?$.slice(1):$,Y=o80(Z,Q);if(!j58(Y,Z))return null;return Y}function Dl6($,Z="../client"){let Q=new URL($),Y=Hl6(Q.pathname);return o80(Y,Z)}function Ll6($={}){let{env:Z="production",clientDir:Q=Ol6,isServerPath:Y=()=>!1}=$;if(Z==="development")return async function(J){return null};return async function(J){if(J.method!=="GET")return null;let G=new URL(J.url),W;try{W=decodeURIComponent(G.pathname)}catch{return null}if(Y(W))return null;let K=E58({requestPath:W,clientDir:Q});if(!K)return null;let H=Fl6(K,"index.html"),F=o80(Q,"index.html"),U=J.headers.get("accept"),B=U?.includes("text/html")||U?.includes("*/*")&&["",".html"].includes(Ul6(K))?[H,F]:[];for(let O of[K,...B])try{let L=Bun.file(O);if(await L.exists())return new Response(L,{headers:Bl6(O,F)})}catch{}if(W.includes("/assets/"))return new Response("Not Found",{status:404,headers:{"Cache-Control":"no-store"}});return null}}var Ol6="./dist/client";var P58=()=>{};var A58={};A6(A58,{tryUpgradePreviewWs:()=>Tl6,tryHandlePreviewHttp:()=>Al6,previewWebSocketHandler:()=>Rl6,parsePreviewBaseDomain:()=>Pl6,isPreviewWsData:()=>tk0,extractHandleFromHost:()=>JU1});function El6($){if($.method!=="GET")return!1;return($.headers.get("accept")??"").includes("text/html")}function zl6(){return new Response(jl6,{status:503,headers:{"content-type":"text/html; charset=utf-8","cache-control":"no-store","retry-after":"1","access-control-allow-origin":"*"}})}function Pl6($){if(!$||$.trim()==="")return null;let Z=$.includes("{handle}")?$.replace("{handle}","__handle__"):$,Q;try{Q=new URL(Z)}catch{return null}let Y=Q.hostname;if($.includes("{handle}")){let X=Y.indexOf(".");if(X<=0||X===Y.length-1)return null;return Y.slice(X+1)}return Y}function JU1($,Z){if(!$||!Z)return null;let Q=$.indexOf(":"),Y=(Q>=0?$.slice(0,Q):$).toLowerCase(),J=`.${Z.toLowerCase().replace(/^\.+|\.+$/g,"")}`;if(!Y.endsWith(J))return null;let G=Y.slice(0,Y.length-J.length);if(!G||G.includes("."))return null;return G}async function Al6($,Z){let Q=JU1($.headers.get("host"),Z.baseDomain);if(!Q)return null;let Y=await Z.getRunner();if(!Y)return a80(503,"preview proxy not configured");let X=await Y.proxyPreviewRequest(Q,$);if(X.headers.get(Bx)&&El6($))return zl6();return X.headers.delete(Bx),X}function a80($,Z){return new Response(JSON.stringify({error:Z}),{status:$,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function tk0($){return typeof $==="object"&&$!==null&&$.kind==="preview"}async function Tl6($,Z,Q){if(($.headers.get("upgrade")??"").toLowerCase()!=="websocket")return null;let Y=JU1($.headers.get("host"),Q.baseDomain);if(!Y)return null;let X=await Q.getRunner();if(!X)return a80(503,"preview proxy not configured");let J=await X.resolvePreviewUpstreamUrl(Y);if(!J)return a80(404,"sandbox not found");let G=new URL($.url);if(G.pathname.startsWith("/_sandbox"))return a80(404,"not found");let W=`${J.replace(/^http/,"ws")}${G.pathname}${G.search}`,K=$.headers.get("sec-websocket-protocol"),H=K?K.split(",").map((N)=>N.trim()).filter(Boolean):[],F={kind:"preview",upstreamUrl:W,upstreamProtocols:H,pending:[],upstream:null,closed:!1};if(!Z.upgrade($,{data:F}))return a80(426,"upgrade failed");return}function r80($,Z,Q,Y){if(Z.closed)return;Z.closed=!0;try{$.close(Q,Y)}catch{}try{Z.upstream?.close()}catch{}}var wl6=256,jl6='<!DOCTYPE html><html><head><meta charset="utf-8"><title>Connecting\u2026</title><style>body{font-family:system-ui,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0;background:#fafafa;color:#555}div{text-align:center;max-width:420px;padding:24px}h3{margin:0 0 8px}p{margin:0;font-size:14px;color:#999;line-height:1.5}</style></head><body><div><h3>Connecting to sandbox\u2026</h3><p>Waiting for the sandbox to come online. This page refreshes automatically.</p></div><script>setTimeout(function(){window.location.reload()},1500)</script></body></html>',Rl6;var T58=D(()=>{G41();Rl6={open($){let Z=$.data;if(!tk0(Z))return;let Q;try{Q=Z.upstreamProtocols.length>0?new WebSocket(Z.upstreamUrl,Z.upstreamProtocols):new WebSocket(Z.upstreamUrl)}catch(Y){console.warn(`[preview-ws] failed to dial upstream ${Z.upstreamUrl}: ${Y instanceof Error?Y.message:String(Y)}`),r80($,Z,1011,"upstream connect failed");return}Q.binaryType="arraybuffer",Z.upstream=Q,Q.addEventListener("open",()=>{while(Z.pending.length>0){let Y=Z.pending.shift();if(Y!==void 0)Q.send(Y)}}),Q.addEventListener("message",(Y)=>{if(Z.closed)return;$.send(Y.data)}),Q.addEventListener("close",(Y)=>{r80($,Z,Y.code||1000,Y.reason||"")}),Q.addEventListener("error",()=>{r80($,Z,1011,"upstream error")})},message($,Z){let Q=$.data;if(!tk0(Q))return;let Y=Q.upstream;if(Y&&Y.readyState===WebSocket.OPEN){Y.send(Z);return}if(Q.pending.length>=wl6){r80($,Q,1011,"preview ws backlog overflow");return}Q.pending.push(Z)},close($){let Z=$.data;if(!tk0(Z))return;r80($,Z,1000,"")}}});var I58={};A6(I58,{printBanner:()=>Ml6,bannerLines:()=>M58,BANNER_LINES:()=>R58,BANNER_GRADIENT:()=>q58});function ql6($){let Z=Number.parseInt($.slice(1),16);return[Z>>16&255,Z>>8&255,Z&255]}function M58($){let Z=R58.map((Q,Y)=>{let[X,J,G]=ql6(q58[Y]);return`\x1B[38;2;${X};${J};${G}m${Q}\x1B[39m`});if($!==void 0)Z.push(`\x1B[2m  v${$}\x1B[22m`);return Z}function Ml6($){console.log("");for(let Z of M58($))console.log(Z);console.log("")}var R58,q58;var V58=D(()=>{R58=[" \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588     \u2588\u2588\u2588\u2588\u2588\u2588\u2588   ","\u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588 "," \u2591\u2588\u2588\u2588   \u2591\u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588  \u2588 \u2591  \u2588\u2588\u2588     \u2591\u2591\u2591  \u2588\u2588\u2588     \u2591\u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2588\u2588\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2591\u2591\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2588\u2588\u2588  \u2591\u2588\u2588\u2588 \u2591   \u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588 "," \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588  \u2591\u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2591  ","\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591     \u2591\u2591\u2591\u2591\u2591\u2591\u2591   "],q58=["#00ff64","#00ee5e","#00dc56","#00c84e","#00b444","#00a03c","#008832","#006e28"]});B8();var jU1="13";function EU1($){return{name:"decocms",systemDatabaseUrl:$.systemDatabaseUrl,systemDatabaseSchemaName:"dbos",systemDatabasePoolSize:$.poolSize,runAdminServer:!1,executorID:$.executorID,applicationVersion:jU1,...$.listenQueues!==void 0?{listenQueues:$.listenQueues}:{}}}B8();import p58 from"pg";var zU1=8314027461559302n,n58=600000,t58=500;async function PU1($,Z){let{databaseUrl:Q,lockTimeoutMs:Y=n58}=$,X=$.log??((K)=>console.log(K)),J=new p58.Client({connectionString:Q});await J.connect();let G=Date.now(),W=!1;try{while(!W){if(W=(await J.query("SELECT pg_try_advisory_lock($1) AS locked",[zU1.toString()])).rows[0]?.locked===!0,W)break;if(Date.now()-G>=Y)throw Error(`Timed out after ${Y}ms waiting for the DBOS migration lock. Another process is still migrating the dbos schema; this pod will restart and retry.`);await m$(t58)}let K=Date.now()-G;if(K>1000)X(`[dbos] waited ${K}ms for the migration lock; another process migrated first`);return await Z()}finally{if(W)try{await J.query("SELECT pg_advisory_unlock($1)",[zU1.toString()])}catch{}await J.end().catch(()=>{})}}U$();JS0();I6();function p98(){let $=(process.env.BUN_OPTIONS??"").split(/\s+/).filter(Boolean);return[...process.argv.slice(1),...$]}function AS0($,Z){for(let Q=0;Q<$.length;Q++){let Y=$[Q];if(Y===void 0)continue;if(Y===Z)return $[Q+1];if(Y.startsWith(`${Z}=`))return Y.slice(Z.length+1)}return}function XN1(){let $=p98();if($.includes("--cpu-prof")){console.log(JSON.stringify({msg:"cpu-profiling-active",dir:AS0($,"--cpu-prof-dir")??process.cwd(),name:AS0($,"--cpu-prof-name"),markdown:$.includes("--cpu-prof-md"),intervalUs:Number(AS0($,"--cpu-prof-interval")??1000),note:"profile is written on process exit"}));return}if(process.env.CPU_PROFILE)console.warn(JSON.stringify({msg:"cpu-profiling-requested-but-inactive",hint:'CPU profiling is a Bun launch flag. Set BUN_OPTIONS="--cpu-prof --cpu-prof-md --cpu-prof-dir=/tmp" before starting the process.'}))}qS0();var B40;function BN1(){if(process.env.HEAP_WATCH!=="1")return()=>{};let $=Number(process.env.HEAP_WATCH_INTERVAL_MS??60000),Z=async()=>{let Q=OE();if(!Q)return;let Y={};try{let{heapStats:X}=await import("bun:jsc"),J=X(),G=Object.entries(J.objectTypeCounts).sort((W,K)=>K[1]-W[1]).slice(0,20);Y={objectCount:J.objectCount,heapSize:J.heapSize,top:Object.fromEntries(G)}}catch{}console.log(JSON.stringify({msg:"heap-watch",ts:new Date().toISOString(),uptimeS:Math.round(process.uptime()),rss:Q.rss,heapUsed:Q.heapUsed,heapTotal:Q.heapTotal,external:Q.external,arrayBuffers:Q.arrayBuffers,...Y}))};return Z().catch(()=>{}),B40=setInterval(()=>void Z().catch(()=>{}),$),B40.unref?.(),process.on("SIGUSR2",()=>{try{let Q=Bun.generateHeapSnapshot("v8"),Y=typeof Q==="string"?Q:JSON.stringify(Q),X=`/tmp/heap-${process.pid}-${Date.now()}.heapsnapshot`;Bun.write(X,Y),console.log(JSON.stringify({msg:"heap-snapshot-written",path:X}))}catch(Q){console.error("[heap-watch] snapshot failed:",Q)}}),()=>{if(B40)clearInterval(B40)}}import*as o98 from"bun:jsc";var{startSamplingProfiler:r98,samplingProfilerStackTraces:a98}=o98;function ON1(){if(process.env.STALL_WATCHDOG!=="1")return()=>{};let $=Number(process.env.STALL_WATCHDOG_MS??100),Z=Number(process.env.STALL_WATCHDOG_TICK_MS??50);try{r98()}catch(J){return console.error("[stall-watchdog] failed to start sampling profiler:",J),()=>{}}let Q,Y=performance.now()+Z,X=()=>{let J=performance.now(),G=J-Y;Y=J+Z;let W=[];try{W=a98()?.traces??[]}catch{}if(G>$&&W.length>0){let K=new Map;for(let F of W){let U=F.frames.find((O)=>O.sourceURL&&!/Unknown Executable/.test(O.category??""))??F.frames[0];if(!U)continue;let N=(U.sourceURL??"?").replace(/^.*\/node_modules\//,"node_modules/"),B=`${U.name??"?"} @ ${N}:${U.line??"?"}`;K.set(B,(K.get(B)??0)+1)}let H=[...K.entries()].sort((F,U)=>U[1]-F[1]).slice(0,8).map(([F,U])=>({frame:F,count:U}));console.warn(JSON.stringify({msg:"stall-stack",ts:new Date().toISOString(),lagMs:Math.round(G),samplesInWindow:W.length,top:H}))}Q=setTimeout(X,Z),Q.unref?.()};return Q=setTimeout(X,Z),Q.unref?.(),()=>{if(Q)clearTimeout(Q)}}function DN1(){XN1();let $=[BN1(),NN1(),ON1()];return()=>{for(let Z of $)Z()}}import{existsSync as bl6}from"fs";var lJ=E0();ZN1();var{DBOS:s80,DBOSClient:Il6}=await import("@dbos-inc/dbos-sdk");function UU1($,Z){if(!Z)return $;let Q=new URL($);if(!Q.searchParams.has("sslmode"))Q.searchParams.set("sslmode","verify-full");return Q.toString()}var Vl6=[K3,W3,iU,pU,xO,UE],kl6=lJ.dispatchRole==="worker"?Vl6:lJ.dispatchRole==="api"?[]:void 0;s80.setConfig(EU1({systemDatabaseUrl:UU1(lJ.databaseUrl,lJ.databasePgSsl),poolSize:lJ.dbosPoolSize,executorID:lJ.podName,listenQueues:kl6}));var{createApp:Sl6}=await Promise.resolve().then(() => (L58(),D58)),{isServerPath:Cl6}=await Promise.resolve().then(() => (F40(),gU1)),{createAssetHandler:_l6,resolveClientDir:v58}=await Promise.resolve().then(() => (P58(),z58)),vl6=lJ.port,k58=v58(import.meta.url,"../client"),b58=bl6(k58)?k58:v58(import.meta.url,"../dist/client"),xl6=_l6({clientDir:b58,isServerPath:Cl6}),fl6={"X-Frame-Options":"DENY","Content-Security-Policy":"frame-ancestors 'none'"};function yl6($){let Z=new Headers($.headers);for(let[Q,Y]of Object.entries(fl6))Z.set(Q,Y);return new Response($.body,{status:$.status,statusText:$.statusText,headers:Z})}var{parsePreviewBaseDomain:gl6,tryHandlePreviewHttp:hl6,tryUpgradePreviewWs:ul6,previewWebSocketHandler:GU1,isPreviewWsData:WU1}=await Promise.resolve().then(() => (T58(),A58)),{getOrInitSharedRunner:x58}=await Promise.resolve().then(() => (aK(),rj$)),f58=gl6(process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN),S58={baseDomain:f58??"",getRunner:x58};if(process.env.STUDIO_SANDBOX_TENANT_POOLS?.trim())x58().catch(($)=>{console.warn("[lifecycle] eager sandbox provider init for tenant pools failed:",$ instanceof Error?$.message:String($))});var ok0=await Sl6({clientDir:b58}),KU1=process.env.DBOS_CONDUCTOR_KEY?.trim(),C58=process.env.DBOS_CONDUCTOR_URL?.trim();await PU1({databaseUrl:UU1(lJ.databaseUrl,lJ.databasePgSsl)},()=>s80.launch({...KU1?{conductorKey:KU1}:{},...KU1&&C58?{conductorURL:C58}:{}}));console.log(`[dbos] application version: ${s80.applicationVersion}`);var HU1=5,FU1=0;await f8(async()=>{FU1++;try{return await ok0.initDbos()}catch($){let Z=FU1>=HU1?"giving up":"retrying";throw console.warn(`[dbos] initDbos attempt ${FU1}/${HU1} failed, ${Z}`,$),$}},{maxAttempts:HU1,minTimeout:1000,maxTimeout:1e4,jitter:0.5});if(!lJ.isCli){let{bannerLines:$}=await Promise.resolve().then(() => (V58(),I58));console.log("");for(let Z of $())console.log(Z)}var ll6=Bun.serve({idleTimeout:0,port:vl6,hostname:"0.0.0.0",fetch:async($,Z)=>{if(f58){let Y=await ul6($,Z,S58);if(Y===void 0)return;if(Y)return Y;let X=await hl6($,S58);if(X)return X}let Q=await xl6($);if(Q)return yl6(Q);return ok0.fetch($,{server:Z})},websocket:{open($){if(WU1($.data))GU1.open($)},message($,Z){if(WU1($.data))GU1.message($,Z)},close($){if(WU1($.data))GU1.close($)}},development:!1}),cl6=DN1();if(lJ.localMode)Promise.resolve().then(() => (cx(),ET0)).then(async({seedLocalMode:$,markSeedComplete:Z,healLocalJwks:Q})=>{try{let Y=await Q();if(Y>0)console.log(`[local-mode] cleared ${Y} undecryptable JWKS key(s); Better Auth will generate a fresh one`);let X=await $()}catch(Y){console.error("Failed to seed local mode:",Y)}finally{Z()}}).catch(async($)=>{console.error("Failed to load local-mode module:",$);try{let{markSeedComplete:Z}=await Promise.resolve().then(() => (cx(),ET0));Z()}catch{}});var _58=!1;async function ml6($){let Z;try{Z=await Il6.create({systemDatabaseUrl:UU1(lJ.databaseUrl,lJ.databasePgSsl),systemDatabaseSchemaName:"dbos"});let Q=await Z.listWorkflows({status:"PENDING",queueName:W3,executorId:$,loadInput:!1,loadOutput:!1});if(Q.length===0){console.log(`[shutdown] no in-flight thread-gate gates to hand off (executor ${$})`);return}let Y=Q.map((X)=>X.workflowID);await Z.resumeWorkflows(Y,{queueName:W3}),console.log(`[shutdown] re-enqueued ${Y.length} in-flight thread-gate gate(s) for re-adoption by a live executor (from ${$}):`,Y)}catch(Q){console.error("[shutdown] thread-gate handoff failed:",Q)}finally{await Z?.destroy().catch(()=>{})}}async function rk0($){if(_58)return;_58=!0,console.log(`
 [shutdown] Received ${$}, shutting down gracefully...`);let Z=Number(process.env.SHUTDOWN_GRACE_SECONDS??60)*1000,Q=Math.max(Z-5000,1e4),Y=setTimeout(()=>{console.error(`[shutdown] Timed out after ${Q}ms, forcing exit.`),process.exit(1)},Q);Y.unref?.();let X=0;try{cl6(),ok0.markShuttingDown();let J=TU1(lJ.dispatchRole,Q,process.env.SHUTDOWN_DRAIN_MS);await m$(J),await ll6.stop(!0);let G=s80.executorID;await s80.shutdown(),await ml6(G),await ok0.shutdown()}catch(J){console.error("[shutdown] Error during shutdown:",J),X=1}clearTimeout(Y),process.exit(X)}process.on("SIGTERM",()=>rk0("SIGTERM"));process.on("SIGINT",()=>rk0("SIGINT"));process.on("SIGHUP",()=>rk0("SIGHUP"));process.on("unhandledRejection",($)=>{console.error("[process] Unhandled rejection:",$)});process.on("uncaughtException",($)=>{console.error("[process] Uncaught exception:",$),rk0("uncaughtException")});