decocms 4.427.2 → 4.427.3

package/dist/server/cli.js

@@ -2178,7 +2178,7 @@ Usage: deco services <up|down|status>`),process.exit(1)}}var wZ$=L(()=>{uu()});f
       `.execute($);if(Number(K.rows[0]?.cnt)===0){console.warn(`Failed to migrate ${G}/${W}, keeping in old table`);continue}}await Bc`
       DELETE FROM kysely_migration WHERE name = ${Q}
     `.execute($)}}async function JG$($){await JO4($),await GO4($);let Z=new XG$({db:$,provider:{getMigrations:()=>Promise.resolve(d81)}}),{error:Q,results:X}=await Z.migrateToLatest(),Y=0;if(X?.forEach((J)=>{if(J.status==="Success")Y++;else if(J.status==="Error")console.error(`Failed to execute migration "${J.migrationName}"`)}),Q)throw console.error("Failed to migrate"),console.error(Q),Q;return Y}async function WO4($){let{keepOpen:Z=!1,database:Q,skipBetterAuth:X=!1}=$??{},Y="skipped";if(!X&&!Q)Y=await ps0();let J=Q??Z8(),G=async()=>{if(!Z&&!Q)await vj(J).catch((W)=>{console.warn("Warning: Error closing database:",W)})};try{let W=await JG$(J.db);return await G(),{betterAuth:Y,kysely:W}}catch(W){throw await G(),W}}async function KO4(){let $=Z8(),Z=new XG$({db:$.db,provider:{getMigrations:()=>Promise.resolve(d81)}}),{error:Q,results:X}=await Z.migrateDown();if(X?.forEach((Y)=>{if(Y.status==="Success")console.log(`\u2705 Migration "${Y.migrationName}" rolled back successfully`);else if(Y.status==="Error")console.error(`\u274C Failed to rollback migration "${Y.migrationName}"`)}),Q)throw console.error("Failed to rollback migration"),console.error(Q),Q}var WG$=L(()=>{QG$();ns0();bQ()});async function WK0($){let Z={...process.env},Q=oQ0($,Z);console.log(z_1(Q.settings.encryptionKey));let X=Q.settings.betterAuthSecret||(Q.settings.localMode?r7$(Q.settings.dataDir):""),{ensureServices:Y}=await Promise.resolve().then(() => (WW0(),GW0)),{outputs:J,services:G}=await Y({home:Q.settings.dataDir,externalDatabaseUrl:Q.externalDatabaseUrl,externalNatsUrl:Q.externalNatsUrl});if(!Q.skipMigrations){let{migrateBetterAuth:K}=await Promise.resolve().then(() => (ns0(),s7$));await K(J.databaseUrl);let{createDatabase:H}=await Promise.resolve().then(() => (bQ(),L7$)),{migrateToLatest:F}=await Promise.resolve().then(() => (WG$(),GG$)),U=H(J.databaseUrl);await F({keepOpen:!0,database:U,skipBetterAuth:!0})}let W={...Q.settings,betterAuthSecret:X,databaseUrl:J.databaseUrl,natsUrls:J.natsUrls,...J.s3?{s3Endpoint:J.s3.endpoint,s3Bucket:J.s3.bucket,s3AccessKeyId:J.s3.accessKeyId,s3SecretAccessKey:J.s3.secretAccessKey,s3ForcePathStyle:J.s3.forcePathStyle}:{}};return EZ$(W),{settings:W,services:G.map((K)=>({name:K.name==="PostgreSQL"?"Postgres":K.name,port:K.port})),managedServiceNames:G.filter((K)=>K.owner==="managed").map((K)=>K.name)}}var i81=L(()=>{uu();a7$();X$()});var UG$={};J0(UG$,{updateService:()=>YT,subscribeCliState:()=>t81,setTuiConsoleIntercepted:()=>KK0,setServerUrl:()=>zs,setMigrationsDone:()=>Es,setDevMode:()=>FO4,resetCliStateForTests:()=>HO4,isTuiConsoleIntercepted:()=>HK0,getCliState:()=>n81,addLogEntry:()=>hj});function KG$(){return[{name:"Postgres",status:"pending",port:0},{name:"NATS",status:"pending",port:0}]}function HG$(){return{services:KG$(),migrationsStatus:"pending",serverUrl:null,logs:[]}}function HO4(){CJ=HG$()}function ws(){for(let $ of p81)$()}function n81(){return CJ}function t81($){return p81.add($),()=>p81.delete($)}function YT($){CJ={...CJ,services:CJ.services.map((Z)=>Z.name===$.name?$:Z)},ws()}function Es(){CJ={...CJ,migrationsStatus:"done"},ws()}function zs($){CJ={...CJ,serverUrl:$},ws()}function hj($){let Z=[...CJ.logs,$];CJ={...CJ,logs:Z.length>500?Z.slice(-500):Z},ws()}function FO4(){CJ={...CJ,services:[...KG$(),{name:"API",status:"pending",port:0},{name:"Vite",status:"pending",port:0}]},ws()}function KK0($){FG$=$}function HK0(){return FG$}var CJ,p81,FG$=!1;var JT=L(()=>{CJ=HG$();p81=new Set});import{createServer as NG$}from"net";function UO4($){return new Promise((Z)=>{let Q=NG$();Q.once("error",()=>Z(!1)),Q.listen($,"0.0.0.0",()=>{Q.close(()=>Z(!0))})})}async function Ps($){if(await UO4($))return $;let Z=await new Promise((Q,X)=>{let Y=NG$();Y.once("error",X),Y.listen(0,"0.0.0.0",()=>{let J=Y.address(),G=typeof J==="object"&&J?J.port:0;Y.close(()=>Q(G))})});return console.warn(`Port ${$} is in use, using port ${Z} instead.`),Z}var o81=()=>{};var a81={};J0(a81,{startDevServer:()=>BO4,pipeToLogStore:()=>r81});import{join as NO4}from"path";function r81($){let Z=$.getReader(),Q=new TextDecoder,X="";function Y(){let J=X.split(`
-`);X=J.pop()??"";for(let G of J){let W=Bun.stripANSI(G).replace(/^\[\d+\]\s*/,"").trim();if(!W)continue;hj({method:"",path:"",status:0,duration:0,timestamp:new Date,rawLine:W})}}(async()=>{try{for(;;){let{done:J,value:G}=await Z.read();if(J)break;X+=Q.decode(G,{stream:!0}),Y()}}catch{}if(X.trim()){let J=Bun.stripANSI(X).replace(/^\[\d+\]\s*/,"").trim();if(J)hj({method:"",path:"",status:0,duration:0,timestamp:new Date,rawLine:J})}})()}async function BO4($){let{baseUrl:Z,noTui:Q}=$,X=process.env.HOST==="0.0.0.0"&&Boolean(process.env.PORT),Y=X?process.env.PORT:$.vitePort,J=Z||`http://localhost:${Y}`,G=X?await Ps(Number(Y)+1):await Ps(Number($.port)),{settings:W,services:K,managedServiceNames:H}=await WK0({port:String(G),home:$.home,baseUrl:$.baseUrl,localMode:$.localMode,skipMigrations:$.skipMigrations,noTui:$.noTui,vitePort:$.vitePort});for(let O of K)YT({name:O.name,status:"ready",port:O.port});Es();let F=NO4(import.meta.dir,"..","..","..","..",".."),U=Q===!0,N=Bun.spawn(["bun","run","dev:servers"],{cwd:F,env:{...process.env,PORT:String(W.port),VITE_PORT:String(Y),DATABASE_URL:W.databaseUrl,NATS_URL:W.natsUrls.join(","),NODE_ENV:W.nodeEnv,BASE_URL:J,DECOCMS_LOCAL_MODE:String(W.localMode),DECOCMS_HOME:W.dataDir,DATA_DIR:W.dataDir,DECO_CLI:"1",...W.betterAuthSecret?{BETTER_AUTH_SECRET:W.betterAuthSecret}:{},...W.s3Endpoint?{S3_ENDPOINT:W.s3Endpoint,S3_BUCKET:W.s3Bucket??"",S3_ACCESS_KEY_ID:W.s3AccessKeyId??"",S3_SECRET_ACCESS_KEY:W.s3SecretAccessKey??"",S3_FORCE_PATH_STYLE:String(W.s3ForcePathStyle)}:{},...W.natsCredsPath?{NATS_CREDS:W.natsCredsPath}:{}},stdio:["inherit",U?"inherit":"pipe",U?"inherit":"pipe"]});if(!U)r81(N.stdout),r81(N.stderr);zs(J),YT({name:"Vite",status:"ready",port:Number(Y)}),YT({name:"API",status:"ready",port:Number(W.port)});let D=async(O)=>{if(N.kill(O),await N.exited,H.length>0){let{stopServices:j}=await Promise.resolve().then(() => (WW0(),GW0));await j(W.dataDir)}};return process.on("SIGINT",()=>D("SIGINT")),process.on("SIGTERM",()=>D("SIGTERM")),{port:Number(Y),process:N}}var s81=L(()=>{i81();JT();o81()});var FK0;var e81=L(()=>{FK0={name:"decocms",version:"4.427.2",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js","db:migrate:dbos":"bun run ./dist/server/migrate-dbos.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts","migrate:dbos":"bun run src/database/migrate-dbos.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^4.0.58","@ai-sdk/google":"^4.0.76","@ai-sdk/openai":"^4.0.71","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^3.1.0","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^4.0.17","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^7.0.107","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});import{Box as DO4,Text as BG$}from"ink";import{jsx as OO4,jsxs as LG$}from"react/jsx-runtime";function DG$({version:$}){return LG$(DO4,{flexDirection:"column",marginTop:1,children:[CW0.map((Z,Q)=>OO4(BG$,{color:SW0[Q],children:Z},Q)),LG$(BG$,{dimColor:!0,children:[" v",$]})]})}var OG$=L(()=>{Qs()});import{Box as GT,Text as uj}from"ink";import{Spinner as jO4}from"@inkjs/ui";import{jsx as aG,jsxs as Lc}from"react/jsx-runtime";function jG$({status:$}){if($==="pending")return aG(jO4,{label:""});return aG(uj,{color:"green",children:"\u2713"})}function wO4($){return`${$.name}: ${$.port||"...."}`}function wG$({services:$,migrationsStatus:Z,home:Q,serverUrl:X}){return Lc(GT,{flexDirection:"column",paddingBottom:1,children:[aG(DG$,{version:FK0.version}),aG(GT,{marginBottom:1,children:aG(uj,{dimColor:!0,children:"\u2500".repeat(80)})}),aG(GT,{children:Lc(uj,{dimColor:!0,children:["Home: ",Q]})}),Lc(GT,{gap:2,children:[$.map((Y)=>Lc(GT,{gap:1,children:[aG(uj,{children:wO4(Y)}),aG(jG$,{status:Y.status})]},Y.name)),Lc(GT,{gap:1,children:[aG(uj,{children:"Migrations"}),aG(jG$,{status:Z})]})]}),aG(GT,{children:X?Lc(uj,{children:["Open in browser: ",aG(uj,{color:"cyan",children:X})]}):aG(uj,{dimColor:!0,children:"Starting..."})})]})}var EG$=L(()=>{e81();OG$()});import{Box as EO4,Text as Ts}from"ink";import{jsx as $41,jsxs as Z41}from"react/jsx-runtime";function zO4($){if($>=500)return"red";if($>=400)return"yellow";if($>=300)return"cyan";return"green"}function zG$({logs:$}){return $41(EO4,{flexDirection:"column",children:$.map((Z,Q)=>{if(Z.rawLine)return $41(Ts,{dimColor:!0,children:Z.rawLine},Q);let X=Z.duration<1000?`${Z.duration}ms`:`${(Z.duration/1000).toFixed(1)}s`;return Z41(Ts,{children:[Z41(Ts,{dimColor:!0,children:[Z.method.padEnd(6)," ",Z.path.padEnd(30)," "]}),$41(Ts,{color:zO4(Z.status),children:Z.status}),Z41(Ts,{dimColor:!0,children:[" ",X.padStart(8)]})]},Q)})})}var PG$=()=>{};var Q41={};J0(Q41,{App:()=>AO4});import{Box as PO4}from"ink";import{useSyncExternalStore as TO4}from"react";import{jsx as TG$,jsxs as RO4}from"react/jsx-runtime";function AO4({home:$}){let Z=TO4(t81,n81);return RO4(PO4,{flexDirection:"column",children:[TG$(wG$,{services:Z.services,migrationsStatus:Z.migrationsStatus,home:$,serverUrl:Z.serverUrl}),TG$(zG$,{logs:Z.logs})]})}var X41=L(()=>{EG$();PG$();JT()});var CW="thread-gate",LL="decopilot-hosted-harness",DL="decopilot-hosted-harness-sandboxed",SW="automations",lj="background-tools",WT="task-board-github-reads";var AG$="13";function RG$($){return{name:"decocms",systemDatabaseUrl:$.systemDatabaseUrl,systemDatabaseSchemaName:"dbos",systemDatabasePoolSize:$.poolSize,runAdminServer:!1,executorID:$.executorID,applicationVersion:AG$,...$.listenQueues!==void 0?{listenQueues:$.listenQueues}:{}}}var qG$=()=>{};import qO4 from"pg";async function IG$($,Z){let{databaseUrl:Q,lockTimeoutMs:X=MO4}=$,Y=$.log??((K)=>console.log(K)),J=new qO4.Client({connectionString:Q});await J.connect();let G=Date.now(),W=!1;try{while(!W){if(W=(await J.query("SELECT pg_try_advisory_lock($1) AS locked",[MG$.toString()])).rows[0]?.locked===!0,W)break;if(Date.now()-G>=X)throw Error(`Timed out after ${X}ms waiting for the DBOS migration lock. Another process is still migrating the dbos schema; this pod will restart and retry.`);await $$(IO4)}let K=Date.now()-G;if(K>1000)Y(`[dbos] waited ${K}ms for the migration lock; another process migrated first`);return await Z()}finally{if(W)try{await J.query("SELECT pg_advisory_unlock($1)",[MG$.toString()])}catch{}await J.end().catch(()=>{})}}var MG$=8314027461559302n,MO4=600000,IO4=500;var VG$=L(()=>{$8()});function VO4(){let $=(process.env.BUN_OPTIONS??"").split(/\s+/).filter(Boolean);return[...process.argv.slice(1),...$]}function Y41($,Z){for(let Q=0;Q<$.length;Q++){let X=$[Q];if(X===void 0)continue;if(X===Z)return $[Q+1];if(X.startsWith(`${Z}=`))return X.slice(Z.length+1)}return}function kG$(){let $=VO4();if($.includes("--cpu-prof")){console.log(JSON.stringify({msg:"cpu-profiling-active",dir:Y41($,"--cpu-prof-dir")??process.cwd(),name:Y41($,"--cpu-prof-name"),markdown:$.includes("--cpu-prof-md"),intervalUs:Number(Y41($,"--cpu-prof-interval")??1000),note:"profile is written on process exit"}));return}if(process.env.CPU_PROFILE)console.warn(JSON.stringify({msg:"cpu-profiling-requested-but-inactive",hint:'CPU profiling is a Bun launch flag. Set BUN_OPTIONS="--cpu-prof --cpu-prof-md --cpu-prof-dir=/tmp" before starting the process.'}))}function CG$(){if(process.env.HEAP_WATCH!=="1")return()=>{};let $=Number(process.env.HEAP_WATCH_INTERVAL_MS??60000),Z=async()=>{let Q=$T();if(!Q)return;let X={};try{let{heapStats:Y}=await import("bun:jsc"),J=Y(),G=Object.entries(J.objectTypeCounts).sort((W,K)=>K[1]-W[1]).slice(0,20);X={objectCount:J.objectCount,heapSize:J.heapSize,top:Object.fromEntries(G)}}catch{}console.log(JSON.stringify({msg:"heap-watch",ts:new Date().toISOString(),uptimeS:Math.round(process.uptime()),rss:Q.rss,heapUsed:Q.heapUsed,heapTotal:Q.heapTotal,external:Q.external,arrayBuffers:Q.arrayBuffers,...X}))};return Z().catch(()=>{}),UK0=setInterval(()=>void Z().catch(()=>{}),$),UK0.unref?.(),process.on("SIGUSR2",()=>{try{let Q=Bun.generateHeapSnapshot("v8"),X=typeof Q==="string"?Q:JSON.stringify(Q),Y=`/tmp/heap-${process.pid}-${Date.now()}.heapsnapshot`;Bun.write(Y,X),console.log(JSON.stringify({msg:"heap-snapshot-written",path:Y}))}catch(Q){console.error("[heap-watch] snapshot failed:",Q)}}),()=>{if(UK0)clearInterval(UK0)}}var UK0;var SG$=()=>{};import*as kO4 from"bun:jsc";function _G$(){if(process.env.STALL_WATCHDOG!=="1")return()=>{};let $=Number(process.env.STALL_WATCHDOG_MS??100),Z=Number(process.env.STALL_WATCHDOG_TICK_MS??50);try{CO4()}catch(J){return console.error("[stall-watchdog] failed to start sampling profiler:",J),()=>{}}let Q,X=performance.now()+Z,Y=()=>{let J=performance.now(),G=J-X;X=J+Z;let W=[];try{W=SO4()?.traces??[]}catch{}if(G>$&&W.length>0){let K=new Map;for(let F of W){let U=F.frames.find((D)=>D.sourceURL&&!/Unknown Executable/.test(D.category??""))??F.frames[0];if(!U)continue;let N=(U.sourceURL??"?").replace(/^.*\/node_modules\//,"node_modules/"),B=`${U.name??"?"} @ ${N}:${U.line??"?"}`;K.set(B,(K.get(B)??0)+1)}let H=[...K.entries()].sort((F,U)=>U[1]-F[1]).slice(0,8).map(([F,U])=>({frame:F,count:U}));console.warn(JSON.stringify({msg:"stall-stack",ts:new Date().toISOString(),lagMs:Math.round(G),samplesInWindow:W.length,top:H}))}Q=setTimeout(Y,Z),Q.unref?.()};return Q=setTimeout(Y,Z),Q.unref?.(),()=>{if(Q)clearTimeout(Q)}}var CO4,SO4;var vG$=L(()=>{({startSamplingProfiler:CO4,samplingProfilerStackTraces:SO4}=kO4)});function xG$(){kG$();let $=[CG$(),G7$(),_G$()];return()=>{for(let Z of $)Z()}}var fG$=L(()=>{gs0();SG$();vG$()});var KT=b((bG$)=>{Object.defineProperty(bG$,"__esModule",{value:!0});bG$.RepublishHeaders=bG$.DirectMsgHeaders=bG$.JsHeaders=bG$.AdvisoryKind=void 0;bG$.isOrderedPushConsumerOptions=_O4;bG$.isPullConsumer=vO4;bG$.isPushConsumer=xO4;bG$.isBoundPushConsumerOptions=fO4;function _O4($){if($&&typeof $==="object")return"name_prefix"in $||"deliver_subject_prefix"in $||"filter_subjects"in $||"filter_subject"in $||"deliver_policy"in $||"opt_start_seq"in $||"opt_start_time"in $||"replay_policy"in $||"inactive_threshold"in $||"headers_only"in $||"deliver_prefix"in $;return!1}function vO4($){return $.isPullConsumer()}function xO4($){return $.isPushConsumer()}function fO4($){if($&&typeof $==="object")return"deliver_subject"in $||"deliver_group"in $||"idle_heartbeat"in $;return!1}bG$.AdvisoryKind={API:"api_audit",StreamAction:"stream_action",ConsumerAction:"consumer_action",SnapshotCreate:"snapshot_create",SnapshotComplete:"snapshot_complete",RestoreCreate:"restore_create",RestoreComplete:"restore_complete",MaxDeliver:"max_deliver",Terminated:"terminated",Ack:"consumer_ack",StreamLeaderElected:"stream_leader_elected",StreamQuorumLost:"stream_quorum_lost",ConsumerLeaderElected:"consumer_leader_elected",ConsumerQuorumLost:"consumer_quorum_lost"};bG$.JsHeaders={StreamSourceHdr:"Nats-Stream-Source",LastConsumerSeqHdr:"Nats-Last-Consumer",LastStreamSeqHdr:"Nats-Last-Stream",ConsumerStalledHdr:"Nats-Consumer-Stalled",MessageSizeHdr:"Nats-Msg-Size",RollupHdr:"Nats-Rollup",RollupValueSubject:"sub",RollupValueAll:"all",PendingMessagesHdr:"Nats-Pending-Messages",PendingBytesHdr:"Nats-Pending-Bytes",RequiredApiLevel:"Nats-Required-Api-Level"};bG$.DirectMsgHeaders={Stream:"Nats-Stream",Sequence:"Nats-Sequence",TimeStamp:"Nats-Time-Stamp",Subject:"Nats-Subject",LastSequence:"Nats-Last-Sequence",NumPending:"Nats-Num-Pending"};bG$.RepublishHeaders={Stream:"Nats-Stream",Subject:"Nats-Subject",Sequence:"Nats-Sequence",LastSequence:"Nats-Last-Sequence",Size:"Nats-Msg-Size"}});var sG=b((gG$)=>{Object.defineProperty(gG$,"__esModule",{value:!0});gG$.TD=gG$.TE=gG$.Empty=void 0;gG$.encode=dO4;gG$.decode=iO4;gG$.Empty=new Uint8Array(0);gG$.TE=new TextEncoder;gG$.TD=new TextDecoder;function mO4(...$){let Z=0;for(let Y=0;Y<$.length;Y++)Z+=$[Y].length;let Q=new Uint8Array(Z),X=0;for(let Y=0;Y<$.length;Y++)Q.set($[Y],X),X+=$[Y].length;return Q}function dO4(...$){let Z=[];for(let Q=0;Q<$.length;Q++)Z.push(gG$.TE.encode($[Q]));if(Z.length===0)return gG$.Empty;if(Z.length===1)return Z[0];return mO4(...Z)}function iO4($){if(!$||$.length===0)return"";return gG$.TD.decode($)}});var eG=b((lG$)=>{Object.defineProperty(lG$,"__esModule",{value:!0});lG$.errors=lG$.PermissionViolationError=lG$.NoRespondersError=lG$.TimeoutError=lG$.RequestError=lG$.ProtocolError=lG$.ConnectionError=lG$.DrainingConnectionError=lG$.ClosedConnectionError=lG$.AuthorizationError=lG$.UserAuthenticationExpiredError=lG$.InvalidOperationError=lG$.InvalidArgumentError=lG$.InvalidSubjectError=void 0;class G41 extends Error{constructor($,Z){super(`illegal subject: '${$}'`,Z);this.name="InvalidSubjectError"}}lG$.InvalidSubjectError=G41;class NK0 extends Error{constructor($,Z){super($,Z);this.name="InvalidArgumentError"}static format($,Z,Q){if(Array.isArray(Z)&&Z.length>1)Z=Z[0];if(Array.isArray($))$=$.map((X)=>`'${X}'`),$=$.join(",");else $=`'${$}'`;return new NK0(`${$} ${Z}`,Q)}}lG$.InvalidArgumentError=NK0;class W41 extends Error{constructor($,Z){super($,Z);this.name="InvalidOperationError"}}lG$.InvalidOperationError=W41;class BK0 extends Error{constructor($,Z){super($,Z);this.name="UserAuthenticationExpiredError"}static parse($){if($.toLowerCase().indexOf("user authentication expired")!==-1)return new BK0($);return null}}lG$.UserAuthenticationExpiredError=BK0;class LK0 extends Error{constructor($,Z){super($,Z);this.name="AuthorizationError"}static parse($){let Z=["authorization violation","account authentication expired","authentication timeout"],Q=$.toLowerCase();for(let X=0;X<Z.length;X++)if(Q.indexOf(Z[X])!==-1)return new LK0($);return null}}lG$.AuthorizationError=LK0;class K41 extends Error{constructor(){super("closed connection");this.name="ClosedConnectionError"}}lG$.ClosedConnectionError=K41;class H41 extends Error{constructor(){super("connection draining");this.name="DrainingConnectionError"}}lG$.DrainingConnectionError=H41;class F41 extends Error{constructor($,Z){super($,Z);this.name="ConnectionError"}}lG$.ConnectionError=F41;class U41 extends Error{constructor($,Z){super($,Z);this.name="ProtocolError"}}lG$.ProtocolError=U41;class N41 extends Error{constructor($="",Z){super($,Z);this.name="RequestError"}isNoResponders(){return this.cause instanceof DK0}}lG$.RequestError=N41;class B41 extends Error{constructor($){super("timeout",$);this.name="TimeoutError"}}lG$.TimeoutError=B41;class DK0 extends Error{subject;constructor($,Z){super(`no responders: '${$}'`,Z);this.subject=$,this.name="NoResponders"}}lG$.NoRespondersError=DK0;class OK0 extends Error{operation;subject;queue;constructor($,Z,Q,X,Y){super($,Y);this.name="PermissionViolationError",this.operation=Z,this.subject=Q,this.queue=X}static parse($){if(($?$.toLowerCase():"").indexOf("permissions violation")===-1)return null;let Q="publish",X="",Y=void 0,J=$.match(/(Publish|Subscription) to "(\S+)"/);if(J){if(Q=J[1].toLowerCase(),X=J[2],Q==="subscription"){let G=$.match(/using queue "(\S+)"/);if(G)Y=G[1]}}return new OK0($,Q,X,Y)}}lG$.PermissionViolationError=OK0;lG$.errors={AuthorizationError:LK0,ClosedConnectionError:K41,ConnectionError:F41,DrainingConnectionError:H41,InvalidArgumentError:NK0,InvalidOperationError:W41,InvalidSubjectError:G41,NoRespondersError:DK0,PermissionViolationError:OK0,ProtocolError:U41,RequestError:N41,TimeoutError:B41,UserAuthenticationExpiredError:BK0}});var DH=b((pG$)=>{Object.defineProperty(pG$,"__esModule",{value:!0});pG$.SimpleMutex=pG$.Perf=void 0;pG$.extend=Kj4;pG$.render=Hj4;pG$.timeout=Fj4;pG$.delay=Uj4;pG$.deadline=Nj4;pG$.deferred=D41;pG$.debugDeferred=Bj4;pG$.shuffle=Lj4;pG$.collect=Dj4;pG$.jitter=iG$;pG$.backoff=Oj4;pG$.nanos=jj4;pG$.millis=wj4;pG$.randomToken=Pj4;var Wj4=sG(),L41=eG();function Kj4($,...Z){for(let Q=0;Q<Z.length;Q++){let X=Z[Q];Object.keys(X).forEach(function(Y){$[Y]=X[Y]})}return $}function Hj4($){return Wj4.TD.decode($).replace(/\n/g,"\u240A").replace(/\r/g,"\u240D")}function Fj4($,Z=!0){let Q=Z?new L41.TimeoutError:null,X,Y,J=new Promise((G,W)=>{X={cancel:()=>{if(Y)clearTimeout(Y)}},Y=setTimeout(()=>{if(Q===null)W(new L41.TimeoutError);else W(Q)},$)});return Object.assign(J,X)}function Uj4($=0){let Z,Q=new Promise((X)=>{let Y=setTimeout(()=>{X()},$);Z={cancel:()=>{if(Y)clearTimeout(Y),X()}}});return Object.assign(Q,Z)}async function Nj4($,Z=1000){let Q=D41(),X=setTimeout(()=>{Q.reject(new L41.TimeoutError)},Z);try{return await Promise.race([$,Q])}finally{clearTimeout(X)}}function D41(){let $={},Z=new Promise((Q,X)=>{$={resolve:Q,reject:X}});return Object.assign(Z,$)}function Bj4(){let $={},Z=new Promise((Q,X)=>{$={resolve:(Y)=>{console.trace("resolve",Y),Q(Y)},reject:(Y)=>{console.trace("reject"),X(Y)}}});return Object.assign(Z,$)}function Lj4($){for(let Z=$.length-1;Z>0;Z--){let Q=Math.floor(Math.random()*(Z+1));[$[Z],$[Q]]=[$[Q],$[Z]]}return $}async function Dj4($){let Z=[];for await(let Q of $)Z.push(Q);return Z}class mG${timers;measures;constructor(){this.timers=new Map,this.measures=new Map}mark($){this.timers.set($,performance.now())}measure($,Z,Q){let X=this.timers.get(Z);if(X===void 0)throw Error(`${Z} is not defined`);let Y=this.timers.get(Q);if(Y===void 0)throw Error(`${Q} is not defined`);this.measures.set($,Y-X)}getEntries(){let $=[];return this.measures.forEach((Z,Q)=>{$.push({name:Q,duration:Z})}),$}}pG$.Perf=mG$;class dG${max;current;waiting;constructor($=1){this.max=$,this.current=0,this.waiting=[]}lock(){if(this.current++,this.current<=this.max)return Promise.resolve();let $=D41();return this.waiting.push($),$}unlock(){this.current--,this.waiting.pop()?.resolve()}}pG$.SimpleMutex=dG$;function iG$($){if($===0)return 0;return Math.floor($/2+Math.random()*$)}function Oj4($=[0,250,250,500,500,3000,5000]){if(!Array.isArray($))$=[0,250,250,500,500,3000,5000];let Z=$.length-1;return{backoff(Q){return iG$(Q>Z?$[Z]:$[Q])}}}function jj4($){return $*1e6}function wj4($){return Math.floor($/1e6)}var Ej4="0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz",OL=new Uint8Array(62);for(let $=0;$<62;$++)OL[$]=Ej4.charCodeAt($);var zj4=218340105584896;function Pj4(){let $=Math.floor(Math.random()*zj4),Z=$%62,Q=OL[Z];$=($-Z)/62,Z=$%62;let X=OL[Z];$=($-Z)/62,Z=$%62;let Y=OL[Z];$=($-Z)/62,Z=$%62;let J=OL[Z];$=($-Z)/62,Z=$%62;let G=OL[Z];$=($-Z)/62,Z=$%62;let W=OL[Z];$=($-Z)/62,Z=$%62;let K=OL[Z];$=($-Z)/62;let H=OL[$];return String.fromCharCode(Q,X,Y,J,G,W,K,H)}});var $3$=b((sG$)=>{Object.defineProperty(sG$,"__esModule",{value:!0});sG$.nuid=sG$.NuidImpl=void 0;var yj4="0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz",cj=62,wK0=12,rG$=10,tG$=33,gj4=333,oG$=wK0+rG$,j41=new Uint8Array(cj);for(let $=0;$<cj;$++)j41[$]=yj4.charCodeAt($);var jK0=4294967296,aG$=BigInt(cj)**BigInt(rG$),As=Number(aG$/(1n<<32n)),O41=Number(aG$%(1n<<32n));function hj4($){for(let Z=0;Z<$.length;Z++)$[Z]=Math.floor(Math.random()*256)}function uj4($){if(globalThis?.crypto?.getRandomValues)globalThis.crypto.getRandomValues($);else hj4($)}class w41{buf;cbuf;seqHi;seqLo;inc;inited;constructor(){this.buf=new Uint8Array(oG$),this.cbuf=new Uint8Array(wK0),this.inited=!1}init(){this.inited=!0,this.setPre(),this.initSeqAndInc(),this.fillSeq()}initSeqAndInc(){let $=0;do this.seqHi=Math.floor(Math.random()*(As+1)),this.seqLo=Math.floor(Math.random()*jK0);while($++<8&&this.seqHi===As&&this.seqLo>=O41);if(this.seqHi===As&&this.seqLo>=O41)this.seqLo=0;this.inc=Math.random()*(gj4-tG$)+tG$|0}setPre(){uj4(this.cbuf);for(let $=0;$<wK0;$++)this.buf[$]=j41[this.cbuf[$]%cj]}fillSeq(){let $=this.seqHi,Z=this.seqLo;for(let Q=oG$-1;Q>=wK0;Q--){let X=Math.floor($/cj),J=($-X*cj)*jK0+Z,G=Math.floor(J/cj),W=J-G*cj;this.buf[Q]=j41[W],$=X,Z=G}}next(){if(!this.inited)this.init();if(this.seqLo+=this.inc,this.seqLo>=jK0)this.seqLo-=jK0,this.seqHi+=1;if(this.seqHi>As||this.seqHi===As&&this.seqLo>=O41)this.setPre(),this.initSeqAndInc();this.fillSeq();let $=this.buf;return String.fromCharCode($[0],$[1],$[2],$[3],$[4],$[5],$[6],$[7],$[8],$[9],$[10],$[11],$[12],$[13],$[14],$[15],$[16],$[17],$[18],$[19],$[20],$[21])}reset(){this.init()}}sG$.NuidImpl=w41;sG$.nuid=new w41});var Y3$=b((Q3$)=>{Object.defineProperty(Q3$,"__esModule",{value:!0});Q3$.nuid=Q3$.Nuid=void 0;var Z3$=$3$();Q3$.Nuid=Z3$.NuidImpl;Q3$.nuid=Z3$.nuid});var zK0=b((EK0)=>{Object.defineProperty(EK0,"__esModule",{value:!0});EK0.nuid=EK0.Nuid=void 0;var J3$=Y3$();Object.defineProperty(EK0,"Nuid",{enumerable:!0,get:function(){return J3$.Nuid}});Object.defineProperty(EK0,"nuid",{enumerable:!0,get:function(){return J3$.nuid}})});var mj=b((G3$)=>{Object.defineProperty(G3$,"__esModule",{value:!0});G3$.DEFAULT_HOST=G3$.DEFAULT_PORT=G3$.Match=void 0;G3$.syncIterator=pj4;G3$.createInbox=nj4;var dj4=zK0(),ij4=eG();G3$.Match={Exact:"exact",CanonicalMIME:"canonical",IgnoreCase:"insensitive"};function pj4($){let Z=$[Symbol.asyncIterator]();return{async next(){let Q=await Z.next();if(Q.done)return Promise.resolve(null);return Promise.resolve(Q.value)}}}function nj4($=""){if($=$||"_INBOX",typeof $!=="string")throw TypeError("prefix must be a string");return $.split(".").forEach((Z)=>{if(Z==="*"||Z===">")throw ij4.InvalidArgumentError.format("prefix",`cannot have wildcards ('${$}')`)}),`${$}.${dj4.nuid.next()}`}G3$.DEFAULT_PORT=4222;G3$.DEFAULT_HOST="127.0.0.1"});var Rs=b((F3$)=>{Object.defineProperty(F3$,"__esModule",{value:!0});F3$.DataBuffer=void 0;var K3$=sG();class H3${buffers;byteLength;constructor(){this.buffers=[],this.byteLength=0}static concat(...$){let Z=0;for(let Y=0;Y<$.length;Y++)Z+=$[Y].length;let Q=new Uint8Array(Z),X=0;for(let Y=0;Y<$.length;Y++)Q.set($[Y],X),X+=$[Y].length;return Q}static fromAscii($){if(!$)$="";return K3$.TE.encode($)}static toAscii($){return K3$.TD.decode($)}reset(){this.buffers.length=0,this.byteLength=0}pack(){if(this.buffers.length>1){let $=new Uint8Array(this.byteLength),Z=0;for(let Q=0;Q<this.buffers.length;Q++)$.set(this.buffers[Q],Z),Z+=this.buffers[Q].length;this.buffers.length=0,this.buffers.push($)}}shift(){if(this.buffers.length){let $=this.buffers.shift();if($)return this.byteLength-=$.length,$}return new Uint8Array(0)}drain($){if(this.buffers.length){this.pack();let Z=this.buffers.pop();if(Z){let Q=this.byteLength;if($===void 0||$>Q)$=Q;let X=Z.subarray(0,$);if(Q>$)this.buffers.push(Z.subarray($));return this.byteLength=Q-$,X}}return new Uint8Array(0)}fill($,...Z){if($)this.buffers.push($),this.byteLength+=$.length;for(let Q=0;Q<Z.length;Q++)if(Z[Q]&&Z[Q].length)this.buffers.push(Z[Q]),this.byteLength+=Z[Q].length}peek(){if(this.buffers.length)return this.pack(),this.buffers[0];return new Uint8Array(0)}size(){return this.byteLength}length(){return this.buffers.length}}F3$.DataBuffer=H3$});var HT=b((B3$)=>{Object.defineProperty(B3$,"__esModule",{value:!0});B3$.LF=B3$.CR=B3$.CRLF=B3$.CR_LF_LEN=B3$.CR_LF=void 0;B3$.setTransportFactory=Zw4;B3$.defaultPort=Qw4;B3$.getUrlParseFn=Xw4;B3$.newTransport=Yw4;B3$.getResolveFn=Jw4;B3$.protoLen=N3$;B3$.extractProtocolMessage=Gw4;var sj4=sG(),ej4=mj(),$w4=Rs(),$3;function Zw4($){$3=$}function Qw4(){return $3!==void 0&&$3.defaultPort!==void 0?$3.defaultPort:ej4.DEFAULT_PORT}function Xw4(){return $3!==void 0&&$3.urlParseFn?$3.urlParseFn:void 0}function Yw4(){if(!$3||typeof $3.factory!=="function")throw Error("transport fn is not set");return $3.factory()}function Jw4(){return $3!==void 0&&$3.dnsResolveFn?$3.dnsResolveFn:void 0}B3$.CR_LF=`\r
+`);X=J.pop()??"";for(let G of J){let W=Bun.stripANSI(G).replace(/^\[\d+\]\s*/,"").trim();if(!W)continue;hj({method:"",path:"",status:0,duration:0,timestamp:new Date,rawLine:W})}}(async()=>{try{for(;;){let{done:J,value:G}=await Z.read();if(J)break;X+=Q.decode(G,{stream:!0}),Y()}}catch{}if(X.trim()){let J=Bun.stripANSI(X).replace(/^\[\d+\]\s*/,"").trim();if(J)hj({method:"",path:"",status:0,duration:0,timestamp:new Date,rawLine:J})}})()}async function BO4($){let{baseUrl:Z,noTui:Q}=$,X=process.env.HOST==="0.0.0.0"&&Boolean(process.env.PORT),Y=X?process.env.PORT:$.vitePort,J=Z||`http://localhost:${Y}`,G=X?await Ps(Number(Y)+1):await Ps(Number($.port)),{settings:W,services:K,managedServiceNames:H}=await WK0({port:String(G),home:$.home,baseUrl:$.baseUrl,localMode:$.localMode,skipMigrations:$.skipMigrations,noTui:$.noTui,vitePort:$.vitePort});for(let O of K)YT({name:O.name,status:"ready",port:O.port});Es();let F=NO4(import.meta.dir,"..","..","..","..",".."),U=Q===!0,N=Bun.spawn(["bun","run","dev:servers"],{cwd:F,env:{...process.env,PORT:String(W.port),VITE_PORT:String(Y),DATABASE_URL:W.databaseUrl,NATS_URL:W.natsUrls.join(","),NODE_ENV:W.nodeEnv,BASE_URL:J,DECOCMS_LOCAL_MODE:String(W.localMode),DECOCMS_HOME:W.dataDir,DATA_DIR:W.dataDir,DECO_CLI:"1",...W.betterAuthSecret?{BETTER_AUTH_SECRET:W.betterAuthSecret}:{},...W.s3Endpoint?{S3_ENDPOINT:W.s3Endpoint,S3_BUCKET:W.s3Bucket??"",S3_ACCESS_KEY_ID:W.s3AccessKeyId??"",S3_SECRET_ACCESS_KEY:W.s3SecretAccessKey??"",S3_FORCE_PATH_STYLE:String(W.s3ForcePathStyle)}:{},...W.natsCredsPath?{NATS_CREDS:W.natsCredsPath}:{}},stdio:["inherit",U?"inherit":"pipe",U?"inherit":"pipe"]});if(!U)r81(N.stdout),r81(N.stderr);zs(J),YT({name:"Vite",status:"ready",port:Number(Y)}),YT({name:"API",status:"ready",port:Number(W.port)});let D=async(O)=>{if(N.kill(O),await N.exited,H.length>0){let{stopServices:j}=await Promise.resolve().then(() => (WW0(),GW0));await j(W.dataDir)}};return process.on("SIGINT",()=>D("SIGINT")),process.on("SIGTERM",()=>D("SIGTERM")),{port:Number(Y),process:N}}var s81=L(()=>{i81();JT();o81()});var FK0;var e81=L(()=>{FK0={name:"decocms",version:"4.427.3",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js","db:migrate:dbos":"bun run ./dist/server/migrate-dbos.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts","migrate:dbos":"bun run src/database/migrate-dbos.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^4.0.58","@ai-sdk/google":"^4.0.76","@ai-sdk/openai":"^4.0.71","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^3.1.0","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^4.0.17","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^7.0.107","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});import{Box as DO4,Text as BG$}from"ink";import{jsx as OO4,jsxs as LG$}from"react/jsx-runtime";function DG$({version:$}){return LG$(DO4,{flexDirection:"column",marginTop:1,children:[CW0.map((Z,Q)=>OO4(BG$,{color:SW0[Q],children:Z},Q)),LG$(BG$,{dimColor:!0,children:[" v",$]})]})}var OG$=L(()=>{Qs()});import{Box as GT,Text as uj}from"ink";import{Spinner as jO4}from"@inkjs/ui";import{jsx as aG,jsxs as Lc}from"react/jsx-runtime";function jG$({status:$}){if($==="pending")return aG(jO4,{label:""});return aG(uj,{color:"green",children:"\u2713"})}function wO4($){return`${$.name}: ${$.port||"...."}`}function wG$({services:$,migrationsStatus:Z,home:Q,serverUrl:X}){return Lc(GT,{flexDirection:"column",paddingBottom:1,children:[aG(DG$,{version:FK0.version}),aG(GT,{marginBottom:1,children:aG(uj,{dimColor:!0,children:"\u2500".repeat(80)})}),aG(GT,{children:Lc(uj,{dimColor:!0,children:["Home: ",Q]})}),Lc(GT,{gap:2,children:[$.map((Y)=>Lc(GT,{gap:1,children:[aG(uj,{children:wO4(Y)}),aG(jG$,{status:Y.status})]},Y.name)),Lc(GT,{gap:1,children:[aG(uj,{children:"Migrations"}),aG(jG$,{status:Z})]})]}),aG(GT,{children:X?Lc(uj,{children:["Open in browser: ",aG(uj,{color:"cyan",children:X})]}):aG(uj,{dimColor:!0,children:"Starting..."})})]})}var EG$=L(()=>{e81();OG$()});import{Box as EO4,Text as Ts}from"ink";import{jsx as $41,jsxs as Z41}from"react/jsx-runtime";function zO4($){if($>=500)return"red";if($>=400)return"yellow";if($>=300)return"cyan";return"green"}function zG$({logs:$}){return $41(EO4,{flexDirection:"column",children:$.map((Z,Q)=>{if(Z.rawLine)return $41(Ts,{dimColor:!0,children:Z.rawLine},Q);let X=Z.duration<1000?`${Z.duration}ms`:`${(Z.duration/1000).toFixed(1)}s`;return Z41(Ts,{children:[Z41(Ts,{dimColor:!0,children:[Z.method.padEnd(6)," ",Z.path.padEnd(30)," "]}),$41(Ts,{color:zO4(Z.status),children:Z.status}),Z41(Ts,{dimColor:!0,children:[" ",X.padStart(8)]})]},Q)})})}var PG$=()=>{};var Q41={};J0(Q41,{App:()=>AO4});import{Box as PO4}from"ink";import{useSyncExternalStore as TO4}from"react";import{jsx as TG$,jsxs as RO4}from"react/jsx-runtime";function AO4({home:$}){let Z=TO4(t81,n81);return RO4(PO4,{flexDirection:"column",children:[TG$(wG$,{services:Z.services,migrationsStatus:Z.migrationsStatus,home:$,serverUrl:Z.serverUrl}),TG$(zG$,{logs:Z.logs})]})}var X41=L(()=>{EG$();PG$();JT()});var CW="thread-gate",LL="decopilot-hosted-harness",DL="decopilot-hosted-harness-sandboxed",SW="automations",lj="background-tools",WT="task-board-github-reads";var AG$="13";function RG$($){return{name:"decocms",systemDatabaseUrl:$.systemDatabaseUrl,systemDatabaseSchemaName:"dbos",systemDatabasePoolSize:$.poolSize,runAdminServer:!1,executorID:$.executorID,applicationVersion:AG$,...$.listenQueues!==void 0?{listenQueues:$.listenQueues}:{}}}var qG$=()=>{};import qO4 from"pg";async function IG$($,Z){let{databaseUrl:Q,lockTimeoutMs:X=MO4}=$,Y=$.log??((K)=>console.log(K)),J=new qO4.Client({connectionString:Q});await J.connect();let G=Date.now(),W=!1;try{while(!W){if(W=(await J.query("SELECT pg_try_advisory_lock($1) AS locked",[MG$.toString()])).rows[0]?.locked===!0,W)break;if(Date.now()-G>=X)throw Error(`Timed out after ${X}ms waiting for the DBOS migration lock. Another process is still migrating the dbos schema; this pod will restart and retry.`);await $$(IO4)}let K=Date.now()-G;if(K>1000)Y(`[dbos] waited ${K}ms for the migration lock; another process migrated first`);return await Z()}finally{if(W)try{await J.query("SELECT pg_advisory_unlock($1)",[MG$.toString()])}catch{}await J.end().catch(()=>{})}}var MG$=8314027461559302n,MO4=600000,IO4=500;var VG$=L(()=>{$8()});function VO4(){let $=(process.env.BUN_OPTIONS??"").split(/\s+/).filter(Boolean);return[...process.argv.slice(1),...$]}function Y41($,Z){for(let Q=0;Q<$.length;Q++){let X=$[Q];if(X===void 0)continue;if(X===Z)return $[Q+1];if(X.startsWith(`${Z}=`))return X.slice(Z.length+1)}return}function kG$(){let $=VO4();if($.includes("--cpu-prof")){console.log(JSON.stringify({msg:"cpu-profiling-active",dir:Y41($,"--cpu-prof-dir")??process.cwd(),name:Y41($,"--cpu-prof-name"),markdown:$.includes("--cpu-prof-md"),intervalUs:Number(Y41($,"--cpu-prof-interval")??1000),note:"profile is written on process exit"}));return}if(process.env.CPU_PROFILE)console.warn(JSON.stringify({msg:"cpu-profiling-requested-but-inactive",hint:'CPU profiling is a Bun launch flag. Set BUN_OPTIONS="--cpu-prof --cpu-prof-md --cpu-prof-dir=/tmp" before starting the process.'}))}function CG$(){if(process.env.HEAP_WATCH!=="1")return()=>{};let $=Number(process.env.HEAP_WATCH_INTERVAL_MS??60000),Z=async()=>{let Q=$T();if(!Q)return;let X={};try{let{heapStats:Y}=await import("bun:jsc"),J=Y(),G=Object.entries(J.objectTypeCounts).sort((W,K)=>K[1]-W[1]).slice(0,20);X={objectCount:J.objectCount,heapSize:J.heapSize,top:Object.fromEntries(G)}}catch{}console.log(JSON.stringify({msg:"heap-watch",ts:new Date().toISOString(),uptimeS:Math.round(process.uptime()),rss:Q.rss,heapUsed:Q.heapUsed,heapTotal:Q.heapTotal,external:Q.external,arrayBuffers:Q.arrayBuffers,...X}))};return Z().catch(()=>{}),UK0=setInterval(()=>void Z().catch(()=>{}),$),UK0.unref?.(),process.on("SIGUSR2",()=>{try{let Q=Bun.generateHeapSnapshot("v8"),X=typeof Q==="string"?Q:JSON.stringify(Q),Y=`/tmp/heap-${process.pid}-${Date.now()}.heapsnapshot`;Bun.write(Y,X),console.log(JSON.stringify({msg:"heap-snapshot-written",path:Y}))}catch(Q){console.error("[heap-watch] snapshot failed:",Q)}}),()=>{if(UK0)clearInterval(UK0)}}var UK0;var SG$=()=>{};import*as kO4 from"bun:jsc";function _G$(){if(process.env.STALL_WATCHDOG!=="1")return()=>{};let $=Number(process.env.STALL_WATCHDOG_MS??100),Z=Number(process.env.STALL_WATCHDOG_TICK_MS??50);try{CO4()}catch(J){return console.error("[stall-watchdog] failed to start sampling profiler:",J),()=>{}}let Q,X=performance.now()+Z,Y=()=>{let J=performance.now(),G=J-X;X=J+Z;let W=[];try{W=SO4()?.traces??[]}catch{}if(G>$&&W.length>0){let K=new Map;for(let F of W){let U=F.frames.find((D)=>D.sourceURL&&!/Unknown Executable/.test(D.category??""))??F.frames[0];if(!U)continue;let N=(U.sourceURL??"?").replace(/^.*\/node_modules\//,"node_modules/"),B=`${U.name??"?"} @ ${N}:${U.line??"?"}`;K.set(B,(K.get(B)??0)+1)}let H=[...K.entries()].sort((F,U)=>U[1]-F[1]).slice(0,8).map(([F,U])=>({frame:F,count:U}));console.warn(JSON.stringify({msg:"stall-stack",ts:new Date().toISOString(),lagMs:Math.round(G),samplesInWindow:W.length,top:H}))}Q=setTimeout(Y,Z),Q.unref?.()};return Q=setTimeout(Y,Z),Q.unref?.(),()=>{if(Q)clearTimeout(Q)}}var CO4,SO4;var vG$=L(()=>{({startSamplingProfiler:CO4,samplingProfilerStackTraces:SO4}=kO4)});function xG$(){kG$();let $=[CG$(),G7$(),_G$()];return()=>{for(let Z of $)Z()}}var fG$=L(()=>{gs0();SG$();vG$()});var KT=b((bG$)=>{Object.defineProperty(bG$,"__esModule",{value:!0});bG$.RepublishHeaders=bG$.DirectMsgHeaders=bG$.JsHeaders=bG$.AdvisoryKind=void 0;bG$.isOrderedPushConsumerOptions=_O4;bG$.isPullConsumer=vO4;bG$.isPushConsumer=xO4;bG$.isBoundPushConsumerOptions=fO4;function _O4($){if($&&typeof $==="object")return"name_prefix"in $||"deliver_subject_prefix"in $||"filter_subjects"in $||"filter_subject"in $||"deliver_policy"in $||"opt_start_seq"in $||"opt_start_time"in $||"replay_policy"in $||"inactive_threshold"in $||"headers_only"in $||"deliver_prefix"in $;return!1}function vO4($){return $.isPullConsumer()}function xO4($){return $.isPushConsumer()}function fO4($){if($&&typeof $==="object")return"deliver_subject"in $||"deliver_group"in $||"idle_heartbeat"in $;return!1}bG$.AdvisoryKind={API:"api_audit",StreamAction:"stream_action",ConsumerAction:"consumer_action",SnapshotCreate:"snapshot_create",SnapshotComplete:"snapshot_complete",RestoreCreate:"restore_create",RestoreComplete:"restore_complete",MaxDeliver:"max_deliver",Terminated:"terminated",Ack:"consumer_ack",StreamLeaderElected:"stream_leader_elected",StreamQuorumLost:"stream_quorum_lost",ConsumerLeaderElected:"consumer_leader_elected",ConsumerQuorumLost:"consumer_quorum_lost"};bG$.JsHeaders={StreamSourceHdr:"Nats-Stream-Source",LastConsumerSeqHdr:"Nats-Last-Consumer",LastStreamSeqHdr:"Nats-Last-Stream",ConsumerStalledHdr:"Nats-Consumer-Stalled",MessageSizeHdr:"Nats-Msg-Size",RollupHdr:"Nats-Rollup",RollupValueSubject:"sub",RollupValueAll:"all",PendingMessagesHdr:"Nats-Pending-Messages",PendingBytesHdr:"Nats-Pending-Bytes",RequiredApiLevel:"Nats-Required-Api-Level"};bG$.DirectMsgHeaders={Stream:"Nats-Stream",Sequence:"Nats-Sequence",TimeStamp:"Nats-Time-Stamp",Subject:"Nats-Subject",LastSequence:"Nats-Last-Sequence",NumPending:"Nats-Num-Pending"};bG$.RepublishHeaders={Stream:"Nats-Stream",Subject:"Nats-Subject",Sequence:"Nats-Sequence",LastSequence:"Nats-Last-Sequence",Size:"Nats-Msg-Size"}});var sG=b((gG$)=>{Object.defineProperty(gG$,"__esModule",{value:!0});gG$.TD=gG$.TE=gG$.Empty=void 0;gG$.encode=dO4;gG$.decode=iO4;gG$.Empty=new Uint8Array(0);gG$.TE=new TextEncoder;gG$.TD=new TextDecoder;function mO4(...$){let Z=0;for(let Y=0;Y<$.length;Y++)Z+=$[Y].length;let Q=new Uint8Array(Z),X=0;for(let Y=0;Y<$.length;Y++)Q.set($[Y],X),X+=$[Y].length;return Q}function dO4(...$){let Z=[];for(let Q=0;Q<$.length;Q++)Z.push(gG$.TE.encode($[Q]));if(Z.length===0)return gG$.Empty;if(Z.length===1)return Z[0];return mO4(...Z)}function iO4($){if(!$||$.length===0)return"";return gG$.TD.decode($)}});var eG=b((lG$)=>{Object.defineProperty(lG$,"__esModule",{value:!0});lG$.errors=lG$.PermissionViolationError=lG$.NoRespondersError=lG$.TimeoutError=lG$.RequestError=lG$.ProtocolError=lG$.ConnectionError=lG$.DrainingConnectionError=lG$.ClosedConnectionError=lG$.AuthorizationError=lG$.UserAuthenticationExpiredError=lG$.InvalidOperationError=lG$.InvalidArgumentError=lG$.InvalidSubjectError=void 0;class G41 extends Error{constructor($,Z){super(`illegal subject: '${$}'`,Z);this.name="InvalidSubjectError"}}lG$.InvalidSubjectError=G41;class NK0 extends Error{constructor($,Z){super($,Z);this.name="InvalidArgumentError"}static format($,Z,Q){if(Array.isArray(Z)&&Z.length>1)Z=Z[0];if(Array.isArray($))$=$.map((X)=>`'${X}'`),$=$.join(",");else $=`'${$}'`;return new NK0(`${$} ${Z}`,Q)}}lG$.InvalidArgumentError=NK0;class W41 extends Error{constructor($,Z){super($,Z);this.name="InvalidOperationError"}}lG$.InvalidOperationError=W41;class BK0 extends Error{constructor($,Z){super($,Z);this.name="UserAuthenticationExpiredError"}static parse($){if($.toLowerCase().indexOf("user authentication expired")!==-1)return new BK0($);return null}}lG$.UserAuthenticationExpiredError=BK0;class LK0 extends Error{constructor($,Z){super($,Z);this.name="AuthorizationError"}static parse($){let Z=["authorization violation","account authentication expired","authentication timeout"],Q=$.toLowerCase();for(let X=0;X<Z.length;X++)if(Q.indexOf(Z[X])!==-1)return new LK0($);return null}}lG$.AuthorizationError=LK0;class K41 extends Error{constructor(){super("closed connection");this.name="ClosedConnectionError"}}lG$.ClosedConnectionError=K41;class H41 extends Error{constructor(){super("connection draining");this.name="DrainingConnectionError"}}lG$.DrainingConnectionError=H41;class F41 extends Error{constructor($,Z){super($,Z);this.name="ConnectionError"}}lG$.ConnectionError=F41;class U41 extends Error{constructor($,Z){super($,Z);this.name="ProtocolError"}}lG$.ProtocolError=U41;class N41 extends Error{constructor($="",Z){super($,Z);this.name="RequestError"}isNoResponders(){return this.cause instanceof DK0}}lG$.RequestError=N41;class B41 extends Error{constructor($){super("timeout",$);this.name="TimeoutError"}}lG$.TimeoutError=B41;class DK0 extends Error{subject;constructor($,Z){super(`no responders: '${$}'`,Z);this.subject=$,this.name="NoResponders"}}lG$.NoRespondersError=DK0;class OK0 extends Error{operation;subject;queue;constructor($,Z,Q,X,Y){super($,Y);this.name="PermissionViolationError",this.operation=Z,this.subject=Q,this.queue=X}static parse($){if(($?$.toLowerCase():"").indexOf("permissions violation")===-1)return null;let Q="publish",X="",Y=void 0,J=$.match(/(Publish|Subscription) to "(\S+)"/);if(J){if(Q=J[1].toLowerCase(),X=J[2],Q==="subscription"){let G=$.match(/using queue "(\S+)"/);if(G)Y=G[1]}}return new OK0($,Q,X,Y)}}lG$.PermissionViolationError=OK0;lG$.errors={AuthorizationError:LK0,ClosedConnectionError:K41,ConnectionError:F41,DrainingConnectionError:H41,InvalidArgumentError:NK0,InvalidOperationError:W41,InvalidSubjectError:G41,NoRespondersError:DK0,PermissionViolationError:OK0,ProtocolError:U41,RequestError:N41,TimeoutError:B41,UserAuthenticationExpiredError:BK0}});var DH=b((pG$)=>{Object.defineProperty(pG$,"__esModule",{value:!0});pG$.SimpleMutex=pG$.Perf=void 0;pG$.extend=Kj4;pG$.render=Hj4;pG$.timeout=Fj4;pG$.delay=Uj4;pG$.deadline=Nj4;pG$.deferred=D41;pG$.debugDeferred=Bj4;pG$.shuffle=Lj4;pG$.collect=Dj4;pG$.jitter=iG$;pG$.backoff=Oj4;pG$.nanos=jj4;pG$.millis=wj4;pG$.randomToken=Pj4;var Wj4=sG(),L41=eG();function Kj4($,...Z){for(let Q=0;Q<Z.length;Q++){let X=Z[Q];Object.keys(X).forEach(function(Y){$[Y]=X[Y]})}return $}function Hj4($){return Wj4.TD.decode($).replace(/\n/g,"\u240A").replace(/\r/g,"\u240D")}function Fj4($,Z=!0){let Q=Z?new L41.TimeoutError:null,X,Y,J=new Promise((G,W)=>{X={cancel:()=>{if(Y)clearTimeout(Y)}},Y=setTimeout(()=>{if(Q===null)W(new L41.TimeoutError);else W(Q)},$)});return Object.assign(J,X)}function Uj4($=0){let Z,Q=new Promise((X)=>{let Y=setTimeout(()=>{X()},$);Z={cancel:()=>{if(Y)clearTimeout(Y),X()}}});return Object.assign(Q,Z)}async function Nj4($,Z=1000){let Q=D41(),X=setTimeout(()=>{Q.reject(new L41.TimeoutError)},Z);try{return await Promise.race([$,Q])}finally{clearTimeout(X)}}function D41(){let $={},Z=new Promise((Q,X)=>{$={resolve:Q,reject:X}});return Object.assign(Z,$)}function Bj4(){let $={},Z=new Promise((Q,X)=>{$={resolve:(Y)=>{console.trace("resolve",Y),Q(Y)},reject:(Y)=>{console.trace("reject"),X(Y)}}});return Object.assign(Z,$)}function Lj4($){for(let Z=$.length-1;Z>0;Z--){let Q=Math.floor(Math.random()*(Z+1));[$[Z],$[Q]]=[$[Q],$[Z]]}return $}async function Dj4($){let Z=[];for await(let Q of $)Z.push(Q);return Z}class mG${timers;measures;constructor(){this.timers=new Map,this.measures=new Map}mark($){this.timers.set($,performance.now())}measure($,Z,Q){let X=this.timers.get(Z);if(X===void 0)throw Error(`${Z} is not defined`);let Y=this.timers.get(Q);if(Y===void 0)throw Error(`${Q} is not defined`);this.measures.set($,Y-X)}getEntries(){let $=[];return this.measures.forEach((Z,Q)=>{$.push({name:Q,duration:Z})}),$}}pG$.Perf=mG$;class dG${max;current;waiting;constructor($=1){this.max=$,this.current=0,this.waiting=[]}lock(){if(this.current++,this.current<=this.max)return Promise.resolve();let $=D41();return this.waiting.push($),$}unlock(){this.current--,this.waiting.pop()?.resolve()}}pG$.SimpleMutex=dG$;function iG$($){if($===0)return 0;return Math.floor($/2+Math.random()*$)}function Oj4($=[0,250,250,500,500,3000,5000]){if(!Array.isArray($))$=[0,250,250,500,500,3000,5000];let Z=$.length-1;return{backoff(Q){return iG$(Q>Z?$[Z]:$[Q])}}}function jj4($){return $*1e6}function wj4($){return Math.floor($/1e6)}var Ej4="0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz",OL=new Uint8Array(62);for(let $=0;$<62;$++)OL[$]=Ej4.charCodeAt($);var zj4=218340105584896;function Pj4(){let $=Math.floor(Math.random()*zj4),Z=$%62,Q=OL[Z];$=($-Z)/62,Z=$%62;let X=OL[Z];$=($-Z)/62,Z=$%62;let Y=OL[Z];$=($-Z)/62,Z=$%62;let J=OL[Z];$=($-Z)/62,Z=$%62;let G=OL[Z];$=($-Z)/62,Z=$%62;let W=OL[Z];$=($-Z)/62,Z=$%62;let K=OL[Z];$=($-Z)/62;let H=OL[$];return String.fromCharCode(Q,X,Y,J,G,W,K,H)}});var $3$=b((sG$)=>{Object.defineProperty(sG$,"__esModule",{value:!0});sG$.nuid=sG$.NuidImpl=void 0;var yj4="0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz",cj=62,wK0=12,rG$=10,tG$=33,gj4=333,oG$=wK0+rG$,j41=new Uint8Array(cj);for(let $=0;$<cj;$++)j41[$]=yj4.charCodeAt($);var jK0=4294967296,aG$=BigInt(cj)**BigInt(rG$),As=Number(aG$/(1n<<32n)),O41=Number(aG$%(1n<<32n));function hj4($){for(let Z=0;Z<$.length;Z++)$[Z]=Math.floor(Math.random()*256)}function uj4($){if(globalThis?.crypto?.getRandomValues)globalThis.crypto.getRandomValues($);else hj4($)}class w41{buf;cbuf;seqHi;seqLo;inc;inited;constructor(){this.buf=new Uint8Array(oG$),this.cbuf=new Uint8Array(wK0),this.inited=!1}init(){this.inited=!0,this.setPre(),this.initSeqAndInc(),this.fillSeq()}initSeqAndInc(){let $=0;do this.seqHi=Math.floor(Math.random()*(As+1)),this.seqLo=Math.floor(Math.random()*jK0);while($++<8&&this.seqHi===As&&this.seqLo>=O41);if(this.seqHi===As&&this.seqLo>=O41)this.seqLo=0;this.inc=Math.random()*(gj4-tG$)+tG$|0}setPre(){uj4(this.cbuf);for(let $=0;$<wK0;$++)this.buf[$]=j41[this.cbuf[$]%cj]}fillSeq(){let $=this.seqHi,Z=this.seqLo;for(let Q=oG$-1;Q>=wK0;Q--){let X=Math.floor($/cj),J=($-X*cj)*jK0+Z,G=Math.floor(J/cj),W=J-G*cj;this.buf[Q]=j41[W],$=X,Z=G}}next(){if(!this.inited)this.init();if(this.seqLo+=this.inc,this.seqLo>=jK0)this.seqLo-=jK0,this.seqHi+=1;if(this.seqHi>As||this.seqHi===As&&this.seqLo>=O41)this.setPre(),this.initSeqAndInc();this.fillSeq();let $=this.buf;return String.fromCharCode($[0],$[1],$[2],$[3],$[4],$[5],$[6],$[7],$[8],$[9],$[10],$[11],$[12],$[13],$[14],$[15],$[16],$[17],$[18],$[19],$[20],$[21])}reset(){this.init()}}sG$.NuidImpl=w41;sG$.nuid=new w41});var Y3$=b((Q3$)=>{Object.defineProperty(Q3$,"__esModule",{value:!0});Q3$.nuid=Q3$.Nuid=void 0;var Z3$=$3$();Q3$.Nuid=Z3$.NuidImpl;Q3$.nuid=Z3$.nuid});var zK0=b((EK0)=>{Object.defineProperty(EK0,"__esModule",{value:!0});EK0.nuid=EK0.Nuid=void 0;var J3$=Y3$();Object.defineProperty(EK0,"Nuid",{enumerable:!0,get:function(){return J3$.Nuid}});Object.defineProperty(EK0,"nuid",{enumerable:!0,get:function(){return J3$.nuid}})});var mj=b((G3$)=>{Object.defineProperty(G3$,"__esModule",{value:!0});G3$.DEFAULT_HOST=G3$.DEFAULT_PORT=G3$.Match=void 0;G3$.syncIterator=pj4;G3$.createInbox=nj4;var dj4=zK0(),ij4=eG();G3$.Match={Exact:"exact",CanonicalMIME:"canonical",IgnoreCase:"insensitive"};function pj4($){let Z=$[Symbol.asyncIterator]();return{async next(){let Q=await Z.next();if(Q.done)return Promise.resolve(null);return Promise.resolve(Q.value)}}}function nj4($=""){if($=$||"_INBOX",typeof $!=="string")throw TypeError("prefix must be a string");return $.split(".").forEach((Z)=>{if(Z==="*"||Z===">")throw ij4.InvalidArgumentError.format("prefix",`cannot have wildcards ('${$}')`)}),`${$}.${dj4.nuid.next()}`}G3$.DEFAULT_PORT=4222;G3$.DEFAULT_HOST="127.0.0.1"});var Rs=b((F3$)=>{Object.defineProperty(F3$,"__esModule",{value:!0});F3$.DataBuffer=void 0;var K3$=sG();class H3${buffers;byteLength;constructor(){this.buffers=[],this.byteLength=0}static concat(...$){let Z=0;for(let Y=0;Y<$.length;Y++)Z+=$[Y].length;let Q=new Uint8Array(Z),X=0;for(let Y=0;Y<$.length;Y++)Q.set($[Y],X),X+=$[Y].length;return Q}static fromAscii($){if(!$)$="";return K3$.TE.encode($)}static toAscii($){return K3$.TD.decode($)}reset(){this.buffers.length=0,this.byteLength=0}pack(){if(this.buffers.length>1){let $=new Uint8Array(this.byteLength),Z=0;for(let Q=0;Q<this.buffers.length;Q++)$.set(this.buffers[Q],Z),Z+=this.buffers[Q].length;this.buffers.length=0,this.buffers.push($)}}shift(){if(this.buffers.length){let $=this.buffers.shift();if($)return this.byteLength-=$.length,$}return new Uint8Array(0)}drain($){if(this.buffers.length){this.pack();let Z=this.buffers.pop();if(Z){let Q=this.byteLength;if($===void 0||$>Q)$=Q;let X=Z.subarray(0,$);if(Q>$)this.buffers.push(Z.subarray($));return this.byteLength=Q-$,X}}return new Uint8Array(0)}fill($,...Z){if($)this.buffers.push($),this.byteLength+=$.length;for(let Q=0;Q<Z.length;Q++)if(Z[Q]&&Z[Q].length)this.buffers.push(Z[Q]),this.byteLength+=Z[Q].length}peek(){if(this.buffers.length)return this.pack(),this.buffers[0];return new Uint8Array(0)}size(){return this.byteLength}length(){return this.buffers.length}}F3$.DataBuffer=H3$});var HT=b((B3$)=>{Object.defineProperty(B3$,"__esModule",{value:!0});B3$.LF=B3$.CR=B3$.CRLF=B3$.CR_LF_LEN=B3$.CR_LF=void 0;B3$.setTransportFactory=Zw4;B3$.defaultPort=Qw4;B3$.getUrlParseFn=Xw4;B3$.newTransport=Yw4;B3$.getResolveFn=Jw4;B3$.protoLen=N3$;B3$.extractProtocolMessage=Gw4;var sj4=sG(),ej4=mj(),$w4=Rs(),$3;function Zw4($){$3=$}function Qw4(){return $3!==void 0&&$3.defaultPort!==void 0?$3.defaultPort:ej4.DEFAULT_PORT}function Xw4(){return $3!==void 0&&$3.urlParseFn?$3.urlParseFn:void 0}function Yw4(){if(!$3||typeof $3.factory!=="function")throw Error("transport fn is not set");return $3.factory()}function Jw4(){return $3!==void 0&&$3.dnsResolveFn?$3.dnsResolveFn:void 0}B3$.CR_LF=`\r
 `;B3$.CR_LF_LEN=B3$.CR_LF.length;B3$.CRLF=$w4.DataBuffer.fromAscii(B3$.CR_LF);B3$.CR=new Uint8Array(B3$.CRLF)[0];B3$.LF=new Uint8Array(B3$.CRLF)[1];function N3$($){for(let Z=0;Z<$.length;Z++){let Q=Z+1;if($.byteLength>Q&&$[Z]===B3$.CR&&$[Q]===B3$.LF)return Q+1}return 0}function Gw4($){let Z=N3$($);if(Z>0){let X=new Uint8Array($).slice(0,Z);return sj4.TD.decode(X)}return""}});var A41=b((P3$)=>{Object.defineProperty(P3$,"__esModule",{value:!0});P3$.ipV4=w3$;P3$.isIP=jw4;P3$.parseIP=E3$;var qs=4,FT=16,PK0=48,j3$=57,D3$=65,Dw4=70,O3$=97,Ow4=102,T41=16777215;function w3$($,Z,Q,X){let Y=new Uint8Array(FT);return[0,0,0,0,0,0,0,0,0,0,255,255].forEach((G,W)=>{Y[W]=G}),Y[12]=$,Y[13]=Z,Y[14]=Q,Y[15]=X,Y}function jw4($){return E3$($)!==void 0}function E3$($){for(let Z=0;Z<$.length;Z++)switch($[Z]){case".":return z3$($);case":":return ww4($)}return}function z3$($){let Z=new Uint8Array(qs);for(let Q=0;Q<qs;Q++){if($.length===0)return;if(Q>0){if($[0]!==".")return;$=$.substring(1)}let{n:X,c:Y,ok:J}=Ew4($);if(!J||X>255)return;$=$.substring(Y),Z[Q]=X}return w3$(Z[0],Z[1],Z[2],Z[3])}function ww4($){let Z=new Uint8Array(FT),Q=-1;if($.length>=2&&$[0]===":"&&$[1]===":"){if(Q=0,$=$.substring(2),$.length===0)return Z}let X=0;while(X<FT){let{n:Y,c:J,ok:G}=zw4($);if(!G||Y>65535)return;if(J<$.length&&$[J]==="."){if(Q<0&&X!=FT-qs)return;if(X+qs>FT)return;let W=z3$($);if(W===void 0)return;Z[X]=W[12],Z[X+1]=W[13],Z[X+2]=W[14],Z[X+3]=W[15],$="",X+=qs;break}if(Z[X]=Y>>8,Z[X+1]=Y,X+=2,$=$.substring(J),$.length===0)break;if($[0]!==":"||$.length==1)return;if($=$.substring(1),$[0]===":"){if(Q>=0)return;if(Q=X,$=$.substring(1),$.length===0)break}}if($.length!==0)return;if(X<FT){if(Q<0)return;let Y=FT-X;for(let J=X-1;J>=Q;J--)Z[J+Y]=Z[J];for(let J=Q+Y-1;J>=Q;J--)Z[J]=0}else if(Q>=0)return;return Z}function Ew4($){let Z=0,Q=0;for(Z=0;Z<$.length&&PK0<=$.charCodeAt(Z)&&$.charCodeAt(Z)<=j3$;Z++)if(Q=Q*10+($.charCodeAt(Z)-PK0),Q>=T41)return{n:T41,c:Z,ok:!1};if(Z===0)return{n:0,c:0,ok:!1};return{n:Q,c:Z,ok:!0}}function zw4($){let Z=0,Q=0;for(Q=0;Q<$.length;Q++){if(PK0<=$.charCodeAt(Q)&&$.charCodeAt(Q)<=j3$)Z*=16,Z+=$.charCodeAt(Q)-PK0;else if(O3$<=$.charCodeAt(Q)&&$.charCodeAt(Q)<=Ow4)Z*=16,Z+=$.charCodeAt(Q)-O3$+10;else if(D3$<=$.charCodeAt(Q)&&$.charCodeAt(Q)<=Dw4)Z*=16,Z+=$.charCodeAt(Q)-D3$+10;else break;if(Z>=T41)return{n:0,c:Q,ok:!1}}if(Q===0)return{n:0,c:Q,ok:!1};return{n:Z,c:Q,ok:!0}}});var k41=b((A3$)=>{Object.defineProperty(A3$,"__esModule",{value:!0});A3$.Servers=A3$.ServerImpl=void 0;A3$.isIPV4OrHostname=T3$;A3$.hostPort=V41;var R41=HT(),q41=DH(),M41=A41(),Rw4=mj(),qw4=eG();function T3$($){if($.indexOf("[")!==-1||$.indexOf("::")!==-1)return!1;if($.indexOf(".")!==-1)return!0;if($.split(":").length<=2)return!0;return!1}function I41($){return!T3$($)}function Mw4($){let Q=$.toUpperCase().indexOf("::FFFF:");if(Q!==-1&&$.indexOf(".")!==-1){let X=$.substring(Q+7);return X=X.replace("[",""),X.replace("]","")}return $}function V41($){if($=$.trim(),$.match(/^(.*:\/\/)(.*)/m))$=$.replace(/^(.*:\/\/)(.*)/gm,"$2");if($=Mw4($),I41($)&&$.indexOf("[")===-1)$=`[${$}]`;let Z=I41($)?$.match(/(]:)(\d+)/):$.match(/(:)(\d+)/),Q=Z&&Z.length===3&&Z[1]&&Z[2]?parseInt(Z[2]):Rw4.DEFAULT_PORT,Y=new URL(`${Q===80?"https":"http"}://${$}`);Y.port=`${Q}`;let J=Y.hostname;if(J.charAt(0)==="[")J=J.substring(1,J.length-1);return{listen:Y.host,hostname:J,port:Q}}class Dc{src;listen;hostname;port;didConnect;reconnects;lastConnect;gossiped;tlsName;resolves;constructor($,Z=!1){this.src=$,this.tlsName="";let Q=V41($);this.listen=Q.listen,this.hostname=Q.hostname,this.port=Q.port,this.didConnect=!1,this.reconnects=0,this.lastConnect=0,this.gossiped=Z}toString(){return this.listen}async resolve($){if(!$.fn||$.resolve===!1)return[this];let Z=[];if((0,M41.isIP)(this.hostname))return[this];else{let Q=await $.fn(this.hostname);if($.debug)console.log(`resolve ${this.hostname} = ${Q.join(",")}`);for(let X of Q){let Y=this.port===80?"https":"http",J=new URL(`${Y}://${I41(X)?"["+X+"]":X}`);J.port=`${this.port}`;let G=new Dc(J.host,!1);G.tlsName=this.hostname,Z.push(G)}}if($.randomize)(0,q41.shuffle)(Z);return this.resolves=Z,Z}}A3$.ServerImpl=Dc;class TK0{firstSelect;servers;currentServer;tlsName;randomize;constructor($={}){this.firstSelect=!0,this.servers=[],this.tlsName="",this.randomize=$.randomize||!1}setServers($){if(!Array.isArray($)||$.length===0)throw qw4.InvalidArgumentError.format("servers","cannot be empty");let Z=(0,R41.getUrlParseFn)(),Q=new Map;for(let Y of this.servers)Q.set(Y.listen,Y);let X=[];for(let Y of $){Y=Z?Z(Y):Y;let{listen:J}=V41(Y),G=Q.get(J);if(G)G.gossiped=!1,X.push(G);else X.push(new Dc(Y))}if(this.randomize)(0,q41.shuffle)(X);if(this.servers=X,this.currentServer===void 0||!X.includes(this.currentServer))this.currentServer=X[0],this.firstSelect=!0}clear(){this.servers.length=0}updateTLSName(){let $=this.getCurrentServer();if(!(0,M41.isIP)($.hostname))this.tlsName=$.hostname,this.servers.forEach((Z)=>{if(Z.gossiped)Z.tlsName=this.tlsName})}getCurrentServer(){return this.currentServer}addServer($,Z=!1){let Q=(0,R41.getUrlParseFn)();$=Q?Q($):$;let X=new Dc($,Z);if((0,M41.isIP)(X.hostname))X.tlsName=this.tlsName;this.servers.push(X)}selectServer(){if(this.firstSelect)return this.firstSelect=!1,this.currentServer;let $=this.servers.shift();if($)this.servers.push($),this.currentServer=$;return $}removeCurrentServer(){this.removeServer(this.currentServer)}removeServer($){if($){let Z=this.servers.indexOf($);this.servers.splice(Z,1)}}snapshot(){return TK0.freezeAll(this.servers)}snapshotForHandler(){let $=this.currentServer;if(!$)return this.snapshot();let Z=this.servers.indexOf($);if(Z<=0)return this.snapshot();return TK0.freezeAll([$,...this.servers.slice(0,Z),...this.servers.slice(Z+1)])}static freezeAll($){return $.map((Z)=>Object.freeze({hostname:Z.hostname,port:Z.port,listen:Z.listen,src:Z.src,tlsName:Z.tlsName,reconnects:Z.reconnects,lastConnect:Z.lastConnect,gossiped:Z.gossiped,didConnect:Z.didConnect}))}find($){return this.servers.find((Z)=>Z.listen===$.listen)}setCurrent($){this.currentServer=$}length(){return this.servers.length}next(){return this.servers.length?this.servers[0]:void 0}getServers(){return this.servers}update($,Z){let Q=[],X=[],Y=(0,R41.getUrlParseFn)(),J=new Map;if($.connect_urls&&$.connect_urls.length>0)$.connect_urls.forEach((W)=>{W=Y?Y(W,Z):W;let K=new Dc(W,!0);J.set(W,K)});let G=[];if(this.servers.forEach((W,K)=>{let H=W.listen;if(W.gossiped&&this.currentServer.listen!==H&&J.get(H)===void 0)G.push(K);J.delete(H)}),G.reverse(),G.forEach((W)=>{let K=this.servers.splice(W,1);X=X.concat(K[0].listen)}),J.forEach((W,K)=>{this.servers.push(W),Q.push(K)}),this.randomize&&Q.length>0){let W=this.currentServer,K=this.servers.filter((H)=>H!==W);(0,q41.shuffle)(K),this.servers=W?[W,...K]:K}return{added:Q,deleted:X}}}A3$.Servers=TK0});var AK0=b((I3$)=>{Object.defineProperty(I3$,"__esModule",{value:!0});I3$.QueuedIteratorImpl=void 0;var C41=DH(),q3$=eG();class M3${inflight;processed;received;noIterator;iterClosed;done;signal;yields;filtered;pendingFiltered;ctx;_data;err;time;profile;yielding;didBreak;constructor(){this.inflight=0,this.filtered=0,this.pendingFiltered=0,this.processed=0,this.received=0,this.noIterator=!1,this.done=!1,this.signal=(0,C41.deferred)(),this.yields=[],this.iterClosed=(0,C41.deferred)(),this.time=0,this.yielding=!1,this.didBreak=!1,this.profile=!1}[Symbol.asyncIterator](){return this.iterate()}push($){if(this.done)return;if(this.didBreak){if(typeof $==="function"){let Z=$;try{Z()}catch(Q){}}return}if(typeof $==="function")this.pendingFiltered++;this.yields.push($),this.signal.resolve()}async*iterate(){if(this.noIterator)throw new q3$.InvalidOperationError("iterator cannot be used when a callback is registered");if(this.yielding)throw new q3$.InvalidOperationError("iterator is already yielding");this.yielding=!0;try{while(!0){if(this.yields.length===0)await this.signal;if(this.err)throw this.err;let $=this.yields;this.inflight=$.length,this.yields=[];for(let Z=0;Z<$.length;Z++){if(typeof $[Z]==="function"){this.pendingFiltered--;let X=$[Z];try{X()}catch(Y){throw Y}if(this.err)throw this.err;continue}this.processed++,this.inflight--;let Q=this.profile?Date.now():0;yield $[Z],this.time=this.profile?Date.now()-Q:0}if(this.done)break;else if(this.yields.length===0)$.length=0,this.yields=$,this.signal=(0,C41.deferred)()}}finally{this.didBreak=!0,this.stop()}}stop($){if(this.done)return;this.err=$,this.done=!0,this.signal.resolve(),this.iterClosed.resolve($)}getProcessed(){return this.noIterator?this.received:this.processed}getPending(){return this.yields.length+this.inflight-this.pendingFiltered}getReceived(){return this.received-this.filtered}}I3$.QueuedIteratorImpl=M3$});var S41=b((S3$)=>{Object.defineProperty(S3$,"__esModule",{value:!0});S3$.MuxSubscription=void 0;var Cw4=mj(),k3$=eG();class C3${baseInbox;reqs;constructor(){this.reqs=new Map}size(){return this.reqs.size}init($){return this.baseInbox=`${(0,Cw4.createInbox)($)}.`,this.baseInbox}add($){if(!isNaN($.received))$.received=0;this.reqs.set($.token,$)}get($){return this.reqs.get($)}cancel($){this.reqs.delete($.token)}getToken($){let Z=$.subject||"";if(Z.indexOf(this.baseInbox)===0)return Z.substring(this.baseInbox.length);return null}all(){return Array.from(this.reqs.values())}handleError($,Z){if($)return this.all().forEach((Q)=>{Q.resolver(Z,{})}),!0;if(Z.operation==="publish"){let Q=this.all().find((X)=>{return X.requestSubject===Z.subject});if(Q)return Q.resolver(Z,{}),!0}return!1}dispatcher(){return($,Z)=>{let Q=this.getToken(Z);if(Q){let X=this.get(Q);if(X){if($===null)$=Z?.data?.length===0&&Z.headers?.code===503?new k3$.NoRespondersError(X.requestSubject):null;X.resolver($,Z)}}}}close(){let $=new k3$.RequestError("connection closed");this.reqs.forEach((Z)=>{Z.resolver($,{})})}}S3$.MuxSubscription=C3$});var _41=b((x3$)=>{Object.defineProperty(x3$,"__esModule",{value:!0});x3$.Heartbeat=void 0;var Sw4=DH();class v3${ph;interval;maxOut;timer;pendings;constructor($,Z,Q){this.ph=$,this.interval=Z,this.maxOut=Q,this.pendings=[]}start(){this.cancel(),this._schedule()}cancel($){if(this.timer)clearTimeout(this.timer),this.timer=void 0;if(this._reset(),$)this.ph.disconnect()}_schedule(){this.timer=setTimeout(()=>{if(this.ph.dispatchStatus({type:"ping",pendingPings:this.pendings.length+1}),this.pendings.length===this.maxOut){this.cancel(!0);return}let $=(0,Sw4.deferred)();this.ph.flush($).then(()=>{this._reset()}).catch(()=>{this.cancel()}),this.pendings.push($),this._schedule()},this.interval)}_reset(){this.pendings=this.pendings.filter(($)=>{return $.resolve(),!1})}}x3$.Heartbeat=v3$});var f41=b((h3$)=>{Object.defineProperty(h3$,"__esModule",{value:!0});h3$.DenoBuffer=h3$.MAX_SIZE=h3$.AssertionError=void 0;h3$.assert=y3$;h3$.concat=g3$;h3$.append=vw4;h3$.readAll=xw4;h3$.writeAll=fw4;var _w4=sG();class v41 extends Error{constructor($){super($);this.name="AssertionError"}}h3$.AssertionError=v41;function y3$($,Z="Assertion failed."){if(!$)throw new v41(Z)}var b3$=32768;h3$.MAX_SIZE=4294967294;function RK0($,Z,Q=0){let X=Z.byteLength-Q;if($.byteLength>X)$=$.subarray(0,X);return Z.set($,Q),$.byteLength}function g3$($,Z){if($===void 0&&Z===void 0)return new Uint8Array(0);if($===void 0)return Z;if(Z===void 0)return $;let Q=new Uint8Array($.length+Z.length);return Q.set($,0),Q.set(Z,$.length),Q}function vw4($,Z){return g3$($,Uint8Array.of(Z))}class x41{_buf;_off;constructor($){if(this._off=0,$==null){this._buf=new Uint8Array(0);return}this._buf=new Uint8Array($)}bytes($={copy:!0}){if($.copy===!1)return this._buf.subarray(this._off);return this._buf.slice(this._off)}empty(){return this._buf.byteLength<=this._off}get length(){return this._buf.byteLength-this._off}get capacity(){return this._buf.buffer.byteLength}truncate($){if($===0){this.reset();return}if($<0||$>this.length)throw Error("bytes.Buffer: truncation out of range");this._reslice(this._off+$)}reset(){this._reslice(0),this._off=0}_tryGrowByReslice($){let Z=this._buf.byteLength;if($<=this.capacity-Z)return this._reslice(Z+$),Z;return-1}_reslice($){y3$($<=this._buf.buffer.byteLength),this._buf=new Uint8Array(this._buf.buffer,0,$)}readByte(){let $=new Uint8Array(1);if(this.read($))return $[0];return null}read($){if(this.empty()){if(this.reset(),$.byteLength===0)return 0;return null}let Z=RK0(this._buf.subarray(this._off),$);return this._off+=Z,Z}writeByte($){return this.write(Uint8Array.of($))}writeString($){return this.write(_w4.TE.encode($))}write($){let Z=this._grow($.byteLength);return RK0($,this._buf,Z)}_grow($){let Z=this.length;if(Z===0&&this._off!==0)this.reset();let Q=this._tryGrowByReslice($);if(Q>=0)return Q;let X=this.capacity;if($<=Math.floor(X/2)-Z)RK0(this._buf.subarray(this._off),this._buf);else if(X+$>h3$.MAX_SIZE)throw Error("The buffer cannot be grown beyond the maximum size.");else{let Y=new Uint8Array(Math.min(2*X+$,h3$.MAX_SIZE));RK0(this._buf.subarray(this._off),Y),this._buf=Y}return this._off=0,this._reslice(Math.min(Z+$,h3$.MAX_SIZE)),Z}grow($){if($<0)throw Error("Buffer._grow: negative count");let Z=this._grow($);this._reslice(Z)}readFrom($){let Z=0,Q=new Uint8Array(b3$);while(!0){let X=this.capacity-this.length<b3$,Y=X?Q:new Uint8Array(this._buf.buffer,this.length),J=$.read(Y);if(J===null)return Z;if(X)this.write(Y.subarray(0,J));else this._reslice(this.length+J);Z+=J}}}h3$.DenoBuffer=x41;function xw4($){let Z=new x41;return Z.readFrom($),Z.bytes()}function fw4($,Z){let Q=0;while(Q<Z.length)Q+=$.write(Z.subarray(Q))}});var g41=b((d3$)=>{Object.defineProperty(d3$,"__esModule",{value:!0});d3$.cc=d3$.State=d3$.Parser=d3$.Kind=void 0;d3$.describe=cw4;var b41=f41(),y41=sG();d3$.Kind={OK:0,ERR:1,MSG:2,INFO:3,PING:4,PONG:5};function cw4($){let Z,Q="";switch($.kind){case d3$.Kind.MSG:Z="MSG";break;case d3$.Kind.OK:Z="OK";break;case d3$.Kind.ERR:Z="ERR",Q=y41.TD.decode($.data);break;case d3$.Kind.PING:Z="PING";break;case d3$.Kind.PONG:Z="PONG";break;case d3$.Kind.INFO:Z="INFO",Q=y41.TD.decode($.data)}return`${Z}: ${Q}`}function l3$(){let $={};return $.sid=-1,$.hdr=-1,$.size=-1,$}var c3$=48,mw4=57,Oc=67108864;class m3${dispatcher;state;as;drop;hdr;ma;argBuf;msgBuf;constructor($){this.dispatcher=$,this.state=d3$.State.OP_START,this.as=0,this.drop=0,this.hdr=0}parse($){let Z;for(Z=0;Z<$.length;Z++){let Q=$[Z];switch(this.state){case d3$.State.OP_START:switch(Q){case d3$.cc.M:case d3$.cc.m:this.state=d3$.State.OP_M,this.hdr=-1,this.ma=l3$();break;case d3$.cc.H:case d3$.cc.h:this.state=d3$.State.OP_H,this.hdr=0,this.ma=l3$();break;case d3$.cc.P:case d3$.cc.p:this.state=d3$.State.OP_P;break;case d3$.cc.PLUS:this.state=d3$.State.OP_PLUS;break;case d3$.cc.MINUS:this.state=d3$.State.OP_MINUS;break;case d3$.cc.I:case d3$.cc.i:this.state=d3$.State.OP_I;break;default:throw this.fail($.subarray(Z))}break;case d3$.State.OP_H:switch(Q){case d3$.cc.M:case d3$.cc.m:this.state=d3$.State.OP_M;break;default:throw this.fail($.subarray(Z))}break;case d3$.State.OP_M:switch(Q){case d3$.cc.S:case d3$.cc.s:this.state=d3$.State.OP_MS;break;default:throw this.fail($.subarray(Z))}break;case d3$.State.OP_MS:switch(Q){case d3$.cc.G:case d3$.cc.g:this.state=d3$.State.OP_MSG;break;default:throw this.fail($.subarray(Z))}break;case d3$.State.OP_MSG:switch(Q){case d3$.cc.SPACE:case d3$.cc.TAB:this.state=d3$.State.OP_MSG_SPC;break;default:throw this.fail($.subarray(Z))}break;case d3$.State.OP_MSG_SPC:switch(Q){case d3$.cc.SPACE:case d3$.cc.TAB:continue;default:this.state=d3$.State.MSG_ARG,this.as=Z}break;case d3$.State.MSG_ARG:switch(Q){case d3$.cc.CR:this.drop=1;break;case d3$.cc.NL:{let X=this.argBuf?this.argBuf.bytes():$.subarray(this.as,Z-this.drop);this.processMsgArgs(X),this.drop=0,this.as=Z+1,this.state=d3$.State.MSG_PAYLOAD,Z=this.as+this.ma.size-1;break}default:if(this.argBuf)this.argBuf.writeByte(Q)}break;case d3$.State.MSG_PAYLOAD:if(this.msgBuf)if(this.msgBuf.length>=this.ma.size){let X=this.msgBuf.bytes({copy:!1});this.dispatcher.push({kind:d3$.Kind.MSG,msg:this.ma,data:X}),this.argBuf=void 0,this.msgBuf=void 0,this.state=d3$.State.MSG_END}else{let X=this.ma.size-this.msgBuf.length,Y=$.length-Z;if(Y<X)X=Y;if(X>0)this.msgBuf.write($.subarray(Z,Z+X)),Z=Z+X-1;else this.msgBuf.writeByte(Q)}else if(Z-this.as>=this.ma.size)this.dispatcher.push({kind:d3$.Kind.MSG,msg:this.ma,data:$.subarray(this.as,Z)}),this.argBuf=void 0,this.msgBuf=void 0,this.state=d3$.State.MSG_END;break;case d3$.State.MSG_END:switch(Q){case d3$.cc.NL:this.drop=0,this.as=Z+1,this.state=d3$.State.OP_START;break;default:continue}break;case d3$.State.OP_PLUS:switch(Q){case d3$.cc.O:case d3$.cc.o:this.state=d3$.State.OP_PLUS_O;break;default:throw this.fail($.subarray(Z))}break;case d3$.State.OP_PLUS_O:switch(Q){case d3$.cc.K:case d3$.cc.k:this.state=d3$.State.OP_PLUS_OK;break;default:throw this.fail($.subarray(Z))}break;case d3$.State.OP_PLUS_OK:switch(Q){case d3$.cc.NL:this.dispatcher.push({kind:d3$.Kind.OK}),this.drop=0,this.state=d3$.State.OP_START;break}break;case d3$.State.OP_MINUS:switch(Q){case d3$.cc.E:case d3$.cc.e:this.state=d3$.State.OP_MINUS_E;break;default:throw this.fail($.subarray(Z))}break;case d3$.State.OP_MINUS_E:switch(Q){case d3$.cc.R:case d3$.cc.r:this.state=d3$.State.OP_MINUS_ER;break;default:throw this.fail($.subarray(Z))}break;case d3$.State.OP_MINUS_ER:switch(Q){case d3$.cc.R:case d3$.cc.r:this.state=d3$.State.OP_MINUS_ERR;break;default:throw this.fail($.subarray(Z))}break;case d3$.State.OP_MINUS_ERR:switch(Q){case d3$.cc.SPACE:case d3$.cc.TAB:this.state=d3$.State.OP_MINUS_ERR_SPC;break;default:throw this.fail($.subarray(Z))}break;case d3$.State.OP_MINUS_ERR_SPC:switch(Q){case d3$.cc.SPACE:case d3$.cc.TAB:continue;default:this.state=d3$.State.MINUS_ERR_ARG,this.as=Z}break;case d3$.State.MINUS_ERR_ARG:switch(Q){case d3$.cc.CR:this.drop=1;break;case d3$.cc.NL:{let X;if(this.argBuf)X=this.argBuf.bytes(),this.argBuf=void 0;else X=$.subarray(this.as,Z-this.drop);this.dispatcher.push({kind:d3$.Kind.ERR,data:X}),this.drop=0,this.as=Z+1,this.state=d3$.State.OP_START;break}default:if(this.argBuf)this.argBuf.write(Uint8Array.of(Q))}break;case d3$.State.OP_P:switch(Q){case d3$.cc.I:case d3$.cc.i:this.state=d3$.State.OP_PI;break;case d3$.cc.O:case d3$.cc.o:this.state=d3$.State.OP_PO;break;default:throw this.fail($.subarray(Z))}break;case d3$.State.OP_PO:switch(Q){case d3$.cc.N:case d3$.cc.n:this.state=d3$.State.OP_PON;break;default:throw this.fail($.subarray(Z))}break;case d3$.State.OP_PON:switch(Q){case d3$.cc.G:case d3$.cc.g:this.state=d3$.State.OP_PONG;break;default:throw this.fail($.subarray(Z))}break;case d3$.State.OP_PONG:switch(Q){case d3$.cc.NL:this.dispatcher.push({kind:d3$.Kind.PONG}),this.drop=0,this.state=d3$.State.OP_START;break}break;case d3$.State.OP_PI:switch(Q){case d3$.cc.N:case d3$.cc.n:this.state=d3$.State.OP_PIN;break;default:throw this.fail($.subarray(Z))}break;case d3$.State.OP_PIN:switch(Q){case d3$.cc.G:case d3$.cc.g:this.state=d3$.State.OP_PING;break;default:throw this.fail($.subarray(Z))}break;case d3$.State.OP_PING:switch(Q){case d3$.cc.NL:this.dispatcher.push({kind:d3$.Kind.PING}),this.drop=0,this.state=d3$.State.OP_START;break}break;case d3$.State.OP_I:switch(Q){case d3$.cc.N:case d3$.cc.n:this.state=d3$.State.OP_IN;break;default:throw this.fail($.subarray(Z))}break;case d3$.State.OP_IN:switch(Q){case d3$.cc.F:case d3$.cc.f:this.state=d3$.State.OP_INF;break;default:throw this.fail($.subarray(Z))}break;case d3$.State.OP_INF:switch(Q){case d3$.cc.O:case d3$.cc.o:this.state=d3$.State.OP_INFO;break;default:throw this.fail($.subarray(Z))}break;case d3$.State.OP_INFO:switch(Q){case d3$.cc.SPACE:case d3$.cc.TAB:this.state=d3$.State.OP_INFO_SPC;break;default:throw this.fail($.subarray(Z))}break;case d3$.State.OP_INFO_SPC:switch(Q){case d3$.cc.SPACE:case d3$.cc.TAB:continue;default:this.state=d3$.State.INFO_ARG,this.as=Z}break;case d3$.State.INFO_ARG:switch(Q){case d3$.cc.CR:this.drop=1;break;case d3$.cc.NL:{let X;if(this.argBuf)X=this.argBuf.bytes(),this.argBuf=void 0;else X=$.subarray(this.as,Z-this.drop);this.dispatcher.push({kind:d3$.Kind.INFO,data:X}),this.drop=0,this.as=Z+1,this.state=d3$.State.OP_START;break}default:if(this.argBuf)this.argBuf.writeByte(Q)}break;default:throw this.fail($.subarray(Z))}}if((this.state===d3$.State.MSG_ARG||this.state===d3$.State.MINUS_ERR_ARG||this.state===d3$.State.INFO_ARG)&&!this.argBuf)this.argBuf=new b41.DenoBuffer($.subarray(this.as,Z-this.drop));if(this.state===d3$.State.MSG_PAYLOAD&&!this.msgBuf){if(!this.argBuf)this.cloneMsgArg();this.msgBuf=new b41.DenoBuffer($.subarray(this.as))}}cloneMsgArg(){let $=this.ma.subject.length,Z=this.ma.reply?this.ma.reply.length:0,Q=new Uint8Array($+Z);if(Q.set(this.ma.subject),this.ma.reply)Q.set(this.ma.reply,$);if(this.argBuf=new b41.DenoBuffer(Q),this.ma.subject=Q.subarray(0,$),this.ma.reply)this.ma.reply=Q.subarray($)}processMsgArgs($){if(this.hdr>=0)return this.processHeaderMsgArgs($);let Z=[],Q=-1;for(let X=0;X<$.length;X++)switch($[X]){case d3$.cc.SPACE:case d3$.cc.TAB:case d3$.cc.CR:case d3$.cc.NL:if(Q>=0)Z.push($.subarray(Q,X)),Q=-1;break;default:if(Q<0)Q=X}if(Q>=0)Z.push($.subarray(Q));switch(Z.length){case 3:this.ma.subject=Z[0],this.ma.sid=this.protoParseInt(Z[1]),this.ma.reply=void 0,this.ma.size=this.protoParseInt(Z[2],Oc);break;case 4:this.ma.subject=Z[0],this.ma.sid=this.protoParseInt(Z[1]),this.ma.reply=Z[2],this.ma.size=this.protoParseInt(Z[3],Oc);break;default:throw this.fail($,"processMsgArgs Parse Error")}if(this.ma.sid<0)throw this.fail($,"processMsgArgs Bad or Missing Sid Error");if(this.ma.size<0)throw this.fail($,"processMsgArgs Bad or Missing Size Error")}fail($,Z=""){if(!Z)Z=`parse error [${this.state}]`;else Z=`${Z} [${this.state}]`;return Error(`${Z}: ${y41.TD.decode($)}`)}processHeaderMsgArgs($){let Z=[],Q=-1;for(let X=0;X<$.length;X++)switch($[X]){case d3$.cc.SPACE:case d3$.cc.TAB:case d3$.cc.CR:case d3$.cc.NL:if(Q>=0)Z.push($.subarray(Q,X)),Q=-1;break;default:if(Q<0)Q=X}if(Q>=0)Z.push($.subarray(Q));switch(Z.length){case 4:this.ma.subject=Z[0],this.ma.sid=this.protoParseInt(Z[1]),this.ma.reply=void 0,this.ma.hdr=this.protoParseInt(Z[2],Oc),this.ma.size=this.protoParseInt(Z[3],Oc);break;case 5:this.ma.subject=Z[0],this.ma.sid=this.protoParseInt(Z[1]),this.ma.reply=Z[2],this.ma.hdr=this.protoParseInt(Z[3],Oc),this.ma.size=this.protoParseInt(Z[4],Oc);break;default:throw this.fail($,"processHeaderMsgArgs Parse Error")}if(this.ma.sid<0)throw this.fail($,"processHeaderMsgArgs Bad or Missing Sid Error");if(this.ma.hdr<0||this.ma.hdr>this.ma.size)throw this.fail($,"processHeaderMsgArgs Bad or Missing Header Size Error");if(this.ma.size<0)throw this.fail($,"processHeaderMsgArgs Bad or Missing Size Error")}protoParseInt($,Z){if($.length===0||$.length>15)return-1;let Q=0;for(let X=0;X<$.length;X++){if($[X]<c3$||$[X]>mw4)return-1;Q=Q*10+($[X]-c3$)}return Z!==void 0&&Q>Z?-1:Q}}d3$.Parser=m3$;d3$.State={OP_START:0,OP_PLUS:1,OP_PLUS_O:2,OP_PLUS_OK:3,OP_MINUS:4,OP_MINUS_E:5,OP_MINUS_ER:6,OP_MINUS_ERR:7,OP_MINUS_ERR_SPC:8,MINUS_ERR_ARG:9,OP_M:10,OP_MS:11,OP_MSG:12,OP_MSG_SPC:13,MSG_ARG:14,MSG_PAYLOAD:15,MSG_END:16,OP_H:17,OP_P:18,OP_PI:19,OP_PIN:20,OP_PING:21,OP_PO:22,OP_PON:23,OP_PONG:24,OP_I:25,OP_IN:26,OP_INF:27,OP_INFO:28,OP_INFO_SPC:29,INFO_ARG:30};d3$.cc={CR:13,E:69,e:101,F:70,f:102,G:71,g:103,H:72,h:104,I:73,i:105,K:75,k:107,M:77,m:109,MINUS:45,N:78,n:110,NL:10,O:79,o:111,P:80,p:112,PLUS:43,R:82,r:114,S:83,s:115,SPACE:32,TAB:9}});var IK0=b((p3$)=>{Object.defineProperty(p3$,"__esModule",{value:!0});p3$.MsgHdrsImpl=void 0;p3$.canonicalMIMEHeaderKey=u41;p3$.headers=pw4;var i3$=sG(),OH=mj(),MK0=eG();function u41($){let F=!0,U=Array($.length);for(let N=0;N<$.length;N++){let B=$.charCodeAt(N);if(B===58||B<33||B>126)throw MK0.InvalidArgumentError.format("header",`'${$[N]}' is not a valid character in a header name`);if(F&&97<=B&&B<=122)B-=32;else if(!F&&65<=B&&B<=90)B+=32;U[N]=B,F=B==45}return String.fromCharCode(...U)}function pw4($=0,Z=""){if($===0&&Z!=="")throw MK0.InvalidArgumentError.format("code","is required");else if($>0&&Z==="")throw MK0.InvalidArgumentError.format("description","is required");return new jc($,Z)}var h41="NATS/1.0";class jc{_code;headers;_description;constructor($=0,Z=""){this._code=$,this._description=Z,this.headers=new Map}[Symbol.iterator](){return this.headers.entries()}size(){return this.headers.size}equals($){if($&&this.headers.size===$.headers.size&&this._code===$._code){for(let[Z,Q]of this.headers){let X=$.values(Z);if(Q.length!==X.length)return!1;let Y=[...Q].sort(),J=[...X].sort();for(let G=0;G<Y.length;G++)if(Y[G]!==J[G])return!1}return!0}return!1}static decode($){let Z=new jc,X=i3$.TD.decode($).split(`\r
 `),Y=X[0];if(Y!==h41){let J=Y.replace(h41,"").trim();if(J.length>0){if(Z._code=parseInt(J,10),isNaN(Z._code))Z._code=0;let G=Z._code.toString();J=J.replace(G,""),Z._description=J.trim()}}if(X.length>=1)X.slice(1).map((J)=>{if(J){let G=J.indexOf(":");if(G>-1){let W=J.slice(0,G),K=J.slice(G+1).trim();Z.append(W,K)}}});return Z}toString(){if(this.headers.size===0&&this._code===0)return"";let $=h41;if(this._code>0&&this._description!=="")$+=` ${this._code} ${this._description}`;for(let[Z,Q]of this.headers)for(let X=0;X<Q.length;X++)$=`${$}\r
 ${Z}: ${Q[X]}`;return`${$}\r
@@ -3327,7 +3327,7 @@ Caused by: ${Z.stack}`}};Fp=class Fp extends $Y{constructor($,Z){super($,Z);this
 `).filter((Z)=>!/^Co-authored-by:\s/i.test(Z)).join(`
 `).trimEnd()}function Mj6($){let Z=$.userName.trim(),Q=$.userEmail?.trim();if(Q)return`Co-authored-by: ${Z} <${Q}>`;return`Co-authored-by: ${Z}`}function IN1($,Z){let Q=qp(Z);if(!Q)return $;let X=Ct$($),Y=Mj6(Q);if(X.includes(Y))return X;let J=X.trimEnd();return J.length>0?`${J}
 
-${Y}`:Y}var kt$,qj6;var VN1=L(()=>{kt$=/[\r\n<>]/,qj6=/^[^\s@<>]+@[^\s@<>]+\.[^\s@<>]+$/});var jC0=L(()=>{$8();VN1()});function Ij6($){if($ instanceof TypeError)return!0;if($ instanceof Error&&!($ instanceof DOMException)&&typeof $.code==="string")return!0;if($ instanceof DOMException&&$.name==="AbortError")return!0;return!1}async function kN1($,Z,Q,X){try{return await O8(async()=>{let J=await fetch($,{...Z,signal:AbortSignal.timeout(X)});return{status:J.status,ok:J.ok,body:await J.text()}},{maxAttempts:3,minTimeout:50,maxTimeout:500,multiplier:2,jitter:0.5,isRetriable:Ij6})}catch(Y){let J=Y instanceof Error?Y.message:String(Y);throw Error(`[SANDBOX_UNREACHABLE] sandbox daemon ${Q} request failed: ${J}`,{cause:Y})}}async function wC0($){try{let Z=await fetch(`${$}/health`,{signal:AbortSignal.timeout(Vj6)});if(!Z.ok){try{await Z.text()}catch{}return null}let Q=await Z.json();if(typeof Q==="object"&&Q!==null&&typeof Q.bootId==="string"&&typeof Q.ready==="boolean"&&Q.setup&&typeof Q.setup.running==="boolean"&&typeof Q.setup.done==="boolean")return Q;return null}catch{return null}}async function SN1($){for(let Z=0;Z<St$;Z++){if(await wC0($)!==null)return;let Q=(Math.random()*2-1)*kj6;await $$(_t$+Q)}throw Error(`sandbox daemon at ${$} did not respond on /health within ${St$*_t$/1000}s`)}async function yN($,Z,Q,X,Y){return Cj6($,Z,"POST",Q,X,Y)}async function Cj6($,Z,Q,X,Y,J){let G={...X};if(Y&&Y.rotateToken!==void 0)G.auth=Y;let W=await kN1(`${$}/_sandbox/config`,{method:Q,headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:JSON.stringify(G)},"/_sandbox/config",J?.timeoutMs??CN1);if(!W.ok)throw new wF(W.status,W.body);return xt$(W.body,"/_sandbox/config")}async function vt$($,Z,Q){let X=await kN1(`${$}/_sandbox/setup/${Q}`,{method:"POST",headers:{Authorization:`Bearer ${Z}`}},`/_sandbox/setup/${Q}`,CN1);if(!X.ok)throw Error(`sandbox daemon /_sandbox/setup/${Q} returned ${X.status}: ${X.body}`)}async function D60($,Z,Q){let X=await kN1(`${$}/_sandbox/orgfs-config`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:Q},"/_sandbox/orgfs-config",CN1);if(!X.ok)throw Error(`sandbox daemon /_sandbox/orgfs-config returned ${X.status}: ${X.body}`);return xt$(X.body,"/_sandbox/orgfs-config")}function xt$($,Z){try{return JSON.parse($)}catch(Q){throw Error(`sandbox daemon ${Z} returned a malformed JSON body: ${$.slice(0,200)}`,{cause:Q})}}async function EC0($,Z,Q,X){let Y=new Headers(X.headers);for(let W of Sj6)Y.delete(W);Y.set("authorization",`Bearer ${Z}`);let J=X.method!=="GET"&&X.method!=="HEAD",G=`${$}${Q.startsWith("/")?Q:`/${Q}`}`;return fetch(G,{method:X.method,headers:Y,body:J?X.body:void 0,redirect:"manual",signal:X.signal,duplex:J?"half":void 0})}var wF,Vj6=500,CN1=30000,St$=25,_t$=200,kj6=50,Sj6;var Bg=L(()=>{jC0();$8();wF=class wF extends Error{status;constructor($,Z){super(`sandbox daemon /_sandbox/config returned ${$}: ${Z}`);this.status=$;this.name="ConfigRequestError"}};Sj6=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length"]});class zC0{counted=new Set;markCounted($){this.counted.add($)}consume($){return this.counted.delete($)}}class Lg{map=new Map;async run($,Z){let Q=this.map.get($);if(Q)return Q;let X=Z();this.map.set($,X);try{return await X}finally{this.map.delete($)}}}function PC0($,Z,Q){if(!$)return Q(null);if(!$.withLock)return Q($);return $.withLock(Z,Q)}function O60($){if(!$.orgId||!$.virtualMcpId||!$.branch)throw Error("composeSandboxRef: orgId, virtualMcpId and branch are all required for agent refs");return`agent:${$.orgId}:${$.virtualMcpId}:${$.branch}`}function ft$($){if(!$.startsWith("agent:"))return"";let Z=$.split(":");return Z.length>=4?Z.slice(3).join(":"):""}import{hash as _j6}from"crypto";function vj6($,Z=16){return _j6("sha256",Tl$($),"hex").slice(0,Z)}function c3($){let Z=vj6($),Q=xj6(ft$($.projectRef));return Q?`${Q}-${Z}`:`s-${Z}`}function xj6($){if(!$)return"";let Z=$.split("/").pop()??"",Q="",X=!1;for(let Y of Z.toLowerCase()){let J=Y.charCodeAt(0),G=J>=97&&J<=122,W=J>=48&&J<=57;if(!G&&!W){X||=Q.length>0;continue}if(X){if(Q.length+1>=bt$)break;Q+="-",X=!1}if(Q+=Y,Q.length===bt$)break}return Q}var bt$=24;var yt$=L(()=>{IF1()});function TC0($,Z){let Q=$.replace(/\/+$/,"");if(Q.includes("{handle}"))return`${Q.replace("{handle}",Z)}/`;try{let X=new URL(Q);return X.hostname=`${Z}.${X.hostname}`,`${X.toString()}/`}catch{return`${Q}/${Z}/`}}function Mp($){let Z=$.repo,Q=Z?{repository:{cloneUrl:Z.cloneUrl,repoName:Z.displayName??fj6(Z.cloneUrl),...Z.branch?{branch:Z.branch}:{},submoduleCredentials:Z.submoduleCredentials??[]},repositories:($.extraRepos??[]).filter((K)=>!!K.directoryName).map((K)=>({cloneUrl:K.cloneUrl,repoName:K.directoryName,...K.branch?{branch:K.branch}:{},submoduleCredentials:K.submoduleCredentials??[]})),...Z.userName.trim()||Z.userEmail.trim()?{identity:{userName:Z.userName,userEmail:Z.userEmail}}:{}}:void 0,X=$.tenant,Y=qp({userName:X?.userName,userEmail:X?.userEmail})??void 0,J=$.packageManager?{name:$.packageManager.name,...$.packageManager.path?{path:$.packageManager.path}:{}}:void 0,G=J?{packageManager:J,runtime:$.runtime,...$.port!==void 0?{port:$.port}:{}}:void 0,W=X?.orgId;if(!Q&&!G&&!Y&&$.cloneOnly===void 0&&!W)return null;return{...Q?{git:Q}:{},...Y?{operator:Y}:{},...W?{orgId:W}:{},...$.cloneOnly!==void 0?{cloneOnly:$.cloneOnly}:{},...G?{application:G}:{}}}function fj6($){try{let Z=new URL($);return Z.pathname.replace(/^\/+/,"").replace(/\.git$/,"")||Z.hostname}catch{return $}}var gt$=L(()=>{VN1()});function bj6($){try{return new URL($).username.length>0}catch{return!1}}function j60($){let Z=$.repo?.cloneUrl;if(!Z||!bj6(Z))return null;return{git:{repository:{cloneUrl:Z}}}}var Ip=L(()=>{yt$();gt$()});async function*lt$($){let Z=$.now??(()=>Date.now()),Q=Z(),X=$.schedulingTimeoutMs??gj6,Y={pod:{},sandbox:{},events:{hasPulling:!1,hasPulled:!1},startedAt:Q},J=[],G=null,W=!1,K=(E)=>{if(W)return;if(G){let z=G;G=null,z(E)}else J.push(E)},H=()=>{if(J.length>0)return Promise.resolve(J.shift());if(W)return Promise.resolve(null);return new Promise((E)=>{G=E})},F=()=>{if(W)return;if(W=!0,G){let E=G;G=null,E(null)}},U=new AbortController,N=()=>{U.abort(),F()};if($.signal)if($.signal.aborted)U.abort(),F();else $.signal.addEventListener("abort",N,{once:!0});let B=Math.max(0,X-(Z()-Q)),D=setTimeout(()=>K("tick"),B+100),O,j=new Promise((E)=>{O=E}),w=Promise.allSettled([uj6($.kc,$.namespace,$.claimName,U.signal,Y,K,Z,O),cj6($.kc,$.namespace,$.claimName,U.signal,Y,K),mj6($.kc,$.namespace,$.claimName,j,U.signal,Y,K,Z)]);try{let E=null,z=-1,A=ht$(Y,X,Z);if(E=vN1(A),!_N1(A))z=ut$(A);if(yield A,_N1(A))return;while(!W){if(await H()===null)break;let P=ht$(Y,X,Z);if(_N1(P)){let S=vN1(P);if(S!==E)E=S,yield P;return}let q=ut$(P);if(q<z)continue;let f=vN1(P);if(f!==E)E=f,z=q,yield P}}finally{if(clearTimeout(D),U.abort(),$.signal)$.signal.removeEventListener("abort",N);F(),await w.catch(()=>{})}}async function ct$($,Z=hj6){let Q=new AbortController,X="claiming",Y,J=()=>{clearTimeout(Y),Y=setTimeout(()=>Q.abort(),Z)};try{J();for await(let G of $(Q.signal)){if(G.kind==="ready")return;if(G.kind==="failed")throw new $Y(G.message);X=G.kind,J()}}finally{clearTimeout(Y),Q.abort()}throw new Fp(`Sandbox did not become ready: no progress for ${Math.round(Z/1000)}s while ${X}`)}function ht$($,Z,Q){let{pod:X,sandbox:Y,events:J,startedAt:G}=$;if(Y.ready)return{kind:"ready"};let W=X.containerWaitingReason;if(W==="ImagePullBackOff"||W==="ErrImagePull")return{kind:"failed",reason:"image-pull-backoff",message:"Sandbox image failed to download. The cluster may be missing pull credentials or the image tag may not exist."};if(W==="CrashLoopBackOff")return{kind:"failed",reason:"crash-loop-backoff",message:"Sandbox crashed during startup and is now in CrashLoopBackOff. Check pod logs."};if(!X.scheduled&&J.lastFailedSchedulingAt!==void 0&&Q()-G>Z)return{kind:"failed",reason:"scheduling-timeout",message:J.failedSchedulingMessage??`Pod could not be scheduled within ${Math.round(Z/1000)}s.`};if(X.containerRunning&&!X.containerReady)return{kind:"warming-daemon",since:G};if(J.hasPulling&&!J.hasPulled)return{kind:"pulling-image",since:G};if(W==="ContainerCreating"||W==="PodInitializing"||X.scheduled&&!X.containerRunning)return{kind:"starting-container",since:G};if(X.scheduledFalseReason==="Unschedulable"||J.lastFailedSchedulingAt!==void 0&&!X.scheduled)return{kind:"waiting-for-capacity",since:G,message:J.failedSchedulingMessage??X.scheduledFalseMessage,nodeClaim:J.nominatedNodeClaim};return{kind:"claiming",since:G}}function _N1($){return $.kind==="ready"||$.kind==="failed"}function ut$($){switch($.kind){case"claiming":return 0;case"waiting-for-capacity":return 1;case"pulling-image":return 2;case"starting-container":return 3;case"warming-daemon":return 4;case"ready":case"failed":return 99}}function vN1($){switch($.kind){case"claiming":case"pulling-image":case"starting-container":case"warming-daemon":return $.kind;case"waiting-for-capacity":return`waiting-for-capacity:${$.message??""}:${$.nodeClaim??""}`;case"ready":return"ready";case"failed":return`failed:${$.reason}:${$.message}`}}async function uj6($,Z,Q,X,Y,J,G,W){let K=`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?watch=true&labelSelector=${encodeURIComponent(`${yj6}=${Q}`)}`;return AC0({kc:$,path:K,signal:X,label:`pod/${Q}`,onEvent:(H)=>{if(H.type!=="ADDED"&&H.type!=="MODIFIED")return;let F=H.object;if(F.metadata?.name)W(F.metadata.name);lj6(F,Y,G),J("pod")}})}function lj6($,Z,Q){let Y=($.status?.conditions??[]).find((G)=>G.type==="PodScheduled");if(Y?.status==="True")Z.pod.scheduled=!0,Z.pod.scheduledFalseReason=void 0,Z.pod.scheduledFalseMessage=void 0;else if(Y?.status==="False")Z.pod.scheduled=!1,Z.pod.scheduledFalseReason=Y.reason,Z.pod.scheduledFalseMessage=Y.message;let J=($.status?.containerStatuses??[]).find((G)=>G.name===Q7.MAIN_CONTAINER_NAME);if(J)Z.pod.containerWaitingReason=J.state?.waiting?.reason,Z.pod.containerRunning=!!J.state?.running,Z.pod.containerReady=J.ready===!0}async function cj6($,Z,Q,X,Y,J){let G=`/apis/${Q7.CLAIM_API_GROUP}/${Q7.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(Z)}/${Q7.CLAIM_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${Q}`)}`;return AC0({kc:$,path:G,signal:X,label:`sandboxclaim/${Q}`,onEvent:(W)=>{if(W.type!=="ADDED"&&W.type!=="MODIFIED")return;let H=W.object.status?.conditions?.find((F)=>F.type==="Ready");if(!H)return;if(H.status==="True")Y.sandbox.ready=!0,Y.sandbox.notReadyReason=void 0,Y.sandbox.notReadyMessage=void 0;else Y.sandbox.ready=!1,Y.sandbox.notReadyReason=H.reason,Y.sandbox.notReadyMessage=H.message;J("sandbox")}})}async function mj6($,Z,Q,X,Y,J,G,W){let K=await Promise.race([X,new Promise((F)=>{if(Y.aborted){F(Q);return}Y.addEventListener("abort",()=>F(Q),{once:!0})})]);if(Y.aborted)return;let H=`/api/v1/namespaces/${encodeURIComponent(Z)}/events?watch=true&fieldSelector=${encodeURIComponent(`involvedObject.name=${K},involvedObject.kind=Pod`)}`;return AC0({kc:$,path:H,signal:Y,label:`events/${Q}`,onEvent:(F)=>{if(F.type!=="ADDED"&&F.type!=="MODIFIED")return;let U=F.object,N=U.reason;if(!N)return;switch(N){case"Pulling":J.events.hasPulling=!0;break;case"Pulled":J.events.hasPulling=!0,J.events.hasPulled=!0;break;case"FailedScheduling":J.events.lastFailedSchedulingAt=W(),J.events.failedSchedulingMessage=U.message;break;case"Nominated":{let B=U.message?.match(/nodeclaim\/([\w-]+)/);if(B)J.events.nominatedNodeClaim=B[1];break}default:return}G("event")}})}async function mt$($){let{kc:Z,namespace:Q,labelSelector:X,signal:Y,onDelete:J}=$,G=`/apis/${Q7.CLAIM_API_GROUP}/${Q7.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(Q)}/${Q7.CLAIM_PLURAL}?watch=true&labelSelector=${encodeURIComponent(X)}`;return AC0({kc:Z,path:G,signal:Y,label:"sandboxclaim-reaper",onEvent:(W)=>{if(W.type!=="DELETED")return;let K=W.object.metadata?.name;if(K)J(K)}})}async function AC0($){let{kc:Z,path:Q,signal:X,label:Y,onEvent:J}=$,G=0;while(!X.aborted){try{let K=await EK(Z,{method:"GET",path:Q,signal:X,headers:{accept:"application/json"},stream:!0});if(!K.ok||!K.body){try{await K.body?.cancel()}catch{}if(K.status===401||K.status===403){console.warn(`[lifecycle-watcher] ${Y} stopped: watch denied (${K.status} ${K.statusText}). `+"The kubeconfig in use cannot watch SandboxClaims \u2014 if you are running locally, "+"this provider should not be active (check STUDIO_AGENT_SANDBOX_ENABLED).");return}throw Error(`watch handshake failed: ${K.status} ${K.statusText}`)}G=0;for await(let H of $c$(K.body)){if(X.aborted)return;try{J(H)}catch(F){console.warn(`[lifecycle-watcher] ${Y} onEvent threw: ${F instanceof Error?F.message:String(F)}`)}}}catch(K){if(X.aborted)return;let H=K instanceof Error?K.message:String(K);console.warn(`[lifecycle-watcher] ${Y} watch ended: ${H}`)}if(X.aborted)return;let W=A7(5000,250,G,2,0);G+=1,await $$(W,{signal:X}).catch(()=>{})}}var yj6="studio.decocms.com/sandbox-handle",gj6=300000,hj6=600000;var dt$=L(()=>{$8();n40();$j0()});import{createHash as dj6}from"crypto";import{z as JJ}from"zod";function gN($){let Z;try{Z=new URL($.trim())}catch{return null}if(Z.protocol!=="https:"||Z.search||Z.hash)return null;let Q=Z.pathname.replace(/\/+$/,"").replace(/\.git$/,"").replace(/\/+$/,"");return Q?`https://${Z.host.toLowerCase()}${Q}`:null}function w60($){return gN($)?.toLowerCase()??null}function oj6($){let Z=new Set;for(let Q of $){let X=`${w60(Q.repoUrl)??Q.repoUrl}#${Q.branch}`;if(Z.has(X))return Q;Z.add(X)}return null}function it$($){return $.reduce((Z,Q)=>Z+Q.replicas,0)}function nt$($,Z){if(Z.warmPoolName)return Z.warmPoolName;let Q=dj6("sha256").update(`${Z.repoUrl}#${Z.branch}`).digest("hex").slice(0,8);return`${$}-${Q}`}function tt$($){return Math.max(0,$.size-it$($.repos))}function Vp($){return $.flatMap((Z)=>Z.repos.map((Q)=>({pool:Z,repo:Q,warmPoolName:nt$(Z.name,Q)})))}function rj6($,Z){return at$(void 0,$,!0,Z)}function ot$($,{templateName:Z}){let Q=rj6(Z,$.image),X=(Y,J)=>({apiVersion:`${Q7.CLAIM_API_GROUP}/${Q7.CLAIM_API_VERSION}`,kind:"SandboxWarmPool",metadata:{name:Y,labels:{[aj6]:$.name}},spec:{replicas:J,updateStrategy:{type:"OnReplenish"},sandboxTemplateRef:{name:Q}}});return[...$.repos.map((Y)=>X(nt$($.name,Y),Y.replicas)),X($.name,tt$($))]}function qC0($){return $.tenant?.orgId}function fN1($,Z){if(!Z.tenant)return null;let Q=$.filter((J)=>J.tenant===Z.tenant&&J.image===Z.image),X=Z.cloneUrl?w60(Z.cloneUrl):null;if(X){let J=Vp(Q).filter((W)=>w60(W.repo.repoUrl)===X),G=J.find((W)=>W.repo.branch===Z.branch)??J[0];if(G)return G}let Y=Q.find((J)=>tt$(J)>0);return Y?{pool:Y,repo:null,warmPoolName:Y.name}:null}function rt$($,Z,Q){return $?.warmPoolName??(Z?Q:"none")}function at$($,Z,Q=!1,X){let Y=X&&X!=="default"?`-${X}`:"";return`${Z}${Y}${$==="harness-run"||Q?"-medium":""}`}async function bN1($){let Z=at$($.purpose,$.templateName,$.tenantPool,$.sandboxImage);if(Z===$.templateName)return{name:Z,probes:$.probes};let Q=$.probes[Z]??null,X=Q!==null&&$.now-Q.checkedAt<$.ttlMs?Q:{checkedAt:$.now,present:await $.exists(Z)},Y={...$.probes,[Z]:X};if(X.present)return{name:Z,probes:Y};if(Q?.present!==!1)$.onAbsent?.(Z);if($.sandboxImage&&$.sandboxImage!=="default")return bN1({...$,sandboxImage:void 0,probes:Y});return{name:$.templateName,probes:Y}}function yN1($,Z,Q){let X=w60(Z);if(!X)return[];let Y=Q.replace(/^refs\/heads\//,"");return Vp($).filter(({repo:J})=>w60(J.repoUrl)===X&&J.branch===Y)}class gN1{source;dirty=new Set;pods=new Map;known=new Map;constructor($){this.source=$}pools(){return this.source()}resolve($){return fN1(this.pools(),$)}markDirty($,Z){let Q=yN1(this.pools(),$,Z).map((X)=>X.warmPoolName);for(let X of Q)this.dirty.add(X);return Q}takeDirty($){return this.dirty.delete($)}pod($){return this.pods.get($)}setPod($,Z){this.pods.set($,Z)}retainPods($,Z){for(let[Q,X]of this.pods)if(X.pool===$&&!Z.has(Q))this.pods.delete(Q)}retain($){let Z=new Map($.map((X)=>[X.warmPoolName,X])),Q=[...this.known.values()].filter((X)=>!Z.has(X.warmPoolName));for(let X of this.dirty)if(!Z.has(X))this.dirty.delete(X);for(let[X,Y]of this.pods)if(!Z.has(Y.pool))this.pods.delete(X);return this.known=Z,Q}}var ij6=54,pj6,nj6=2048,tj6,E60,RC0,xN1,pt$,aj6="studio.decocms.com/tenant-pool";var z60=L(()=>{r4();n40();pj6=/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/;tj6=JJ.object({runtime:JJ.enum(["node","bun","deno"]).default("node"),packageManager:JJ.enum(["npm","pnpm","yarn","bun","deno"]).optional(),packageManagerPath:JJ.string().optional(),devPort:JJ.number().int().positive().optional()}).default({runtime:"node"}),E60=JJ.object({repoUrl:JJ.string().max(nj6).transform(($,Z)=>{let Q=gN($);if(Q)return Q;return Z.addIssue({code:"custom",message:"repoUrl must be an https clone URL"}),JJ.NEVER}),branch:JJ.string().min(1).default("main"),workload:tj6,replicas:JJ.number().int().min(1)});RC0=class RC0 extends Error{poolName;size;allocated;constructor($,Z,Q){super(`pool ${$}: repos take ${Q} replicas, more than its size ${Z}`);this.poolName=$;this.size=Z;this.allocated=Q;this.name="TenantPoolCapacityError"}};xN1=JJ.object({name:JJ.string().max(ij6).regex(pj6,"pool name must be a DNS label (lowercase alphanumeric and '-')"),tenant:JJ.string().min(1).max(512),size:JJ.number().int().min(1),image:DN.default("default")}),pt$=xN1.extend({repos:JJ.array(E60).default([])}).superRefine(($,Z)=>{let Q=oj6($.repos);if(Q)Z.addIssue({code:"custom",path:["repos"],message:`duplicate repo allocation ${Q.repoUrl}#${Q.branch}`});let X=it$($.repos);if(X>$.size)Z.addIssue({code:"custom",path:["repos"],message:new RC0($.name,$.size,X).message})})});async function st$($,Z,Q){let X=new Map;for(let Y of $){let J=Z(Y);if(!J)continue;let G=X.get(J);if(G)G.push(Y);else X.set(J,[Y])}await Promise.allSettled([...X.values()].map(async(Y)=>{for(let J of Y)await Q(J).catch(()=>{})}))}function sj6($){try{let Z=new URL($);if(Z.hostname.toLowerCase()!=="github.com")return null;let[Q,X]=Z.pathname.replace(/^\/+/,"").split("/"),Y=X?.replace(/\.git$/,"");return Q&&Y?`${Q}/${Y}`.toLowerCase():null}catch{return null}}function et$($){if($.repositoryId)return{repositoryId:$.repositoryId};let Z=$.connectionId?sj6($.cloneUrl):null;return $.connectionId&&Z?{connectionId:$.connectionId,repo:Z}:null}var $o$=L(()=>{z60()});async function kp($,Z,Q,X){let Y=(G)=>EC0(G.url,G.token,Z,Q),J=!(Q.body instanceof ReadableStream);try{let G=await Y($);if(G.status!==401||!J)return G;let W=await X.unauthorized();if(!W)return G;return await G.body?.cancel().catch(()=>{}),await Y(W)}catch(G){if(!J)throw G;let W=await X.unreachable();if(!W)throw G;return Y(W)}}var MC0=L(()=>{Bg()});function Xo$($,Z){return new Response(JSON.stringify(Z),{status:$,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function Zo$($){let Z=new Headers;for(let[Q,X]of $.headers.entries())if(!$w6.includes(Q.toLowerCase()))Z.set(Q,X);return new Response($.body,{status:$.status,statusText:$.statusText,headers:Z})}function Qo$($,Z){let Q=Xo$($,{error:Z});return Q.headers.set("x-sandbox-preview-not-ready","1"),Q}async function Sp($,Z,Q){let X=await Z.base();if(!X)return Qo$(404,"sandbox not found");let Y=new URL($.url);if((Y.pathname==="/_sandbox"||Y.pathname.startsWith("/_sandbox/"))&&$.method!=="GET")return Xo$(404,{error:"not found"});let G=(F)=>`${F}${Y.pathname}${Y.search}`,W=new Headers($.headers);for(let F of ej6)W.delete(F);let K=$.method!=="GET"&&$.method!=="HEAD",H={method:$.method,headers:W,body:K?$.body:void 0,redirect:"manual",signal:$.signal,duplex:K?"half":void 0};try{return Zo$(await fetch(G(X),H))}catch(F){let U=`${X}${Y.pathname}`;if(console.warn(`[${Q}] preview fetch to ${U} failed: ${F instanceof Error?F.message:String(F)}`),Z.invalidate(),$.method==="GET"||$.method==="HEAD"){let N=await Z.retryBase();if(N)try{return Zo$(await fetch(G(N),H))}catch(B){console.warn(`[${Q}] preview fetch retry to ${U} failed: ${B instanceof Error?B.message:String(B)}`)}}return Qo$(502,"sandbox daemon unreachable")}}var Cp="x-sandbox-preview-not-ready",ej6,$w6;var IC0=L(()=>{ej6=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length","upgrade"],$w6=["connection","keep-alive","transfer-encoding","content-encoding","content-length"]});import{createHash as Zw6,randomBytes as Qw6,randomUUID as Yo$}from"crypto";import*as Uo$ from"net";import{PassThrough as Xw6}from"stream";function Jo$($){if($ instanceof Error)return $.message;if($&&typeof $==="object"){let Z=$;if(Z.error instanceof Error)return Z.error.message;if(typeof Z.message==="string"&&Z.message)return Z.message}return String($)}function Ko$($){return{pool:$.warmPoolName,org:$.pool.tenant}}class iN1{records=new Map;inflight=new Lg;activeGauge=new zC0;stateStore;previewUrlPattern;kubeConfig;capacityProbe;portForward;namespace;sandboxTemplateName;envName;tokenGenerator;idleTtlMs;metrics;previewGateway;sentinelToken;mintCloneUrl;mintPoolCloneUrl;mintOrgFsConfig;forwardPort;daemonAddress;persistCredentials;tenantPools;tenantPoolRefreshMs;templateProbes={};closed=!1;claimWatchAbort=new AbortController;constructor($={}){this.stateStore=$.stateStore??null,this.previewUrlPattern=$.previewUrlPattern??null,this.kubeConfig=$.kubeConfig??Ow6(),this.portForward=new UN1(this.kubeConfig),this.namespace=$.namespace??Yw6,this.sandboxTemplateName=$.sandboxTemplateName??Jw6,this.envName=Pw6($.envName),this.tokenGenerator=$.tokenGenerator??(()=>Qw6(Ww6).toString("hex")),this.idleTtlMs=$.idleTtlMs??Hw6,this.metrics=$.meter?Dw6($.meter):null,this.previewGateway=$.previewGateway&&$.previewUrlPattern?{...$.previewGateway}:null;let Z=$.sentinelToken?.trim()??"";this.sentinelToken=Z.length>0?Z:null,this.mintCloneUrl=$.mintCloneUrl,this.mintPoolCloneUrl=$.mintPoolCloneUrl,this.mintOrgFsConfig=$.mintOrgFsConfig,this.forwardPort=$.forwardPort,this.daemonAddress=$.daemonAddress??"forward",this.persistCredentials=$.persistCredentials??!0;let Q=$.tenantPools;if(this.tenantPools=this.sentinelToken===null?null:new gN1(typeof Q==="function"?Q:()=>Q??[]),this.sentinelToken===null&&(typeof Q==="function"||(Q?.length??0)>0))console.warn(`[${I6}] tenant pools configured without a sentinel token \u2014 ignoring them (warm-pool mode is off)`);this.tenantPoolRefreshMs=$.tenantPoolRefreshMs??Uw6,this.startClaimReaper(),this.startCredentialRefresher(),this.startTenantPoolReconciler()}startClaimReaper(){let $=["app.kubernetes.io/managed-by=studio","app.kubernetes.io/name=studio-sandbox",...this.envName?[`${GJ.env}=${this.envName}`]:[]].join(",");mt$({kc:this.kubeConfig,namespace:this.namespace,labelSelector:$,signal:this.claimWatchAbort.signal,onDelete:(Z)=>this.invalidateRecord(Z)})}async ensure($,Z={}){let Q=c3($);if(Q.startsWith("s-"))throw Error(`ensure: projectRef has no slug source: ${$.projectRef}`);return this.inflight.run(Q,()=>PC0(this.stateStore,$,(X)=>this.ensureLocked($,Q,Z,X)))}async delete($){let Z=await this.getRecord($);if(this.records.delete($),Z)this.dropRecord(Z);if(await this.deleteHttpRouteIfManaged($).catch((Q)=>{console.warn(`[${I6}] HTTPRoute delete failed for ${$}: ${Q instanceof Error?Q.message:String(Q)}`)}),await hR(this.kubeConfig,this.namespace,$),this.stateStore)if(Z)await this.stateStore.delete(Z.id);else await this.stateStore.deleteByHandle($)}lastTermination($){return il$(this.kubeConfig,this.namespace,GJ.sandboxHandle,$,Q7.MAIN_CONTAINER_NAME)}async alive($){return await _D(this.kubeConfig,this.namespace,$)!==void 0}watchClaimLifecycle($,Z){return lt$({kc:this.kubeConfig,namespace:this.namespace,claimName:$,signal:Z})}hasSchedulableCapacity(){return this.capacityProbe??=Qc$(this.kubeConfig,this.namespace),this.capacityProbe()}async getPreviewUrl($){let Z=await this.getRecord($);if(!Z)return null;return this.composePreviewUrl(Z)}async proxyDaemonRequest($,Z,Q){let X=await this.getRecord($);if(!X&&this.previewUrlPattern&&this.stateStore){let K=await this.stateStore.getByHandle($),H=K?.state,F=H?.token;if(K&&F){let N=`http://${H?.adoptedSandboxName??$}.${this.namespace}.svc.cluster.local:${hN}`;try{let B=await EC0(N,F,Z,Q);if(B.status!==404)return B;try{await B.body?.cancel()}catch{}}catch{}}}if(!X)X=await this.resurrectByHandle($);if(!X)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let Y=X,J=performance.now(),G=0,W=(K)=>{return Y=K,{url:K.daemonUrl,token:K.token}};try{let K=await kp(W(X),Z,Q,{unauthorized:async()=>{this.invalidateRecord($);let H=await this.getRecord($).catch(()=>null)??await this.resurrectByHandle($).catch(()=>null);return H?W(H):null},unreachable:async()=>{this.invalidateRecord($);let H=await this.resurrectByHandle($)??await this.getRecord($).catch(()=>null);return H?W(H):null}});return G=K.status,K}finally{this.recordProxyDuration("daemon",G,Y,performance.now()-J)}}async adoptLiveClaim($,Z){if(this.records.has(Z))return!0;let Q=await _D(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!Q||Q.metadata?.deletionTimestamp)return!1;return await this.inflight.run(Z,async()=>{let Y=this.records.get(Z);if(Y)return this.toSandbox(Y);let J=await this.adopt($,Z,Q);if(!J)throw Error(`cannot adopt live claim ${Z}`);return PC0(this.stateStore,$,(G)=>this.finish(J,G,!0,!0,"adopt"))}).catch(()=>null)!=null}async resolvePreviewUpstreamUrl($){if(this.previewUrlPattern)return`http://${await this.resolveServiceNameForHandle($)}.${this.namespace}.svc.cluster.local:${hN}`;let Z=await this.getRecord($);if(Z)return Z.daemonUrl;let Q=await this.resurrectByHandle($);return Q?Q.daemonUrl:null}async daemonEndpoint($){let Z=await this.getRecord($)??await this.resurrectByHandle($);if(!Z)return null;return{url:this.daemonAddress==="service"?`http://${Z.adoptedSandboxName}.${this.namespace}.svc.cluster.local:${hN}`:Z.daemonUrl,token:Z.token}}listSandboxes(){return[...this.records.values()].map(($)=>{let Z=$.ensureOpts,Q=Z?.tenant;return{handle:$.handle,tenant:Q?{orgId:Q.orgId,userId:Q.userId}:null,repos:[Z?.repo,...Z?.extraRepos??[]].filter((X)=>X!==void 0).map(et$).filter((X)=>X!==null),orgFs:Boolean(Z?.orgFsConfigJson)||$.orgFsRedacted===!0}})}async resolveServiceNameForHandle($){let Z=this.records.get($);if(Z)return Z.adoptedSandboxName;if(this.stateStore){let X=(await this.stateStore.getByHandle($).catch(()=>null))?.state?.adoptedSandboxName;if(X)return X}return $}async proxyPreviewRequest($,Z){let Q=performance.now(),X=this.records.get($)??null,Y=0;try{let J=await Sp(Z,{base:()=>this.resolvePreviewUpstreamUrl($),invalidate:()=>this.invalidateRecord($),retryBase:async()=>{return await this.resurrectByHandle($).catch(()=>null)?this.resolvePreviewUpstreamUrl($):null}},I6);return Y=J.status,J}finally{this.recordProxyDuration("preview",Y,X,performance.now()-Q,$)}}async ensureLocked($,Z,Q,X){if(Q.image)console.warn(`[${I6}] opts.image ignored (template ${this.sandboxTemplateName} pins image): got ${Q.image}`);if(X){let G=await X.get($);if(G){let W=await this.rehydrate($,Z,G);if(W)return await this.refreshDaemonGitCredential(W,Q),await this.relayOrgFsConfig(W.daemonUrl,W.token,Q.orgFsConfigJson),this.finish(W,X,!1,!0,"resume");await X.delete($)}}let Y=await _D(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(Y)if(Y.metadata?.deletionTimestamp)await r40(this.kubeConfig,this.namespace,Z).catch((G)=>{console.warn(`[${I6}] wait for terminating claim ${Z} failed: ${G instanceof Error?G.message:String(G)}`)});else if(!hN1(Y)){let G=await this.join($,Z,Q,Y).catch((W)=>{return console.warn(`[${I6}] join of starting claim ${Z} failed, recreating: ${W instanceof Error?W.message:String(W)}`),null});if(G)return this.finish(G,X,!0,!0,"adopt");await hR(this.kubeConfig,this.namespace,Z).catch(()=>{}),await r40(this.kubeConfig,this.namespace,Z).catch((W)=>{console.warn(`[${I6}] wait for deleted claim ${Z} failed: ${W instanceof Error?W.message:String(W)}`)})}else{let G=await this.adopt($,Z,Y).catch((W)=>{return console.warn(`[${I6}] adopt ${Z} failed, recreating: ${W instanceof Error?W.message:String(W)}`),null});if(G)return await this.refreshDaemonGitCredential(G,Q),await this.relayOrgFsConfig(G.daemonUrl,G.token,Q.orgFsConfigJson),this.finish(G,X,!0,!0,"adopt");await hR(this.kubeConfig,this.namespace,Z).catch(()=>{}),await r40(this.kubeConfig,this.namespace,Z).catch((W)=>{console.warn(`[${I6}] wait for deleted claim ${Z} failed: ${W instanceof Error?W.message:String(W)}`)})}let J=await this.provision($,Z,Q);return this.finish(J,X,!0,!1,"fresh")}async finish($,Z,Q,X,Y){let J=this.records.get($.handle),G=J!==void 0;if(J&&J.daemonForward!==$.daemonForward)this.closeForwarder(J.daemonForward);if(this.records.set($.handle,$),Q)await this.persist(Z,$);if(X)await eO0(this.kubeConfig,this.namespace,$.handle,this.computeShutdownTime()).catch((W)=>console.warn(`[${I6}] TTL refresh failed for ${$.handle}: ${W instanceof Error?W.message:String(W)}`));if(this.metrics){let W=cN1($.tenant);if(this.metrics.ensureOutcome.add(1,{...W,outcome:Y}),!G)this.metrics.active.add(1,W),this.activeGauge.markCounted($.handle)}return this.toSandbox($)}buildEnvMap($,Z){let Q={},X=[];for(let[Y,J]of Object.entries($.env??{}))if(Kw6.has(Y))X.push(Y);else Q[Y]=J;if(X.length>0)console.warn(`[${I6}] opts.env keys overlap reserved bootstrap names and were dropped: ${X.join(",")}`);return{...Q,DAEMON_TOKEN:Z.token,DAEMON_BOOT_ID:Z.daemonBootId,APP_ROOT:Z.workdir,PROXY_PORT:String(hN)}}async resolveTemplateName($,Z,Q){let{name:X,probes:Y}=await bN1({purpose:$,tenantPool:Z,...Q?{sandboxImage:Q}:{},templateName:this.sandboxTemplateName,probes:this.templateProbes,now:Date.now(),ttlMs:Gw6,exists:(J)=>ll$(this.kubeConfig,this.namespace,J),onAbsent:(J)=>console.warn(`[${I6}] SandboxTemplate ${J} not found (or not readable) \u2014 this claim falls back to a template without that suffix. Upgrade the sandbox-env chart to the version that renders it.`)});return this.templateProbes=Y,X}buildClaim($,Z,Q,X,Y){let J=this.sentinelToken!==null,G=J?[]:Object.entries(this.buildEnvMap(Z,Q)).sort(([H],[F])=>H<F?-1:H>F?1:0).map(([H,F])=>({name:H,value:F})),W=Rw6(Z),K=Object.keys(W).length>0;return{apiVersion:`${Q7.CLAIM_API_GROUP}/${Q7.CLAIM_API_VERSION}`,kind:"SandboxClaim",metadata:{name:$,namespace:this.namespace,labels:{"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[GJ.env]:this.envName}:{},...lN1(Z.tenant)},...K?{annotations:W}:{}},spec:{sandboxTemplateRef:{name:Y},additionalPodMetadata:{labels:lN1(Z.tenant,{[GJ.role]:"claimed",[GJ.sandboxHandle]:$,...this.envName?{[GJ.env]:this.envName}:{}}),...K?{annotations:W}:{}},env:G,warmpool:rt$(X,J,Y),lifecycle:{shutdownPolicy:"Delete",shutdownTime:this.computeShutdownTime()}}}}async provision($,Z,Q){let X=this.tokenGenerator(),Y=Yo$(),J=VC0,G=this.claimTenantPoolBinding(Q),W=this.buildClaim(Z,Q,{token:X,daemonBootId:Y,workdir:J},G,await this.resolveTemplateName(Q.purpose,G!==null,Q.sandboxImage));try{await _F1(this.kubeConfig,this.namespace,W)}catch(K){if(K instanceof p40)await r40(this.kubeConfig,this.namespace,Z),await _F1(this.kubeConfig,this.namespace,W);else throw K}return this.bind($,Z,Q,G,{token:X,daemonBootId:Y,workdir:J})}claimTenantPoolBinding($){return this.tenantPools?.resolve({tenant:qC0($),image:$.sandboxImage??"default",cloneUrl:$.repo?.cloneUrl,branch:$.repo?.branch})??null}async bind($,Z,Q,X,{token:Y,daemonBootId:J,workdir:G}){let W;try{W=await cl$(this.kubeConfig,this.namespace,Z),await ct$((B)=>this.watchClaimLifecycle(Z,B))}catch(B){throw await hR(this.kubeConfig,this.namespace,Z).catch(()=>{}),B}try{await this.ensureServicePortForAdoptedSandbox(W),await this.ensureHttpRouteForHandle(Z,W,Q.tenant??null)}catch(B){throw await hR(this.kubeConfig,this.namespace,Z).catch(()=>{}),B}let K=await this.openForwarder(W,hN,Z),H=`http://127.0.0.1:${K.localPort}`,F=X?.repo!=null&&W!==Z,U=this.workloadConfigPayload(Q,F),N=J;try{if(await SN1(H),this.sentinelToken!==null){let B=await wC0(H);if(B)N=B.bootId;try{await yN(H,this.sentinelToken,U??{},{rotateToken:Y})}catch(D){if(D instanceof wF&&D.status===401)console.warn(`[${I6}] sentinel rejected by adopted pod (handle=${Z}, sandbox=${W}): pod belongs to another claim; tearing down and reprovisioning`);throw D}}else if(U)await yN(H,Y,U);await this.relayOrgFsConfig(H,Y,Q.orgFsConfigJson)}catch(B){throw this.closeForwarder(K),await this.deleteHttpRouteIfManaged(Z).catch(()=>{}),await hR(this.kubeConfig,this.namespace,Z).catch(()=>{}),B}return{id:$,handle:Z,adoptedSandboxName:W,token:Y,workdir:G,daemonUrl:H,daemonForward:K,workload:Q.workload??null,daemonBootId:N,tenant:Q.tenant??null,tenantPoolPodBound:F,ensureOpts:Cw6(Q)}}workloadConfigPayload($,Z){return Mp({runtime:$?.workload?.runtime??"node",packageManager:$?.workload?.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:$?.repo??null,extraRepos:$?.extraRepos??[],port:$?.workload?.devPort??Go$,tenant:$?.tenant??void 0,...$?{cloneOnly:$.cloneOnly===!0&&!Z}:{}})}async relayOrgFsConfig($,Z,Q){if(!Q)return;await D60($,Z,Q).catch((X)=>console.warn("[org-fs] sidecar config relay failed",X))}async refreshDaemonGitCredential($,Z){let Q=j60(Z);if(!Q)return;try{await yN($.daemonUrl,$.token,Q)}catch(X){console.warn(`[${I6}] git credential refresh failed for ${$.handle}: ${X instanceof Error?X.message:String(X)}`)}}async withFreshCloneUrl($,Z={}){if(!this.mintCloneUrl)return $;try{let Q=await this.mintCloneUrl($,Z);if(!Q)return $;let{credentialExpiresAt:X,...Y}=$;return{...Y,cloneUrl:Q}}catch(Q){return console.warn(`[${I6}] clone credential re-mint failed: ${Q instanceof Error?Q.message:String(Q)}`),$}}async withFreshCredentials($,Z=!1){return{...$,...$.repo?{repo:await this.withFreshCloneUrl($.repo,{tenant:$.tenant})}:{},...$.orgFsConfigJson||Z?{orgFsConfigJson:await Vw6($,this.mintOrgFsConfig)}:{}}}startCredentialRefresher(){if(!this.mintCloneUrl)return;let{signal:$}=this.claimWatchAbort;(async()=>{while(!$.aborted){if(await $$(Nw6,{signal:$}).catch(()=>{}),$.aborted)break;try{await this.refreshAllGitCredentials()}catch(Z){console.warn(`[${I6}] periodic credential refresh failed: ${Z instanceof Error?Z.message:String(Z)}`)}}})()}startTenantPoolReconciler(){let $=this.tenantPools;if(!$)return;let{signal:Z}=this.claimWatchAbort;(async()=>{while(!Z.aborted){try{await this.reconcileTenantPools($)}catch(Q){console.warn(`[${I6}] tenant pool reconcile failed: ${Q instanceof Error?Q.message:String(Q)}`)}await $$(Fw6,{signal:Z}).catch(()=>{})}})()}listTenantPools(){return this.tenantPools?.pools()??[]}markTenantPoolsDirty($,Z){return Promise.resolve(this.tenantPools?.markDirty($,Z)??[])}async reconcileTenantPools($){let Z=Vp($.pools());for(let Q of $.retain(Z))this.recordPoolGone(Q);for(let Q of Z){let X=Q.warmPoolName,Y=await ml$(this.kubeConfig,this.namespace,X);if(Y===null){console.warn(`[${I6}] tenant pool ${X}: no SandboxWarmPool (or no selector yet) in ${this.namespace}`);continue}let J=$.takeDirty(X),G=Y.filter((W)=>!W.labels[GJ.sandboxHandle]);$.retainPods(X,new Set(Y.map((W)=>W.uid)));for(let W of G){if(this.claimWatchAbort.signal.aborted)return;await this.warmPoolPod($,Q,W,J)}this.recordPoolDepth($,Q,Y,G)}}recordPoolGone($){let Z=Ko$($);for(let Q of["ready","bound","pending","failed"])this.metrics?.poolPods.record(0,{...Z,state:Q})}recordPoolDepth($,Z,Q,X){let Y=this.metrics?.poolPods;if(!Y)return;let J=0,G=0;for(let K of X){let H=$.pod(K.uid);if(!H)continue;if(H.failures>=kC0)G++;else if(H.lastConfigAt>0)J++}let W=Ko$(Z);Y.record(J,{...W,state:"ready"}),Y.record(Q.length-X.length,{...W,state:"bound"}),Y.record(X.length-J-G,{...W,state:"pending"}),Y.record(G,{...W,state:"failed"})}async warmPoolPod($,Z,Q,X){let Y=Z.warmPoolName,{workload:J}=Z.repo,G=$.pod(Q.uid);if(G&&G.failures>=kC0){if(Date.now()-G.lastFailureAt<Wo$)return;$.setPod(Q.uid,{...G,failures:0})}let W=X||G!==void 0&&Date.now()-G.lastConfigAt>=this.tenantPoolRefreshMs;if(G&&!W)return;let K=await this.allocationCloneUrl(Z);if(!K){this.recordPoolFailure($,Q,Y,"clone credential mint failed");return}let H={cloneUrl:K,branch:Z.repo.branch,userName:"",userEmail:""},F=await this.openForwarder(Q.name,hN,Q.name).catch(()=>null);if(!F){this.recordPoolFailure($,Q,Y,"port-forward failed");return}let U=`http://127.0.0.1:${F.localPort}`;try{await SN1(U);let N=this.sentinelToken;if(!N)return;if(!await this.isPoolPodUnbound(Q))return;let B=Mp({runtime:J.runtime,packageManager:J.packageManager?{name:J.packageManager,...J.packageManagerPath?{path:J.packageManagerPath}:{}}:null,repo:H,port:J.devPort??Go$})??{},{transition:D}=await yN(U,N,B);if(W&&D!=="bootstrap"&&await this.isPoolPodUnbound(Q))await vt$(U,N,"clone");$.setPod(Q.uid,{pool:Y,lastConfigAt:Date.now(),lastFailureAt:0,failures:0}),console.log(`[${I6}] tenant pool ${Y}: warmed ${Q.name} (${D})`)}catch(N){this.recordPoolFailure($,Q,Y,N instanceof Error?N.message:String(N))}finally{this.closeForwarder(F)}}async allocationCloneUrl({pool:$,repo:Z}){if(!this.mintPoolCloneUrl)return`${Z.repoUrl}.git`;try{return await this.mintPoolCloneUrl({tenant:$.tenant,repoUrl:Z.repoUrl,branch:Z.branch})}catch(Q){return console.warn(`[${I6}] tenant pool clone credential mint failed: ${Q instanceof Error?Q.message:String(Q)}`),null}}isPoolPodUnbound($){return dl$(this.kubeConfig,this.namespace,$.name,GJ.sandboxHandle)}recordPoolFailure($,Z,Q,X){let Y=$.pod(Z.uid),J=(Y?.failures??0)+1;$.setPod(Z.uid,{pool:Q,lastConfigAt:Y?.lastConfigAt??0,lastFailureAt:Date.now(),failures:J});let G=J>=kC0?` \u2014 backing off ${Wo$/60000}min`:"";console.warn(`[${I6}] tenant pool ${Q}: warming ${Z.name} failed (${J}/${kC0})${G}: ${X}`)}async refreshAllGitCredentials(){await st$(this.records.values(),($)=>$.ensureOpts?.repo?.connectionId,async($)=>{if(this.claimWatchAbort.signal.aborted)return;let Z=$.ensureOpts?.repo;if(!Z)return;try{let Q=await this.withFreshCloneUrl(Z,{bufferMs:Bw6,tenant:$.ensureOpts?.tenant});await this.refreshDaemonGitCredential($,{...$.ensureOpts,repo:Q}),$.ensureOpts={...$.ensureOpts,repo:Q}}catch(Q){throw console.warn(`[${I6}] git credential refresh failed for ${$.handle}: ${Q instanceof Error?Q.message:String(Q)}`),Q}})}async rebootstrapDaemon($,Z,Q){if(this.sentinelToken===null)return!1;let X=this.workloadConfigPayload(Q,!1)??{};try{return await yN($,this.sentinelToken,X,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,Q?.orgFsConfigJson),!0}catch(Y){if(Y instanceof wF&&Y.status===401)try{return await yN($,Z,X,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,Q?.orgFsConfigJson),!0}catch(J){return console.warn(`[${I6}] re-bootstrap retry with claim token failed: ${J instanceof Error?J.message:String(J)}`),!1}return console.warn(`[${I6}] re-bootstrap failed: ${Y instanceof Error?Y.message:String(Y)}`),!1}}async ensureServicePortForAdoptedSandbox($){if(!this.previewGateway||!this.previewUrlPattern)return;await el$(this.kubeConfig,this.namespace,$,{name:"daemon",port:hN,targetPort:hN})}async ensureHttpRouteForHandle($,Z,Q){if(!this.previewGateway||!this.previewUrlPattern)return;let X=Sw6(this.previewUrlPattern,$);if(!X)throw new $Y(`Unable to derive preview hostname for ${$} from pattern: ${this.previewUrlPattern}`);let Y={apiVersion:`${xF1.API_GROUP}/${xF1.API_VERSION}`,kind:"HTTPRoute",metadata:{name:$,namespace:this.namespace,labels:lN1(Q??void 0,{[GJ.role]:"claimed",[GJ.sandboxHandle]:$,"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[GJ.env]:this.envName}:{}})},spec:{parentRefs:[{kind:"Gateway",group:"gateway.networking.k8s.io",name:this.previewGateway.name,namespace:this.previewGateway.namespace}],hostnames:[X],rules:[{backendRefs:[{group:"",kind:"Service",name:Z,port:hN}]}]}};await rl$(this.kubeConfig,this.namespace,Y)}async deleteHttpRouteIfManaged($){if(!this.previewGateway)return;await al$(this.kubeConfig,this.namespace,$)}async rehydrate($,Z,Q){let X=Q.state;if(!X.adoptedSandboxName&&!X.podName||!X.token)return null;let Y=await _D(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!Y||!hN1(Y))return null;let J=Y.status?.sandbox?.name??X.adoptedSandboxName??X.podName??Z,G=await this.openAndProbeDaemon(J,Z);if(!G)return null;if(X.daemonBootId&&X.daemonBootId!==G.bootId){if(this.sentinelToken!==null){let W=X.ensureOpts?await this.withFreshCredentials(X.ensureOpts,X.orgFsRedacted===!0):null;if(!await this.rebootstrapDaemon(G.daemonUrl,X.token,W))return this.closeForwarder(G.daemonForward),null}else console.warn(`[${I6}] daemon restart detected (handle=${Z}): stored bootId=${X.daemonBootId} live bootId=${G.bootId}`);await this.stateStore?.put($,{handle:Z,state:{...X,daemonBootId:G.bootId}}).catch((W)=>console.warn(`[${I6}] bootId persist failed for ${Z}: ${W instanceof Error?W.message:String(W)}`))}return{id:$,handle:Z,adoptedSandboxName:J,tenantPoolPodBound:!1,token:X.token,workdir:X.workdir??VC0,daemonUrl:G.daemonUrl,daemonForward:G.daemonForward,workload:X.workload??null,daemonBootId:G.bootId,tenant:X.tenant??null,ensureOpts:X.ensureOpts??null,orgFsRedacted:X.orgFsRedacted===!0}}join($,Z,Q,X){let Y=this.sentinelToken!==null,J=Y?this.tokenGenerator():uN1(X,"DAEMON_TOKEN"),G=Y?Yo$():uN1(X,"DAEMON_BOOT_ID");if(!J||!G)throw new $Y(`claim ${Z} carries no daemon token`);return this.bind($,Z,Q,this.claimTenantPoolBinding(Q),{token:J,daemonBootId:G,workdir:VC0})}async adopt($,Z,Q){if(!hN1(Q))return null;let X=Q.status?.sandbox?.name??Z;if(this.sentinelToken!==null)return null;let Y=uN1(Q,"DAEMON_TOKEN");if(!Y)return null;let J=await this.openAndProbeDaemon(X,Z);if(!J)return null;let G=qw6(Q);if(this.previewGateway)await this.ensureServicePortForAdoptedSandbox(X).catch((W)=>{console.warn(`[${I6}] Service port backfill failed for ${Z}: ${W instanceof Error?W.message:String(W)}`)}),await this.ensureHttpRouteForHandle(Z,X,G).catch((W)=>{console.warn(`[${I6}] HTTPRoute backfill failed for ${Z}: ${W instanceof Error?W.message:String(W)}`)});return{id:$,handle:Z,adoptedSandboxName:X,tenantPoolPodBound:!1,token:Y,workdir:VC0,daemonUrl:J.daemonUrl,daemonForward:J.daemonForward,workload:null,daemonBootId:J.bootId,tenant:G,ensureOpts:null}}async openAndProbeDaemon($,Z){let Q=await this.openForwarder($,hN,Z).catch(()=>null);if(!Q)return null;let X=`http://127.0.0.1:${Q.localPort}`,Y=await wC0(X);if(!Y)return this.closeForwarder(Q),null;return{daemonForward:Q,daemonUrl:X,bootId:Y.bootId}}async getRecord($){let Z=this.records.get($);if(Z)return Z;if(!this.stateStore)return null;let Q=await this.stateStore.getByHandle($);if(!Q)return null;let X=await this.rehydrate(Q.id,$,Q);if(X)this.records.set($,X);return X}async resurrectByHandle($){if(!this.stateStore)return null;let Z=await this.stateStore.getByHandle($);if(!Z)return null;let Q=Z.state,X=Q.ensureOpts;if(!X)return null;let Y=await this.withFreshCredentials(X,Q.orgFsRedacted===!0);if(c3(Z.id)!==$)return null;return await this.ensure(Z.id,Y),this.records.get($)??null}invalidateRecord($){let Z=this.records.get($);if(!Z)return;this.records.delete($),this.dropRecord(Z)}dropRecord($){if(this.closeForwarder($.daemonForward),this.metrics&&this.activeGauge.consume($.handle))this.metrics.active.add(-1,cN1($.tenant))}recordProxyDuration($,Z,Q,X,Y){if(!this.metrics)return;this.metrics.proxyDurationMs.record(X,{...cN1(Q?.tenant??null),source:$,sandbox_handle:Q?.handle??Y??"",status_code:Z||0})}composePreviewUrl($){if(this.previewUrlPattern)return TC0(this.previewUrlPattern,$.handle);return`http://127.0.0.1:${$.daemonForward.localPort}/`}toSandbox($){return{handle:$.handle,workdir:$.workdir,previewUrl:this.composePreviewUrl($),warmPoolAdopted:$.tenantPoolPodBound===!0,provider:"kubernetes"}}async persist($,Z){if(!$)return;let Q={adoptedSandboxName:Z.adoptedSandboxName,token:Z.token,workdir:Z.workdir,workload:Z.workload,daemonBootId:Z.daemonBootId,tenant:Z.tenant,...Z.ensureOpts?this.persistCredentials?{ensureOpts:Z.ensureOpts}:kw6(Z.ensureOpts,Z.orgFsRedacted===!0):{}};await $.put(Z.id,{handle:Z.handle,state:Q})}computeShutdownTime(){return new Date(Date.now()+this.idleTtlMs).toISOString()}async releaseAfter($,Z){let Q=await _D(this.kubeConfig,this.namespace,$);if(!Q)return;let X=Mw6(Q.spec?.lifecycle?.shutdownTime,new Date(Date.now()+Z));if(!X)return;await eO0(this.kubeConfig,this.namespace,$,X).catch((Y)=>console.warn(`[${I6}] release failed for ${$}: ${Y instanceof Error?Y.message:String(Y)}`))}async renewTtl($){let Z=await _D(this.kubeConfig,this.namespace,$);if(!Z)return;let Q=Iw6(Z.spec?.lifecycle?.shutdownTime,new Date(Date.now()+this.idleTtlMs));if(!Q)return;await eO0(this.kubeConfig,this.namespace,$,Q).catch((X)=>console.warn(`[${I6}] TTL renew failed for ${$}: ${X instanceof Error?X.message:String(X)}`))}openForwarder($,Z,Q=$){if(this.forwardPort)return this.forwardPort($,Z,Q);let X=jw6(Q,Z);return new Promise((Y,J)=>{let G=(W,K)=>{let H=Uo$.createServer((F)=>this.handleForwardedConnection(F,$,Z,Q));H.once("error",(F)=>{if(F.code==="EADDRINUSE"&&K<Lw6){try{H.close()}catch{}let U=mN1+(W-mN1+1)%No$;G(U,K+1);return}J(F)}),H.listen(W,"127.0.0.1",()=>{let F=H.address();if(!F||typeof F==="string"){H.close(),J(Error("port-forward listener failed to bind"));return}let U=F.port;Y({localPort:U,close:()=>H.close((N)=>{if(N)console.warn(`[${I6}] port-forward close on :${U} errored: ${N.message}`)})})})};G(X,0)})}handleForwardedConnection($,Z,Q,X){let Y=new Xw6,J=null,G=!1,W=()=>{if(G)return;if(G=!0,Y.destroy(),J)try{J.close()}catch{}if(!$.destroyed)$.destroy()};$.pipe(Y),$.on("error",W),$.on("close",W),this.portForward.portForward(this.namespace,Z,[Q],$,null,Y).then((K)=>{let H=typeof K==="function"?K():K;if(!H){W();return}if(J=H,J.on("close",W),J.on("error",(F)=>{console.warn(`[${I6}] port-forward to ${Z}:${Q} dropped mid-connection: ${Jo$(F)}`,JSON.stringify(dN1(F))),this.invalidateRecord(X),W()}),G)try{J.close()}catch{}}).catch((K)=>{console.warn(`[${I6}] port-forward to ${Z}:${Q} failed: ${Jo$(K)}`,JSON.stringify(dN1(K))),this.invalidateRecord(X),W()})}closeForwarder($){$.close()}close(){if(this.closed)return;this.closed=!0,this.claimWatchAbort.abort();for(let $ of this.records.values())this.dropRecord($);this.records.clear()}}function Dw6($){return{active:$.createUpDownCounter("studio.sandbox.active",{description:"Active sandbox count, by runner kind, owning org, and daemon impl. Cross-checks the cAdvisor-derived count from the cluster \u2014 divergence between the two indicates orphaned claims (studio deleted but K8s didn't reap) or unattributed pods.",unit:"{sandbox}"}),ensureOutcome:$.createCounter("studio.sandbox.ensure.outcome",{description:"Outcome of each ensure() call: fresh provision, resume from state-store after restart, or adopt of a cluster-side claim studio didn't know about. Cold-start ratio is the primary input for warm-pool sizing.",unit:"{call}"}),proxyDurationMs:$.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of studio-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"}),poolPods:$.createGauge("studio.sandbox.pool.pods",{description:"Tenant warm pool depth by pool and state: ready (warmed and unbound \u2014 what a claim can actually bind instantly), bound (serving a user), pending (unbound, not yet warmed), failed (gave up after repeated bootstrap failures). Alert on sustained ready=0: a pool that is always empty is doing nothing while costing N pods.",unit:"{pod}"})}}function dN1($){let Z=[],Q=$;for(let X=0;X<5&&Q instanceof Error;X++){let Y=Q;if(Z.push({name:Y.name,message:Y.message,...Y.code!==void 0?{code:Y.code}:{},...Y.errno!==void 0?{errno:Y.errno}:{}}),Y.cause===Q)break;Q=Y.cause}if(Q!==void 0&&!(Q instanceof Error)&&Q!==null){let X=Q,Y=X.error instanceof Error?dN1(X.error).chain:void 0;Z.push({nonError:String(Q),...typeof X.type==="string"?{type:X.type}:{},...typeof X.message==="string"?{message:X.message}:{},...X.code!==void 0?{code:X.code}:{},...typeof X.reason==="string"?{reason:X.reason}:{},...Y?{error:Y}:{},...Y===void 0&&X.error!==void 0?{rawError:String(X.error)}:{},keys:Object.keys(X)})}return{chain:Z}}function Ow6(){let $=new $C0;return $.loadFromDefault(),$}function hN1($){return Boolean($.status?.conditions?.some((Z)=>Z.type==="Ready"&&Z.status==="True"))}function uN1($,Z){let Q=$.spec?.env;if(!Q)return null;for(let X of Q)if(X.name===Z&&X.value)return X.value;return null}function jw6($,Z){let Q=Zw6("sha256").update(`${$}:${Z}`).digest();return mN1+Q.readUInt32BE(0)%No$}function Ho$($){let Z=$.slice(0,Ew6);return ww6.test(Z)?Z:""}function Pw6($){if($===void 0)return null;let Z=$.trim();if(Z==="")return null;if(!zw6.test(Z))throw Error(`AgentSandboxProvider: envName=${JSON.stringify(Z)} is not a valid DNS-label-safe environment name (lowercase alphanumeric or '-', starts with a letter, ends alphanumeric, \u226432 chars). Studio sets this from STUDIO_ENV; check the studio chart's configMap.`);return Z}function lN1($,Z={}){let Q={...Z};if($){let X=Ho$($.orgId),Y=Ho$($.userId);if(X)Q[GJ.orgId]=X;if(Y)Q[GJ.userId]=Y}return Q}function Dg($){let Z="";for(let Q of $){let X=Q.codePointAt(0)??0;Z+=X<32||X===127?" ":Q}return Z.slice(0,Tw6)}function Aw6($){try{let Z=new URL($);return Z.username="",Z.password="",Z.toString()}catch{return""}}function Rw6($){let Z={},Q=$.tenant;if(Q?.orgSlug)Z[EF.orgSlug]=Dg(Q.orgSlug);if(Q?.orgName)Z[EF.orgName]=Dg(Q.orgName);if(Q?.userEmail)Z[EF.userEmail]=Dg(Q.userEmail);if(Q?.userName)Z[EF.userName]=Dg(Q.userName);let X=$.repo;if(X){if(X.displayName)Z[EF.gitRepo]=Dg(X.displayName);let Y=Aw6(X.cloneUrl);if(Y)Z[EF.gitRepoUrl]=Dg(Y);let J=$.branch??X.branch;if(J)Z[EF.gitBranch]=Dg(J)}return Z}function qw6($){let Z=$.metadata?.labels;if(!Z)return null;let Q=Z[GJ.orgId],X=Z[GJ.userId];if(!Q||!X)return null;let Y=$.metadata?.annotations??{};return{orgId:Q,userId:X,orgSlug:Y[EF.orgSlug],orgName:Y[EF.orgName],userEmail:Y[EF.userEmail],userName:Y[EF.userName]}}function Mw6($,Z){if($){let Q=new Date($).getTime();if(Number.isFinite(Q)&&Q<=Z.getTime())return null}return Z.toISOString()}function Iw6($,Z){if($){let Q=new Date($).getTime();if(Number.isFinite(Q)&&Q>=Z.getTime())return null}return Z.toISOString()}function cN1($){return{org_id:$?.orgId??"",user_id:$?.userId??"",runner_kind:"agent-sandbox"}}async function Vw6($,Z){if(!Z||!$.tenant)return $.orgFsConfigJson;try{return await Z($.tenant)??$.orgFsConfigJson}catch(Q){return console.warn(`[${I6}] org-fs credential re-mint failed: ${Q instanceof Error?Q.message:String(Q)}`),$.orgFsConfigJson}}function Fo$($){try{let Z=new URL($.cloneUrl);Z.username="",Z.password="";let{submoduleCredentials:Q,credentialExpiresAt:X,...Y}=$;return{...Y,cloneUrl:Z.toString()}}catch{return null}}function kw6($,Z){let{orgFsConfigJson:Q,repo:X,extraRepos:Y,...J}=$,G=J,W=X&&Fo$(X);if(W)G.repo=W;if(Y)G.extraRepos=Y.map(Fo$).filter((K)=>K!==null);return Q||Z?{ensureOpts:G,orgFsRedacted:!0}:{ensureOpts:G}}function Cw6($){let Z={};if($.branch)Z.branch=$.branch;if($.repo)Z.repo=$.repo;if($.workload)Z.workload=$.workload;if($.env&&Object.keys($.env).length>0)Z.env=$.env;if($.tenant)Z.tenant=$.tenant;if($.cloneOnly)Z.cloneOnly=!0;if($.purpose)Z.purpose=$.purpose;if($.sandboxImage)Z.sandboxImage=$.sandboxImage;if($.orgFsConfigJson)Z.orgFsConfigJson=$.orgFsConfigJson;return Object.keys(Z).length>0?Z:null}function Sw6($,Z){try{return new URL(TC0($,Z)).hostname||null}catch{return null}}var I6="AgentSandboxProvider",Yw6="agent-sandbox-system",Jw6="studio-sandbox",Gw6=300000,hN=9000,Go$=3000,VC0="/app",Ww6=32,Kw6,Hw6=900000,Fw6=60000,Uw6=1800000,kC0=3,Wo$=1800000,Nw6=900000,Bw6=1800000,mN1=40000,No$=1e4,Lw6=256,GJ,EF,ww6,Ew6=63,zw6,Tw6=253;var Bo$=L(()=>{$8();Xc$();Vt$();Bg();Ip();$j0();n40();dt$();z60();$o$();MC0();IC0();Kw6=new Set(["DAEMON_TOKEN","DAEMON_BOOT_ID","APP_ROOT","PROXY_PORT"]);GJ={role:"studio.decocms.com/role",sandboxHandle:"studio.decocms.com/sandbox-handle",orgId:"studio.decocms.com/org-id",userId:"studio.decocms.com/user-id",env:"studio.decocms.com/env"},EF={orgSlug:"studio.decocms.com/org-slug",orgName:"studio.decocms.com/org-name",userEmail:"studio.decocms.com/user-email",userName:"studio.decocms.com/user-name",gitRepo:"studio.decocms.com/git-repo",gitRepoUrl:"studio.decocms.com/git-repo-url",gitBranch:"studio.decocms.com/git-branch"},ww6=/^([A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?)?$/;zw6=/^[a-z]([a-z0-9-]{0,30}[a-z0-9])?$/});var Lo$={};J0(Lo$,{tenantPoolSchema:()=>pt$,tenantPoolRepoSchema:()=>E60,tenantPoolFieldsSchema:()=>xN1,tenantPoolAllocations:()=>Vp,resolveTenantPoolBinding:()=>fN1,renderTenantPoolWarmPools:()=>ot$,normalizeRepoUrl:()=>gN,allocationsMatchingPush:()=>yN1,TenantPoolCapacityError:()=>RC0,PREVIEW_NOT_READY_HEADER:()=>Cp,AgentSandboxProvider:()=>iN1});var P60=L(()=>{Bo$();z60()});import{z as Og}from"zod";function CC0($){if(!$||$.trim()==="")return[];let Z=Og.array(_w6).parse(JSON.parse($)),Q=new Set;for(let X of Z){if(Q.has(X.name))throw Error(`tenant pools: duplicate pool name ${X.name}`);Q.add(X.name)}return Z}function Do$($){let Z=gN(`https://github.com/${$.repo}`);if(!Z)throw Error(`tenant pools: bad repo ${$.repo}`);return Z}function Oo$($){return $.map((Z)=>({name:Z.name,tenant:Z.orgId,size:1,image:"default",repos:[{repoUrl:Do$(Z),branch:Z.branch,workload:Z.workload,replicas:1,warmPoolName:Z.name}]}))}function pN1($,Z){let Q=gN(Z.repoUrl)?.toLowerCase(),X=$.find((J)=>J.orgId===Z.tenant&&J.branch===Z.branch&&Do$(J).toLowerCase()===Q);if(!X)return null;let Y=`https://github.com/${X.repo}.git`;return X.connectionId?{cloneUrl:Y,connectionId:X.connectionId}:{cloneUrl:Y}}function jo$($,Z){return async(Q)=>{let X=pN1($,Q);if(!X)return null;return X.connectionId?Z(X):X.cloneUrl}}var _w6;var SC0=L(()=>{P60();_w6=Og.object({name:Og.string().max(63).regex(/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/,"pool name must be a DNS label (lowercase alphanumeric and '-')"),orgId:Og.string().min(1),repo:Og.string().regex(/^[^/\s]+\/[^/\s]+$/,"repo must be `owner/name`"),connectionId:Og.string().min(1).optional(),branch:Og.string().min(1).default("main"),workload:E60.shape.workload})});function aN1($,Z=Date.now()){if($===void 0)return;return $===null?Z+vw6:$.getTime()}function rN1($){return JSON.stringify([$.orgId,$.userId])}function wo$($,Z){let Q=gN(Z);return Q?JSON.stringify([$,Q.toLowerCase()]):null}function fw6($,Z){return"repositoryId"in Z?$.repositoryOrgs.get(Z.repositoryId):$.connectionOrgs.get(Z.connectionId)}function Eo$($){let{records:Z,now:Q}=$,X=new Map,Y=new Map,J=new Map,G=0;for(let W of $.pools)for(let{repoUrl:K,branch:H}of W.repos){let F=wo$(W.tenant,K),U=pN1($.legacyPools??[],{tenant:W.tenant,repoUrl:K,branch:H});if(F&&U?.connectionId){Y.set(F,{tenant:W.tenant,repoUrl:K,connectionId:U.connectionId,cloneUrl:U.cloneUrl});continue}let N=F?Z.orgRepositories.get(F):void 0;if(!F||!N){G++;continue}Y.set(F,{tenant:W.tenant,repoUrl:K,repositoryId:N})}for(let W of $.sandboxes){let K=W.tenant;if(!K)continue;let H=Z.members.get(rN1(K));if(H===void 0){G++;continue}for(let U of W.repos){if(fw6(Z,U)!==K.orgId){G++;continue}let N="repositoryId"in U?{repositoryId:U.repositoryId}:{connectionId:U.connectionId,repo:U.repo.toLowerCase()},B={orgId:K.orgId,userId:K.userId};X.set(JSON.stringify([B,N]),{tenant:B,repo:N})}let F=W.orgFsConfigExpiresAt;if(W.orgFs&&(F===null||F-Q<xw6))J.set(rN1(K),{orgId:K.orgId,userId:K.userId,orgSlug:H})}return{clones:[...X.values()],poolClones:[...Y.values()],orgFs:[...J.values()],refused:G}}async function zo$($,Z,Q){let X=new Set,Y=new Set,J=new Set,G=new Set,W=new Set(Q.map((D)=>D.tenant)),K=new Set;for(let D of Q)for(let{repoUrl:O}of D.repos){let j=tX(O);if(j)K.add(j.path.toLowerCase())}for(let D of Z){if(D.tenant)X.add(D.tenant.orgId),Y.add(D.tenant.userId);for(let O of D.repos)if("repositoryId"in O)G.add(O.repositoryId);else J.add(O.connectionId)}let[H,F,U,N]=await Promise.all([X.size===0?[]:$.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.organizationId as orgId","member.userId as userId","organization.slug as slug"]).where("member.organizationId","in",[...X]).where("member.userId","in",[...Y]).execute(),J.size===0?[]:$.selectFrom("connections").select(["id","organization_id"]).where("id","in",[...J]).execute(),G.size===0?[]:$.selectFrom("repositories").select(["id","organization_id"]).where("id","in",[...G]).execute(),K.size===0?[]:$.selectFrom("repositories").select(["id","organization_id","provider","host","path"]).where("organization_id","in",[...W]).where((D)=>D(D.fn("lower",["path"]),"in",[...K])).execute()]),B=new Map;for(let D of N){let O=wo$(D.organization_id,k80({provider:D.provider,host:D.host,path:D.path}));if(O&&!B.has(O))B.set(O,D.id)}return{members:new Map(H.map((D)=>[rN1(D),D.slug])),connectionOrgs:new Map(F.map((D)=>[D.id,D.organization_id])),repositoryOrgs:new Map(U.map((D)=>[D.id,D.organization_id])),orgRepositories:B}}function oN1($){return $ instanceof Error?$.message:String($)}async function Po$($,Z,Q){let X=0;if($.clones.length>_p||$.poolClones.length>_p||$.orgFs.length>tN1)console.warn(`[sandbox-credential-push] ${$.clones.length} clone, ${$.poolClones.length} pool clone and ${$.orgFs.length} org-fs mints planned; minting the first ${_p}, ${_p} and ${tN1}`);let Y=await E9($.clones.slice(0,_p),nN1,async(U)=>{let N="repositoryId"in U.repo?{cloneUrl:"",repositoryId:U.repo.repositoryId}:{cloneUrl:`https://github.com/${U.repo.repo}.git`,connectionId:U.repo.connectionId};try{let B=await Z.mintCloneUrl(N,{bufferMs:_C0});return B?{tenant:U.tenant,repo:U.repo,cloneUrl:B,expiresAt:Q.now+_C0}:null}catch(B){return X++,console.warn(`[sandbox-credential-push] clone mint failed: ${oN1(B)}`),null}}),J=await E9($.poolClones.slice(0,_p),nN1,async(U)=>{try{let N=await Z.mintCloneUrl("repositoryId"in U?{cloneUrl:"",repositoryId:U.repositoryId}:{cloneUrl:U.cloneUrl,connectionId:U.connectionId},{bufferMs:_C0});return N?{tenant:U.tenant,repoUrl:U.repoUrl,cloneUrl:N,expiresAt:Q.now+_C0}:null}catch(N){return X++,console.warn(`[sandbox-credential-push] pool clone mint failed: ${oN1(N)}`),null}}),G=await E9($.orgFs.slice(0,tN1),nN1,async(U)=>{try{let N=await Z.mintOrgFsConfig(U);return N?{tenant:{orgId:U.orgId,userId:U.userId},orgFsConfigJson:N,expiresAt:Q.now+Q.orgFsLifetimeMs}:null}catch(N){return X++,console.warn(`[sandbox-credential-push] org-fs mint failed: ${oN1(N)}`),null}}),W=Y.filter((U)=>U!==null),K=J.filter((U)=>U!==null),H=G.filter((U)=>U!==null),F=[];for(let U=0;U<Math.max(W.length,K.length,H.length);U+=Pz)F.push({cloneUrls:W.slice(U,U+Pz),poolCloneUrls:K.slice(U,U+Pz),orgFsConfigs:H.slice(U,U+Pz)});return{batches:F,failed:X}}var _C0=2700000,vC0,vw6=86400000,xw6=86400000,nN1=8,_p=2000,tN1=200;var xC0=L(()=>{CF1();P60();r4();$8();zz();SC0();vC0=jl$-3600000});var WJ;var T60=L(()=>{WJ=class WJ extends Error{code;status;path;constructor($,Z,Q){super(Z.message||`Freestyle API error: ${Z.code}`);this.name="FreestyleApiError",this.code=Z.code,this.status=$,this.path=Q,Object.setPrototypeOf(this,WJ.prototype)}}});function To$(){return typeof process<"u"&&Boolean(process.versions?.node)}var fC0=($,Z)=>globalThis.fetch($,Z);async function bw6(){if(!To$())return null;try{return await import("undici")}catch{return null}}async function gw6(){let $=await bw6();if(!$)return null;let Z=new $.Agent({allowH2:!0,connections:yw6});return(Q,X)=>$.fetch(Q,{...X,dispatcher:Z})}function hw6($){return(typeof $==="string"?$:$ instanceof URL?$.href:$.url).startsWith("https:")}function Ao$(){let $,Z=()=>{return $??=gw6().then((Q)=>Q??fC0).catch(()=>fC0),$};return(Q,X)=>hw6(Q)?Z().then((Y)=>Y(Q,X)):fC0(Q,X)}var yw6=4;var Ro$=()=>{};function iw6($){return new Promise((Z)=>setTimeout(Z,$))}function pw6($){if(!$)return"";let Z=new URLSearchParams;for(let[X,Y]of Object.entries($)){if(Y===void 0||Y===null)continue;Z.set(X,String(Y))}let Q=Z.toString();return Q?`?${Q}`:""}function p6($){return encodeURIComponent($)}class sN1{baseUrl;authenticationHeaders;fetchImpl;backgroundEligible;constructor($={}){if(this.baseUrl=($.baseUrl??dw6).replace(/\/+$/,""),!$.fetch&&!globalThis.fetch)throw Error("No fetch implementation available. Pass `fetch` in FreestyleOptions when running on a runtime without a global fetch.");if(this.fetchImpl=$.fetch??Ao$(),"identityAccessToken"in $&&$.identityAccessToken){this.authenticationHeaders={[uw6]:$.identityAccessToken},this.backgroundEligible=!1;return}if(this.backgroundEligible=!0,"stackAccessToken"in $&&$.stackAccessToken){this.authenticationHeaders={Authorization:`Bearer ${$.stackAccessToken}`,"X-Freestyle-Team-Id":$.teamId};return}let Z=$.apiKey??globalThis.process?.env?.FREESTYLE_API_KEY;if(!Z)throw Error("No Freestyle API key provided. Pass `apiKey` in FreestyleOptions or set FREESTYLE_API_KEY.");this.authenticationHeaders={Authorization:`Bearer ${Z}`}}authHeaders(){return{...this.authenticationHeaders}}url($,Z){return`${this.baseUrl}${$}${pw6(Z)}`}async fetch($,Z={}){let Q=new Headers(Z.headers);for(let[X,Y]of Object.entries(this.authHeaders()))if(!Q.has(X))Q.set(X,Y);return this.fetchImpl(this.absoluteUrl($),{...Z,headers:Q})}absoluteUrl($){return/^https?:\/\//i.test($)?$:`${this.baseUrl}${$}`}async request($,Z,{query:Q,body:X,rawBody:Y,signal:J}={}){let G={...this.authHeaders()};if(this.backgroundEligible)G[qo$]=String(cw6);let W;if(Y!==void 0)G["Content-Type"]="application/octet-stream",W=Y;else if(X!==void 0)G["Content-Type"]="application/json",W=JSON.stringify(X);let K=this.url(Z,Q),H=await this.fetchImpl(K,{method:$,headers:G,body:W,signal:J});if(this.backgroundEligible&&H.status===202)try{return await this.pollBackgroundRequest(H,Z)}catch(F){if($==="GET"&&F instanceof WJ&&F.code==="BACKGROUND_RESULT_UNSTORABLE"){delete G[qo$];let U=await this.fetchImpl(K,{method:$,headers:G,body:W});return this.finalize(U,Z)}throw F}return this.finalize(H,Z)}async pollBackgroundRequest($,Z){let Q=await $.json().catch(()=>({})),X=$.headers.get(lw6)??Q.requestId,Y=Q.resultUrl??(X?`/v5/background-requests/${p6(X)}`:void 0);if(!Y)throw new WJ($.status,{code:"BACKGROUND_PROTOCOL_ERROR",message:"202 Accepted carried no background request id"},Z);let J=0;for(;;){await iw6(mw6);let G;try{G=await this.fetch(Y,{method:"GET"}),J=0}catch(W){if(++J>=5)throw W;continue}if(G.status===202)continue;return this.finalize(G,Z)}}async finalize($,Z){if(!$.ok){let X;try{X=await $.json()}catch{X={code:"UNKNOWN_ERROR",message:await $.text().catch(()=>$.statusText)}}throw new WJ($.status,X,Z)}if($.status===204)return;let Q=await $.text();if(!Q)return;return JSON.parse(Q)}get($,Z){return this.request("GET",$,{query:Z})}post($,Z){return this.request("POST",$,{body:Z??{}})}patch($,Z){return this.request("PATCH",$,{body:Z??{}})}put($,Z){return this.request("PUT",$,{body:Z??{}})}putEmpty($){return this.request("PUT",$,{})}putBytes($,Z,Q,X){return this.request("PUT",$,{query:Q,rawBody:Z,signal:X})}async getBytes($,Z,Q={}){let X={...this.authHeaders()};if(Q.range)X.Range=Q.range;let Y=await this.fetchImpl(this.url($,Z),{method:"GET",headers:X,signal:Q.signal});if(!Y.ok){let J;try{J=await Y.json()}catch{J={code:"UNKNOWN_ERROR",message:await Y.text().catch(()=>Y.statusText)}}throw new WJ(Y.status,J,$)}return Y}delete($,Z){return this.request("DELETE",$,{query:Z})}}var uw6="x-freestyle-identity-access-token",qo$="x-freestyle-background-after-secs",lw6="x-freestyle-background-request-id",cw6=5,mw6=2000,dw6="https://api.freestyle.sh";var PK=L(()=>{T60();Ro$()});class eN1{client;verifications;certificates;placeholder;constructor($){this.client=$,this.verifications=new Mo$($),this.certificates=new Io$($),this.placeholder=new Vo$($)}async list(){let{domains:$}=await this.client.get("/v5/domains");return $}}class Mo${client;constructor($){this.client=$}create($){return this.client.post("/v5/verifications",{domain:$})}async list($={}){let{verifications:Z}=await this.client.get("/v5/verifications",$);return Z}get($){return this.client.get(`/v5/verifications/${p6($)}`)}complete($){return this.client.putEmpty(`/v5/verifications/${p6($)}`)}delete($){return this.client.delete(`/v5/verifications/${p6($)}`)}}class Io${client;constructor($){this.client=$}async list(){let{certificates:$}=await this.client.get("/v5/certificates");return $}createWildcard($){return this.client.post("/v5/certificates/wildcard",{domain:$})}}class Vo${client;constructor($){this.client=$}async get(){try{return await this.client.get("/v5/domains/placeholder")}catch($){if($ instanceof WJ&&$.status===404)return null;throw $}}set($){return this.client.put("/v5/domains/placeholder",$)}delete(){return this.client.delete("/v5/domains/placeholder")}}var $B1=L(()=>{PK();T60()});function J5($,Z){throw new QB1($,Z)}function ZB1($){return nw6.some((Z)=>$[Z]!==void 0)}function XB1($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function ow6($,Z){let Q=Z.lastIndexOf("/");if(Q<0)J5($,`${$} \`${Z}\` is not a CIDR: expected address/prefix, e.g. 203.0.113.0/24 or 2001:db8::/32`);let X=Z.slice(0,Q),Y=Z.slice(Q+1);if(!/^\d+$/.test(Y))J5($,`${$} \`${Z}\`: prefix length must be a number`);let J=Number(Y),G=X.includes(":"),W=G?128:32;if(J>W)J5($,`${$} \`${Z}\`: prefix length must be 0\u2013${W}`);if(!G&&!/^\d{1,3}(\.\d{1,3}){3}$/.test(X))J5($,`${$} \`${Z}\`: \`${X}\` is not an IP address`)}function _o$($,Z){if(!XB1($))J5(Z,`${Z} must be an object`);for(let X of Object.keys($))if(!ko$.includes(X))J5(`${Z}.${X}`,`${Z} has unknown field \`${X}\`. Expected one of: ${ko$.join(", ")}`);let Q=$;for(let X of["vmId","vpcId","tunnelId","cidr"]){let Y=Q[X];if(Y!==void 0&&(typeof Y!=="string"||Y.length===0))J5(`${Z}.${X}`,`${Z}.${X} must be a non-empty string`)}if(Q.public!==void 0&&Q.public!==!0)J5(`${Z}.public`,`${Z}.public must be true when present: it declares the public Internet. Omit the field to match something else`);if(Q.public===!0){if(Q.vmId!==void 0)J5(`${Z}.public`,`${Z} cannot combine \`public: true\` with \`vmId\`: that would mean the VM only when reached over its public address, a distinction this API does not make yet. Use \`vmId\` alone to match the VM on any path, or \`public: true\` alone to match public addresses`);if(Q.vpcId!==void 0)J5(`${Z}.public`,`${Z} cannot combine \`public: true\` with \`vpcId\`: that would mean the network's members only when reached over their public addresses, a distinction this API does not make yet. Use \`vpcId\` alone or \`public: true\` alone`);if(Q.tunnelId!==void 0)J5(`${Z}.public`,`${Z} cannot combine \`public: true\` with \`tunnelId\`: traffic through a tunnel arrives over the tunnel, not over the public Internet. Use \`tunnelId\` alone`)}if(Q.cidr!==void 0)ow6(`${Z}.cidr`,Q.cidr);if(Q.protocol!==void 0&&!Co$.includes(Q.protocol))J5(`${Z}.protocol`,`${Z}.protocol must be one of: ${Co$.join(", ")} (got \`${String(Q.protocol)}\`)`);if(Q.port!==void 0){if(!Number.isInteger(Q.port)||Q.port<1||Q.port>65535)J5(`${Z}.port`,`${Z}.port must be an integer between 1 and 65535`);if(Q.protocol===void 0)J5(`${Z}.protocol`,`${Z}.port ${Q.port} requires ${Z}.protocol: set it to "tcp" or "udp" so the rule opens one transport rather than both`);if(!tw6.includes(Q.protocol))J5(`${Z}.port`,`${Z}.protocol "${Q.protocol}" has no ports; remove ${Z}.port ${Q.port}`)}}function fo$($,Z){if(!XB1($))J5(Z||"rule",`${Z||"rule"} must be an object`);for(let X of Object.keys($))if(!vo$.includes(X))J5(`${Z}${X}`,`Unknown field \`${X}\`. Expected one of: ${vo$.join(", ")}`);let Q=$;if(Q.action===void 0)J5(`${Z}action`,`${Z}action is required. Write \`action: "allow"\` \u2014 every rule states what it does rather than defaulting to it`);if(Q.action!=="allow")J5(`${Z}action`,`${Z}action must be "allow" (got \`${String(Q.action)}\`). Only allow rules exist today`);if(Q.description!==void 0){if(typeof Q.description!=="string")J5(`${Z}description`,"description must be a string");if(Q.description.length>So$)J5(`${Z}description`,`description is too long (${Q.description.length} characters, maximum ${So$})`)}if(Q.source===void 0)J5(`${Z}source`,`${Z}source is required`);if(Q.destination===void 0)J5(`${Z}destination`,`${Z}destination is required`);return _o$(Q.source,`${Z}source`),_o$(Q.destination,`${Z}destination`),Q}function rw6($){let Z=fo$($,"");for(let Q of["source","destination"]){let X=Z[Q];if(ZB1(X))continue;let Y=[X.port!==void 0?`port ${X.port}`:void 0,X.protocol!==void 0?`protocol ${X.protocol}`:void 0].filter(Boolean).join(", ");J5(Q,Y?`${Q} only narrows traffic (${Y}) without saying what it is. Add \`vmId\`, \`vpcId\`, \`tunnelId\`, \`cidr\`, or \`public: true\`. Leaving it out to mean "this VM" only works inside vms.create`:`${Q} is empty. A matcher must say what the traffic is: \`vmId\`, \`vpcId\`, \`tunnelId\`, \`cidr\`, or \`public: true\` for the public Internet`)}return Z}function bC0($,Z="VM"){if($===void 0||$===null)J5("firewall",`firewall is required on a ${Z} create. A ${Z} gets nothing implicitly, so state what it may reach \u2014 \`{ rules: [] }\` if the answer is nothing`);if(!XB1($))J5("firewall","firewall must be an object with a `rules` array");for(let X of Object.keys($))if(X!=="rules")J5(`firewall.${X}`,`firewall has unknown field \`${X}\`. Expected: rules`);let Q=$.rules;if(!Array.isArray(Q))J5("firewall.rules","firewall.rules must be an array");return Q.forEach((X,Y)=>{let J=`firewall.rules[${Y}].`,G=fo$(X,J),W=ZB1(G.source),K=ZB1(G.destination);if(!W&&!K&&Z!=="network")J5(`firewall.rules[${Y}]`,`firewall.rules[${Y}]: both source and destination refer to the ${Z} being created, which allows nothing. Give one of them a \`vmId\`, \`vpcId\`, \`tunnelId\`, \`cidr\`, or \`public: true\``);if(W&&K)J5(`firewall.rules[${Y}]`,`firewall.rules[${Y}]: neither end refers to the ${Z} being created. Leave one endpoint's identity unset so it means this ${Z}, or create the rule with firewall.rules.create instead`)}),$}function xo$($){return`/v5/firewall/rules/${p6($)}`}class bo${client;constructor($){this.client=$}async create($){let Z=rw6($);return this.client.post("/v5/firewall/rules",Z)}list($={}){return this.client.get("/v5/firewall/rules",$)}get($){return this.client.get(xo$($))}delete($){return this.client.delete(xo$($))}}class YB1{client;rules;constructor($){this.client=$,this.rules=new bo$($)}evaluate($){return this.client.post("/v5/firewall/evaluate",$)}}var QB1,ko$,nw6,Co$,tw6,So$=1024,vo$;var A60=L(()=>{PK();QB1=class QB1 extends Error{path;constructor($,Z){super(Z);this.name="FirewallRuleValidationError",this.path=$,Object.setPrototypeOf(this,QB1.prototype)}};ko$=["vmId","vpcId","tunnelId","cidr","public","port","protocol"],nw6=["vmId","vpcId","tunnelId","cidr","public"],Co$=["tcp","udp","icmp"],tw6=["tcp","udp"];vo$=["action","source","destination","description"]});function JB1($){return`/v5/identities/${p6($)}`}class yo${client;basePath;constructor($,Z){this.client=$,this.basePath=Z}create(){return this.client.post(`${this.basePath}/tokens`)}list(){return this.client.get(`${this.basePath}/tokens`)}revoke($){return this.client.delete(`${this.basePath}/tokens/${p6($)}`)}}class go${client;basePath;constructor($,Z){this.client=$,this.basePath=Z}list(){return this.client.get(`${this.basePath}/permissions/vm`)}grant($){return this.client.post(`${this.basePath}/permissions/vm`,$)}get($){return this.client.get(`${this.basePath}/permissions/vm/${p6($)}`)}update($,Z){return this.client.patch(`${this.basePath}/permissions/vm/${p6($)}`,{allowedLinuxUsers:Z})}revoke($){return this.client.delete(`${this.basePath}/permissions/vm/${p6($)}`)}}class GB1{id;tokens;permissions;client;basePath;constructor($,Z){this.client=$,this.id=Z,this.basePath=JB1(Z),this.tokens=new yo$($,this.basePath),this.permissions={vm:new go$($,this.basePath)}}data(){return this.client.get(this.basePath)}delete(){return this.client.delete(this.basePath)}}class WB1{client;constructor($){this.client=$}async create($={}){let Z=await this.client.post("/v5/identities",$);return{identity:new GB1(this.client,Z.id),identityId:Z.id,data:Z}}list($={}){return this.client.get("/v5/identities",$)}get($){return this.client.get(JB1($))}ref($){return new GB1(this.client,$)}delete($){return this.client.delete(JB1($))}}var KB1=L(()=>{PK()});function b1($,Z){throw new NB1($,Z)}function L7($,Z){throw new BB1($,Z)}function R60($){return aw6.some((Z)=>$[Z]!==void 0)}function JE6($){return!R60($)&&$.port===void 0}function XY($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function so$($,Z,Q){if(typeof $!=="string"||!ZE6.test($))L7(Z,`${Z} must be a valid HTTP header name`);let X=$.toLowerCase();if(YE6.has(X)||X.startsWith("x-forwarded-")||X.startsWith("x-freestyle-")||Q&&(X==="cookie"||X==="set-cookie"))L7(Z,`${Z} may not use reserved header \`${$}\``)}function GE6($,Z){if(!Array.isArray($))L7(Z,`${Z} must be an array of header names`);if($.length>io$)L7(Z,`${Z} may contain at most ${io$} names`);let Q=new Set;$.forEach((X,Y)=>{so$(X,`${Z}[${Y}]`,!0);let J=X.toLowerCase();if(Q.has(J))L7(`${Z}[${Y}]`,`${Z} contains duplicate header \`${X}\``);Q.add(J)})}function no$($){if(!XY($))L7("forwardAuth","forwardAuth must be an object");for(let X of Object.keys($))if(!lo$.includes(X))L7(X,`Unknown field \`${X}\`. Expected one of: ${lo$.join(", ")}`);let Z=$;if(typeof Z.url!=="string"||Z.url.length===0||Z.url.length>QE6)L7("url","url is required and must be an absolute HTTPS URL");let Q;try{Q=new URL(Z.url)}catch{L7("url","url must be an absolute HTTPS URL")}if(Q.protocol!=="https:"||Q.hostname.length===0||Q.username.length>0||Q.password.length>0||Q.hash.length>0||Q.port==="0")L7("url","url must be an absolute HTTPS URL");if(Z.headers!==void 0){if(!XY(Z.headers))L7("headers","headers must be an object of header name to value");let X=Object.entries(Z.headers);if(X.length>mo$)L7("headers",`headers may contain at most ${mo$} entries`);let Y=0,J=new Set;for(let[G,W]of X){so$(G,`headers.${G}`,!1);let K=G.toLowerCase();if(J.has(K))L7(`headers.${G}`,`headers contains duplicate header \`${G}\``);if(J.add(K),typeof W!=="string"||/[\0\r\n]/.test(W))L7(`headers.${G}`,`headers.${G} must be a string`);Y+=G.length+W.length}if(Y>do$)L7("headers",`headers may contain at most ${do$} bytes`)}if(Z.timeoutMs!==void 0&&(!Number.isInteger(Z.timeoutMs)||Z.timeoutMs<100||Z.timeoutMs>5000))L7("timeoutMs","timeoutMs must be an integer between 100 and 5000");if(Z.protectedCookies!==void 0){if(!Array.isArray(Z.protectedCookies))L7("protectedCookies","protectedCookies must be an array of cookie names");if(Z.protectedCookies.length>po$)L7("protectedCookies",`protectedCookies may contain at most ${po$} names`);let X=new Set;Z.protectedCookies.forEach((Y,J)=>{if(typeof Y!=="string"||Y.length>XE6||!$E6.test(Y))L7(`protectedCookies[${J}]`,`protectedCookies[${J}] must be a valid HTTP cookie name`);if(X.has(Y))L7(`protectedCookies[${J}]`,`protectedCookies contains duplicate cookie \`${Y}\``);X.add(Y)})}if(Z.authResponseHeaders!==void 0)GE6(Z.authResponseHeaders,"authResponseHeaders");return Z}function WE6($,Z){if(!XY($))b1(Z,`${Z} must be an object with an \`id\``);for(let X of Object.keys($))if(!co$.includes(X))b1(`${Z}.${X}`,`${Z} has unknown field \`${X}\`. Expected: ${co$.join(", ")}`);let Q=$.id;if(typeof Q!=="string"||Q.length===0)b1(`${Z}.id`,`${Z}.id is required and must be a non-empty string`)}function UB1($){if(typeof $!=="string")b1("domain","domain is required and must be a string");if($==="*")return;let Z=$.startsWith("*.")?$.slice(2):$;if(Z.length===0||Z.length>sw6)b1("domain",`domain \`${$}\` is not a hostname`);let Q=Z.split(".");if(Q.length<2)b1("domain",`domain \`${$}\` must have at least two labels, e.g. acme.com`);for(let X of Q){if(X.length===0||X.length>ew6)b1("domain",`domain \`${$}\` has an empty or over-long label`);if(!/^[a-z0-9-]+$/.test(X))b1("domain",`domain \`${$}\`: labels are lowercase letters, digits, and hyphens (a \`*.\` prefix is the only wildcard)`);if(X.startsWith("-")||X.endsWith("-"))b1("domain",`domain \`${$}\`: a label cannot start or end with a hyphen`)}}function KE6($){if(typeof $!=="string")b1("domain","domain is required and must be a string");let Z=$.lastIndexOf("@");if(Z===-1){UB1($);return}let Q=$.slice(0,Z),X=$.slice(Z+1);if(Q.length===0||Q.length>64)b1("domain",`mail route \`${$}\`: the part before \`@\` must be 1-64 characters`);if(Q.startsWith(".")||Q.endsWith(".")||Q.includes(".."))b1("domain",`mail route \`${$}\`: the part before \`@\` cannot start or end with a dot, or contain \`..\``);for(let Y of Q)if(!/[a-zA-Z0-9]/.test(Y)&&!to$.includes(Y))b1("domain",`mail route \`${$}\`: the part before \`@\` may use letters, digits, dots, and \`${to$.slice(0,-1)}\` (quoted mailboxes are not supported)`);if(X==="*")b1("domain",`mail route \`${$}\`: \`*\` is not a mail domain \u2014 name the domain the mailbox lives at`);UB1(X)}function oo$($,Z){if(!XY($))b1(Z,`${Z} must be an object`);for(let X of Object.keys($))if(!ho$.includes(X))b1(`${Z}.${X}`,`${Z} has unknown field \`${X}\`. Expected one of: ${ho$.join(", ")}`);let Q=$;for(let X of["vmId","vpcId","host"]){let Y=Q[X];if(Y!==void 0&&(typeof Y!=="string"||Y.length===0))b1(`${Z}.${X}`,`${Z}.${X} must be a non-empty string`)}if(Q.public!==void 0&&Q.public!==!0)b1(`${Z}.public`,`${Z}.public must be true when present. Omit the field to match something else`);if(Z==="source"){if(Q.host!==void 0)b1("source.host","source.host is not allowed: a source is who opens the session, not where it lands. Put `host` on the destination");if(Q.port!==void 0)b1("source.port","source.port is not allowed: a source is who opens the session, not where it lands. Put `port` on the destination");if(Q.public===!0&&(Q.vmId!==void 0||Q.vpcId!==void 0))b1("source.public","source cannot combine `public: true` with `vmId` or `vpcId`: use one alone. `public` is every client on the Internet; `vmId`/`vpcId` is a specific dialer")}else{if(Q.vpcId!==void 0)b1("destination.vpcId","destination.vpcId is not allowed: a session lands in one place, not on a whole network. Name a `vmId`, a `host`, or `public: true` for the domain's own origin. A whole network may be a source");if([Q.vmId!==void 0,Q.host!==void 0,Q.public===!0].filter(Boolean).length>1)b1("destination","destination names more than one landing: give exactly one of `vmId`, `host`, or `public: true`");if((Q.vmId!==void 0||Q.host!==void 0)&&Q.port===void 0)b1("destination.port",`destination.port is required with ${Q.vmId!==void 0?"`vmId`":"`host`"}: say which port the session lands on`)}if(Q.port!==void 0){if(!Number.isInteger(Q.port)||Q.port<1||Q.port>65535)b1(`${Z}.port`,`${Z}.port must be an integer between 1 and 65535`)}}function HE6($){if("postgres"in $)return"postgres";if("smtp"in $)return"smtp";if("socks5"in $)return"socks5";return"http"}function FE6($,Z){function Q(W,K,H){if(!XY(W)||Object.keys(W).some((F)=>!K.includes(F)))b1(H,`${H} must contain only ${K.join(", ")}`)}if(Q($,["region","credentials","scope"],Z),typeof $.region!=="string"||!/^[a-z0-9-]{1,63}$/.test($.region))b1(`${Z}.region`,"invalid s3.region");Q($.credentials,["accessKeyId","secretAccessKey","sessionToken"],`${Z}.credentials`);for(let W of["accessKeyId","secretAccessKey","sessionToken"]){let K=$.credentials[W];if(W==="sessionToken"&&K===void 0)continue;if(typeof K!=="string"||!/^[\x21-\x7e]{1,16384}$/.test(K))b1(`${Z}.credentials.${W}`,"invalid s3 credentials")}if(!/^[a-zA-Z0-9]+$/.test($.credentials.accessKeyId))b1(`${Z}.credentials.accessKeyId`,"invalid s3 access key id");Q($.scope,["bucket","prefix","operations"],`${Z}.scope`);let{bucket:X,prefix:Y,operations:J}=$.scope;if(typeof X!=="string"||!/^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/.test(X)||X.includes(".."))b1(`${Z}.scope.bucket`,"invalid s3.scope.bucket");if(typeof Y!=="string"||Buffer.byteLength(Y,"utf8")>1024||/[\x00-\x1f\x7f-\x9f]/u.test(Y))b1(`${Z}.scope.prefix`,"invalid s3.scope.prefix");let G=["GetObject","HeadObject","PutObject","DeleteObject","ListObjectsV2","CreateMultipartUpload","UploadPart","ListParts","CompleteMultipartUpload","AbortMultipartUpload","ListMultipartUploads"];if(!Array.isArray(J)||J.length===0||J.length>G.length||J.some((W)=>!G.includes(W))||new Set(J).size!==J.length)b1(`${Z}.scope.operations`,"s3.scope.operations must be a nonempty list of distinct supported operations")}function UE6($,Z){if(!XY($))b1(Z,`${Z} must be an object: \`{ headers: { \u2026 } }\`, \`{ postgres: { \u2026 } }\`, \`{ smtp: { \u2026 } }\` or \`{ socks5: { \u2026 } }\``);let Q=Object.keys($);if(Q.length!==1||!["headers","jsonPatch","postgres","smtp","socks5","s3"].includes(Q[0]??""))b1(Z,`${Z} must have exactly one of \`headers\`, \`jsonPatch\`, \`postgres\`, \`smtp\`, \`socks5\` or \`s3\` (got: ${Q.length===0?"nothing":Q.join(", ")})`);if(Q[0]==="s3"){FE6($.s3,`${Z}.s3`);return}if(Q[0]==="jsonPatch"){let X=$.jsonPatch;if(!Array.isArray(X)||X.length>128)b1(Z,`${Z}.jsonPatch must be an array of at most 128 operations`);let Y=(W)=>typeof W==="string"&&(W===""||W.startsWith("/"))&&!/~(?:[^01]|$)/u.test(W),J=(W,K=new Set,H=0)=>{if(H>64)return!1;if(W===null||typeof W==="string"||typeof W==="boolean")return!0;if(typeof W==="number")return Number.isFinite(W);if(typeof W!=="object"||K.has(W))return!1;K.add(W);let F=(Array.isArray(W)?Array.from(W):XY(W)?Object.values(W):[void 0]).every((U)=>J(U,K,H+1));return K.delete(W),F};for(let[W,K]of X.entries()){if(!XY(K)||!["add","remove","replace","move","copy","test"].includes(String(K.op))||!Y(K.path))b1(Z,`${Z}.jsonPatch[${W}] requires a standard op and valid JSON Pointer path`);if(["move","copy"].includes(K.op)&&!Y(K.from))b1(Z,`${Z}.jsonPatch[${W}].from must be a JSON Pointer`);if(["add","replace","test"].includes(K.op)&&(!Object.hasOwn(K,"value")||!J(K.value)))b1(Z,`${Z}.jsonPatch[${W}].value must be a JSON value (null is allowed)`)}let G;try{G=JSON.stringify(X)}catch{b1(Z,"jsonPatch must be JSON serializable")}if(Buffer.byteLength(G,"utf8")>65536)b1(Z,"jsonPatch exceeds 64 KiB");return}if(Q[0]==="socks5"){let X=$.socks5;if(!XY(X))b1(`${Z}.socks5`,`${Z}.socks5 must be an object with \`username\` and \`password\``);for(let Y of Object.keys(X))if(!["username","password"].includes(Y))b1(`${Z}.socks5.${Y}`,`${Z}.socks5 has unknown field \`${Y}\`. Expected: username, password`);for(let Y of["username","password"])if(typeof X[Y]!=="string"||X[Y].length===0)b1(`${Z}.socks5.${Y}`,`${Z}.socks5.${Y} is required and must be a non-empty string`);return}if(Q[0]==="smtp"){let X=$.smtp;if(!XY(X))b1(`${Z}.smtp`,`${Z}.smtp must be an object with \`username\` and \`password\``);for(let Y of Object.keys(X))if(!["username","password"].includes(Y))b1(`${Z}.smtp.${Y}`,`${Z}.smtp has unknown field \`${Y}\`. Expected: username, password`);for(let Y of["username","password"])if(typeof X[Y]!=="string"||X[Y].length===0)b1(`${Z}.smtp.${Y}`,`${Z}.smtp.${Y} is required and must be a non-empty string`);return}if(Q[0]==="headers"){let X=$.headers;if(!XY(X))b1(`${Z}.headers`,`${Z}.headers must be an object of header name to value`);for(let[Y,J]of Object.entries(X))if(typeof J!=="string")b1(`${Z}.headers.${Y}`,`${Z}.headers.${Y} must be a string`)}else{let X=$.postgres;if(!XY(X))b1(`${Z}.postgres`,`${Z}.postgres must be an object with \`username\` and \`password\``);for(let J of Object.keys(X))if(!["username","password","database"].includes(J))b1(`${Z}.postgres.${J}`,`${Z}.postgres has unknown field \`${J}\`. Expected: username, password, database`);let Y=X;for(let J of["username","password"])if(typeof Y[J]!=="string"||Y[J].length===0)b1(`${Z}.postgres.${J}`,`${Z}.postgres.${J} is required and must be a non-empty string`);if(Y.database!==void 0&&typeof Y.database!=="string")b1(`${Z}.postgres.database`,`${Z}.postgres.database must be a string`)}}function NE6($,Z){let Q=$;return Z.forEach((X,Y)=>{let J=HE6(X);if(Q===void 0)Q=J;else if(Q!==J)b1(`transform[${Y}]`,`transform requires protocol \`${J}\` but the rule is \`${Q}\`; a rule terminates one protocol`)}),Q??"http"}function BE6($,Z){if(!XY($)||Object.keys($).some((Q)=>Q!=="method"&&Q!=="path"))b1(Z,`${Z} must be an object containing only method and path`);if($.method!==void 0&&(!Array.isArray($.method)||$.method.some((Q)=>typeof Q!=="string"||Q.length===0||/[^!#$%&'*+.^_`|~0-9A-Za-z-]/.test(Q))))b1(`${Z}.method`,`${Z}.method must be an array of HTTP method tokens`);if($.path!==void 0){let Q=$.path;if(!XY(Q)||Object.keys(Q).length!==1||typeof Q.exact!=="string"||!Q.exact.startsWith("/")||/[\s?#]/.test(Q.exact))b1(`${Z}.path`,`${Z}.path must contain exact: an absolute path without a query or fragment`)}}function eo$($,Z){if(!XY($))b1(Z||"rule",`${Z||"rule"} must be an object`);for(let H of Object.keys($))if(!ro$.includes(H))b1(`${Z}${H}`,`Unknown field \`${H}\`. Expected one of: ${ro$.join(", ")}`);let Q=$;if(Q.action===void 0)b1(`${Z}action`,`${Z}action is required. Write \`action: "allow"\` \u2014 every rule states what it does rather than defaulting to it`);if(Q.action!=="allow")b1(`${Z}action`,`${Z}action must be "allow" (got \`${String(Q.action)}\`). Only allow rules exist today`);if(Q.protocol!==void 0&&!uo$.includes(Q.protocol))b1(`${Z}protocol`,`${Z}protocol must be one of: ${uo$.join(", ")} (got \`${String(Q.protocol)}\`)`);let X=Q.source??{},Y=Q.destination??{};oo$(X,"source"),oo$(Y,"destination");let J=Q.transform??[];if(!Array.isArray(J))b1(`${Z}transform`,`${Z}transform must be an array`);J.forEach((H,F)=>UE6(H,`${Z}transform[${F}]`));let G=NE6(Q.protocol,J);if(Q.match!==void 0){if(BE6(Q.match,`${Z}match`),G!=="http"||X.public===!0||!(Y.public===!0||Y.host!==void 0))b1(`${Z}match`,"match requires HTTP egress from a VM or VPC to a public origin or host")}if(J.some((H)=>("s3"in H))){if(J.length!==1||Q.match!==void 0||X.public===!0||!(Y.public===!0||Y.host!==void 0)||Q.domain.includes("*"))b1(`${Z}transform`,"s3 requires a sole transform on HTTP egress to a concrete origin, without match")}let W=J.filter((H)=>("jsonPatch"in H));if(W.length>1)b1(`${Z}transform`,"a rule may carry only one jsonPatch transform");if(W.length&&(X.public===!0||!(Y.public===!0||Y.host!==void 0)))b1(`${Z}transform`,"jsonPatch requires HTTP egress from a VM or VPC to a public origin or host");if(Q.forwardAuth!==void 0){WE6(Q.forwardAuth,`${Z}forwardAuth`);let H=Y.vmId!==void 0||!R60(Y)&&Y.port!==void 0;if(G!=="http"||X.public!==!0||!H||Q.domain==="*")b1(`${Z}forwardAuth`,`${Z}forwardAuth is only supported on HTTP public ingress: \`{ public: true } -> { vmId, port }\``)}if(G==="smtp")KE6(Q.domain);else UB1(Q.domain);if((X.vmId!==void 0||X.vpcId!==void 0)&&Y.vmId!==void 0&&J.length>0)b1(`${Z}transform`,"a VM-to-VM rule cannot carry a transform yet \u2014 remove it (only public ingress/egress rules run transforms)");if(G==="tcp"){let H=Y.public===!0||Y.host!==void 0,F=X.vmId!==void 0||X.vpcId!==void 0;if(H||F)b1(`${Z}protocol`,"a `tcp` rule is public ingress only \u2014 `{ public: true } -> { vmId, port }`. The edge splices the session without terminating it, so outbound there is nothing to broker (an outbound allow is a firewall rule, and injecting into one needs `http` or `postgres`) and inward there is no certificate to answer the source with. Give the source `public: true`, or drop `protocol` to be served as HTTPS")}else if(G==="imap"||G==="imaps"){let H=Y.public===!0||Y.host!==void 0,F=X.vmId!==void 0||X.vpcId!==void 0;if(H||F)b1(`${Z}protocol`,`an \`${G}\` rule is public ingress only \u2014 \`{ public: true } -> { vmId, port }\`. The 993 front serves mail clients reaching a VM's IMAP server; outbound there is nothing to broker (an outbound allow is a firewall rule) and inward there is no certificate to answer the source with`)}else if(G==="socks5"){let H=Y.public===!0||Y.host!==void 0;if(X.public===!0||!H)b1(`${Z}protocol`,'a `socks5` rule is egress only \u2014 `{ vmId } -> { host: "gate.provider.com", port: 1080 }`. The front exists so a guest can open sessions through a proxy whose credentials it never holds; inbound there is nothing to serve, and publishing one would be an open proxy on a platform address');if(Y.host===void 0)b1(`${Z}destination`,"a `socks5` rule has to name the proxy it goes through: give the destination a `host` and the `port` the provider listens on. `{ public: true }` on its own asks the edge to be the proxy, which would let the guest out on our address rather than through yours")}else if(G==="postgres"){let H=J.some((U)=>U!==null&&typeof U==="object"&&("postgres"in U)),F=Y.public===!0||Y.host!==void 0;if(H&&!F)b1(`${Z}transform`,"a `postgres` transform belongs on an egress rule: the edge spends a credential the guest never holds, so pointing it at your own VM would hand every client a logged-in session. Give the destination `public: true` or a `host`, or drop the transform")}else if(G==="smtp"){let H=J.some((U)=>U!==null&&typeof U==="object"&&("smtp"in U)),F=Y.public===!0||Y.host!==void 0;if(H&&!F)b1(`${Z}transform`,"an `smtp` transform belongs on an egress rule: the edge spends a credential the guest never holds, so pointing it at your own VM would turn it into an open relay. Give the destination `public: true` or a `host`, or drop the transform");if(typeof Q.domain==="string"&&Q.domain.includes("@")&&X.public!==!0)b1(`${Z}domain`,`\`${Q.domain}\` names a mailbox, which only makes sense on a rule that receives mail. An egress or VM-to-VM rule names the host the guest submits through \u2014 drop the part before \`@\``)}return{...Q,source:X,destination:Y}}function LE6($,Z){if($==="source")return JE6(Z)?"source is empty. Say who opens the session: `vmId`, `vpcId`, or `public: true`":"source only narrows the session without saying who opens it. Add `vmId`, `vpcId`, or `public: true`";return"destination is empty. Say where the session lands: `vmId` + `port`, `host` + `port`, or `public: true` for the domain's own origin"}function ao$($){let Z=eo$($,"");for(let Q of["source","destination"]){let X=Z[Q];if(!R60(X))b1(Q,LE6(Q,X))}if(Z.source.public===!0&&Z.destination.public===!0)b1("destination","a rule from the public Internet to the domain's own origin allows nothing the world cannot already do. Did you mean a `vmId` destination (ingress) or a `vmId` source (egress)?");return Z}function $r$($){if(!XY($))b1("tls","tls must be an object with a `rules` array");for(let Q of Object.keys($))if(Q!=="rules")b1(`tls.${Q}`,`tls has unknown field \`${Q}\`. Expected: rules`);let Z=$.rules;if(!Array.isArray(Z))b1("tls.rules","tls.rules must be an array");return Z.forEach((Q,X)=>{let Y=`tls.rules[${X}].`,J=eo$(Q,Y),G=R60(J.source),W=R60(J.destination);if(!G&&!W)b1(`tls.rules[${X}]`,`tls.rules[${X}]: both source and destination refer to the VM being created, which allows nothing. Give one of them a \`vmId\`, \`vpcId\`, or \`public: true\``);if(G&&W)b1(`tls.rules[${X}]`,`tls.rules[${X}]: neither end refers to the VM being created. Leave one endpoint's identity unset so it means this VM, or create the rule with tls.rules.create instead`);if(!W&&J.destination.port===void 0)b1(`tls.rules[${X}].destination.port`,`tls.rules[${X}]: destination.port is required: say which port on this VM the session lands on`)}),$}function HB1($){return`/v5/tls/${p6($)}`}function FB1($){return`/v5/tls/forward-auth/${p6($)}`}class Zr${client;constructor($){this.client=$}list(){return this.client.get("/v5/tls/forward-auth")}async create($){let Z=no$($);return this.client.post("/v5/tls/forward-auth",Z)}get($){return this.client.get(FB1($))}async update($,Z){let Q=no$(Z);return this.client.put(FB1($),Q)}delete($){return this.client.delete(FB1($))}}class Qr${client;constructor($){this.client=$}async create($){let Z=ao$($);return this.client.post("/v5/tls",Z)}list($={}){return this.client.get("/v5/tls",$)}get($){return this.client.get(HB1($))}async update($,Z){let Q=ao$(Z);return this.client.put(HB1($),Q)}delete($){return this.client.delete(HB1($))}}class LB1{client;rules;forwardAuth;constructor($){this.client=$,this.rules=new Qr$($),this.forwardAuth=new Zr$($)}}var NB1,BB1,ho$,aw6,uo$,sw6=253,ew6=63,lo$,co$,$E6,ZE6,QE6=2048,mo$=32,do$=16384,io$=32,po$=32,XE6=128,YE6,to$="!#$%&'*+-/=?^_`{|}~.",ro$;var yC0=L(()=>{PK();NB1=class NB1 extends Error{path;constructor($,Z){super(Z);this.name="TlsRuleValidationError",this.path=$,Object.setPrototypeOf(this,NB1.prototype)}};BB1=class BB1 extends Error{path;constructor($,Z){super(Z);this.name="TlsForwardAuthValidationError",this.path=$,Object.setPrototypeOf(this,BB1.prototype)}};ho$=["vmId","vpcId","public","host","port"],aw6=["vmId","vpcId","public","host"],uo$=["tcp","http","postgres","minecraft","smtp","imap","imaps","socks5"],lo$=["url","headers","timeoutMs","protectedCookies","authResponseHeaders"],co$=["id"],$E6=/^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/,ZE6=/^[0-9A-Za-z-]+$/,YE6=new Set(["host","content-length","connection","keep-alive","proxy-authenticate","proxy-authorization","proxy-connection","te","trailer","transfer-encoding","upgrade"]);ro$=["action","domain","protocol","source","destination","transform","match","forwardAuth"]});function vp($){return`/v5/tunnels/${p6($)}`}function jg($){return $.tunnelId??=$.id,$}class DB1{client;constructor($){this.client=$}list(){return this.client.get("/v5/tunnels").then(($)=>{return $.tunnels.forEach(jg),$})}create($={}){return this.client.post("/v5/tunnels",$).then(jg)}get($){return this.client.get(vp($)).then(jg)}update($,Z){return this.client.patch(vp($),Z).then(jg)}rotateKey($,Z={}){return this.client.post(`${vp($)}/rotate-key`,Z).then(jg)}delete($){return this.client.delete(vp($))}attachVpc($,Z,Q={}){return this.client.post(`${vp($)}/vpcs/${p6(Z)}`,Q).then(jg)}detachVpc($,Z){return this.client.delete(`${vp($)}/vpcs/${p6(Z)}`).then(jg)}}var OB1=L(()=>{PK()});class jB1{client;basePath;constructor($,Z){this.client=$,this.basePath=Z}async readFile($,Z={}){let Q=await this.openRead($,Z);return new Uint8Array(await Q.arrayBuffer())}async readTextFile($,Z={}){return await(await this.openRead($,Z)).text()}async readFileStream($,Z={}){let Q=await this.openRead($,Z);if(!Q.body)throw Error(`no response body reading ${$}`);return Q.body}async writeFile($,Z,Q={}){let X=typeof Z==="string"?new TextEncoder().encode(Z):Z,Y=X instanceof Uint8Array?X.byteLength:X.size;if(Y>DE6)return this.uploadInChunks($,X,Y,Q);let J=X instanceof Uint8Array?X:new Uint8Array(await X.arrayBuffer());await this.client.putBytes(`${this.basePath}/fs/write`,J,{path:$,mode:Q.mode,sha256:await Xr$(J)},Q.signal),Q.onProgress?.({completedBytes:Y,totalBytes:Y})}writeTextFile($,Z,Q={}){return this.writeFile($,Z,Q)}async readDir($){let{entries:Z}=await this.client.get(`${this.basePath}/fs/dir`,{path:$});return Z}async mkdir($){await this.client.post(`${this.basePath}/fs/mkdir`,{path:$})}async remove($){await this.client.delete(`${this.basePath}/fs/remove`,{path:$})}async exists($){let{exists:Z}=await this.client.get(`${this.basePath}/fs/exists`,{path:$});return Z}stat($){return this.client.get(`${this.basePath}/fs/stat`,{path:$})}openRead($,Z){let{offset:Q,length:X}=Z,Y;if(Q!==void 0||X!==void 0){let J=Q??0;Y=X===void 0?`bytes=${J}-`:`bytes=${J}-${J+X-1}`}return this.client.getBytes(`${this.basePath}/fs/read`,{path:$},{range:Y,signal:Z.signal})}async uploadInChunks($,Z,Q,X){let Y=X.chunkSize??OE6,J=X.maxAttempts??jE6,G=Z instanceof Uint8Array?await Xr$(Z):void 0,W=await this.client.post(`${this.basePath}/fs/uploads`,{path:$,size:Q,sha256:G,mode:X.mode}),K=`${this.basePath}/fs/uploads/${W.uploadId}`;try{let H=W.receivedBytes;while(H<Q){let F=Math.min(H+Y,Q),U=Z instanceof Uint8Array?Z.subarray(H,F):Z.slice(H,F);H=(await this.putChunkWithRetry(K,U,H,J,X.signal)).receivedBytes,X.onProgress?.({completedBytes:Math.min(H,Q),totalBytes:Q})}await this.client.post(`${K}/commit`)}catch(H){throw await this.client.delete(K).catch(()=>{}),H}}async putChunkWithRetry($,Z,Q,X,Y){let J;for(let G=1;G<=X;G++){Y?.throwIfAborted?.();try{return await this.client.putBytes($,Z,{offset:Q},Y)}catch(W){if(J=W,!(!(W instanceof WJ)||W.status>=500||W.status===408||W.status===409||W.status===429)||Y?.aborted||G===X)throw W;await wE6(Math.min(500*2**(G-1),8000));let H=await this.client.get($).catch(()=>{return});if(H&&H.receivedBytes>Q)return H}}throw J}}async function Xr$($){let Z=globalThis.crypto?.subtle;if(!Z)return;let Q=await Z.digest("SHA-256",$);return Array.from(new Uint8Array(Q),(X)=>X.toString(16).padStart(2,"0")).join("")}function wE6($){return new Promise((Z)=>setTimeout(Z,$))}var DE6=8388608,OE6=16777216,jE6=5;var wB1=L(()=>{T60()});function EE6(){return typeof process<"u"&&Boolean(process.versions?.node)}async function Yr$($,Z){if(EE6()){let X;try{X=await import("ws")}catch{throw Error("PTY sessions need the `ws` package in Node. Install it with `npm install ws`.")}return new X.default($,{headers:Z})}let Q=globalThis.WebSocket;if(!Q)throw Error("PTY sessions need a WebSocket client; no global WebSocket is available in this environment.");return new Q($)}function q60($,Z,Q){if($.on){$.on(Z,Q);return}$.addEventListener?.(Z,Q)}function PE6($,Z){if($&&typeof $==="object"&&"data"in $){let Q=$.data;if(typeof Q==="string")return{text:Q};if(Q instanceof ArrayBuffer)return{binary:new Uint8Array(Q)};return{}}if($ instanceof Uint8Array)return Z?{binary:$}:{text:zE6.decode($)};if(typeof $==="string")return{text:$};return{}}class EB1{_sessionId;_slug;_created=!1;socket;constructor($,Z,Q={}){this.socket=$,this._sessionId=Z,q60($,"message",(X,Y)=>{let{text:J,binary:G}=PE6(X,Y);if(G){Q.onData?.(G);return}if(!J)return;let W;try{W=JSON.parse(J)}catch{return}if(W.type==="exited")Q.onExit?.(W.exitCode);else if(W.type==="error")Q.onError?.(Error(W.message));else if(W.type==="sessionInfo")this._sessionId=W.sessionId,this._slug=W.slug,this._created=W.created??!0,Q.onSessionInfo?.(W.sessionId)}),q60($,"close",(X)=>{let Y=X;Q.onClose?.({wasClean:Y?.wasClean??!0,code:Y?.code??1000,reason:Y?.reason??""})}),q60($,"error",(X)=>Q.onError?.(X))}write($){this.socket.send(typeof $==="string"?new TextEncoder().encode($):$)}resize($){this.sendControl({type:"resize",cols:$.cols,rows:$.rows})}signal($){this.sendControl({type:"signal",signal:$})}sendControl($){this.socket.send(JSON.stringify($))}detach(){this.socket.close()}get sessionId(){return this._sessionId}get slug(){return this._slug}get created(){return this._created}get readyState(){return this.socket.readyState}}function TE6($){return new Promise((Z,Q)=>{if($.readyState===1){Z();return}q60($,"open",()=>Z()),q60($,"error",(X)=>Q(X))})}class zB1{client;basePath;constructor($,Z){this.client=$,this.basePath=Z}async open($={}){let{exec:Z,cols:Q,rows:X,linuxUser:Y,slug:J,replaceOnExit:G,onData:W,onExit:K,onClose:H,onError:F}=$,U={};if(Z!==void 0)U.exec=Z;if(Q!==void 0)U.cols=Q;if(X!==void 0)U.rows=X;if(Y!==void 0)U.linuxUser=Y;if(J!==void 0)U.slug=J;if(G!==void 0)U.replaceOnExit=String(G);let N=Jr$(this.client,`${this.basePath}/pty`,U),B=this.client.authHeaders(),D=await Yr$(N,B);return new Promise((O,j)=>{let w=!1,E=new EB1(D,-1,{onData:W,onExit:K,onClose:(z)=>{if(!w)w=!0,j(Error("connection closed before sessionInfo"));H?.(z)},onError:(z)=>{if(!w)w=!0,j(z);F?.(z)},onSessionInfo:()=>{w=!0,O(E)}})})}async attach($){let{session:Z,linuxUser:Q,onData:X,onExit:Y,onClose:J,onError:G}=$,W=Jr$(this.client,`${this.basePath}/pty/sessions/${p6(String(Z))}`,{...Q!==void 0?{linuxUser:Q}:{}}),K=this.client.authHeaders(),H=await Yr$(W,K),F=new EB1(H,typeof Z==="number"?Z:-1,{onData:X,onExit:Y,onClose:J,onError:G});return await TE6(H),F}list($={}){return this.client.get(`${this.basePath}/pty/sessions`,$)}close($,Z={}){return this.client.delete(`${this.basePath}/pty/sessions/${p6(String($))}`,Z)}}class PB1{pty;linuxUser;constructor($,Z){this.pty=$,this.linuxUser=Z}open($={}){return this.pty.open({...$,linuxUser:this.linuxUser})}attach($){return this.pty.attach({...$,linuxUser:this.linuxUser})}list(){return this.pty.list({linuxUser:this.linuxUser})}close($){return this.pty.close($,{linuxUser:this.linuxUser})}}function Jr$($,Z,Q){return $.url(Z,Q).replace(/^http/,"ws")}var zE6;var TB1=L(()=>{PK();zE6=new TextDecoder});class AB1{client;constructor($){this.client=$}list($={}){return this.client.get("/v5/snapshots",$)}get($){return this.client.get(`/v5/snapshots/${p6($)}`)}update($,Z){return this.client.patch(`/v5/snapshots/${p6($)}`,Z)}delete($){return this.client.delete(`/v5/snapshots/${p6($)}`)}}var RB1=L(()=>{PK()});var Gr$=()=>{};function qB1($){return`/v5/vms/${p6($)}`}class MB1{id;fs;pty;client;basePath;constructor($,Z){this.client=$,this.id=Z,this.basePath=qB1(Z),this.fs=new jB1($,this.basePath),this.pty=new zB1($,this.basePath)}data(){return this.client.get(this.basePath)}firewallRules(){return this.client.get("/v5/firewall/rules",{vmId:this.id})}update($){return this.client.patch(this.basePath,$)}start(){return this.client.post(`${this.basePath}/start`)}pause(){return this.client.post(`${this.basePath}/pause`)}resize($){return this.client.post(`${this.basePath}/resize`,$)}delete(){return this.client.delete(this.basePath)}exec($){let Z=typeof $==="string"?{command:$}:$;return this.client.post(`${this.basePath}/exec-await`,Z)}linuxUser($){return new Wr$(this,$)}snapshot($={}){return this.client.post(`${this.basePath}/snapshot`,$)}}class Wr${vm;linuxUser;pty;constructor($,Z){this.vm=$,this.linuxUser=Z,this.pty=new PB1($.pty,Z)}exec($){let Z=typeof $==="string"?{command:$}:$;return this.vm.exec({...Z,linuxUser:this.linuxUser})}}class IB1{client;snapshots;constructor($){this.client=$,this.snapshots=new AB1($)}async create($){if(bC0($.firewall,"VM"),$.tls!==void 0)$r$($.tls);let Z=await this.client.post("/v5/vms",$);return{vm:new MB1(this.client,Z.id),vmId:Z.id,data:Z,firewallRules:Z.firewallRules??[],tlsRules:Z.tlsRules??[]}}list($={}){return this.client.get("/v5/vms",$)}get($){return this.client.get(qB1($))}ref($){return new MB1(this.client,$)}delete($){return this.client.delete(qB1($))}}var VB1=L(()=>{A60();yC0();PK();wB1();TB1();RB1();Gr$();wB1();TB1();RB1()});function kB1($){return`/v5/vpcs/${p6($)}`}class Kr${client;basePath;constructor($,Z){this.client=$,this.basePath=Z}list(){return this.client.get(`${this.basePath}/tunnels`)}}class CB1{id;tunnels;client;basePath;constructor($,Z){this.client=$,this.id=Z,this.basePath=kB1(Z),this.tunnels=new Kr$($,this.basePath)}data(){return this.client.get(this.basePath)}update($){return this.client.patch(this.basePath,$)}delete(){return this.client.delete(this.basePath)}}class SB1{client;constructor($){this.client=$}list(){return this.client.get("/v5/vpcs")}async create($={}){if($.firewall!==void 0)bC0($.firewall,"network");let Z=await this.client.post("/v5/vpcs",$);return{vpc:new CB1(this.client,Z.id),vpcId:Z.id,data:Z,firewallRules:Z.firewallRules??[]}}get($){return this.client.get(kB1($))}ref($){return new CB1(this.client,$)}delete($){return this.client.delete(kB1($))}}var _B1=L(()=>{A60();PK()});class gC0{client;vms;vpc;tunnels;firewall;tls;domains;identities;constructor($={}){this.client=new sN1($),this.vms=new IB1(this.client),this.vpc=new SB1(this.client),this.tunnels=new DB1(this.client),this.firewall=new YB1(this.client),this.tls=new LB1(this.client),this.domains=new eN1(this.client),this.identities=new WB1(this.client)}fetch($,Z){return this.client.fetch($,Z)}}var Hr$=L(()=>{PK();$B1();A60();KB1();yC0();OB1();VB1();_B1();PK();T60();VB1();_B1();OB1();$B1();A60();yC0();KB1()});var Ur$;var Fr$=L(()=>{Ur$={name:"@decocms/sandbox",version:"1.80.1",private:!0,type:"module",description:"Sandbox runtime for isolated Studio tool execution",scripts:{check:"tsc --noEmit",test:"bun test",build:"bun run build:typegen && bun run build:harness-runner","build:typegen":"mkdir -p dist && bun run --cwd=../typegen build && bun --cwd=../typegen pm pack --filename $PWD/dist/typegen.tgz --quiet","build:harness-runner":"mkdir -p dist && bun --cwd=../harness-runner pm pack --filename $PWD/dist/harness-runner.tgz --quiet"},exports:{"./shared":"./shared.ts","./provider":"./server/provider/index.ts","./provider/agent-sandbox":"./server/provider/agent-sandbox/index.ts","./provider/postgres-state-store":"./server/provider/postgres-state-store.ts","./provider/freestyle":"./server/provider/freestyle.ts","./provider/remote":"./server/provider/remote.ts","./provider/router":"./server/provider/router.ts","./provider/sandbox-api":"./server/provider/sandbox-api.ts","./provider/sandbox-server":"./server/provider/sandbox-server.ts","./daemon-client":"./server/daemon-client.ts","./org-fs":"./org-fs.ts","./dispatch":"./dispatch/index.ts","./dispatch/*":"./dispatch/*.ts","./proxy/http":"./proxy/http.ts","./proxy/websocket":"./proxy/websocket.ts"},dependencies:{"@decocms/shared":"workspace:*","@kubernetes/client-node":"^1.4.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0",freestyle:"0.2.16",zod:"4.3.6"},devDependencies:{"@types/bun":"latest",postgres:"^3.4.5",typescript:"^7.0.2"}}});function hC0($){let Z=$?.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of studio-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"});return async(Q,X)=>{if(!Z)return X();let Y=performance.now(),J=(G)=>Z.record(performance.now()-Y,{runner_kind:Q,source:"daemon",status_code:G});try{let G=await X();return J(G.status),G}catch(G){throw J(0),G}}}var hD;var uC0=L(()=>{hD={kubernetes:"agent-sandbox",freestyle:"freestyle"}});var zr$={};J0(zr$,{FreestyleSandboxProvider:()=>Er$});import{createHash as RE6,randomBytes as qE6}from"crypto";class Er${freestyle;lookupClient;image;sidecarImage;idleTimeoutSeconds;autoDeleteSeconds;domainSuffix;timeDaemonRequest;inflight=new Lg;snapshotInflight=new Lg;lookups=new Map;releaseTimers=new Map;constructor($){this.freestyle=$.client??new gC0({apiKey:$.apiKey}),this.lookupClient=$.client??new gC0({apiKey:$.apiKey,fetch:Object.assign((Z,Q)=>fetch(Z,{...Q,signal:Q?.signal?AbortSignal.any([Q.signal,AbortSignal.timeout(Or$)]):AbortSignal.timeout(Or$)}),{preconnect:fetch.preconnect})}),this.image=$.image??`ghcr.io/decocms/studio/studio-sandbox-go:${Ur$.version}`,this.sidecarImage=$.orgFsSidecarImage??IE6,this.idleTimeoutSeconds=$.idleTimeoutSeconds??900,this.autoDeleteSeconds=$.autoDeleteSeconds??259200,this.domainSuffix=$.domainSuffix??"style.dev",this.timeDaemonRequest=hC0($.meter)}async owns($){return await this.find($)!==null}daemonUrl($){return`https://${$}.${this.domainSuffix}`}async find($,Z={}){let Q=this.lookups.get($);if(!Z.refresh&&Q&&Date.now()-Q.at<(Q.found?vE6:xE6))return Q.found;let X=null;try{let Y=await this.lookupClient.vms.get($),J=Y.metadata[Lr$];if(J)X={vm:this.freestyle.vms.ref(Y.id),daemon:{url:this.daemonUrl($),token:J}}}catch(Y){if(!(Y instanceof WJ&&Y.status===404))throw Y}return this.remember($,X),X}remember($,Z){if(this.lookups.delete($),this.lookups.size>=fE6){let Q=this.lookups.keys().next();if(!Q.done)this.lookups.delete(Q.value)}this.lookups.set($,{found:Z,at:Date.now()})}baseSnapshot(){let{image:$,sidecarImage:Z}=this,Q=`studio-sandbox-${RE6("sha256").update(`${$}
+${Y}`:Y}var kt$,qj6;var VN1=L(()=>{kt$=/[\r\n<>]/,qj6=/^[^\s@<>]+@[^\s@<>]+\.[^\s@<>]+$/});var jC0=L(()=>{$8();VN1()});function Ij6($){if($ instanceof TypeError)return!0;if($ instanceof Error&&!($ instanceof DOMException)&&typeof $.code==="string")return!0;if($ instanceof DOMException&&$.name==="AbortError")return!0;return!1}async function kN1($,Z,Q,X){try{return await O8(async()=>{let J=await fetch($,{...Z,signal:AbortSignal.timeout(X)});return{status:J.status,ok:J.ok,body:await J.text()}},{maxAttempts:3,minTimeout:50,maxTimeout:500,multiplier:2,jitter:0.5,isRetriable:Ij6})}catch(Y){let J=Y instanceof Error?Y.message:String(Y);throw Error(`[SANDBOX_UNREACHABLE] sandbox daemon ${Q} request failed: ${J}`,{cause:Y})}}async function wC0($){try{let Z=await fetch(`${$}/health`,{signal:AbortSignal.timeout(Vj6)});if(!Z.ok){try{await Z.text()}catch{}return null}let Q=await Z.json();if(typeof Q==="object"&&Q!==null&&typeof Q.bootId==="string"&&typeof Q.ready==="boolean"&&Q.setup&&typeof Q.setup.running==="boolean"&&typeof Q.setup.done==="boolean")return Q;return null}catch{return null}}async function SN1($){for(let Z=0;Z<St$;Z++){if(await wC0($)!==null)return;let Q=(Math.random()*2-1)*kj6;await $$(_t$+Q)}throw Error(`sandbox daemon at ${$} did not respond on /health within ${St$*_t$/1000}s`)}async function yN($,Z,Q,X,Y){return Cj6($,Z,"POST",Q,X,Y)}async function Cj6($,Z,Q,X,Y,J){let G={...X};if(Y&&Y.rotateToken!==void 0)G.auth=Y;let W=await kN1(`${$}/_sandbox/config`,{method:Q,headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:JSON.stringify(G)},"/_sandbox/config",J?.timeoutMs??CN1);if(!W.ok)throw new wF(W.status,W.body);return xt$(W.body,"/_sandbox/config")}async function vt$($,Z,Q){let X=await kN1(`${$}/_sandbox/setup/${Q}`,{method:"POST",headers:{Authorization:`Bearer ${Z}`}},`/_sandbox/setup/${Q}`,CN1);if(!X.ok)throw Error(`sandbox daemon /_sandbox/setup/${Q} returned ${X.status}: ${X.body}`)}async function D60($,Z,Q){let X=await kN1(`${$}/_sandbox/orgfs-config`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:Q},"/_sandbox/orgfs-config",CN1);if(!X.ok)throw Error(`sandbox daemon /_sandbox/orgfs-config returned ${X.status}: ${X.body}`);return xt$(X.body,"/_sandbox/orgfs-config")}function xt$($,Z){try{return JSON.parse($)}catch(Q){throw Error(`sandbox daemon ${Z} returned a malformed JSON body: ${$.slice(0,200)}`,{cause:Q})}}async function EC0($,Z,Q,X){let Y=new Headers(X.headers);for(let W of Sj6)Y.delete(W);Y.set("authorization",`Bearer ${Z}`);let J=X.method!=="GET"&&X.method!=="HEAD",G=`${$}${Q.startsWith("/")?Q:`/${Q}`}`;return fetch(G,{method:X.method,headers:Y,body:J?X.body:void 0,redirect:"manual",signal:X.signal,duplex:J?"half":void 0})}var wF,Vj6=500,CN1=30000,St$=25,_t$=200,kj6=50,Sj6;var Bg=L(()=>{jC0();$8();wF=class wF extends Error{status;constructor($,Z){super(`sandbox daemon /_sandbox/config returned ${$}: ${Z}`);this.status=$;this.name="ConfigRequestError"}};Sj6=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length"]});class zC0{counted=new Set;markCounted($){this.counted.add($)}consume($){return this.counted.delete($)}}class Lg{map=new Map;async run($,Z){let Q=this.map.get($);if(Q)return Q;let X=Z();this.map.set($,X);try{return await X}finally{this.map.delete($)}}}function PC0($,Z,Q){if(!$)return Q(null);if(!$.withLock)return Q($);return $.withLock(Z,Q)}function O60($){if(!$.orgId||!$.virtualMcpId||!$.branch)throw Error("composeSandboxRef: orgId, virtualMcpId and branch are all required for agent refs");return`agent:${$.orgId}:${$.virtualMcpId}:${$.branch}`}function ft$($){if(!$.startsWith("agent:"))return"";let Z=$.split(":");return Z.length>=4?Z.slice(3).join(":"):""}import{hash as _j6}from"crypto";function vj6($,Z=16){return _j6("sha256",Tl$($),"hex").slice(0,Z)}function c3($){let Z=vj6($),Q=xj6(ft$($.projectRef));return Q?`${Q}-${Z}`:`s-${Z}`}function xj6($){if(!$)return"";let Z=$.split("/").pop()??"",Q="",X=!1;for(let Y of Z.toLowerCase()){let J=Y.charCodeAt(0),G=J>=97&&J<=122,W=J>=48&&J<=57;if(!G&&!W){X||=Q.length>0;continue}if(X){if(Q.length+1>=bt$)break;Q+="-",X=!1}if(Q+=Y,Q.length===bt$)break}return Q}var bt$=24;var yt$=L(()=>{IF1()});function TC0($,Z){let Q=$.replace(/\/+$/,"");if(Q.includes("{handle}"))return`${Q.replace("{handle}",Z)}/`;try{let X=new URL(Q);return X.hostname=`${Z}.${X.hostname}`,`${X.toString()}/`}catch{return`${Q}/${Z}/`}}function Mp($){let Z=$.repo,Q=Z?{repository:{cloneUrl:Z.cloneUrl,repoName:Z.displayName??fj6(Z.cloneUrl),...Z.branch?{branch:Z.branch}:{},submoduleCredentials:Z.submoduleCredentials??[]},repositories:($.extraRepos??[]).filter((K)=>!!K.directoryName).map((K)=>({cloneUrl:K.cloneUrl,repoName:K.directoryName,...K.branch?{branch:K.branch}:{},submoduleCredentials:K.submoduleCredentials??[]})),...Z.userName.trim()||Z.userEmail.trim()?{identity:{userName:Z.userName,userEmail:Z.userEmail}}:{}}:void 0,X=$.tenant,Y=qp({userName:X?.userName,userEmail:X?.userEmail})??void 0,J=$.packageManager?{name:$.packageManager.name,...$.packageManager.path?{path:$.packageManager.path}:{}}:void 0,G=J?{packageManager:J,runtime:$.runtime,...$.port!==void 0?{port:$.port}:{}}:void 0,W=X?.orgId;if(!Q&&!G&&!Y&&$.cloneOnly===void 0&&!W)return null;return{...Q?{git:Q}:{},...Y?{operator:Y}:{},...W?{orgId:W}:{},...$.cloneOnly!==void 0?{cloneOnly:$.cloneOnly}:{},...G?{application:G}:{}}}function fj6($){try{let Z=new URL($);return Z.pathname.replace(/^\/+/,"").replace(/\.git$/,"")||Z.hostname}catch{return $}}var gt$=L(()=>{VN1()});function bj6($){try{return new URL($).username.length>0}catch{return!1}}function j60($){let Z=$.repo?.cloneUrl;if(!Z||!bj6(Z))return null;return{git:{repository:{cloneUrl:Z}}}}var Ip=L(()=>{yt$();gt$()});async function*lt$($){let Z=$.now??(()=>Date.now()),Q=Z(),X=$.schedulingTimeoutMs??gj6,Y={pod:{},sandbox:{},events:{hasPulling:!1,hasPulled:!1},startedAt:Q},J=[],G=null,W=!1,K=(E)=>{if(W)return;if(G){let z=G;G=null,z(E)}else J.push(E)},H=()=>{if(J.length>0)return Promise.resolve(J.shift());if(W)return Promise.resolve(null);return new Promise((E)=>{G=E})},F=()=>{if(W)return;if(W=!0,G){let E=G;G=null,E(null)}},U=new AbortController,N=()=>{U.abort(),F()};if($.signal)if($.signal.aborted)U.abort(),F();else $.signal.addEventListener("abort",N,{once:!0});let B=Math.max(0,X-(Z()-Q)),D=setTimeout(()=>K("tick"),B+100),O,j=new Promise((E)=>{O=E}),w=Promise.allSettled([uj6($.kc,$.namespace,$.claimName,U.signal,Y,K,Z,O),cj6($.kc,$.namespace,$.claimName,U.signal,Y,K),mj6($.kc,$.namespace,$.claimName,j,U.signal,Y,K,Z)]);try{let E=null,z=-1,A=ht$(Y,X,Z);if(E=vN1(A),!_N1(A))z=ut$(A);if(yield A,_N1(A))return;while(!W){if(await H()===null)break;let P=ht$(Y,X,Z);if(_N1(P)){let S=vN1(P);if(S!==E)E=S,yield P;return}let q=ut$(P);if(q<z)continue;let f=vN1(P);if(f!==E)E=f,z=q,yield P}}finally{if(clearTimeout(D),U.abort(),$.signal)$.signal.removeEventListener("abort",N);F(),await w.catch(()=>{})}}async function ct$($,Z=hj6){let Q=new AbortController,X="claiming",Y,J=()=>{clearTimeout(Y),Y=setTimeout(()=>Q.abort(),Z)};try{J();for await(let G of $(Q.signal)){if(G.kind==="ready")return;if(G.kind==="failed")throw new $Y(G.message);X=G.kind,J()}}finally{clearTimeout(Y),Q.abort()}throw new Fp(`Sandbox did not become ready: no progress for ${Math.round(Z/1000)}s while ${X}`)}function ht$($,Z,Q){let{pod:X,sandbox:Y,events:J,startedAt:G}=$;if(Y.ready)return{kind:"ready"};let W=X.containerWaitingReason;if(W==="ImagePullBackOff"||W==="ErrImagePull")return{kind:"failed",reason:"image-pull-backoff",message:"Sandbox image failed to download. The cluster may be missing pull credentials or the image tag may not exist."};if(W==="CrashLoopBackOff")return{kind:"failed",reason:"crash-loop-backoff",message:"Sandbox crashed during startup and is now in CrashLoopBackOff. Check pod logs."};if(!X.scheduled&&J.lastFailedSchedulingAt!==void 0&&Q()-G>Z)return{kind:"failed",reason:"scheduling-timeout",message:J.failedSchedulingMessage??`Pod could not be scheduled within ${Math.round(Z/1000)}s.`};if(X.containerRunning&&!X.containerReady)return{kind:"warming-daemon",since:G};if(J.hasPulling&&!J.hasPulled)return{kind:"pulling-image",since:G};if(W==="ContainerCreating"||W==="PodInitializing"||X.scheduled&&!X.containerRunning)return{kind:"starting-container",since:G};if(X.scheduledFalseReason==="Unschedulable"||J.lastFailedSchedulingAt!==void 0&&!X.scheduled)return{kind:"waiting-for-capacity",since:G,message:J.failedSchedulingMessage??X.scheduledFalseMessage,nodeClaim:J.nominatedNodeClaim};return{kind:"claiming",since:G}}function _N1($){return $.kind==="ready"||$.kind==="failed"}function ut$($){switch($.kind){case"claiming":return 0;case"waiting-for-capacity":return 1;case"pulling-image":return 2;case"starting-container":return 3;case"warming-daemon":return 4;case"ready":case"failed":return 99}}function vN1($){switch($.kind){case"claiming":case"pulling-image":case"starting-container":case"warming-daemon":return $.kind;case"waiting-for-capacity":return`waiting-for-capacity:${$.message??""}:${$.nodeClaim??""}`;case"ready":return"ready";case"failed":return`failed:${$.reason}:${$.message}`}}async function uj6($,Z,Q,X,Y,J,G,W){let K=`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?watch=true&labelSelector=${encodeURIComponent(`${yj6}=${Q}`)}`;return AC0({kc:$,path:K,signal:X,label:`pod/${Q}`,onEvent:(H)=>{if(H.type!=="ADDED"&&H.type!=="MODIFIED")return;let F=H.object;if(F.metadata?.name)W(F.metadata.name);lj6(F,Y,G),J("pod")}})}function lj6($,Z,Q){let Y=($.status?.conditions??[]).find((G)=>G.type==="PodScheduled");if(Y?.status==="True")Z.pod.scheduled=!0,Z.pod.scheduledFalseReason=void 0,Z.pod.scheduledFalseMessage=void 0;else if(Y?.status==="False")Z.pod.scheduled=!1,Z.pod.scheduledFalseReason=Y.reason,Z.pod.scheduledFalseMessage=Y.message;let J=($.status?.containerStatuses??[]).find((G)=>G.name===Q7.MAIN_CONTAINER_NAME);if(J)Z.pod.containerWaitingReason=J.state?.waiting?.reason,Z.pod.containerRunning=!!J.state?.running,Z.pod.containerReady=J.ready===!0}async function cj6($,Z,Q,X,Y,J){let G=`/apis/${Q7.CLAIM_API_GROUP}/${Q7.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(Z)}/${Q7.CLAIM_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${Q}`)}`;return AC0({kc:$,path:G,signal:X,label:`sandboxclaim/${Q}`,onEvent:(W)=>{if(W.type!=="ADDED"&&W.type!=="MODIFIED")return;let H=W.object.status?.conditions?.find((F)=>F.type==="Ready");if(!H)return;if(H.status==="True")Y.sandbox.ready=!0,Y.sandbox.notReadyReason=void 0,Y.sandbox.notReadyMessage=void 0;else Y.sandbox.ready=!1,Y.sandbox.notReadyReason=H.reason,Y.sandbox.notReadyMessage=H.message;J("sandbox")}})}async function mj6($,Z,Q,X,Y,J,G,W){let K=await Promise.race([X,new Promise((F)=>{if(Y.aborted){F(Q);return}Y.addEventListener("abort",()=>F(Q),{once:!0})})]);if(Y.aborted)return;let H=`/api/v1/namespaces/${encodeURIComponent(Z)}/events?watch=true&fieldSelector=${encodeURIComponent(`involvedObject.name=${K},involvedObject.kind=Pod`)}`;return AC0({kc:$,path:H,signal:Y,label:`events/${Q}`,onEvent:(F)=>{if(F.type!=="ADDED"&&F.type!=="MODIFIED")return;let U=F.object,N=U.reason;if(!N)return;switch(N){case"Pulling":J.events.hasPulling=!0;break;case"Pulled":J.events.hasPulling=!0,J.events.hasPulled=!0;break;case"FailedScheduling":J.events.lastFailedSchedulingAt=W(),J.events.failedSchedulingMessage=U.message;break;case"Nominated":{let B=U.message?.match(/nodeclaim\/([\w-]+)/);if(B)J.events.nominatedNodeClaim=B[1];break}default:return}G("event")}})}async function mt$($){let{kc:Z,namespace:Q,labelSelector:X,signal:Y,onDelete:J}=$,G=`/apis/${Q7.CLAIM_API_GROUP}/${Q7.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(Q)}/${Q7.CLAIM_PLURAL}?watch=true&labelSelector=${encodeURIComponent(X)}`;return AC0({kc:Z,path:G,signal:Y,label:"sandboxclaim-reaper",onEvent:(W)=>{if(W.type!=="DELETED")return;let K=W.object.metadata?.name;if(K)J(K)}})}async function AC0($){let{kc:Z,path:Q,signal:X,label:Y,onEvent:J}=$,G=0;while(!X.aborted){try{let K=await EK(Z,{method:"GET",path:Q,signal:X,headers:{accept:"application/json"},stream:!0});if(!K.ok||!K.body){try{await K.body?.cancel()}catch{}if(K.status===401||K.status===403){console.warn(`[lifecycle-watcher] ${Y} stopped: watch denied (${K.status} ${K.statusText}). `+"The kubeconfig in use cannot watch SandboxClaims \u2014 if you are running locally, "+"this provider should not be active (check STUDIO_AGENT_SANDBOX_ENABLED).");return}throw Error(`watch handshake failed: ${K.status} ${K.statusText}`)}G=0;for await(let H of $c$(K.body)){if(X.aborted)return;try{J(H)}catch(F){console.warn(`[lifecycle-watcher] ${Y} onEvent threw: ${F instanceof Error?F.message:String(F)}`)}}}catch(K){if(X.aborted)return;let H=K instanceof Error?K.message:String(K);console.warn(`[lifecycle-watcher] ${Y} watch ended: ${H}`)}if(X.aborted)return;let W=A7(5000,250,G,2,0);G+=1,await $$(W,{signal:X}).catch(()=>{})}}var yj6="studio.decocms.com/sandbox-handle",gj6=300000,hj6=600000;var dt$=L(()=>{$8();n40();$j0()});import{createHash as dj6}from"crypto";import{z as JJ}from"zod";function gN($){let Z;try{Z=new URL($.trim())}catch{return null}if(Z.protocol!=="https:"||Z.search||Z.hash)return null;let Q=Z.pathname.replace(/\/+$/,"").replace(/\.git$/,"").replace(/\/+$/,"");return Q?`https://${Z.host.toLowerCase()}${Q}`:null}function w60($){return gN($)?.toLowerCase()??null}function oj6($){let Z=new Set;for(let Q of $){let X=`${w60(Q.repoUrl)??Q.repoUrl}#${Q.branch}`;if(Z.has(X))return Q;Z.add(X)}return null}function it$($){return $.reduce((Z,Q)=>Z+Q.replicas,0)}function nt$($,Z){if(Z.warmPoolName)return Z.warmPoolName;let Q=dj6("sha256").update(`${Z.repoUrl}#${Z.branch}`).digest("hex").slice(0,8);return`${$}-${Q}`}function tt$($){return Math.max(0,$.size-it$($.repos))}function Vp($){return $.flatMap((Z)=>Z.repos.map((Q)=>({pool:Z,repo:Q,warmPoolName:nt$(Z.name,Q)})))}function rj6($,Z){return at$(void 0,$,!0,Z)}function ot$($,{templateName:Z}){let Q=rj6(Z,$.image),X=(Y,J)=>({apiVersion:`${Q7.CLAIM_API_GROUP}/${Q7.CLAIM_API_VERSION}`,kind:"SandboxWarmPool",metadata:{name:Y,labels:{[aj6]:$.name}},spec:{replicas:J,updateStrategy:{type:"OnReplenish"},sandboxTemplateRef:{name:Q}}});return[...$.repos.map((Y)=>X(nt$($.name,Y),Y.replicas)),X($.name,tt$($))]}function qC0($){return $.tenant?.orgId}function fN1($,Z){if(!Z.tenant)return null;let Q=$.filter((J)=>J.tenant===Z.tenant&&J.image===Z.image),X=Z.cloneUrl?w60(Z.cloneUrl):null;if(X){let J=Vp(Q).filter((W)=>w60(W.repo.repoUrl)===X),G=J.find((W)=>W.repo.branch===Z.branch)??J[0];if(G)return G}let Y=Q.find((J)=>tt$(J)>0);return Y?{pool:Y,repo:null,warmPoolName:Y.name}:null}function rt$($,Z,Q){return $?.warmPoolName??(Z?Q:"none")}function at$($,Z,Q=!1,X){let Y=X&&X!=="default"?`-${X}`:"";return`${Z}${Y}${$==="harness-run"||Q?"-medium":""}`}async function bN1($){let Z=at$($.purpose,$.templateName,$.tenantPool,$.sandboxImage);if(Z===$.templateName)return{name:Z,probes:$.probes};let Q=$.probes[Z]??null,X=Q!==null&&$.now-Q.checkedAt<$.ttlMs?Q:{checkedAt:$.now,present:await $.exists(Z)},Y={...$.probes,[Z]:X};if(X.present)return{name:Z,probes:Y};if(Q?.present!==!1)$.onAbsent?.(Z);if($.sandboxImage&&$.sandboxImage!=="default")return bN1({...$,sandboxImage:void 0,probes:Y});return{name:$.templateName,probes:Y}}function yN1($,Z,Q){let X=w60(Z);if(!X)return[];let Y=Q.replace(/^refs\/heads\//,"");return Vp($).filter(({repo:J})=>w60(J.repoUrl)===X&&J.branch===Y)}class gN1{source;dirty=new Set;pods=new Map;known=new Map;constructor($){this.source=$}pools(){return this.source()}resolve($){return fN1(this.pools(),$)}markDirty($,Z){let Q=yN1(this.pools(),$,Z).map((X)=>X.warmPoolName);for(let X of Q)this.dirty.add(X);return Q}takeDirty($){return this.dirty.delete($)}pod($){return this.pods.get($)}setPod($,Z){this.pods.set($,Z)}retainPods($,Z){for(let[Q,X]of this.pods)if(X.pool===$&&!Z.has(Q))this.pods.delete(Q)}retain($){let Z=new Map($.map((X)=>[X.warmPoolName,X])),Q=[...this.known.values()].filter((X)=>!Z.has(X.warmPoolName));for(let X of this.dirty)if(!Z.has(X))this.dirty.delete(X);for(let[X,Y]of this.pods)if(!Z.has(Y.pool))this.pods.delete(X);return this.known=Z,Q}}var ij6=54,pj6,nj6=2048,tj6,E60,RC0,xN1,pt$,aj6="studio.decocms.com/tenant-pool";var z60=L(()=>{r4();n40();pj6=/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/;tj6=JJ.object({runtime:JJ.enum(["node","bun","deno"]).default("node"),packageManager:JJ.enum(["npm","pnpm","yarn","bun","deno"]).optional(),packageManagerPath:JJ.string().optional(),devPort:JJ.number().int().positive().optional()}).default({runtime:"node"}),E60=JJ.object({repoUrl:JJ.string().max(nj6).transform(($,Z)=>{let Q=gN($);if(Q)return Q;return Z.addIssue({code:"custom",message:"repoUrl must be an https clone URL"}),JJ.NEVER}),branch:JJ.string().min(1).default("main"),workload:tj6,replicas:JJ.number().int().min(1)});RC0=class RC0 extends Error{poolName;size;allocated;constructor($,Z,Q){super(`pool ${$}: repos take ${Q} replicas, more than its size ${Z}`);this.poolName=$;this.size=Z;this.allocated=Q;this.name="TenantPoolCapacityError"}};xN1=JJ.object({name:JJ.string().max(ij6).regex(pj6,"pool name must be a DNS label (lowercase alphanumeric and '-')"),tenant:JJ.string().min(1).max(512),size:JJ.number().int().min(1),image:DN.default("default")}),pt$=xN1.extend({repos:JJ.array(E60).default([])}).superRefine(($,Z)=>{let Q=oj6($.repos);if(Q)Z.addIssue({code:"custom",path:["repos"],message:`duplicate repo allocation ${Q.repoUrl}#${Q.branch}`});let X=it$($.repos);if(X>$.size)Z.addIssue({code:"custom",path:["repos"],message:new RC0($.name,$.size,X).message})})});async function st$($,Z,Q){let X=new Map;for(let Y of $){let J=Z(Y);if(!J)continue;let G=X.get(J);if(G)G.push(Y);else X.set(J,[Y])}await Promise.allSettled([...X.values()].map(async(Y)=>{for(let J of Y)await Q(J).catch(()=>{})}))}function sj6($){try{let Z=new URL($);if(Z.hostname.toLowerCase()!=="github.com")return null;let[Q,X]=Z.pathname.replace(/^\/+/,"").split("/"),Y=X?.replace(/\.git$/,"");return Q&&Y?`${Q}/${Y}`.toLowerCase():null}catch{return null}}function et$($){if($.repositoryId)return{repositoryId:$.repositoryId};let Z=$.connectionId?sj6($.cloneUrl):null;return $.connectionId&&Z?{connectionId:$.connectionId,repo:Z}:null}var $o$=L(()=>{z60()});async function kp($,Z,Q,X){let Y=(G)=>EC0(G.url,G.token,Z,Q),J=!(Q.body instanceof ReadableStream);try{let G=await Y($);if(G.status!==401||!J)return G;let W=await X.unauthorized();if(!W)return G;return await G.body?.cancel().catch(()=>{}),await Y(W)}catch(G){if(!J)throw G;let W=await X.unreachable();if(!W)throw G;return Y(W)}}var MC0=L(()=>{Bg()});function Xo$($,Z){return new Response(JSON.stringify(Z),{status:$,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function Zo$($){let Z=new Headers;for(let[Q,X]of $.headers.entries())if(!$w6.includes(Q.toLowerCase()))Z.set(Q,X);return new Response($.body,{status:$.status,statusText:$.statusText,headers:Z})}function Qo$($,Z){let Q=Xo$($,{error:Z});return Q.headers.set("x-sandbox-preview-not-ready","1"),Q}async function Sp($,Z,Q){let X=await Z.base();if(!X)return Qo$(404,"sandbox not found");let Y=new URL($.url);if((Y.pathname==="/_sandbox"||Y.pathname.startsWith("/_sandbox/"))&&$.method!=="GET")return Xo$(404,{error:"not found"});let G=(F)=>`${F}${Y.pathname}${Y.search}`,W=new Headers($.headers);for(let F of ej6)W.delete(F);let K=$.method!=="GET"&&$.method!=="HEAD",H={method:$.method,headers:W,body:K?$.body:void 0,redirect:"manual",signal:$.signal,duplex:K?"half":void 0};try{return Zo$(await fetch(G(X),H))}catch(F){let U=`${X}${Y.pathname}`;if(console.warn(`[${Q}] preview fetch to ${U} failed: ${F instanceof Error?F.message:String(F)}`),Z.invalidate(),$.method==="GET"||$.method==="HEAD"){let N=await Z.retryBase();if(N)try{return Zo$(await fetch(G(N),H))}catch(B){console.warn(`[${Q}] preview fetch retry to ${U} failed: ${B instanceof Error?B.message:String(B)}`)}}return Qo$(502,"sandbox daemon unreachable")}}var Cp="x-sandbox-preview-not-ready",ej6,$w6;var IC0=L(()=>{ej6=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length","upgrade"],$w6=["connection","keep-alive","transfer-encoding","content-encoding","content-length"]});import{createHash as Zw6,randomBytes as Qw6,randomUUID as Yo$}from"crypto";import*as Uo$ from"net";import{PassThrough as Xw6}from"stream";function Jo$($){if($ instanceof Error)return $.message;if($&&typeof $==="object"){let Z=$;if(Z.error instanceof Error)return Z.error.message;if(typeof Z.message==="string"&&Z.message)return Z.message}return String($)}function Ko$($){return{pool:$.warmPoolName,org:$.pool.tenant}}class iN1{records=new Map;inflight=new Lg;activeGauge=new zC0;stateStore;previewUrlPattern;kubeConfig;capacityProbe;portForward;namespace;sandboxTemplateName;envName;tokenGenerator;idleTtlMs;metrics;previewGateway;sentinelToken;mintCloneUrl;mintPoolCloneUrl;mintOrgFsConfig;forwardPort;daemonAddress;persistCredentials;tenantPools;tenantPoolRefreshMs;templateProbes={};closed=!1;claimWatchAbort=new AbortController;constructor($={}){this.stateStore=$.stateStore??null,this.previewUrlPattern=$.previewUrlPattern??null,this.kubeConfig=$.kubeConfig??Ow6(),this.portForward=new UN1(this.kubeConfig),this.namespace=$.namespace??Yw6,this.sandboxTemplateName=$.sandboxTemplateName??Jw6,this.envName=Pw6($.envName),this.tokenGenerator=$.tokenGenerator??(()=>Qw6(Ww6).toString("hex")),this.idleTtlMs=$.idleTtlMs??Hw6,this.metrics=$.meter?Dw6($.meter):null,this.previewGateway=$.previewGateway&&$.previewUrlPattern?{...$.previewGateway}:null;let Z=$.sentinelToken?.trim()??"";this.sentinelToken=Z.length>0?Z:null,this.mintCloneUrl=$.mintCloneUrl,this.mintPoolCloneUrl=$.mintPoolCloneUrl,this.mintOrgFsConfig=$.mintOrgFsConfig,this.forwardPort=$.forwardPort,this.daemonAddress=$.daemonAddress??"forward",this.persistCredentials=$.persistCredentials??!0;let Q=$.tenantPools;if(this.tenantPools=this.sentinelToken===null?null:new gN1(typeof Q==="function"?Q:()=>Q??[]),this.sentinelToken===null&&(typeof Q==="function"||(Q?.length??0)>0))console.warn(`[${I6}] tenant pools configured without a sentinel token \u2014 ignoring them (warm-pool mode is off)`);this.tenantPoolRefreshMs=$.tenantPoolRefreshMs??Uw6,this.startClaimReaper(),this.startCredentialRefresher(),this.startTenantPoolReconciler()}startClaimReaper(){let $=["app.kubernetes.io/managed-by=studio","app.kubernetes.io/name=studio-sandbox",...this.envName?[`${GJ.env}=${this.envName}`]:[]].join(",");mt$({kc:this.kubeConfig,namespace:this.namespace,labelSelector:$,signal:this.claimWatchAbort.signal,onDelete:(Z)=>this.invalidateRecord(Z)})}async ensure($,Z={}){let Q=c3($);if(Q.startsWith("s-"))throw Error(`ensure: projectRef has no slug source: ${$.projectRef}`);return this.inflight.run(Q,()=>PC0(this.stateStore,$,(X)=>this.ensureLocked($,Q,Z,X)))}async delete($){let Z=await this.getRecord($);if(this.records.delete($),Z)this.dropRecord(Z);if(await this.deleteHttpRouteIfManaged($).catch((Q)=>{console.warn(`[${I6}] HTTPRoute delete failed for ${$}: ${Q instanceof Error?Q.message:String(Q)}`)}),await hR(this.kubeConfig,this.namespace,$),this.stateStore)if(Z)await this.stateStore.delete(Z.id);else await this.stateStore.deleteByHandle($)}lastTermination($){return il$(this.kubeConfig,this.namespace,GJ.sandboxHandle,$,Q7.MAIN_CONTAINER_NAME)}async alive($){return await _D(this.kubeConfig,this.namespace,$)!==void 0}watchClaimLifecycle($,Z){return lt$({kc:this.kubeConfig,namespace:this.namespace,claimName:$,signal:Z})}hasSchedulableCapacity(){return this.capacityProbe??=Qc$(this.kubeConfig,this.namespace),this.capacityProbe()}async getPreviewUrl($){let Z=await this.getRecord($);if(!Z)return null;return this.composePreviewUrl(Z)}async proxyDaemonRequest($,Z,Q){let X=await this.getRecord($);if(!X&&this.previewUrlPattern&&this.stateStore){let K=await this.stateStore.getByHandle($),H=K?.state,F=H?.token;if(K&&F){let N=`http://${H?.adoptedSandboxName??$}.${this.namespace}.svc.cluster.local:${hN}`;try{let B=await EC0(N,F,Z,Q);if(B.status!==404)return B;try{await B.body?.cancel()}catch{}}catch{}}}if(!X)X=await this.resurrectByHandle($);if(!X)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let Y=X,J=performance.now(),G=0,W=(K)=>{return Y=K,{url:K.daemonUrl,token:K.token}};try{let K=await kp(W(X),Z,Q,{unauthorized:async()=>{this.invalidateRecord($);let H=await this.getRecord($).catch(()=>null)??await this.resurrectByHandle($).catch(()=>null);return H?W(H):null},unreachable:async()=>{this.invalidateRecord($);let H=await this.resurrectByHandle($)??await this.getRecord($).catch(()=>null);return H?W(H):null}});return G=K.status,K}finally{this.recordProxyDuration("daemon",G,Y,performance.now()-J)}}async adoptLiveClaim($,Z){if(this.records.has(Z))return!0;let Q=await _D(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!Q||Q.metadata?.deletionTimestamp)return!1;return await this.inflight.run(Z,async()=>{let Y=this.records.get(Z);if(Y)return this.toSandbox(Y);let J=await this.adopt($,Z,Q);if(!J)throw Error(`cannot adopt live claim ${Z}`);return PC0(this.stateStore,$,(G)=>this.finish(J,G,!0,!0,"adopt"))}).catch(()=>null)!=null}async resolvePreviewUpstreamUrl($){if(this.previewUrlPattern)return`http://${await this.resolveServiceNameForHandle($)}.${this.namespace}.svc.cluster.local:${hN}`;let Z=await this.getRecord($);if(Z)return Z.daemonUrl;let Q=await this.resurrectByHandle($);return Q?Q.daemonUrl:null}async daemonEndpoint($){let Z=await this.getRecord($)??await this.resurrectByHandle($);if(!Z)return null;return{url:this.daemonAddress==="service"?`http://${Z.adoptedSandboxName}.${this.namespace}.svc.cluster.local:${hN}`:Z.daemonUrl,token:Z.token}}listSandboxes(){return[...this.records.values()].map(($)=>{let Z=$.ensureOpts,Q=Z?.tenant;return{handle:$.handle,tenant:Q?{orgId:Q.orgId,userId:Q.userId}:null,repos:[Z?.repo,...Z?.extraRepos??[]].filter((X)=>X!==void 0).map(et$).filter((X)=>X!==null),orgFs:Boolean(Z?.orgFsConfigJson)||$.orgFsRedacted===!0}})}async resolveServiceNameForHandle($){let Z=this.records.get($);if(Z)return Z.adoptedSandboxName;if(this.stateStore){let X=(await this.stateStore.getByHandle($).catch(()=>null))?.state?.adoptedSandboxName;if(X)return X}return $}async proxyPreviewRequest($,Z){let Q=performance.now(),X=this.records.get($)??null,Y=0;try{let J=await Sp(Z,{base:()=>this.resolvePreviewUpstreamUrl($),invalidate:()=>this.invalidateRecord($),retryBase:async()=>{return await this.resurrectByHandle($).catch(()=>null)?this.resolvePreviewUpstreamUrl($):null}},I6);return Y=J.status,J}finally{this.recordProxyDuration("preview",Y,X,performance.now()-Q,$)}}async ensureLocked($,Z,Q,X){if(Q.image)console.warn(`[${I6}] opts.image ignored (template ${this.sandboxTemplateName} pins image): got ${Q.image}`);if(X){let G=await X.get($);if(G){let W=await this.rehydrate($,Z,G);if(W)return await this.refreshDaemonGitCredential(W,Q),await this.relayOrgFsConfig(W.daemonUrl,W.token,Q.orgFsConfigJson),this.finish(W,X,!1,!0,"resume");await X.delete($)}}let Y=await _D(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(Y)if(Y.metadata?.deletionTimestamp)await r40(this.kubeConfig,this.namespace,Z).catch((G)=>{console.warn(`[${I6}] wait for terminating claim ${Z} failed: ${G instanceof Error?G.message:String(G)}`)});else if(!hN1(Y)){let G=await this.join($,Z,Q,Y).catch((W)=>{return console.warn(`[${I6}] join of starting claim ${Z} failed, recreating: ${W instanceof Error?W.message:String(W)}`),null});if(G)return this.finish(G,X,!0,!0,"adopt");await hR(this.kubeConfig,this.namespace,Z).catch(()=>{}),await r40(this.kubeConfig,this.namespace,Z).catch((W)=>{console.warn(`[${I6}] wait for deleted claim ${Z} failed: ${W instanceof Error?W.message:String(W)}`)})}else{let G=await this.adopt($,Z,Y).catch((W)=>{return console.warn(`[${I6}] adopt ${Z} failed, recreating: ${W instanceof Error?W.message:String(W)}`),null});if(G)return await this.refreshDaemonGitCredential(G,Q),await this.relayOrgFsConfig(G.daemonUrl,G.token,Q.orgFsConfigJson),this.finish(G,X,!0,!0,"adopt");await hR(this.kubeConfig,this.namespace,Z).catch(()=>{}),await r40(this.kubeConfig,this.namespace,Z).catch((W)=>{console.warn(`[${I6}] wait for deleted claim ${Z} failed: ${W instanceof Error?W.message:String(W)}`)})}let J=await this.provision($,Z,Q);return this.finish(J,X,!0,!1,"fresh")}async finish($,Z,Q,X,Y){let J=this.records.get($.handle),G=J!==void 0;if(J&&J.daemonForward!==$.daemonForward)this.closeForwarder(J.daemonForward);if(this.records.set($.handle,$),Q)await this.persist(Z,$);if(X)await eO0(this.kubeConfig,this.namespace,$.handle,this.computeShutdownTime()).catch((W)=>console.warn(`[${I6}] TTL refresh failed for ${$.handle}: ${W instanceof Error?W.message:String(W)}`));if(this.metrics){let W=cN1($.tenant);if(this.metrics.ensureOutcome.add(1,{...W,outcome:Y}),!G)this.metrics.active.add(1,W),this.activeGauge.markCounted($.handle)}return this.toSandbox($)}buildEnvMap($,Z){let Q={},X=[];for(let[Y,J]of Object.entries($.env??{}))if(Kw6.has(Y))X.push(Y);else Q[Y]=J;if(X.length>0)console.warn(`[${I6}] opts.env keys overlap reserved bootstrap names and were dropped: ${X.join(",")}`);return{...Q,DAEMON_TOKEN:Z.token,DAEMON_BOOT_ID:Z.daemonBootId,APP_ROOT:Z.workdir,PROXY_PORT:String(hN)}}async resolveTemplateName($,Z,Q){let{name:X,probes:Y}=await bN1({purpose:$,tenantPool:Z,...Q?{sandboxImage:Q}:{},templateName:this.sandboxTemplateName,probes:this.templateProbes,now:Date.now(),ttlMs:Gw6,exists:(J)=>ll$(this.kubeConfig,this.namespace,J),onAbsent:(J)=>console.warn(`[${I6}] SandboxTemplate ${J} not found (or not readable) \u2014 this claim falls back to a template without that suffix. Upgrade the sandbox-env chart to the version that renders it.`)});return this.templateProbes=Y,X}buildClaim($,Z,Q,X,Y){let J=this.sentinelToken!==null,G=J?[]:Object.entries(this.buildEnvMap(Z,Q)).sort(([H],[F])=>H<F?-1:H>F?1:0).map(([H,F])=>({name:H,value:F})),W=Rw6(Z),K=Object.keys(W).length>0;return{apiVersion:`${Q7.CLAIM_API_GROUP}/${Q7.CLAIM_API_VERSION}`,kind:"SandboxClaim",metadata:{name:$,namespace:this.namespace,labels:{"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[GJ.env]:this.envName}:{},...lN1(Z.tenant)},...K?{annotations:W}:{}},spec:{sandboxTemplateRef:{name:Y},additionalPodMetadata:{labels:lN1(Z.tenant,{[GJ.role]:"claimed",[GJ.sandboxHandle]:$,...this.envName?{[GJ.env]:this.envName}:{}}),...K?{annotations:W}:{}},env:G,warmpool:rt$(X,J,Y),lifecycle:{shutdownPolicy:"Delete",shutdownTime:this.computeShutdownTime()}}}}async provision($,Z,Q){let X=this.tokenGenerator(),Y=Yo$(),J=VC0,G=this.claimTenantPoolBinding(Q),W=this.buildClaim(Z,Q,{token:X,daemonBootId:Y,workdir:J},G,await this.resolveTemplateName(Q.purpose,G!==null,Q.sandboxImage));try{await _F1(this.kubeConfig,this.namespace,W)}catch(K){if(K instanceof p40)await r40(this.kubeConfig,this.namespace,Z),await _F1(this.kubeConfig,this.namespace,W);else throw K}return this.bind($,Z,Q,G,{token:X,daemonBootId:Y,workdir:J})}claimTenantPoolBinding($){return this.tenantPools?.resolve({tenant:qC0($),image:$.sandboxImage??"default",cloneUrl:$.repo?.cloneUrl,branch:$.repo?.branch})??null}async bind($,Z,Q,X,{token:Y,daemonBootId:J,workdir:G}){let W;try{W=await cl$(this.kubeConfig,this.namespace,Z),await ct$((B)=>this.watchClaimLifecycle(Z,B))}catch(B){throw await hR(this.kubeConfig,this.namespace,Z).catch(()=>{}),B}try{await this.ensureServicePortForAdoptedSandbox(W),await this.ensureHttpRouteForHandle(Z,W,Q.tenant??null)}catch(B){throw await hR(this.kubeConfig,this.namespace,Z).catch(()=>{}),B}let K=await this.openForwarder(W,hN,Z),H=`http://127.0.0.1:${K.localPort}`,F=X?.repo!=null&&W!==Z,U=this.workloadConfigPayload(Q,F),N=J;try{if(await SN1(H),this.sentinelToken!==null){let B=await wC0(H);if(B)N=B.bootId;try{await yN(H,this.sentinelToken,U??{},{rotateToken:Y})}catch(D){if(D instanceof wF&&D.status===401)console.warn(`[${I6}] sentinel rejected by adopted pod (handle=${Z}, sandbox=${W}): pod belongs to another claim; tearing down and reprovisioning`);throw D}}else if(U)await yN(H,Y,U);await this.relayOrgFsConfig(H,Y,Q.orgFsConfigJson)}catch(B){throw this.closeForwarder(K),await this.deleteHttpRouteIfManaged(Z).catch(()=>{}),await hR(this.kubeConfig,this.namespace,Z).catch(()=>{}),B}return{id:$,handle:Z,adoptedSandboxName:W,token:Y,workdir:G,daemonUrl:H,daemonForward:K,workload:Q.workload??null,daemonBootId:N,tenant:Q.tenant??null,tenantPoolPodBound:F,ensureOpts:Cw6(Q)}}workloadConfigPayload($,Z){return Mp({runtime:$?.workload?.runtime??"node",packageManager:$?.workload?.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:$?.repo??null,extraRepos:$?.extraRepos??[],port:$?.workload?.devPort??Go$,tenant:$?.tenant??void 0,...$?{cloneOnly:$.cloneOnly===!0&&!Z}:{}})}async relayOrgFsConfig($,Z,Q){if(!Q)return;await D60($,Z,Q).catch((X)=>console.warn("[org-fs] sidecar config relay failed",X))}async refreshDaemonGitCredential($,Z){let Q=j60(Z);if(!Q)return;try{await yN($.daemonUrl,$.token,Q)}catch(X){console.warn(`[${I6}] git credential refresh failed for ${$.handle}: ${X instanceof Error?X.message:String(X)}`)}}async withFreshCloneUrl($,Z={}){if(!this.mintCloneUrl)return $;try{let Q=await this.mintCloneUrl($,Z);if(!Q)return $;let{credentialExpiresAt:X,...Y}=$;return{...Y,cloneUrl:Q}}catch(Q){return console.warn(`[${I6}] clone credential re-mint failed: ${Q instanceof Error?Q.message:String(Q)}`),$}}async withFreshCredentials($,Z=!1){return{...$,...$.repo?{repo:await this.withFreshCloneUrl($.repo,{tenant:$.tenant})}:{},...$.orgFsConfigJson||Z?{orgFsConfigJson:await Vw6($,this.mintOrgFsConfig)}:{}}}startCredentialRefresher(){if(!this.mintCloneUrl)return;let{signal:$}=this.claimWatchAbort;(async()=>{while(!$.aborted){if(await $$(Nw6,{signal:$}).catch(()=>{}),$.aborted)break;try{await this.refreshAllGitCredentials()}catch(Z){console.warn(`[${I6}] periodic credential refresh failed: ${Z instanceof Error?Z.message:String(Z)}`)}}})()}startTenantPoolReconciler(){let $=this.tenantPools;if(!$)return;let{signal:Z}=this.claimWatchAbort;(async()=>{while(!Z.aborted){try{await this.reconcileTenantPools($)}catch(Q){console.warn(`[${I6}] tenant pool reconcile failed: ${Q instanceof Error?Q.message:String(Q)}`)}await $$(Fw6,{signal:Z}).catch(()=>{})}})()}listTenantPools(){return this.tenantPools?.pools()??[]}markTenantPoolsDirty($,Z){return Promise.resolve(this.tenantPools?.markDirty($,Z)??[])}async reconcileTenantPools($){let Z=Vp($.pools());for(let Q of $.retain(Z))this.recordPoolGone(Q);for(let Q of Z){let X=Q.warmPoolName,Y=await ml$(this.kubeConfig,this.namespace,X);if(Y===null){console.warn(`[${I6}] tenant pool ${X}: no SandboxWarmPool (or no selector yet) in ${this.namespace}`);continue}let J=$.takeDirty(X),G=Y.filter((W)=>!W.labels[GJ.sandboxHandle]);$.retainPods(X,new Set(Y.map((W)=>W.uid)));for(let W of G){if(this.claimWatchAbort.signal.aborted)return;await this.warmPoolPod($,Q,W,J)}this.recordPoolDepth($,Q,Y,G)}}recordPoolGone($){let Z=Ko$($);for(let Q of["ready","bound","pending","failed"])this.metrics?.poolPods.record(0,{...Z,state:Q})}recordPoolDepth($,Z,Q,X){let Y=this.metrics?.poolPods;if(!Y)return;let J=0,G=0;for(let K of X){let H=$.pod(K.uid);if(!H)continue;if(H.failures>=kC0)G++;else if(H.lastConfigAt>0)J++}let W=Ko$(Z);Y.record(J,{...W,state:"ready"}),Y.record(Q.length-X.length,{...W,state:"bound"}),Y.record(X.length-J-G,{...W,state:"pending"}),Y.record(G,{...W,state:"failed"})}async warmPoolPod($,Z,Q,X){let Y=Z.warmPoolName,{workload:J}=Z.repo,G=$.pod(Q.uid);if(G&&G.failures>=kC0){if(Date.now()-G.lastFailureAt<Wo$)return;$.setPod(Q.uid,{...G,failures:0})}let W=X||G!==void 0&&Date.now()-G.lastConfigAt>=this.tenantPoolRefreshMs;if(G&&!W)return;let K=await this.allocationCloneUrl(Z);if(!K){this.recordPoolFailure($,Q,Y,"clone credential mint failed");return}let H={cloneUrl:K,branch:Z.repo.branch,userName:"",userEmail:""},F=await this.openForwarder(Q.name,hN,Q.name).catch(()=>null);if(!F){this.recordPoolFailure($,Q,Y,"port-forward failed");return}let U=`http://127.0.0.1:${F.localPort}`;try{await SN1(U);let N=this.sentinelToken;if(!N)return;if(!await this.isPoolPodUnbound(Q))return;let B=Mp({runtime:J.runtime,packageManager:J.packageManager?{name:J.packageManager,...J.packageManagerPath?{path:J.packageManagerPath}:{}}:null,repo:H,port:J.devPort??Go$})??{},{transition:D}=await yN(U,N,B);if(W&&D!=="bootstrap"&&await this.isPoolPodUnbound(Q))await vt$(U,N,"clone");$.setPod(Q.uid,{pool:Y,lastConfigAt:Date.now(),lastFailureAt:0,failures:0}),console.log(`[${I6}] tenant pool ${Y}: warmed ${Q.name} (${D})`)}catch(N){this.recordPoolFailure($,Q,Y,N instanceof Error?N.message:String(N))}finally{this.closeForwarder(F)}}async allocationCloneUrl({pool:$,repo:Z}){if(!this.mintPoolCloneUrl)return`${Z.repoUrl}.git`;try{return await this.mintPoolCloneUrl({tenant:$.tenant,repoUrl:Z.repoUrl,branch:Z.branch})}catch(Q){return console.warn(`[${I6}] tenant pool clone credential mint failed: ${Q instanceof Error?Q.message:String(Q)}`),null}}isPoolPodUnbound($){return dl$(this.kubeConfig,this.namespace,$.name,GJ.sandboxHandle)}recordPoolFailure($,Z,Q,X){let Y=$.pod(Z.uid),J=(Y?.failures??0)+1;$.setPod(Z.uid,{pool:Q,lastConfigAt:Y?.lastConfigAt??0,lastFailureAt:Date.now(),failures:J});let G=J>=kC0?` \u2014 backing off ${Wo$/60000}min`:"";console.warn(`[${I6}] tenant pool ${Q}: warming ${Z.name} failed (${J}/${kC0})${G}: ${X}`)}async refreshAllGitCredentials(){await st$(this.records.values(),($)=>$.ensureOpts?.repo?.connectionId,async($)=>{if(this.claimWatchAbort.signal.aborted)return;let Z=$.ensureOpts?.repo;if(!Z)return;try{let Q=await this.withFreshCloneUrl(Z,{bufferMs:Bw6,tenant:$.ensureOpts?.tenant});await this.refreshDaemonGitCredential($,{...$.ensureOpts,repo:Q}),$.ensureOpts={...$.ensureOpts,repo:Q}}catch(Q){throw console.warn(`[${I6}] git credential refresh failed for ${$.handle}: ${Q instanceof Error?Q.message:String(Q)}`),Q}})}async rebootstrapDaemon($,Z,Q){if(this.sentinelToken===null)return!1;let X=this.workloadConfigPayload(Q,!1)??{};try{return await yN($,this.sentinelToken,X,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,Q?.orgFsConfigJson),!0}catch(Y){if(Y instanceof wF&&Y.status===401)try{return await yN($,Z,X,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,Q?.orgFsConfigJson),!0}catch(J){return console.warn(`[${I6}] re-bootstrap retry with claim token failed: ${J instanceof Error?J.message:String(J)}`),!1}return console.warn(`[${I6}] re-bootstrap failed: ${Y instanceof Error?Y.message:String(Y)}`),!1}}async ensureServicePortForAdoptedSandbox($){if(!this.previewGateway||!this.previewUrlPattern)return;await el$(this.kubeConfig,this.namespace,$,{name:"daemon",port:hN,targetPort:hN})}async ensureHttpRouteForHandle($,Z,Q){if(!this.previewGateway||!this.previewUrlPattern)return;let X=Sw6(this.previewUrlPattern,$);if(!X)throw new $Y(`Unable to derive preview hostname for ${$} from pattern: ${this.previewUrlPattern}`);let Y={apiVersion:`${xF1.API_GROUP}/${xF1.API_VERSION}`,kind:"HTTPRoute",metadata:{name:$,namespace:this.namespace,labels:lN1(Q??void 0,{[GJ.role]:"claimed",[GJ.sandboxHandle]:$,"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[GJ.env]:this.envName}:{}})},spec:{parentRefs:[{kind:"Gateway",group:"gateway.networking.k8s.io",name:this.previewGateway.name,namespace:this.previewGateway.namespace}],hostnames:[X],rules:[{backendRefs:[{group:"",kind:"Service",name:Z,port:hN}]}]}};await rl$(this.kubeConfig,this.namespace,Y)}async deleteHttpRouteIfManaged($){if(!this.previewGateway)return;await al$(this.kubeConfig,this.namespace,$)}async rehydrate($,Z,Q){let X=Q.state;if(!X.adoptedSandboxName&&!X.podName||!X.token)return null;let Y=await _D(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!Y||!hN1(Y))return null;let J=Y.status?.sandbox?.name??X.adoptedSandboxName??X.podName??Z,G=await this.openAndProbeDaemon(J,Z);if(!G)return null;if(X.daemonBootId&&X.daemonBootId!==G.bootId){if(this.sentinelToken!==null){let W=X.ensureOpts?await this.withFreshCredentials(X.ensureOpts,X.orgFsRedacted===!0):null;if(!await this.rebootstrapDaemon(G.daemonUrl,X.token,W))return this.closeForwarder(G.daemonForward),null}else console.warn(`[${I6}] daemon restart detected (handle=${Z}): stored bootId=${X.daemonBootId} live bootId=${G.bootId}`);await this.stateStore?.put($,{handle:Z,state:{...X,daemonBootId:G.bootId}}).catch((W)=>console.warn(`[${I6}] bootId persist failed for ${Z}: ${W instanceof Error?W.message:String(W)}`))}return{id:$,handle:Z,adoptedSandboxName:J,tenantPoolPodBound:!1,token:X.token,workdir:X.workdir??VC0,daemonUrl:G.daemonUrl,daemonForward:G.daemonForward,workload:X.workload??null,daemonBootId:G.bootId,tenant:X.tenant??null,ensureOpts:X.ensureOpts??null,orgFsRedacted:X.orgFsRedacted===!0}}join($,Z,Q,X){let Y=this.sentinelToken!==null,J=Y?this.tokenGenerator():uN1(X,"DAEMON_TOKEN"),G=Y?Yo$():uN1(X,"DAEMON_BOOT_ID");if(!J||!G)throw new $Y(`claim ${Z} carries no daemon token`);return this.bind($,Z,Q,this.claimTenantPoolBinding(Q),{token:J,daemonBootId:G,workdir:VC0})}async adopt($,Z,Q){if(!hN1(Q))return null;let X=Q.status?.sandbox?.name??Z;if(this.sentinelToken!==null)return null;let Y=uN1(Q,"DAEMON_TOKEN");if(!Y)return null;let J=await this.openAndProbeDaemon(X,Z);if(!J)return null;let G=qw6(Q);if(this.previewGateway)await this.ensureServicePortForAdoptedSandbox(X).catch((W)=>{console.warn(`[${I6}] Service port backfill failed for ${Z}: ${W instanceof Error?W.message:String(W)}`)}),await this.ensureHttpRouteForHandle(Z,X,G).catch((W)=>{console.warn(`[${I6}] HTTPRoute backfill failed for ${Z}: ${W instanceof Error?W.message:String(W)}`)});return{id:$,handle:Z,adoptedSandboxName:X,tenantPoolPodBound:!1,token:Y,workdir:VC0,daemonUrl:J.daemonUrl,daemonForward:J.daemonForward,workload:null,daemonBootId:J.bootId,tenant:G,ensureOpts:null}}async openAndProbeDaemon($,Z){let Q=await this.openForwarder($,hN,Z).catch(()=>null);if(!Q)return null;let X=`http://127.0.0.1:${Q.localPort}`,Y=await wC0(X);if(!Y)return this.closeForwarder(Q),null;return{daemonForward:Q,daemonUrl:X,bootId:Y.bootId}}async getRecord($){let Z=this.records.get($);if(Z)return Z;if(!this.stateStore)return null;let Q=await this.stateStore.getByHandle($);if(!Q)return null;let X=await this.rehydrate(Q.id,$,Q);if(X)this.records.set($,X);return X}async resurrectByHandle($){if(!this.stateStore)return null;let Z=await this.stateStore.getByHandle($);if(!Z)return null;let Q=Z.state,X=Q.ensureOpts;if(!X)return null;let Y=await this.withFreshCredentials(X,Q.orgFsRedacted===!0);if(c3(Z.id)!==$)return null;return await this.ensure(Z.id,Y),this.records.get($)??null}invalidateRecord($){let Z=this.records.get($);if(!Z)return;this.records.delete($),this.dropRecord(Z)}dropRecord($){if(this.closeForwarder($.daemonForward),this.metrics&&this.activeGauge.consume($.handle))this.metrics.active.add(-1,cN1($.tenant))}recordProxyDuration($,Z,Q,X,Y){if(!this.metrics)return;this.metrics.proxyDurationMs.record(X,{...cN1(Q?.tenant??null),source:$,sandbox_handle:Q?.handle??Y??"",status_code:Z||0})}composePreviewUrl($){if(this.previewUrlPattern)return TC0(this.previewUrlPattern,$.handle);return`http://127.0.0.1:${$.daemonForward.localPort}/`}toSandbox($){return{handle:$.handle,workdir:$.workdir,previewUrl:this.composePreviewUrl($),warmPoolAdopted:$.tenantPoolPodBound===!0,provider:"kubernetes"}}async persist($,Z){if(!$)return;let Q={adoptedSandboxName:Z.adoptedSandboxName,token:Z.token,workdir:Z.workdir,workload:Z.workload,daemonBootId:Z.daemonBootId,tenant:Z.tenant,...Z.ensureOpts?this.persistCredentials?{ensureOpts:Z.ensureOpts}:kw6(Z.ensureOpts,Z.orgFsRedacted===!0):{}};await $.put(Z.id,{handle:Z.handle,state:Q})}computeShutdownTime(){return new Date(Date.now()+this.idleTtlMs).toISOString()}async releaseAfter($,Z){let Q=await _D(this.kubeConfig,this.namespace,$);if(!Q)return;let X=Mw6(Q.spec?.lifecycle?.shutdownTime,new Date(Date.now()+Z));if(!X)return;await eO0(this.kubeConfig,this.namespace,$,X).catch((Y)=>console.warn(`[${I6}] release failed for ${$}: ${Y instanceof Error?Y.message:String(Y)}`))}async renewTtl($){let Z=await _D(this.kubeConfig,this.namespace,$);if(!Z)return;let Q=Iw6(Z.spec?.lifecycle?.shutdownTime,new Date(Date.now()+this.idleTtlMs));if(!Q)return;await eO0(this.kubeConfig,this.namespace,$,Q).catch((X)=>console.warn(`[${I6}] TTL renew failed for ${$}: ${X instanceof Error?X.message:String(X)}`))}openForwarder($,Z,Q=$){if(this.forwardPort)return this.forwardPort($,Z,Q);let X=jw6(Q,Z);return new Promise((Y,J)=>{let G=(W,K)=>{let H=Uo$.createServer((F)=>this.handleForwardedConnection(F,$,Z,Q));H.once("error",(F)=>{if(F.code==="EADDRINUSE"&&K<Lw6){try{H.close()}catch{}let U=mN1+(W-mN1+1)%No$;G(U,K+1);return}J(F)}),H.listen(W,"127.0.0.1",()=>{let F=H.address();if(!F||typeof F==="string"){H.close(),J(Error("port-forward listener failed to bind"));return}let U=F.port;Y({localPort:U,close:()=>H.close((N)=>{if(N)console.warn(`[${I6}] port-forward close on :${U} errored: ${N.message}`)})})})};G(X,0)})}handleForwardedConnection($,Z,Q,X){let Y=new Xw6,J=null,G=!1,W=()=>{if(G)return;if(G=!0,Y.destroy(),J)try{J.close()}catch{}if(!$.destroyed)$.destroy()};$.pipe(Y),$.on("error",W),$.on("close",W),this.portForward.portForward(this.namespace,Z,[Q],$,null,Y).then((K)=>{let H=typeof K==="function"?K():K;if(!H){W();return}if(J=H,J.on("close",W),J.on("error",(F)=>{console.warn(`[${I6}] port-forward to ${Z}:${Q} dropped mid-connection: ${Jo$(F)}`,JSON.stringify(dN1(F))),this.invalidateRecord(X),W()}),G)try{J.close()}catch{}}).catch((K)=>{console.warn(`[${I6}] port-forward to ${Z}:${Q} failed: ${Jo$(K)}`,JSON.stringify(dN1(K))),this.invalidateRecord(X),W()})}closeForwarder($){$.close()}close(){if(this.closed)return;this.closed=!0,this.claimWatchAbort.abort();for(let $ of this.records.values())this.dropRecord($);this.records.clear()}}function Dw6($){return{active:$.createUpDownCounter("studio.sandbox.active",{description:"Active sandbox count, by runner kind, owning org, and daemon impl. Cross-checks the cAdvisor-derived count from the cluster \u2014 divergence between the two indicates orphaned claims (studio deleted but K8s didn't reap) or unattributed pods.",unit:"{sandbox}"}),ensureOutcome:$.createCounter("studio.sandbox.ensure.outcome",{description:"Outcome of each ensure() call: fresh provision, resume from state-store after restart, or adopt of a cluster-side claim studio didn't know about. Cold-start ratio is the primary input for warm-pool sizing.",unit:"{call}"}),proxyDurationMs:$.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of studio-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"}),poolPods:$.createGauge("studio.sandbox.pool.pods",{description:"Tenant warm pool depth by pool and state: ready (warmed and unbound \u2014 what a claim can actually bind instantly), bound (serving a user), pending (unbound, not yet warmed), failed (gave up after repeated bootstrap failures). Alert on sustained ready=0: a pool that is always empty is doing nothing while costing N pods.",unit:"{pod}"})}}function dN1($){let Z=[],Q=$;for(let X=0;X<5&&Q instanceof Error;X++){let Y=Q;if(Z.push({name:Y.name,message:Y.message,...Y.code!==void 0?{code:Y.code}:{},...Y.errno!==void 0?{errno:Y.errno}:{}}),Y.cause===Q)break;Q=Y.cause}if(Q!==void 0&&!(Q instanceof Error)&&Q!==null){let X=Q,Y=X.error instanceof Error?dN1(X.error).chain:void 0;Z.push({nonError:String(Q),...typeof X.type==="string"?{type:X.type}:{},...typeof X.message==="string"?{message:X.message}:{},...X.code!==void 0?{code:X.code}:{},...typeof X.reason==="string"?{reason:X.reason}:{},...Y?{error:Y}:{},...Y===void 0&&X.error!==void 0?{rawError:String(X.error)}:{},keys:Object.keys(X)})}return{chain:Z}}function Ow6(){let $=new $C0;return $.loadFromDefault(),$}function hN1($){return Boolean($.status?.conditions?.some((Z)=>Z.type==="Ready"&&Z.status==="True"))}function uN1($,Z){let Q=$.spec?.env;if(!Q)return null;for(let X of Q)if(X.name===Z&&X.value)return X.value;return null}function jw6($,Z){let Q=Zw6("sha256").update(`${$}:${Z}`).digest();return mN1+Q.readUInt32BE(0)%No$}function Ho$($){let Z=$.slice(0,Ew6);return ww6.test(Z)?Z:""}function Pw6($){if($===void 0)return null;let Z=$.trim();if(Z==="")return null;if(!zw6.test(Z))throw Error(`AgentSandboxProvider: envName=${JSON.stringify(Z)} is not a valid DNS-label-safe environment name (lowercase alphanumeric or '-', starts with a letter, ends alphanumeric, \u226432 chars). Studio sets this from STUDIO_ENV; check the studio chart's configMap.`);return Z}function lN1($,Z={}){let Q={...Z};if($){let X=Ho$($.orgId),Y=Ho$($.userId);if(X)Q[GJ.orgId]=X;if(Y)Q[GJ.userId]=Y}return Q}function Dg($){let Z="";for(let Q of $){let X=Q.codePointAt(0)??0;Z+=X<32||X===127?" ":Q}return Z.slice(0,Tw6)}function Aw6($){try{let Z=new URL($);return Z.username="",Z.password="",Z.toString()}catch{return""}}function Rw6($){let Z={},Q=$.tenant;if(Q?.orgSlug)Z[EF.orgSlug]=Dg(Q.orgSlug);if(Q?.orgName)Z[EF.orgName]=Dg(Q.orgName);if(Q?.userEmail)Z[EF.userEmail]=Dg(Q.userEmail);if(Q?.userName)Z[EF.userName]=Dg(Q.userName);let X=$.repo;if(X){if(X.displayName)Z[EF.gitRepo]=Dg(X.displayName);let Y=Aw6(X.cloneUrl);if(Y)Z[EF.gitRepoUrl]=Dg(Y);let J=$.branch??X.branch;if(J)Z[EF.gitBranch]=Dg(J)}return Z}function qw6($){let Z=$.metadata?.labels;if(!Z)return null;let Q=Z[GJ.orgId],X=Z[GJ.userId];if(!Q||!X)return null;let Y=$.metadata?.annotations??{};return{orgId:Q,userId:X,orgSlug:Y[EF.orgSlug],orgName:Y[EF.orgName],userEmail:Y[EF.userEmail],userName:Y[EF.userName]}}function Mw6($,Z){if($){let Q=new Date($).getTime();if(Number.isFinite(Q)&&Q<=Z.getTime())return null}return Z.toISOString()}function Iw6($,Z){if($){let Q=new Date($).getTime();if(Number.isFinite(Q)&&Q>=Z.getTime())return null}return Z.toISOString()}function cN1($){return{org_id:$?.orgId??"",user_id:$?.userId??"",runner_kind:"agent-sandbox"}}async function Vw6($,Z){if(!Z||!$.tenant)return $.orgFsConfigJson;try{return await Z($.tenant)??$.orgFsConfigJson}catch(Q){return console.warn(`[${I6}] org-fs credential re-mint failed: ${Q instanceof Error?Q.message:String(Q)}`),$.orgFsConfigJson}}function Fo$($){try{let Z=new URL($.cloneUrl);Z.username="",Z.password="";let{submoduleCredentials:Q,credentialExpiresAt:X,...Y}=$;return{...Y,cloneUrl:Z.toString()}}catch{return null}}function kw6($,Z){let{orgFsConfigJson:Q,repo:X,extraRepos:Y,...J}=$,G=J,W=X&&Fo$(X);if(W)G.repo=W;if(Y)G.extraRepos=Y.map(Fo$).filter((K)=>K!==null);return Q||Z?{ensureOpts:G,orgFsRedacted:!0}:{ensureOpts:G}}function Cw6($){let Z={};if($.branch)Z.branch=$.branch;if($.repo)Z.repo=$.repo;if($.workload)Z.workload=$.workload;if($.env&&Object.keys($.env).length>0)Z.env=$.env;if($.tenant)Z.tenant=$.tenant;if($.cloneOnly)Z.cloneOnly=!0;if($.purpose)Z.purpose=$.purpose;if($.sandboxImage)Z.sandboxImage=$.sandboxImage;if($.orgFsConfigJson)Z.orgFsConfigJson=$.orgFsConfigJson;return Object.keys(Z).length>0?Z:null}function Sw6($,Z){try{return new URL(TC0($,Z)).hostname||null}catch{return null}}var I6="AgentSandboxProvider",Yw6="agent-sandbox-system",Jw6="studio-sandbox",Gw6=300000,hN=9000,Go$=3000,VC0="/app",Ww6=32,Kw6,Hw6=900000,Fw6=60000,Uw6=1800000,kC0=3,Wo$=1800000,Nw6=900000,Bw6=1800000,mN1=40000,No$=1e4,Lw6=256,GJ,EF,ww6,Ew6=63,zw6,Tw6=253;var Bo$=L(()=>{$8();Xc$();Vt$();Bg();Ip();$j0();n40();dt$();z60();$o$();MC0();IC0();Kw6=new Set(["DAEMON_TOKEN","DAEMON_BOOT_ID","APP_ROOT","PROXY_PORT"]);GJ={role:"studio.decocms.com/role",sandboxHandle:"studio.decocms.com/sandbox-handle",orgId:"studio.decocms.com/org-id",userId:"studio.decocms.com/user-id",env:"studio.decocms.com/env"},EF={orgSlug:"studio.decocms.com/org-slug",orgName:"studio.decocms.com/org-name",userEmail:"studio.decocms.com/user-email",userName:"studio.decocms.com/user-name",gitRepo:"studio.decocms.com/git-repo",gitRepoUrl:"studio.decocms.com/git-repo-url",gitBranch:"studio.decocms.com/git-branch"},ww6=/^([A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?)?$/;zw6=/^[a-z]([a-z0-9-]{0,30}[a-z0-9])?$/});var Lo$={};J0(Lo$,{tenantPoolSchema:()=>pt$,tenantPoolRepoSchema:()=>E60,tenantPoolFieldsSchema:()=>xN1,tenantPoolAllocations:()=>Vp,resolveTenantPoolBinding:()=>fN1,renderTenantPoolWarmPools:()=>ot$,normalizeRepoUrl:()=>gN,allocationsMatchingPush:()=>yN1,TenantPoolCapacityError:()=>RC0,PREVIEW_NOT_READY_HEADER:()=>Cp,AgentSandboxProvider:()=>iN1});var P60=L(()=>{Bo$();z60()});import{z as Og}from"zod";function CC0($){if(!$||$.trim()==="")return[];let Z=Og.array(_w6).parse(JSON.parse($)),Q=new Set;for(let X of Z){if(Q.has(X.name))throw Error(`tenant pools: duplicate pool name ${X.name}`);Q.add(X.name)}return Z}function Do$($){let Z=gN(`https://github.com/${$.repo}`);if(!Z)throw Error(`tenant pools: bad repo ${$.repo}`);return Z}function Oo$($){return $.map((Z)=>({name:Z.name,tenant:Z.orgId,size:1,image:"default",repos:[{repoUrl:Do$(Z),branch:Z.branch,workload:Z.workload,replicas:1,warmPoolName:Z.name}]}))}function pN1($,Z){let Q=gN(Z.repoUrl)?.toLowerCase(),X=$.find((J)=>J.orgId===Z.tenant&&J.branch===Z.branch&&Do$(J).toLowerCase()===Q);if(!X)return null;let Y=`https://github.com/${X.repo}.git`;return X.connectionId?{cloneUrl:Y,connectionId:X.connectionId}:{cloneUrl:Y}}function jo$($,Z){return async(Q)=>{let X=pN1($,Q);if(!X)return null;return X.connectionId?Z(X):X.cloneUrl}}var _w6;var SC0=L(()=>{P60();_w6=Og.object({name:Og.string().max(63).regex(/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/,"pool name must be a DNS label (lowercase alphanumeric and '-')"),orgId:Og.string().min(1),repo:Og.string().regex(/^[^/\s]+\/[^/\s]+$/,"repo must be `owner/name`"),connectionId:Og.string().min(1).optional(),branch:Og.string().min(1).default("main"),workload:E60.shape.workload})});function aN1($,Z=Date.now()){if($===void 0)return;return $===null?Z+vw6:$.getTime()}function rN1($){return JSON.stringify([$.orgId,$.userId])}function wo$($,Z){let Q=gN(Z);return Q?JSON.stringify([$,Q.toLowerCase()]):null}function fw6($,Z){return"repositoryId"in Z?$.repositoryOrgs.get(Z.repositoryId):$.connectionOrgs.get(Z.connectionId)}function Eo$($){let{records:Z,now:Q}=$,X=new Map,Y=new Map,J=new Map,G=0;for(let W of $.pools)for(let{repoUrl:K,branch:H}of W.repos){let F=wo$(W.tenant,K),U=pN1($.legacyPools??[],{tenant:W.tenant,repoUrl:K,branch:H});if(F&&U){if(U.connectionId)Y.set(F,{tenant:W.tenant,repoUrl:K,connectionId:U.connectionId,cloneUrl:U.cloneUrl});continue}let N=F?Z.orgRepositories.get(F):void 0;if(!F||!N){G++;continue}Y.set(F,{tenant:W.tenant,repoUrl:K,repositoryId:N})}for(let W of $.sandboxes){let K=W.tenant;if(!K)continue;let H=Z.members.get(rN1(K));if(H===void 0){G++;continue}for(let U of W.repos){if(fw6(Z,U)!==K.orgId){G++;continue}let N="repositoryId"in U?{repositoryId:U.repositoryId}:{connectionId:U.connectionId,repo:U.repo.toLowerCase()},B={orgId:K.orgId,userId:K.userId};X.set(JSON.stringify([B,N]),{tenant:B,repo:N})}let F=W.orgFsConfigExpiresAt;if(W.orgFs&&(F===null||F-Q<xw6))J.set(rN1(K),{orgId:K.orgId,userId:K.userId,orgSlug:H})}return{clones:[...X.values()],poolClones:[...Y.values()],orgFs:[...J.values()],refused:G}}async function zo$($,Z,Q){let X=new Set,Y=new Set,J=new Set,G=new Set,W=new Set(Q.map((D)=>D.tenant)),K=new Set;for(let D of Q)for(let{repoUrl:O}of D.repos){let j=tX(O);if(j)K.add(j.path.toLowerCase())}for(let D of Z){if(D.tenant)X.add(D.tenant.orgId),Y.add(D.tenant.userId);for(let O of D.repos)if("repositoryId"in O)G.add(O.repositoryId);else J.add(O.connectionId)}let[H,F,U,N]=await Promise.all([X.size===0?[]:$.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.organizationId as orgId","member.userId as userId","organization.slug as slug"]).where("member.organizationId","in",[...X]).where("member.userId","in",[...Y]).execute(),J.size===0?[]:$.selectFrom("connections").select(["id","organization_id"]).where("id","in",[...J]).execute(),G.size===0?[]:$.selectFrom("repositories").select(["id","organization_id"]).where("id","in",[...G]).execute(),K.size===0?[]:$.selectFrom("repositories").select(["id","organization_id","provider","host","path"]).where("organization_id","in",[...W]).where((D)=>D(D.fn("lower",["path"]),"in",[...K])).execute()]),B=new Map;for(let D of N){let O=wo$(D.organization_id,k80({provider:D.provider,host:D.host,path:D.path}));if(O&&!B.has(O))B.set(O,D.id)}return{members:new Map(H.map((D)=>[rN1(D),D.slug])),connectionOrgs:new Map(F.map((D)=>[D.id,D.organization_id])),repositoryOrgs:new Map(U.map((D)=>[D.id,D.organization_id])),orgRepositories:B}}function oN1($){return $ instanceof Error?$.message:String($)}async function Po$($,Z,Q){let X=0;if($.clones.length>_p||$.poolClones.length>_p||$.orgFs.length>tN1)console.warn(`[sandbox-credential-push] ${$.clones.length} clone, ${$.poolClones.length} pool clone and ${$.orgFs.length} org-fs mints planned; minting the first ${_p}, ${_p} and ${tN1}`);let Y=await E9($.clones.slice(0,_p),nN1,async(U)=>{let N="repositoryId"in U.repo?{cloneUrl:"",repositoryId:U.repo.repositoryId}:{cloneUrl:`https://github.com/${U.repo.repo}.git`,connectionId:U.repo.connectionId};try{let B=await Z.mintCloneUrl(N,{bufferMs:_C0});return B?{tenant:U.tenant,repo:U.repo,cloneUrl:B,expiresAt:Q.now+_C0}:null}catch(B){return X++,console.warn(`[sandbox-credential-push] clone mint failed: ${oN1(B)}`),null}}),J=await E9($.poolClones.slice(0,_p),nN1,async(U)=>{try{let N=await Z.mintCloneUrl("repositoryId"in U?{cloneUrl:"",repositoryId:U.repositoryId}:{cloneUrl:U.cloneUrl,connectionId:U.connectionId},{bufferMs:_C0});return N?{tenant:U.tenant,repoUrl:U.repoUrl,cloneUrl:N,expiresAt:Q.now+_C0}:null}catch(N){return X++,console.warn(`[sandbox-credential-push] pool clone mint failed: ${oN1(N)}`),null}}),G=await E9($.orgFs.slice(0,tN1),nN1,async(U)=>{try{let N=await Z.mintOrgFsConfig(U);return N?{tenant:{orgId:U.orgId,userId:U.userId},orgFsConfigJson:N,expiresAt:Q.now+Q.orgFsLifetimeMs}:null}catch(N){return X++,console.warn(`[sandbox-credential-push] org-fs mint failed: ${oN1(N)}`),null}}),W=Y.filter((U)=>U!==null),K=J.filter((U)=>U!==null),H=G.filter((U)=>U!==null),F=[];for(let U=0;U<Math.max(W.length,K.length,H.length);U+=Pz)F.push({cloneUrls:W.slice(U,U+Pz),poolCloneUrls:K.slice(U,U+Pz),orgFsConfigs:H.slice(U,U+Pz)});return{batches:F,failed:X}}var _C0=2700000,vC0,vw6=86400000,xw6=86400000,nN1=8,_p=2000,tN1=200;var xC0=L(()=>{CF1();P60();r4();$8();zz();SC0();vC0=jl$-3600000});var WJ;var T60=L(()=>{WJ=class WJ extends Error{code;status;path;constructor($,Z,Q){super(Z.message||`Freestyle API error: ${Z.code}`);this.name="FreestyleApiError",this.code=Z.code,this.status=$,this.path=Q,Object.setPrototypeOf(this,WJ.prototype)}}});function To$(){return typeof process<"u"&&Boolean(process.versions?.node)}var fC0=($,Z)=>globalThis.fetch($,Z);async function bw6(){if(!To$())return null;try{return await import("undici")}catch{return null}}async function gw6(){let $=await bw6();if(!$)return null;let Z=new $.Agent({allowH2:!0,connections:yw6});return(Q,X)=>$.fetch(Q,{...X,dispatcher:Z})}function hw6($){return(typeof $==="string"?$:$ instanceof URL?$.href:$.url).startsWith("https:")}function Ao$(){let $,Z=()=>{return $??=gw6().then((Q)=>Q??fC0).catch(()=>fC0),$};return(Q,X)=>hw6(Q)?Z().then((Y)=>Y(Q,X)):fC0(Q,X)}var yw6=4;var Ro$=()=>{};function iw6($){return new Promise((Z)=>setTimeout(Z,$))}function pw6($){if(!$)return"";let Z=new URLSearchParams;for(let[X,Y]of Object.entries($)){if(Y===void 0||Y===null)continue;Z.set(X,String(Y))}let Q=Z.toString();return Q?`?${Q}`:""}function p6($){return encodeURIComponent($)}class sN1{baseUrl;authenticationHeaders;fetchImpl;backgroundEligible;constructor($={}){if(this.baseUrl=($.baseUrl??dw6).replace(/\/+$/,""),!$.fetch&&!globalThis.fetch)throw Error("No fetch implementation available. Pass `fetch` in FreestyleOptions when running on a runtime without a global fetch.");if(this.fetchImpl=$.fetch??Ao$(),"identityAccessToken"in $&&$.identityAccessToken){this.authenticationHeaders={[uw6]:$.identityAccessToken},this.backgroundEligible=!1;return}if(this.backgroundEligible=!0,"stackAccessToken"in $&&$.stackAccessToken){this.authenticationHeaders={Authorization:`Bearer ${$.stackAccessToken}`,"X-Freestyle-Team-Id":$.teamId};return}let Z=$.apiKey??globalThis.process?.env?.FREESTYLE_API_KEY;if(!Z)throw Error("No Freestyle API key provided. Pass `apiKey` in FreestyleOptions or set FREESTYLE_API_KEY.");this.authenticationHeaders={Authorization:`Bearer ${Z}`}}authHeaders(){return{...this.authenticationHeaders}}url($,Z){return`${this.baseUrl}${$}${pw6(Z)}`}async fetch($,Z={}){let Q=new Headers(Z.headers);for(let[X,Y]of Object.entries(this.authHeaders()))if(!Q.has(X))Q.set(X,Y);return this.fetchImpl(this.absoluteUrl($),{...Z,headers:Q})}absoluteUrl($){return/^https?:\/\//i.test($)?$:`${this.baseUrl}${$}`}async request($,Z,{query:Q,body:X,rawBody:Y,signal:J}={}){let G={...this.authHeaders()};if(this.backgroundEligible)G[qo$]=String(cw6);let W;if(Y!==void 0)G["Content-Type"]="application/octet-stream",W=Y;else if(X!==void 0)G["Content-Type"]="application/json",W=JSON.stringify(X);let K=this.url(Z,Q),H=await this.fetchImpl(K,{method:$,headers:G,body:W,signal:J});if(this.backgroundEligible&&H.status===202)try{return await this.pollBackgroundRequest(H,Z)}catch(F){if($==="GET"&&F instanceof WJ&&F.code==="BACKGROUND_RESULT_UNSTORABLE"){delete G[qo$];let U=await this.fetchImpl(K,{method:$,headers:G,body:W});return this.finalize(U,Z)}throw F}return this.finalize(H,Z)}async pollBackgroundRequest($,Z){let Q=await $.json().catch(()=>({})),X=$.headers.get(lw6)??Q.requestId,Y=Q.resultUrl??(X?`/v5/background-requests/${p6(X)}`:void 0);if(!Y)throw new WJ($.status,{code:"BACKGROUND_PROTOCOL_ERROR",message:"202 Accepted carried no background request id"},Z);let J=0;for(;;){await iw6(mw6);let G;try{G=await this.fetch(Y,{method:"GET"}),J=0}catch(W){if(++J>=5)throw W;continue}if(G.status===202)continue;return this.finalize(G,Z)}}async finalize($,Z){if(!$.ok){let X;try{X=await $.json()}catch{X={code:"UNKNOWN_ERROR",message:await $.text().catch(()=>$.statusText)}}throw new WJ($.status,X,Z)}if($.status===204)return;let Q=await $.text();if(!Q)return;return JSON.parse(Q)}get($,Z){return this.request("GET",$,{query:Z})}post($,Z){return this.request("POST",$,{body:Z??{}})}patch($,Z){return this.request("PATCH",$,{body:Z??{}})}put($,Z){return this.request("PUT",$,{body:Z??{}})}putEmpty($){return this.request("PUT",$,{})}putBytes($,Z,Q,X){return this.request("PUT",$,{query:Q,rawBody:Z,signal:X})}async getBytes($,Z,Q={}){let X={...this.authHeaders()};if(Q.range)X.Range=Q.range;let Y=await this.fetchImpl(this.url($,Z),{method:"GET",headers:X,signal:Q.signal});if(!Y.ok){let J;try{J=await Y.json()}catch{J={code:"UNKNOWN_ERROR",message:await Y.text().catch(()=>Y.statusText)}}throw new WJ(Y.status,J,$)}return Y}delete($,Z){return this.request("DELETE",$,{query:Z})}}var uw6="x-freestyle-identity-access-token",qo$="x-freestyle-background-after-secs",lw6="x-freestyle-background-request-id",cw6=5,mw6=2000,dw6="https://api.freestyle.sh";var PK=L(()=>{T60();Ro$()});class eN1{client;verifications;certificates;placeholder;constructor($){this.client=$,this.verifications=new Mo$($),this.certificates=new Io$($),this.placeholder=new Vo$($)}async list(){let{domains:$}=await this.client.get("/v5/domains");return $}}class Mo${client;constructor($){this.client=$}create($){return this.client.post("/v5/verifications",{domain:$})}async list($={}){let{verifications:Z}=await this.client.get("/v5/verifications",$);return Z}get($){return this.client.get(`/v5/verifications/${p6($)}`)}complete($){return this.client.putEmpty(`/v5/verifications/${p6($)}`)}delete($){return this.client.delete(`/v5/verifications/${p6($)}`)}}class Io${client;constructor($){this.client=$}async list(){let{certificates:$}=await this.client.get("/v5/certificates");return $}createWildcard($){return this.client.post("/v5/certificates/wildcard",{domain:$})}}class Vo${client;constructor($){this.client=$}async get(){try{return await this.client.get("/v5/domains/placeholder")}catch($){if($ instanceof WJ&&$.status===404)return null;throw $}}set($){return this.client.put("/v5/domains/placeholder",$)}delete(){return this.client.delete("/v5/domains/placeholder")}}var $B1=L(()=>{PK();T60()});function J5($,Z){throw new QB1($,Z)}function ZB1($){return nw6.some((Z)=>$[Z]!==void 0)}function XB1($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function ow6($,Z){let Q=Z.lastIndexOf("/");if(Q<0)J5($,`${$} \`${Z}\` is not a CIDR: expected address/prefix, e.g. 203.0.113.0/24 or 2001:db8::/32`);let X=Z.slice(0,Q),Y=Z.slice(Q+1);if(!/^\d+$/.test(Y))J5($,`${$} \`${Z}\`: prefix length must be a number`);let J=Number(Y),G=X.includes(":"),W=G?128:32;if(J>W)J5($,`${$} \`${Z}\`: prefix length must be 0\u2013${W}`);if(!G&&!/^\d{1,3}(\.\d{1,3}){3}$/.test(X))J5($,`${$} \`${Z}\`: \`${X}\` is not an IP address`)}function _o$($,Z){if(!XB1($))J5(Z,`${Z} must be an object`);for(let X of Object.keys($))if(!ko$.includes(X))J5(`${Z}.${X}`,`${Z} has unknown field \`${X}\`. Expected one of: ${ko$.join(", ")}`);let Q=$;for(let X of["vmId","vpcId","tunnelId","cidr"]){let Y=Q[X];if(Y!==void 0&&(typeof Y!=="string"||Y.length===0))J5(`${Z}.${X}`,`${Z}.${X} must be a non-empty string`)}if(Q.public!==void 0&&Q.public!==!0)J5(`${Z}.public`,`${Z}.public must be true when present: it declares the public Internet. Omit the field to match something else`);if(Q.public===!0){if(Q.vmId!==void 0)J5(`${Z}.public`,`${Z} cannot combine \`public: true\` with \`vmId\`: that would mean the VM only when reached over its public address, a distinction this API does not make yet. Use \`vmId\` alone to match the VM on any path, or \`public: true\` alone to match public addresses`);if(Q.vpcId!==void 0)J5(`${Z}.public`,`${Z} cannot combine \`public: true\` with \`vpcId\`: that would mean the network's members only when reached over their public addresses, a distinction this API does not make yet. Use \`vpcId\` alone or \`public: true\` alone`);if(Q.tunnelId!==void 0)J5(`${Z}.public`,`${Z} cannot combine \`public: true\` with \`tunnelId\`: traffic through a tunnel arrives over the tunnel, not over the public Internet. Use \`tunnelId\` alone`)}if(Q.cidr!==void 0)ow6(`${Z}.cidr`,Q.cidr);if(Q.protocol!==void 0&&!Co$.includes(Q.protocol))J5(`${Z}.protocol`,`${Z}.protocol must be one of: ${Co$.join(", ")} (got \`${String(Q.protocol)}\`)`);if(Q.port!==void 0){if(!Number.isInteger(Q.port)||Q.port<1||Q.port>65535)J5(`${Z}.port`,`${Z}.port must be an integer between 1 and 65535`);if(Q.protocol===void 0)J5(`${Z}.protocol`,`${Z}.port ${Q.port} requires ${Z}.protocol: set it to "tcp" or "udp" so the rule opens one transport rather than both`);if(!tw6.includes(Q.protocol))J5(`${Z}.port`,`${Z}.protocol "${Q.protocol}" has no ports; remove ${Z}.port ${Q.port}`)}}function fo$($,Z){if(!XB1($))J5(Z||"rule",`${Z||"rule"} must be an object`);for(let X of Object.keys($))if(!vo$.includes(X))J5(`${Z}${X}`,`Unknown field \`${X}\`. Expected one of: ${vo$.join(", ")}`);let Q=$;if(Q.action===void 0)J5(`${Z}action`,`${Z}action is required. Write \`action: "allow"\` \u2014 every rule states what it does rather than defaulting to it`);if(Q.action!=="allow")J5(`${Z}action`,`${Z}action must be "allow" (got \`${String(Q.action)}\`). Only allow rules exist today`);if(Q.description!==void 0){if(typeof Q.description!=="string")J5(`${Z}description`,"description must be a string");if(Q.description.length>So$)J5(`${Z}description`,`description is too long (${Q.description.length} characters, maximum ${So$})`)}if(Q.source===void 0)J5(`${Z}source`,`${Z}source is required`);if(Q.destination===void 0)J5(`${Z}destination`,`${Z}destination is required`);return _o$(Q.source,`${Z}source`),_o$(Q.destination,`${Z}destination`),Q}function rw6($){let Z=fo$($,"");for(let Q of["source","destination"]){let X=Z[Q];if(ZB1(X))continue;let Y=[X.port!==void 0?`port ${X.port}`:void 0,X.protocol!==void 0?`protocol ${X.protocol}`:void 0].filter(Boolean).join(", ");J5(Q,Y?`${Q} only narrows traffic (${Y}) without saying what it is. Add \`vmId\`, \`vpcId\`, \`tunnelId\`, \`cidr\`, or \`public: true\`. Leaving it out to mean "this VM" only works inside vms.create`:`${Q} is empty. A matcher must say what the traffic is: \`vmId\`, \`vpcId\`, \`tunnelId\`, \`cidr\`, or \`public: true\` for the public Internet`)}return Z}function bC0($,Z="VM"){if($===void 0||$===null)J5("firewall",`firewall is required on a ${Z} create. A ${Z} gets nothing implicitly, so state what it may reach \u2014 \`{ rules: [] }\` if the answer is nothing`);if(!XB1($))J5("firewall","firewall must be an object with a `rules` array");for(let X of Object.keys($))if(X!=="rules")J5(`firewall.${X}`,`firewall has unknown field \`${X}\`. Expected: rules`);let Q=$.rules;if(!Array.isArray(Q))J5("firewall.rules","firewall.rules must be an array");return Q.forEach((X,Y)=>{let J=`firewall.rules[${Y}].`,G=fo$(X,J),W=ZB1(G.source),K=ZB1(G.destination);if(!W&&!K&&Z!=="network")J5(`firewall.rules[${Y}]`,`firewall.rules[${Y}]: both source and destination refer to the ${Z} being created, which allows nothing. Give one of them a \`vmId\`, \`vpcId\`, \`tunnelId\`, \`cidr\`, or \`public: true\``);if(W&&K)J5(`firewall.rules[${Y}]`,`firewall.rules[${Y}]: neither end refers to the ${Z} being created. Leave one endpoint's identity unset so it means this ${Z}, or create the rule with firewall.rules.create instead`)}),$}function xo$($){return`/v5/firewall/rules/${p6($)}`}class bo${client;constructor($){this.client=$}async create($){let Z=rw6($);return this.client.post("/v5/firewall/rules",Z)}list($={}){return this.client.get("/v5/firewall/rules",$)}get($){return this.client.get(xo$($))}delete($){return this.client.delete(xo$($))}}class YB1{client;rules;constructor($){this.client=$,this.rules=new bo$($)}evaluate($){return this.client.post("/v5/firewall/evaluate",$)}}var QB1,ko$,nw6,Co$,tw6,So$=1024,vo$;var A60=L(()=>{PK();QB1=class QB1 extends Error{path;constructor($,Z){super(Z);this.name="FirewallRuleValidationError",this.path=$,Object.setPrototypeOf(this,QB1.prototype)}};ko$=["vmId","vpcId","tunnelId","cidr","public","port","protocol"],nw6=["vmId","vpcId","tunnelId","cidr","public"],Co$=["tcp","udp","icmp"],tw6=["tcp","udp"];vo$=["action","source","destination","description"]});function JB1($){return`/v5/identities/${p6($)}`}class yo${client;basePath;constructor($,Z){this.client=$,this.basePath=Z}create(){return this.client.post(`${this.basePath}/tokens`)}list(){return this.client.get(`${this.basePath}/tokens`)}revoke($){return this.client.delete(`${this.basePath}/tokens/${p6($)}`)}}class go${client;basePath;constructor($,Z){this.client=$,this.basePath=Z}list(){return this.client.get(`${this.basePath}/permissions/vm`)}grant($){return this.client.post(`${this.basePath}/permissions/vm`,$)}get($){return this.client.get(`${this.basePath}/permissions/vm/${p6($)}`)}update($,Z){return this.client.patch(`${this.basePath}/permissions/vm/${p6($)}`,{allowedLinuxUsers:Z})}revoke($){return this.client.delete(`${this.basePath}/permissions/vm/${p6($)}`)}}class GB1{id;tokens;permissions;client;basePath;constructor($,Z){this.client=$,this.id=Z,this.basePath=JB1(Z),this.tokens=new yo$($,this.basePath),this.permissions={vm:new go$($,this.basePath)}}data(){return this.client.get(this.basePath)}delete(){return this.client.delete(this.basePath)}}class WB1{client;constructor($){this.client=$}async create($={}){let Z=await this.client.post("/v5/identities",$);return{identity:new GB1(this.client,Z.id),identityId:Z.id,data:Z}}list($={}){return this.client.get("/v5/identities",$)}get($){return this.client.get(JB1($))}ref($){return new GB1(this.client,$)}delete($){return this.client.delete(JB1($))}}var KB1=L(()=>{PK()});function b1($,Z){throw new NB1($,Z)}function L7($,Z){throw new BB1($,Z)}function R60($){return aw6.some((Z)=>$[Z]!==void 0)}function JE6($){return!R60($)&&$.port===void 0}function XY($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function so$($,Z,Q){if(typeof $!=="string"||!ZE6.test($))L7(Z,`${Z} must be a valid HTTP header name`);let X=$.toLowerCase();if(YE6.has(X)||X.startsWith("x-forwarded-")||X.startsWith("x-freestyle-")||Q&&(X==="cookie"||X==="set-cookie"))L7(Z,`${Z} may not use reserved header \`${$}\``)}function GE6($,Z){if(!Array.isArray($))L7(Z,`${Z} must be an array of header names`);if($.length>io$)L7(Z,`${Z} may contain at most ${io$} names`);let Q=new Set;$.forEach((X,Y)=>{so$(X,`${Z}[${Y}]`,!0);let J=X.toLowerCase();if(Q.has(J))L7(`${Z}[${Y}]`,`${Z} contains duplicate header \`${X}\``);Q.add(J)})}function no$($){if(!XY($))L7("forwardAuth","forwardAuth must be an object");for(let X of Object.keys($))if(!lo$.includes(X))L7(X,`Unknown field \`${X}\`. Expected one of: ${lo$.join(", ")}`);let Z=$;if(typeof Z.url!=="string"||Z.url.length===0||Z.url.length>QE6)L7("url","url is required and must be an absolute HTTPS URL");let Q;try{Q=new URL(Z.url)}catch{L7("url","url must be an absolute HTTPS URL")}if(Q.protocol!=="https:"||Q.hostname.length===0||Q.username.length>0||Q.password.length>0||Q.hash.length>0||Q.port==="0")L7("url","url must be an absolute HTTPS URL");if(Z.headers!==void 0){if(!XY(Z.headers))L7("headers","headers must be an object of header name to value");let X=Object.entries(Z.headers);if(X.length>mo$)L7("headers",`headers may contain at most ${mo$} entries`);let Y=0,J=new Set;for(let[G,W]of X){so$(G,`headers.${G}`,!1);let K=G.toLowerCase();if(J.has(K))L7(`headers.${G}`,`headers contains duplicate header \`${G}\``);if(J.add(K),typeof W!=="string"||/[\0\r\n]/.test(W))L7(`headers.${G}`,`headers.${G} must be a string`);Y+=G.length+W.length}if(Y>do$)L7("headers",`headers may contain at most ${do$} bytes`)}if(Z.timeoutMs!==void 0&&(!Number.isInteger(Z.timeoutMs)||Z.timeoutMs<100||Z.timeoutMs>5000))L7("timeoutMs","timeoutMs must be an integer between 100 and 5000");if(Z.protectedCookies!==void 0){if(!Array.isArray(Z.protectedCookies))L7("protectedCookies","protectedCookies must be an array of cookie names");if(Z.protectedCookies.length>po$)L7("protectedCookies",`protectedCookies may contain at most ${po$} names`);let X=new Set;Z.protectedCookies.forEach((Y,J)=>{if(typeof Y!=="string"||Y.length>XE6||!$E6.test(Y))L7(`protectedCookies[${J}]`,`protectedCookies[${J}] must be a valid HTTP cookie name`);if(X.has(Y))L7(`protectedCookies[${J}]`,`protectedCookies contains duplicate cookie \`${Y}\``);X.add(Y)})}if(Z.authResponseHeaders!==void 0)GE6(Z.authResponseHeaders,"authResponseHeaders");return Z}function WE6($,Z){if(!XY($))b1(Z,`${Z} must be an object with an \`id\``);for(let X of Object.keys($))if(!co$.includes(X))b1(`${Z}.${X}`,`${Z} has unknown field \`${X}\`. Expected: ${co$.join(", ")}`);let Q=$.id;if(typeof Q!=="string"||Q.length===0)b1(`${Z}.id`,`${Z}.id is required and must be a non-empty string`)}function UB1($){if(typeof $!=="string")b1("domain","domain is required and must be a string");if($==="*")return;let Z=$.startsWith("*.")?$.slice(2):$;if(Z.length===0||Z.length>sw6)b1("domain",`domain \`${$}\` is not a hostname`);let Q=Z.split(".");if(Q.length<2)b1("domain",`domain \`${$}\` must have at least two labels, e.g. acme.com`);for(let X of Q){if(X.length===0||X.length>ew6)b1("domain",`domain \`${$}\` has an empty or over-long label`);if(!/^[a-z0-9-]+$/.test(X))b1("domain",`domain \`${$}\`: labels are lowercase letters, digits, and hyphens (a \`*.\` prefix is the only wildcard)`);if(X.startsWith("-")||X.endsWith("-"))b1("domain",`domain \`${$}\`: a label cannot start or end with a hyphen`)}}function KE6($){if(typeof $!=="string")b1("domain","domain is required and must be a string");let Z=$.lastIndexOf("@");if(Z===-1){UB1($);return}let Q=$.slice(0,Z),X=$.slice(Z+1);if(Q.length===0||Q.length>64)b1("domain",`mail route \`${$}\`: the part before \`@\` must be 1-64 characters`);if(Q.startsWith(".")||Q.endsWith(".")||Q.includes(".."))b1("domain",`mail route \`${$}\`: the part before \`@\` cannot start or end with a dot, or contain \`..\``);for(let Y of Q)if(!/[a-zA-Z0-9]/.test(Y)&&!to$.includes(Y))b1("domain",`mail route \`${$}\`: the part before \`@\` may use letters, digits, dots, and \`${to$.slice(0,-1)}\` (quoted mailboxes are not supported)`);if(X==="*")b1("domain",`mail route \`${$}\`: \`*\` is not a mail domain \u2014 name the domain the mailbox lives at`);UB1(X)}function oo$($,Z){if(!XY($))b1(Z,`${Z} must be an object`);for(let X of Object.keys($))if(!ho$.includes(X))b1(`${Z}.${X}`,`${Z} has unknown field \`${X}\`. Expected one of: ${ho$.join(", ")}`);let Q=$;for(let X of["vmId","vpcId","host"]){let Y=Q[X];if(Y!==void 0&&(typeof Y!=="string"||Y.length===0))b1(`${Z}.${X}`,`${Z}.${X} must be a non-empty string`)}if(Q.public!==void 0&&Q.public!==!0)b1(`${Z}.public`,`${Z}.public must be true when present. Omit the field to match something else`);if(Z==="source"){if(Q.host!==void 0)b1("source.host","source.host is not allowed: a source is who opens the session, not where it lands. Put `host` on the destination");if(Q.port!==void 0)b1("source.port","source.port is not allowed: a source is who opens the session, not where it lands. Put `port` on the destination");if(Q.public===!0&&(Q.vmId!==void 0||Q.vpcId!==void 0))b1("source.public","source cannot combine `public: true` with `vmId` or `vpcId`: use one alone. `public` is every client on the Internet; `vmId`/`vpcId` is a specific dialer")}else{if(Q.vpcId!==void 0)b1("destination.vpcId","destination.vpcId is not allowed: a session lands in one place, not on a whole network. Name a `vmId`, a `host`, or `public: true` for the domain's own origin. A whole network may be a source");if([Q.vmId!==void 0,Q.host!==void 0,Q.public===!0].filter(Boolean).length>1)b1("destination","destination names more than one landing: give exactly one of `vmId`, `host`, or `public: true`");if((Q.vmId!==void 0||Q.host!==void 0)&&Q.port===void 0)b1("destination.port",`destination.port is required with ${Q.vmId!==void 0?"`vmId`":"`host`"}: say which port the session lands on`)}if(Q.port!==void 0){if(!Number.isInteger(Q.port)||Q.port<1||Q.port>65535)b1(`${Z}.port`,`${Z}.port must be an integer between 1 and 65535`)}}function HE6($){if("postgres"in $)return"postgres";if("smtp"in $)return"smtp";if("socks5"in $)return"socks5";return"http"}function FE6($,Z){function Q(W,K,H){if(!XY(W)||Object.keys(W).some((F)=>!K.includes(F)))b1(H,`${H} must contain only ${K.join(", ")}`)}if(Q($,["region","credentials","scope"],Z),typeof $.region!=="string"||!/^[a-z0-9-]{1,63}$/.test($.region))b1(`${Z}.region`,"invalid s3.region");Q($.credentials,["accessKeyId","secretAccessKey","sessionToken"],`${Z}.credentials`);for(let W of["accessKeyId","secretAccessKey","sessionToken"]){let K=$.credentials[W];if(W==="sessionToken"&&K===void 0)continue;if(typeof K!=="string"||!/^[\x21-\x7e]{1,16384}$/.test(K))b1(`${Z}.credentials.${W}`,"invalid s3 credentials")}if(!/^[a-zA-Z0-9]+$/.test($.credentials.accessKeyId))b1(`${Z}.credentials.accessKeyId`,"invalid s3 access key id");Q($.scope,["bucket","prefix","operations"],`${Z}.scope`);let{bucket:X,prefix:Y,operations:J}=$.scope;if(typeof X!=="string"||!/^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/.test(X)||X.includes(".."))b1(`${Z}.scope.bucket`,"invalid s3.scope.bucket");if(typeof Y!=="string"||Buffer.byteLength(Y,"utf8")>1024||/[\x00-\x1f\x7f-\x9f]/u.test(Y))b1(`${Z}.scope.prefix`,"invalid s3.scope.prefix");let G=["GetObject","HeadObject","PutObject","DeleteObject","ListObjectsV2","CreateMultipartUpload","UploadPart","ListParts","CompleteMultipartUpload","AbortMultipartUpload","ListMultipartUploads"];if(!Array.isArray(J)||J.length===0||J.length>G.length||J.some((W)=>!G.includes(W))||new Set(J).size!==J.length)b1(`${Z}.scope.operations`,"s3.scope.operations must be a nonempty list of distinct supported operations")}function UE6($,Z){if(!XY($))b1(Z,`${Z} must be an object: \`{ headers: { \u2026 } }\`, \`{ postgres: { \u2026 } }\`, \`{ smtp: { \u2026 } }\` or \`{ socks5: { \u2026 } }\``);let Q=Object.keys($);if(Q.length!==1||!["headers","jsonPatch","postgres","smtp","socks5","s3"].includes(Q[0]??""))b1(Z,`${Z} must have exactly one of \`headers\`, \`jsonPatch\`, \`postgres\`, \`smtp\`, \`socks5\` or \`s3\` (got: ${Q.length===0?"nothing":Q.join(", ")})`);if(Q[0]==="s3"){FE6($.s3,`${Z}.s3`);return}if(Q[0]==="jsonPatch"){let X=$.jsonPatch;if(!Array.isArray(X)||X.length>128)b1(Z,`${Z}.jsonPatch must be an array of at most 128 operations`);let Y=(W)=>typeof W==="string"&&(W===""||W.startsWith("/"))&&!/~(?:[^01]|$)/u.test(W),J=(W,K=new Set,H=0)=>{if(H>64)return!1;if(W===null||typeof W==="string"||typeof W==="boolean")return!0;if(typeof W==="number")return Number.isFinite(W);if(typeof W!=="object"||K.has(W))return!1;K.add(W);let F=(Array.isArray(W)?Array.from(W):XY(W)?Object.values(W):[void 0]).every((U)=>J(U,K,H+1));return K.delete(W),F};for(let[W,K]of X.entries()){if(!XY(K)||!["add","remove","replace","move","copy","test"].includes(String(K.op))||!Y(K.path))b1(Z,`${Z}.jsonPatch[${W}] requires a standard op and valid JSON Pointer path`);if(["move","copy"].includes(K.op)&&!Y(K.from))b1(Z,`${Z}.jsonPatch[${W}].from must be a JSON Pointer`);if(["add","replace","test"].includes(K.op)&&(!Object.hasOwn(K,"value")||!J(K.value)))b1(Z,`${Z}.jsonPatch[${W}].value must be a JSON value (null is allowed)`)}let G;try{G=JSON.stringify(X)}catch{b1(Z,"jsonPatch must be JSON serializable")}if(Buffer.byteLength(G,"utf8")>65536)b1(Z,"jsonPatch exceeds 64 KiB");return}if(Q[0]==="socks5"){let X=$.socks5;if(!XY(X))b1(`${Z}.socks5`,`${Z}.socks5 must be an object with \`username\` and \`password\``);for(let Y of Object.keys(X))if(!["username","password"].includes(Y))b1(`${Z}.socks5.${Y}`,`${Z}.socks5 has unknown field \`${Y}\`. Expected: username, password`);for(let Y of["username","password"])if(typeof X[Y]!=="string"||X[Y].length===0)b1(`${Z}.socks5.${Y}`,`${Z}.socks5.${Y} is required and must be a non-empty string`);return}if(Q[0]==="smtp"){let X=$.smtp;if(!XY(X))b1(`${Z}.smtp`,`${Z}.smtp must be an object with \`username\` and \`password\``);for(let Y of Object.keys(X))if(!["username","password"].includes(Y))b1(`${Z}.smtp.${Y}`,`${Z}.smtp has unknown field \`${Y}\`. Expected: username, password`);for(let Y of["username","password"])if(typeof X[Y]!=="string"||X[Y].length===0)b1(`${Z}.smtp.${Y}`,`${Z}.smtp.${Y} is required and must be a non-empty string`);return}if(Q[0]==="headers"){let X=$.headers;if(!XY(X))b1(`${Z}.headers`,`${Z}.headers must be an object of header name to value`);for(let[Y,J]of Object.entries(X))if(typeof J!=="string")b1(`${Z}.headers.${Y}`,`${Z}.headers.${Y} must be a string`)}else{let X=$.postgres;if(!XY(X))b1(`${Z}.postgres`,`${Z}.postgres must be an object with \`username\` and \`password\``);for(let J of Object.keys(X))if(!["username","password","database"].includes(J))b1(`${Z}.postgres.${J}`,`${Z}.postgres has unknown field \`${J}\`. Expected: username, password, database`);let Y=X;for(let J of["username","password"])if(typeof Y[J]!=="string"||Y[J].length===0)b1(`${Z}.postgres.${J}`,`${Z}.postgres.${J} is required and must be a non-empty string`);if(Y.database!==void 0&&typeof Y.database!=="string")b1(`${Z}.postgres.database`,`${Z}.postgres.database must be a string`)}}function NE6($,Z){let Q=$;return Z.forEach((X,Y)=>{let J=HE6(X);if(Q===void 0)Q=J;else if(Q!==J)b1(`transform[${Y}]`,`transform requires protocol \`${J}\` but the rule is \`${Q}\`; a rule terminates one protocol`)}),Q??"http"}function BE6($,Z){if(!XY($)||Object.keys($).some((Q)=>Q!=="method"&&Q!=="path"))b1(Z,`${Z} must be an object containing only method and path`);if($.method!==void 0&&(!Array.isArray($.method)||$.method.some((Q)=>typeof Q!=="string"||Q.length===0||/[^!#$%&'*+.^_`|~0-9A-Za-z-]/.test(Q))))b1(`${Z}.method`,`${Z}.method must be an array of HTTP method tokens`);if($.path!==void 0){let Q=$.path;if(!XY(Q)||Object.keys(Q).length!==1||typeof Q.exact!=="string"||!Q.exact.startsWith("/")||/[\s?#]/.test(Q.exact))b1(`${Z}.path`,`${Z}.path must contain exact: an absolute path without a query or fragment`)}}function eo$($,Z){if(!XY($))b1(Z||"rule",`${Z||"rule"} must be an object`);for(let H of Object.keys($))if(!ro$.includes(H))b1(`${Z}${H}`,`Unknown field \`${H}\`. Expected one of: ${ro$.join(", ")}`);let Q=$;if(Q.action===void 0)b1(`${Z}action`,`${Z}action is required. Write \`action: "allow"\` \u2014 every rule states what it does rather than defaulting to it`);if(Q.action!=="allow")b1(`${Z}action`,`${Z}action must be "allow" (got \`${String(Q.action)}\`). Only allow rules exist today`);if(Q.protocol!==void 0&&!uo$.includes(Q.protocol))b1(`${Z}protocol`,`${Z}protocol must be one of: ${uo$.join(", ")} (got \`${String(Q.protocol)}\`)`);let X=Q.source??{},Y=Q.destination??{};oo$(X,"source"),oo$(Y,"destination");let J=Q.transform??[];if(!Array.isArray(J))b1(`${Z}transform`,`${Z}transform must be an array`);J.forEach((H,F)=>UE6(H,`${Z}transform[${F}]`));let G=NE6(Q.protocol,J);if(Q.match!==void 0){if(BE6(Q.match,`${Z}match`),G!=="http"||X.public===!0||!(Y.public===!0||Y.host!==void 0))b1(`${Z}match`,"match requires HTTP egress from a VM or VPC to a public origin or host")}if(J.some((H)=>("s3"in H))){if(J.length!==1||Q.match!==void 0||X.public===!0||!(Y.public===!0||Y.host!==void 0)||Q.domain.includes("*"))b1(`${Z}transform`,"s3 requires a sole transform on HTTP egress to a concrete origin, without match")}let W=J.filter((H)=>("jsonPatch"in H));if(W.length>1)b1(`${Z}transform`,"a rule may carry only one jsonPatch transform");if(W.length&&(X.public===!0||!(Y.public===!0||Y.host!==void 0)))b1(`${Z}transform`,"jsonPatch requires HTTP egress from a VM or VPC to a public origin or host");if(Q.forwardAuth!==void 0){WE6(Q.forwardAuth,`${Z}forwardAuth`);let H=Y.vmId!==void 0||!R60(Y)&&Y.port!==void 0;if(G!=="http"||X.public!==!0||!H||Q.domain==="*")b1(`${Z}forwardAuth`,`${Z}forwardAuth is only supported on HTTP public ingress: \`{ public: true } -> { vmId, port }\``)}if(G==="smtp")KE6(Q.domain);else UB1(Q.domain);if((X.vmId!==void 0||X.vpcId!==void 0)&&Y.vmId!==void 0&&J.length>0)b1(`${Z}transform`,"a VM-to-VM rule cannot carry a transform yet \u2014 remove it (only public ingress/egress rules run transforms)");if(G==="tcp"){let H=Y.public===!0||Y.host!==void 0,F=X.vmId!==void 0||X.vpcId!==void 0;if(H||F)b1(`${Z}protocol`,"a `tcp` rule is public ingress only \u2014 `{ public: true } -> { vmId, port }`. The edge splices the session without terminating it, so outbound there is nothing to broker (an outbound allow is a firewall rule, and injecting into one needs `http` or `postgres`) and inward there is no certificate to answer the source with. Give the source `public: true`, or drop `protocol` to be served as HTTPS")}else if(G==="imap"||G==="imaps"){let H=Y.public===!0||Y.host!==void 0,F=X.vmId!==void 0||X.vpcId!==void 0;if(H||F)b1(`${Z}protocol`,`an \`${G}\` rule is public ingress only \u2014 \`{ public: true } -> { vmId, port }\`. The 993 front serves mail clients reaching a VM's IMAP server; outbound there is nothing to broker (an outbound allow is a firewall rule) and inward there is no certificate to answer the source with`)}else if(G==="socks5"){let H=Y.public===!0||Y.host!==void 0;if(X.public===!0||!H)b1(`${Z}protocol`,'a `socks5` rule is egress only \u2014 `{ vmId } -> { host: "gate.provider.com", port: 1080 }`. The front exists so a guest can open sessions through a proxy whose credentials it never holds; inbound there is nothing to serve, and publishing one would be an open proxy on a platform address');if(Y.host===void 0)b1(`${Z}destination`,"a `socks5` rule has to name the proxy it goes through: give the destination a `host` and the `port` the provider listens on. `{ public: true }` on its own asks the edge to be the proxy, which would let the guest out on our address rather than through yours")}else if(G==="postgres"){let H=J.some((U)=>U!==null&&typeof U==="object"&&("postgres"in U)),F=Y.public===!0||Y.host!==void 0;if(H&&!F)b1(`${Z}transform`,"a `postgres` transform belongs on an egress rule: the edge spends a credential the guest never holds, so pointing it at your own VM would hand every client a logged-in session. Give the destination `public: true` or a `host`, or drop the transform")}else if(G==="smtp"){let H=J.some((U)=>U!==null&&typeof U==="object"&&("smtp"in U)),F=Y.public===!0||Y.host!==void 0;if(H&&!F)b1(`${Z}transform`,"an `smtp` transform belongs on an egress rule: the edge spends a credential the guest never holds, so pointing it at your own VM would turn it into an open relay. Give the destination `public: true` or a `host`, or drop the transform");if(typeof Q.domain==="string"&&Q.domain.includes("@")&&X.public!==!0)b1(`${Z}domain`,`\`${Q.domain}\` names a mailbox, which only makes sense on a rule that receives mail. An egress or VM-to-VM rule names the host the guest submits through \u2014 drop the part before \`@\``)}return{...Q,source:X,destination:Y}}function LE6($,Z){if($==="source")return JE6(Z)?"source is empty. Say who opens the session: `vmId`, `vpcId`, or `public: true`":"source only narrows the session without saying who opens it. Add `vmId`, `vpcId`, or `public: true`";return"destination is empty. Say where the session lands: `vmId` + `port`, `host` + `port`, or `public: true` for the domain's own origin"}function ao$($){let Z=eo$($,"");for(let Q of["source","destination"]){let X=Z[Q];if(!R60(X))b1(Q,LE6(Q,X))}if(Z.source.public===!0&&Z.destination.public===!0)b1("destination","a rule from the public Internet to the domain's own origin allows nothing the world cannot already do. Did you mean a `vmId` destination (ingress) or a `vmId` source (egress)?");return Z}function $r$($){if(!XY($))b1("tls","tls must be an object with a `rules` array");for(let Q of Object.keys($))if(Q!=="rules")b1(`tls.${Q}`,`tls has unknown field \`${Q}\`. Expected: rules`);let Z=$.rules;if(!Array.isArray(Z))b1("tls.rules","tls.rules must be an array");return Z.forEach((Q,X)=>{let Y=`tls.rules[${X}].`,J=eo$(Q,Y),G=R60(J.source),W=R60(J.destination);if(!G&&!W)b1(`tls.rules[${X}]`,`tls.rules[${X}]: both source and destination refer to the VM being created, which allows nothing. Give one of them a \`vmId\`, \`vpcId\`, or \`public: true\``);if(G&&W)b1(`tls.rules[${X}]`,`tls.rules[${X}]: neither end refers to the VM being created. Leave one endpoint's identity unset so it means this VM, or create the rule with tls.rules.create instead`);if(!W&&J.destination.port===void 0)b1(`tls.rules[${X}].destination.port`,`tls.rules[${X}]: destination.port is required: say which port on this VM the session lands on`)}),$}function HB1($){return`/v5/tls/${p6($)}`}function FB1($){return`/v5/tls/forward-auth/${p6($)}`}class Zr${client;constructor($){this.client=$}list(){return this.client.get("/v5/tls/forward-auth")}async create($){let Z=no$($);return this.client.post("/v5/tls/forward-auth",Z)}get($){return this.client.get(FB1($))}async update($,Z){let Q=no$(Z);return this.client.put(FB1($),Q)}delete($){return this.client.delete(FB1($))}}class Qr${client;constructor($){this.client=$}async create($){let Z=ao$($);return this.client.post("/v5/tls",Z)}list($={}){return this.client.get("/v5/tls",$)}get($){return this.client.get(HB1($))}async update($,Z){let Q=ao$(Z);return this.client.put(HB1($),Q)}delete($){return this.client.delete(HB1($))}}class LB1{client;rules;forwardAuth;constructor($){this.client=$,this.rules=new Qr$($),this.forwardAuth=new Zr$($)}}var NB1,BB1,ho$,aw6,uo$,sw6=253,ew6=63,lo$,co$,$E6,ZE6,QE6=2048,mo$=32,do$=16384,io$=32,po$=32,XE6=128,YE6,to$="!#$%&'*+-/=?^_`{|}~.",ro$;var yC0=L(()=>{PK();NB1=class NB1 extends Error{path;constructor($,Z){super(Z);this.name="TlsRuleValidationError",this.path=$,Object.setPrototypeOf(this,NB1.prototype)}};BB1=class BB1 extends Error{path;constructor($,Z){super(Z);this.name="TlsForwardAuthValidationError",this.path=$,Object.setPrototypeOf(this,BB1.prototype)}};ho$=["vmId","vpcId","public","host","port"],aw6=["vmId","vpcId","public","host"],uo$=["tcp","http","postgres","minecraft","smtp","imap","imaps","socks5"],lo$=["url","headers","timeoutMs","protectedCookies","authResponseHeaders"],co$=["id"],$E6=/^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/,ZE6=/^[0-9A-Za-z-]+$/,YE6=new Set(["host","content-length","connection","keep-alive","proxy-authenticate","proxy-authorization","proxy-connection","te","trailer","transfer-encoding","upgrade"]);ro$=["action","domain","protocol","source","destination","transform","match","forwardAuth"]});function vp($){return`/v5/tunnels/${p6($)}`}function jg($){return $.tunnelId??=$.id,$}class DB1{client;constructor($){this.client=$}list(){return this.client.get("/v5/tunnels").then(($)=>{return $.tunnels.forEach(jg),$})}create($={}){return this.client.post("/v5/tunnels",$).then(jg)}get($){return this.client.get(vp($)).then(jg)}update($,Z){return this.client.patch(vp($),Z).then(jg)}rotateKey($,Z={}){return this.client.post(`${vp($)}/rotate-key`,Z).then(jg)}delete($){return this.client.delete(vp($))}attachVpc($,Z,Q={}){return this.client.post(`${vp($)}/vpcs/${p6(Z)}`,Q).then(jg)}detachVpc($,Z){return this.client.delete(`${vp($)}/vpcs/${p6(Z)}`).then(jg)}}var OB1=L(()=>{PK()});class jB1{client;basePath;constructor($,Z){this.client=$,this.basePath=Z}async readFile($,Z={}){let Q=await this.openRead($,Z);return new Uint8Array(await Q.arrayBuffer())}async readTextFile($,Z={}){return await(await this.openRead($,Z)).text()}async readFileStream($,Z={}){let Q=await this.openRead($,Z);if(!Q.body)throw Error(`no response body reading ${$}`);return Q.body}async writeFile($,Z,Q={}){let X=typeof Z==="string"?new TextEncoder().encode(Z):Z,Y=X instanceof Uint8Array?X.byteLength:X.size;if(Y>DE6)return this.uploadInChunks($,X,Y,Q);let J=X instanceof Uint8Array?X:new Uint8Array(await X.arrayBuffer());await this.client.putBytes(`${this.basePath}/fs/write`,J,{path:$,mode:Q.mode,sha256:await Xr$(J)},Q.signal),Q.onProgress?.({completedBytes:Y,totalBytes:Y})}writeTextFile($,Z,Q={}){return this.writeFile($,Z,Q)}async readDir($){let{entries:Z}=await this.client.get(`${this.basePath}/fs/dir`,{path:$});return Z}async mkdir($){await this.client.post(`${this.basePath}/fs/mkdir`,{path:$})}async remove($){await this.client.delete(`${this.basePath}/fs/remove`,{path:$})}async exists($){let{exists:Z}=await this.client.get(`${this.basePath}/fs/exists`,{path:$});return Z}stat($){return this.client.get(`${this.basePath}/fs/stat`,{path:$})}openRead($,Z){let{offset:Q,length:X}=Z,Y;if(Q!==void 0||X!==void 0){let J=Q??0;Y=X===void 0?`bytes=${J}-`:`bytes=${J}-${J+X-1}`}return this.client.getBytes(`${this.basePath}/fs/read`,{path:$},{range:Y,signal:Z.signal})}async uploadInChunks($,Z,Q,X){let Y=X.chunkSize??OE6,J=X.maxAttempts??jE6,G=Z instanceof Uint8Array?await Xr$(Z):void 0,W=await this.client.post(`${this.basePath}/fs/uploads`,{path:$,size:Q,sha256:G,mode:X.mode}),K=`${this.basePath}/fs/uploads/${W.uploadId}`;try{let H=W.receivedBytes;while(H<Q){let F=Math.min(H+Y,Q),U=Z instanceof Uint8Array?Z.subarray(H,F):Z.slice(H,F);H=(await this.putChunkWithRetry(K,U,H,J,X.signal)).receivedBytes,X.onProgress?.({completedBytes:Math.min(H,Q),totalBytes:Q})}await this.client.post(`${K}/commit`)}catch(H){throw await this.client.delete(K).catch(()=>{}),H}}async putChunkWithRetry($,Z,Q,X,Y){let J;for(let G=1;G<=X;G++){Y?.throwIfAborted?.();try{return await this.client.putBytes($,Z,{offset:Q},Y)}catch(W){if(J=W,!(!(W instanceof WJ)||W.status>=500||W.status===408||W.status===409||W.status===429)||Y?.aborted||G===X)throw W;await wE6(Math.min(500*2**(G-1),8000));let H=await this.client.get($).catch(()=>{return});if(H&&H.receivedBytes>Q)return H}}throw J}}async function Xr$($){let Z=globalThis.crypto?.subtle;if(!Z)return;let Q=await Z.digest("SHA-256",$);return Array.from(new Uint8Array(Q),(X)=>X.toString(16).padStart(2,"0")).join("")}function wE6($){return new Promise((Z)=>setTimeout(Z,$))}var DE6=8388608,OE6=16777216,jE6=5;var wB1=L(()=>{T60()});function EE6(){return typeof process<"u"&&Boolean(process.versions?.node)}async function Yr$($,Z){if(EE6()){let X;try{X=await import("ws")}catch{throw Error("PTY sessions need the `ws` package in Node. Install it with `npm install ws`.")}return new X.default($,{headers:Z})}let Q=globalThis.WebSocket;if(!Q)throw Error("PTY sessions need a WebSocket client; no global WebSocket is available in this environment.");return new Q($)}function q60($,Z,Q){if($.on){$.on(Z,Q);return}$.addEventListener?.(Z,Q)}function PE6($,Z){if($&&typeof $==="object"&&"data"in $){let Q=$.data;if(typeof Q==="string")return{text:Q};if(Q instanceof ArrayBuffer)return{binary:new Uint8Array(Q)};return{}}if($ instanceof Uint8Array)return Z?{binary:$}:{text:zE6.decode($)};if(typeof $==="string")return{text:$};return{}}class EB1{_sessionId;_slug;_created=!1;socket;constructor($,Z,Q={}){this.socket=$,this._sessionId=Z,q60($,"message",(X,Y)=>{let{text:J,binary:G}=PE6(X,Y);if(G){Q.onData?.(G);return}if(!J)return;let W;try{W=JSON.parse(J)}catch{return}if(W.type==="exited")Q.onExit?.(W.exitCode);else if(W.type==="error")Q.onError?.(Error(W.message));else if(W.type==="sessionInfo")this._sessionId=W.sessionId,this._slug=W.slug,this._created=W.created??!0,Q.onSessionInfo?.(W.sessionId)}),q60($,"close",(X)=>{let Y=X;Q.onClose?.({wasClean:Y?.wasClean??!0,code:Y?.code??1000,reason:Y?.reason??""})}),q60($,"error",(X)=>Q.onError?.(X))}write($){this.socket.send(typeof $==="string"?new TextEncoder().encode($):$)}resize($){this.sendControl({type:"resize",cols:$.cols,rows:$.rows})}signal($){this.sendControl({type:"signal",signal:$})}sendControl($){this.socket.send(JSON.stringify($))}detach(){this.socket.close()}get sessionId(){return this._sessionId}get slug(){return this._slug}get created(){return this._created}get readyState(){return this.socket.readyState}}function TE6($){return new Promise((Z,Q)=>{if($.readyState===1){Z();return}q60($,"open",()=>Z()),q60($,"error",(X)=>Q(X))})}class zB1{client;basePath;constructor($,Z){this.client=$,this.basePath=Z}async open($={}){let{exec:Z,cols:Q,rows:X,linuxUser:Y,slug:J,replaceOnExit:G,onData:W,onExit:K,onClose:H,onError:F}=$,U={};if(Z!==void 0)U.exec=Z;if(Q!==void 0)U.cols=Q;if(X!==void 0)U.rows=X;if(Y!==void 0)U.linuxUser=Y;if(J!==void 0)U.slug=J;if(G!==void 0)U.replaceOnExit=String(G);let N=Jr$(this.client,`${this.basePath}/pty`,U),B=this.client.authHeaders(),D=await Yr$(N,B);return new Promise((O,j)=>{let w=!1,E=new EB1(D,-1,{onData:W,onExit:K,onClose:(z)=>{if(!w)w=!0,j(Error("connection closed before sessionInfo"));H?.(z)},onError:(z)=>{if(!w)w=!0,j(z);F?.(z)},onSessionInfo:()=>{w=!0,O(E)}})})}async attach($){let{session:Z,linuxUser:Q,onData:X,onExit:Y,onClose:J,onError:G}=$,W=Jr$(this.client,`${this.basePath}/pty/sessions/${p6(String(Z))}`,{...Q!==void 0?{linuxUser:Q}:{}}),K=this.client.authHeaders(),H=await Yr$(W,K),F=new EB1(H,typeof Z==="number"?Z:-1,{onData:X,onExit:Y,onClose:J,onError:G});return await TE6(H),F}list($={}){return this.client.get(`${this.basePath}/pty/sessions`,$)}close($,Z={}){return this.client.delete(`${this.basePath}/pty/sessions/${p6(String($))}`,Z)}}class PB1{pty;linuxUser;constructor($,Z){this.pty=$,this.linuxUser=Z}open($={}){return this.pty.open({...$,linuxUser:this.linuxUser})}attach($){return this.pty.attach({...$,linuxUser:this.linuxUser})}list(){return this.pty.list({linuxUser:this.linuxUser})}close($){return this.pty.close($,{linuxUser:this.linuxUser})}}function Jr$($,Z,Q){return $.url(Z,Q).replace(/^http/,"ws")}var zE6;var TB1=L(()=>{PK();zE6=new TextDecoder});class AB1{client;constructor($){this.client=$}list($={}){return this.client.get("/v5/snapshots",$)}get($){return this.client.get(`/v5/snapshots/${p6($)}`)}update($,Z){return this.client.patch(`/v5/snapshots/${p6($)}`,Z)}delete($){return this.client.delete(`/v5/snapshots/${p6($)}`)}}var RB1=L(()=>{PK()});var Gr$=()=>{};function qB1($){return`/v5/vms/${p6($)}`}class MB1{id;fs;pty;client;basePath;constructor($,Z){this.client=$,this.id=Z,this.basePath=qB1(Z),this.fs=new jB1($,this.basePath),this.pty=new zB1($,this.basePath)}data(){return this.client.get(this.basePath)}firewallRules(){return this.client.get("/v5/firewall/rules",{vmId:this.id})}update($){return this.client.patch(this.basePath,$)}start(){return this.client.post(`${this.basePath}/start`)}pause(){return this.client.post(`${this.basePath}/pause`)}resize($){return this.client.post(`${this.basePath}/resize`,$)}delete(){return this.client.delete(this.basePath)}exec($){let Z=typeof $==="string"?{command:$}:$;return this.client.post(`${this.basePath}/exec-await`,Z)}linuxUser($){return new Wr$(this,$)}snapshot($={}){return this.client.post(`${this.basePath}/snapshot`,$)}}class Wr${vm;linuxUser;pty;constructor($,Z){this.vm=$,this.linuxUser=Z,this.pty=new PB1($.pty,Z)}exec($){let Z=typeof $==="string"?{command:$}:$;return this.vm.exec({...Z,linuxUser:this.linuxUser})}}class IB1{client;snapshots;constructor($){this.client=$,this.snapshots=new AB1($)}async create($){if(bC0($.firewall,"VM"),$.tls!==void 0)$r$($.tls);let Z=await this.client.post("/v5/vms",$);return{vm:new MB1(this.client,Z.id),vmId:Z.id,data:Z,firewallRules:Z.firewallRules??[],tlsRules:Z.tlsRules??[]}}list($={}){return this.client.get("/v5/vms",$)}get($){return this.client.get(qB1($))}ref($){return new MB1(this.client,$)}delete($){return this.client.delete(qB1($))}}var VB1=L(()=>{A60();yC0();PK();wB1();TB1();RB1();Gr$();wB1();TB1();RB1()});function kB1($){return`/v5/vpcs/${p6($)}`}class Kr${client;basePath;constructor($,Z){this.client=$,this.basePath=Z}list(){return this.client.get(`${this.basePath}/tunnels`)}}class CB1{id;tunnels;client;basePath;constructor($,Z){this.client=$,this.id=Z,this.basePath=kB1(Z),this.tunnels=new Kr$($,this.basePath)}data(){return this.client.get(this.basePath)}update($){return this.client.patch(this.basePath,$)}delete(){return this.client.delete(this.basePath)}}class SB1{client;constructor($){this.client=$}list(){return this.client.get("/v5/vpcs")}async create($={}){if($.firewall!==void 0)bC0($.firewall,"network");let Z=await this.client.post("/v5/vpcs",$);return{vpc:new CB1(this.client,Z.id),vpcId:Z.id,data:Z,firewallRules:Z.firewallRules??[]}}get($){return this.client.get(kB1($))}ref($){return new CB1(this.client,$)}delete($){return this.client.delete(kB1($))}}var _B1=L(()=>{A60();PK()});class gC0{client;vms;vpc;tunnels;firewall;tls;domains;identities;constructor($={}){this.client=new sN1($),this.vms=new IB1(this.client),this.vpc=new SB1(this.client),this.tunnels=new DB1(this.client),this.firewall=new YB1(this.client),this.tls=new LB1(this.client),this.domains=new eN1(this.client),this.identities=new WB1(this.client)}fetch($,Z){return this.client.fetch($,Z)}}var Hr$=L(()=>{PK();$B1();A60();KB1();yC0();OB1();VB1();_B1();PK();T60();VB1();_B1();OB1();$B1();A60();yC0();KB1()});var Ur$;var Fr$=L(()=>{Ur$={name:"@decocms/sandbox",version:"1.80.1",private:!0,type:"module",description:"Sandbox runtime for isolated Studio tool execution",scripts:{check:"tsc --noEmit",test:"bun test",build:"bun run build:typegen && bun run build:harness-runner","build:typegen":"mkdir -p dist && bun run --cwd=../typegen build && bun --cwd=../typegen pm pack --filename $PWD/dist/typegen.tgz --quiet","build:harness-runner":"mkdir -p dist && bun --cwd=../harness-runner pm pack --filename $PWD/dist/harness-runner.tgz --quiet"},exports:{"./shared":"./shared.ts","./provider":"./server/provider/index.ts","./provider/agent-sandbox":"./server/provider/agent-sandbox/index.ts","./provider/postgres-state-store":"./server/provider/postgres-state-store.ts","./provider/freestyle":"./server/provider/freestyle.ts","./provider/remote":"./server/provider/remote.ts","./provider/router":"./server/provider/router.ts","./provider/sandbox-api":"./server/provider/sandbox-api.ts","./provider/sandbox-server":"./server/provider/sandbox-server.ts","./daemon-client":"./server/daemon-client.ts","./org-fs":"./org-fs.ts","./dispatch":"./dispatch/index.ts","./dispatch/*":"./dispatch/*.ts","./proxy/http":"./proxy/http.ts","./proxy/websocket":"./proxy/websocket.ts"},dependencies:{"@decocms/shared":"workspace:*","@kubernetes/client-node":"^1.4.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0",freestyle:"0.2.16",zod:"4.3.6"},devDependencies:{"@types/bun":"latest",postgres:"^3.4.5",typescript:"^7.0.2"}}});function hC0($){let Z=$?.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of studio-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"});return async(Q,X)=>{if(!Z)return X();let Y=performance.now(),J=(G)=>Z.record(performance.now()-Y,{runner_kind:Q,source:"daemon",status_code:G});try{let G=await X();return J(G.status),G}catch(G){throw J(0),G}}}var hD;var uC0=L(()=>{hD={kubernetes:"agent-sandbox",freestyle:"freestyle"}});var zr$={};J0(zr$,{FreestyleSandboxProvider:()=>Er$});import{createHash as RE6,randomBytes as qE6}from"crypto";class Er${freestyle;lookupClient;image;sidecarImage;idleTimeoutSeconds;autoDeleteSeconds;domainSuffix;timeDaemonRequest;inflight=new Lg;snapshotInflight=new Lg;lookups=new Map;releaseTimers=new Map;constructor($){this.freestyle=$.client??new gC0({apiKey:$.apiKey}),this.lookupClient=$.client??new gC0({apiKey:$.apiKey,fetch:Object.assign((Z,Q)=>fetch(Z,{...Q,signal:Q?.signal?AbortSignal.any([Q.signal,AbortSignal.timeout(Or$)]):AbortSignal.timeout(Or$)}),{preconnect:fetch.preconnect})}),this.image=$.image??`ghcr.io/decocms/studio/studio-sandbox-go:${Ur$.version}`,this.sidecarImage=$.orgFsSidecarImage??IE6,this.idleTimeoutSeconds=$.idleTimeoutSeconds??900,this.autoDeleteSeconds=$.autoDeleteSeconds??259200,this.domainSuffix=$.domainSuffix??"style.dev",this.timeDaemonRequest=hC0($.meter)}async owns($){return await this.find($)!==null}daemonUrl($){return`https://${$}.${this.domainSuffix}`}async find($,Z={}){let Q=this.lookups.get($);if(!Z.refresh&&Q&&Date.now()-Q.at<(Q.found?vE6:xE6))return Q.found;let X=null;try{let Y=await this.lookupClient.vms.get($),J=Y.metadata[Lr$];if(J)X={vm:this.freestyle.vms.ref(Y.id),daemon:{url:this.daemonUrl($),token:J}}}catch(Y){if(!(Y instanceof WJ&&Y.status===404))throw Y}return this.remember($,X),X}remember($,Z){if(this.lookups.delete($),this.lookups.size>=fE6){let Q=this.lookups.keys().next();if(!Q.done)this.lookups.delete(Q.value)}this.lookups.set($,{found:Z,at:Date.now()})}baseSnapshot(){let{image:$,sidecarImage:Z}=this,Q=`studio-sandbox-${RE6("sha256").update(`${$}
 ${Z}`).digest("hex").slice(0,16)}`;return this.snapshotInflight.run(Q,async()=>{if(await this.snapshotExists(Q))return Q;console.log(`[${wg}] building base snapshot ${Q} for ${$}`);let{vm:X}=await this.freestyle.vms.create({ttlSeconds:1800,firewall:{rules:[{action:"allow",source:{},destination:{public:!0}}]}});try{await this.run(X,`docker pull -q ${xp($)} && docker pull -q ${xp(Z)}`,{timeoutMs:vB1}),await X.snapshot({slug:Q})}catch(Y){if(!await this.snapshotExists(Q))throw Y}finally{await X.delete().catch(()=>{})}return Q})}async snapshotExists($){try{return await this.freestyle.vms.snapshots.get($),!0}catch(Z){if(Z instanceof WJ&&Z.status===404)return!1;throw Z}}async run($,Z,Q={}){let X=await $.exec({command:Z,...Q});if(X.statusCode!==0)throw Error(`${Z.split(" ",2).join(" ")} failed (${X.statusCode??"timeout"}): ${(X.stderr||X.stdout||"").slice(-500)}`);return X.stdout??""}async ensure($,Z={}){let Q=c3($);if(Q.startsWith("s-"))throw Error(`ensure: projectRef has no slug source: ${$.projectRef}`);return this.inflight.run(Q,async()=>{this.cancelRelease(Q);let X=await this.find(Q,{refresh:!0});if(X)await this.resume(X,Z);else await this.create(Q,Z);return{handle:Q,workdir:M60,previewUrl:this.daemonUrl(Q),warmPoolAdopted:!1,provider:"freestyle"}})}async resume($,Z){let{state:Q}=await $.vm.data();if(Q!=="running")await $.vm.start();if(await this.waitForDaemon($.daemon.url),Z.orgFsConfigJson)await D60($.daemon.url,$.daemon.token,Z.orgFsConfigJson).catch((Y)=>console.warn(`[${wg}] org-fs relay failed`,Y));let X=j60(Z);if(X)await yN($.daemon.url,$.daemon.token,X).catch((Y)=>console.warn(`[${wg}] git credential refresh failed: ${wr$(Y)}`))}async create($,Z){let Q=await this.baseSnapshot(),X=qE6(24).toString("hex"),{vm:Y}=await this.createVm({snapshotId:Q,slug:$,idleTimeoutSeconds:this.idleTimeoutSeconds,metadata:{[Lr$]:X,...Z.tenant?{[kE6]:Z.tenant.orgId,[CE6]:Z.tenant.userId}:{}},firewall:{rules:[{action:"allow",source:{},destination:{public:!0}}]},tls:{rules:[{action:"allow",domain:`${$}.${this.domainSuffix}`,source:{public:!0},destination:{port:lC0}}]}}),J={url:this.daemonUrl($),token:X};try{let G={...Z.env,DAEMON_TOKEN:X,DAEMON_BOOT_ID:crypto.randomUUID(),APP_ROOT:M60,PROXY_PORT:String(lC0),ORGFS_SIDECAR_CONFIG_PATH:`${cC0}/config.json`,ORGFS_SIDECAR_STATUS_PATH:`${cC0}/status.json`},W=Object.keys(G).map((K)=>`-e ${xp(K)}`).join(" ");if(await this.run(Y,`sudo sh -c ${xp(VE6)} && docker run -d --name ${Br$} --restart=always --privileged --device /dev/fuse -e APP_ROOT=${M60} -v ${_z}:${M60}/org:rshared -v ${fp}:${cC0} ${xp(this.sidecarImage)}`,{timeoutMs:vB1}),await this.run(Y,`docker run -d --name ${Nr$} --restart=always -p ${lC0}:${lC0} -v ${_z}:${M60}/org:rslave -v ${fp}:${cC0} ${W} ${xp(this.image)}`,{env:G,timeoutMs:vB1}),await this.waitForDaemon(J.url),await yN(J.url,X,this.configPayload(Z)??{}),Z.orgFsConfigJson)await D60(J.url,X,Z.orgFsConfigJson).catch((K)=>console.warn(`[${wg}] org-fs relay failed`,K))}catch(G){throw await Y.delete().catch(()=>{}),this.lookups.delete($),G}this.remember($,{vm:Y,daemon:J})}async createVm($){try{return await this.freestyle.vms.create({...$,autoDeleteSeconds:this.autoDeleteSeconds})}catch(Z){if(!(Z instanceof WJ&&Z.status===400))throw Z;return console.warn(`[${wg}] autoDeleteSeconds=${this.autoDeleteSeconds} refused (${Z.message}); creating with the plan's cap`),this.freestyle.vms.create($)}}configPayload($){return Mp({runtime:$.workload?.runtime??"node",packageManager:$.workload?.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:$.repo??null,extraRepos:$.extraRepos??[],port:$.workload?.devPort??ME6,tenant:$.tenant,cloneOnly:$.cloneOnly===!0})}async waitForDaemon($){let Z=Date.now()+Dr$;while(Date.now()<Z){if(await jr$($))return;await $$(SE6)}throw Error(`sandbox daemon at ${$} did not answer /health within ${Dr$/1000}s`)}async delete($){this.cancelRelease($);let Z=await this.find($,{refresh:!0});if(this.lookups.delete($),!Z)return;await Z.vm.exec({command:`docker stop -t 30 ${Nr$}; docker stop -t 10 ${Br$}`,timeoutMs:60000}).catch(()=>{}),await Z.vm.delete()}async lastTermination($){return null}async alive($){return await this.find($,{refresh:!0})!==null}async*watchClaimLifecycle($,Z){let Q=Date.now();yield{kind:"claiming",since:Q};let X=!1;while(!Z?.aborted){let Y=await this.find($,{refresh:!0}).catch(()=>null);if(Y){if(!X)X=!0,yield{kind:"warming-daemon",since:Date.now()};if(await jr$(Y.daemon.url)){yield{kind:"ready"};return}}if(Date.now()-Q>bE6){yield{kind:"failed",reason:Y?"crash-loop-backoff":"claim-never-created",message:Y?"the sandbox VM exists but its daemon never answered":"no sandbox VM was created"};return}await $$(1000)}}async hasSchedulableCapacity(){return!0}async getPreviewUrl($){return await this.find($)?this.daemonUrl($):null}async proxyDaemonRequest($,Z,Q){let X=await this.find($);if(!X)return Response.json({error:"sandbox not found"},{status:404});let Y=async()=>(await this.find($,{refresh:!0}))?.daemon??null;return this.timeDaemonRequest(hD.freestyle,()=>kp(X.daemon,Z,Q,{unauthorized:async()=>{let J=await Y();return J&&J.token!==X.daemon.token?J:null},unreachable:Y}))}async daemonEndpoint($){return(await this.find($))?.daemon??null}async adoptLiveClaim($,Z){return await this.find(Z,{refresh:!0})!==null}async resolvePreviewUpstreamUrl($){return(await this.find($))?.daemon.url??null}proxyPreviewRequest($,Z){return Sp(Z,{base:()=>this.resolvePreviewUpstreamUrl($).catch(()=>null),invalidate:()=>this.lookups.delete($),retryBase:()=>this.find($,{refresh:!0}).then((Q)=>Q?.daemon.url??null).catch(()=>null)},wg)}async markTenantPoolsDirty($,Z){return[]}async releaseAfter($,Z){this.cancelRelease($);let Q=setTimeout(()=>{this.releaseTimers.delete($),this.find($).then((X)=>X?.vm.pause()).catch((X)=>console.warn(`[${wg}] pause ${$} failed: ${wr$(X)}`))},Z);Q.unref?.(),this.releaseTimers.set($,Q)}async renewTtl($){this.cancelRelease($)}cancelRelease($){let Z=this.releaseTimers.get($);if(Z)clearTimeout(Z);this.releaseTimers.delete($)}close(){for(let $ of this.releaseTimers.values())clearTimeout($);this.releaseTimers.clear(),this.lookups.clear()}}async function jr$($){try{let Z=await fetch(`${$}/health`,{signal:AbortSignal.timeout(_E6)});return await Z.body?.cancel(),Z.ok}catch{return!1}}function xp($){return`'${$.replaceAll("'","'\\''")}'`}function wr$($){return $ instanceof Error?$.message:String($)}var wg="FreestyleSandboxProvider",lC0=9000,M60="/app",ME6=3000,Nr$="sandbox",Br$="orgfs",IE6="ghcr.io/decocms/studio/orgfs-sidecar:0.1.0",_z="/srv/sandbox/org",fp="/srv/sandbox/orgfs-ctl",cC0="/run/orgfs",VE6,Lr$="studio-daemon-token",kE6="studio-org-id",CE6="studio-user-id",Dr$=120000,SE6=500,_E6=5000,vB1=300000,vE6=300000,xE6=1e4,fE6=5000,bE6=300000,Or$=3000;var Pr$=L(()=>{Hr$();$8();Fr$();Bg();Ip();MC0();IC0();uC0();VE6=[`mkdir -p ${_z} ${fp}`,`grep -q ' ${_z} ' /etc/fstab || printf '%s\\n' '${_z} ${_z} none bind,rshared 0 0' 'tmpfs ${fp} tmpfs uid=1000,gid=1000,mode=0755,size=1m 0 0' >> /etc/fstab`,`mountpoint -q ${_z} || mount ${_z}`,`mountpoint -q ${fp} || mount ${fp}`].join(" && ")});function I60($,Z){if($ instanceof Error)Object.assign($,{["sandboxProvider"]:Z});return $}function xB1($){for(let Z=$,Q=0;Z instanceof Error&&Q<5;Q++){let X=Z.sandboxProvider;if(X==="kubernetes"||X==="freestyle")return X;Z=Z.cause}return}var fB1={};J0(fB1,{handleShare:()=>Tr$,SandboxProviderRouter:()=>Ar$});import{createHash as yE6}from"crypto";function Tr$($){let Z=yE6("sha256").update($).digest("hex").slice(0,8);return Number.parseInt(Z,16)/4294967296}function uE6($){return $ instanceof wF}class Ar${providers;picked=new Map;strays=new Map;freestyleShare;constructor($,Z={}){this.providers=$;if(!$.kubernetes&&!$.freestyle)throw Error("SandboxProviderRouter needs at least one provider");this.freestyleShare=Math.min(1,Math.max(0,Z.freestyleShare??0))}get($){let Z=this.providers[$];if(!Z)throw Error(`sandbox provider ${$} is not configured`);return Z}remember($,Z){if(this.picked.delete($),this.picked.size>=gE6){let Q=this.picked.keys().next();if(!Q.done)this.picked.delete(Q.value)}this.picked.set($,Z)}async providerOf($){let{kubernetes:Z,freestyle:Q}=this.providers;if(!Q)return"kubernetes";if(!Z)return"freestyle";let X=this.picked.get($);if(X)return X;return await Q.owns($).catch(()=>!1)?"freestyle":"kubernetes"}async owner($){return this.get(await this.providerOf($))}async place($,Z){let{kubernetes:Q,freestyle:X}=this.providers,Y=Z.sandboxImage??"default";if(Y!=="default"){if(!Q)throw Error(`sandbox image ${Y} needs the kubernetes provider`);return{kind:"kubernetes",reason:X?"image":void 0}}if(!Q)return{kind:"freestyle"};if(!X)return{kind:"kubernetes"};let J=this.strays.get($);if(J)this.retire(J,$);if(J!=="kubernetes"&&await Q.alive($).catch(()=>!1))return{kind:"kubernetes",reason:"existing"};let G=J==="freestyle"?!1:await X.owns($).catch(()=>null);if(G)return{kind:"freestyle",reason:"existing"};if(G===null)return{kind:"kubernetes",reason:"freestyle-unavailable"};if(Z.provider)return{kind:Z.provider,reason:"requested"};if(this.hasWarmPool(Z,Y))return{kind:"kubernetes",reason:"warm-pool"};if(Tr$($)<this.freestyleShare)return{kind:"freestyle",reason:"split"};return await Q.hasSchedulableCapacity().catch(()=>!1)?{kind:"kubernetes",reason:"split"}:{kind:"freestyle",reason:"capacity"}}hasWarmPool($,Z){let Q=qC0($);if(!Q)return!1;return(this.providers.kubernetes?.listTenantPools?.()??[]).some((Y)=>Y.tenant===Q&&Y.image===Z)}async ensure($,Z={}){let{provider:Q,...X}=Z,Y=c3($),J=await this.place(Y,Z);if(this.remember(Y,J.kind),this.strays.get(Y)===J.kind)this.strays.delete(Y);let G;try{let H=await this.get(J.kind).ensure($,X);return J.reason?{...H,placement:{reason:J.reason}}:H}catch(H){G=I60(H,J.kind)}let W=hE6(J.kind);if(!J.reason||J.reason==="image"||uE6(G))throw G;console.warn(`[SandboxProviderRouter] ensure ${Y} failed on ${J.kind}, trying ${W}:`,G instanceof Error?G.message:String(G)),this.remember(Y,W);let K;try{K=await this.get(W).ensure($,X)}catch(H){throw this.picked.delete(Y),I60(H,W)}if(J.reason==="existing")this.retire(J.kind,Y);return{...K,placement:{reason:"fallback",fallbackFrom:J.kind}}}retire($,Z){this.strays.set(Z,$),O8(async()=>{if(this.strays.get(Z)===$)await this.get($).delete(Z)},{maxAttempts:3}).then(()=>{if(this.strays.get(Z)===$)this.strays.delete(Z)}).catch((Q)=>console.warn(`[SandboxProviderRouter] delete of ${$} sandbox ${Z} after fallback failed:`,Q instanceof Error?Q.message:String(Q)))}async delete($){let Z=this.strays.get($);this.strays.delete($),await Promise.all([(await this.owner($)).delete($),Z&&this.get(Z).delete($).catch(()=>{})]),this.picked.delete($)}async lastTermination($){return(await this.owner($)).lastTermination($)}async alive($){return(await this.owner($)).alive($)}async*watchClaimLifecycle($,Z){yield*(await this.owner($)).watchClaimLifecycle($,Z)}async hasSchedulableCapacity(){let{kubernetes:$,freestyle:Z}=this.providers;if(!$||Z)return!0;return $.hasSchedulableCapacity()}async getPreviewUrl($){return(await this.owner($)).getPreviewUrl($)}async proxyDaemonRequest($,Z,Q){return(await this.owner($)).proxyDaemonRequest($,Z,Q)}async adoptLiveClaim($,Z){return(await this.owner(Z)).adoptLiveClaim($,Z)}async resolvePreviewUpstreamUrl($){return(await this.owner($)).resolvePreviewUpstreamUrl($)}async proxyPreviewRequest($,Z){return(await this.owner($)).proxyPreviewRequest($,Z)}async markTenantPoolsDirty($,Z){return await this.providers.kubernetes?.markTenantPoolsDirty($,Z)??[]}async releaseAfter($,Z){await(await this.owner($)).releaseAfter($,Z)}async renewTtl($){await(await this.owner($)).renewTtl($)}async daemonEndpoint($){let Z=this.providers[await this.providerOf($)];if(!Z?.daemonEndpoint)throw Error("sandbox provider has no daemon endpoint to serve");return Z.daemonEndpoint($)}listSandboxes(){return this.providers.kubernetes?.listSandboxes?.()??[]}listTenantPools(){return this.providers.kubernetes?.listTenantPools?.()??[]}close(){this.providers.kubernetes?.close(),this.providers.freestyle?.close(),this.picked.clear(),this.strays.clear()}}var gE6=5000,hE6=($)=>$==="kubernetes"?"freestyle":"kubernetes";var bB1=L(()=>{$8();Bg();z60();Ip()});var yB1={};J0(yB1,{toClaimPhase:()=>Cr$,SandboxHostError:()=>Eg,RemoteSandboxProvider:()=>kr$});function yp($){return $ instanceof Error?$.message:String($)}function pE6($){if(!Array.isArray($))return"";let Z=$[0];return typeof Z==="object"&&Z!==null&&"text"in Z&&typeof Z.text==="string"?Z.text:""}function nE6($){return $ instanceof cL&&$.code===503}function tE6($,Z){let Q=null;try{Q=JSON.parse(Z)}catch{}let X=vl$.safeParse(Q);if(!X.success)return new Eg(`${$} failed: ${Z.slice(0,300)}`);let Y=X.data.code==="bootstrap-rejected"?new wF(X.data.status??502,X.data.error):new Eg(`${$}: ${X.data.error}`);return X.data.provider?I60(Y,X.data.provider):Y}function iC0($){return{kind:"failed",reason:"unknown",message:$}}function qr$($){return $.kind==="ready"||$.kind==="failed"}function Mr$($){return A7(Vr$,Ir$,$,2,0.5)}function mC0(...$){let Z=$.filter((Q)=>Q!==void 0);return Z.length>1?AbortSignal.any(Z):Z[0]}class kr${baseUrl;token;credentialLifetimeMs;stallMs;timeDaemonRequest;closed=new AbortController;connecting=null;sandboxes=new Map;capacity=null;capacityInFlight=null;constructor($){this.baseUrl=$.baseUrl.replace(/\/$/,""),this.token=$.token,this.credentialLifetimeMs=$.credentialLifetimeMs,this.stallMs=$.stallMs??4*Ml$,this.timeDaemonRequest=hC0($.meter)}headers(){return{authorization:`Bearer ${this.token}`}}client(){return this.connecting??=(async()=>{let $=new K7({name:"studio",version:"1.0.0"}),Z=new yU(new URL(`${this.baseUrl}/mcp`),{requestInit:{headers:this.headers()},fetch:(Q,X)=>fetch(Q,{...X,timeout:!1})});return await $.connect(Z,{timeout:Rr$}),$})().catch(($)=>{throw this.connecting=null,$}),this.connecting}async call($,Z,Q,X={}){let{timeoutMs:Y=Rr$,signal:J}=X,G;try{G=await O8(async()=>(await this.client()).callTool({name:$,arguments:{...Z}},void 0,{timeout:Y??lE6,signal:J}),{maxAttempts:cE6,minTimeout:Ir$,maxTimeout:Vr$,isRetriable:nE6,signal:J})}catch(K){if(J?.aborted)throw J.reason;throw K instanceof k5?K.cause:K}if(G.isError)throw tE6($,pE6(G.content));let W=Q.safeParse(G.structuredContent);if(!W.success)throw new Eg(`${$} returned a malformed result: ${W.error.message}`);return W.data}async whileHostAlive($,Z,Q){let X=new AbortController,Y=new AbortController;this.hostStall($,mC0(X.signal,Q,this.closed.signal)??X.signal).then((J)=>{if(J)Y.abort(J)});try{return await Z(mC0(Y.signal,Q,this.closed.signal)??Y.signal)}finally{X.abort()}}cached($){let Z=this.sandboxes.get($);if(!Z)return null;if(Date.now()-Z.at>dE6)return this.sandboxes.delete($),null;return Z}remember($,Z,Q,X){if(this.sandboxes.delete($),!Z)return;if(this.sandboxes.size>=iE6){let Y=this.sandboxes.keys().next();if(!Y.done)this.sandboxes.delete(Y.value)}this.sandboxes.set($,{daemon:Z,previewUrl:Q,provider:X,at:Date.now()})}async status($,Z={}){let Q=(Y,J)=>this.call(SD.status,{handle:$,resurrect:Z.resurrect??!1},Cl$,{signal:Y,timeoutMs:J}),X=Z.resurrect?await this.whileHostAlive($,(Y)=>Q(Y,null),Z.signal):await Q(Z.signal);return this.remember($,X.daemon,X.previewUrl,X.provider),X}async daemonFor($,Z={}){if(!Z.refresh){let Q=this.cached($);if(Q)return Q.daemon}return(await this.status($,{resurrect:!0,signal:Z.signal})).daemon}async ensure($,Z={}){let{image:Q,...X}=Z,Y=c3($),J=this.credentialLifetimeMs,G=Date.now(),W=await this.whileHostAlive(Y,(K)=>this.call(SD.ensure,{id:$,opts:X,...J&&{credentialsValidUntil:{orgFsConfig:G+J.orgFsConfig}}},kl$,{timeoutMs:null,signal:K}));if(W.handle!==Y)throw new Eg(`host answered ensure with ${W.handle}, expected ${Y}`);return this.remember(W.handle,W.daemon,W.previewUrl,W.provider),{handle:W.handle,workdir:W.workdir,previewUrl:W.previewUrl,warmPoolAdopted:W.warmPoolAdopted,provider:W.provider,...W.placement&&{placement:W.placement}}}async delete($){this.sandboxes.delete($),await this.call(SD.delete,{handle:$},kF1)}async alive($){return(await this.status($)).alive}async getPreviewUrl($){let Z=this.cached($);if(Z)return Z.previewUrl;return(await this.status($)).previewUrl}async lastTermination($){return(await this.status($)).lastTermination}async lifetime($,Z){try{await this.call(SD.lifetime,$,kF1)}catch(Q){console.warn(`[${bp}] ${Z} failed: ${yp(Q)}`)}}renewTtl($){return this.lifetime({handle:$},`TTL renew for ${$}`)}releaseAfter($,Z){return this.lifetime({handle:$,graceMs:Math.max(0,Math.round(Z))},`release of ${$}`)}hasSchedulableCapacity(){let $=this.capacity;if($&&Date.now()-$.at<mE6)return Promise.resolve($.value);return this.capacityInFlight??=this.readCapacity().finally(()=>{this.capacityInFlight=null}),this.capacityInFlight}async readCapacity(){let $=!0;try{$=(await this.call(SD.capacity,{},Sl$)).schedulable}catch(Z){console.warn(`[${bp}] capacity probe failed: ${yp(Z)}`)}return this.capacity={value:$,at:Date.now()},$}async adoptLiveClaim($,Z){let Q=await this.status(Z).catch(()=>null);return Boolean(Q?.daemon)}async markTenantPoolsDirty($,Z){try{return(await this.call(SD.tenantPoolsPush,{repoUrl:$,ref:Z},_l$)).pools}catch(Q){return console.warn(`[${bp}] tenant pool push for ${$}@${Z} failed: ${yp(Q)}`),[]}}list(){return this.call(SD.list,{},yl$)}pushCredentials($){return this.call(SD.credentialsPush,$,bl$)}close(){this.closed.abort(),this.sandboxes.clear();let $=this.connecting;this.connecting=null,$?.then((Z)=>Z.close()).catch(()=>{})}async proxyDaemonRequest($,Z,Q){let X=Q.signal,Y=await this.daemonFor($,{signal:X});if(!Y)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let J=this.sandboxes.get($)?.provider??"kubernetes";return this.timeDaemonRequest(hD[J],()=>kp(Y,Z,Q,{unauthorized:async()=>{let G=await this.daemonFor($,{refresh:!0,signal:X}).catch(()=>null);return G&&(G.token!==Y.token||G.url!==Y.url)?G:null},unreachable:()=>this.daemonFor($,{refresh:!0,signal:X})}))}async resolvePreviewUpstreamUrl($,Z){return(await this.daemonFor($,{signal:Z}))?.url??null}proxyPreviewRequest($,Z){let Q=Z.signal;return Sp(Z,{base:()=>this.resolvePreviewUpstreamUrl($,Q).catch((X)=>{return console.warn(`[${bp}] preview upstream for ${$} failed: ${yp(X)}`),null}),invalidate:()=>this.sandboxes.delete($),retryBase:()=>this.daemonFor($,{refresh:!0,signal:Q}).then((X)=>X?.url??null).catch(()=>null)},bp)}async*watchOnce($,Z){let Q=new URL(`${this.baseUrl}${ql$}`);Q.searchParams.set("handle",$);let X=new AbortController,Y,J=this.stallMs/2,G=()=>{clearTimeout(Y),Y=setTimeout(()=>X.abort(Error(`host sent nothing for ${J/1000}s`)),J)};G();try{let W=await fetch(Q,{headers:{...this.headers(),accept:"text/event-stream"},signal:mC0(X.signal,Z),timeout:!1});if(!W.ok||!W.body){await W.body?.cancel().catch(()=>{});let F=`watch answered ${W.status}`;throw W.status>=400&&W.status<500?new dC0(F):Error(F)}G();let K=new TextDecoder,H="";for await(let F of W.body){G(),H+=K.decode(F,{stream:!0});let U=H.indexOf(`
 
 `);while(U!==-1){let N=H.slice(0,U);H=H.slice(U+2),U=H.indexOf(`