decocms 4.393.2 → 4.394.1

package/dist/server/cli.js

@@ -2105,7 +2105,7 @@ Usage: deco services <up|down|status>`),process.exit(1)}}var t8$=L(()=>{ph()});f
       `.execute($);if(Number(W.rows[0]?.cnt)===0){console.warn(`Failed to migrate ${G}/${K}, keeping in old table`);continue}}await El`
       DELETE FROM kysely_migration WHERE name = ${Q}
     `.execute($)}}async function R7$($){await lK4($),await cK4($);let Z=new T7$({db:$,provider:{getMigrations:()=>Promise.resolve(O11)}}),{error:Q,results:X}=await Z.migrateToLatest(),Y=0;if(X?.forEach((J)=>{if(J.status==="Success")Y++;else if(J.status==="Error")console.error(`Failed to execute migration "${J.migrationName}"`)}),Q)throw console.error("Failed to migrate"),console.error(Q),Q;return Y}async function mK4($){let{keepOpen:Z=!1,database:Q,skipBetterAuth:X=!1}=$??{},Y="skipped";if(!X&&!Q)Y=await Ma0();let J=Q??W8(),G=async()=>{if(!Z&&!Q)await pD(J).catch((K)=>{console.warn("Warning: Error closing database:",K)})};try{let K=await R7$(J.db);return await G(),{betterAuth:Y,kysely:K}}catch(K){throw await G(),K}}async function dK4(){let $=W8(),Z=new T7$({db:$.db,provider:{getMigrations:()=>Promise.resolve(O11)}}),{error:Q,results:X}=await Z.migrateDown();if(X?.forEach((Y)=>{if(Y.status==="Success")console.log(`\u2705 Migration "${Y.migrationName}" rolled back successfully`);else if(Y.status==="Error")console.error(`\u274C Failed to rollback migration "${Y.migrationName}"`)}),Q)throw console.error("Failed to rollback migration"),console.error(Q),Q}var M7$=L(()=>{P7$();Ia0();LX()});async function N30($){let Z={...process.env},Q=Z70($,Z);console.log(aI1(Q.settings.encryptionKey));let X=Q.settings.betterAuthSecret||(Q.settings.localMode?M6$(Q.settings.dataDir):""),{ensureServices:Y}=await Promise.resolve().then(() => (BG0(),NG0)),{outputs:J,services:G}=await Y({home:Q.settings.dataDir,externalDatabaseUrl:Q.externalDatabaseUrl,externalNatsUrl:Q.externalNatsUrl});if(!Q.skipMigrations){let{migrateBetterAuth:W}=await Promise.resolve().then(() => (Ia0(),V6$));await W(J.databaseUrl);let{createDatabase:H}=await Promise.resolve().then(() => (LX(),d4$)),{migrateToLatest:F}=await Promise.resolve().then(() => (M7$(),q7$)),U=H(J.databaseUrl);await F({keepOpen:!0,database:U,skipBetterAuth:!0})}let K={...Q.settings,betterAuthSecret:X,databaseUrl:J.databaseUrl,natsUrls:J.natsUrls,...J.s3?{s3Endpoint:J.s3.endpoint,s3Bucket:J.s3.bucket,s3AccessKeyId:J.s3.accessKeyId,s3SecretAccessKey:J.s3.secretAccessKey,s3ForcePathStyle:J.s3.forcePathStyle}:{}};return o8$(K),{settings:K,services:G.map((W)=>({name:W.name==="PostgreSQL"?"Postgres":W.name,port:W.port})),managedServiceNames:G.filter((W)=>W.owner==="managed").map((W)=>W.name)}}var D11=L(()=>{ph();I6$();H$()});var S7$={};K0(S7$,{updateService:()=>KT,subscribeCliState:()=>E11,setTuiConsoleIntercepted:()=>B30,setServerUrl:()=>sa,setMigrationsDone:()=>ra,setDevMode:()=>pK4,resetCliStateForTests:()=>iK4,isTuiConsoleIntercepted:()=>L30,getCliState:()=>j11,addLogEntry:()=>sD});function I7$(){return[{name:"Postgres",status:"pending",port:0},{name:"NATS",status:"pending",port:0}]}function V7$(){return{services:I7$(),migrationsStatus:"pending",serverUrl:null,logs:[]}}function iK4(){NJ=V7$()}function aa(){for(let $ of w11)$()}function j11(){return NJ}function E11($){return w11.add($),()=>w11.delete($)}function KT($){NJ={...NJ,services:NJ.services.map((Z)=>Z.name===$.name?$:Z)},aa()}function ra(){NJ={...NJ,migrationsStatus:"done"},aa()}function sa($){NJ={...NJ,serverUrl:$},aa()}function sD($){let Z=[...NJ.logs,$];NJ={...NJ,logs:Z.length>500?Z.slice(-500):Z},aa()}function pK4(){NJ={...NJ,services:[...I7$(),{name:"API",status:"pending",port:0},{name:"Vite",status:"pending",port:0}]},aa()}function B30($){k7$=$}function L30(){return k7$}var NJ,w11,k7$=!1;var WT=L(()=>{NJ=V7$();w11=new Set});import{createServer as C7$}from"net";function nK4($){return new Promise((Z)=>{let Q=C7$();Q.once("error",()=>Z(!1)),Q.listen($,"0.0.0.0",()=>{Q.close(()=>Z(!0))})})}async function ea($){if(await nK4($))return $;let Z=await new Promise((Q,X)=>{let Y=C7$();Y.once("error",X),Y.listen(0,"0.0.0.0",()=>{let J=Y.address(),G=typeof J==="object"&&J?J.port:0;Y.close(()=>Q(G))})});return console.warn(`Port ${$} is in use, using port ${Z} instead.`),Z}var z11=()=>{};var T11={};K0(T11,{startDevServer:()=>oK4,pipeToLogStore:()=>P11});import{join as tK4}from"path";function P11($){let Z=$.getReader(),Q=new TextDecoder,X="";function Y(){let J=X.split(`
-`);X=J.pop()??"";for(let G of J){let K=Bun.stripANSI(G).replace(/^\[\d+\]\s*/,"").trim();if(!K)continue;sD({method:"",path:"",status:0,duration:0,timestamp:new Date,rawLine:K})}}(async()=>{try{for(;;){let{done:J,value:G}=await Z.read();if(J)break;X+=Q.decode(G,{stream:!0}),Y()}}catch{}if(X.trim()){let J=Bun.stripANSI(X).replace(/^\[\d+\]\s*/,"").trim();if(J)sD({method:"",path:"",status:0,duration:0,timestamp:new Date,rawLine:J})}})()}async function oK4($){let{baseUrl:Z,noTui:Q}=$,X=process.env.HOST==="0.0.0.0"&&Boolean(process.env.PORT),Y=X?process.env.PORT:$.vitePort,J=Z||`http://localhost:${Y}`,G=X?await ea(Number(Y)+1):await ea(Number($.port)),{settings:K,services:W,managedServiceNames:H}=await N30({port:String(G),home:$.home,baseUrl:$.baseUrl,localMode:$.localMode,skipMigrations:$.skipMigrations,noTui:$.noTui,vitePort:$.vitePort});for(let D of W)KT({name:D.name,status:"ready",port:D.port});ra();let F=tK4(import.meta.dir,"..","..","..","..",".."),U=Q===!0,N=Bun.spawn(["bun","run","dev:servers"],{cwd:F,env:{...process.env,PORT:String(K.port),VITE_PORT:String(Y),DATABASE_URL:K.databaseUrl,NATS_URL:K.natsUrls.join(","),NODE_ENV:K.nodeEnv,BASE_URL:J,DECOCMS_LOCAL_MODE:String(K.localMode),DECOCMS_HOME:K.dataDir,DATA_DIR:K.dataDir,DECO_CLI:"1",...K.betterAuthSecret?{BETTER_AUTH_SECRET:K.betterAuthSecret}:{},...K.s3Endpoint?{S3_ENDPOINT:K.s3Endpoint,S3_BUCKET:K.s3Bucket??"",S3_ACCESS_KEY_ID:K.s3AccessKeyId??"",S3_SECRET_ACCESS_KEY:K.s3SecretAccessKey??"",S3_FORCE_PATH_STYLE:String(K.s3ForcePathStyle)}:{},...K.natsCredsPath?{NATS_CREDS:K.natsCredsPath}:{}},stdio:["inherit",U?"inherit":"pipe",U?"inherit":"pipe"]});if(!U)P11(N.stdout),P11(N.stderr);sa(J),KT({name:"Vite",status:"ready",port:Number(Y)}),KT({name:"API",status:"ready",port:Number(K.port)});let O=async(D)=>{if(N.kill(D),await N.exited,H.length>0){let{stopServices:w}=await Promise.resolve().then(() => (BG0(),NG0));await w(K.dataDir)}};return process.on("SIGINT",()=>O("SIGINT")),process.on("SIGTERM",()=>O("SIGTERM")),{port:Number(Y),process:N}}var A11=L(()=>{D11();WT();z11()});var O30;var R11=L(()=>{O30={name:"decocms",version:"4.393.2",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js","db:migrate:dbos":"bun run ./dist/server/migrate-dbos.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts","migrate:dbos":"bun run src/database/migrate-dbos.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^4.0.58","@ai-sdk/google":"^4.0.76","@ai-sdk/openai":"^4.0.71","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^3.1.0","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^4.0.17","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^7.0.107","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});import{Box as rK4,Text as _7$}from"ink";import{jsx as sK4,jsxs as v7$}from"react/jsx-runtime";function x7$({version:$}){return v7$(rK4,{flexDirection:"column",marginTop:1,children:[bG0.map((Z,Q)=>sK4(_7$,{color:yG0[Q],children:Z},Q)),v7$(_7$,{dimColor:!0,children:[" v",$]})]})}var f7$=L(()=>{fa()});import{Box as HT,Text as eD}from"ink";import{Spinner as eK4}from"@inkjs/ui";import{jsx as CG,jsxs as zl}from"react/jsx-runtime";function b7$({status:$}){if($==="pending")return CG(eK4,{label:""});return CG(eD,{color:"green",children:"\u2713"})}function $W4($){return`${$.name}: ${$.port||"...."}`}function y7$({services:$,migrationsStatus:Z,home:Q,serverUrl:X}){return zl(HT,{flexDirection:"column",paddingBottom:1,children:[CG(x7$,{version:O30.version}),CG(HT,{marginBottom:1,children:CG(eD,{dimColor:!0,children:"\u2500".repeat(80)})}),CG(HT,{children:zl(eD,{dimColor:!0,children:["Home: ",Q]})}),zl(HT,{gap:2,children:[$.map((Y)=>zl(HT,{gap:1,children:[CG(eD,{children:$W4(Y)}),CG(b7$,{status:Y.status})]},Y.name)),zl(HT,{gap:1,children:[CG(eD,{children:"Migrations"}),CG(b7$,{status:Z})]})]}),CG(HT,{children:X?zl(eD,{children:["Open in browser: ",CG(eD,{color:"cyan",children:X})]}):CG(eD,{dimColor:!0,children:"Starting..."})})]})}var g7$=L(()=>{R11();f7$()});import{Box as ZW4,Text as $r}from"ink";import{jsx as q11,jsxs as M11}from"react/jsx-runtime";function QW4($){if($>=500)return"red";if($>=400)return"yellow";if($>=300)return"cyan";return"green"}function h7$({logs:$}){return q11(ZW4,{flexDirection:"column",children:$.map((Z,Q)=>{if(Z.rawLine)return q11($r,{dimColor:!0,children:Z.rawLine},Q);let X=Z.duration<1000?`${Z.duration}ms`:`${(Z.duration/1000).toFixed(1)}s`;return M11($r,{children:[M11($r,{dimColor:!0,children:[Z.method.padEnd(6)," ",Z.path.padEnd(30)," "]}),q11($r,{color:QW4(Z.status),children:Z.status}),M11($r,{dimColor:!0,children:[" ",X.padStart(8)]})]},Q)})})}var u7$=()=>{};var I11={};K0(I11,{App:()=>JW4});import{Box as XW4}from"ink";import{useSyncExternalStore as YW4}from"react";import{jsx as l7$,jsxs as GW4}from"react/jsx-runtime";function JW4({home:$}){let Z=YW4(E11,j11);return GW4(XW4,{flexDirection:"column",children:[l7$(y7$,{services:Z.services,migrationsStatus:Z.migrationsStatus,home:$,serverUrl:Z.serverUrl}),l7$(h7$,{logs:Z.logs})]})}var V11=L(()=>{g7$();u7$();WT()});var WK="thread-gate",fB="decopilot-hosted-harness",bB="decopilot-hosted-harness-sandboxed",HK="automations",$w="background-tools",FT="task-board-github-reads";var c7$="13";function m7$($){return{name:"decocms",systemDatabaseUrl:$.systemDatabaseUrl,systemDatabaseSchemaName:"dbos",systemDatabasePoolSize:$.poolSize,runAdminServer:!1,executorID:$.executorID,applicationVersion:c7$,...$.listenQueues!==void 0?{listenQueues:$.listenQueues}:{}}}var d7$=()=>{};import KW4 from"pg";async function p7$($,Z){let{databaseUrl:Q,lockTimeoutMs:X=WW4}=$,Y=$.log??((W)=>console.log(W)),J=new KW4.Client({connectionString:Q});await J.connect();let G=Date.now(),K=!1;try{while(!K){if(K=(await J.query("SELECT pg_try_advisory_lock($1) AS locked",[i7$.toString()])).rows[0]?.locked===!0,K)break;if(Date.now()-G>=X)throw Error(`Timed out after ${X}ms waiting for the DBOS migration lock. Another process is still migrating the dbos schema; this pod will restart and retry.`);await k$(HW4)}let W=Date.now()-G;if(W>1000)Y(`[dbos] waited ${W}ms for the migration lock; another process migrated first`);return await Z()}finally{if(K)try{await J.query("SELECT pg_advisory_unlock($1)",[i7$.toString()])}catch{}await J.end().catch(()=>{})}}var i7$=8314027461559302n,WW4=600000,HW4=500;var n7$=L(()=>{O8()});function FW4(){let $=(process.env.BUN_OPTIONS??"").split(/\s+/).filter(Boolean);return[...process.argv.slice(1),...$]}function k11($,Z){for(let Q=0;Q<$.length;Q++){let X=$[Q];if(X===void 0)continue;if(X===Z)return $[Q+1];if(X.startsWith(`${Z}=`))return X.slice(Z.length+1)}return}function t7$(){let $=FW4();if($.includes("--cpu-prof")){console.log(JSON.stringify({msg:"cpu-profiling-active",dir:k11($,"--cpu-prof-dir")??process.cwd(),name:k11($,"--cpu-prof-name"),markdown:$.includes("--cpu-prof-md"),intervalUs:Number(k11($,"--cpu-prof-interval")??1000),note:"profile is written on process exit"}));return}if(process.env.CPU_PROFILE)console.warn(JSON.stringify({msg:"cpu-profiling-requested-but-inactive",hint:'CPU profiling is a Bun launch flag. Set BUN_OPTIONS="--cpu-prof --cpu-prof-md --cpu-prof-dir=/tmp" before starting the process.'}))}function o7$(){if(process.env.HEAP_WATCH!=="1")return()=>{};let $=Number(process.env.HEAP_WATCH_INTERVAL_MS??60000),Z=async()=>{let Q=XT();if(!Q)return;let X={};try{let{heapStats:Y}=await import("bun:jsc"),J=Y(),G=Object.entries(J.objectTypeCounts).sort((K,W)=>W[1]-K[1]).slice(0,20);X={objectCount:J.objectCount,heapSize:J.heapSize,top:Object.fromEntries(G)}}catch{}console.log(JSON.stringify({msg:"heap-watch",ts:new Date().toISOString(),uptimeS:Math.round(process.uptime()),rss:Q.rss,heapUsed:Q.heapUsed,heapTotal:Q.heapTotal,external:Q.external,arrayBuffers:Q.arrayBuffers,...X}))};return Z().catch(()=>{}),D30=setInterval(()=>void Z().catch(()=>{}),$),D30.unref?.(),process.on("SIGUSR2",()=>{try{let Q=Bun.generateHeapSnapshot("v8"),X=typeof Q==="string"?Q:JSON.stringify(Q),Y=`/tmp/heap-${process.pid}-${Date.now()}.heapsnapshot`;Bun.write(Y,X),console.log(JSON.stringify({msg:"heap-snapshot-written",path:Y}))}catch(Q){console.error("[heap-watch] snapshot failed:",Q)}}),()=>{if(D30)clearInterval(D30)}}var D30;var a7$=()=>{};import*as UW4 from"bun:jsc";function r7$(){if(process.env.STALL_WATCHDOG!=="1")return()=>{};let $=Number(process.env.STALL_WATCHDOG_MS??100),Z=Number(process.env.STALL_WATCHDOG_TICK_MS??50);try{NW4()}catch(J){return console.error("[stall-watchdog] failed to start sampling profiler:",J),()=>{}}let Q,X=performance.now()+Z,Y=()=>{let J=performance.now(),G=J-X;X=J+Z;let K=[];try{K=BW4()?.traces??[]}catch{}if(G>$&&K.length>0){let W=new Map;for(let F of K){let U=F.frames.find((O)=>O.sourceURL&&!/Unknown Executable/.test(O.category??""))??F.frames[0];if(!U)continue;let N=(U.sourceURL??"?").replace(/^.*\/node_modules\//,"node_modules/"),B=`${U.name??"?"} @ ${N}:${U.line??"?"}`;W.set(B,(W.get(B)??0)+1)}let H=[...W.entries()].sort((F,U)=>U[1]-F[1]).slice(0,8).map(([F,U])=>({frame:F,count:U}));console.warn(JSON.stringify({msg:"stall-stack",ts:new Date().toISOString(),lagMs:Math.round(G),samplesInWindow:K.length,top:H}))}Q=setTimeout(Y,Z),Q.unref?.()};return Q=setTimeout(Y,Z),Q.unref?.(),()=>{if(Q)clearTimeout(Q)}}var NW4,BW4;var s7$=L(()=>{({startSamplingProfiler:NW4,samplingProfilerStackTraces:BW4}=UW4)});function e7$(){t7$();let $=[o7$(),b4$(),r7$()];return()=>{for(let Z of $)Z()}}var $Q$=L(()=>{ja0();a7$();s7$()});var UT=b((ZQ$)=>{Object.defineProperty(ZQ$,"__esModule",{value:!0});ZQ$.RepublishHeaders=ZQ$.DirectMsgHeaders=ZQ$.JsHeaders=ZQ$.AdvisoryKind=void 0;ZQ$.isOrderedPushConsumerOptions=LW4;ZQ$.isPullConsumer=OW4;ZQ$.isPushConsumer=DW4;ZQ$.isBoundPushConsumerOptions=wW4;function LW4($){if($&&typeof $==="object")return"name_prefix"in $||"deliver_subject_prefix"in $||"filter_subjects"in $||"filter_subject"in $||"deliver_policy"in $||"opt_start_seq"in $||"opt_start_time"in $||"replay_policy"in $||"inactive_threshold"in $||"headers_only"in $||"deliver_prefix"in $;return!1}function OW4($){return $.isPullConsumer()}function DW4($){return $.isPushConsumer()}function wW4($){if($&&typeof $==="object")return"deliver_subject"in $||"deliver_group"in $||"idle_heartbeat"in $;return!1}ZQ$.AdvisoryKind={API:"api_audit",StreamAction:"stream_action",ConsumerAction:"consumer_action",SnapshotCreate:"snapshot_create",SnapshotComplete:"snapshot_complete",RestoreCreate:"restore_create",RestoreComplete:"restore_complete",MaxDeliver:"max_deliver",Terminated:"terminated",Ack:"consumer_ack",StreamLeaderElected:"stream_leader_elected",StreamQuorumLost:"stream_quorum_lost",ConsumerLeaderElected:"consumer_leader_elected",ConsumerQuorumLost:"consumer_quorum_lost"};ZQ$.JsHeaders={StreamSourceHdr:"Nats-Stream-Source",LastConsumerSeqHdr:"Nats-Last-Consumer",LastStreamSeqHdr:"Nats-Last-Stream",ConsumerStalledHdr:"Nats-Consumer-Stalled",MessageSizeHdr:"Nats-Msg-Size",RollupHdr:"Nats-Rollup",RollupValueSubject:"sub",RollupValueAll:"all",PendingMessagesHdr:"Nats-Pending-Messages",PendingBytesHdr:"Nats-Pending-Bytes",RequiredApiLevel:"Nats-Required-Api-Level"};ZQ$.DirectMsgHeaders={Stream:"Nats-Stream",Sequence:"Nats-Sequence",TimeStamp:"Nats-Time-Stamp",Subject:"Nats-Subject",LastSequence:"Nats-Last-Sequence",NumPending:"Nats-Num-Pending"};ZQ$.RepublishHeaders={Stream:"Nats-Stream",Subject:"Nats-Subject",Sequence:"Nats-Sequence",LastSequence:"Nats-Last-Sequence",Size:"Nats-Msg-Size"}});var _G=b((XQ$)=>{Object.defineProperty(XQ$,"__esModule",{value:!0});XQ$.TD=XQ$.TE=XQ$.Empty=void 0;XQ$.encode=MW4;XQ$.decode=IW4;XQ$.Empty=new Uint8Array(0);XQ$.TE=new TextEncoder;XQ$.TD=new TextDecoder;function qW4(...$){let Z=0;for(let Y=0;Y<$.length;Y++)Z+=$[Y].length;let Q=new Uint8Array(Z),X=0;for(let Y=0;Y<$.length;Y++)Q.set($[Y],X),X+=$[Y].length;return Q}function MW4(...$){let Z=[];for(let Q=0;Q<$.length;Q++)Z.push(XQ$.TE.encode($[Q]));if(Z.length===0)return XQ$.Empty;if(Z.length===1)return Z[0];return qW4(...Z)}function IW4($){if(!$||$.length===0)return"";return XQ$.TD.decode($)}});var vG=b((GQ$)=>{Object.defineProperty(GQ$,"__esModule",{value:!0});GQ$.errors=GQ$.PermissionViolationError=GQ$.NoRespondersError=GQ$.TimeoutError=GQ$.RequestError=GQ$.ProtocolError=GQ$.ConnectionError=GQ$.DrainingConnectionError=GQ$.ClosedConnectionError=GQ$.AuthorizationError=GQ$.UserAuthenticationExpiredError=GQ$.InvalidOperationError=GQ$.InvalidArgumentError=GQ$.InvalidSubjectError=void 0;class C11 extends Error{constructor($,Z){super(`illegal subject: '${$}'`,Z);this.name="InvalidSubjectError"}}GQ$.InvalidSubjectError=C11;class w30 extends Error{constructor($,Z){super($,Z);this.name="InvalidArgumentError"}static format($,Z,Q){if(Array.isArray(Z)&&Z.length>1)Z=Z[0];if(Array.isArray($))$=$.map((X)=>`'${X}'`),$=$.join(",");else $=`'${$}'`;return new w30(`${$} ${Z}`,Q)}}GQ$.InvalidArgumentError=w30;class _11 extends Error{constructor($,Z){super($,Z);this.name="InvalidOperationError"}}GQ$.InvalidOperationError=_11;class j30 extends Error{constructor($,Z){super($,Z);this.name="UserAuthenticationExpiredError"}static parse($){if($.toLowerCase().indexOf("user authentication expired")!==-1)return new j30($);return null}}GQ$.UserAuthenticationExpiredError=j30;class E30 extends Error{constructor($,Z){super($,Z);this.name="AuthorizationError"}static parse($){let Z=["authorization violation","account authentication expired","authentication timeout"],Q=$.toLowerCase();for(let X=0;X<Z.length;X++)if(Q.indexOf(Z[X])!==-1)return new E30($);return null}}GQ$.AuthorizationError=E30;class v11 extends Error{constructor(){super("closed connection");this.name="ClosedConnectionError"}}GQ$.ClosedConnectionError=v11;class x11 extends Error{constructor(){super("connection draining");this.name="DrainingConnectionError"}}GQ$.DrainingConnectionError=x11;class f11 extends Error{constructor($,Z){super($,Z);this.name="ConnectionError"}}GQ$.ConnectionError=f11;class b11 extends Error{constructor($,Z){super($,Z);this.name="ProtocolError"}}GQ$.ProtocolError=b11;class y11 extends Error{constructor($="",Z){super($,Z);this.name="RequestError"}isNoResponders(){return this.cause instanceof z30}}GQ$.RequestError=y11;class g11 extends Error{constructor($){super("timeout",$);this.name="TimeoutError"}}GQ$.TimeoutError=g11;class z30 extends Error{subject;constructor($,Z){super(`no responders: '${$}'`,Z);this.subject=$,this.name="NoResponders"}}GQ$.NoRespondersError=z30;class P30 extends Error{operation;subject;queue;constructor($,Z,Q,X,Y){super($,Y);this.name="PermissionViolationError",this.operation=Z,this.subject=Q,this.queue=X}static parse($){if(($?$.toLowerCase():"").indexOf("permissions violation")===-1)return null;let Q="publish",X="",Y=void 0,J=$.match(/(Publish|Subscription) to "(\S+)"/);if(J){if(Q=J[1].toLowerCase(),X=J[2],Q==="subscription"){let G=$.match(/using queue "(\S+)"/);if(G)Y=G[1]}}return new P30($,Q,X,Y)}}GQ$.PermissionViolationError=P30;GQ$.errors={AuthorizationError:E30,ClosedConnectionError:v11,ConnectionError:f11,DrainingConnectionError:x11,InvalidArgumentError:w30,InvalidOperationError:_11,InvalidSubjectError:C11,NoRespondersError:z30,PermissionViolationError:P30,ProtocolError:b11,RequestError:y11,TimeoutError:g11,UserAuthenticationExpiredError:j30}});var iW=b((UQ$)=>{Object.defineProperty(UQ$,"__esModule",{value:!0});UQ$.SimpleMutex=UQ$.Perf=void 0;UQ$.extend=dW4;UQ$.render=iW4;UQ$.timeout=pW4;UQ$.delay=nW4;UQ$.deadline=tW4;UQ$.deferred=u11;UQ$.debugDeferred=oW4;UQ$.shuffle=aW4;UQ$.collect=rW4;UQ$.jitter=FQ$;UQ$.backoff=sW4;UQ$.nanos=eW4;UQ$.millis=$H4;UQ$.randomToken=XH4;var mW4=_G(),h11=vG();function dW4($,...Z){for(let Q=0;Q<Z.length;Q++){let X=Z[Q];Object.keys(X).forEach(function(Y){$[Y]=X[Y]})}return $}function iW4($){return mW4.TD.decode($).replace(/\n/g,"\u240A").replace(/\r/g,"\u240D")}function pW4($,Z=!0){let Q=Z?new h11.TimeoutError:null,X,Y,J=new Promise((G,K)=>{X={cancel:()=>{if(Y)clearTimeout(Y)}},Y=setTimeout(()=>{if(Q===null)K(new h11.TimeoutError);else K(Q)},$)});return Object.assign(J,X)}function nW4($=0){let Z,Q=new Promise((X)=>{let Y=setTimeout(()=>{X()},$);Z={cancel:()=>{if(Y)clearTimeout(Y),X()}}});return Object.assign(Q,Z)}async function tW4($,Z=1000){let Q=u11(),X=setTimeout(()=>{Q.reject(new h11.TimeoutError)},Z);try{return await Promise.race([$,Q])}finally{clearTimeout(X)}}function u11(){let $={},Z=new Promise((Q,X)=>{$={resolve:Q,reject:X}});return Object.assign(Z,$)}function oW4(){let $={},Z=new Promise((Q,X)=>{$={resolve:(Y)=>{console.trace("resolve",Y),Q(Y)},reject:(Y)=>{console.trace("reject"),X(Y)}}});return Object.assign(Z,$)}function aW4($){for(let Z=$.length-1;Z>0;Z--){let Q=Math.floor(Math.random()*(Z+1));[$[Z],$[Q]]=[$[Q],$[Z]]}return $}async function rW4($){let Z=[];for await(let Q of $)Z.push(Q);return Z}class WQ${timers;measures;constructor(){this.timers=new Map,this.measures=new Map}mark($){this.timers.set($,performance.now())}measure($,Z,Q){let X=this.timers.get(Z);if(X===void 0)throw Error(`${Z} is not defined`);let Y=this.timers.get(Q);if(Y===void 0)throw Error(`${Q} is not defined`);this.measures.set($,Y-X)}getEntries(){let $=[];return this.measures.forEach((Z,Q)=>{$.push({name:Q,duration:Z})}),$}}UQ$.Perf=WQ$;class HQ${max;current;waiting;constructor($=1){this.max=$,this.current=0,this.waiting=[]}lock(){if(this.current++,this.current<=this.max)return Promise.resolve();let $=u11();return this.waiting.push($),$}unlock(){this.current--,this.waiting.pop()?.resolve()}}UQ$.SimpleMutex=HQ$;function FQ$($){if($===0)return 0;return Math.floor($/2+Math.random()*$)}function sW4($=[0,250,250,500,500,3000,5000]){if(!Array.isArray($))$=[0,250,250,500,500,3000,5000];let Z=$.length-1;return{backoff(Q){return FQ$(Q>Z?$[Z]:$[Q])}}}function eW4($){return $*1e6}function $H4($){return Math.floor($/1e6)}var ZH4="0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz",yB=new Uint8Array(62);for(let $=0;$<62;$++)yB[$]=ZH4.charCodeAt($);var QH4=218340105584896;function XH4(){let $=Math.floor(Math.random()*QH4),Z=$%62,Q=yB[Z];$=($-Z)/62,Z=$%62;let X=yB[Z];$=($-Z)/62,Z=$%62;let Y=yB[Z];$=($-Z)/62,Z=$%62;let J=yB[Z];$=($-Z)/62,Z=$%62;let G=yB[Z];$=($-Z)/62,Z=$%62;let K=yB[Z];$=($-Z)/62,Z=$%62;let W=yB[Z];$=($-Z)/62;let H=yB[$];return String.fromCharCode(Q,X,Y,J,G,K,W,H)}});var EQ$=b((wQ$)=>{Object.defineProperty(wQ$,"__esModule",{value:!0});wQ$.nuid=wQ$.NuidImpl=void 0;var EH4="0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz",Zw=62,A30=12,OQ$=10,BQ$=33,zH4=333,LQ$=A30+OQ$,c11=new Uint8Array(Zw);for(let $=0;$<Zw;$++)c11[$]=EH4.charCodeAt($);var T30=4294967296,DQ$=BigInt(Zw)**BigInt(OQ$),Zr=Number(DQ$/(1n<<32n)),l11=Number(DQ$%(1n<<32n));function PH4($){for(let Z=0;Z<$.length;Z++)$[Z]=Math.floor(Math.random()*256)}function TH4($){if(globalThis?.crypto?.getRandomValues)globalThis.crypto.getRandomValues($);else PH4($)}class m11{buf;cbuf;seqHi;seqLo;inc;inited;constructor(){this.buf=new Uint8Array(LQ$),this.cbuf=new Uint8Array(A30),this.inited=!1}init(){this.inited=!0,this.setPre(),this.initSeqAndInc(),this.fillSeq()}initSeqAndInc(){let $=0;do this.seqHi=Math.floor(Math.random()*(Zr+1)),this.seqLo=Math.floor(Math.random()*T30);while($++<8&&this.seqHi===Zr&&this.seqLo>=l11);if(this.seqHi===Zr&&this.seqLo>=l11)this.seqLo=0;this.inc=Math.random()*(zH4-BQ$)+BQ$|0}setPre(){TH4(this.cbuf);for(let $=0;$<A30;$++)this.buf[$]=c11[this.cbuf[$]%Zw]}fillSeq(){let $=this.seqHi,Z=this.seqLo;for(let Q=LQ$-1;Q>=A30;Q--){let X=Math.floor($/Zw),J=($-X*Zw)*T30+Z,G=Math.floor(J/Zw),K=J-G*Zw;this.buf[Q]=c11[K],$=X,Z=G}}next(){if(!this.inited)this.init();if(this.seqLo+=this.inc,this.seqLo>=T30)this.seqLo-=T30,this.seqHi+=1;if(this.seqHi>Zr||this.seqHi===Zr&&this.seqLo>=l11)this.setPre(),this.initSeqAndInc();this.fillSeq();let $=this.buf;return String.fromCharCode($[0],$[1],$[2],$[3],$[4],$[5],$[6],$[7],$[8],$[9],$[10],$[11],$[12],$[13],$[14],$[15],$[16],$[17],$[18],$[19],$[20],$[21])}reset(){this.init()}}wQ$.NuidImpl=m11;wQ$.nuid=new m11});var AQ$=b((PQ$)=>{Object.defineProperty(PQ$,"__esModule",{value:!0});PQ$.nuid=PQ$.Nuid=void 0;var zQ$=EQ$();PQ$.Nuid=zQ$.NuidImpl;PQ$.nuid=zQ$.nuid});var q30=b((R30)=>{Object.defineProperty(R30,"__esModule",{value:!0});R30.nuid=R30.Nuid=void 0;var RQ$=AQ$();Object.defineProperty(R30,"Nuid",{enumerable:!0,get:function(){return RQ$.Nuid}});Object.defineProperty(R30,"nuid",{enumerable:!0,get:function(){return RQ$.nuid}})});var Qw=b((qQ$)=>{Object.defineProperty(qQ$,"__esModule",{value:!0});qQ$.DEFAULT_HOST=qQ$.DEFAULT_PORT=qQ$.Match=void 0;qQ$.syncIterator=VH4;qQ$.createInbox=kH4;var MH4=q30(),IH4=vG();qQ$.Match={Exact:"exact",CanonicalMIME:"canonical",IgnoreCase:"insensitive"};function VH4($){let Z=$[Symbol.asyncIterator]();return{async next(){let Q=await Z.next();if(Q.done)return Promise.resolve(null);return Promise.resolve(Q.value)}}}function kH4($=""){if($=$||"_INBOX",typeof $!=="string")throw TypeError("prefix must be a string");return $.split(".").forEach((Z)=>{if(Z==="*"||Z===">")throw IH4.InvalidArgumentError.format("prefix",`cannot have wildcards ('${$}')`)}),`${$}.${MH4.nuid.next()}`}qQ$.DEFAULT_PORT=4222;qQ$.DEFAULT_HOST="127.0.0.1"});var Qr=b((kQ$)=>{Object.defineProperty(kQ$,"__esModule",{value:!0});kQ$.DataBuffer=void 0;var IQ$=_G();class VQ${buffers;byteLength;constructor(){this.buffers=[],this.byteLength=0}static concat(...$){let Z=0;for(let Y=0;Y<$.length;Y++)Z+=$[Y].length;let Q=new Uint8Array(Z),X=0;for(let Y=0;Y<$.length;Y++)Q.set($[Y],X),X+=$[Y].length;return Q}static fromAscii($){if(!$)$="";return IQ$.TE.encode($)}static toAscii($){return IQ$.TD.decode($)}reset(){this.buffers.length=0,this.byteLength=0}pack(){if(this.buffers.length>1){let $=new Uint8Array(this.byteLength),Z=0;for(let Q=0;Q<this.buffers.length;Q++)$.set(this.buffers[Q],Z),Z+=this.buffers[Q].length;this.buffers.length=0,this.buffers.push($)}}shift(){if(this.buffers.length){let $=this.buffers.shift();if($)return this.byteLength-=$.length,$}return new Uint8Array(0)}drain($){if(this.buffers.length){this.pack();let Z=this.buffers.pop();if(Z){let Q=this.byteLength;if($===void 0||$>Q)$=Q;let X=Z.subarray(0,$);if(Q>$)this.buffers.push(Z.subarray($));return this.byteLength=Q-$,X}}return new Uint8Array(0)}fill($,...Z){if($)this.buffers.push($),this.byteLength+=$.length;for(let Q=0;Q<Z.length;Q++)if(Z[Q]&&Z[Q].length)this.buffers.push(Z[Q]),this.byteLength+=Z[Q].length}peek(){if(this.buffers.length)return this.pack(),this.buffers[0];return new Uint8Array(0)}size(){return this.byteLength}length(){return this.buffers.length}}kQ$.DataBuffer=VQ$});var NT=b((_Q$)=>{Object.defineProperty(_Q$,"__esModule",{value:!0});_Q$.LF=_Q$.CR=_Q$.CRLF=_Q$.CR_LF_LEN=_Q$.CR_LF=void 0;_Q$.setTransportFactory=yH4;_Q$.defaultPort=gH4;_Q$.getUrlParseFn=hH4;_Q$.newTransport=uH4;_Q$.getResolveFn=lH4;_Q$.protoLen=CQ$;_Q$.extractProtocolMessage=cH4;var xH4=_G(),fH4=Qw(),bH4=Qr(),xG;function yH4($){xG=$}function gH4(){return xG!==void 0&&xG.defaultPort!==void 0?xG.defaultPort:fH4.DEFAULT_PORT}function hH4(){return xG!==void 0&&xG.urlParseFn?xG.urlParseFn:void 0}function uH4(){if(!xG||typeof xG.factory!=="function")throw Error("transport fn is not set");return xG.factory()}function lH4(){return xG!==void 0&&xG.dnsResolveFn?xG.dnsResolveFn:void 0}_Q$.CR_LF=`\r
+`);X=J.pop()??"";for(let G of J){let K=Bun.stripANSI(G).replace(/^\[\d+\]\s*/,"").trim();if(!K)continue;sD({method:"",path:"",status:0,duration:0,timestamp:new Date,rawLine:K})}}(async()=>{try{for(;;){let{done:J,value:G}=await Z.read();if(J)break;X+=Q.decode(G,{stream:!0}),Y()}}catch{}if(X.trim()){let J=Bun.stripANSI(X).replace(/^\[\d+\]\s*/,"").trim();if(J)sD({method:"",path:"",status:0,duration:0,timestamp:new Date,rawLine:J})}})()}async function oK4($){let{baseUrl:Z,noTui:Q}=$,X=process.env.HOST==="0.0.0.0"&&Boolean(process.env.PORT),Y=X?process.env.PORT:$.vitePort,J=Z||`http://localhost:${Y}`,G=X?await ea(Number(Y)+1):await ea(Number($.port)),{settings:K,services:W,managedServiceNames:H}=await N30({port:String(G),home:$.home,baseUrl:$.baseUrl,localMode:$.localMode,skipMigrations:$.skipMigrations,noTui:$.noTui,vitePort:$.vitePort});for(let D of W)KT({name:D.name,status:"ready",port:D.port});ra();let F=tK4(import.meta.dir,"..","..","..","..",".."),U=Q===!0,N=Bun.spawn(["bun","run","dev:servers"],{cwd:F,env:{...process.env,PORT:String(K.port),VITE_PORT:String(Y),DATABASE_URL:K.databaseUrl,NATS_URL:K.natsUrls.join(","),NODE_ENV:K.nodeEnv,BASE_URL:J,DECOCMS_LOCAL_MODE:String(K.localMode),DECOCMS_HOME:K.dataDir,DATA_DIR:K.dataDir,DECO_CLI:"1",...K.betterAuthSecret?{BETTER_AUTH_SECRET:K.betterAuthSecret}:{},...K.s3Endpoint?{S3_ENDPOINT:K.s3Endpoint,S3_BUCKET:K.s3Bucket??"",S3_ACCESS_KEY_ID:K.s3AccessKeyId??"",S3_SECRET_ACCESS_KEY:K.s3SecretAccessKey??"",S3_FORCE_PATH_STYLE:String(K.s3ForcePathStyle)}:{},...K.natsCredsPath?{NATS_CREDS:K.natsCredsPath}:{}},stdio:["inherit",U?"inherit":"pipe",U?"inherit":"pipe"]});if(!U)P11(N.stdout),P11(N.stderr);sa(J),KT({name:"Vite",status:"ready",port:Number(Y)}),KT({name:"API",status:"ready",port:Number(K.port)});let O=async(D)=>{if(N.kill(D),await N.exited,H.length>0){let{stopServices:w}=await Promise.resolve().then(() => (BG0(),NG0));await w(K.dataDir)}};return process.on("SIGINT",()=>O("SIGINT")),process.on("SIGTERM",()=>O("SIGTERM")),{port:Number(Y),process:N}}var A11=L(()=>{D11();WT();z11()});var O30;var R11=L(()=>{O30={name:"decocms",version:"4.394.1",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js","db:migrate:dbos":"bun run ./dist/server/migrate-dbos.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts","migrate:dbos":"bun run src/database/migrate-dbos.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^4.0.58","@ai-sdk/google":"^4.0.76","@ai-sdk/openai":"^4.0.71","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^3.1.0","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^4.0.17","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^7.0.107","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});import{Box as rK4,Text as _7$}from"ink";import{jsx as sK4,jsxs as v7$}from"react/jsx-runtime";function x7$({version:$}){return v7$(rK4,{flexDirection:"column",marginTop:1,children:[bG0.map((Z,Q)=>sK4(_7$,{color:yG0[Q],children:Z},Q)),v7$(_7$,{dimColor:!0,children:[" v",$]})]})}var f7$=L(()=>{fa()});import{Box as HT,Text as eD}from"ink";import{Spinner as eK4}from"@inkjs/ui";import{jsx as CG,jsxs as zl}from"react/jsx-runtime";function b7$({status:$}){if($==="pending")return CG(eK4,{label:""});return CG(eD,{color:"green",children:"\u2713"})}function $W4($){return`${$.name}: ${$.port||"...."}`}function y7$({services:$,migrationsStatus:Z,home:Q,serverUrl:X}){return zl(HT,{flexDirection:"column",paddingBottom:1,children:[CG(x7$,{version:O30.version}),CG(HT,{marginBottom:1,children:CG(eD,{dimColor:!0,children:"\u2500".repeat(80)})}),CG(HT,{children:zl(eD,{dimColor:!0,children:["Home: ",Q]})}),zl(HT,{gap:2,children:[$.map((Y)=>zl(HT,{gap:1,children:[CG(eD,{children:$W4(Y)}),CG(b7$,{status:Y.status})]},Y.name)),zl(HT,{gap:1,children:[CG(eD,{children:"Migrations"}),CG(b7$,{status:Z})]})]}),CG(HT,{children:X?zl(eD,{children:["Open in browser: ",CG(eD,{color:"cyan",children:X})]}):CG(eD,{dimColor:!0,children:"Starting..."})})]})}var g7$=L(()=>{R11();f7$()});import{Box as ZW4,Text as $r}from"ink";import{jsx as q11,jsxs as M11}from"react/jsx-runtime";function QW4($){if($>=500)return"red";if($>=400)return"yellow";if($>=300)return"cyan";return"green"}function h7$({logs:$}){return q11(ZW4,{flexDirection:"column",children:$.map((Z,Q)=>{if(Z.rawLine)return q11($r,{dimColor:!0,children:Z.rawLine},Q);let X=Z.duration<1000?`${Z.duration}ms`:`${(Z.duration/1000).toFixed(1)}s`;return M11($r,{children:[M11($r,{dimColor:!0,children:[Z.method.padEnd(6)," ",Z.path.padEnd(30)," "]}),q11($r,{color:QW4(Z.status),children:Z.status}),M11($r,{dimColor:!0,children:[" ",X.padStart(8)]})]},Q)})})}var u7$=()=>{};var I11={};K0(I11,{App:()=>JW4});import{Box as XW4}from"ink";import{useSyncExternalStore as YW4}from"react";import{jsx as l7$,jsxs as GW4}from"react/jsx-runtime";function JW4({home:$}){let Z=YW4(E11,j11);return GW4(XW4,{flexDirection:"column",children:[l7$(y7$,{services:Z.services,migrationsStatus:Z.migrationsStatus,home:$,serverUrl:Z.serverUrl}),l7$(h7$,{logs:Z.logs})]})}var V11=L(()=>{g7$();u7$();WT()});var WK="thread-gate",fB="decopilot-hosted-harness",bB="decopilot-hosted-harness-sandboxed",HK="automations",$w="background-tools",FT="task-board-github-reads";var c7$="13";function m7$($){return{name:"decocms",systemDatabaseUrl:$.systemDatabaseUrl,systemDatabaseSchemaName:"dbos",systemDatabasePoolSize:$.poolSize,runAdminServer:!1,executorID:$.executorID,applicationVersion:c7$,...$.listenQueues!==void 0?{listenQueues:$.listenQueues}:{}}}var d7$=()=>{};import KW4 from"pg";async function p7$($,Z){let{databaseUrl:Q,lockTimeoutMs:X=WW4}=$,Y=$.log??((W)=>console.log(W)),J=new KW4.Client({connectionString:Q});await J.connect();let G=Date.now(),K=!1;try{while(!K){if(K=(await J.query("SELECT pg_try_advisory_lock($1) AS locked",[i7$.toString()])).rows[0]?.locked===!0,K)break;if(Date.now()-G>=X)throw Error(`Timed out after ${X}ms waiting for the DBOS migration lock. Another process is still migrating the dbos schema; this pod will restart and retry.`);await k$(HW4)}let W=Date.now()-G;if(W>1000)Y(`[dbos] waited ${W}ms for the migration lock; another process migrated first`);return await Z()}finally{if(K)try{await J.query("SELECT pg_advisory_unlock($1)",[i7$.toString()])}catch{}await J.end().catch(()=>{})}}var i7$=8314027461559302n,WW4=600000,HW4=500;var n7$=L(()=>{O8()});function FW4(){let $=(process.env.BUN_OPTIONS??"").split(/\s+/).filter(Boolean);return[...process.argv.slice(1),...$]}function k11($,Z){for(let Q=0;Q<$.length;Q++){let X=$[Q];if(X===void 0)continue;if(X===Z)return $[Q+1];if(X.startsWith(`${Z}=`))return X.slice(Z.length+1)}return}function t7$(){let $=FW4();if($.includes("--cpu-prof")){console.log(JSON.stringify({msg:"cpu-profiling-active",dir:k11($,"--cpu-prof-dir")??process.cwd(),name:k11($,"--cpu-prof-name"),markdown:$.includes("--cpu-prof-md"),intervalUs:Number(k11($,"--cpu-prof-interval")??1000),note:"profile is written on process exit"}));return}if(process.env.CPU_PROFILE)console.warn(JSON.stringify({msg:"cpu-profiling-requested-but-inactive",hint:'CPU profiling is a Bun launch flag. Set BUN_OPTIONS="--cpu-prof --cpu-prof-md --cpu-prof-dir=/tmp" before starting the process.'}))}function o7$(){if(process.env.HEAP_WATCH!=="1")return()=>{};let $=Number(process.env.HEAP_WATCH_INTERVAL_MS??60000),Z=async()=>{let Q=XT();if(!Q)return;let X={};try{let{heapStats:Y}=await import("bun:jsc"),J=Y(),G=Object.entries(J.objectTypeCounts).sort((K,W)=>W[1]-K[1]).slice(0,20);X={objectCount:J.objectCount,heapSize:J.heapSize,top:Object.fromEntries(G)}}catch{}console.log(JSON.stringify({msg:"heap-watch",ts:new Date().toISOString(),uptimeS:Math.round(process.uptime()),rss:Q.rss,heapUsed:Q.heapUsed,heapTotal:Q.heapTotal,external:Q.external,arrayBuffers:Q.arrayBuffers,...X}))};return Z().catch(()=>{}),D30=setInterval(()=>void Z().catch(()=>{}),$),D30.unref?.(),process.on("SIGUSR2",()=>{try{let Q=Bun.generateHeapSnapshot("v8"),X=typeof Q==="string"?Q:JSON.stringify(Q),Y=`/tmp/heap-${process.pid}-${Date.now()}.heapsnapshot`;Bun.write(Y,X),console.log(JSON.stringify({msg:"heap-snapshot-written",path:Y}))}catch(Q){console.error("[heap-watch] snapshot failed:",Q)}}),()=>{if(D30)clearInterval(D30)}}var D30;var a7$=()=>{};import*as UW4 from"bun:jsc";function r7$(){if(process.env.STALL_WATCHDOG!=="1")return()=>{};let $=Number(process.env.STALL_WATCHDOG_MS??100),Z=Number(process.env.STALL_WATCHDOG_TICK_MS??50);try{NW4()}catch(J){return console.error("[stall-watchdog] failed to start sampling profiler:",J),()=>{}}let Q,X=performance.now()+Z,Y=()=>{let J=performance.now(),G=J-X;X=J+Z;let K=[];try{K=BW4()?.traces??[]}catch{}if(G>$&&K.length>0){let W=new Map;for(let F of K){let U=F.frames.find((O)=>O.sourceURL&&!/Unknown Executable/.test(O.category??""))??F.frames[0];if(!U)continue;let N=(U.sourceURL??"?").replace(/^.*\/node_modules\//,"node_modules/"),B=`${U.name??"?"} @ ${N}:${U.line??"?"}`;W.set(B,(W.get(B)??0)+1)}let H=[...W.entries()].sort((F,U)=>U[1]-F[1]).slice(0,8).map(([F,U])=>({frame:F,count:U}));console.warn(JSON.stringify({msg:"stall-stack",ts:new Date().toISOString(),lagMs:Math.round(G),samplesInWindow:K.length,top:H}))}Q=setTimeout(Y,Z),Q.unref?.()};return Q=setTimeout(Y,Z),Q.unref?.(),()=>{if(Q)clearTimeout(Q)}}var NW4,BW4;var s7$=L(()=>{({startSamplingProfiler:NW4,samplingProfilerStackTraces:BW4}=UW4)});function e7$(){t7$();let $=[o7$(),b4$(),r7$()];return()=>{for(let Z of $)Z()}}var $Q$=L(()=>{ja0();a7$();s7$()});var UT=b((ZQ$)=>{Object.defineProperty(ZQ$,"__esModule",{value:!0});ZQ$.RepublishHeaders=ZQ$.DirectMsgHeaders=ZQ$.JsHeaders=ZQ$.AdvisoryKind=void 0;ZQ$.isOrderedPushConsumerOptions=LW4;ZQ$.isPullConsumer=OW4;ZQ$.isPushConsumer=DW4;ZQ$.isBoundPushConsumerOptions=wW4;function LW4($){if($&&typeof $==="object")return"name_prefix"in $||"deliver_subject_prefix"in $||"filter_subjects"in $||"filter_subject"in $||"deliver_policy"in $||"opt_start_seq"in $||"opt_start_time"in $||"replay_policy"in $||"inactive_threshold"in $||"headers_only"in $||"deliver_prefix"in $;return!1}function OW4($){return $.isPullConsumer()}function DW4($){return $.isPushConsumer()}function wW4($){if($&&typeof $==="object")return"deliver_subject"in $||"deliver_group"in $||"idle_heartbeat"in $;return!1}ZQ$.AdvisoryKind={API:"api_audit",StreamAction:"stream_action",ConsumerAction:"consumer_action",SnapshotCreate:"snapshot_create",SnapshotComplete:"snapshot_complete",RestoreCreate:"restore_create",RestoreComplete:"restore_complete",MaxDeliver:"max_deliver",Terminated:"terminated",Ack:"consumer_ack",StreamLeaderElected:"stream_leader_elected",StreamQuorumLost:"stream_quorum_lost",ConsumerLeaderElected:"consumer_leader_elected",ConsumerQuorumLost:"consumer_quorum_lost"};ZQ$.JsHeaders={StreamSourceHdr:"Nats-Stream-Source",LastConsumerSeqHdr:"Nats-Last-Consumer",LastStreamSeqHdr:"Nats-Last-Stream",ConsumerStalledHdr:"Nats-Consumer-Stalled",MessageSizeHdr:"Nats-Msg-Size",RollupHdr:"Nats-Rollup",RollupValueSubject:"sub",RollupValueAll:"all",PendingMessagesHdr:"Nats-Pending-Messages",PendingBytesHdr:"Nats-Pending-Bytes",RequiredApiLevel:"Nats-Required-Api-Level"};ZQ$.DirectMsgHeaders={Stream:"Nats-Stream",Sequence:"Nats-Sequence",TimeStamp:"Nats-Time-Stamp",Subject:"Nats-Subject",LastSequence:"Nats-Last-Sequence",NumPending:"Nats-Num-Pending"};ZQ$.RepublishHeaders={Stream:"Nats-Stream",Subject:"Nats-Subject",Sequence:"Nats-Sequence",LastSequence:"Nats-Last-Sequence",Size:"Nats-Msg-Size"}});var _G=b((XQ$)=>{Object.defineProperty(XQ$,"__esModule",{value:!0});XQ$.TD=XQ$.TE=XQ$.Empty=void 0;XQ$.encode=MW4;XQ$.decode=IW4;XQ$.Empty=new Uint8Array(0);XQ$.TE=new TextEncoder;XQ$.TD=new TextDecoder;function qW4(...$){let Z=0;for(let Y=0;Y<$.length;Y++)Z+=$[Y].length;let Q=new Uint8Array(Z),X=0;for(let Y=0;Y<$.length;Y++)Q.set($[Y],X),X+=$[Y].length;return Q}function MW4(...$){let Z=[];for(let Q=0;Q<$.length;Q++)Z.push(XQ$.TE.encode($[Q]));if(Z.length===0)return XQ$.Empty;if(Z.length===1)return Z[0];return qW4(...Z)}function IW4($){if(!$||$.length===0)return"";return XQ$.TD.decode($)}});var vG=b((GQ$)=>{Object.defineProperty(GQ$,"__esModule",{value:!0});GQ$.errors=GQ$.PermissionViolationError=GQ$.NoRespondersError=GQ$.TimeoutError=GQ$.RequestError=GQ$.ProtocolError=GQ$.ConnectionError=GQ$.DrainingConnectionError=GQ$.ClosedConnectionError=GQ$.AuthorizationError=GQ$.UserAuthenticationExpiredError=GQ$.InvalidOperationError=GQ$.InvalidArgumentError=GQ$.InvalidSubjectError=void 0;class C11 extends Error{constructor($,Z){super(`illegal subject: '${$}'`,Z);this.name="InvalidSubjectError"}}GQ$.InvalidSubjectError=C11;class w30 extends Error{constructor($,Z){super($,Z);this.name="InvalidArgumentError"}static format($,Z,Q){if(Array.isArray(Z)&&Z.length>1)Z=Z[0];if(Array.isArray($))$=$.map((X)=>`'${X}'`),$=$.join(",");else $=`'${$}'`;return new w30(`${$} ${Z}`,Q)}}GQ$.InvalidArgumentError=w30;class _11 extends Error{constructor($,Z){super($,Z);this.name="InvalidOperationError"}}GQ$.InvalidOperationError=_11;class j30 extends Error{constructor($,Z){super($,Z);this.name="UserAuthenticationExpiredError"}static parse($){if($.toLowerCase().indexOf("user authentication expired")!==-1)return new j30($);return null}}GQ$.UserAuthenticationExpiredError=j30;class E30 extends Error{constructor($,Z){super($,Z);this.name="AuthorizationError"}static parse($){let Z=["authorization violation","account authentication expired","authentication timeout"],Q=$.toLowerCase();for(let X=0;X<Z.length;X++)if(Q.indexOf(Z[X])!==-1)return new E30($);return null}}GQ$.AuthorizationError=E30;class v11 extends Error{constructor(){super("closed connection");this.name="ClosedConnectionError"}}GQ$.ClosedConnectionError=v11;class x11 extends Error{constructor(){super("connection draining");this.name="DrainingConnectionError"}}GQ$.DrainingConnectionError=x11;class f11 extends Error{constructor($,Z){super($,Z);this.name="ConnectionError"}}GQ$.ConnectionError=f11;class b11 extends Error{constructor($,Z){super($,Z);this.name="ProtocolError"}}GQ$.ProtocolError=b11;class y11 extends Error{constructor($="",Z){super($,Z);this.name="RequestError"}isNoResponders(){return this.cause instanceof z30}}GQ$.RequestError=y11;class g11 extends Error{constructor($){super("timeout",$);this.name="TimeoutError"}}GQ$.TimeoutError=g11;class z30 extends Error{subject;constructor($,Z){super(`no responders: '${$}'`,Z);this.subject=$,this.name="NoResponders"}}GQ$.NoRespondersError=z30;class P30 extends Error{operation;subject;queue;constructor($,Z,Q,X,Y){super($,Y);this.name="PermissionViolationError",this.operation=Z,this.subject=Q,this.queue=X}static parse($){if(($?$.toLowerCase():"").indexOf("permissions violation")===-1)return null;let Q="publish",X="",Y=void 0,J=$.match(/(Publish|Subscription) to "(\S+)"/);if(J){if(Q=J[1].toLowerCase(),X=J[2],Q==="subscription"){let G=$.match(/using queue "(\S+)"/);if(G)Y=G[1]}}return new P30($,Q,X,Y)}}GQ$.PermissionViolationError=P30;GQ$.errors={AuthorizationError:E30,ClosedConnectionError:v11,ConnectionError:f11,DrainingConnectionError:x11,InvalidArgumentError:w30,InvalidOperationError:_11,InvalidSubjectError:C11,NoRespondersError:z30,PermissionViolationError:P30,ProtocolError:b11,RequestError:y11,TimeoutError:g11,UserAuthenticationExpiredError:j30}});var iW=b((UQ$)=>{Object.defineProperty(UQ$,"__esModule",{value:!0});UQ$.SimpleMutex=UQ$.Perf=void 0;UQ$.extend=dW4;UQ$.render=iW4;UQ$.timeout=pW4;UQ$.delay=nW4;UQ$.deadline=tW4;UQ$.deferred=u11;UQ$.debugDeferred=oW4;UQ$.shuffle=aW4;UQ$.collect=rW4;UQ$.jitter=FQ$;UQ$.backoff=sW4;UQ$.nanos=eW4;UQ$.millis=$H4;UQ$.randomToken=XH4;var mW4=_G(),h11=vG();function dW4($,...Z){for(let Q=0;Q<Z.length;Q++){let X=Z[Q];Object.keys(X).forEach(function(Y){$[Y]=X[Y]})}return $}function iW4($){return mW4.TD.decode($).replace(/\n/g,"\u240A").replace(/\r/g,"\u240D")}function pW4($,Z=!0){let Q=Z?new h11.TimeoutError:null,X,Y,J=new Promise((G,K)=>{X={cancel:()=>{if(Y)clearTimeout(Y)}},Y=setTimeout(()=>{if(Q===null)K(new h11.TimeoutError);else K(Q)},$)});return Object.assign(J,X)}function nW4($=0){let Z,Q=new Promise((X)=>{let Y=setTimeout(()=>{X()},$);Z={cancel:()=>{if(Y)clearTimeout(Y),X()}}});return Object.assign(Q,Z)}async function tW4($,Z=1000){let Q=u11(),X=setTimeout(()=>{Q.reject(new h11.TimeoutError)},Z);try{return await Promise.race([$,Q])}finally{clearTimeout(X)}}function u11(){let $={},Z=new Promise((Q,X)=>{$={resolve:Q,reject:X}});return Object.assign(Z,$)}function oW4(){let $={},Z=new Promise((Q,X)=>{$={resolve:(Y)=>{console.trace("resolve",Y),Q(Y)},reject:(Y)=>{console.trace("reject"),X(Y)}}});return Object.assign(Z,$)}function aW4($){for(let Z=$.length-1;Z>0;Z--){let Q=Math.floor(Math.random()*(Z+1));[$[Z],$[Q]]=[$[Q],$[Z]]}return $}async function rW4($){let Z=[];for await(let Q of $)Z.push(Q);return Z}class WQ${timers;measures;constructor(){this.timers=new Map,this.measures=new Map}mark($){this.timers.set($,performance.now())}measure($,Z,Q){let X=this.timers.get(Z);if(X===void 0)throw Error(`${Z} is not defined`);let Y=this.timers.get(Q);if(Y===void 0)throw Error(`${Q} is not defined`);this.measures.set($,Y-X)}getEntries(){let $=[];return this.measures.forEach((Z,Q)=>{$.push({name:Q,duration:Z})}),$}}UQ$.Perf=WQ$;class HQ${max;current;waiting;constructor($=1){this.max=$,this.current=0,this.waiting=[]}lock(){if(this.current++,this.current<=this.max)return Promise.resolve();let $=u11();return this.waiting.push($),$}unlock(){this.current--,this.waiting.pop()?.resolve()}}UQ$.SimpleMutex=HQ$;function FQ$($){if($===0)return 0;return Math.floor($/2+Math.random()*$)}function sW4($=[0,250,250,500,500,3000,5000]){if(!Array.isArray($))$=[0,250,250,500,500,3000,5000];let Z=$.length-1;return{backoff(Q){return FQ$(Q>Z?$[Z]:$[Q])}}}function eW4($){return $*1e6}function $H4($){return Math.floor($/1e6)}var ZH4="0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz",yB=new Uint8Array(62);for(let $=0;$<62;$++)yB[$]=ZH4.charCodeAt($);var QH4=218340105584896;function XH4(){let $=Math.floor(Math.random()*QH4),Z=$%62,Q=yB[Z];$=($-Z)/62,Z=$%62;let X=yB[Z];$=($-Z)/62,Z=$%62;let Y=yB[Z];$=($-Z)/62,Z=$%62;let J=yB[Z];$=($-Z)/62,Z=$%62;let G=yB[Z];$=($-Z)/62,Z=$%62;let K=yB[Z];$=($-Z)/62,Z=$%62;let W=yB[Z];$=($-Z)/62;let H=yB[$];return String.fromCharCode(Q,X,Y,J,G,K,W,H)}});var EQ$=b((wQ$)=>{Object.defineProperty(wQ$,"__esModule",{value:!0});wQ$.nuid=wQ$.NuidImpl=void 0;var EH4="0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz",Zw=62,A30=12,OQ$=10,BQ$=33,zH4=333,LQ$=A30+OQ$,c11=new Uint8Array(Zw);for(let $=0;$<Zw;$++)c11[$]=EH4.charCodeAt($);var T30=4294967296,DQ$=BigInt(Zw)**BigInt(OQ$),Zr=Number(DQ$/(1n<<32n)),l11=Number(DQ$%(1n<<32n));function PH4($){for(let Z=0;Z<$.length;Z++)$[Z]=Math.floor(Math.random()*256)}function TH4($){if(globalThis?.crypto?.getRandomValues)globalThis.crypto.getRandomValues($);else PH4($)}class m11{buf;cbuf;seqHi;seqLo;inc;inited;constructor(){this.buf=new Uint8Array(LQ$),this.cbuf=new Uint8Array(A30),this.inited=!1}init(){this.inited=!0,this.setPre(),this.initSeqAndInc(),this.fillSeq()}initSeqAndInc(){let $=0;do this.seqHi=Math.floor(Math.random()*(Zr+1)),this.seqLo=Math.floor(Math.random()*T30);while($++<8&&this.seqHi===Zr&&this.seqLo>=l11);if(this.seqHi===Zr&&this.seqLo>=l11)this.seqLo=0;this.inc=Math.random()*(zH4-BQ$)+BQ$|0}setPre(){TH4(this.cbuf);for(let $=0;$<A30;$++)this.buf[$]=c11[this.cbuf[$]%Zw]}fillSeq(){let $=this.seqHi,Z=this.seqLo;for(let Q=LQ$-1;Q>=A30;Q--){let X=Math.floor($/Zw),J=($-X*Zw)*T30+Z,G=Math.floor(J/Zw),K=J-G*Zw;this.buf[Q]=c11[K],$=X,Z=G}}next(){if(!this.inited)this.init();if(this.seqLo+=this.inc,this.seqLo>=T30)this.seqLo-=T30,this.seqHi+=1;if(this.seqHi>Zr||this.seqHi===Zr&&this.seqLo>=l11)this.setPre(),this.initSeqAndInc();this.fillSeq();let $=this.buf;return String.fromCharCode($[0],$[1],$[2],$[3],$[4],$[5],$[6],$[7],$[8],$[9],$[10],$[11],$[12],$[13],$[14],$[15],$[16],$[17],$[18],$[19],$[20],$[21])}reset(){this.init()}}wQ$.NuidImpl=m11;wQ$.nuid=new m11});var AQ$=b((PQ$)=>{Object.defineProperty(PQ$,"__esModule",{value:!0});PQ$.nuid=PQ$.Nuid=void 0;var zQ$=EQ$();PQ$.Nuid=zQ$.NuidImpl;PQ$.nuid=zQ$.nuid});var q30=b((R30)=>{Object.defineProperty(R30,"__esModule",{value:!0});R30.nuid=R30.Nuid=void 0;var RQ$=AQ$();Object.defineProperty(R30,"Nuid",{enumerable:!0,get:function(){return RQ$.Nuid}});Object.defineProperty(R30,"nuid",{enumerable:!0,get:function(){return RQ$.nuid}})});var Qw=b((qQ$)=>{Object.defineProperty(qQ$,"__esModule",{value:!0});qQ$.DEFAULT_HOST=qQ$.DEFAULT_PORT=qQ$.Match=void 0;qQ$.syncIterator=VH4;qQ$.createInbox=kH4;var MH4=q30(),IH4=vG();qQ$.Match={Exact:"exact",CanonicalMIME:"canonical",IgnoreCase:"insensitive"};function VH4($){let Z=$[Symbol.asyncIterator]();return{async next(){let Q=await Z.next();if(Q.done)return Promise.resolve(null);return Promise.resolve(Q.value)}}}function kH4($=""){if($=$||"_INBOX",typeof $!=="string")throw TypeError("prefix must be a string");return $.split(".").forEach((Z)=>{if(Z==="*"||Z===">")throw IH4.InvalidArgumentError.format("prefix",`cannot have wildcards ('${$}')`)}),`${$}.${MH4.nuid.next()}`}qQ$.DEFAULT_PORT=4222;qQ$.DEFAULT_HOST="127.0.0.1"});var Qr=b((kQ$)=>{Object.defineProperty(kQ$,"__esModule",{value:!0});kQ$.DataBuffer=void 0;var IQ$=_G();class VQ${buffers;byteLength;constructor(){this.buffers=[],this.byteLength=0}static concat(...$){let Z=0;for(let Y=0;Y<$.length;Y++)Z+=$[Y].length;let Q=new Uint8Array(Z),X=0;for(let Y=0;Y<$.length;Y++)Q.set($[Y],X),X+=$[Y].length;return Q}static fromAscii($){if(!$)$="";return IQ$.TE.encode($)}static toAscii($){return IQ$.TD.decode($)}reset(){this.buffers.length=0,this.byteLength=0}pack(){if(this.buffers.length>1){let $=new Uint8Array(this.byteLength),Z=0;for(let Q=0;Q<this.buffers.length;Q++)$.set(this.buffers[Q],Z),Z+=this.buffers[Q].length;this.buffers.length=0,this.buffers.push($)}}shift(){if(this.buffers.length){let $=this.buffers.shift();if($)return this.byteLength-=$.length,$}return new Uint8Array(0)}drain($){if(this.buffers.length){this.pack();let Z=this.buffers.pop();if(Z){let Q=this.byteLength;if($===void 0||$>Q)$=Q;let X=Z.subarray(0,$);if(Q>$)this.buffers.push(Z.subarray($));return this.byteLength=Q-$,X}}return new Uint8Array(0)}fill($,...Z){if($)this.buffers.push($),this.byteLength+=$.length;for(let Q=0;Q<Z.length;Q++)if(Z[Q]&&Z[Q].length)this.buffers.push(Z[Q]),this.byteLength+=Z[Q].length}peek(){if(this.buffers.length)return this.pack(),this.buffers[0];return new Uint8Array(0)}size(){return this.byteLength}length(){return this.buffers.length}}kQ$.DataBuffer=VQ$});var NT=b((_Q$)=>{Object.defineProperty(_Q$,"__esModule",{value:!0});_Q$.LF=_Q$.CR=_Q$.CRLF=_Q$.CR_LF_LEN=_Q$.CR_LF=void 0;_Q$.setTransportFactory=yH4;_Q$.defaultPort=gH4;_Q$.getUrlParseFn=hH4;_Q$.newTransport=uH4;_Q$.getResolveFn=lH4;_Q$.protoLen=CQ$;_Q$.extractProtocolMessage=cH4;var xH4=_G(),fH4=Qw(),bH4=Qr(),xG;function yH4($){xG=$}function gH4(){return xG!==void 0&&xG.defaultPort!==void 0?xG.defaultPort:fH4.DEFAULT_PORT}function hH4(){return xG!==void 0&&xG.urlParseFn?xG.urlParseFn:void 0}function uH4(){if(!xG||typeof xG.factory!=="function")throw Error("transport fn is not set");return xG.factory()}function lH4(){return xG!==void 0&&xG.dnsResolveFn?xG.dnsResolveFn:void 0}_Q$.CR_LF=`\r
 `;_Q$.CR_LF_LEN=_Q$.CR_LF.length;_Q$.CRLF=bH4.DataBuffer.fromAscii(_Q$.CR_LF);_Q$.CR=new Uint8Array(_Q$.CRLF)[0];_Q$.LF=new Uint8Array(_Q$.CRLF)[1];function CQ$($){for(let Z=0;Z<$.length;Z++){let Q=Z+1;if($.byteLength>Q&&$[Z]===_Q$.CR&&$[Q]===_Q$.LF)return Q+1}return 0}function cH4($){let Z=CQ$($);if(Z>0){let X=new Uint8Array($).slice(0,Z);return xH4.TD.decode(X)}return""}});var t11=b((uQ$)=>{Object.defineProperty(uQ$,"__esModule",{value:!0});uQ$.ipV4=yQ$;uQ$.isIP=eH4;uQ$.parseIP=gQ$;var Xr=4,BT=16,M30=48,bQ$=57,xQ$=65,rH4=70,fQ$=97,sH4=102,n11=16777215;function yQ$($,Z,Q,X){let Y=new Uint8Array(BT);return[0,0,0,0,0,0,0,0,0,0,255,255].forEach((G,K)=>{Y[K]=G}),Y[12]=$,Y[13]=Z,Y[14]=Q,Y[15]=X,Y}function eH4($){return gQ$($)!==void 0}function gQ$($){for(let Z=0;Z<$.length;Z++)switch($[Z]){case".":return hQ$($);case":":return $F4($)}return}function hQ$($){let Z=new Uint8Array(Xr);for(let Q=0;Q<Xr;Q++){if($.length===0)return;if(Q>0){if($[0]!==".")return;$=$.substring(1)}let{n:X,c:Y,ok:J}=ZF4($);if(!J||X>255)return;$=$.substring(Y),Z[Q]=X}return yQ$(Z[0],Z[1],Z[2],Z[3])}function $F4($){let Z=new Uint8Array(BT),Q=-1;if($.length>=2&&$[0]===":"&&$[1]===":"){if(Q=0,$=$.substring(2),$.length===0)return Z}let X=0;while(X<BT){let{n:Y,c:J,ok:G}=QF4($);if(!G||Y>65535)return;if(J<$.length&&$[J]==="."){if(Q<0&&X!=BT-Xr)return;if(X+Xr>BT)return;let K=hQ$($);if(K===void 0)return;Z[X]=K[12],Z[X+1]=K[13],Z[X+2]=K[14],Z[X+3]=K[15],$="",X+=Xr;break}if(Z[X]=Y>>8,Z[X+1]=Y,X+=2,$=$.substring(J),$.length===0)break;if($[0]!==":"||$.length==1)return;if($=$.substring(1),$[0]===":"){if(Q>=0)return;if(Q=X,$=$.substring(1),$.length===0)break}}if($.length!==0)return;if(X<BT){if(Q<0)return;let Y=BT-X;for(let J=X-1;J>=Q;J--)Z[J+Y]=Z[J];for(let J=Q+Y-1;J>=Q;J--)Z[J]=0}else if(Q>=0)return;return Z}function ZF4($){let Z=0,Q=0;for(Z=0;Z<$.length&&M30<=$.charCodeAt(Z)&&$.charCodeAt(Z)<=bQ$;Z++)if(Q=Q*10+($.charCodeAt(Z)-M30),Q>=n11)return{n:n11,c:Z,ok:!1};if(Z===0)return{n:0,c:0,ok:!1};return{n:Q,c:Z,ok:!0}}function QF4($){let Z=0,Q=0;for(Q=0;Q<$.length;Q++){if(M30<=$.charCodeAt(Q)&&$.charCodeAt(Q)<=bQ$)Z*=16,Z+=$.charCodeAt(Q)-M30;else if(fQ$<=$.charCodeAt(Q)&&$.charCodeAt(Q)<=sH4)Z*=16,Z+=$.charCodeAt(Q)-fQ$+10;else if(xQ$<=$.charCodeAt(Q)&&$.charCodeAt(Q)<=rH4)Z*=16,Z+=$.charCodeAt(Q)-xQ$+10;else break;if(Z>=n11)return{n:0,c:Q,ok:!1}}if(Q===0)return{n:0,c:Q,ok:!1};return{n:Z,c:Q,ok:!0}}});var $$1=b((cQ$)=>{Object.defineProperty(cQ$,"__esModule",{value:!0});cQ$.Servers=cQ$.ServerImpl=void 0;cQ$.isIPV4OrHostname=lQ$;cQ$.hostPort=e11;var o11=NT(),a11=iW(),r11=t11(),GF4=Qw(),KF4=vG();function lQ$($){if($.indexOf("[")!==-1||$.indexOf("::")!==-1)return!1;if($.indexOf(".")!==-1)return!0;if($.split(":").length<=2)return!0;return!1}function s11($){return!lQ$($)}function WF4($){let Q=$.toUpperCase().indexOf("::FFFF:");if(Q!==-1&&$.indexOf(".")!==-1){let X=$.substring(Q+7);return X=X.replace("[",""),X.replace("]","")}return $}function e11($){if($=$.trim(),$.match(/^(.*:\/\/)(.*)/m))$=$.replace(/^(.*:\/\/)(.*)/gm,"$2");if($=WF4($),s11($)&&$.indexOf("[")===-1)$=`[${$}]`;let Z=s11($)?$.match(/(]:)(\d+)/):$.match(/(:)(\d+)/),Q=Z&&Z.length===3&&Z[1]&&Z[2]?parseInt(Z[2]):GF4.DEFAULT_PORT,Y=new URL(`${Q===80?"https":"http"}://${$}`);Y.port=`${Q}`;let J=Y.hostname;if(J.charAt(0)==="[")J=J.substring(1,J.length-1);return{listen:Y.host,hostname:J,port:Q}}class Pl{src;listen;hostname;port;didConnect;reconnects;lastConnect;gossiped;tlsName;resolves;constructor($,Z=!1){this.src=$,this.tlsName="";let Q=e11($);this.listen=Q.listen,this.hostname=Q.hostname,this.port=Q.port,this.didConnect=!1,this.reconnects=0,this.lastConnect=0,this.gossiped=Z}toString(){return this.listen}async resolve($){if(!$.fn||$.resolve===!1)return[this];let Z=[];if((0,r11.isIP)(this.hostname))return[this];else{let Q=await $.fn(this.hostname);if($.debug)console.log(`resolve ${this.hostname} = ${Q.join(",")}`);for(let X of Q){let Y=this.port===80?"https":"http",J=new URL(`${Y}://${s11(X)?"["+X+"]":X}`);J.port=`${this.port}`;let G=new Pl(J.host,!1);G.tlsName=this.hostname,Z.push(G)}}if($.randomize)(0,a11.shuffle)(Z);return this.resolves=Z,Z}}cQ$.ServerImpl=Pl;class I30{firstSelect;servers;currentServer;tlsName;randomize;constructor($={}){this.firstSelect=!0,this.servers=[],this.tlsName="",this.randomize=$.randomize||!1}setServers($){if(!Array.isArray($)||$.length===0)throw KF4.InvalidArgumentError.format("servers","cannot be empty");let Z=(0,o11.getUrlParseFn)(),Q=new Map;for(let Y of this.servers)Q.set(Y.listen,Y);let X=[];for(let Y of $){Y=Z?Z(Y):Y;let{listen:J}=e11(Y),G=Q.get(J);if(G)G.gossiped=!1,X.push(G);else X.push(new Pl(Y))}if(this.randomize)(0,a11.shuffle)(X);if(this.servers=X,this.currentServer===void 0||!X.includes(this.currentServer))this.currentServer=X[0],this.firstSelect=!0}clear(){this.servers.length=0}updateTLSName(){let $=this.getCurrentServer();if(!(0,r11.isIP)($.hostname))this.tlsName=$.hostname,this.servers.forEach((Z)=>{if(Z.gossiped)Z.tlsName=this.tlsName})}getCurrentServer(){return this.currentServer}addServer($,Z=!1){let Q=(0,o11.getUrlParseFn)();$=Q?Q($):$;let X=new Pl($,Z);if((0,r11.isIP)(X.hostname))X.tlsName=this.tlsName;this.servers.push(X)}selectServer(){if(this.firstSelect)return this.firstSelect=!1,this.currentServer;let $=this.servers.shift();if($)this.servers.push($),this.currentServer=$;return $}removeCurrentServer(){this.removeServer(this.currentServer)}removeServer($){if($){let Z=this.servers.indexOf($);this.servers.splice(Z,1)}}snapshot(){return I30.freezeAll(this.servers)}snapshotForHandler(){let $=this.currentServer;if(!$)return this.snapshot();let Z=this.servers.indexOf($);if(Z<=0)return this.snapshot();return I30.freezeAll([$,...this.servers.slice(0,Z),...this.servers.slice(Z+1)])}static freezeAll($){return $.map((Z)=>Object.freeze({hostname:Z.hostname,port:Z.port,listen:Z.listen,src:Z.src,tlsName:Z.tlsName,reconnects:Z.reconnects,lastConnect:Z.lastConnect,gossiped:Z.gossiped,didConnect:Z.didConnect}))}find($){return this.servers.find((Z)=>Z.listen===$.listen)}setCurrent($){this.currentServer=$}length(){return this.servers.length}next(){return this.servers.length?this.servers[0]:void 0}getServers(){return this.servers}update($,Z){let Q=[],X=[],Y=(0,o11.getUrlParseFn)(),J=new Map;if($.connect_urls&&$.connect_urls.length>0)$.connect_urls.forEach((K)=>{K=Y?Y(K,Z):K;let W=new Pl(K,!0);J.set(K,W)});let G=[];if(this.servers.forEach((K,W)=>{let H=K.listen;if(K.gossiped&&this.currentServer.listen!==H&&J.get(H)===void 0)G.push(W);J.delete(H)}),G.reverse(),G.forEach((K)=>{let W=this.servers.splice(K,1);X=X.concat(W[0].listen)}),J.forEach((K,W)=>{this.servers.push(K),Q.push(W)}),this.randomize&&Q.length>0){let K=this.currentServer,W=this.servers.filter((H)=>H!==K);(0,a11.shuffle)(W),this.servers=K?[K,...W]:W}return{added:Q,deleted:X}}}cQ$.Servers=I30});var V30=b((pQ$)=>{Object.defineProperty(pQ$,"__esModule",{value:!0});pQ$.QueuedIteratorImpl=void 0;var Z$1=iW(),dQ$=vG();class iQ${inflight;processed;received;noIterator;iterClosed;done;signal;yields;filtered;pendingFiltered;ctx;_data;err;time;profile;yielding;didBreak;constructor(){this.inflight=0,this.filtered=0,this.pendingFiltered=0,this.processed=0,this.received=0,this.noIterator=!1,this.done=!1,this.signal=(0,Z$1.deferred)(),this.yields=[],this.iterClosed=(0,Z$1.deferred)(),this.time=0,this.yielding=!1,this.didBreak=!1,this.profile=!1}[Symbol.asyncIterator](){return this.iterate()}push($){if(this.done)return;if(this.didBreak){if(typeof $==="function"){let Z=$;try{Z()}catch(Q){}}return}if(typeof $==="function")this.pendingFiltered++;this.yields.push($),this.signal.resolve()}async*iterate(){if(this.noIterator)throw new dQ$.InvalidOperationError("iterator cannot be used when a callback is registered");if(this.yielding)throw new dQ$.InvalidOperationError("iterator is already yielding");this.yielding=!0;try{while(!0){if(this.yields.length===0)await this.signal;if(this.err)throw this.err;let $=this.yields;this.inflight=$.length,this.yields=[];for(let Z=0;Z<$.length;Z++){if(typeof $[Z]==="function"){this.pendingFiltered--;let X=$[Z];try{X()}catch(Y){throw Y}if(this.err)throw this.err;continue}this.processed++,this.inflight--;let Q=this.profile?Date.now():0;yield $[Z],this.time=this.profile?Date.now()-Q:0}if(this.done)break;else if(this.yields.length===0)$.length=0,this.yields=$,this.signal=(0,Z$1.deferred)()}}finally{this.didBreak=!0,this.stop()}}stop($){if(this.done)return;this.err=$,this.done=!0,this.signal.resolve(),this.iterClosed.resolve($)}getProcessed(){return this.noIterator?this.received:this.processed}getPending(){return this.yields.length+this.inflight-this.pendingFiltered}getReceived(){return this.received-this.filtered}}pQ$.QueuedIteratorImpl=iQ$});var Q$1=b((aQ$)=>{Object.defineProperty(aQ$,"__esModule",{value:!0});aQ$.MuxSubscription=void 0;var NF4=Qw(),tQ$=vG();class oQ${baseInbox;reqs;constructor(){this.reqs=new Map}size(){return this.reqs.size}init($){return this.baseInbox=`${(0,NF4.createInbox)($)}.`,this.baseInbox}add($){if(!isNaN($.received))$.received=0;this.reqs.set($.token,$)}get($){return this.reqs.get($)}cancel($){this.reqs.delete($.token)}getToken($){let Z=$.subject||"";if(Z.indexOf(this.baseInbox)===0)return Z.substring(this.baseInbox.length);return null}all(){return Array.from(this.reqs.values())}handleError($,Z){if($)return this.all().forEach((Q)=>{Q.resolver(Z,{})}),!0;if(Z.operation==="publish"){let Q=this.all().find((X)=>{return X.requestSubject===Z.subject});if(Q)return Q.resolver(Z,{}),!0}return!1}dispatcher(){return($,Z)=>{let Q=this.getToken(Z);if(Q){let X=this.get(Q);if(X){if($===null)$=Z?.data?.length===0&&Z.headers?.code===503?new tQ$.NoRespondersError(X.requestSubject):null;X.resolver($,Z)}}}}close(){let $=new tQ$.RequestError("connection closed");this.reqs.forEach((Z)=>{Z.resolver($,{})})}}aQ$.MuxSubscription=oQ$});var X$1=b((eQ$)=>{Object.defineProperty(eQ$,"__esModule",{value:!0});eQ$.Heartbeat=void 0;var BF4=iW();class sQ${ph;interval;maxOut;timer;pendings;constructor($,Z,Q){this.ph=$,this.interval=Z,this.maxOut=Q,this.pendings=[]}start(){this.cancel(),this._schedule()}cancel($){if(this.timer)clearTimeout(this.timer),this.timer=void 0;if(this._reset(),$)this.ph.disconnect()}_schedule(){this.timer=setTimeout(()=>{if(this.ph.dispatchStatus({type:"ping",pendingPings:this.pendings.length+1}),this.pendings.length===this.maxOut){this.cancel(!0);return}let $=(0,BF4.deferred)();this.ph.flush($).then(()=>{this._reset()}).catch(()=>{this.cancel()}),this.pendings.push($),this._schedule()},this.interval)}_reset(){this.pendings=this.pendings.filter(($)=>{return $.resolve(),!1})}}eQ$.Heartbeat=sQ$});var G$1=b((YX$)=>{Object.defineProperty(YX$,"__esModule",{value:!0});YX$.DenoBuffer=YX$.MAX_SIZE=YX$.AssertionError=void 0;YX$.assert=QX$;YX$.concat=XX$;YX$.append=OF4;YX$.readAll=DF4;YX$.writeAll=wF4;var LF4=_G();class Y$1 extends Error{constructor($){super($);this.name="AssertionError"}}YX$.AssertionError=Y$1;function QX$($,Z="Assertion failed."){if(!$)throw new Y$1(Z)}var ZX$=32768;YX$.MAX_SIZE=4294967294;function k30($,Z,Q=0){let X=Z.byteLength-Q;if($.byteLength>X)$=$.subarray(0,X);return Z.set($,Q),$.byteLength}function XX$($,Z){if($===void 0&&Z===void 0)return new Uint8Array(0);if($===void 0)return Z;if(Z===void 0)return $;let Q=new Uint8Array($.length+Z.length);return Q.set($,0),Q.set(Z,$.length),Q}function OF4($,Z){return XX$($,Uint8Array.of(Z))}class J$1{_buf;_off;constructor($){if(this._off=0,$==null){this._buf=new Uint8Array(0);return}this._buf=new Uint8Array($)}bytes($={copy:!0}){if($.copy===!1)return this._buf.subarray(this._off);return this._buf.slice(this._off)}empty(){return this._buf.byteLength<=this._off}get length(){return this._buf.byteLength-this._off}get capacity(){return this._buf.buffer.byteLength}truncate($){if($===0){this.reset();return}if($<0||$>this.length)throw Error("bytes.Buffer: truncation out of range");this._reslice(this._off+$)}reset(){this._reslice(0),this._off=0}_tryGrowByReslice($){let Z=this._buf.byteLength;if($<=this.capacity-Z)return this._reslice(Z+$),Z;return-1}_reslice($){QX$($<=this._buf.buffer.byteLength),this._buf=new Uint8Array(this._buf.buffer,0,$)}readByte(){let $=new Uint8Array(1);if(this.read($))return $[0];return null}read($){if(this.empty()){if(this.reset(),$.byteLength===0)return 0;return null}let Z=k30(this._buf.subarray(this._off),$);return this._off+=Z,Z}writeByte($){return this.write(Uint8Array.of($))}writeString($){return this.write(LF4.TE.encode($))}write($){let Z=this._grow($.byteLength);return k30($,this._buf,Z)}_grow($){let Z=this.length;if(Z===0&&this._off!==0)this.reset();let Q=this._tryGrowByReslice($);if(Q>=0)return Q;let X=this.capacity;if($<=Math.floor(X/2)-Z)k30(this._buf.subarray(this._off),this._buf);else if(X+$>YX$.MAX_SIZE)throw Error("The buffer cannot be grown beyond the maximum size.");else{let Y=new Uint8Array(Math.min(2*X+$,YX$.MAX_SIZE));k30(this._buf.subarray(this._off),Y),this._buf=Y}return this._off=0,this._reslice(Math.min(Z+$,YX$.MAX_SIZE)),Z}grow($){if($<0)throw Error("Buffer._grow: negative count");let Z=this._grow($);this._reslice(Z)}readFrom($){let Z=0,Q=new Uint8Array(ZX$);while(!0){let X=this.capacity-this.length<ZX$,Y=X?Q:new Uint8Array(this._buf.buffer,this.length),J=$.read(Y);if(J===null)return Z;if(X)this.write(Y.subarray(0,J));else this._reslice(this.length+J);Z+=J}}}YX$.DenoBuffer=J$1;function DF4($){let Z=new J$1;return Z.readFrom($),Z.bytes()}function wF4($,Z){let Q=0;while(Q<Z.length)Q+=$.write(Z.subarray(Q))}});var H$1=b((HX$)=>{Object.defineProperty(HX$,"__esModule",{value:!0});HX$.cc=HX$.State=HX$.Parser=HX$.Kind=void 0;HX$.describe=RF4;var K$1=G$1(),W$1=_G();HX$.Kind={OK:0,ERR:1,MSG:2,INFO:3,PING:4,PONG:5};function RF4($){let Z,Q="";switch($.kind){case HX$.Kind.MSG:Z="MSG";break;case HX$.Kind.OK:Z="OK";break;case HX$.Kind.ERR:Z="ERR",Q=W$1.TD.decode($.data);break;case HX$.Kind.PING:Z="PING";break;case HX$.Kind.PONG:Z="PONG";break;case HX$.Kind.INFO:Z="INFO",Q=W$1.TD.decode($.data)}return`${Z}: ${Q}`}function GX$(){let $={};return $.sid=-1,$.hdr=-1,$.size=-1,$}var KX$=48,qF4=57,Tl=67108864;class WX${dispatcher;state;as;drop;hdr;ma;argBuf;msgBuf;constructor($){this.dispatcher=$,this.state=HX$.State.OP_START,this.as=0,this.drop=0,this.hdr=0}parse($){let Z;for(Z=0;Z<$.length;Z++){let Q=$[Z];switch(this.state){case HX$.State.OP_START:switch(Q){case HX$.cc.M:case HX$.cc.m:this.state=HX$.State.OP_M,this.hdr=-1,this.ma=GX$();break;case HX$.cc.H:case HX$.cc.h:this.state=HX$.State.OP_H,this.hdr=0,this.ma=GX$();break;case HX$.cc.P:case HX$.cc.p:this.state=HX$.State.OP_P;break;case HX$.cc.PLUS:this.state=HX$.State.OP_PLUS;break;case HX$.cc.MINUS:this.state=HX$.State.OP_MINUS;break;case HX$.cc.I:case HX$.cc.i:this.state=HX$.State.OP_I;break;default:throw this.fail($.subarray(Z))}break;case HX$.State.OP_H:switch(Q){case HX$.cc.M:case HX$.cc.m:this.state=HX$.State.OP_M;break;default:throw this.fail($.subarray(Z))}break;case HX$.State.OP_M:switch(Q){case HX$.cc.S:case HX$.cc.s:this.state=HX$.State.OP_MS;break;default:throw this.fail($.subarray(Z))}break;case HX$.State.OP_MS:switch(Q){case HX$.cc.G:case HX$.cc.g:this.state=HX$.State.OP_MSG;break;default:throw this.fail($.subarray(Z))}break;case HX$.State.OP_MSG:switch(Q){case HX$.cc.SPACE:case HX$.cc.TAB:this.state=HX$.State.OP_MSG_SPC;break;default:throw this.fail($.subarray(Z))}break;case HX$.State.OP_MSG_SPC:switch(Q){case HX$.cc.SPACE:case HX$.cc.TAB:continue;default:this.state=HX$.State.MSG_ARG,this.as=Z}break;case HX$.State.MSG_ARG:switch(Q){case HX$.cc.CR:this.drop=1;break;case HX$.cc.NL:{let X=this.argBuf?this.argBuf.bytes():$.subarray(this.as,Z-this.drop);this.processMsgArgs(X),this.drop=0,this.as=Z+1,this.state=HX$.State.MSG_PAYLOAD,Z=this.as+this.ma.size-1;break}default:if(this.argBuf)this.argBuf.writeByte(Q)}break;case HX$.State.MSG_PAYLOAD:if(this.msgBuf)if(this.msgBuf.length>=this.ma.size){let X=this.msgBuf.bytes({copy:!1});this.dispatcher.push({kind:HX$.Kind.MSG,msg:this.ma,data:X}),this.argBuf=void 0,this.msgBuf=void 0,this.state=HX$.State.MSG_END}else{let X=this.ma.size-this.msgBuf.length,Y=$.length-Z;if(Y<X)X=Y;if(X>0)this.msgBuf.write($.subarray(Z,Z+X)),Z=Z+X-1;else this.msgBuf.writeByte(Q)}else if(Z-this.as>=this.ma.size)this.dispatcher.push({kind:HX$.Kind.MSG,msg:this.ma,data:$.subarray(this.as,Z)}),this.argBuf=void 0,this.msgBuf=void 0,this.state=HX$.State.MSG_END;break;case HX$.State.MSG_END:switch(Q){case HX$.cc.NL:this.drop=0,this.as=Z+1,this.state=HX$.State.OP_START;break;default:continue}break;case HX$.State.OP_PLUS:switch(Q){case HX$.cc.O:case HX$.cc.o:this.state=HX$.State.OP_PLUS_O;break;default:throw this.fail($.subarray(Z))}break;case HX$.State.OP_PLUS_O:switch(Q){case HX$.cc.K:case HX$.cc.k:this.state=HX$.State.OP_PLUS_OK;break;default:throw this.fail($.subarray(Z))}break;case HX$.State.OP_PLUS_OK:switch(Q){case HX$.cc.NL:this.dispatcher.push({kind:HX$.Kind.OK}),this.drop=0,this.state=HX$.State.OP_START;break}break;case HX$.State.OP_MINUS:switch(Q){case HX$.cc.E:case HX$.cc.e:this.state=HX$.State.OP_MINUS_E;break;default:throw this.fail($.subarray(Z))}break;case HX$.State.OP_MINUS_E:switch(Q){case HX$.cc.R:case HX$.cc.r:this.state=HX$.State.OP_MINUS_ER;break;default:throw this.fail($.subarray(Z))}break;case HX$.State.OP_MINUS_ER:switch(Q){case HX$.cc.R:case HX$.cc.r:this.state=HX$.State.OP_MINUS_ERR;break;default:throw this.fail($.subarray(Z))}break;case HX$.State.OP_MINUS_ERR:switch(Q){case HX$.cc.SPACE:case HX$.cc.TAB:this.state=HX$.State.OP_MINUS_ERR_SPC;break;default:throw this.fail($.subarray(Z))}break;case HX$.State.OP_MINUS_ERR_SPC:switch(Q){case HX$.cc.SPACE:case HX$.cc.TAB:continue;default:this.state=HX$.State.MINUS_ERR_ARG,this.as=Z}break;case HX$.State.MINUS_ERR_ARG:switch(Q){case HX$.cc.CR:this.drop=1;break;case HX$.cc.NL:{let X;if(this.argBuf)X=this.argBuf.bytes(),this.argBuf=void 0;else X=$.subarray(this.as,Z-this.drop);this.dispatcher.push({kind:HX$.Kind.ERR,data:X}),this.drop=0,this.as=Z+1,this.state=HX$.State.OP_START;break}default:if(this.argBuf)this.argBuf.write(Uint8Array.of(Q))}break;case HX$.State.OP_P:switch(Q){case HX$.cc.I:case HX$.cc.i:this.state=HX$.State.OP_PI;break;case HX$.cc.O:case HX$.cc.o:this.state=HX$.State.OP_PO;break;default:throw this.fail($.subarray(Z))}break;case HX$.State.OP_PO:switch(Q){case HX$.cc.N:case HX$.cc.n:this.state=HX$.State.OP_PON;break;default:throw this.fail($.subarray(Z))}break;case HX$.State.OP_PON:switch(Q){case HX$.cc.G:case HX$.cc.g:this.state=HX$.State.OP_PONG;break;default:throw this.fail($.subarray(Z))}break;case HX$.State.OP_PONG:switch(Q){case HX$.cc.NL:this.dispatcher.push({kind:HX$.Kind.PONG}),this.drop=0,this.state=HX$.State.OP_START;break}break;case HX$.State.OP_PI:switch(Q){case HX$.cc.N:case HX$.cc.n:this.state=HX$.State.OP_PIN;break;default:throw this.fail($.subarray(Z))}break;case HX$.State.OP_PIN:switch(Q){case HX$.cc.G:case HX$.cc.g:this.state=HX$.State.OP_PING;break;default:throw this.fail($.subarray(Z))}break;case HX$.State.OP_PING:switch(Q){case HX$.cc.NL:this.dispatcher.push({kind:HX$.Kind.PING}),this.drop=0,this.state=HX$.State.OP_START;break}break;case HX$.State.OP_I:switch(Q){case HX$.cc.N:case HX$.cc.n:this.state=HX$.State.OP_IN;break;default:throw this.fail($.subarray(Z))}break;case HX$.State.OP_IN:switch(Q){case HX$.cc.F:case HX$.cc.f:this.state=HX$.State.OP_INF;break;default:throw this.fail($.subarray(Z))}break;case HX$.State.OP_INF:switch(Q){case HX$.cc.O:case HX$.cc.o:this.state=HX$.State.OP_INFO;break;default:throw this.fail($.subarray(Z))}break;case HX$.State.OP_INFO:switch(Q){case HX$.cc.SPACE:case HX$.cc.TAB:this.state=HX$.State.OP_INFO_SPC;break;default:throw this.fail($.subarray(Z))}break;case HX$.State.OP_INFO_SPC:switch(Q){case HX$.cc.SPACE:case HX$.cc.TAB:continue;default:this.state=HX$.State.INFO_ARG,this.as=Z}break;case HX$.State.INFO_ARG:switch(Q){case HX$.cc.CR:this.drop=1;break;case HX$.cc.NL:{let X;if(this.argBuf)X=this.argBuf.bytes(),this.argBuf=void 0;else X=$.subarray(this.as,Z-this.drop);this.dispatcher.push({kind:HX$.Kind.INFO,data:X}),this.drop=0,this.as=Z+1,this.state=HX$.State.OP_START;break}default:if(this.argBuf)this.argBuf.writeByte(Q)}break;default:throw this.fail($.subarray(Z))}}if((this.state===HX$.State.MSG_ARG||this.state===HX$.State.MINUS_ERR_ARG||this.state===HX$.State.INFO_ARG)&&!this.argBuf)this.argBuf=new K$1.DenoBuffer($.subarray(this.as,Z-this.drop));if(this.state===HX$.State.MSG_PAYLOAD&&!this.msgBuf){if(!this.argBuf)this.cloneMsgArg();this.msgBuf=new K$1.DenoBuffer($.subarray(this.as))}}cloneMsgArg(){let $=this.ma.subject.length,Z=this.ma.reply?this.ma.reply.length:0,Q=new Uint8Array($+Z);if(Q.set(this.ma.subject),this.ma.reply)Q.set(this.ma.reply,$);if(this.argBuf=new K$1.DenoBuffer(Q),this.ma.subject=Q.subarray(0,$),this.ma.reply)this.ma.reply=Q.subarray($)}processMsgArgs($){if(this.hdr>=0)return this.processHeaderMsgArgs($);let Z=[],Q=-1;for(let X=0;X<$.length;X++)switch($[X]){case HX$.cc.SPACE:case HX$.cc.TAB:case HX$.cc.CR:case HX$.cc.NL:if(Q>=0)Z.push($.subarray(Q,X)),Q=-1;break;default:if(Q<0)Q=X}if(Q>=0)Z.push($.subarray(Q));switch(Z.length){case 3:this.ma.subject=Z[0],this.ma.sid=this.protoParseInt(Z[1]),this.ma.reply=void 0,this.ma.size=this.protoParseInt(Z[2],Tl);break;case 4:this.ma.subject=Z[0],this.ma.sid=this.protoParseInt(Z[1]),this.ma.reply=Z[2],this.ma.size=this.protoParseInt(Z[3],Tl);break;default:throw this.fail($,"processMsgArgs Parse Error")}if(this.ma.sid<0)throw this.fail($,"processMsgArgs Bad or Missing Sid Error");if(this.ma.size<0)throw this.fail($,"processMsgArgs Bad or Missing Size Error")}fail($,Z=""){if(!Z)Z=`parse error [${this.state}]`;else Z=`${Z} [${this.state}]`;return Error(`${Z}: ${W$1.TD.decode($)}`)}processHeaderMsgArgs($){let Z=[],Q=-1;for(let X=0;X<$.length;X++)switch($[X]){case HX$.cc.SPACE:case HX$.cc.TAB:case HX$.cc.CR:case HX$.cc.NL:if(Q>=0)Z.push($.subarray(Q,X)),Q=-1;break;default:if(Q<0)Q=X}if(Q>=0)Z.push($.subarray(Q));switch(Z.length){case 4:this.ma.subject=Z[0],this.ma.sid=this.protoParseInt(Z[1]),this.ma.reply=void 0,this.ma.hdr=this.protoParseInt(Z[2],Tl),this.ma.size=this.protoParseInt(Z[3],Tl);break;case 5:this.ma.subject=Z[0],this.ma.sid=this.protoParseInt(Z[1]),this.ma.reply=Z[2],this.ma.hdr=this.protoParseInt(Z[3],Tl),this.ma.size=this.protoParseInt(Z[4],Tl);break;default:throw this.fail($,"processHeaderMsgArgs Parse Error")}if(this.ma.sid<0)throw this.fail($,"processHeaderMsgArgs Bad or Missing Sid Error");if(this.ma.hdr<0||this.ma.hdr>this.ma.size)throw this.fail($,"processHeaderMsgArgs Bad or Missing Header Size Error");if(this.ma.size<0)throw this.fail($,"processHeaderMsgArgs Bad or Missing Size Error")}protoParseInt($,Z){if($.length===0||$.length>15)return-1;let Q=0;for(let X=0;X<$.length;X++){if($[X]<KX$||$[X]>qF4)return-1;Q=Q*10+($[X]-KX$)}return Z!==void 0&&Q>Z?-1:Q}}HX$.Parser=WX$;HX$.State={OP_START:0,OP_PLUS:1,OP_PLUS_O:2,OP_PLUS_OK:3,OP_MINUS:4,OP_MINUS_E:5,OP_MINUS_ER:6,OP_MINUS_ERR:7,OP_MINUS_ERR_SPC:8,MINUS_ERR_ARG:9,OP_M:10,OP_MS:11,OP_MSG:12,OP_MSG_SPC:13,MSG_ARG:14,MSG_PAYLOAD:15,MSG_END:16,OP_H:17,OP_P:18,OP_PI:19,OP_PIN:20,OP_PING:21,OP_PO:22,OP_PON:23,OP_PONG:24,OP_I:25,OP_IN:26,OP_INF:27,OP_INFO:28,OP_INFO_SPC:29,INFO_ARG:30};HX$.cc={CR:13,E:69,e:101,F:70,f:102,G:71,g:103,H:72,h:104,I:73,i:105,K:75,k:107,M:77,m:109,MINUS:45,N:78,n:110,NL:10,O:79,o:111,P:80,p:112,PLUS:43,R:82,r:114,S:83,s:115,SPACE:32,TAB:9}});var _30=b((UX$)=>{Object.defineProperty(UX$,"__esModule",{value:!0});UX$.MsgHdrsImpl=void 0;UX$.canonicalMIMEHeaderKey=U$1;UX$.headers=VF4;var FX$=_G(),pW=Qw(),C30=vG();function U$1($){let F=!0,U=Array($.length);for(let N=0;N<$.length;N++){let B=$.charCodeAt(N);if(B===58||B<33||B>126)throw C30.InvalidArgumentError.format("header",`'${$[N]}' is not a valid character in a header name`);if(F&&97<=B&&B<=122)B-=32;else if(!F&&65<=B&&B<=90)B+=32;U[N]=B,F=B==45}return String.fromCharCode(...U)}function VF4($=0,Z=""){if($===0&&Z!=="")throw C30.InvalidArgumentError.format("code","is required");else if($>0&&Z==="")throw C30.InvalidArgumentError.format("description","is required");return new Al($,Z)}var F$1="NATS/1.0";class Al{_code;headers;_description;constructor($=0,Z=""){this._code=$,this._description=Z,this.headers=new Map}[Symbol.iterator](){return this.headers.entries()}size(){return this.headers.size}equals($){if($&&this.headers.size===$.headers.size&&this._code===$._code){for(let[Z,Q]of this.headers){let X=$.values(Z);if(Q.length!==X.length)return!1;let Y=[...Q].sort(),J=[...X].sort();for(let G=0;G<Y.length;G++)if(Y[G]!==J[G])return!1}return!0}return!1}static decode($){let Z=new Al,X=FX$.TD.decode($).split(`\r
 `),Y=X[0];if(Y!==F$1){let J=Y.replace(F$1,"").trim();if(J.length>0){if(Z._code=parseInt(J,10),isNaN(Z._code))Z._code=0;let G=Z._code.toString();J=J.replace(G,""),Z._description=J.trim()}}if(X.length>=1)X.slice(1).map((J)=>{if(J){let G=J.indexOf(":");if(G>-1){let K=J.slice(0,G),W=J.slice(G+1).trim();Z.append(K,W)}}});return Z}toString(){if(this.headers.size===0&&this._code===0)return"";let $=F$1;if(this._code>0&&this._description!=="")$+=` ${this._code} ${this._description}`;for(let[Z,Q]of this.headers)for(let X=0;X<Q.length;X++)$=`${$}\r
 ${Z}: ${Q[X]}`;return`${$}\r
@@ -3271,7 +3271,7 @@ Caused by: ${Z.stack}`}};Fi=class Fi extends uX{constructor($,Z){super($,Z);this
 ${Y}`:Y}var Nm$,tW6;var lH1=L(()=>{Nm$=/[\r\n<>]/,tW6=/^[^\s@<>]+@[^\s@<>]+\.[^\s@<>]+$/});var PV0=L(()=>{O8();lH1()});function aW6($){if($ instanceof TypeError)return!0;if($ instanceof Error&&!($ instanceof DOMException)&&typeof $.code==="string")return!0;if($ instanceof DOMException&&$.name==="AbortError")return!0;return!1}async function cH1($,Z,Q,X){try{return await V8(async()=>{let J=await fetch($,{...Z,signal:AbortSignal.timeout(X)});return{status:J.status,ok:J.ok,body:await J.text()}},{maxAttempts:3,minTimeout:50,maxTimeout:500,multiplier:2,jitter:0.5,isRetriable:aW6})}catch(Y){let J=Y instanceof Error?Y.message:String(Y);throw Error(`[SANDBOX_UNREACHABLE] sandbox daemon ${Q} request failed: ${J}`,{cause:Y})}}async function TV0($){try{let Z=await fetch(`${$}/health`,{signal:AbortSignal.timeout(rW6)});if(!Z.ok){try{await Z.text()}catch{}return null}let Q=await Z.json();if(typeof Q==="object"&&Q!==null&&typeof Q.bootId==="string"&&typeof Q.ready==="boolean"&&Q.setup&&typeof Q.setup.running==="boolean"&&typeof Q.setup.done==="boolean")return Q;return null}catch{return null}}async function dH1($){for(let Z=0;Z<Lm$;Z++){if(await TV0($)!==null)return;let Q=(Math.random()*2-1)*sW6;await k$(Om$+Q)}throw Error(`sandbox daemon at ${$} did not respond on /health within ${Lm$*Om$/1000}s`)}async function jy($,Z,Q,X,Y){return eW6($,Z,"POST",Q,X,Y)}async function eW6($,Z,Q,X,Y,J){let G={...X};if(Y&&Y.rotateToken!==void 0)G.auth=Y;let K=await cH1(`${$}/_sandbox/config`,{method:Q,headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:JSON.stringify(G)},"/_sandbox/config",J?.timeoutMs??mH1);if(!K.ok)throw new wy(K.status,K.body);return jm$(K.body,"/_sandbox/config")}async function Dm$($,Z,Q){let X=await cH1(`${$}/_sandbox/setup/${Q}`,{method:"POST",headers:{Authorization:`Bearer ${Z}`}},`/_sandbox/setup/${Q}`,mH1);if(!X.ok)throw Error(`sandbox daemon /_sandbox/setup/${Q} returned ${X.status}: ${X.body}`)}async function wm$($,Z,Q){let X=await cH1(`${$}/_sandbox/orgfs-config`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:Q},"/_sandbox/orgfs-config",mH1);if(!X.ok)throw Error(`sandbox daemon /_sandbox/orgfs-config returned ${X.status}: ${X.body}`);return jm$(X.body,"/_sandbox/orgfs-config")}function jm$($,Z){try{return JSON.parse($)}catch(Q){throw Error(`sandbox daemon ${Z} returned a malformed JSON body: ${$.slice(0,200)}`,{cause:Q})}}async function g80($,Z,Q,X){let Y=new Headers(X.headers);for(let K of $H6)Y.delete(K);Y.set("authorization",`Bearer ${Z}`);let J=X.method!=="GET"&&X.method!=="HEAD",G=`${$}${Q.startsWith("/")?Q:`/${Q}`}`;return fetch(G,{method:X.method,headers:Y,body:J?X.body:void 0,redirect:"manual",signal:X.signal,duplex:J?"half":void 0})}var wy,rW6=500,mH1=30000,Lm$=25,Om$=200,sW6=50,$H6;var iH1=L(()=>{PV0();O8();wy=class wy extends Error{status;constructor($,Z){super(`sandbox daemon /_sandbox/config returned ${$}: ${Z}`);this.status=$;this.name="ConfigRequestError"}};$H6=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length"]});class AV0{counted=new Set;markCounted($){this.counted.add($)}consume($){return this.counted.delete($)}}class RV0{map=new Map;async run($,Z){let Q=this.map.get($);if(Q)return Q;let X=Z();this.map.set($,X);try{return await X}finally{this.map.delete($)}}}function qV0($,Z,Q){if(!$)return Q(null);if(!$.withLock)return Q($);return $.withLock(Z,Q)}function h80($){if(!$.orgId||!$.virtualMcpId||!$.branch)throw Error("composeSandboxRef: orgId, virtualMcpId and branch are all required for agent refs");return`agent:${$.orgId}:${$.virtualMcpId}:${$.branch}`}function Em$($){if(!$.startsWith("agent:"))return"";let Z=$.split(":");return Z.length>=4?Z.slice(3).join(":"):""}function zm$($){return`${$.userId}:${$.projectRef}`}import{hash as ZH6}from"crypto";function QH6($,Z=16){return ZH6("sha256",zm$($),"hex").slice(0,Z)}function Ey($){let Z=QH6($),Q=XH6(Em$($.projectRef));return Q?`${Q}-${Z}`:`s-${Z}`}function XH6($){if(!$)return"";let Z=$.split("/").pop()??"",Q="",X=!1;for(let Y of Z.toLowerCase()){let J=Y.charCodeAt(0),G=J>=97&&J<=122,K=J>=48&&J<=57;if(!G&&!K){X||=Q.length>0;continue}if(X){if(Q.length+1>=Pm$)break;Q+="-",X=!1}if(Q+=Y,Q.length===Pm$)break}return Q}var Pm$=24;var Tm$=()=>{};function MV0($,Z){let Q=$.replace(/\/+$/,"");if(Q.includes("{handle}"))return`${Q.replace("{handle}",Z)}/`;try{let X=new URL(Q);return X.hostname=`${Z}.${X.hostname}`,`${X.toString()}/`}catch{return`${Q}/${Z}/`}}function IV0($){let Z=$.repo,Q=Z?{repository:{cloneUrl:Z.cloneUrl,repoName:Z.displayName??YH6(Z.cloneUrl),...Z.branch?{branch:Z.branch}:{},submoduleCredentials:Z.submoduleCredentials??[]},repositories:($.extraRepos??[]).filter((W)=>!!W.directoryName).map((W)=>({cloneUrl:W.cloneUrl,repoName:W.directoryName,...W.branch?{branch:W.branch}:{},submoduleCredentials:W.submoduleCredentials??[]})),...Z.userName.trim()||Z.userEmail.trim()?{identity:{userName:Z.userName,userEmail:Z.userEmail}}:{}}:void 0,X=$.tenant,Y=qi({userName:X?.userName,userEmail:X?.userEmail})??void 0,J=$.packageManager?{name:$.packageManager.name,...$.packageManager.path?{path:$.packageManager.path}:{}}:void 0,G=J?{packageManager:J,runtime:$.runtime,...$.port!==void 0?{port:$.port}:{}}:void 0,K=X?.orgId;if(!Q&&!G&&!Y&&$.cloneOnly===void 0&&!K)return null;return{...Q?{git:Q}:{},...Y?{operator:Y}:{},...K?{orgId:K}:{},...$.cloneOnly!==void 0?{cloneOnly:$.cloneOnly}:{},...G?{application:G}:{}}}function YH6($){try{let Z=new URL($);return Z.pathname.replace(/^\/+/,"").replace(/\.git$/,"")||Z.hostname}catch{return $}}var Am$=L(()=>{lH1()});function JH6($){try{return new URL($).username.length>0}catch{return!1}}function pH1($){let Z=$.repo?.cloneUrl;if(!Z||!JH6(Z))return null;return{git:{repository:{cloneUrl:Z}}}}var nH1=L(()=>{Tm$();Am$()});async function*Mm$($){let Z=$.now??(()=>Date.now()),Q=Z(),X=$.schedulingTimeoutMs??KH6,Y={pod:{},sandbox:{},events:{hasPulling:!1,hasPulled:!1},startedAt:Q},J=[],G=null,K=!1,W=(E)=>{if(K)return;if(G){let z=G;G=null,z(E)}else J.push(E)},H=()=>{if(J.length>0)return Promise.resolve(J.shift());if(K)return Promise.resolve(null);return new Promise((E)=>{G=E})},F=()=>{if(K)return;if(K=!0,G){let E=G;G=null,E(null)}},U=new AbortController,N=()=>{U.abort(),F()};if($.signal)if($.signal.aborted)U.abort(),F();else $.signal.addEventListener("abort",N,{once:!0});let B=Math.max(0,X-(Z()-Q)),O=setTimeout(()=>W("tick"),B+100),D,w=new Promise((E)=>{D=E}),j=Promise.allSettled([HH6($.kc,$.namespace,$.claimName,U.signal,Y,W,Z,D),UH6($.kc,$.namespace,$.claimName,U.signal,Y,W),NH6($.kc,$.namespace,$.claimName,w,U.signal,Y,W,Z)]);try{let E=null,z=-1,A=Rm$(Y,X,Z);if(E=oH1(A),!tH1(A))z=qm$(A);if(yield A,tH1(A))return;while(!K){if(await H()===null)break;let T=Rm$(Y,X,Z);if(tH1(T)){let C=oH1(T);if(C!==E)E=C,yield T;return}let q=qm$(T);if(q<z)continue;let f=oH1(T);if(f!==E)E=f,z=q,yield T}}finally{if(clearTimeout(O),U.abort(),$.signal)$.signal.removeEventListener("abort",N);F(),await j.catch(()=>{})}}async function Im$($,Z=WH6){let Q=new AbortController,X="claiming",Y,J=()=>{clearTimeout(Y),Y=setTimeout(()=>Q.abort(),Z)};try{J();for await(let G of $(Q.signal)){if(G.kind==="ready")return;if(G.kind==="failed")throw new uX(G.message);X=G.kind,J()}}finally{clearTimeout(Y),Q.abort()}throw new Fi(`Sandbox did not become ready: no progress for ${Math.round(Z/1000)}s while ${X}`)}function Rm$($,Z,Q){let{pod:X,sandbox:Y,events:J,startedAt:G}=$;if(Y.ready)return{kind:"ready"};let K=X.containerWaitingReason;if(K==="ImagePullBackOff"||K==="ErrImagePull")return{kind:"failed",reason:"image-pull-backoff",message:"Sandbox image failed to download. The cluster may be missing pull credentials or the image tag may not exist."};if(K==="CrashLoopBackOff")return{kind:"failed",reason:"crash-loop-backoff",message:"Sandbox crashed during startup and is now in CrashLoopBackOff. Check pod logs."};if(!X.scheduled&&J.lastFailedSchedulingAt!==void 0&&Q()-G>Z)return{kind:"failed",reason:"scheduling-timeout",message:J.failedSchedulingMessage??`Pod could not be scheduled within ${Math.round(Z/1000)}s.`};if(X.containerRunning&&!X.containerReady)return{kind:"warming-daemon",since:G};if(J.hasPulling&&!J.hasPulled)return{kind:"pulling-image",since:G};if(K==="ContainerCreating"||K==="PodInitializing"||X.scheduled&&!X.containerRunning)return{kind:"starting-container",since:G};if(X.scheduledFalseReason==="Unschedulable"||J.lastFailedSchedulingAt!==void 0&&!X.scheduled)return{kind:"waiting-for-capacity",since:G,message:J.failedSchedulingMessage??X.scheduledFalseMessage,nodeClaim:J.nominatedNodeClaim};return{kind:"claiming",since:G}}function tH1($){return $.kind==="ready"||$.kind==="failed"}function qm$($){switch($.kind){case"claiming":return 0;case"waiting-for-capacity":return 1;case"pulling-image":return 2;case"starting-container":return 3;case"warming-daemon":return 4;case"ready":case"failed":return 99}}function oH1($){switch($.kind){case"claiming":case"pulling-image":case"starting-container":case"warming-daemon":return $.kind;case"waiting-for-capacity":return`waiting-for-capacity:${$.message??""}:${$.nodeClaim??""}`;case"ready":return"ready";case"failed":return`failed:${$.reason}:${$.message}`}}async function HH6($,Z,Q,X,Y,J,G,K){let W=`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?watch=true&labelSelector=${encodeURIComponent(`${GH6}=${Q}`)}`;return VV0({kc:$,path:W,signal:X,label:`pod/${Q}`,onEvent:(H)=>{if(H.type!=="ADDED"&&H.type!=="MODIFIED")return;let F=H.object;if(F.metadata?.name)K(F.metadata.name);FH6(F,Y,G),J("pod")}})}function FH6($,Z,Q){let Y=($.status?.conditions??[]).find((G)=>G.type==="PodScheduled");if(Y?.status==="True")Z.pod.scheduled=!0,Z.pod.scheduledFalseReason=void 0,Z.pod.scheduledFalseMessage=void 0;else if(Y?.status==="False")Z.pod.scheduled=!1,Z.pod.scheduledFalseReason=Y.reason,Z.pod.scheduledFalseMessage=Y.message;let J=($.status?.containerStatuses??[]).find((G)=>G.name===JQ.MAIN_CONTAINER_NAME);if(J)Z.pod.containerWaitingReason=J.state?.waiting?.reason,Z.pod.containerRunning=!!J.state?.running,Z.pod.containerReady=J.ready===!0}async function UH6($,Z,Q,X,Y,J){let G=`/apis/${JQ.CLAIM_API_GROUP}/${JQ.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(Z)}/${JQ.CLAIM_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${Q}`)}`;return VV0({kc:$,path:G,signal:X,label:`sandboxclaim/${Q}`,onEvent:(K)=>{if(K.type!=="ADDED"&&K.type!=="MODIFIED")return;let H=K.object.status?.conditions?.find((F)=>F.type==="Ready");if(!H)return;if(H.status==="True")Y.sandbox.ready=!0,Y.sandbox.notReadyReason=void 0,Y.sandbox.notReadyMessage=void 0;else Y.sandbox.ready=!1,Y.sandbox.notReadyReason=H.reason,Y.sandbox.notReadyMessage=H.message;J("sandbox")}})}async function NH6($,Z,Q,X,Y,J,G,K){let W=await Promise.race([X,new Promise((F)=>{if(Y.aborted){F(Q);return}Y.addEventListener("abort",()=>F(Q),{once:!0})})]);if(Y.aborted)return;let H=`/api/v1/namespaces/${encodeURIComponent(Z)}/events?watch=true&fieldSelector=${encodeURIComponent(`involvedObject.name=${W},involvedObject.kind=Pod`)}`;return VV0({kc:$,path:H,signal:Y,label:`events/${Q}`,onEvent:(F)=>{if(F.type!=="ADDED"&&F.type!=="MODIFIED")return;let U=F.object,N=U.reason;if(!N)return;switch(N){case"Pulling":J.events.hasPulling=!0;break;case"Pulled":J.events.hasPulling=!0,J.events.hasPulled=!0;break;case"FailedScheduling":J.events.lastFailedSchedulingAt=K(),J.events.failedSchedulingMessage=U.message;break;case"Nominated":{let B=U.message?.match(/nodeclaim\/([\w-]+)/);if(B)J.events.nominatedNodeClaim=B[1];break}default:return}G("event")}})}async function Vm$($){let{kc:Z,namespace:Q,labelSelector:X,signal:Y,onDelete:J}=$,G=`/apis/${JQ.CLAIM_API_GROUP}/${JQ.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(Q)}/${JQ.CLAIM_PLURAL}?watch=true&labelSelector=${encodeURIComponent(X)}`;return VV0({kc:Z,path:G,signal:Y,label:"sandboxclaim-reaper",onEvent:(K)=>{if(K.type!=="DELETED")return;let W=K.object.metadata?.name;if(W)J(W)}})}async function VV0($){let{kc:Z,path:Q,signal:X,label:Y,onEvent:J}=$,G=0;while(!X.aborted){try{let W=await eK(Z,{method:"GET",path:Q,signal:X,headers:{accept:"application/json"},stream:!0});if(!W.ok||!W.body){try{await W.body?.cancel()}catch{}if(W.status===401||W.status===403){console.warn(`[lifecycle-watcher] ${Y} stopped: watch denied (${W.status} ${W.statusText}). `+"The kubeconfig in use cannot watch SandboxClaims \u2014 if you are running locally, "+"this provider should not be active (check STUDIO_AGENT_SANDBOX_ENABLED).");return}throw Error(`watch handshake failed: ${W.status} ${W.statusText}`)}G=0;for await(let H of yb$(W.body)){if(X.aborted)return;try{J(H)}catch(F){console.warn(`[lifecycle-watcher] ${Y} onEvent threw: ${F instanceof Error?F.message:String(F)}`)}}}catch(W){if(X.aborted)return;let H=W instanceof Error?W.message:String(W);console.warn(`[lifecycle-watcher] ${Y} watch ended: ${H}`)}if(X.aborted)return;let K=LQ(5000,250,G,2,0);G+=1,await k$(K,{signal:X}).catch(()=>{})}}var GH6="studio.decocms.com/sandbox-handle",KH6=300000,WH6=600000;var km$=L(()=>{O8();ZO0();YO0()});import{z as ZW}from"zod";function Sm$($){if(!$||$.trim()==="")return[];let Z=ZW.array(BH6).parse(JSON.parse($)),Q=new Set;for(let X of Z){if(Q.has(X.name))throw Error(`STUDIO_SANDBOX_TENANT_POOLS: duplicate pool name ${X.name}`);Q.add(X.name)}return Z}function LH6($){try{let Z=new URL($);if(Z.hostname.toLowerCase()!=="github.com")return null;let[Q,X]=Z.pathname.replace(/^\/+/,"").split("/"),Y=X?.replace(/\.git$/,"");return Q&&Y?`${Q}/${Y}`.toLowerCase():null}catch{return null}}function aH1($,Z){let{orgId:Q,cloneUrl:X}=Z;if(!Q||!X)return null;let Y=LH6(X);if(!Y)return null;return $.find((J)=>J.orgId===Q&&J.repo.toLowerCase()===Y)??null}function Cm$($,Z,Q){return $?.name??(Z?Q:"none")}function OH6($,Z,Q,X){let Y=X&&X!=="default"?`-${X}`:"";return`${Z}${Y}${$==="harness-run"||Q?"-medium":""}`}async function rH1($){let Z=OH6($.purpose,$.templateName,$.tenantPool,$.sandboxImage);if(Z===$.templateName)return{name:Z,probes:$.probes};let Q=$.probes[Z]??null,X=Q!==null&&$.now-Q.checkedAt<$.ttlMs?Q:{checkedAt:$.now,present:await $.exists(Z)},Y={...$.probes,[Z]:X};if(X.present)return{name:Z,probes:Y};if(Q?.present!==!1)$.onAbsent?.(Z);if($.sandboxImage&&$.sandboxImage!=="default")return rH1({...$,sandboxImage:void 0,probes:Y});return{name:$.templateName,probes:Y}}function _m$($,Z,Q){let X=Q.replace(/^refs\/heads\//,"");return $.filter((Y)=>Y.repo.toLowerCase()===Z.toLowerCase()&&Y.branch===X)}function vm$($){return`https://github.com/${$.repo}.git`}var BH6;var sH1=L(()=>{BH6=ZW.object({name:ZW.string().regex(/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/,"pool name must be a DNS label (lowercase alphanumeric and '-')"),orgId:ZW.string().min(1),repo:ZW.string().regex(/^[^/\s]+\/[^/\s]+$/,"repo must be `owner/name`"),connectionId:ZW.string().min(1).optional(),branch:ZW.string().min(1).default("main"),workload:ZW.object({runtime:ZW.enum(["node","bun","deno"]).default("node"),packageManager:ZW.enum(["npm","pnpm","yarn","bun","deno"]).optional(),packageManagerPath:ZW.string().optional(),devPort:ZW.number().int().positive().optional()}).default({runtime:"node"})})});async function xm$($,Z,Q){let X=new Map;for(let Y of $){let J=Z(Y);if(!J)continue;let G=X.get(J);if(G)G.push(Y);else X.set(J,[Y])}await Promise.allSettled([...X.values()].map(async(Y)=>{for(let J of Y)await Q(J).catch(()=>{})}))}import{createHash as DH6,randomBytes as wH6,randomUUID as fm$}from"crypto";import*as lm$ from"net";import{PassThrough as jH6}from"stream";function bm$($){if($ instanceof Error)return $.message;if($&&typeof $==="object"){let Z=$;if(Z.error instanceof Error)return Z.error.message;if(typeof Z.message==="string"&&Z.message)return Z.message}return String($)}class GF1{records=new Map;inflight=new RV0;activeGauge=new AV0;stateStore;previewUrlPattern;kubeConfig;capacityProbe;portForward;namespace;sandboxTemplateName;envName;tokenGenerator;idleTtlMs;metrics;previewGateway;sentinelToken;mintCloneUrl;mintOrgFsConfig;tenantPools;tenantPoolRefreshMs;poolPods=new Map;templateProbes={};dirtyPools=new Set;closed=!1;claimWatchAbort=new AbortController;constructor($={}){this.stateStore=$.stateStore??null,this.previewUrlPattern=$.previewUrlPattern??null,this.kubeConfig=$.kubeConfig??_H6(),this.portForward=new RH1(this.kubeConfig),this.namespace=$.namespace??EH6,this.sandboxTemplateName=$.sandboxTemplateName??zH6,this.envName=yH6($.envName),this.tokenGenerator=$.tokenGenerator??(()=>wH6(TH6).toString("hex")),this.idleTtlMs=$.idleTtlMs??RH6,this.metrics=$.meter?CH6($.meter):null,this.previewGateway=$.previewGateway&&$.previewUrlPattern?{...$.previewGateway}:null;let Z=$.sentinelToken?.trim()??"";if(this.sentinelToken=Z.length>0?Z:null,this.mintCloneUrl=$.mintCloneUrl,this.mintOrgFsConfig=$.mintOrgFsConfig,this.tenantPools=this.sentinelToken!==null?$.tenantPools??[]:[],this.sentinelToken===null&&($.tenantPools?.length??0)>0)console.warn(`[${R6}] tenant pools configured without a sentinel token \u2014 ignoring them (warm-pool mode is off)`);this.tenantPoolRefreshMs=$.tenantPoolRefreshMs??MH6,this.startClaimReaper(),this.startCredentialRefresher(),this.startTenantPoolReconciler()}startClaimReaper(){let $=["app.kubernetes.io/managed-by=studio","app.kubernetes.io/name=studio-sandbox",...this.envName?[`${iY.env}=${this.envName}`]:[]].join(",");Vm$({kc:this.kubeConfig,namespace:this.namespace,labelSelector:$,signal:this.claimWatchAbort.signal,onDelete:(Z)=>this.invalidateRecord(Z)})}async ensure($,Z={}){let Q=Ey($);if(Q.startsWith("s-"))throw Error(`ensure: projectRef has no slug source: ${$.projectRef}`);return this.inflight.run(Q,()=>qV0(this.stateStore,$,(X)=>this.ensureLocked($,Q,Z,X)))}async delete($){let Z=await this.getRecord($);if(this.records.delete($),Z)this.dropRecord(Z);if(await this.deleteHttpRouteIfManaged($).catch((Q)=>{console.warn(`[${R6}] HTTPRoute delete failed for ${$}: ${Q instanceof Error?Q.message:String(Q)}`)}),await m2(this.kubeConfig,this.namespace,$),this.stateStore)if(Z)await this.stateStore.delete(Z.id);else await this.stateStore.deleteByHandle($)}lastTermination($){return Vb$(this.kubeConfig,this.namespace,iY.sandboxHandle,$,JQ.MAIN_CONTAINER_NAME)}async alive($){return await rL(this.kubeConfig,this.namespace,$)!==void 0}watchClaimLifecycle($,Z){return Mm$({kc:this.kubeConfig,namespace:this.namespace,claimName:$,signal:Z})}hasSchedulableCapacity(){return this.capacityProbe??=hb$(this.kubeConfig,this.namespace),this.capacityProbe()}async getPreviewUrl($){let Z=await this.getRecord($);if(!Z)return null;return this.composePreviewUrl(Z)}async proxyDaemonRequest($,Z,Q){let X=await this.getRecord($);if(!X&&this.previewUrlPattern&&this.stateStore){let W=await this.stateStore.getByHandle($),H=W?.state,F=H?.token;if(W&&F){let N=`http://${H?.adoptedSandboxName??$}.${this.namespace}.svc.cluster.local:${YO}`;try{let B=await g80(N,F,Z,Q);if(B.status!==404)return B;try{await B.body?.cancel()}catch{}}catch{}}}if(!X)X=await this.resurrectByHandle($);if(!X)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let Y=X,J=performance.now(),G=0,K=!(Q.body instanceof ReadableStream);try{let W=await g80(X.daemonUrl,X.token,Z,Q);if(W.status===401&&K){this.invalidateRecord($);let H=await this.getRecord($).catch(()=>null)??await this.resurrectByHandle($).catch(()=>null);if(H){try{await W.body?.cancel()}catch{}Y=H,W=await g80(H.daemonUrl,H.token,Z,Q)}}return G=W.status,W}catch(W){if(!K)throw W;this.invalidateRecord($);let H=await this.resurrectByHandle($)??await this.getRecord($).catch(()=>null);if(!H)throw W;Y=H;let F=await g80(H.daemonUrl,H.token,Z,Q);return G=F.status,F}finally{this.recordProxyDuration("daemon",G,Y,performance.now()-J)}}async adoptLiveClaim($,Z){if(this.records.has(Z))return!0;let Q=await rL(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!Q||Q.metadata?.deletionTimestamp)return!1;return await this.inflight.run(Z,async()=>{let Y=this.records.get(Z);if(Y)return this.toSandbox(Y);let J=await this.adopt($,Z,Q);if(!J)throw Error(`cannot adopt live claim ${Z}`);return qV0(this.stateStore,$,(G)=>this.finish(J,G,!0,!0,"adopt"))}).catch(()=>null)!=null}async resolvePreviewUpstreamUrl($){if(this.previewUrlPattern)return`http://${await this.resolveServiceNameForHandle($)}.${this.namespace}.svc.cluster.local:${YO}`;let Z=await this.getRecord($);if(Z)return Z.daemonUrl;let Q=await this.resurrectByHandle($);return Q?Q.daemonUrl:null}async resolveServiceNameForHandle($){let Z=this.records.get($);if(Z)return Z.adoptedSandboxName;if(this.stateStore){let X=(await this.stateStore.getByHandle($).catch(()=>null))?.state?.adoptedSandboxName;if(X)return X}return $}async proxyPreviewRequest($,Z){let Q=performance.now(),X=this.records.get($)??null,Y=0;try{let J=await this.resolvePreviewUpstreamUrl($);if(!J){Y=404;let O=ZF1(404,{error:"sandbox not found"});return O.headers.set(Py,"1"),O}let G=new URL(Z.url);if((G.pathname==="/_sandbox"||G.pathname.startsWith("/_sandbox/"))&&Z.method!=="GET")return Y=404,ZF1(404,{error:"not found"});let W=(O)=>`${O}${G.pathname}${G.search}`,H=new Headers(Z.headers);for(let O of kH6)H.delete(O);let F=Z.method!=="GET"&&Z.method!=="HEAD",U={method:Z.method,headers:H,body:F?Z.body:void 0,redirect:"manual",signal:Z.signal,duplex:F?"half":void 0},N;try{N=await fetch(W(J),U)}catch(O){let D=`${J}${G.pathname}`;if(console.warn(`[${R6}] preview fetch to ${D} failed: ${O instanceof Error?O.message:String(O)}`),Z.method==="GET"||Z.method==="HEAD"){if(this.invalidateRecord($),await this.resurrectByHandle($).catch(()=>null)){let E=await this.resolvePreviewUpstreamUrl($);if(E)try{N=await fetch(W(E),U);let z=new Headers;for(let[A,P]of N.headers.entries())if(!hm$.includes(A.toLowerCase()))z.set(A,P);return Y=N.status,new Response(N.body,{status:N.status,statusText:N.statusText,headers:z})}catch(z){console.warn(`[${R6}] preview fetch retry to ${D} failed: ${z instanceof Error?z.message:String(z)}`)}}}else this.invalidateRecord($);Y=502;let w=ZF1(502,{error:"sandbox daemon unreachable"});return w.headers.set(Py,"1"),w}let B=new Headers;for(let[O,D]of N.headers.entries())if(!hm$.includes(O.toLowerCase()))B.set(O,D);return Y=N.status,new Response(N.body,{status:N.status,statusText:N.statusText,headers:B})}finally{this.recordProxyDuration("preview",Y,X,performance.now()-Q,$)}}async ensureLocked($,Z,Q,X){if(Q.image)console.warn(`[${R6}] opts.image ignored (template ${this.sandboxTemplateName} pins image): got ${Q.image}`);if(X){let G=await X.get($);if(G){let K=await this.rehydrate($,Z,G);if(K)return await this.refreshDaemonGitCredential(K,Q),await this.relayOrgFsConfig(K.daemonUrl,K.token,Q.orgFsConfigJson),this.finish(K,X,!1,!0,"resume");await X.delete($)}}let Y=await rL(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(Y)if(Y.metadata?.deletionTimestamp)await E80(this.kubeConfig,this.namespace,Z).catch((G)=>{console.warn(`[${R6}] wait for terminating claim ${Z} failed: ${G instanceof Error?G.message:String(G)}`)});else if(!eH1(Y)){let G=await this.join($,Z,Q,Y).catch((K)=>{return console.warn(`[${R6}] join of starting claim ${Z} failed, recreating: ${K instanceof Error?K.message:String(K)}`),null});if(G)return this.finish(G,X,!0,!0,"adopt");await m2(this.kubeConfig,this.namespace,Z).catch(()=>{}),await E80(this.kubeConfig,this.namespace,Z).catch((K)=>{console.warn(`[${R6}] wait for deleted claim ${Z} failed: ${K instanceof Error?K.message:String(K)}`)})}else{let G=await this.adopt($,Z,Y).catch((K)=>{return console.warn(`[${R6}] adopt ${Z} failed, recreating: ${K instanceof Error?K.message:String(K)}`),null});if(G)return await this.refreshDaemonGitCredential(G,Q),await this.relayOrgFsConfig(G.daemonUrl,G.token,Q.orgFsConfigJson),this.finish(G,X,!0,!0,"adopt");await m2(this.kubeConfig,this.namespace,Z).catch(()=>{}),await E80(this.kubeConfig,this.namespace,Z).catch((K)=>{console.warn(`[${R6}] wait for deleted claim ${Z} failed: ${K instanceof Error?K.message:String(K)}`)})}let J=await this.provision($,Z,Q);return this.finish(J,X,!0,!1,"fresh")}async finish($,Z,Q,X,Y){let J=this.records.get($.handle),G=J!==void 0;if(J&&J.daemonForward!==$.daemonForward)this.closeForwarder(J.daemonForward);if(this.records.set($.handle,$),Q)await this.persist(Z,$);if(X)await XO0(this.kubeConfig,this.namespace,$.handle,this.computeShutdownTime()).catch((K)=>console.warn(`[${R6}] TTL refresh failed for ${$.handle}: ${K instanceof Error?K.message:String(K)}`));if(this.metrics){let K=XF1($.tenant);if(this.metrics.ensureOutcome.add(1,{...K,outcome:Y}),!G)this.metrics.active.add(1,K),this.activeGauge.markCounted($.handle)}return this.toSandbox($)}buildEnvMap($,Z){let Q={},X=[];for(let[Y,J]of Object.entries($.env??{}))if(AH6.has(Y))X.push(Y);else Q[Y]=J;if(X.length>0)console.warn(`[${R6}] opts.env keys overlap reserved bootstrap names and were dropped: ${X.join(",")}`);return{...Q,DAEMON_TOKEN:Z.token,DAEMON_BOOT_ID:Z.daemonBootId,APP_ROOT:Z.workdir,PROXY_PORT:String(YO)}}async resolveTemplateName($,Z,Q){let{name:X,probes:Y}=await rH1({purpose:$,tenantPool:Z,...Q?{sandboxImage:Q}:{},templateName:this.sandboxTemplateName,probes:this.templateProbes,now:Date.now(),ttlMs:PH6,exists:(J)=>Rb$(this.kubeConfig,this.namespace,J),onAbsent:(J)=>console.warn(`[${R6}] SandboxTemplate ${J} not found (or not readable) \u2014 this claim falls back to a template without that suffix. Upgrade the sandbox-env chart to the version that renders it.`)});return this.templateProbes=Y,X}buildClaim($,Z,Q,X){let Y=this.sentinelToken!==null,J=aH1(this.tenantPools,{orgId:Z.tenant?.orgId,cloneUrl:Z.repo?.cloneUrl}),G=Y?[]:Object.entries(this.buildEnvMap(Z,Q)).sort(([H],[F])=>H<F?-1:H>F?1:0).map(([H,F])=>({name:H,value:F})),K=uH6(Z),W=Object.keys(K).length>0;return{apiVersion:`${JQ.CLAIM_API_GROUP}/${JQ.CLAIM_API_VERSION}`,kind:"SandboxClaim",metadata:{name:$,namespace:this.namespace,labels:{"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[iY.env]:this.envName}:{},...QF1(Z.tenant)},...W?{annotations:K}:{}},spec:{sandboxTemplateRef:{name:X},additionalPodMetadata:{labels:QF1(Z.tenant,{[iY.role]:"claimed",[iY.sandboxHandle]:$,...this.envName?{[iY.env]:this.envName}:{}}),...W?{annotations:K}:{}},env:G,warmpool:Cm$(J,Y,X),lifecycle:{shutdownPolicy:"Delete",shutdownTime:this.computeShutdownTime()}}}}async provision($,Z,Q){let X=this.tokenGenerator(),Y=fm$(),J=kV0,G=this.claimTenantPool(Q),K=this.buildClaim(Z,Q,{token:X,daemonBootId:Y,workdir:J},await this.resolveTemplateName(Q.purpose,G,Q.sandboxImage));try{await iK1(this.kubeConfig,this.namespace,K)}catch(W){if(W instanceof D80)await E80(this.kubeConfig,this.namespace,Z),await iK1(this.kubeConfig,this.namespace,K);else throw W}return this.bind($,Z,Q,G,{token:X,daemonBootId:Y,workdir:J})}claimTenantPool($){return!$.sandboxImage||$.sandboxImage==="default"?aH1(this.tenantPools,{orgId:$.tenant?.orgId,cloneUrl:$.repo?.cloneUrl}):null}async bind($,Z,Q,X,{token:Y,daemonBootId:J,workdir:G}){let K;try{K=await qb$(this.kubeConfig,this.namespace,Z),await Im$((B)=>this.watchClaimLifecycle(Z,B))}catch(B){throw await m2(this.kubeConfig,this.namespace,Z).catch(()=>{}),B}try{await this.ensureServicePortForAdoptedSandbox(K),await this.ensureHttpRouteForHandle(Z,K,Q.tenant??null)}catch(B){throw await m2(this.kubeConfig,this.namespace,Z).catch(()=>{}),B}let W=await this.openForwarder(K,YO,Z),H=`http://127.0.0.1:${W.localPort}`,F=X!==null&&K!==Z,U=this.workloadConfigPayload(Q,F),N=J;try{if(await dH1(H),this.sentinelToken!==null){let B=await TV0(H);if(B)N=B.bootId;try{await jy(H,this.sentinelToken,U??{},{rotateToken:Y})}catch(O){if(O instanceof wy&&O.status===401)console.warn(`[${R6}] sentinel rejected by adopted pod (handle=${Z}, sandbox=${K}): pod belongs to another claim; tearing down and reprovisioning`);throw O}}else if(U)await jy(H,Y,U);await this.relayOrgFsConfig(H,Y,Q.orgFsConfigJson)}catch(B){throw this.closeForwarder(W),await this.deleteHttpRouteIfManaged(Z).catch(()=>{}),await m2(this.kubeConfig,this.namespace,Z).catch(()=>{}),B}return{id:$,handle:Z,adoptedSandboxName:K,token:Y,workdir:G,daemonUrl:H,daemonForward:W,workload:Q.workload??null,daemonBootId:N,tenant:Q.tenant??null,tenantPoolPodBound:F,ensureOpts:iH6(Q)}}workloadConfigPayload($,Z){return IV0({runtime:$?.workload?.runtime??"node",packageManager:$?.workload?.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:$?.repo??null,extraRepos:$?.extraRepos??[],port:$?.workload?.devPort??ym$,tenant:$?.tenant??void 0,...$?{cloneOnly:$.cloneOnly===!0&&!Z}:{}})}async relayOrgFsConfig($,Z,Q){if(!Q)return;await wm$($,Z,Q).catch((X)=>console.warn("[org-fs] sidecar config relay failed",X))}async refreshDaemonGitCredential($,Z){let Q=pH1(Z);if(!Q)return;try{await jy($.daemonUrl,$.token,Q)}catch(X){console.warn(`[${R6}] git credential refresh failed for ${$.handle}: ${X instanceof Error?X.message:String(X)}`)}}async withFreshCloneUrl($,Z){if(!this.mintCloneUrl)return $;try{let Q=await this.mintCloneUrl($,Z!==void 0?{bufferMs:Z}:void 0);return Q?{...$,cloneUrl:Q}:$}catch(Q){return console.warn(`[${R6}] clone credential re-mint failed: ${Q instanceof Error?Q.message:String(Q)}`),$}}async withFreshCredentials($){return{...$,...$.repo?{repo:await this.withFreshCloneUrl($.repo)}:{},...$.orgFsConfigJson?{orgFsConfigJson:await dH6($,this.mintOrgFsConfig)}:{}}}startCredentialRefresher(){if(!this.mintCloneUrl)return;let{signal:$}=this.claimWatchAbort;(async()=>{while(!$.aborted){if(await k$(IH6,{signal:$}).catch(()=>{}),$.aborted)break;try{await this.refreshAllGitCredentials()}catch(Z){console.warn(`[${R6}] periodic credential refresh failed: ${Z instanceof Error?Z.message:String(Z)}`)}}})()}startTenantPoolReconciler(){if(this.tenantPools.length===0)return;let{signal:$}=this.claimWatchAbort;(async()=>{while(!$.aborted){try{await this.reconcileTenantPools()}catch(Z){console.warn(`[${R6}] tenant pool reconcile failed: ${Z instanceof Error?Z.message:String(Z)}`)}await k$(qH6,{signal:$}).catch(()=>{})}})()}markTenantPoolsDirty($,Z){let Q=_m$(this.tenantPools,$,Z);for(let X of Q)this.dirtyPools.add(X.name);return Q.map((X)=>X.name)}async reconcileTenantPools(){for(let $ of this.tenantPools){let Z=await Mb$(this.kubeConfig,this.namespace,$.name);if(Z===null){console.warn(`[${R6}] tenant pool ${$.name}: no SandboxWarmPool (or no selector yet) in ${this.namespace}`);continue}let Q=this.dirtyPools.delete($.name),X=Z.filter((Y)=>!Y.labels[iY.sandboxHandle]);for(let[Y]of this.poolPods)if(!Z.some((J)=>J.uid===Y))this.poolPods.delete(Y);for(let Y of X){if(this.claimWatchAbort.signal.aborted)return;await this.warmPoolPod($,Y,Q)}this.recordPoolDepth($,Z,X)}}recordPoolDepth($,Z,Q){let X=this.metrics?.poolPods;if(!X)return;let Y=0,J=0;for(let K of Q){let W=this.poolPods.get(K.uid);if(!W)continue;if(W.failures>=SV0)J++;else if(W.lastConfigAt>0)Y++}let G={pool:$.name,org:$.orgId};X.record(Y,{...G,state:"ready"}),X.record(Z.length-Q.length,{...G,state:"bound"}),X.record(Q.length-Y-J,{...G,state:"pending"}),X.record(J,{...G,state:"failed"})}async warmPoolPod($,Z,Q){let X=this.poolPods.get(Z.uid);if(X&&X.failures>=SV0){if(Date.now()-X.lastFailureAt<gm$)return;this.poolPods.set(Z.uid,{...X,failures:0})}let Y=Q||X!==void 0&&Date.now()-X.lastConfigAt>=this.tenantPoolRefreshMs;if(X&&!Y)return;let J={cloneUrl:vm$($),connectionId:$.connectionId,branch:$.branch,userName:"",userEmail:""},G=await this.withFreshCloneUrl(J);if($.connectionId&&G.cloneUrl===J.cloneUrl){this.recordPoolFailure(Z,$,"clone credential mint failed");return}let K=await this.openForwarder(Z.name,YO,Z.name).catch(()=>null);if(!K){this.recordPoolFailure(Z,$,"port-forward failed");return}let W=`http://127.0.0.1:${K.localPort}`;try{await dH1(W);let H=this.sentinelToken;if(!H)return;if(!await this.isPoolPodUnbound(Z))return;let F=IV0({runtime:$.workload.runtime,packageManager:$.workload.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:G,port:$.workload.devPort??ym$})??{},{transition:U}=await jy(W,H,F);if(Y&&U!=="bootstrap"&&await this.isPoolPodUnbound(Z))await Dm$(W,H,"clone");this.poolPods.set(Z.uid,{lastConfigAt:Date.now(),lastFailureAt:0,failures:0}),console.log(`[${R6}] tenant pool ${$.name}: warmed ${Z.name} (${U})`)}catch(H){this.recordPoolFailure(Z,$,H instanceof Error?H.message:String(H))}finally{this.closeForwarder(K)}}isPoolPodUnbound($){return Ib$(this.kubeConfig,this.namespace,$.name,iY.sandboxHandle)}recordPoolFailure($,Z,Q){let X=this.poolPods.get($.uid),Y=(X?.failures??0)+1;this.poolPods.set($.uid,{lastConfigAt:X?.lastConfigAt??0,lastFailureAt:Date.now(),failures:Y});let J=Y>=SV0?` \u2014 backing off ${gm$/60000}min`:"";console.warn(`[${R6}] tenant pool ${Z.name}: warming ${$.name} failed (${Y}/${SV0})${J}: ${Q}`)}async refreshAllGitCredentials(){await xm$(this.records.values(),($)=>$.ensureOpts?.repo?.connectionId,async($)=>{if(this.claimWatchAbort.signal.aborted)return;let Z=$.ensureOpts?.repo;if(!Z)return;let Q=await this.withFreshCloneUrl(Z,VH6);await this.refreshDaemonGitCredential($,{...$.ensureOpts,repo:Q}),$.ensureOpts={...$.ensureOpts,repo:Q}})}async rebootstrapDaemon($,Z,Q){if(this.sentinelToken===null)return!1;let X=this.workloadConfigPayload(Q,!1)??{};try{return await jy($,this.sentinelToken,X,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,Q?.orgFsConfigJson),!0}catch(Y){if(Y instanceof wy&&Y.status===401)try{return await jy($,Z,X,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,Q?.orgFsConfigJson),!0}catch(J){return console.warn(`[${R6}] re-bootstrap retry with claim token failed: ${J instanceof Error?J.message:String(J)}`),!1}return console.warn(`[${R6}] re-bootstrap failed: ${Y instanceof Error?Y.message:String(Y)}`),!1}}async ensureServicePortForAdoptedSandbox($){if(!this.previewGateway||!this.previewUrlPattern)return;await bb$(this.kubeConfig,this.namespace,$,{name:"daemon",port:YO,targetPort:YO})}async ensureHttpRouteForHandle($,Z,Q){if(!this.previewGateway||!this.previewUrlPattern)return;let X=pH6(this.previewUrlPattern,$);if(!X)throw new uX(`Unable to derive preview hostname for ${$} from pattern: ${this.previewUrlPattern}`);let Y={apiVersion:`${nK1.API_GROUP}/${nK1.API_VERSION}`,kind:"HTTPRoute",metadata:{name:$,namespace:this.namespace,labels:QF1(Q??void 0,{[iY.role]:"claimed",[iY.sandboxHandle]:$,"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[iY.env]:this.envName}:{}})},spec:{parentRefs:[{kind:"Gateway",group:"gateway.networking.k8s.io",name:this.previewGateway.name,namespace:this.previewGateway.namespace}],hostnames:[X],rules:[{backendRefs:[{group:"",kind:"Service",name:Z,port:YO}]}]}};await vb$(this.kubeConfig,this.namespace,Y)}async deleteHttpRouteIfManaged($){if(!this.previewGateway)return;await xb$(this.kubeConfig,this.namespace,$)}async rehydrate($,Z,Q){let X=Q.state;if(!X.adoptedSandboxName&&!X.podName||!X.token)return null;let Y=await rL(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!Y||!eH1(Y))return null;let J=Y.status?.sandbox?.name??X.adoptedSandboxName??X.podName??Z,G=await this.openAndProbeDaemon(J,Z);if(!G)return null;if(X.daemonBootId&&X.daemonBootId!==G.bootId){if(this.sentinelToken!==null){let K=X.ensureOpts?await this.withFreshCredentials(X.ensureOpts):null;if(!await this.rebootstrapDaemon(G.daemonUrl,X.token,K))return this.closeForwarder(G.daemonForward),null}else console.warn(`[${R6}] daemon restart detected (handle=${Z}): stored bootId=${X.daemonBootId} live bootId=${G.bootId}`);await this.stateStore?.put($,{handle:Z,state:{...X,daemonBootId:G.bootId}}).catch((K)=>console.warn(`[${R6}] bootId persist failed for ${Z}: ${K instanceof Error?K.message:String(K)}`))}return{id:$,handle:Z,adoptedSandboxName:J,tenantPoolPodBound:!1,token:X.token,workdir:X.workdir??kV0,daemonUrl:G.daemonUrl,daemonForward:G.daemonForward,workload:X.workload??null,daemonBootId:G.bootId,tenant:X.tenant??null,ensureOpts:X.ensureOpts??null}}join($,Z,Q,X){let Y=this.sentinelToken!==null,J=Y?this.tokenGenerator():$F1(X,"DAEMON_TOKEN"),G=Y?fm$():$F1(X,"DAEMON_BOOT_ID");if(!J||!G)throw new uX(`claim ${Z} carries no daemon token`);return this.bind($,Z,Q,this.claimTenantPool(Q),{token:J,daemonBootId:G,workdir:kV0})}async adopt($,Z,Q){if(!eH1(Q))return null;let X=Q.status?.sandbox?.name??Z;if(this.sentinelToken!==null)return null;let Y=$F1(Q,"DAEMON_TOKEN");if(!Y)return null;let J=await this.openAndProbeDaemon(X,Z);if(!J)return null;let G=lH6(Q);if(this.previewGateway)await this.ensureServicePortForAdoptedSandbox(X).catch((K)=>{console.warn(`[${R6}] Service port backfill failed for ${Z}: ${K instanceof Error?K.message:String(K)}`)}),await this.ensureHttpRouteForHandle(Z,X,G).catch((K)=>{console.warn(`[${R6}] HTTPRoute backfill failed for ${Z}: ${K instanceof Error?K.message:String(K)}`)});return{id:$,handle:Z,adoptedSandboxName:X,tenantPoolPodBound:!1,token:Y,workdir:kV0,daemonUrl:J.daemonUrl,daemonForward:J.daemonForward,workload:null,daemonBootId:J.bootId,tenant:G,ensureOpts:null}}async openAndProbeDaemon($,Z){let Q=await this.openForwarder($,YO,Z).catch(()=>null);if(!Q)return null;let X=`http://127.0.0.1:${Q.localPort}`,Y=await TV0(X);if(!Y)return this.closeForwarder(Q),null;return{daemonForward:Q,daemonUrl:X,bootId:Y.bootId}}async getRecord($){let Z=this.records.get($);if(Z)return Z;if(!this.stateStore)return null;let Q=await this.stateStore.getByHandle($);if(!Q)return null;let X=await this.rehydrate(Q.id,$,Q);if(X)this.records.set($,X);return X}async resurrectByHandle($){if(!this.stateStore)return null;let Z=await this.stateStore.getByHandle($);if(!Z)return null;let Q=Z.state.ensureOpts;if(!Q)return null;let X=await this.withFreshCredentials(Q);if(Ey(Z.id)!==$)return null;return await this.ensure(Z.id,X),this.records.get($)??null}invalidateRecord($){let Z=this.records.get($);if(!Z)return;this.records.delete($),this.dropRecord(Z)}dropRecord($){if(this.closeForwarder($.daemonForward),this.metrics&&this.activeGauge.consume($.handle))this.metrics.active.add(-1,XF1($.tenant))}recordProxyDuration($,Z,Q,X,Y){if(!this.metrics)return;this.metrics.proxyDurationMs.record(X,{...XF1(Q?.tenant??null),source:$,sandbox_handle:Q?.handle??Y??"",status_code:Z||0})}composePreviewUrl($){if(this.previewUrlPattern)return MV0(this.previewUrlPattern,$.handle);return`http://127.0.0.1:${$.daemonForward.localPort}/`}toSandbox($){return{handle:$.handle,workdir:$.workdir,previewUrl:this.composePreviewUrl($),warmPoolAdopted:$.tenantPoolPodBound===!0}}async persist($,Z){if(!$)return;let Q={adoptedSandboxName:Z.adoptedSandboxName,token:Z.token,workdir:Z.workdir,workload:Z.workload,daemonBootId:Z.daemonBootId,tenant:Z.tenant,...Z.ensureOpts?{ensureOpts:Z.ensureOpts}:{}};await $.put(Z.id,{handle:Z.handle,state:Q})}computeShutdownTime(){return new Date(Date.now()+this.idleTtlMs).toISOString()}async releaseAfter($,Z){let Q=await rL(this.kubeConfig,this.namespace,$);if(!Q)return;let X=cH6(Q.spec?.lifecycle?.shutdownTime,new Date(Date.now()+Z));if(!X)return;await XO0(this.kubeConfig,this.namespace,$,X).catch((Y)=>console.warn(`[${R6}] release failed for ${$}: ${Y instanceof Error?Y.message:String(Y)}`))}async renewTtl($){let Z=await rL(this.kubeConfig,this.namespace,$);if(!Z)return;let Q=mH6(Z.spec?.lifecycle?.shutdownTime,new Date(Date.now()+this.idleTtlMs));if(!Q)return;await XO0(this.kubeConfig,this.namespace,$,Q).catch((X)=>console.warn(`[${R6}] TTL renew failed for ${$}: ${X instanceof Error?X.message:String(X)}`))}openForwarder($,Z,Q=$){let X=vH6(Q,Z);return new Promise((Y,J)=>{let G=(K,W)=>{let H=lm$.createServer((F)=>this.handleForwardedConnection(F,$,Z,Q));H.once("error",(F)=>{if(F.code==="EADDRINUSE"&&W<SH6){try{H.close()}catch{}let U=YF1+(K-YF1+1)%cm$;G(U,W+1);return}J(F)}),H.listen(K,"127.0.0.1",()=>{let F=H.address();if(!F||typeof F==="string"){H.close(),J(Error("port-forward listener failed to bind"));return}Y({server:H,localPort:F.port})})};G(X,0)})}handleForwardedConnection($,Z,Q,X){let Y=new jH6,J=null,G=!1,K=()=>{if(G)return;if(G=!0,Y.destroy(),J)try{J.close()}catch{}if(!$.destroyed)$.destroy()};$.pipe(Y),$.on("error",K),$.on("close",K),this.portForward.portForward(this.namespace,Z,[Q],$,null,Y).then((W)=>{let H=typeof W==="function"?W():W;if(!H){K();return}if(J=H,J.on("close",K),J.on("error",(F)=>{console.warn(`[${R6}] port-forward to ${Z}:${Q} dropped mid-connection: ${bm$(F)}`,JSON.stringify(JF1(F))),this.invalidateRecord(X),K()}),G)try{J.close()}catch{}}).catch((W)=>{console.warn(`[${R6}] port-forward to ${Z}:${Q} failed: ${bm$(W)}`,JSON.stringify(JF1(W))),this.invalidateRecord(X),K()})}closeForwarder($){$.server.close((Z)=>{if(Z)console.warn(`[${R6}] port-forward close on :${$.localPort} errored: ${Z instanceof Error?Z.message:String(Z)}`)})}close(){if(this.closed)return;this.closed=!0,this.claimWatchAbort.abort();for(let $ of this.records.values())this.dropRecord($);this.records.clear()}}function CH6($){return{active:$.createUpDownCounter("studio.sandbox.active",{description:"Active sandbox count, by runner kind, owning org, and daemon impl. Cross-checks the cAdvisor-derived count from the cluster \u2014 divergence between the two indicates orphaned claims (studio deleted but K8s didn't reap) or unattributed pods.",unit:"{sandbox}"}),ensureOutcome:$.createCounter("studio.sandbox.ensure.outcome",{description:"Outcome of each ensure() call: fresh provision, resume from state-store after restart, or adopt of a cluster-side claim studio didn't know about. Cold-start ratio is the primary input for warm-pool sizing.",unit:"{call}"}),proxyDurationMs:$.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of studio-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"}),poolPods:$.createGauge("studio.sandbox.pool.pods",{description:"Tenant warm pool depth by pool and state: ready (warmed and unbound \u2014 what a claim can actually bind instantly), bound (serving a user), pending (unbound, not yet warmed), failed (gave up after repeated bootstrap failures). Alert on sustained ready=0: a pool that is always empty is doing nothing while costing N pods.",unit:"{pod}"})}}function JF1($){let Z=[],Q=$;for(let X=0;X<5&&Q instanceof Error;X++){let Y=Q;if(Z.push({name:Y.name,message:Y.message,...Y.code!==void 0?{code:Y.code}:{},...Y.errno!==void 0?{errno:Y.errno}:{}}),Y.cause===Q)break;Q=Y.cause}if(Q!==void 0&&!(Q instanceof Error)&&Q!==null){let X=Q,Y=X.error instanceof Error?JF1(X.error).chain:void 0;Z.push({nonError:String(Q),...typeof X.type==="string"?{type:X.type}:{},...typeof X.message==="string"?{message:X.message}:{},...X.code!==void 0?{code:X.code}:{},...typeof X.reason==="string"?{reason:X.reason}:{},...Y?{error:Y}:{},...Y===void 0&&X.error!==void 0?{rawError:String(X.error)}:{},keys:Object.keys(X)})}return{chain:Z}}function _H6(){let $=new YV0;return $.loadFromDefault(),$}function eH1($){return Boolean($.status?.conditions?.some((Z)=>Z.type==="Ready"&&Z.status==="True"))}function $F1($,Z){let Q=$.spec?.env;if(!Q)return null;for(let X of Q)if(X.name===Z&&X.value)return X.value;return null}function vH6($,Z){let Q=DH6("sha256").update(`${$}:${Z}`).digest();return YF1+Q.readUInt32BE(0)%cm$}function ZF1($,Z){return new Response(JSON.stringify(Z),{status:$,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function um$($){let Z=$.slice(0,fH6);return xH6.test(Z)?Z:""}function yH6($){if($===void 0)return null;let Z=$.trim();if(Z==="")return null;if(!bH6.test(Z))throw Error(`AgentSandboxProvider: envName=${JSON.stringify(Z)} is not a valid DNS-label-safe environment name (lowercase alphanumeric or '-', starts with a letter, ends alphanumeric, \u226432 chars). Studio sets this from STUDIO_ENV; check the studio chart's configMap.`);return Z}function QF1($,Z={}){let Q={...Z};if($){let X=um$($.orgId),Y=um$($.userId);if(X)Q[iY.orgId]=X;if(Y)Q[iY.userId]=Y}return Q}function zy($){let Z="";for(let Q of $){let X=Q.codePointAt(0)??0;Z+=X<32||X===127?" ":Q}return Z.slice(0,gH6)}function hH6($){try{let Z=new URL($);return Z.username="",Z.password="",Z.toString()}catch{return""}}function uH6($){let Z={},Q=$.tenant;if(Q?.orgSlug)Z[tH.orgSlug]=zy(Q.orgSlug);if(Q?.orgName)Z[tH.orgName]=zy(Q.orgName);if(Q?.userEmail)Z[tH.userEmail]=zy(Q.userEmail);if(Q?.userName)Z[tH.userName]=zy(Q.userName);let X=$.repo;if(X){if(X.displayName)Z[tH.gitRepo]=zy(X.displayName);let Y=hH6(X.cloneUrl);if(Y)Z[tH.gitRepoUrl]=zy(Y);let J=$.branch??X.branch;if(J)Z[tH.gitBranch]=zy(J)}return Z}function lH6($){let Z=$.metadata?.labels;if(!Z)return null;let Q=Z[iY.orgId],X=Z[iY.userId];if(!Q||!X)return null;let Y=$.metadata?.annotations??{};return{orgId:Q,userId:X,orgSlug:Y[tH.orgSlug],orgName:Y[tH.orgName],userEmail:Y[tH.userEmail],userName:Y[tH.userName]}}function cH6($,Z){if($){let Q=new Date($).getTime();if(Number.isFinite(Q)&&Q<=Z.getTime())return null}return Z.toISOString()}function mH6($,Z){if($){let Q=new Date($).getTime();if(Number.isFinite(Q)&&Q>=Z.getTime())return null}return Z.toISOString()}function XF1($){return{org_id:$?.orgId??"",user_id:$?.userId??"",runner_kind:"agent-sandbox"}}async function dH6($,Z){if(!Z||!$.tenant)return $.orgFsConfigJson;try{return await Z($.tenant)??$.orgFsConfigJson}catch(Q){return console.warn(`[${R6}] org-fs credential re-mint failed: ${Q instanceof Error?Q.message:String(Q)}`),$.orgFsConfigJson}}function iH6($){let Z={};if($.branch)Z.branch=$.branch;if($.repo)Z.repo=$.repo;if($.workload)Z.workload=$.workload;if($.env&&Object.keys($.env).length>0)Z.env=$.env;if($.tenant)Z.tenant=$.tenant;if($.cloneOnly)Z.cloneOnly=!0;if($.purpose)Z.purpose=$.purpose;if($.sandboxImage)Z.sandboxImage=$.sandboxImage;if($.orgFsConfigJson)Z.orgFsConfigJson=$.orgFsConfigJson;return Object.keys(Z).length>0?Z:null}function pH6($,Z){try{return new URL(MV0($,Z)).hostname||null}catch{return null}}var R6="AgentSandboxProvider",Py="x-sandbox-preview-not-ready",EH6="agent-sandbox-system",zH6="studio-sandbox",PH6=300000,YO=9000,ym$=3000,kV0="/app",TH6=32,AH6,RH6=900000,qH6=60000,MH6=1800000,SV0=3,gm$=1800000,IH6=900000,VH6=1800000,kH6,hm$,YF1=40000,cm$=1e4,SH6=256,iY,tH,xH6,fH6=63,bH6,gH6=253;var mm$=L(()=>{O8();ub$();Um$();iH1();nH1();YO0();ZO0();km$();sH1();AH6=new Set(["DAEMON_TOKEN","DAEMON_BOOT_ID","APP_ROOT","PROXY_PORT"]),kH6=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length","upgrade"],hm$=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];iY={role:"studio.decocms.com/role",sandboxHandle:"studio.decocms.com/sandbox-handle",orgId:"studio.decocms.com/org-id",userId:"studio.decocms.com/user-id",env:"studio.decocms.com/env"},tH={orgSlug:"studio.decocms.com/org-slug",orgName:"studio.decocms.com/org-name",userEmail:"studio.decocms.com/user-email",userName:"studio.decocms.com/user-name",gitRepo:"studio.decocms.com/git-repo",gitRepoUrl:"studio.decocms.com/git-repo-url",gitBranch:"studio.decocms.com/git-branch"},xH6=/^([A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?)?$/;bH6=/^[a-z]([a-z0-9-]{0,30}[a-z0-9])?$/});var dm$={};K0(dm$,{parseTenantPools:()=>Sm$,PREVIEW_NOT_READY_HEADER:()=>Py,AgentSandboxProvider:()=>GF1});var KF1=L(()=>{mm$();sH1()});var nm$={};K0(nm$,{subscribeLifecycle:()=>BF1,getOrInitSharedRunner:()=>NF1,getAgentSandboxProviderForTeardown:()=>UF1,getAgentSandboxProvider:()=>pY,__resetSharedLifecyclesForTesting:()=>QF6});function HF1($){let Z=u80[im$];if(Z)return Promise.resolve(Z);let Q=u80[WF1];if(Q)return Q;let X=$().then((Y)=>{return u80[im$]=Y,Y}).finally(()=>{delete u80[WF1]});return u80[WF1]=X,X}function nH6(){let $=process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN;return $&&$.trim()!==""?$:void 0}function tH6(){let $=process.env.STUDIO_SANDBOX_TEMPLATE_NAME;return $&&$.trim()!==""?$:void 0}function oH6(){let $=process.env.STUDIO_ENV;return $&&$.trim()!==""?$:void 0}function aH6(){let $=process.env.STUDIO_SANDBOX_SENTINEL_TOKEN;return $&&$.trim()!==""?$:void 0}function rH6(){let $=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME?.trim(),Z=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE?.trim();if(!$&&!Z)return;if(!$||!Z)throw Error("STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME and STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE must both be set, or both unset. Half-configured per-claim HTTPRoute routing would silently fail to attach.");return{name:$,namespace:Z}}async function FF1($){let Z=new N80($),Q=nH6(),{AgentSandboxProvider:X,parseTenantPools:Y}=await Promise.resolve().then(() => (KF1(),dm$)),J=new gG(T0().encryptionKey);return new X({stateStore:Z,previewUrlPattern:Q,sandboxTemplateName:tH6(),envName:oH6(),previewGateway:rH6(),sentinelToken:aH6(),tenantPools:Y(process.env.STUDIO_SANDBOX_TENANT_POOLS),meter:A$,mintCloneUrl:async(G,K)=>{if(G.repositoryId){let F=await new t$0($).getUnscoped(G.repositoryId);if(!F)return null;let{cloneUrl:U}=await QN({db:$,vault:J},F,{bufferMs:K?.bufferMs});return U}if(!G.connectionId)return null;let W=Eb$(G.cloneUrl);if(!W)return null;let{cloneUrl:H}=await XN(G.connectionId,W.owner,W.name,$,J,{bufferMs:K?.bufferMs});return H},mintOrgFsConfig:async(G)=>{if(!G.orgSlug)return null;return await $O0({boundAuth:{apiKey:{create:(W)=>x8.api.createApiKey({body:{...W,userId:G.userId}})}},storage:{orgRepoSyncs:new c2($)}},{orgSlug:G.orgSlug,orgId:G.orgId,baseUrl:h5()})??null}})}function pY($){if(!T0().agentSandboxEnabled)throw Error("Agent sandbox is disabled. Set STUDIO_AGENT_SANDBOX_ENABLED=true to enable it.");return HF1(()=>FF1($.db))}function UF1($){return HF1(()=>FF1($.db))}async function NF1(){if(!T0().agentSandboxEnabled)return null;return HF1(()=>FF1(W8().db))}function BF1($,Z,Q){let X=cE.get(Z);if(X){if(X.terminated){if(X.lastPhase)try{Q(X.lastPhase)}catch{}return{unsubscribe:$F6}}if(X.listeners.add(Q),X.lastPhase)try{Q(X.lastPhase)}catch{}return pm$(Z,X,Q)}let Y=new AbortController,J={lastPhase:null,terminated:!1,listeners:new Set([Q]),abort:Y};return cE.set(Z,J),ZF6($,Z,J),pm$(Z,J,Q)}function $F6(){}function pm$($,Z,Q){return{unsubscribe(){if(cE.get($)!==Z)return;if(Z.listeners.delete(Q),Z.listeners.size===0)cE.delete($),Z.abort.abort()}}}async function ZF6($,Z,Q){let X=null;try{for await(let Y of $.watchClaimLifecycle(Z,Q.abort.signal)){if(Q.abort.signal.aborted)break;Q.lastPhase=Y;let J=Y.kind==="ready"||Y.kind==="failed";if(J)Q.terminated=!0;let G=Array.from(Q.listeners);for(let K of G)try{K(Y)}catch{}if(J)break}}catch(Y){X=Y}finally{if(!Q.terminated&&!Q.abort.signal.aborted&&Q.listeners.size>0){let Y={kind:"failed",reason:"unknown",message:X instanceof Error?X.message:"Lifecycle watcher ended unexpectedly"};Q.lastPhase=Y,Q.terminated=!0;for(let J of Array.from(Q.listeners))try{J(Y)}catch{}}if(cE.get(Z)===Q)cE.delete(Z)}}function QF6(){for(let $ of cE.values())$.abort.abort();cE.clear()}var im$,WF1,u80,sH6,eH6,cE;var oH=L(()=>{LX();f6();lK1();L80();rZ();sd();MT();H$();l2();N3();B9();im$=Symbol.for("decocms.sandbox.lifecycle.agent-sandbox-runner"),WF1=Symbol.for("decocms.sandbox.lifecycle.agent-sandbox-inflight"),u80=globalThis;sH6=Symbol.for("decocms.sandbox.lifecycle.shared-lifecycles"),eH6=globalThis,cE=eH6[sH6]??=new Map});import{sql as XF6}from"kysely";function tm$($){return $ instanceof Date?$.toISOString():String($)}class LF1{db;vault;constructor($,Z){this.db=$;this.vault=Z}rowToInfo($){return{id:$.id,organizationId:$.organization_id,scope:$.scope,userId:$.user_id,name:$.name,description:$.description,createdBy:$.created_by,createdAt:tm$($.created_at),updatedBy:$.updated_by,updatedAt:tm$($.updated_at)}}assertVisible($,Z){if($.scope==="user"&&$.user_id!==Z)throw new mE($.id)}async create($){let Z=Z4("sec"),Q=await this.vault.encrypt($.value),X=new Date,Y=await this.db.insertInto("secrets").values({id:Z,organization_id:$.organizationId,scope:$.scope.kind,user_id:$.scope.kind==="user"?$.scope.userId:null,name:$.name,encrypted_value:Q,description:$.description??null,created_by:$.createdBy,created_at:X,updated_by:$.createdBy,updated_at:X}).returning(CV0).executeTakeFirstOrThrow();return this.rowToInfo(Y)}async update($){let Z=await this.db.selectFrom("secrets").where("id","=",$.id).where("organization_id","=",$.organizationId).select(["id","scope","user_id"]).executeTakeFirst();if(!Z)throw new QW($.id);this.assertVisible(Z,$.callerUserId);let Q={updated_by:$.updatedBy,updated_at:new Date};if($.value!==void 0)Q.encrypted_value=await this.vault.encrypt($.value);if($.description!==void 0)Q.description=$.description;let X=await this.db.updateTable("secrets").set(Q).where("id","=",$.id).where("organization_id","=",$.organizationId).returning(CV0).executeTakeFirstOrThrow();return this.rowToInfo(X)}async delete($,Z,Q){let X=await this.db.selectFrom("secrets").where("id","=",$).where("organization_id","=",Z).select(["id","scope","user_id"]).executeTakeFirst();if(!X)throw new QW($);this.assertVisible(X,Q),await this.db.deleteFrom("secrets").where("id","=",$).where("organization_id","=",Z).execute()}async list($){let Z=this.db.selectFrom("secrets").where("organization_id","=",$.organizationId).select(CV0);if($.scope?.kind==="user")Z=Z.where("scope","=","user").where("user_id","=",$.scope.userId);else if($.scope?.kind==="organization")Z=Z.where("scope","=","organization");else Z=Z.where((X)=>X.or([X("scope","=","organization"),X.and([X("scope","=","user"),X("user_id","=",$.callerUserId)])]));return(await Z.orderBy("created_at","desc").execute()).map((X)=>this.rowToInfo(X))}async findById($,Z,Q){let X=await this.db.selectFrom("secrets").where("id","=",$).where("organization_id","=",Z).select(CV0).executeTakeFirst();if(!X)throw new QW($);return this.assertVisible(X,Q),this.rowToInfo(X)}async resolveById($,Z,Q){let X=await this.db.selectFrom("secrets").where("id","=",$).where("organization_id","=",Z).selectAll().executeTakeFirst();if(!X)throw new QW($);this.assertVisible(X,Q);let Y=await this.vault.decrypt(X.encrypted_value);return{info:this.rowToInfo(X),value:Y}}async resolveByName($){let Z=this.db.selectFrom("secrets").where("organization_id","=",$.organizationId).where("scope","=",$.scope.kind).where(XF6`lower(name) = lower(${$.name})`).selectAll();if($.scope.kind==="user")Z=Z.where("user_id","=",$.scope.userId);let Q=await Z.executeTakeFirst();if(!Q)throw new QW(`${$.scope.kind}:${$.name}`);let X=await this.vault.decrypt(Q.encrypted_value);return{info:this.rowToInfo(Q),value:X}}}var CV0,QW,mE;var l80=L(()=>{jX();CV0=["id","organization_id","scope","user_id","name","description","created_by","created_at","updated_by","updated_at"];QW=class QW extends Error{constructor($){super(`Secret ${$} not found`);this.name="SecretNotFoundError"}};mE=class mE extends Error{constructor($){super(`Access denied for secret ${$}`);this.name="SecretAccessDeniedError"}}});async function _V0({ctx:$,orgId:Z,userId:Q,entries:X}){if(!X||X.length===0)return[];let Y=[];for(let J of X)try{let{value:G}=await $.storage.secrets.resolveById(J.secretId,Z,Q);Y.push({host:J.host,token:G})}catch(G){if(G instanceof QW||G instanceof mE){console.warn(`[SANDBOX_START] skipping submodule credential for ${J.host}: ${G.message}. Re-link or recreate the secret to restore.`);continue}throw G}return Y}var OF1=L(()=>{l80()});function lZ($){if(!$||typeof $!=="object")return{};let Z=$.sandboxMap;if(!Z||typeof Z!=="object")return{};return Z}function FN($,Z,Q){let X=$[Z]?.[Q];if(!X)return null;return oB(X)[iQ]??null}function c80($,Z,Q,X){let J={...oB($[Z]?.[Q]),[iQ]:X};return{...$,[Z]:{...$[Z]??{},[Q]:J}}}async function om$($,Z,Q,X,Y,J){let G=await $.findById(Z);if(!G)return;let K=G.metadata??{},W=c80(lZ(K),X,Y,J);await $.update(Z,Q,{metadata:{...K,sandboxMap:W}})}function DF1($,Z,Q){let X=oB($[Z]?.[Q]);if(!X[iQ])return null;let Y={...X};delete Y[iQ];let J={...$[Z]??{}};if(Object.keys(Y).length===0)delete J[Q];else J[Q]=Y;let G={...$};if(Object.keys(J).length===0)delete G[Z];else G[Z]=J;return G}async function dE($,Z,Q,X,Y){let J=await $.findById(Z);if(!J)return;let G=J.metadata??{},K=DF1(lZ(G),X,Y);if(!K)return;await $.update(Z,Q,{metadata:{...G,sandboxMap:K}})}var iQ="agent-sandbox";var aJ=L(()=>{Q4()});function JO($,Z){return Z?`thread:${$}/${Z}`:`thread:${$}`}function aH($){return`sandbox/thread-${$.replace(/^thread:/,"").replace(/\//g,"-")}`}function UN($){if(!$||!$.startsWith("thread:"))return null;return $.slice(7).split("/")[0]||null}async function Ty($,Z,Q){return jF1(await wF1($,Z),Q)}async function wF1($,Z){let Q=UN(Z);if(!Q)return null;return await $.storage.threads.get(Q).catch(()=>null)}function jF1($,Z){return $?.created_by??Z}async function iE($,Z){if(!Z)return null;let Q=await $.storage.threads.get(Z).catch(()=>null);if(!Q)return null;return Q.metadata??{}}async function vV0($,Z){let X=(await iE($,Z))?.headRef;return typeof X==="string"&&X.length>0?X:null}async function am$($,Z,Q){let X=await iE($,Z);if(!X)return;if(X.headRef===Q)return;await $.storage.threads.update(Z,{metadata:{...X,headRef:Q}}).catch((Y)=>console.warn("[thread-repo] setThreadHeadRef failed",Y))}function YF6($,Z){let Q=HL0(Z,$.owner,$.name);if(!Q||Q.id===$.connectionId)return null;let X=t9(Q);return{...$,connectionId:Q.id,...X?.installationId?{installationId:X.installationId}:{}}}async function EF1($,Z){let X=(await iE($,Z))?.githubRepos;return Array.isArray(X)?X.filter((Y)=>Y?.owner&&Y?.name):[]}async function NN($,Z){let Q=await iE($,Z),X=Q?.githubRepo??null;if(!Z||!Q||!X?.connectionId)return X;try{let Y=$.storage.threads.getOrganizationId();if(!Y)return X;if(await $.storage.connections.findById(X.connectionId,Y))return X;let{items:J}=await $.storage.connections.list(Y),G=YF6(X,J);if(!G)return X;return await $.storage.threads.update(Z,{metadata:{...Q,githubRepo:G}}),console.warn("[thread-repo] re-pointed thread at a live repo connection",{threadId:Z,from:X.connectionId,to:G.connectionId}),G}catch(Y){return console.warn("[thread-repo] repoint check failed",Y),X}}function zF1($){if($.pinnedRef)return $.pinnedRef;if($.runBranch&&$.runBranch===JO($.threadId))return $.runBranch;if($.threadRepo)return JO($.threadId,$.threadRepo.connectionId);if(!$.agentRepo)return"ephemeral";return $.runBranch??`thread:${$.threadId}`}async function PF1($,Z){let X=(await iE($,Z))?.pinnedRef;return typeof X==="string"&&X.length>0?X:null}async function Mi($,Z){let[Q,X]=await Promise.all([NN($,Z.threadId),PF1($,Z.threadId)]);return zF1({...Z,threadRepo:Q,pinnedRef:X})}async function rm$($,Z,Q,X,Y){let J=await iE($,Z);if(!J)return;let G=c80(lZ(J),Q,X,Y);await $.storage.threads.update(Z,{metadata:{...J,sandboxMap:G}}).catch((K)=>console.warn("[thread-repo] setThreadSandboxMapEntry failed",K))}async function xV0($,Z){return lZ(await iE($,Z))}async function sm$($,Z,Q,X){let Y=await iE($,Z);if(!Y)return;let J=DF1(lZ(Y),Q,X);if(!J)return;await $.storage.threads.update(Z,{metadata:{...Y,sandboxMap:J}}).catch((G)=>console.warn("[thread-repo] removeThreadSandboxMapEntry failed",G))}var XW=L(()=>{lJ();aJ()});function m80($){let Z=new Set($.map((Y)=>Y.name.toLowerCase()).filter((Y,J,G)=>G.indexOf(Y)!==J)),Q=$.map((Y)=>Z.has(Y.name.toLowerCase())),X=(Y)=>{let J=$[Y];return em$(Q[Y]?`${J.owner}-${J.name}`:J.name).toLowerCase()};for(let Y=0;Y<$.length;Y++){let J=new Map,G=!1;for(let K=0;K<$.length;K++){let W=X(K),H=J.get(W);if(H!==void 0){if(!Q[K])Q[K]=!0,G=!0;if(!Q[H])Q[H]=!0,G=!0}J.set(W,K)}if(!G)break}return $.map((Y,J)=>em$(Q[J]?`${Y.owner}-${Y.name}`:Y.name))}function $d$($,Z){let Q=`${Z.owner}/${Z.name}`.toLowerCase(),X=$.findIndex((Y)=>`${Y.owner}/${Y.name}`.toLowerCase()===Q);return X===-1?null:m80($)[X]??null}function em$($){return $.replace(/[^A-Za-z0-9._-]/g,"-").replace(/^[^A-Za-z0-9]+/,"")||"repo"}import{AsyncLocalStorage as JF6}from"async_hooks";function fV0(){let $=z3.getStore();if(!$)throw Error("This tool is only available on a task run's MCP endpoint (/api/<org>/mcp/task-run/<threadId>).");return $}function bV0($){if($?.metadata?.source==="jira")return KF6;return tK.some((Q)=>NE($?.title,Q))?GF6:Zd$}var z3,Zd$,GF6,KF6;var GO=L(()=>{x4();z3=new JF6;Zd$=["TASK_ADD_REPO","TASK_BOARD_ITEM_LIST","TASK_BOARD_ITEM_UPDATE","TASK_BOARD_ACTIVITY_LIST","TASK_BOARD_COMMENT_LIST","TASK_BOARD_COMMENT_CREATE","TASK_BOARD_COMMENT_UPDATE"],GF6=[...Zd$,"TASK_BOARD_ITEM_PRS_GET","TASK_BOARD_REVIEW_DECISION"],KF6=["TASK_ADD_REPO","JIRA_ISSUE_GET","JIRA_COMMENT_ADD","JIRA_ISSUE_TRANSITION","JIRA_ATTACHMENT_DOWNLOAD","JIRA_REMOTE_LINK_ADD"]});import{z as P3}from"zod";async function UF6($,Z,Q,X){return V8(async()=>{let Y=FN(await xV0($,Z),Q,X);if(!Y)throw Error("sandbox record not written yet");return Y},{maxAttempts:WF6,minTimeout:HF6,maxTimeout:FF6,jitter:0}).catch(()=>null)}function BF6($,Z,Q=Jd$){let X=(J)=>`${J.owner}/${J.name}`.toLowerCase(),Y=X(Z);if($.some((J)=>X(J)===Y))return!1;return $.length>=Q}async function Yd$($,Z,Q,X){let Y=await $.proxyDaemonRequest(Z,"/_sandbox/bash",{method:"POST",headers:new Headers({"content-type":"application/json","x-thread-id":Q}),body:JSON.stringify({command:X})});if(!Y.ok)throw Error(`sandbox bash failed (${Y.status} ${Y.statusText})`);let J=await Y.json();return{stdout:J.stdout??"",exitCode:J.exitCode??0}}function LF6($){let Z=$.split(`
 `).map((Y)=>Y.trim()),Q=Z.includes("__CLONED__"),X=Z.filter((Y)=>Y&&Y!==".git"&&Y!=="__CLONED__");return{cloned:Q,listing:X.join(`
 `)}}function OF6($){return[...$?[`cd ${JSON.stringify($)} || exit 0`]:[],...DF6].join(`
-`)}async function wF6($,Z,Q){if(Q.repository)return QN($,Q.repository,{bufferMs:yV0});return await Hi({ctx:$,connectionId:Q.connectionId,organizationId:Z,forceRefresh:!0,onLegacyMintError:(X)=>console.error("[TASK_ADD_REPO] legacy repo-scoped mint failed",{connectionId:Q.connectionId,error:X.message})}),XN(Q.connectionId,Q.owner,Q.name,$.db,$.vault,{bufferMs:yV0})}async function jF6($,Z,Q){let X=await $.storage.organizationSettings.get(Z);return _V0({ctx:$,orgId:Z,userId:Q,entries:X?.submodule_credentials})}function EF6($){return{git:{...$.primary?{repository:{...$.primary,submoduleCredentials:$.submoduleCredentials}}:{repositories:$.secondaries??[]},identity:{userName:$.gitUserName,userEmail:$.gitUserEmail}}}}async function zF6($,Z,Q,X){let Y=m80(Q);return(await Promise.all(Q.map(async(G,K)=>{let W=await SE($.storage,Z,G),H=W&&await aL($.storage,W)?W:null;if(!H&&!G.connectionId)return null;try{let{cloneUrl:F}=H?await QN($,H,{bufferMs:yV0}):await XN(G.connectionId,G.owner,G.name,$.db,$.vault,{bufferMs:yV0});return{cloneUrl:F,repoName:Y[K],submoduleCredentials:X}}catch(F){return console.warn(`[TASK_ADD_REPO] skipping secondary ${G.owner}/${G.name}:`,F instanceof Error?F.message:F),null}}))).filter((G)=>G!==null)}var yV0=3300000,WF6=4,HF6=250,FF6=2000,Qd$=45000,Xd$=1500,NF6=5,Jd$=20,DF6,TF1;var Gd$=L(()=>{x0();rZ();U80();nL0();oH();L80();OF1();aJ();XW();O8();GO();DF6=["origin=$(git remote get-url origin)",'token=$(printf %s "$origin" | sed -n "s|.*://[^:]*:\\([^@]*\\)@.*|\\1|p")','[ -n "$token" ] || exit 0','user=$(printf %s "$origin" | sed -n "s|.*://\\([^:]*\\):.*|\\1|p")','host=$(printf %s "$origin" | sed -n "s|.*@\\([^/]*\\)/.*|\\1|p")','[ -n "$host" ] || exit 0',"umask 077",'if [ "$user" = "oauth2" ]; then','  mkdir -p "${HOME:-/root}/.config/glab-cli"','  printf "hosts:\\n  %s:\\n    token: %s\\n    api_host: %s\\n    api_protocol: https\\n    is_oauth2: true\\n" "$host" "$token" "$host" > "${HOME:-/root}/.config/glab-cli/config.yml"','  chmod 600 "${HOME:-/root}/.config/glab-cli/config.yml"','elif [ "$user" = "x-access-token" ]; then','  mkdir -p "${HOME:-/root}/.config/gh"','  printf "%s:\\n  oauth_token: %s\\n  git_protocol: https\\n" "$host" "$token" > "${HOME:-/root}/.config/gh/hosts.yml"',"fi"];TF1=p({name:"TASK_ADD_REPO",description:"Clone one of this organization's repositories into your working directory. "+"Your working directory is EMPTY until you call this \u2014 do not look for "+"files, and do not run git, before it returns. Call it once, with the repository the task is about; it waits for the checkout and returns the repository root listing, so you can start reading files immediately after. `git` and the repository's CLI (`gh` for GitHub, `glab` for GitLab; Bitbucket has "+"no CLI \u2014 its token is the password in `git remote get-url origin`, for `curl` "+"against api.bitbucket.org) are authenticated once it returns. Call TASK_ADD_REPO with no arguments to list the repositories available.",annotations:{title:"Add Repository",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:P3.object({id:P3.string().optional().describe("id of the repository to clone, as returned by the listing. Omit to list the available repositories."),connectionId:P3.string().optional().describe("Deprecated alias for `id`.")}),outputSchema:P3.object({success:P3.boolean(),repositories:P3.array(P3.object({id:P3.string(),repo:P3.string()})).optional(),repo:P3.string().optional(),cloned:P3.boolean().optional(),files:P3.string().optional(),message:P3.string()}),handler:async($,Z)=>{$0(Z),await Z.access.check();let Q=U0(Z),X=t0(Z);if(!X)throw Error("User ID required");let{threadId:Y}=fV0(),J=await CE(Z,Q.id),G=$.id??$.connectionId,K=G?J.find((W0)=>W0.id===G):void 0;if(!K){let W0=J.map((P0)=>({id:P0.id,repo:P0.label}));return{success:!1,repositories:W0,message:G?`No repository for id "${G}". Pick one of the repositories listed.`:W0.length===0?"This organization has no repositories linked, so none can be cloned.":"Pick a repository and call TASK_ADD_REPO again with its id."}}let W=await Z.storage.threads.get(Y);if(!W)throw Error(`Thread not found: ${Y}`);let H=await Mi(Z,{threadId:Y,runBranch:W.branch}),F=await Ty(Z,H,X),U=await pY(Z),N=await UF6(Z,Y,F,H);if(!N)throw Error(`No sandbox is registered for this run (thread ${Y}), so there is nowhere to clone into.`);let B=W.metadata?.githubRepo,O=W.metadata?.githubRepos??[],D=B&&B.owner===K.owner&&B.name?.toLowerCase()===K.name.toLowerCase();if(B&&(D||BF6(O,{owner:K.owner,name:K.name})))return{success:!1,repo:`${K.owner}/${K.name}`,cloned:!1,message:D?`${K.label} is already checked out at your working directory.`:`This run already has ${Jd$} additional repositories checked out, which is the limit. Work with what's already checked out instead of adding another.`};let{cloneUrl:w,gitUserName:j,gitUserEmail:E}=await wF6(Z,Q.id,K),z={url:K.webUrl,owner:K.owner,name:K.name,...K.installationId!==void 0?{installationId:K.installationId}:{},...K.connectionId?{connectionId:K.connectionId}:{},...K.repository?{repositoryId:K.repository.id}:{}},A=!B,P=A?[]:await Z.storage.threads.appendThreadGithubRepo(Y,z);if(A)await Z.storage.threads.update(Y,{metadata:{...W.metadata??{},githubRepo:z},updated_by:X});let T=pL0({branch:H,derivedRef:aH(H),recordedHeadRef:null,sticky:!1}),q=await jF6(Z,Q.id,X),f=await U.proxyDaemonRequest(N.sandboxHandle,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify(EF6({...A?{primary:{cloneUrl:w,branch:T,repoName:`${K.owner}/${K.name}`}}:{secondaries:await zF6(Z,Q.id,P,q)},submoduleCredentials:q,gitUserName:j,gitUserEmail:E}))});if(!f.ok)throw Error(`the sandbox rejected the repository (${f.status} ${f.statusText})`);await U.proxyDaemonRequest(N.sandboxHandle,"/_sandbox/setup/clone",{method:"POST",headers:new Headers({"content-type":"application/json"}),body:"{}"}).catch((W0)=>{console.warn("[TASK_ADD_REPO] explicit clone kick failed",W0)});let C=A?null:$d$(P,{owner:K.owner,name:K.name}),V=A||!C?".":`"$(dirname "$PWD")/repos/${C}"`,h=Date.now()+Qd$,g=!1,l="",u=0,d=null;while(Date.now()<h){let W0=await Yd$(U,N.sandboxHandle,Y,`cd ${V} 2>/dev/null || exit 1; if [ -n "$(git ls-files 2>/dev/null | head -1)" ]; then echo __CLONED__; fi; ls -A 2>/dev/null`).catch(()=>null);if(!W0){if(++u>=NF6)break;await k$(Xd$);continue}u=0;let P0=LF6(W0.stdout);if(P0.cloned&&P0.listing===d){g=!0,l=P0.listing;break}d=P0.cloned?P0.listing:null,await k$(Xd$)}if(g)await Yd$(U,N.sandboxHandle,Y,OF6(A?null:`../repos/${C}`)).catch((W0)=>console.warn("[TASK_ADD_REPO] CLI auth setup failed",W0));return{success:g,repo:`${K.owner}/${K.name}`,cloned:g,files:l,message:g?A?`${K.label} is checked out at your working directory on branch ${T}. \`git\` and its CLI are authenticated. Start working.`:`${K.label} is checked out at ../repos/${C}, beside your working directory, on its default branch. \`git\` and its CLI are authenticated there too. Your first checkout is untouched \u2014 commit and open a change request in each repository you change.`:`The clone of ${K.owner}/${K.name} did not finish within ${Math.round(Qd$/1000)}s. It may still be in progress \u2014 check your working directory before calling this again.`}}})});import{z as f1}from"zod";var Ii=50000,Vi=500,gV0=200,ki=50000,KO,d80,Ay,PF6,TF6,AF6,Kd$,Si,RF6,qF6,Wd$;var rJ=L(()=>{x4();x4();KO=f1.enum(cH),d80=f1.enum(["bug","feature","chore","spike","security"]),Ay=f1.enum(["none","low","medium","high","urgent"]),PF6=f1.object({threadId:f1.string(),virtualMcpId:f1.string().nullable(),status:f1.enum(["in_progress","requires_action","failed","completed","expired"]).nullable(),title:f1.string().nullable(),lastMessage:f1.string().nullable(),hasPreview:f1.boolean(),failureKind:f1.string().nullable(),hasMessages:f1.boolean(),costUsd:f1.number().nullable(),costProvider:f1.string().nullable(),createdAt:f1.string(),lastActiveAt:f1.string()}),TF6=f1.object({reviewer:f1.enum(tK),verdict:f1.enum(["approved","changes_requested"]),verified:f1.boolean()}),AF6=f1.object({id:f1.string(),name:f1.string(),color:f1.string().nullable().describe('Hex color, e.g. "#3b82f6"'),createdBy:f1.string(),createdAt:f1.string().datetime()}),Kd$=f1.object({url:f1.string(),number:f1.number(),repoOwner:f1.string(),repoName:f1.string(),createdAt:f1.string(),updatedAt:f1.string().nullable(),title:f1.string().nullable(),body:f1.string().nullable(),state:f1.enum(["open","closed"]).nullable(),draft:f1.boolean().nullable(),merged:f1.boolean().nullable(),mergeable:f1.boolean().nullable(),checksStatus:f1.enum(["pending","passing","failing"]).nullable(),checks:f1.array(f1.object({name:f1.string(),status:f1.string(),conclusion:f1.string().nullable(),detailsUrl:f1.string().nullable(),summary:f1.string().nullable()})),previewUrl:f1.string().nullable()}),Si=f1.object({id:f1.string(),organizationId:f1.string(),title:f1.string(),description:f1.string().nullable(),status:KO,priority:Ay,type:d80,assigneeId:f1.string().nullable(),assignedBy:f1.string().nullable(),repo:f1.string().nullable(),repositoryId:f1.string().nullable(),dueDate:f1.string().datetime().nullable(),sortOrder:f1.number(),keySeq:f1.number().nullable(),externalUrl:f1.string().nullable(),previewRoutes:f1.array(f1.string()),source:f1.enum(["jira"]).nullable(),retryAttempts:f1.number(),reviewCycleStartedAt:f1.string().datetime().nullable(),threads:f1.array(PF6),tags:f1.array(AF6),reviewVerdicts:f1.array(TF6),createdBy:f1.string(),createdAt:f1.string().datetime(),updatedBy:f1.string(),updatedAt:f1.string().datetime()}),RF6=["created","status_changed","assignee_changed","priority_changed","due_date_changed","title_changed","description_changed","tags_changed","review_requested","review_approved","review_changes_requested","review_verdict_requested","merge_conflict_resolution","merge_failed","type_changed","duplicate_reported"],qF6=f1.enum(RF6),Wd$=f1.object({id:f1.string(),taskBoardItemId:f1.string(),action:qF6,actorId:f1.string().nullable(),data:f1.record(f1.string(),f1.unknown()),occurredAt:f1.string().datetime()})});async function hV0($,Z,Q){if(Q===I8)return;let{members:X}=await $.boundAuth.organization.listMembers({organizationId:Z,filterField:"userId",filterValue:Q});if(!X.some((Y)=>Y.userId===Q))throw Error("assigneeId is not a member of the organization")}var AF1=L(()=>{rJ()});function Ud$($){let Z={};for(let[Q,X]of Object.entries($)){if(Q.startsWith(MF6))continue;Z[Q]=X}return Z}function uV0($){return{taskBoardItemId:$.id,...yX($)&&{[Hd$]:Fd$}}}function IF6($){return $?.[Hd$]===Fd$}function VF6($){if(/[:\s]/.test($))throw Error("organization id unsuitable for the subsidy key scheme");return`subsidy:${$}`}async function kF6($,Z){let Q=T0();try{let X=await $.storage.subsidizedGatewayKeys.get(Z);if(X)return X;let Y=$.auth?.user?.id;if(Y&&Q.aiGatewayEnabled&&Q.studioProvisionSecretKey&&jj.provisionKey){let J=await MQ(Y,$.auth?.user?.email),G=await jj.provisionKey(J,VF6(Z));return await $.storage.subsidizedGatewayKeys.put(Z,G),G}}catch(X){console.error("[subsidized-runs] subsidy key unavailable \u2014 run stays on the org's key:",X)}return}async function Nd$($,Z,Q){if(!T0().taskQuotaEnforced)return;if(!IF6(Q))return;let X=Q?.taskBoardItemId;if(!X)return;let Y=await $.storage.taskBoard.getById(X,Z);if(!Y||!yX(Y))return;if(!await xx$($,X))return;return await kF6($,Z)}function Bd$($,Z){if(!Z)return $;if($.providerId!=="deco")return $;return{...$,apiKey:Z}}var MF6="srv.",Hd$="srv.billing",Fd$="subscription";var i80=L(()=>{hm();$H();H$();oK()});function p80($){let Z=$?.runClass;return Z&&Z in RF1?RF1[Z]:RF1.interactive}var RF1,Ci="runClass";var _i=L(()=>{RF1={interactive:10,reviewer:20,retry:30,new_task:40}});async function lV0($,Z,Q){let X;try{return await Promise.race([$.aiProviders.listModels(Z,Q),new Promise((J,G)=>{X=setTimeout(()=>G(Error("listModels timeout")),SF6)})])}finally{if(X)clearTimeout(X)}}function CF6($,Z){switch($){case"fast":return Z.chat.fast;case"smart":return Z.chat.smart;case"thinking":return Z.chat.thinking;case"image":return Z.image;case"web_search":return Z.webSearch;case"deep_research":return Z.deepResearch}}function cV0($,Z,Q){let X=$.find((Y)=>Y.modelId===Z);return{title:X?.title??Q??Z,providerId:X?.providerId,capabilities:X?.capabilities,limits:X?.limits??null}}async function q6($,Z,Q){let X=$.organization?.id;if(!X)throw Error("resolveTier called without an organization");let J=(await $.storage.organizationSettings.get(X))?.simple_mode?.tiers?.[Z]??null,G=$.auth?.user?.id,K=JE.safeParse(Z),W=Q?.applyUserPrefs&&K.success&&G?(await $.storage.userModelPreferences.get(G,X))?.tiers?.[K.data]??null:null,H=(await $.storage.aiProviderKeys.list({organizationId:X})).filter((w)=>VT(w.providerId)),F=await hS$($,X,Z),U=F?H.find((w)=>w.providerId==="deco"):void 0;if(F&&U){let w=await lV0($,U.id,X).catch(()=>[]);return{credentialId:U.id,modelId:F,modelMeta:cV0(w,F)}}for(let w of[W,J])if(w&&H.some((j)=>j.id===w.keyId)){let j=await lV0($,w.keyId,X).catch(()=>[]);return{credentialId:w.keyId,modelId:w.modelId,modelMeta:cV0(j,w.modelId,w.title)}}if(H.length===0)throw new vi(Z);let N={};await Promise.all(H.map(async(w)=>{N[w.id]=await lV0($,w.id,X).catch(()=>[])}));let B=H.map((w)=>({id:w.id,providerId:w.providerId,label:w.label,presetId:w.presetId,createdBy:w.createdBy,createdAt:w.createdAt})),O=M3$(B,N),D=CF6(Z,O);if(!D)throw new vi(Z);return{credentialId:D.keyId,modelId:D.modelId,modelMeta:cV0(N[D.keyId]??[],D.modelId,D.title)}}async function Ld$($,Z,Q){let X=$.organization?.id;if(!X)throw Error("resolveSpecificModel called without an organization");let Y=await $.storage.aiProviderKeys.findById(Z,X).catch((G)=>{if(G instanceof Error&&G.message==="Provider key not found")throw new n80(`AI provider credential "${Z}" was not found`,{cause:G});throw G});if(!VT(Y.providerId))throw new n80(`AI provider credential "${Z}" uses native-only provider "${Y.providerId}" and cannot run a hosted model`);let J=await lV0($,Z,X).catch(()=>[]);return{credentialId:Z,modelId:Q,modelMeta:cV0(J,Q)}}async function mX($,Z){try{return await q6($,Z)}catch(Q){if(Q instanceof vi)return null;return console.warn(`[resolveTier] tier "${Z}" resolution failed:`,Q),null}}var vi,n80,SF6=5000;var dX=L(()=>{lU();xZ();Q4();vi=class vi extends Error{tier;constructor($){super(`No model available for tier "${$}". Connect a provider or configure the tier in organization settings.`);this.tier=$;this.name="TierUnavailableError"}};n80=class n80 extends Error{constructor($,Z){super($,Z);this.name="SpecificModelCredentialUnavailableError"}}});function Od$($){return $ instanceof rH||typeof $==="object"&&$!==null&&$.permanent===!0}var rH;var qF1=L(()=>{rH=class rH extends Error{permanent=!0;code;constructor($,Z){super(Z);this.name="PermanentRunError",this.code=$}}});function wd$($){if($==="reviewer")return"reviewer";if($==="conflict")return"conflict";return"default"}function Ed$($,Z="default"){let{providerId:Q,apiKey:X,baseUrl:Y}=$,J=vF6[Z],G={CLAUDE_CODE_MAX_OUTPUT_TOKENS:`${_F6}`,CLAUDE_CODE_MAX_TURNS:J===null?null:`${J}`,ENABLE_TOOL_SEARCH:xF6};if(Q==="anthropic")return{...G,CLAUDE_CODE_MODEL:MF1.anthropic[Z],ANTHROPIC_API_KEY:X,ANTHROPIC_AUTH_TOKEN:null,CLAUDE_CODE_OAUTH_TOKEN:null,ANTHROPIC_BASE_URL:Y??null};if(Q==="claude-subscription")return{...G,CLAUDE_CODE_MODEL:MF1.anthropic[Z],CLAUDE_CODE_OAUTH_TOKEN:X,ANTHROPIC_API_KEY:null,ANTHROPIC_AUTH_TOKEN:null,ANTHROPIC_BASE_URL:null};if(Q==="openrouter"||Q==="deco")return{...G,CLAUDE_CODE_MODEL:MF1.openrouter[Z],ANTHROPIC_API_KEY:"",ANTHROPIC_AUTH_TOKEN:X,CLAUDE_CODE_OAUTH_TOKEN:null,ANTHROPIC_BASE_URL:Y??"https://openrouter.ai/api"};throw new jd$(Q)}var Dd$="claude-subscription",MF1,mV0="claudeCodeModelClass",_F6=32000,vF6,xF6="1",jd$;var dV0=L(()=>{MF1={anthropic:{default:"claude-opus-5",reviewer:"claude-sonnet-5",conflict:"claude-sonnet-5"},openrouter:{default:"anthropic/claude-opus-5",reviewer:"anthropic/claude-sonnet-5",conflict:"anthropic/claude-sonnet-5"}};vF6={default:null,reviewer:60,conflict:60};jd$=class jd$ extends Error{constructor($){super(`the claude-code harness needs an Anthropic, OpenRouter or Deco model credential; this run's model resolves to "${$}". Point the agent's thinking model at one of those, or run it with Decopilot.`);this.name="UnsupportedClaudeCodeProviderError"}}});import{z as G$}from"zod";var zd$,fF6,t80,bF6,yF6,QiZ;var Pd$=L(()=>{zd$=G$.object({chunks:G$.array(G$.unknown()),done:G$.boolean().nullish().transform(($)=>$??!1),error:G$.object({code:G$.string(),message:G$.string()}).nullish().transform(($)=>$??null)}),fF6=G$.record(G$.string(),G$.unknown()),t80=G$.object({id:G$.string(),title:G$.string().optional(),provider:G$.string().nullable().optional(),credentialId:G$.string(),limits:G$.object({contextWindow:G$.number().int().positive().optional(),maxOutputTokens:G$.number().int().positive().optional()}).optional(),capabilities:G$.object({vision:G$.boolean().optional(),text:G$.boolean().optional(),reasoning:G$.boolean().optional()}).optional()}).strict(),bF6=G$.object({thinking:t80.extend({title:G$.string()}),fast:t80.optional(),smart:t80.optional(),image:t80.optional(),deepResearch:t80.optional()}).strict(),yF6=G$.discriminatedUnion("cwd",[G$.object({cwd:G$.literal("/repo"),repo:G$.object({owner:G$.string(),name:G$.string(),connectedGithub:G$.boolean()}).strict().optional(),branch:G$.string().nullable()}).strict(),G$.object({cwd:G$.null()}).strict()]),QiZ=G$.object({threadId:G$.string(),userMessage:fF6,harness:G$.object({sessionId:G$.string().optional()}).strict(),workspace:yF6,models:bF6,mcp:G$.object({url:G$.string().url(),headers:G$.record(G$.string(),G$.string()),expiresAt:G$.number().int().positive()}).strict(),orgMcps:G$.array(G$.object({name:G$.string(),url:G$.string().url(),headers:G$.record(G$.string(),G$.string())}).strict()).optional(),mode:G$.enum(["default","plan","web-search","gen-image"]),temperature:G$.number(),toolApprovalLevel:G$.enum(["auto","readonly"]),toolAllowlist:G$.array(G$.string()).nullable().optional(),maxAgentSteps:G$.number().int().optional(),user:G$.object({id:G$.string(),email:G$.string()}).strict(),organizationId:G$.string(),agent:G$.object({id:G$.string(),instructions:G$.string().optional(),disallowedTools:G$.array(G$.string()).optional()}).strict(),currentThreadTitle:G$.string().optional(),resume:G$.object({reason:G$.string()}).strict().optional()}).strict()});var Td$="sandbox_gone",Ad$="superseded",iV0="[SANDBOX_UNREACHABLE]";function gF6($){let Z=[$.contentType??"file"];if($.size!=null)Z.push(`${$.size} bytes`);return Z.join(", ")}function hF6($){let Z=($??[]).filter((X)=>X.kind!=="skill");if(Z.length===0)return null;return["<knowledge>","The following files are attached to you as reference knowledge. They are mounted in your sandbox at the paths below; read them with your file tools when relevant to the task, and treat them as authoritative reference material.","","Attached files:",Z.map((X)=>`- ${X.name} (${gF6(X)}), read it at \`${YN(X.volume,X.path)}\``).join(`
+`)}async function wF6($,Z,Q){if(Q.repository)return QN($,Q.repository,{bufferMs:yV0});return await Hi({ctx:$,connectionId:Q.connectionId,organizationId:Z,forceRefresh:!0,onLegacyMintError:(X)=>console.error("[TASK_ADD_REPO] legacy repo-scoped mint failed",{connectionId:Q.connectionId,error:X.message})}),XN(Q.connectionId,Q.owner,Q.name,$.db,$.vault,{bufferMs:yV0})}async function jF6($,Z,Q){let X=await $.storage.organizationSettings.get(Z);return _V0({ctx:$,orgId:Z,userId:Q,entries:X?.submodule_credentials})}function EF6($){return{git:{...$.primary?{repository:{...$.primary,submoduleCredentials:$.submoduleCredentials}}:{repositories:$.secondaries??[]},identity:{userName:$.gitUserName,userEmail:$.gitUserEmail}}}}async function zF6($,Z,Q,X){let Y=m80(Q);return(await Promise.all(Q.map(async(G,K)=>{let W=await SE($.storage,Z,G),H=W&&await aL($.storage,W)?W:null;if(!H&&!G.connectionId)return null;try{let{cloneUrl:F}=H?await QN($,H,{bufferMs:yV0}):await XN(G.connectionId,G.owner,G.name,$.db,$.vault,{bufferMs:yV0});return{cloneUrl:F,repoName:Y[K],submoduleCredentials:X}}catch(F){return console.warn(`[TASK_ADD_REPO] skipping secondary ${G.owner}/${G.name}:`,F instanceof Error?F.message:F),null}}))).filter((G)=>G!==null)}var yV0=3300000,WF6=4,HF6=250,FF6=2000,Qd$=45000,Xd$=1500,NF6=5,Jd$=20,DF6,TF1;var Gd$=L(()=>{x0();rZ();U80();nL0();oH();L80();OF1();aJ();XW();O8();GO();DF6=["origin=$(git remote get-url origin)",'token=$(printf %s "$origin" | sed -n "s|.*://[^:]*:\\([^@]*\\)@.*|\\1|p")','[ -n "$token" ] || exit 0','user=$(printf %s "$origin" | sed -n "s|.*://\\([^:]*\\):.*|\\1|p")','host=$(printf %s "$origin" | sed -n "s|.*@\\([^/]*\\)/.*|\\1|p")','[ -n "$host" ] || exit 0',"umask 077",'if [ "$user" = "oauth2" ]; then','  mkdir -p "${HOME:-/root}/.config/glab-cli"','  printf "hosts:\\n  %s:\\n    token: %s\\n    api_host: %s\\n    api_protocol: https\\n    is_oauth2: true\\n" "$host" "$token" "$host" > "${HOME:-/root}/.config/glab-cli/config.yml"','  chmod 600 "${HOME:-/root}/.config/glab-cli/config.yml"','elif [ "$user" = "x-access-token" ]; then','  mkdir -p "${HOME:-/root}/.config/gh"','  printf "%s:\\n  oauth_token: %s\\n  git_protocol: https\\n" "$host" "$token" > "${HOME:-/root}/.config/gh/hosts.yml"',"fi"];TF1=p({name:"TASK_ADD_REPO",description:"Clone one of this organization's repositories into your working directory. "+"Your working directory is EMPTY until you call this \u2014 do not look for "+"files, and do not run git, before it returns. Call it once, with the repository the task is about; it waits for the checkout and returns the repository root listing, so you can start reading files immediately after. `git` and the repository's CLI (`gh` for GitHub, `glab` for GitLab; Bitbucket has "+"no CLI \u2014 its token is the password in `git remote get-url origin`, for `curl` "+"against api.bitbucket.org) are authenticated once it returns. Call TASK_ADD_REPO with no arguments to list the repositories available.",annotations:{title:"Add Repository",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:P3.object({id:P3.string().optional().describe("id of the repository to clone, as returned by the listing. Omit to list the available repositories."),connectionId:P3.string().optional().describe("Deprecated alias for `id`.")}),outputSchema:P3.object({success:P3.boolean(),repositories:P3.array(P3.object({id:P3.string(),repo:P3.string()})).optional(),repo:P3.string().optional(),cloned:P3.boolean().optional(),files:P3.string().optional(),message:P3.string()}),handler:async($,Z)=>{$0(Z),await Z.access.check();let Q=U0(Z),X=t0(Z);if(!X)throw Error("User ID required");let{threadId:Y}=fV0(),J=await CE(Z,Q.id),G=$.id??$.connectionId,K=G?J.find((W0)=>W0.id===G):void 0;if(!K){let W0=J.map((P0)=>({id:P0.id,repo:P0.label}));return{success:!1,repositories:W0,message:G?`No repository for id "${G}". Pick one of the repositories listed.`:W0.length===0?"This organization has no repositories linked, so none can be cloned.":"Pick a repository and call TASK_ADD_REPO again with its id."}}let W=await Z.storage.threads.get(Y);if(!W)throw Error(`Thread not found: ${Y}`);let H=await Mi(Z,{threadId:Y,runBranch:W.branch}),F=await Ty(Z,H,X),U=await pY(Z),N=await UF6(Z,Y,F,H);if(!N)throw Error(`No sandbox is registered for this run (thread ${Y}), so there is nowhere to clone into.`);let B=W.metadata?.githubRepo,O=W.metadata?.githubRepos??[],D=B&&B.owner===K.owner&&B.name?.toLowerCase()===K.name.toLowerCase();if(B&&(D||BF6(O,{owner:K.owner,name:K.name})))return{success:!1,repo:`${K.owner}/${K.name}`,cloned:!1,message:D?`${K.label} is already checked out at your working directory.`:`This run already has ${Jd$} additional repositories checked out, which is the limit. Work with what's already checked out instead of adding another.`};let{cloneUrl:w,gitUserName:j,gitUserEmail:E}=await wF6(Z,Q.id,K),z={url:K.webUrl,owner:K.owner,name:K.name,...K.installationId!==void 0?{installationId:K.installationId}:{},...K.connectionId?{connectionId:K.connectionId}:{},...K.repository?{repositoryId:K.repository.id}:{}},A=!B,P=A?[]:await Z.storage.threads.appendThreadGithubRepo(Y,z);if(A)await Z.storage.threads.update(Y,{metadata:{...W.metadata??{},githubRepo:z},updated_by:X});let T=pL0({branch:H,derivedRef:aH(H),recordedHeadRef:null,sticky:!1}),q=await jF6(Z,Q.id,X),f=await U.proxyDaemonRequest(N.sandboxHandle,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify(EF6({...A?{primary:{cloneUrl:w,branch:T,repoName:`${K.owner}/${K.name}`}}:{secondaries:await zF6(Z,Q.id,P,q)},submoduleCredentials:q,gitUserName:j,gitUserEmail:E}))});if(!f.ok)throw Error(`the sandbox rejected the repository (${f.status} ${f.statusText})`);await U.proxyDaemonRequest(N.sandboxHandle,"/_sandbox/setup/clone",{method:"POST",headers:new Headers({"content-type":"application/json"}),body:"{}"}).catch((W0)=>{console.warn("[TASK_ADD_REPO] explicit clone kick failed",W0)});let C=A?null:$d$(P,{owner:K.owner,name:K.name}),V=A||!C?".":`"$(dirname "$PWD")/repos/${C}"`,h=Date.now()+Qd$,g=!1,l="",u=0,d=null;while(Date.now()<h){let W0=await Yd$(U,N.sandboxHandle,Y,`cd ${V} 2>/dev/null || exit 1; if [ -n "$(git ls-files 2>/dev/null | head -1)" ]; then echo __CLONED__; fi; ls -A 2>/dev/null`).catch(()=>null);if(!W0){if(++u>=NF6)break;await k$(Xd$);continue}u=0;let P0=LF6(W0.stdout);if(P0.cloned&&P0.listing===d){g=!0,l=P0.listing;break}d=P0.cloned?P0.listing:null,await k$(Xd$)}if(g)await Yd$(U,N.sandboxHandle,Y,OF6(A?null:`../repos/${C}`)).catch((W0)=>console.warn("[TASK_ADD_REPO] CLI auth setup failed",W0));return{success:g,repo:`${K.owner}/${K.name}`,cloned:g,files:l,message:g?A?`${K.label} is checked out at your working directory on branch ${T}. \`git\` and its CLI are authenticated. Start working.`:`${K.label} is checked out at ../repos/${C}, beside your working directory, on its default branch. \`git\` and its CLI are authenticated there too. Your first checkout is untouched \u2014 commit and open a change request in each repository you change.`:`The clone of ${K.owner}/${K.name} did not finish within ${Math.round(Qd$/1000)}s. It may still be in progress \u2014 check your working directory before calling this again.`}}})});import{z as f1}from"zod";var Ii=50000,Vi=500,gV0=200,ki=50000,KO,d80,Ay,PF6,TF6,AF6,Kd$,Si,RF6,qF6,Wd$;var rJ=L(()=>{x4();x4();KO=f1.enum(cH),d80=f1.enum(["bug","feature","chore","spike","security"]),Ay=f1.enum(["none","low","medium","high","urgent"]),PF6=f1.object({threadId:f1.string(),virtualMcpId:f1.string().nullable(),status:f1.enum(["in_progress","requires_action","failed","completed","expired"]).nullable(),title:f1.string().nullable(),lastMessage:f1.string().nullable(),hasPreview:f1.boolean(),failureKind:f1.string().nullable(),hasMessages:f1.boolean(),costUsd:f1.number().nullable(),costProvider:f1.string().nullable(),createdAt:f1.string(),lastActiveAt:f1.string()}),TF6=f1.object({reviewer:f1.enum(tK),verdict:f1.enum(["approved","changes_requested"]),verified:f1.boolean()}),AF6=f1.object({id:f1.string(),name:f1.string(),color:f1.string().nullable().describe('Hex color, e.g. "#3b82f6"'),createdBy:f1.string(),createdAt:f1.string().datetime()}),Kd$=f1.object({url:f1.string(),number:f1.number(),repoOwner:f1.string(),repoName:f1.string(),createdAt:f1.string(),updatedAt:f1.string().nullable(),title:f1.string().nullable(),body:f1.string().nullable(),state:f1.enum(["open","closed"]).nullable(),draft:f1.boolean().nullable(),merged:f1.boolean().nullable(),mergeable:f1.boolean().nullable(),checksStatus:f1.enum(["pending","passing","failing"]).nullable(),checks:f1.array(f1.object({name:f1.string(),status:f1.string(),conclusion:f1.string().nullable(),detailsUrl:f1.string().nullable(),summary:f1.string().nullable()})),previewUrl:f1.string().nullable()}),Si=f1.object({id:f1.string(),organizationId:f1.string(),title:f1.string(),description:f1.string().nullable(),status:KO,priority:Ay,type:d80,assigneeId:f1.string().nullable(),assignedBy:f1.string().nullable(),repo:f1.string().nullable(),repositoryId:f1.string().nullable(),dueDate:f1.string().datetime().nullable(),sortOrder:f1.number(),keySeq:f1.number().nullable(),externalUrl:f1.string().nullable(),previewRoutes:f1.array(f1.string()),source:f1.enum(["jira"]).nullable(),retryAttempts:f1.number(),reviewCycleStartedAt:f1.string().datetime().nullable(),threads:f1.array(PF6),tags:f1.array(AF6),reviewVerdicts:f1.array(TF6),createdBy:f1.string(),createdAt:f1.string().datetime(),updatedBy:f1.string(),updatedAt:f1.string().datetime()}),RF6=["created","status_changed","assignee_changed","priority_changed","due_date_changed","title_changed","description_changed","tags_changed","review_requested","review_approved","review_changes_requested","review_verdict_requested","merge_conflict_resolution","merge_failed","type_changed","duplicate_reported"],qF6=f1.enum(RF6),Wd$=f1.object({id:f1.string(),taskBoardItemId:f1.string(),action:qF6,actorId:f1.string().nullable(),data:f1.record(f1.string(),f1.unknown()),occurredAt:f1.string().datetime()})});async function hV0($,Z,Q){if(Q===I8)return;let{members:X}=await $.boundAuth.organization.listMembers({organizationId:Z,filterField:"userId",filterValue:Q});if(!X.some((Y)=>Y.userId===Q))throw Error("assigneeId is not a member of the organization")}var AF1=L(()=>{rJ()});function Ud$($){let Z={};for(let[Q,X]of Object.entries($)){if(Q.startsWith(MF6))continue;Z[Q]=X}return Z}function uV0($){return{taskBoardItemId:$.id,...yX($)&&{[Hd$]:Fd$}}}function IF6($){return $?.[Hd$]===Fd$}function VF6($){if(/[:\s]/.test($))throw Error("organization id unsuitable for the subsidy key scheme");return`subsidy:${$}`}async function kF6($,Z){let Q=T0();try{let X=await $.storage.subsidizedGatewayKeys.get(Z);if(X)return X;let Y=$.auth?.user?.id;if(Y&&Q.aiGatewayEnabled&&Q.studioProvisionSecretKey&&jj.provisionKey){let J=await MQ(Y,$.auth?.user?.email),G=await jj.provisionKey(J,VF6(Z));return await $.storage.subsidizedGatewayKeys.put(Z,G),G}}catch(X){console.error("[subsidized-runs] subsidy key unavailable \u2014 run stays on the org's key:",X)}return}async function Nd$($,Z,Q){if(!T0().taskQuotaEnforced)return;if(!IF6(Q))return;let X=Q?.taskBoardItemId;if(!X)return;let Y=await $.storage.taskBoard.getById(X,Z);if(!Y||!yX(Y))return;if(!await xx$($,X))return;return await kF6($,Z)}function Bd$($,Z){if(!Z)return $;if($.providerId!=="deco")return $;return{...$,apiKey:Z}}var MF6="srv.",Hd$="srv.billing",Fd$="subscription";var i80=L(()=>{hm();$H();H$();oK()});function p80($){let Z=$?.runClass;return Z&&Z in RF1?RF1[Z]:RF1.interactive}var RF1,Ci="runClass";var _i=L(()=>{RF1={interactive:10,reviewer:20,retry:30,new_task:40}});async function lV0($,Z,Q){let X;try{return await Promise.race([$.aiProviders.listModels(Z,Q),new Promise((J,G)=>{X=setTimeout(()=>G(Error("listModels timeout")),SF6)})])}finally{if(X)clearTimeout(X)}}function CF6($,Z){switch($){case"fast":return Z.chat.fast;case"smart":return Z.chat.smart;case"thinking":return Z.chat.thinking;case"image":return Z.image;case"web_search":return Z.webSearch;case"deep_research":return Z.deepResearch}}function cV0($,Z,Q){let X=$.find((Y)=>Y.modelId===Z);return{title:X?.title??Q??Z,providerId:X?.providerId,capabilities:X?.capabilities,limits:X?.limits??null}}async function q6($,Z,Q){let X=$.organization?.id;if(!X)throw Error("resolveTier called without an organization");let J=(await $.storage.organizationSettings.get(X))?.simple_mode?.tiers?.[Z]??null,G=$.auth?.user?.id,K=JE.safeParse(Z),W=Q?.applyUserPrefs&&K.success&&G?(await $.storage.userModelPreferences.get(G,X))?.tiers?.[K.data]??null:null,H=(await $.storage.aiProviderKeys.list({organizationId:X})).filter((w)=>VT(w.providerId)),F=await hS$($,X,Z),U=F?H.find((w)=>w.providerId==="deco"):void 0;if(F&&U){let w=await lV0($,U.id,X).catch(()=>[]);return{credentialId:U.id,modelId:F,modelMeta:cV0(w,F)}}for(let w of[W,J])if(w&&H.some((j)=>j.id===w.keyId)){let j=await lV0($,w.keyId,X).catch(()=>[]);return{credentialId:w.keyId,modelId:w.modelId,modelMeta:cV0(j,w.modelId,w.title)}}if(H.length===0)throw new vi(Z);let N={};await Promise.all(H.map(async(w)=>{N[w.id]=await lV0($,w.id,X).catch(()=>[])}));let B=H.map((w)=>({id:w.id,providerId:w.providerId,label:w.label,presetId:w.presetId,createdBy:w.createdBy,createdAt:w.createdAt})),O=M3$(B,N),D=CF6(Z,O);if(!D)throw new vi(Z);return{credentialId:D.keyId,modelId:D.modelId,modelMeta:cV0(N[D.keyId]??[],D.modelId,D.title)}}async function Ld$($,Z,Q){let X=$.organization?.id;if(!X)throw Error("resolveSpecificModel called without an organization");let Y=await $.storage.aiProviderKeys.findById(Z,X).catch((G)=>{if(G instanceof Error&&G.message==="Provider key not found")throw new n80(`AI provider credential "${Z}" was not found`,{cause:G});throw G});if(!VT(Y.providerId))throw new n80(`AI provider credential "${Z}" uses native-only provider "${Y.providerId}" and cannot run a hosted model`);let J=await lV0($,Z,X).catch(()=>[]);return{credentialId:Z,modelId:Q,modelMeta:cV0(J,Q)}}async function mX($,Z){try{return await q6($,Z)}catch(Q){if(Q instanceof vi)return null;return console.warn(`[resolveTier] tier "${Z}" resolution failed:`,Q),null}}var vi,n80,SF6=5000;var dX=L(()=>{lU();xZ();Q4();vi=class vi extends Error{tier;constructor($){super(`No model available for tier "${$}". Connect a provider or configure the tier in organization settings.`);this.tier=$;this.name="TierUnavailableError"}};n80=class n80 extends Error{constructor($,Z){super($,Z);this.name="SpecificModelCredentialUnavailableError"}}});function Od$($){return $ instanceof rH||typeof $==="object"&&$!==null&&$.permanent===!0}var rH;var qF1=L(()=>{rH=class rH extends Error{permanent=!0;code;constructor($,Z){super(Z);this.name="PermanentRunError",this.code=$}}});function wd$($){if($==="reviewer")return"reviewer";if($==="conflict")return"conflict";return"default"}function Ed$($,Z="default"){let{providerId:Q,apiKey:X,baseUrl:Y}=$,J=vF6[Z],G={CLAUDE_CODE_MAX_OUTPUT_TOKENS:`${_F6}`,CLAUDE_CODE_MAX_TURNS:J===null?null:`${J}`,ENABLE_TOOL_SEARCH:xF6};if(Q==="anthropic")return{...G,CLAUDE_CODE_MODEL:MF1.anthropic[Z],ANTHROPIC_API_KEY:X,ANTHROPIC_AUTH_TOKEN:null,CLAUDE_CODE_OAUTH_TOKEN:null,ANTHROPIC_BASE_URL:Y??null};if(Q==="claude-subscription")return{...G,CLAUDE_CODE_MODEL:MF1.anthropic[Z],CLAUDE_CODE_OAUTH_TOKEN:X,ANTHROPIC_API_KEY:null,ANTHROPIC_AUTH_TOKEN:null,ANTHROPIC_BASE_URL:null};if(Q==="openrouter"||Q==="deco")return{...G,CLAUDE_CODE_MODEL:MF1.openrouter[Z],ANTHROPIC_API_KEY:"",ANTHROPIC_AUTH_TOKEN:X,CLAUDE_CODE_OAUTH_TOKEN:null,ANTHROPIC_BASE_URL:Y??"https://openrouter.ai/api"};throw new jd$(Q)}var Dd$="claude-subscription",MF1,mV0="claudeCodeModelClass",_F6=32000,vF6,xF6="1",jd$;var dV0=L(()=>{MF1={anthropic:{default:"claude-opus-5-5",reviewer:"claude-sonnet-5",conflict:"claude-sonnet-5"},openrouter:{default:"anthropic/claude-opus-5.5",reviewer:"anthropic/claude-sonnet-5",conflict:"anthropic/claude-sonnet-5"}};vF6={default:null,reviewer:60,conflict:60};jd$=class jd$ extends Error{constructor($){super(`the claude-code harness needs an Anthropic, OpenRouter or Deco model credential; this run's model resolves to "${$}". Point the agent's thinking model at one of those, or run it with Decopilot.`);this.name="UnsupportedClaudeCodeProviderError"}}});import{z as G$}from"zod";var zd$,fF6,t80,bF6,yF6,QiZ;var Pd$=L(()=>{zd$=G$.object({chunks:G$.array(G$.unknown()),done:G$.boolean().nullish().transform(($)=>$??!1),error:G$.object({code:G$.string(),message:G$.string()}).nullish().transform(($)=>$??null)}),fF6=G$.record(G$.string(),G$.unknown()),t80=G$.object({id:G$.string(),title:G$.string().optional(),provider:G$.string().nullable().optional(),credentialId:G$.string(),limits:G$.object({contextWindow:G$.number().int().positive().optional(),maxOutputTokens:G$.number().int().positive().optional()}).optional(),capabilities:G$.object({vision:G$.boolean().optional(),text:G$.boolean().optional(),reasoning:G$.boolean().optional()}).optional()}).strict(),bF6=G$.object({thinking:t80.extend({title:G$.string()}),fast:t80.optional(),smart:t80.optional(),image:t80.optional(),deepResearch:t80.optional()}).strict(),yF6=G$.discriminatedUnion("cwd",[G$.object({cwd:G$.literal("/repo"),repo:G$.object({owner:G$.string(),name:G$.string(),connectedGithub:G$.boolean()}).strict().optional(),branch:G$.string().nullable()}).strict(),G$.object({cwd:G$.null()}).strict()]),QiZ=G$.object({threadId:G$.string(),userMessage:fF6,harness:G$.object({sessionId:G$.string().optional()}).strict(),workspace:yF6,models:bF6,mcp:G$.object({url:G$.string().url(),headers:G$.record(G$.string(),G$.string()),expiresAt:G$.number().int().positive()}).strict(),orgMcps:G$.array(G$.object({name:G$.string(),url:G$.string().url(),headers:G$.record(G$.string(),G$.string())}).strict()).optional(),mode:G$.enum(["default","plan","web-search","gen-image"]),temperature:G$.number(),toolApprovalLevel:G$.enum(["auto","readonly"]),toolAllowlist:G$.array(G$.string()).nullable().optional(),maxAgentSteps:G$.number().int().optional(),user:G$.object({id:G$.string(),email:G$.string()}).strict(),organizationId:G$.string(),agent:G$.object({id:G$.string(),instructions:G$.string().optional(),disallowedTools:G$.array(G$.string()).optional()}).strict(),currentThreadTitle:G$.string().optional(),resume:G$.object({reason:G$.string()}).strict().optional()}).strict()});var Td$="sandbox_gone",Ad$="superseded",iV0="[SANDBOX_UNREACHABLE]";function gF6($){let Z=[$.contentType??"file"];if($.size!=null)Z.push(`${$.size} bytes`);return Z.join(", ")}function hF6($){let Z=($??[]).filter((X)=>X.kind!=="skill");if(Z.length===0)return null;return["<knowledge>","The following files are attached to you as reference knowledge. They are mounted in your sandbox at the paths below; read them with your file tools when relevant to the task, and treat them as authoritative reference material.","","Attached files:",Z.map((X)=>`- ${X.name} (${gF6(X)}), read it at \`${YN(X.volume,X.path)}\``).join(`
 `),"</knowledge>"].join(`
 `)}function Rd$($,Z){let Q=hF6(Z);if(!Q)return $;return $?`${$}
 
@@ -3625,7 +3625,7 @@ ${Y}`:Y}case"media":return"";case"mediaSingle":case"mediaGroup":return ai(wN(Q),
                   then max(up.metadata->'models'->'thinking'->>'provider')
                 end`.as("provider")]).whereRef("up.thread_id","=","link.thread_id").where("up.kind","=","finish").as("cost"),(G)=>G.onTrue()).select((G)=>["cost.usd as costUsd","cost.provider as costProvider","link.task_board_item_id as taskId","link.thread_id as threadId","link.created_at as createdAt","t.status as status","t.failure_kind as failureKind","t.title as title","t.virtual_mcp_id as virtualMcpId","t.metadata as metadata","t.updated_at as updatedAt","t.last_progress_at as lastProgressAt","lastmsg.payload as lastMessagePayload",G.or([G.exists(G.selectFrom("thread_message_parts as mp").select("mp.id").whereRef("mp.thread_id","=","link.thread_id")),G.exists(G.selectFrom("thread_messages as tm").select("tm.id").whereRef("tm.thread_id","=","link.thread_id"))]).as("hasMessages")]).where("link.organization_id","=",Q).where("link.task_board_item_id","in",X).orderBy("link.created_at","desc").execute(),J=new Map;for(let G of Y){let K={threadId:G.threadId,virtualMcpId:G.virtualMcpId??null,status:G.status??null,failureKind:G.failureKind??null,title:G.title??null,lastMessage:we$(G.lastMessagePayload),hasPreview:MP6(G.metadata),hasMessages:!!G.hasMessages,lastActiveAt:VP6(G.updatedAt,G.lastProgressAt),costUsd:IP6(G.costUsd),costProvider:G.costProvider??null,createdAt:G.createdAt instanceof Date?G.createdAt.toISOString():G.createdAt},W=J.get(G.taskId);if(W)W.push(K);else J.set(G.taskId,[K])}for(let G of Z)G.threads=J.get(G.id)??[]}async attachTags($,Z){let Q=Z.map((J)=>J.id),X=await $.selectFrom("task_board_item_tags as link").innerJoin("organization_tags as tag","tag.id","link.id").select(["link.task_board_item_id as taskId","link.created_by as createdBy","link.created_at as createdAt","tag.id as id","tag.name as name","tag.color as color"]).where("link.task_board_item_id","in",Q).orderBy("tag.name","asc").execute(),Y=new Map;for(let J of X){let G={id:J.id,name:J.name,color:J.color??null,createdBy:J.createdBy,createdAt:J.createdAt instanceof Date?J.createdAt.toISOString():J.createdAt},K=Y.get(J.taskId);if(K)K.push(G);else Y.set(J.taskId,[G])}for(let J of Z)J.tags=Y.get(J.id)??[]}async attachReviewVerdicts($,Z){let Q=Z.map((J)=>J.id),X=await $.selectFrom("task_board_activity").select(["task_board_item_id as taskId","action","data","occurred_at"]).where("task_board_item_id","in",Q).where("action","in",["status_changed","review_approved","review_changes_requested"]).orderBy("occurred_at","asc").execute(),Y=new Map;for(let J of X){let G={action:J.action,data:J.data??null,occurredAt:J.occurred_at instanceof Date?J.occurred_at.toISOString():J.occurred_at},K=Y.get(J.taskId);if(K)K.push(G);else Y.set(J.taskId,[G])}for(let J of Z){let G=Y.get(J.id)??[],K=J.reviewCycleStartedAt,W=BE(G,{cycleStartedAt:K}),H=BE(G,{cycleStartedAt:K,verifiedOnly:!0});J.reviewVerdicts=tK.flatMap((F)=>{let U=W.get(F);if(!U)return[];return[{reviewer:F,verdict:U,verified:H.get(F)==="approved"}]})}}async recordActivity($){await this.db.insertInto("task_board_activity").values({id:Z4("act"),task_board_item_id:$.taskBoardItemId,action:$.action,actor_id:$.actorId,data:$.data?JSON.stringify($.data):null,occurred_at:new Date().toISOString()}).execute(),await this.fanOut([$])}async fanOut($){for(let Z of $){let Q=AP6(Z.action);if(!Q)continue;await Zp({db:this.db,taskBoardItemId:Z.taskBoardItemId,type:Q,actorId:Z.actorId,alsoSubscribe:Z.alsoSubscribe})}}async resolveReviewClaimByToken($,Z){let Q=await this.db.selectFrom("task_board_review_claims").select(["reviewer","cycle_at"]).where("task_board_item_id","=",$).where("token","=",Z).executeTakeFirst();return Q?{reviewer:Q.reviewer,cycleAt:Q.cycle_at}:null}async recordActivities($){if($.length===0)return;let Z=new Date().toISOString(),Q=[];for(let X of $)if(!(RP6.has(X.action)&&await this.touchRecentActivity(X,Z)))Q.push(X);if(Q.length===0)return;await this.db.insertInto("task_board_activity").values(Q.map((X)=>({id:Z4("act"),task_board_item_id:X.taskBoardItemId,action:X.action,actor_id:X.actorId,data:X.data?JSON.stringify(X.data):null,occurred_at:Z}))).execute(),await this.fanOut(Q)}async touchRecentActivity($,Z){let Q=new Date(Date.parse(Z)-qP6).toISOString();return((await this.db.updateTable("task_board_activity").set({occurred_at:new Date(Z)}).where("id","=",this.db.selectFrom("task_board_activity").select("id").where("task_board_item_id","=",$.taskBoardItemId).where("action","=",$.action).where((Y)=>$.actorId===null?Y("actor_id","is",null):Y("actor_id","=",$.actorId)).where("occurred_at",">=",new Date(Q)).orderBy("occurred_at","desc").limit(1)).executeTakeFirst()).numUpdatedRows??0n)>0n}async listActivity($,Z){return(await this.db.selectFrom("task_board_activity as a").innerJoin("task_board_items as item","item.id","a.task_board_item_id").selectAll("a").where("item.organization_id","=",Z).where("a.task_board_item_id","=",$).orderBy("a.occurred_at","asc").execute()).map((X)=>({id:X.id,taskBoardItemId:X.task_board_item_id,action:X.action,actorId:X.actor_id,data:typeof X.data==="string"?JSON.parse(X.data):X.data??{},occurredAt:X.occurred_at instanceof Date?X.occurred_at.toISOString():X.occurred_at}))}async hasHumanRejectedDone($,Z){let Q=$F`a.data->>'from'`,X=$F`a.data->>'reason'`,Y="a.actor_id";return await this.db.selectFrom("task_board_activity as a").innerJoin("task_board_items as item","item.id","a.task_board_item_id").select("a.id").where("item.organization_id","=",Z).where("a.task_board_item_id","=",$).where("a.action","=","status_changed").where("a.actor_id","is not",null).where(Q,"in",["done","merged"]).where(X,"is",null).limit(1).executeTakeFirst()!==void 0}async listComments($,Z){return(await this.db.selectFrom("task_board_comments as c").innerJoin("task_board_items as item","item.id","c.task_board_item_id").selectAll("c").where("item.organization_id","=",Z).where("c.task_board_item_id","=",$).orderBy("c.created_at","asc").execute()).map((X)=>LS0(X))}async createComment($){if(!await this.db.selectFrom("task_board_items").select("id").where("id","=",$.taskBoardItemId).where("organization_id","=",$.organizationId).executeTakeFirst())return null;let Q=null;if($.parentId){let Y=await this.db.selectFrom("task_board_comments").select(["id","parent_id"]).where("id","=",$.parentId).where("task_board_item_id","=",$.taskBoardItemId).executeTakeFirst();if(!Y)return null;Q=Y.parent_id??Y.id}let X=await this.db.insertInto("task_board_comments").values({id:Z4("cmt"),task_board_item_id:$.taskBoardItemId,parent_id:Q,author_id:$.authorId,thread_id:$.threadId??null,body:$.body}).returningAll().executeTakeFirstOrThrow();return LS0(X)}async updateComment($){let Z=await this.commentInOrg($.id,$.organizationId);if(!Z)return null;if($.body!==void 0&&Z.authorId!==$.callerId)return null;if($.resolved!==void 0&&Z.parentId!==null)return null;let Q=await this.db.updateTable("task_board_comments").set({...$.body===void 0?{}:{body:$.body},...$.resolved===void 0?{}:{resolved:$.resolved},updated_at:new Date().toISOString()}).where("id","=",$.id).returningAll().executeTakeFirst();return Q?LS0(Q):null}async deleteComment($,Z,Q){let X=await this.commentInOrg($,Z);if(!X)return!1;if(X.authorId!==Q&&X.authorId!==I8)return!1;return await this.db.deleteFrom("task_board_comments").where("id","=",$).execute(),!0}async getComment($,Z){let Q=await this.db.selectFrom("task_board_comments as c").innerJoin("task_board_items as item","item.id","c.task_board_item_id").selectAll("c").where("c.id","=",$).where("item.organization_id","=",Z).executeTakeFirst();return Q?LS0(Q):null}async commentInOrg($,Z){let Q=await this.db.selectFrom("task_board_comments as c").innerJoin("task_board_items as item","item.id","c.task_board_item_id").select(["c.id","c.author_id","c.parent_id"]).where("c.id","=",$).where("item.organization_id","=",Z).executeTakeFirst();return Q?{authorId:Q.author_id,parentId:Q.parent_id}:null}itemFromDbRow($){return{id:$.id,organizationId:$.organization_id,title:$.title,description:$.description,status:$.status,priority:$.priority,type:$.type??r31,assigneeId:$.assignee_id,assignedBy:$.assigned_by,repo:$.repo,repositoryId:$.repository_id??null,dueDate:$.due_date instanceof Date?$.due_date.toISOString():$.due_date,externalUrl:$.external_url??null,previewRoutes:$.preview_routes??[],source:$.source??null,sortOrder:$.sort_order,keySeq:$.key_seq,retryAttempts:$.retry_attempts??0,reviewCycleStartedAt:$.review_cycle_started_at instanceof Date?$.review_cycle_started_at.toISOString():$.review_cycle_started_at??null,threads:[],tags:[],reviewVerdicts:[],createdBy:$.created_by,createdAt:$.created_at instanceof Date?$.created_at.toISOString():$.created_at,updatedBy:$.updated_by,updatedAt:$.updated_at instanceof Date?$.updated_at.toISOString():$.updated_at}}}var TP6,RP6,qP6=600000,je$,h40,kP6;var OO=L(()=>{A6();oK();jX();x4();x4();ok0();FS0();BS0();mr();TP6=new Set(HS0);RP6=new Set(["description_changed","title_changed"]);je$=new Set(["in_progress","in_review"]),h40=new Set(["completed","failed","expired"]);kP6=[...jL0,"done"]});function Jz($){if($==null)return null;if(typeof $==="string")return WG1($);let Z;try{Z=JSON.stringify($)}catch{return null}return Z?WG1(Z):null}function u40($){return{repo:xH($.url)??SL($.repoOwner,$.repoName),repositoryId:$.repositoryId,connectionId:$.connectionId}}var cy=L(()=>{A6()});function l40($){return $.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;")}function SP6($){let Z=ei($.orgSlug,$.keySeq),Q=Z??$.title,X=Z?`${$.baseUrl}/${encodeURIComponent($.orgSlug)}/t/${encodeURIComponent(Z)}`:null,Y=$.prs.map((J)=>`<p style="margin:0 0 8px 0;"><a href="${l40(J.url)}" style="color:#141413;">Review ${l40(J.repo)} #${J.number}</a></p>`).join("");return{subject:`${Q} is ready for your review`,html:pG({preheader:`${Q} has a pull request waiting for you.`,heading:"Ready for your review",subheading:X?`<a href="${X}" style="color:#141413;">${l40(Q)}</a> \u2014 ${l40($.title)}`:l40($.title),body:Y})}}function CP6(){let $=jH().auth,Z=$.emailProviders??[],Q=$.inviteEmailProviderId?iG(Z,$.inviteEmailProviderId):Z[0];return Q?dG(Q):null}async function Ee$($,Z){try{let Q=await $.storage.organizationSettings.get(Z.organizationId);if(!cQ(Q?.flags,"home_task_intake_enabled"))return;if(!Z.createdBy)return;let X=await $.storage.taskBoard.listPrs(Z.id,Z.organizationId);if(X.length===0)return;let Y=await $.db.selectFrom("user").innerJoin("member","member.userId","user.id").select("user.email as email").where("user.id","=",Z.createdBy).where("member.organizationId","=",Z.organizationId).executeTakeFirst();if(!Y?.email)return;let J=await $.db.selectFrom("organization").select("slug").where("id","=",Z.organizationId).executeTakeFirst();if(!J?.slug)return;let G=CP6();if(!G)return;let{subject:K,html:W}=SP6({title:Z.title,orgSlug:J.slug,keySeq:Z.keySeq,prs:X.map((H)=>({url:H.url,repo:`${H.repoOwner}/${H.repoName}`,number:H.number})),baseUrl:V9()});await G({to:Y.email,subject:K,html:W})}catch(Q){console.error(`[task-board] PR-ready email for ${Z.id} failed`,Q)}}var ze$=L(()=>{US0();xZ();MA();Q00();B9()});function c40($){return!!$&&T0().taskBoardAdminOrgIds.includes($)}async function aN1($,Z){let Q=T0().taskBoardAdminOrgIds;if(!Z||Q.length===0)return!1;return!!await $.selectFrom("member").select(["id"]).where("userId","=",Z).where("organizationId","in",Q).executeTakeFirst()}async function m40($){if(!$.db)return!1;return aN1($.db,$.auth?.user?.id)}function my($){console.log("task_board_admin_action",$)}var OS0=L(()=>{H$()});async function GW($,Z){let Q=await $.selectFrom("organization").select(["id","slug","name"]).where("id","=",Z).executeTakeFirst();if(!Q)return null;let X=await pQ.create();return X.organization={id:Q.id,slug:Q.slug,name:Q.name},Gz(X,{id:Q.id,slug:Q.slug}),X}var dy=L(()=>{aU()});import{z as _P6}from"zod";async function fP6($,Z,Q){if(!c40($.organization?.id)||!await m40($))throw Error("Not allowed to act on another organization (the `org` parameter needs an admin org)");let X=await $.storage.taskBoardAnalytics.resolveOrgRef(Z);if(!X)throw Error(`Organization not found: ${Z}`);let Y=await GW($.db,X.id);if(!Y)throw Error(`Organization not found: ${Z}`);return my({action:"tool_org_override",actorUserId:$.auth?.user?.id,actorOrgId:$.organization?.id,targetOrgId:X.id,tool:Q}),Y.auth=$.auth,Y.boundAuth=$.boundAuth,Y.access=$.access,Y}function Qp($){let Z=$;return{...$,description:`${$.description}${xP6}`,inputSchema:Z.inputSchema.extend(vP6),execute:async(Q,X)=>{let{org:Y,...J}=Q??{};if(!Y)return Z.execute(Q,X);return Z.execute(J,await fP6(X,Y,$.name))}}}var vP6,xP6;var DS0=L(()=>{OS0();dy();vP6={org:_P6.string().optional().describe("Org slug or id to read instead of the current one. Requires membership of an admin org; omit for the current org.")},xP6=" Pass `org` to read ANOTHER organization's board instead of the current "+"one \u2014 call TASK_BOARD_ADMIN_ORG_LIST first for the organizations you may "+"name (an empty list means none, and `org` will be refused)."});import{z as wS0}from"zod";async function r6($,Z){try{await $.storage.taskBoard.recordActivity(Z)}catch(Q){console.error("[task-board] activity log write failed",Q)}}async function Pe$($,Z){if(Z.length===0)return;try{await $.storage.taskBoard.recordActivities(Z)}catch(Q){console.error("[task-board] activity log write failed",Q)}}var bP6,rN1;var tX=L(()=>{x0();rJ();DS0();bP6=p({name:"TASK_BOARD_ACTIVITY_LIST",description:"List a task board item's change history (timeline, oldest first).",annotations:{title:"List Task Activity",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:wS0.object({taskBoardItemId:wS0.string()}),outputSchema:wS0.object({activity:wS0.array(Wd$)}),handler:async($,Z)=>{$0(Z),await Z.access.check();let Q=Z.organization?.id;if(!Q)throw Error("Organization ID required (no active organization in context)");return{activity:await Z.storage.taskBoard.listActivity($.taskBoardItemId,Q)}}}),rN1=Qp(bP6)});function iy($){if($.length===0)return!1;let Z=new Map;for(let Q of $){let X=`${Q.repoOwner}/${Q.repoName}`.toLowerCase(),Y=Z.get(X);if(Y)Y.push(Q);else Z.set(X,[Q])}return[...Z.values()].every(yP6)}function yP6($){return $.some((Z)=>Z.merged===!0)&&$.every((Z)=>Z.merged===!0||Z.state==="closed")}async function gP6($,Z,Q,X){let Y=await $.storage.taskBoard.getById(Q,Z);if(!Y||Y.status!=="done")return!1;let J=await $.storage.taskBoard.listPrs(Q,Z),G=await Promise.all(J.map(async(H)=>({...H,...await X($,Z,H)})));if(!iy(G))return!1;let K=l$.archive,W=await $.storage.taskBoard.update(Q,Z,{status:K},Y.updatedBy);return await r6($,{taskBoardItemId:Q,action:"status_changed",actorId:null,data:{from:"done",to:K,reason:"merged_pr_auto_archive"}}),T8(Z,W),!0}async function Te$($,Z,Q,X=ES0){let Y=0;for(let J of Q)try{if(await gP6($,Z,J,X))Y+=1}catch(G){console.error(`[task-board-archive] ${J} failed`,G)}return{archived:Y}}function jS0($){let Z=new Map;for(let{id:Q,organizationId:X}of $){let Y=Z.get(X);if(Y)Y.push(Q);else Z.set(X,[Q])}return[...Z].map(([Q,X])=>({organizationId:Q,itemIds:X}))}var Xp=L(()=>{x4();tX();V7();y9()});function py($){let Z=uP6[$];if(Z===void 0)throw Error(`Unknown board column "${$}"`);return Z}function sN1($){return Ae$.includes($)}function Re$($,Z){return py(Z)>py($)}function PS0($,Z){return py($)<=py(Z)}function Me$($){return $==="done"||Ae$.includes($)}function ZG($){if(py($.status)>zS0.in_review)return!1;return $.status===l$.review||Boolean($.reviewCycleStartedAt)}var hP6,zS0,uP6,Ae$,qe$;var ZF=L(()=>{x4();hP6=Object.fromEntries(cH.map(($,Z)=>[$,Z])),zS0=hP6,uP6=zS0;Ae$=jL0;qe$=new Set(["in_review","approved"])});function TS0($){return $===""?"Your Studio tools are registered under their bare names: a tool named `JIRA_COMMENT_ADD` is called exactly that.":"Your Studio tools are namespaced `mcp__studio__`: where an instruction names a tool `JIRA_COMMENT_ADD`, the tool you actually call is `mcp__studio__JIRA_COMMENT_ADD`. Don't search for the unprefixed name."}function AS0($){return $.replace(/\/api\/[^/\s)]+\/fs\/([^/\s)]+)\/read\?path=([^)\s]+)/g,(Z,Q,X)=>{let Y,J;try{Y=decodeURIComponent(Q),J=decodeURIComponent(X)}catch{return Z}let G=(K)=>K.startsWith("/")||K.split("/").includes("..");if(G(Y)||G(J))return Z;return YN(Y,J)})}function RS0($,Z){return Z===$?null:"The image and file links in that description are real paths in this sandbox, not URLs \u2014 `Read` them. A screenshot the task points at is usually the clearest statement of what it wants."}var eN1=L(()=>{l2()});function lP6($,Z){let Q=Z?.repositoryId,X=Z?.repo;if(Q){let Y=$.filter((J)=>J.repository?.id===Q);if(Y.length>0)return Y}if(X)return $.filter((Y)=>`${Y.owner}/${Y.name}`.toLowerCase()===X.toLowerCase());return Q?[]:$}function cP6($,Z){if($=lP6($,Z),$.length!==1)return null;let Q=$[0];return{id:Q.id,owner:Q.owner,name:Q.name,url:Q.webUrl,provider:Q.provider,...Q.connectionId?{connectionId:Q.connectionId}:{},...Q.repository?{repositoryId:Q.repository.id}:{},...Q.installationId!==void 0?{installationId:Q.installationId}:{}}}async function MS0($,Z,Q){if(!cD())return console.warn(`[task-board] claude-code skipped for org ${Z}: `+"hosted sandbox unavailable \u2014 running Decopilot"),null;try{let X=await CE($,Z),Y=cP6(X,Q);if(Y)return{repo:Y};if(X.length===0)return console.warn(`[task-board] claude-code skipped for org ${Z}: `+"no importable repos \u2014 running Decopilot"),null;return console.warn(`[task-board] claude-code for org ${Z}: ${X.length} importable repos \u2014 the run picks one with TASK_ADD_REPO`),{choices:X.map((J)=>({id:J.id,repo:`${J.owner}/${J.name}`}))}}catch(X){return console.warn("[task-board] repo lookup for claude-code failed",X),null}}function qS0($){let Z=$?.others??[];if(Z.length===0)return[];return[`This issue spans ${Z.length+1} repositories, and it has an open pull request in each of the others too:`,...Z.map((Q)=>`- ${Q.repo}: pull request #${Q.number} (${Q.url}) on branch \`${Q.head}\`. After cloning that repository, run \`git fetch origin +refs/heads/${Q.head}:refs/remotes/origin/${Q.head} && git checkout -B ${Q.head} origin/${Q.head}\` BEFORE editing (the clone is single-branch, so a bare \`git fetch origin ${Q.head}\` creates no branch to check out), and push to update that SAME pull request \u2014 do NOT open a new one there.`),"A change that only lands on one side is worse than none: if you cannot update them all, update none and say why."]}function Ie$($,Z,Q){let X=AC$(Z?.provider??"github"),Y=Q?.source?.kind==="jira",J=[Q?.instruction?.trim()||(Y?"":`You've been assigned this task. Complete it and finish with a ${X.changeRequest} if it makes sense (like a coding task) or is explicitly requested.`),"","You are running AUTONOMOUSLY \u2014 no human is watching, so drive this to "+"completion yourself. Make reasonable decisions and move on; do not stop to ask for confirmation.","",`Title: ${$.title}`];if($.description){let G=AS0($.description);J.push("","Description:",G);let K=RS0($.description,G);if(K)J.push("",K)}if(J.push("",Z?`The repository ${Z.owner}/${Z.name} is already cloned at your working directory, on its own branch. It is hosted on ${X.name}, so ${X.cli?`\`git\` and \`${X.cli}\` are`:"`git` is"} authenticated there${X.cli?"":" (Bitbucket has no CLI; `$BITBUCKET_TOKEN` is the bearer for its REST API)"}. ${u$0}`:["Your working directory is EMPTY: this organization has several repositories, so nothing has been cloned yet. FIRST call `mcp__studio__TASK_ADD_REPO` with the id of the repository this task is about. It clones that repository into your working directory and waits for the checkout, so once it returns the repository is there on its own branch, with `git` and that repository's own CLI authenticated. Do not read files or run `git` before it returns; there is nothing there yet.","","Repositories in this organization:",...(Q?.repoChoices??[]).map((G)=>`- ${G.repo} (id: ${G.id})`),Q?.repoChoices?.length?"Start with the one the task is about. If it turns out to need a change in "+"another of them too, call `mcp__studio__TASK_ADD_REPO` again \u2014 repositories "+"accumulate, so a second call adds a checkout beside the first rather than replacing it. Each lands in its own directory and keeps its own git remote, so open one change request per repository you changed.":"Call `mcp__studio__TASK_ADD_REPO` with no arguments to list them."].join(`
 `),"",mP6,""),Q?.resolveConflict&&Q.pr)J.push(`Pull request #${Q.pr.number} (${Q.pr.url}) is approved but has a MERGE CONFLICT with its base branch.`,`Check that branch out (\`${UG1(Z?.provider??"github",Q.pr.number)}\`), merge or rebase the base branch into it, resolve the conflicts, and push to update the SAME ${X.changeRequest} \u2014 do NOT open a new one. Resolve by preserving BOTH sides' intent; never blindly discard either side, and change only what the conflict requires.`,"");else if(Q?.feedback)J.push(Q.pr?`A reviewer requested changes on pull request #${Q.pr.number} (${Q.pr.url}):`:"A reviewer requested changes on your previous work:",Q.feedback,Q.pr?`Check that branch out (\`${UG1(Z?.provider??"github",Q.pr.number)}\`) before editing, address the feedback, then push to update the SAME ${X.changeRequest} \u2014 do NOT open a new one.`:"Address this feedback.",...qS0(Q.pr),"");else if(Q?.pr)J.push(`This task already has an open pull request #${Q.pr.number} (${Q.pr.url}), and you are already on its branch.`,"Continue that work: commit and push to update the SAME pull request \u2014 do NOT open a new one. If it already does everything the task asks, say so and stop rather than changing it.",...qS0(Q.pr),"");if(Y)return J.push(TS0("mcp__studio__"),""),J.join(`
-`).trimStart();return J.push("How to finish:","- Make the change, commit it, push the branch, and open a pull request"+(Q?.pr?" \u2014 or push to the existing one, per the instruction above.":"."),"- Change only what the task needs. Don't refactor around it.","- The change must be REACHABLE from the surface the task names: edit the component that route actually renders, not one that merely looks like the right place. A change nothing imports is the most common reason a task comes back rejected.","- Before handing over, VERIFY the task's outcome LOCALLY, in the sandbox: exercise the affected code path and confirm the behaviour actually happens. A green test suite is not the bar. Do NOT wait for, or verify against, the PR's deploy preview \u2014 a reviewer checks that after you hand over.",'- A browser is installed globally, NOT in the repo\'s `node_modules` \u2014 don\'t go looking for playwright there. `qa-screenshot <url> <path>.png [--mobile] [--full] [--selector=<css>]` renders any URL (localhost included) in headless Chromium, runs the page\'s JS, and writes a file you must then `Read` \u2014 a screenshot you never opened is not verification. To INTERACT (click, fill, `document.elementFromPoint`), write a throwaway node script: `const { chromium } = require("/usr/local/lib/node_modules/playwright-core"); chromium.launch({ executablePath: "/usr/bin/chromium", args: ["--no-sandbox"] })`.',`- Open the ${X.changeRequest} from the branch you were given \u2014 the board finds it by that branch. Don't move the work to a differently-named one.`),J.push(`- If your change adds or edits pages a person can open, report their paths with \`mcp__studio__TASK_BOARD_ITEM_UPDATE\` (id "${$.id}", \`previewRoutes: ["/some-page"]\`) \u2014 paths only, no host. The card joins them onto the deploy preview so a reviewer opens the page directly. Skip it when the change has no visible route.`,'- If the task turns out to need no code change, do NOT open a PR: explain why in a comment on the task (`mcp__studio__TASK_BOARD_COMMENT_CREATE`) and move it to "done". There is nothing for a reviewer to review, so leaving it for one would strand it.',`- Anything a reviewer should know (a decision you made, something you found and deliberately left alone, a question) goes on the task as a comment: \`mcp__studio__TASK_BOARD_COMMENT_CREATE\` with taskBoardItemId "${$.id}". Read what's already there first with \`mcp__studio__TASK_BOARD_COMMENT_LIST\` \u2014 a comment may be addressed to you.`,"",`(task id: ${$.id})`),J.join(`
+`).trimStart();return J.push("How to finish:","- Make the change, commit it, push the branch, and open a pull request"+(Q?.pr?" \u2014 or push to the existing one, per the instruction above.":"."),"- Change only what the task needs. Don't refactor around it.","- The change must be REACHABLE from the surface the task names: edit the component that route actually renders, not one that merely looks like the right place. A change nothing imports is the most common reason a task comes back rejected.","- Before handing over, VERIFY the task's outcome LOCALLY, in the sandbox: exercise the affected code path and confirm the behaviour actually happens. A green test suite is not the bar. Do NOT wait for, or verify against, the PR's deploy preview \u2014 a reviewer checks that after you hand over.",'- A browser is installed globally, NOT in the repo\'s `node_modules` \u2014 don\'t go looking for playwright there. `qa-screenshot <url> <path>.png [--mobile] [--full] [--selector=<css>]` renders any URL (localhost included) in headless Chromium, runs the page\'s JS, and writes a file you must then `Read` \u2014 a screenshot you never opened is not verification. Write screenshots under `org/output/` and EMBED them in your task comment as markdown images, `![home](org/output/qa/home.png)` \u2014 only that form renders on the card; a bare path or a code span shows the reader nothing. To INTERACT (click, fill, `document.elementFromPoint`), write a throwaway node script: `const { chromium } = require("/usr/local/lib/node_modules/playwright-core"); chromium.launch({ executablePath: "/usr/bin/chromium", args: ["--no-sandbox"] })`.',`- Open the ${X.changeRequest} from the branch you were given \u2014 the board finds it by that branch. Don't move the work to a differently-named one.`),J.push(`- If your change adds or edits pages a person can open, report their paths with \`mcp__studio__TASK_BOARD_ITEM_UPDATE\` (id "${$.id}", \`previewRoutes: ["/some-page"]\`) \u2014 paths only, no host. The card joins them onto the deploy preview so a reviewer opens the page directly. Skip it when the change has no visible route.`,'- If the task turns out to need no code change, do NOT open a PR: explain why in a comment on the task (`mcp__studio__TASK_BOARD_COMMENT_CREATE`) and move it to "done". There is nothing for a reviewer to review, so leaving it for one would strand it.',`- Anything a reviewer should know (a decision you made, something you found and deliberately left alone, a question) goes on the task as a comment: \`mcp__studio__TASK_BOARD_COMMENT_CREATE\` with taskBoardItemId "${$.id}". Read what's already there first with \`mcp__studio__TASK_BOARD_COMMENT_LIST\` \u2014 a comment may be addressed to you.`,"",`(task id: ${$.id})`),J.join(`
 `)}var mP6;var $B1=L(()=>{U80();A6();x4();H$();eN1();mP6='Each checkout is authenticated for ITS OWN host: use `gh` inside a GitHub repository and `glab` inside a GitLab one (`glab mr create` is the counterpart of `gh pr create`). Bitbucket has no CLI: inside a Bitbucket repository open pull requests through the Studio tools or the REST API with `curl -H "Authorization: Bearer $BITBUCKET_TOKEN"` against api.bitbucket.org. A run can hold several at once, so pick the one that matches the repository '+"you are standing in \u2014 check its remote with `git remote get-url origin` if "+"you are unsure."});import{createHmac as dP6,timingSafeEqual as iP6}from"crypto";function ZB1($,Z,Q){return`rtok_${dP6("sha256",rk0()).update(`${$}:${Z}:${Q.toISOString()}`).digest("base64url")}`}function Ve$($,Z,Q,X){let Y=Buffer.from($),J=Buffer.from(ZB1(Z,Q,X));return Y.length===J.length&&iP6(Y,J)}var QB1=L(()=>{DN1()});import{createHash as pP6}from"crypto";function d40($,Z){if($.status===null||ke$.has($.status))return!1;return!C40({updated_at:$.lastActiveAt,last_progress_at:null},Z)}function XB1($,Z){return $.threads.some((Q)=>!tK.some((X)=>NE(Q.title,X))&&d40(Q,Z))}function oP6($,Z){return Z-$>=tP6}function aP6($,Z,Q,X){if($||Z!==!1)return!1;return oP6(Q,X)}async function Yp($,Z,Q){let X=await $.storage.organizationSettings.get(Z.organizationId),Y=Q?.kinds??lL(X?.flags);if(Y.length===0)return[];if(XB1(Z,Date.now()))return[];let J=cQ(X?.flags,"cheap_reviewer_model")?"reviewer":"default",G=await $.storage.taskBoard.listActivity(Z.id,Z.organizationId),K=Z.reviewCycleStartedAt,W=cL(G,K),H=new Date(W),F=BE(G,{cycleStartedAt:K}),U=[];return await Promise.all(Y.map(async(N)=>{let B=F.has(N);if(!B){let w=XT6(G,W),j=QT6(Z,N,W,w);if(j){await KT6($,Z,N,j).catch((E)=>console.error(`[task-board] ${N} verdict nudge failed`,E));return}if(JT6(w,Date.now()))return}if($T6(Z,N,W,Date.now(),B)){await EN($,Z,`${sU[N]} failed ${YB1} times on `+"this review \u2014 it will not be retried");return}if(Q?.previewMatchesHead===!1){if(aP6(B,Q.previewMatchesHead,W,Date.now()))await EN($,Z,"the pull request's deploy preview is not showing its latest commit (its checks never went green), so the Reviewer cannot verify this change against what the PR actually does");return}if(ZT6(Z,N,W,Date.now(),B))return;let O=rP6(Z,N,W,Date.now(),B);if(await FT6($,Z,N,H,O,J).catch((w)=>{return console.error(`[task-board] ${N} reviewer enqueue failed`,w),!1}))U.push(N)})),U}function rP6($,Z,Q,X=Date.now(),Y=!0){return $.threads.filter((J)=>NE(J.title,Z)&&JB1(J,X,Y)&&new Date(J.createdAt).getTime()>=Q).length}function sP6($,Z){if(!$||!Z||!("choices"in Z))return null;return Z.choices.find((Q)=>Q.repo===$)?.id??null}function eP6($,Z,Q){let X=$.threads.filter((Y)=>NE(Y.title,Z)&&Y.status==="completed"&&new Date(Y.createdAt).getTime()<Q).map((Y)=>new Date(Y.lastActiveAt).getTime()).filter((Y)=>Number.isFinite(Y));return X.length===0?0:Math.max(...X)}function JB1($,Z,Q=!0){if($.status==="failed")return!0;if($.status!==null&&ke$.has($.status))return!Q;return $.status!==null&&!d40($,Z)}function Se$($,Z,Q,X=Date.now()){return $.threads.filter((Y)=>{if(!NE(Y.title,Z))return!1;return d40(Y,X)||new Date(Y.createdAt).getTime()>=Q})}function $T6($,Z,Q,X=Date.now(),Y=!0){let J=Se$($,Z,Q,X);return J.length>0&&J.every((G)=>JB1(G,X,Y))&&J.length>=YB1}function ZT6($,Z,Q,X=Date.now(),Y=!0){let J=Se$($,Z,Q,X);if(J.length===0)return!1;if(J.some((K)=>d40(K,X)))return!0;let G=J.filter((K)=>JB1(K,X,Y));if(G.length>=YB1)return!0;return G.length!==J.length}function QT6($,Z,Q,X,Y=Date.now()){return $.threads.find((J)=>NE(J.title,Z)&&J.status==="completed"&&!d40(J,Y)&&new Date(J.createdAt).getTime()>=Q&&!X.has(J.threadId))??null}function XT6($,Z){let Q=new Map;for(let X of $){if(X.action!=="review_verdict_requested")continue;let Y=new Date(X.occurredAt).getTime();if(Y<Z)continue;let J=X.data?.threadId;if(typeof J==="string")Q.set(J,Y)}return Q}function JT6($,Z){for(let Q of $.values())if(Z-Q<YT6)return!0;return!1}function GT6($){return[`Your ${sU[$]} run ended without recording a decision, so the task is stuck: nothing ships and nobody is told why. A review that reaches no verdict is not a review.`,"","Do exactly ONE thing in this run and then stop:","- Call `TASK_BOARD_REVIEW_DECISION` now, with the verdict your review already reached and notes that say what you checked.","- Approve ONLY if you actually exercised the change and it holds. If you could not finish \u2014 a check never came back, a preview never rendered, you ran out of room \u2014 `request_changes` and say exactly what is unresolved. That hands the card to a person, which is the correct outcome for an unfinished review.","- Do NOT re-run the review, do NOT change any code, and do NOT wait on any background task: whatever you know right now is the verdict."].join(`
 `)}async function KT6($,Z,Q,X){let Y=await $.storage.threads.get(X.threadId);if(!Y||Y.message_storage_version!==2)return;await $.storage.taskBoard.recordActivity({taskBoardItemId:Z.id,action:"review_verdict_requested",actorId:null,data:{reviewer:Q,threadId:X.threadId}}),console.warn(`[task-board] ${Q} reviewer on ${Z.id} completed with no verdict \u2014 `+"asking for one"),await si($,Z,Y,{messageId:`review-verdict-${X.threadId}`,prompt:GT6(Q),workflowID:`review-verdict:${X.threadId}`,runClass:"reviewer"})}function WT6($,Z,Q,X){return`review:${$}:${Z}:${Q.toISOString()}:${X}`}function HT6($){return`thrd_${pP6("sha256").update($).digest("hex").slice(0,32)}`}async function FT6($,Z,Q,X,Y,J){let G=Z.organizationId,K=ZB1(Z.id,Q,X),W=await MS0($,G,{repositoryId:Z.repositoryId,repo:Z.repo}),H=W&&"repo"in W?W.repo:null,F=W!==null,U=eP6(Z,Q,X.getTime()),N=sP6(Z.repo,W),B=F?"mcp__studio__TASK_BOARD_ITEM_PRS_GET":"TASK_BOARD_ITEM_PRS_GET",O=F?"mcp__studio__TASK_BOARD_REVIEW_DECISION":"TASK_BOARD_REVIEW_DECISION",D=F?"mcp__studio__TASK_BOARD_COMMENT_CREATE":"TASK_BOARD_COMMENT_CREATE",w=F?"mcp__studio__TASK_BOARD_COMMENT_LIST":"TASK_BOARD_COMMENT_LIST",j=[nP6[Q],"","You are running AUTONOMOUSLY \u2014 no human is watching this run. Making the "+'approve / request-changes call IS your job; you are the decision-maker, not an assistant asking a human to decide. NEVER use `user_ask` to ask whether to approve, or to confirm an obvious call ("Approve the PR?"). Reserve `user_ask` for a genuine, unresolvable blocker only a human can clear (e.g. a missing credential, or a requirement so ambiguous you '+"truly cannot judge the outcome) \u2014 that should be rare. When in doubt "+"between asking and deciding, DECIDE.","","Do NOT merge the pull request \u2014 the board does that itself once your "+"approval is in. Pushing fixes to the PR's own branch is expected of you; opening a second pull request, force-pushing, or touching any other ref is not."].join(`
 `),E=Z.description&&F?AS0(Z.description):Z.description,z=Z.description&&E?RS0(Z.description,E):null,A=[...F?[]:[j,""],`Task title: ${Z.title}`,E?`