decocms 4.427.2 → 4.427.4

package/dist/server/server.js

@@ -1201,7 +1201,7 @@ Caused by: ${Z.stack}`}};Nm=class Nm extends vY{constructor($,Z){super($,Z);this
 `).filter((Z)=>!/^Co-authored-by:\s/i.test(Z)).join(`
 `).trimEnd()}function nl4($){let Z=$.userName.trim(),Q=$.userEmail?.trim();if(Q)return`Co-authored-by: ${Z} <${Q}>`;return`Co-authored-by: ${Z}`}function D51($,Z){let Q=Im(Z);if(!Q)return $;let Y=FA$($),X=nl4(Q);if(Y.includes(X))return Y;let J=Y.trimEnd();return J.length>0?`${J}
 
-${X}`:X}var HA$,pl4;var O51=D(()=>{HA$=/[\r\n<>]/,pl4=/^[^\s@<>]+@[^\s@<>]+\.[^\s@<>]+$/});var pA0=D(()=>{a$();O51()});function tl4($){if($ instanceof TypeError)return!0;if($ instanceof Error&&!($ instanceof DOMException)&&typeof $.code==="string")return!0;if($ instanceof DOMException&&$.name==="AbortError")return!0;return!1}async function L51($,Z,Q,Y){try{return await E8(async()=>{let J=await fetch($,{...Z,signal:AbortSignal.timeout(Y)});return{status:J.status,ok:J.ok,body:await J.text()}},{maxAttempts:3,minTimeout:50,maxTimeout:500,multiplier:2,jitter:0.5,isRetriable:tl4})}catch(X){let J=X instanceof Error?X.message:String(X);throw Error(`[SANDBOX_UNREACHABLE] sandbox daemon ${Q} request failed: ${J}`,{cause:X})}}async function nA0($){try{let Z=await fetch(`${$}/health`,{signal:AbortSignal.timeout(ol4)});if(!Z.ok){try{await Z.text()}catch{}return null}let Q=await Z.json();if(typeof Q==="object"&&Q!==null&&typeof Q.bootId==="string"&&typeof Q.ready==="boolean"&&Q.setup&&typeof Q.setup.running==="boolean"&&typeof Q.setup.done==="boolean")return Q;return null}catch{return null}}async function j51($){for(let Z=0;Z<UA$;Z++){if(await nA0($)!==null)return;let Q=(Math.random()*2-1)*rl4;await z$(NA$+Q)}throw Error(`sandbox daemon at ${$} did not respond on /health within ${UA$*NA$/1000}s`)}async function VU($,Z,Q,Y,X){return sl4($,Z,"POST",Q,Y,X)}async function sl4($,Z,Q,Y,X,J){let G={...Y};if(X&&X.rotateToken!==void 0)G.auth=X;let W=await L51(`${$}/_sandbox/config`,{method:Q,headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:JSON.stringify(G)},"/_sandbox/config",J?.timeoutMs??w51);if(!W.ok)throw new EH(W.status,W.body);return DA$(W.body,"/_sandbox/config")}async function BA$($,Z,Q){let Y=await L51(`${$}/_sandbox/setup/${Q}`,{method:"POST",headers:{Authorization:`Bearer ${Z}`}},`/_sandbox/setup/${Q}`,w51);if(!Y.ok)throw Error(`sandbox daemon /_sandbox/setup/${Q} returned ${Y.status}: ${Y.body}`)}async function N10($,Z,Q){let Y=await L51(`${$}/_sandbox/orgfs-config`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:Q},"/_sandbox/orgfs-config",w51);if(!Y.ok)throw Error(`sandbox daemon /_sandbox/orgfs-config returned ${Y.status}: ${Y.body}`);return DA$(Y.body,"/_sandbox/orgfs-config")}function DA$($,Z){try{return JSON.parse($)}catch(Q){throw Error(`sandbox daemon ${Z} returned a malformed JSON body: ${$.slice(0,200)}`,{cause:Q})}}async function tA0($,Z,Q,Y){let X=new Headers(Y.headers);for(let W of al4)X.delete(W);X.set("authorization",`Bearer ${Z}`);let J=Y.method!=="GET"&&Y.method!=="HEAD",G=`${$}${Q.startsWith("/")?Q:`/${Q}`}`;return fetch(G,{method:Y.method,headers:X,body:J?Y.body:void 0,redirect:"manual",signal:Y.signal,duplex:J?"half":void 0})}var EH,ol4=500,w51=30000,UA$=25,NA$=200,rl4=50,al4;var Xf=D(()=>{pA0();a$();EH=class EH extends Error{status;constructor($,Z){super(`sandbox daemon /_sandbox/config returned ${$}: ${Z}`);this.status=$;this.name="ConfigRequestError"}};al4=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length"]});class oA0{counted=new Set;markCounted($){this.counted.add($)}consume($){return this.counted.delete($)}}class Jf{map=new Map;async run($,Z){let Q=this.map.get($);if(Q)return Q;let Y=Z();this.map.set($,Y);try{return await Y}finally{this.map.delete($)}}}function rA0($,Z,Q){if(!$)return Q(null);if(!$.withLock)return Q($);return $.withLock(Z,Q)}function B10($){if(!$.orgId||!$.virtualMcpId||!$.branch)throw Error("composeSandboxRef: orgId, virtualMcpId and branch are all required for agent refs");return`agent:${$.orgId}:${$.virtualMcpId}:${$.branch}`}function OA$($){if(!$.startsWith("agent:"))return"";let Z=$.split(":");return Z.length>=4?Z.slice(3).join(":"):""}import{hash as el4}from"crypto";function $c4($,Z=16){return el4("sha256",QL$($),"hex").slice(0,Z)}function F3($){let Z=$c4($),Q=Zc4(OA$($.projectRef));return Q?`${Q}-${Z}`:`s-${Z}`}function Zc4($){if(!$)return"";let Z=$.split("/").pop()??"",Q="",Y=!1;for(let X of Z.toLowerCase()){let J=X.charCodeAt(0),G=J>=97&&J<=122,W=J>=48&&J<=57;if(!G&&!W){Y||=Q.length>0;continue}if(Y){if(Q.length+1>=LA$)break;Q+="-",Y=!1}if(Q+=X,Q.length===LA$)break}return Q}var LA$=24;var wA$=D(()=>{D41()});function sA0($,Z){let Q=$.replace(/\/+$/,"");if(Q.includes("{handle}"))return`${Q.replace("{handle}",Z)}/`;try{let Y=new URL(Q);return Y.hostname=`${Z}.${Y.hostname}`,`${Y.toString()}/`}catch{return`${Q}/${Z}/`}}function Vm($){let Z=$.repo,Q=Z?{repository:{cloneUrl:Z.cloneUrl,repoName:Z.displayName??Qc4(Z.cloneUrl),...Z.branch?{branch:Z.branch}:{},submoduleCredentials:Z.submoduleCredentials??[]},repositories:($.extraRepos??[]).filter((K)=>!!K.directoryName).map((K)=>({cloneUrl:K.cloneUrl,repoName:K.directoryName,...K.branch?{branch:K.branch}:{},submoduleCredentials:K.submoduleCredentials??[]})),...Z.userName.trim()||Z.userEmail.trim()?{identity:{userName:Z.userName,userEmail:Z.userEmail}}:{}}:void 0,Y=$.tenant,X=Im({userName:Y?.userName,userEmail:Y?.userEmail})??void 0,J=$.packageManager?{name:$.packageManager.name,...$.packageManager.path?{path:$.packageManager.path}:{}}:void 0,G=J?{packageManager:J,runtime:$.runtime,...$.port!==void 0?{port:$.port}:{}}:void 0,W=Y?.orgId;if(!Q&&!G&&!X&&$.cloneOnly===void 0&&!W)return null;return{...Q?{git:Q}:{},...X?{operator:X}:{},...W?{orgId:W}:{},...$.cloneOnly!==void 0?{cloneOnly:$.cloneOnly}:{},...G?{application:G}:{}}}function Qc4($){try{let Z=new URL($);return Z.pathname.replace(/^\/+/,"").replace(/\.git$/,"")||Z.hostname}catch{return $}}var jA$=D(()=>{O51()});function Yc4($){try{return new URL($).username.length>0}catch{return!1}}function D10($){let Z=$.repo?.cloneUrl;if(!Z||!Yc4(Z))return null;return{git:{repository:{cloneUrl:Z}}}}var km=D(()=>{wA$();jA$()});async function*PA$($){let Z=$.now??(()=>Date.now()),Q=Z(),Y=$.schedulingTimeoutMs??Jc4,X={pod:{},sandbox:{},events:{hasPulling:!1,hasPulled:!1},startedAt:Q},J=[],G=null,W=!1,K=(E)=>{if(W)return;if(G){let z=G;G=null,z(E)}else J.push(E)},H=()=>{if(J.length>0)return Promise.resolve(J.shift());if(W)return Promise.resolve(null);return new Promise((E)=>{G=E})},F=()=>{if(W)return;if(W=!0,G){let E=G;G=null,E(null)}},U=new AbortController,N=()=>{U.abort(),F()};if($.signal)if($.signal.aborted)U.abort(),F();else $.signal.addEventListener("abort",N,{once:!0});let B=Math.max(0,Y-(Z()-Q)),O=setTimeout(()=>K("tick"),B+100),L,w=new Promise((E)=>{L=E}),j=Promise.allSettled([Wc4($.kc,$.namespace,$.claimName,U.signal,X,K,Z,L),Hc4($.kc,$.namespace,$.claimName,U.signal,X,K),Fc4($.kc,$.namespace,$.claimName,w,U.signal,X,K,Z)]);try{let E=null,z=-1,T=EA$(X,Y,Z);if(E=z51(T),!E51(T))z=zA$(T);if(yield T,E51(T))return;while(!W){if(await H()===null)break;let P=EA$(X,Y,Z);if(E51(P)){let _=z51(P);if(_!==E)E=_,yield P;return}let q=zA$(P);if(q<z)continue;let x=z51(P);if(x!==E)E=x,z=q,yield P}}finally{if(clearTimeout(O),U.abort(),$.signal)$.signal.removeEventListener("abort",N);F(),await j.catch(()=>{})}}async function AA$($,Z=Gc4){let Q=new AbortController,Y="claiming",X,J=()=>{clearTimeout(X),X=setTimeout(()=>Q.abort(),Z)};try{J();for await(let G of $(Q.signal)){if(G.kind==="ready")return;if(G.kind==="failed")throw new vY(G.message);Y=G.kind,J()}}finally{clearTimeout(X),Q.abort()}throw new Nm(`Sandbox did not become ready: no progress for ${Math.round(Z/1000)}s while ${Y}`)}function EA$($,Z,Q){let{pod:Y,sandbox:X,events:J,startedAt:G}=$;if(X.ready)return{kind:"ready"};let W=Y.containerWaitingReason;if(W==="ImagePullBackOff"||W==="ErrImagePull")return{kind:"failed",reason:"image-pull-backoff",message:"Sandbox image failed to download. The cluster may be missing pull credentials or the image tag may not exist."};if(W==="CrashLoopBackOff")return{kind:"failed",reason:"crash-loop-backoff",message:"Sandbox crashed during startup and is now in CrashLoopBackOff. Check pod logs."};if(!Y.scheduled&&J.lastFailedSchedulingAt!==void 0&&Q()-G>Z)return{kind:"failed",reason:"scheduling-timeout",message:J.failedSchedulingMessage??`Pod could not be scheduled within ${Math.round(Z/1000)}s.`};if(Y.containerRunning&&!Y.containerReady)return{kind:"warming-daemon",since:G};if(J.hasPulling&&!J.hasPulled)return{kind:"pulling-image",since:G};if(W==="ContainerCreating"||W==="PodInitializing"||Y.scheduled&&!Y.containerRunning)return{kind:"starting-container",since:G};if(Y.scheduledFalseReason==="Unschedulable"||J.lastFailedSchedulingAt!==void 0&&!Y.scheduled)return{kind:"waiting-for-capacity",since:G,message:J.failedSchedulingMessage??Y.scheduledFalseMessage,nodeClaim:J.nominatedNodeClaim};return{kind:"claiming",since:G}}function E51($){return $.kind==="ready"||$.kind==="failed"}function zA$($){switch($.kind){case"claiming":return 0;case"waiting-for-capacity":return 1;case"pulling-image":return 2;case"starting-container":return 3;case"warming-daemon":return 4;case"ready":case"failed":return 99}}function z51($){switch($.kind){case"claiming":case"pulling-image":case"starting-container":case"warming-daemon":return $.kind;case"waiting-for-capacity":return`waiting-for-capacity:${$.message??""}:${$.nodeClaim??""}`;case"ready":return"ready";case"failed":return`failed:${$.reason}:${$.message}`}}async function Wc4($,Z,Q,Y,X,J,G,W){let K=`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?watch=true&labelSelector=${encodeURIComponent(`${Xc4}=${Q}`)}`;return aA0({kc:$,path:K,signal:Y,label:`pod/${Q}`,onEvent:(H)=>{if(H.type!=="ADDED"&&H.type!=="MODIFIED")return;let F=H.object;if(F.metadata?.name)W(F.metadata.name);Kc4(F,X,G),J("pod")}})}function Kc4($,Z,Q){let X=($.status?.conditions??[]).find((G)=>G.type==="PodScheduled");if(X?.status==="True")Z.pod.scheduled=!0,Z.pod.scheduledFalseReason=void 0,Z.pod.scheduledFalseMessage=void 0;else if(X?.status==="False")Z.pod.scheduled=!1,Z.pod.scheduledFalseReason=X.reason,Z.pod.scheduledFalseMessage=X.message;let J=($.status?.containerStatuses??[]).find((G)=>G.name===dZ.MAIN_CONTAINER_NAME);if(J)Z.pod.containerWaitingReason=J.state?.waiting?.reason,Z.pod.containerRunning=!!J.state?.running,Z.pod.containerReady=J.ready===!0}async function Hc4($,Z,Q,Y,X,J){let G=`/apis/${dZ.CLAIM_API_GROUP}/${dZ.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(Z)}/${dZ.CLAIM_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${Q}`)}`;return aA0({kc:$,path:G,signal:Y,label:`sandboxclaim/${Q}`,onEvent:(W)=>{if(W.type!=="ADDED"&&W.type!=="MODIFIED")return;let H=W.object.status?.conditions?.find((F)=>F.type==="Ready");if(!H)return;if(H.status==="True")X.sandbox.ready=!0,X.sandbox.notReadyReason=void 0,X.sandbox.notReadyMessage=void 0;else X.sandbox.ready=!1,X.sandbox.notReadyReason=H.reason,X.sandbox.notReadyMessage=H.message;J("sandbox")}})}async function Fc4($,Z,Q,Y,X,J,G,W){let K=await Promise.race([Y,new Promise((F)=>{if(X.aborted){F(Q);return}X.addEventListener("abort",()=>F(Q),{once:!0})})]);if(X.aborted)return;let H=`/api/v1/namespaces/${encodeURIComponent(Z)}/events?watch=true&fieldSelector=${encodeURIComponent(`involvedObject.name=${K},involvedObject.kind=Pod`)}`;return aA0({kc:$,path:H,signal:X,label:`events/${Q}`,onEvent:(F)=>{if(F.type!=="ADDED"&&F.type!=="MODIFIED")return;let U=F.object,N=U.reason;if(!N)return;switch(N){case"Pulling":J.events.hasPulling=!0;break;case"Pulled":J.events.hasPulling=!0,J.events.hasPulled=!0;break;case"FailedScheduling":J.events.lastFailedSchedulingAt=W(),J.events.failedSchedulingMessage=U.message;break;case"Nominated":{let B=U.message?.match(/nodeclaim\/([\w-]+)/);if(B)J.events.nominatedNodeClaim=B[1];break}default:return}G("event")}})}async function TA$($){let{kc:Z,namespace:Q,labelSelector:Y,signal:X,onDelete:J}=$,G=`/apis/${dZ.CLAIM_API_GROUP}/${dZ.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(Q)}/${dZ.CLAIM_PLURAL}?watch=true&labelSelector=${encodeURIComponent(Y)}`;return aA0({kc:Z,path:G,signal:X,label:"sandboxclaim-reaper",onEvent:(W)=>{if(W.type!=="DELETED")return;let K=W.object.metadata?.name;if(K)J(K)}})}async function aA0($){let{kc:Z,path:Q,signal:Y,label:X,onEvent:J}=$,G=0;while(!Y.aborted){try{let K=await SW(Z,{method:"GET",path:Q,signal:Y,headers:{accept:"application/json"},stream:!0});if(!K.ok||!K.body){try{await K.body?.cancel()}catch{}if(K.status===401||K.status===403){console.warn(`[lifecycle-watcher] ${X} stopped: watch denied (${K.status} ${K.statusText}). `+"The kubeconfig in use cannot watch SandboxClaims \u2014 if you are running locally, "+"this provider should not be active (check STUDIO_AGENT_SANDBOX_ENABLED).");return}throw Error(`watch handshake failed: ${K.status} ${K.statusText}`)}G=0;for await(let H of bL$(K.body)){if(Y.aborted)return;try{J(H)}catch(F){console.warn(`[lifecycle-watcher] ${X} onEvent threw: ${F instanceof Error?F.message:String(F)}`)}}}catch(K){if(Y.aborted)return;let H=K instanceof Error?K.message:String(K);console.warn(`[lifecycle-watcher] ${X} watch ended: ${H}`)}if(Y.aborted)return;let W=U7(5000,250,G,2,0);G+=1,await z$(W,{signal:Y}).catch(()=>{})}}var Xc4="studio.decocms.com/sandbox-handle",Jc4=300000,Gc4=600000;var RA$=D(()=>{a$();d00();kH0()});import{createHash as Uc4}from"crypto";import{z as xX}from"zod";function kU($){let Z;try{Z=new URL($.trim())}catch{return null}if(Z.protocol!=="https:"||Z.search||Z.hash)return null;let Q=Z.pathname.replace(/\/+$/,"").replace(/\.git$/,"").replace(/\/+$/,"");return Q?`https://${Z.host.toLowerCase()}${Q}`:null}function O10($){return kU($)?.toLowerCase()??null}function Lc4($){let Z=new Set;for(let Q of $){let Y=`${O10(Q.repoUrl)??Q.repoUrl}#${Q.branch}`;if(Z.has(Y))return Q;Z.add(Y)}return null}function qA$($){return $.reduce((Z,Q)=>Z+Q.replicas,0)}function IA$($,Z){if(Z.warmPoolName)return Z.warmPoolName;let Q=Uc4("sha256").update(`${Z.repoUrl}#${Z.branch}`).digest("hex").slice(0,8);return`${$}-${Q}`}function VA$($){return Math.max(0,$.size-qA$($.repos))}function Sm($){return $.flatMap((Z)=>Z.repos.map((Q)=>({pool:Z,repo:Q,warmPoolName:IA$(Z.name,Q)})))}function wc4($,Z){return CA$(void 0,$,!0,Z)}function kA$($,{templateName:Z}){let Q=wc4(Z,$.image),Y=(X,J)=>({apiVersion:`${dZ.CLAIM_API_GROUP}/${dZ.CLAIM_API_VERSION}`,kind:"SandboxWarmPool",metadata:{name:X,labels:{[jc4]:$.name}},spec:{replicas:J,updateStrategy:{type:"OnReplenish"},sandboxTemplateRef:{name:Q}}});return[...$.repos.map((X)=>Y(IA$($.name,X),X.replicas)),Y($.name,VA$($))]}function $T0($){return $.tenant?.orgId}function A51($,Z){if(!Z.tenant)return null;let Q=$.filter((J)=>J.tenant===Z.tenant&&J.image===Z.image),Y=Z.cloneUrl?O10(Z.cloneUrl):null;if(Y){let J=Sm(Q).filter((W)=>O10(W.repo.repoUrl)===Y),G=J.find((W)=>W.repo.branch===Z.branch)??J[0];if(G)return G}let X=Q.find((J)=>VA$(J)>0);return X?{pool:X,repo:null,warmPoolName:X.name}:null}function SA$($,Z,Q){return $?.warmPoolName??(Z?Q:"none")}function CA$($,Z,Q=!1,Y){let X=Y&&Y!=="default"?`-${Y}`:"";return`${Z}${X}${$==="harness-run"||Q?"-medium":""}`}async function T51($){let Z=CA$($.purpose,$.templateName,$.tenantPool,$.sandboxImage);if(Z===$.templateName)return{name:Z,probes:$.probes};let Q=$.probes[Z]??null,Y=Q!==null&&$.now-Q.checkedAt<$.ttlMs?Q:{checkedAt:$.now,present:await $.exists(Z)},X={...$.probes,[Z]:Y};if(Y.present)return{name:Z,probes:X};if(Q?.present!==!1)$.onAbsent?.(Z);if($.sandboxImage&&$.sandboxImage!=="default")return T51({...$,sandboxImage:void 0,probes:X});return{name:$.templateName,probes:X}}function R51($,Z,Q){let Y=O10(Z);if(!Y)return[];let X=Q.replace(/^refs\/heads\//,"");return Sm($).filter(({repo:J})=>O10(J.repoUrl)===Y&&J.branch===X)}class q51{source;dirty=new Set;pods=new Map;known=new Map;constructor($){this.source=$}pools(){return this.source()}resolve($){return A51(this.pools(),$)}markDirty($,Z){let Q=R51(this.pools(),$,Z).map((Y)=>Y.warmPoolName);for(let Y of Q)this.dirty.add(Y);return Q}takeDirty($){return this.dirty.delete($)}pod($){return this.pods.get($)}setPod($,Z){this.pods.set($,Z)}retainPods($,Z){for(let[Q,Y]of this.pods)if(Y.pool===$&&!Z.has(Q))this.pods.delete(Q)}retain($){let Z=new Map($.map((Y)=>[Y.warmPoolName,Y])),Q=[...this.known.values()].filter((Y)=>!Z.has(Y.warmPoolName));for(let Y of this.dirty)if(!Z.has(Y))this.dirty.delete(Y);for(let[Y,X]of this.pods)if(!Z.has(X.pool))this.pods.delete(Y);return this.known=Z,Q}}var Nc4=54,Bc4,Dc4=2048,Oc4,L10,eA0,P51,MA$,jc4="studio.decocms.com/tenant-pool";var w10=D(()=>{i4();d00();Bc4=/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/;Oc4=xX.object({runtime:xX.enum(["node","bun","deno"]).default("node"),packageManager:xX.enum(["npm","pnpm","yarn","bun","deno"]).optional(),packageManagerPath:xX.string().optional(),devPort:xX.number().int().positive().optional()}).default({runtime:"node"}),L10=xX.object({repoUrl:xX.string().max(Dc4).transform(($,Z)=>{let Q=kU($);if(Q)return Q;return Z.addIssue({code:"custom",message:"repoUrl must be an https clone URL"}),xX.NEVER}),branch:xX.string().min(1).default("main"),workload:Oc4,replicas:xX.number().int().min(1)});eA0=class eA0 extends Error{poolName;size;allocated;constructor($,Z,Q){super(`pool ${$}: repos take ${Q} replicas, more than its size ${Z}`);this.poolName=$;this.size=Z;this.allocated=Q;this.name="TenantPoolCapacityError"}};P51=xX.object({name:xX.string().max(Nc4).regex(Bc4,"pool name must be a DNS label (lowercase alphanumeric and '-')"),tenant:xX.string().min(1).max(512),size:xX.number().int().min(1),image:GU.default("default")}),MA$=P51.extend({repos:xX.array(L10).default([])}).superRefine(($,Z)=>{let Q=Lc4($.repos);if(Q)Z.addIssue({code:"custom",path:["repos"],message:`duplicate repo allocation ${Q.repoUrl}#${Q.branch}`});let Y=qA$($.repos);if(Y>$.size)Z.addIssue({code:"custom",path:["repos"],message:new eA0($.name,$.size,Y).message})})});async function _A$($,Z,Q){let Y=new Map;for(let X of $){let J=Z(X);if(!J)continue;let G=Y.get(J);if(G)G.push(X);else Y.set(J,[X])}await Promise.allSettled([...Y.values()].map(async(X)=>{for(let J of X)await Q(J).catch(()=>{})}))}function Ec4($){try{let Z=new URL($);if(Z.hostname.toLowerCase()!=="github.com")return null;let[Q,Y]=Z.pathname.replace(/^\/+/,"").split("/"),X=Y?.replace(/\.git$/,"");return Q&&X?`${Q}/${X}`.toLowerCase():null}catch{return null}}function vA$($){if($.repositoryId)return{repositoryId:$.repositoryId};let Z=$.connectionId?Ec4($.cloneUrl):null;return $.connectionId&&Z?{connectionId:$.connectionId,repo:Z}:null}var bA$=D(()=>{w10()});async function Cm($,Z,Q,Y){let X=(G)=>tA0(G.url,G.token,Z,Q),J=!(Q.body instanceof ReadableStream);try{let G=await X($);if(G.status!==401||!J)return G;let W=await Y.unauthorized();if(!W)return G;return await G.body?.cancel().catch(()=>{}),await X(W)}catch(G){if(!J)throw G;let W=await Y.unreachable();if(!W)throw G;return X(W)}}var ZT0=D(()=>{Xf()});function yA$($,Z){return new Response(JSON.stringify(Z),{status:$,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function xA$($){let Z=new Headers;for(let[Q,Y]of $.headers.entries())if(!Pc4.includes(Q.toLowerCase()))Z.set(Q,Y);return new Response($.body,{status:$.status,statusText:$.statusText,headers:Z})}function fA$($,Z){let Q=yA$($,{error:Z});return Q.headers.set("x-sandbox-preview-not-ready","1"),Q}async function vm($,Z,Q){let Y=await Z.base();if(!Y)return fA$(404,"sandbox not found");let X=new URL($.url);if((X.pathname==="/_sandbox"||X.pathname.startsWith("/_sandbox/"))&&$.method!=="GET")return yA$(404,{error:"not found"});let G=(F)=>`${F}${X.pathname}${X.search}`,W=new Headers($.headers);for(let F of zc4)W.delete(F);let K=$.method!=="GET"&&$.method!=="HEAD",H={method:$.method,headers:W,body:K?$.body:void 0,redirect:"manual",signal:$.signal,duplex:K?"half":void 0};try{return xA$(await fetch(G(Y),H))}catch(F){let U=`${Y}${X.pathname}`;if(console.warn(`[${Q}] preview fetch to ${U} failed: ${F instanceof Error?F.message:String(F)}`),Z.invalidate(),$.method==="GET"||$.method==="HEAD"){let N=await Z.retryBase();if(N)try{return xA$(await fetch(G(N),H))}catch(B){console.warn(`[${Q}] preview fetch retry to ${U} failed: ${B instanceof Error?B.message:String(B)}`)}}return fA$(502,"sandbox daemon unreachable")}}var _m="x-sandbox-preview-not-ready",zc4,Pc4;var QT0=D(()=>{zc4=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length","upgrade"],Pc4=["connection","keep-alive","transfer-encoding","content-encoding","content-length"]});import{createHash as Ac4,randomBytes as Tc4,randomUUID as gA$}from"crypto";import*as iA$ from"net";import{PassThrough as Rc4}from"stream";function hA$($){if($ instanceof Error)return $.message;if($&&typeof $==="object"){let Z=$;if(Z.error instanceof Error)return Z.error.message;if(typeof Z.message==="string"&&Z.message)return Z.message}return String($)}function cA$($){return{pool:$.warmPoolName,org:$.pool.tenant}}class _51{records=new Map;inflight=new Jf;activeGauge=new oA0;stateStore;previewUrlPattern;kubeConfig;capacityProbe;portForward;namespace;sandboxTemplateName;envName;tokenGenerator;idleTtlMs;metrics;previewGateway;sentinelToken;mintCloneUrl;mintPoolCloneUrl;mintOrgFsConfig;forwardPort;daemonAddress;persistCredentials;tenantPools;tenantPoolRefreshMs;templateProbes={};closed=!1;claimWatchAbort=new AbortController;constructor($={}){this.stateStore=$.stateStore??null,this.previewUrlPattern=$.previewUrlPattern??null,this.kubeConfig=$.kubeConfig??yc4(),this.portForward=new a61(this.kubeConfig),this.namespace=$.namespace??qc4,this.sandboxTemplateName=$.sandboxTemplateName??Mc4,this.envName=cc4($.envName),this.tokenGenerator=$.tokenGenerator??(()=>Tc4(Vc4).toString("hex")),this.idleTtlMs=$.idleTtlMs??Sc4,this.metrics=$.meter?fc4($.meter):null,this.previewGateway=$.previewGateway&&$.previewUrlPattern?{...$.previewGateway}:null;let Z=$.sentinelToken?.trim()??"";this.sentinelToken=Z.length>0?Z:null,this.mintCloneUrl=$.mintCloneUrl,this.mintPoolCloneUrl=$.mintPoolCloneUrl,this.mintOrgFsConfig=$.mintOrgFsConfig,this.forwardPort=$.forwardPort,this.daemonAddress=$.daemonAddress??"forward",this.persistCredentials=$.persistCredentials??!0;let Q=$.tenantPools;if(this.tenantPools=this.sentinelToken===null?null:new q51(typeof Q==="function"?Q:()=>Q??[]),this.sentinelToken===null&&(typeof Q==="function"||(Q?.length??0)>0))console.warn(`[${T6}] tenant pools configured without a sentinel token \u2014 ignoring them (warm-pool mode is off)`);this.tenantPoolRefreshMs=$.tenantPoolRefreshMs??_c4,this.startClaimReaper(),this.startCredentialRefresher(),this.startTenantPoolReconciler()}startClaimReaper(){let $=["app.kubernetes.io/managed-by=studio","app.kubernetes.io/name=studio-sandbox",...this.envName?[`${fX.env}=${this.envName}`]:[]].join(",");TA$({kc:this.kubeConfig,namespace:this.namespace,labelSelector:$,signal:this.claimWatchAbort.signal,onDelete:(Z)=>this.invalidateRecord(Z)})}async ensure($,Z={}){let Q=F3($);if(Q.startsWith("s-"))throw Error(`ensure: projectRef has no slug source: ${$.projectRef}`);return this.inflight.run(Q,()=>rA0(this.stateStore,$,(Y)=>this.ensureLocked($,Q,Z,Y)))}async delete($){let Z=await this.getRecord($);if(this.records.delete($),Z)this.dropRecord(Z);if(await this.deleteHttpRouteIfManaged($).catch((Q)=>{console.warn(`[${T6}] HTTPRoute delete failed for ${$}: ${Q instanceof Error?Q.message:String(Q)}`)}),await CA(this.kubeConfig,this.namespace,$),this.stateStore)if(Z)await this.stateStore.delete(Z.id);else await this.stateStore.deleteByHandle($)}lastTermination($){return qL$(this.kubeConfig,this.namespace,fX.sandboxHandle,$,dZ.MAIN_CONTAINER_NAME)}async alive($){return await BD(this.kubeConfig,this.namespace,$)!==void 0}watchClaimLifecycle($,Z){return PA$({kc:this.kubeConfig,namespace:this.namespace,claimName:$,signal:Z})}hasSchedulableCapacity(){return this.capacityProbe??=fL$(this.kubeConfig,this.namespace),this.capacityProbe()}async getPreviewUrl($){let Z=await this.getRecord($);if(!Z)return null;return this.composePreviewUrl(Z)}async proxyDaemonRequest($,Z,Q){let Y=await this.getRecord($);if(!Y&&this.previewUrlPattern&&this.stateStore){let K=await this.stateStore.getByHandle($),H=K?.state,F=H?.token;if(K&&F){let N=`http://${H?.adoptedSandboxName??$}.${this.namespace}.svc.cluster.local:${SU}`;try{let B=await tA0(N,F,Z,Q);if(B.status!==404)return B;try{await B.body?.cancel()}catch{}}catch{}}}if(!Y)Y=await this.resurrectByHandle($);if(!Y)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let X=Y,J=performance.now(),G=0,W=(K)=>{return X=K,{url:K.daemonUrl,token:K.token}};try{let K=await Cm(W(Y),Z,Q,{unauthorized:async()=>{this.invalidateRecord($);let H=await this.getRecord($).catch(()=>null)??await this.resurrectByHandle($).catch(()=>null);return H?W(H):null},unreachable:async()=>{this.invalidateRecord($);let H=await this.resurrectByHandle($)??await this.getRecord($).catch(()=>null);return H?W(H):null}});return G=K.status,K}finally{this.recordProxyDuration("daemon",G,X,performance.now()-J)}}async adoptLiveClaim($,Z){if(this.records.has(Z))return!0;let Q=await BD(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!Q||Q.metadata?.deletionTimestamp)return!1;return await this.inflight.run(Z,async()=>{let X=this.records.get(Z);if(X)return this.toSandbox(X);let J=await this.adopt($,Z,Q);if(!J)throw Error(`cannot adopt live claim ${Z}`);return rA0(this.stateStore,$,(G)=>this.finish(J,G,!0,!0,"adopt"))}).catch(()=>null)!=null}async resolvePreviewUpstreamUrl($){if(this.previewUrlPattern)return`http://${await this.resolveServiceNameForHandle($)}.${this.namespace}.svc.cluster.local:${SU}`;let Z=await this.getRecord($);if(Z)return Z.daemonUrl;let Q=await this.resurrectByHandle($);return Q?Q.daemonUrl:null}async daemonEndpoint($){let Z=await this.getRecord($)??await this.resurrectByHandle($);if(!Z)return null;return{url:this.daemonAddress==="service"?`http://${Z.adoptedSandboxName}.${this.namespace}.svc.cluster.local:${SU}`:Z.daemonUrl,token:Z.token}}listSandboxes(){return[...this.records.values()].map(($)=>{let Z=$.ensureOpts,Q=Z?.tenant;return{handle:$.handle,tenant:Q?{orgId:Q.orgId,userId:Q.userId}:null,repos:[Z?.repo,...Z?.extraRepos??[]].filter((Y)=>Y!==void 0).map(vA$).filter((Y)=>Y!==null),orgFs:Boolean(Z?.orgFsConfigJson)||$.orgFsRedacted===!0}})}async resolveServiceNameForHandle($){let Z=this.records.get($);if(Z)return Z.adoptedSandboxName;if(this.stateStore){let Y=(await this.stateStore.getByHandle($).catch(()=>null))?.state?.adoptedSandboxName;if(Y)return Y}return $}async proxyPreviewRequest($,Z){let Q=performance.now(),Y=this.records.get($)??null,X=0;try{let J=await vm(Z,{base:()=>this.resolvePreviewUpstreamUrl($),invalidate:()=>this.invalidateRecord($),retryBase:async()=>{return await this.resurrectByHandle($).catch(()=>null)?this.resolvePreviewUpstreamUrl($):null}},T6);return X=J.status,J}finally{this.recordProxyDuration("preview",X,Y,performance.now()-Q,$)}}async ensureLocked($,Z,Q,Y){if(Q.image)console.warn(`[${T6}] opts.image ignored (template ${this.sandboxTemplateName} pins image): got ${Q.image}`);if(Y){let G=await Y.get($);if(G){let W=await this.rehydrate($,Z,G);if(W)return await this.refreshDaemonGitCredential(W,Q),await this.relayOrgFsConfig(W.daemonUrl,W.token,Q.orgFsConfigJson),this.finish(W,Y,!1,!0,"resume");await Y.delete($)}}let X=await BD(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(X)if(X.metadata?.deletionTimestamp)await n00(this.kubeConfig,this.namespace,Z).catch((G)=>{console.warn(`[${T6}] wait for terminating claim ${Z} failed: ${G instanceof Error?G.message:String(G)}`)});else if(!M51(X)){let G=await this.join($,Z,Q,X).catch((W)=>{return console.warn(`[${T6}] join of starting claim ${Z} failed, recreating: ${W instanceof Error?W.message:String(W)}`),null});if(G)return this.finish(G,Y,!0,!0,"adopt");await CA(this.kubeConfig,this.namespace,Z).catch(()=>{}),await n00(this.kubeConfig,this.namespace,Z).catch((W)=>{console.warn(`[${T6}] wait for deleted claim ${Z} failed: ${W instanceof Error?W.message:String(W)}`)})}else{let G=await this.adopt($,Z,X).catch((W)=>{return console.warn(`[${T6}] adopt ${Z} failed, recreating: ${W instanceof Error?W.message:String(W)}`),null});if(G)return await this.refreshDaemonGitCredential(G,Q),await this.relayOrgFsConfig(G.daemonUrl,G.token,Q.orgFsConfigJson),this.finish(G,Y,!0,!0,"adopt");await CA(this.kubeConfig,this.namespace,Z).catch(()=>{}),await n00(this.kubeConfig,this.namespace,Z).catch((W)=>{console.warn(`[${T6}] wait for deleted claim ${Z} failed: ${W instanceof Error?W.message:String(W)}`)})}let J=await this.provision($,Z,Q);return this.finish(J,Y,!0,!1,"fresh")}async finish($,Z,Q,Y,X){let J=this.records.get($.handle),G=J!==void 0;if(J&&J.daemonForward!==$.daemonForward)this.closeForwarder(J.daemonForward);if(this.records.set($.handle,$),Q)await this.persist(Z,$);if(Y)await VH0(this.kubeConfig,this.namespace,$.handle,this.computeShutdownTime()).catch((W)=>console.warn(`[${T6}] TTL refresh failed for ${$.handle}: ${W instanceof Error?W.message:String(W)}`));if(this.metrics){let W=k51($.tenant);if(this.metrics.ensureOutcome.add(1,{...W,outcome:X}),!G)this.metrics.active.add(1,W),this.activeGauge.markCounted($.handle)}return this.toSandbox($)}buildEnvMap($,Z){let Q={},Y=[];for(let[X,J]of Object.entries($.env??{}))if(kc4.has(X))Y.push(X);else Q[X]=J;if(Y.length>0)console.warn(`[${T6}] opts.env keys overlap reserved bootstrap names and were dropped: ${Y.join(",")}`);return{...Q,DAEMON_TOKEN:Z.token,DAEMON_BOOT_ID:Z.daemonBootId,APP_ROOT:Z.workdir,PROXY_PORT:String(SU)}}async resolveTemplateName($,Z,Q){let{name:Y,probes:X}=await T51({purpose:$,tenantPool:Z,...Q?{sandboxImage:Q}:{},templateName:this.sandboxTemplateName,probes:this.templateProbes,now:Date.now(),ttlMs:Ic4,exists:(J)=>PL$(this.kubeConfig,this.namespace,J),onAbsent:(J)=>console.warn(`[${T6}] SandboxTemplate ${J} not found (or not readable) \u2014 this claim falls back to a template without that suffix. Upgrade the sandbox-env chart to the version that renders it.`)});return this.templateProbes=X,Y}buildClaim($,Z,Q,Y,X){let J=this.sentinelToken!==null,G=J?[]:Object.entries(this.buildEnvMap(Z,Q)).sort(([H],[F])=>H<F?-1:H>F?1:0).map(([H,F])=>({name:H,value:F})),W=ic4(Z),K=Object.keys(W).length>0;return{apiVersion:`${dZ.CLAIM_API_GROUP}/${dZ.CLAIM_API_VERSION}`,kind:"SandboxClaim",metadata:{name:$,namespace:this.namespace,labels:{"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[fX.env]:this.envName}:{},...V51(Z.tenant)},...K?{annotations:W}:{}},spec:{sandboxTemplateRef:{name:X},additionalPodMetadata:{labels:V51(Z.tenant,{[fX.role]:"claimed",[fX.sandboxHandle]:$,...this.envName?{[fX.env]:this.envName}:{}}),...K?{annotations:W}:{}},env:G,warmpool:SA$(Y,J,X),lifecycle:{shutdownPolicy:"Delete",shutdownTime:this.computeShutdownTime()}}}}async provision($,Z,Q){let Y=this.tokenGenerator(),X=gA$(),J=YT0,G=this.claimTenantPoolBinding(Q),W=this.buildClaim(Z,Q,{token:Y,daemonBootId:X,workdir:J},G,await this.resolveTemplateName(Q.purpose,G!==null,Q.sandboxImage));try{await E41(this.kubeConfig,this.namespace,W)}catch(K){if(K instanceof m00)await n00(this.kubeConfig,this.namespace,Z),await E41(this.kubeConfig,this.namespace,W);else throw K}return this.bind($,Z,Q,G,{token:Y,daemonBootId:X,workdir:J})}claimTenantPoolBinding($){return this.tenantPools?.resolve({tenant:$T0($),image:$.sandboxImage??"default",cloneUrl:$.repo?.cloneUrl,branch:$.repo?.branch})??null}async bind($,Z,Q,Y,{token:X,daemonBootId:J,workdir:G}){let W;try{W=await AL$(this.kubeConfig,this.namespace,Z),await AA$((B)=>this.watchClaimLifecycle(Z,B))}catch(B){throw await CA(this.kubeConfig,this.namespace,Z).catch(()=>{}),B}try{await this.ensureServicePortForAdoptedSandbox(W),await this.ensureHttpRouteForHandle(Z,W,Q.tenant??null)}catch(B){throw await CA(this.kubeConfig,this.namespace,Z).catch(()=>{}),B}let K=await this.openForwarder(W,SU,Z),H=`http://127.0.0.1:${K.localPort}`,F=Y?.repo!=null&&W!==Z,U=this.workloadConfigPayload(Q,F),N=J;try{if(await j51(H),this.sentinelToken!==null){let B=await nA0(H);if(B)N=B.bootId;try{await VU(H,this.sentinelToken,U??{},{rotateToken:X})}catch(O){if(O instanceof EH&&O.status===401)console.warn(`[${T6}] sentinel rejected by adopted pod (handle=${Z}, sandbox=${W}): pod belongs to another claim; tearing down and reprovisioning`);throw O}}else if(U)await VU(H,X,U);await this.relayOrgFsConfig(H,X,Q.orgFsConfigJson)}catch(B){throw this.closeForwarder(K),await this.deleteHttpRouteIfManaged(Z).catch(()=>{}),await CA(this.kubeConfig,this.namespace,Z).catch(()=>{}),B}return{id:$,handle:Z,adoptedSandboxName:W,token:X,workdir:G,daemonUrl:H,daemonForward:K,workload:Q.workload??null,daemonBootId:N,tenant:Q.tenant??null,tenantPoolPodBound:F,ensureOpts:sc4(Q)}}workloadConfigPayload($,Z){return Vm({runtime:$?.workload?.runtime??"node",packageManager:$?.workload?.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:$?.repo??null,extraRepos:$?.extraRepos??[],port:$?.workload?.devPort??uA$,tenant:$?.tenant??void 0,...$?{cloneOnly:$.cloneOnly===!0&&!Z}:{}})}async relayOrgFsConfig($,Z,Q){if(!Q)return;await N10($,Z,Q).catch((Y)=>console.warn("[org-fs] sidecar config relay failed",Y))}async refreshDaemonGitCredential($,Z){let Q=D10(Z);if(!Q)return;try{await VU($.daemonUrl,$.token,Q)}catch(Y){console.warn(`[${T6}] git credential refresh failed for ${$.handle}: ${Y instanceof Error?Y.message:String(Y)}`)}}async withFreshCloneUrl($,Z={}){if(!this.mintCloneUrl)return $;try{let Q=await this.mintCloneUrl($,Z);if(!Q)return $;let{credentialExpiresAt:Y,...X}=$;return{...X,cloneUrl:Q}}catch(Q){return console.warn(`[${T6}] clone credential re-mint failed: ${Q instanceof Error?Q.message:String(Q)}`),$}}async withFreshCredentials($,Z=!1){return{...$,...$.repo?{repo:await this.withFreshCloneUrl($.repo,{tenant:$.tenant})}:{},...$.orgFsConfigJson||Z?{orgFsConfigJson:await oc4($,this.mintOrgFsConfig)}:{}}}startCredentialRefresher(){if(!this.mintCloneUrl)return;let{signal:$}=this.claimWatchAbort;(async()=>{while(!$.aborted){if(await z$(vc4,{signal:$}).catch(()=>{}),$.aborted)break;try{await this.refreshAllGitCredentials()}catch(Z){console.warn(`[${T6}] periodic credential refresh failed: ${Z instanceof Error?Z.message:String(Z)}`)}}})()}startTenantPoolReconciler(){let $=this.tenantPools;if(!$)return;let{signal:Z}=this.claimWatchAbort;(async()=>{while(!Z.aborted){try{await this.reconcileTenantPools($)}catch(Q){console.warn(`[${T6}] tenant pool reconcile failed: ${Q instanceof Error?Q.message:String(Q)}`)}await z$(Cc4,{signal:Z}).catch(()=>{})}})()}listTenantPools(){return this.tenantPools?.pools()??[]}markTenantPoolsDirty($,Z){return Promise.resolve(this.tenantPools?.markDirty($,Z)??[])}async reconcileTenantPools($){let Z=Sm($.pools());for(let Q of $.retain(Z))this.recordPoolGone(Q);for(let Q of Z){let Y=Q.warmPoolName,X=await TL$(this.kubeConfig,this.namespace,Y);if(X===null){console.warn(`[${T6}] tenant pool ${Y}: no SandboxWarmPool (or no selector yet) in ${this.namespace}`);continue}let J=$.takeDirty(Y),G=X.filter((W)=>!W.labels[fX.sandboxHandle]);$.retainPods(Y,new Set(X.map((W)=>W.uid)));for(let W of G){if(this.claimWatchAbort.signal.aborted)return;await this.warmPoolPod($,Q,W,J)}this.recordPoolDepth($,Q,X,G)}}recordPoolGone($){let Z=cA$($);for(let Q of["ready","bound","pending","failed"])this.metrics?.poolPods.record(0,{...Z,state:Q})}recordPoolDepth($,Z,Q,Y){let X=this.metrics?.poolPods;if(!X)return;let J=0,G=0;for(let K of Y){let H=$.pod(K.uid);if(!H)continue;if(H.failures>=XT0)G++;else if(H.lastConfigAt>0)J++}let W=cA$(Z);X.record(J,{...W,state:"ready"}),X.record(Q.length-Y.length,{...W,state:"bound"}),X.record(Y.length-J-G,{...W,state:"pending"}),X.record(G,{...W,state:"failed"})}async warmPoolPod($,Z,Q,Y){let X=Z.warmPoolName,{workload:J}=Z.repo,G=$.pod(Q.uid);if(G&&G.failures>=XT0){if(Date.now()-G.lastFailureAt<lA$)return;$.setPod(Q.uid,{...G,failures:0})}let W=Y||G!==void 0&&Date.now()-G.lastConfigAt>=this.tenantPoolRefreshMs;if(G&&!W)return;let K=await this.allocationCloneUrl(Z);if(!K){this.recordPoolFailure($,Q,X,"clone credential mint failed");return}let H={cloneUrl:K,branch:Z.repo.branch,userName:"",userEmail:""},F=await this.openForwarder(Q.name,SU,Q.name).catch(()=>null);if(!F){this.recordPoolFailure($,Q,X,"port-forward failed");return}let U=`http://127.0.0.1:${F.localPort}`;try{await j51(U);let N=this.sentinelToken;if(!N)return;if(!await this.isPoolPodUnbound(Q))return;let B=Vm({runtime:J.runtime,packageManager:J.packageManager?{name:J.packageManager,...J.packageManagerPath?{path:J.packageManagerPath}:{}}:null,repo:H,port:J.devPort??uA$})??{},{transition:O}=await VU(U,N,B);if(W&&O!=="bootstrap"&&await this.isPoolPodUnbound(Q))await BA$(U,N,"clone");$.setPod(Q.uid,{pool:X,lastConfigAt:Date.now(),lastFailureAt:0,failures:0}),console.log(`[${T6}] tenant pool ${X}: warmed ${Q.name} (${O})`)}catch(N){this.recordPoolFailure($,Q,X,N instanceof Error?N.message:String(N))}finally{this.closeForwarder(F)}}async allocationCloneUrl({pool:$,repo:Z}){if(!this.mintPoolCloneUrl)return`${Z.repoUrl}.git`;try{return await this.mintPoolCloneUrl({tenant:$.tenant,repoUrl:Z.repoUrl,branch:Z.branch})}catch(Q){return console.warn(`[${T6}] tenant pool clone credential mint failed: ${Q instanceof Error?Q.message:String(Q)}`),null}}isPoolPodUnbound($){return RL$(this.kubeConfig,this.namespace,$.name,fX.sandboxHandle)}recordPoolFailure($,Z,Q,Y){let X=$.pod(Z.uid),J=(X?.failures??0)+1;$.setPod(Z.uid,{pool:Q,lastConfigAt:X?.lastConfigAt??0,lastFailureAt:Date.now(),failures:J});let G=J>=XT0?` \u2014 backing off ${lA$/60000}min`:"";console.warn(`[${T6}] tenant pool ${Q}: warming ${Z.name} failed (${J}/${XT0})${G}: ${Y}`)}async refreshAllGitCredentials(){await _A$(this.records.values(),($)=>$.ensureOpts?.repo?.connectionId,async($)=>{if(this.claimWatchAbort.signal.aborted)return;let Z=$.ensureOpts?.repo;if(!Z)return;try{let Q=await this.withFreshCloneUrl(Z,{bufferMs:bc4,tenant:$.ensureOpts?.tenant});await this.refreshDaemonGitCredential($,{...$.ensureOpts,repo:Q}),$.ensureOpts={...$.ensureOpts,repo:Q}}catch(Q){throw console.warn(`[${T6}] git credential refresh failed for ${$.handle}: ${Q instanceof Error?Q.message:String(Q)}`),Q}})}async rebootstrapDaemon($,Z,Q){if(this.sentinelToken===null)return!1;let Y=this.workloadConfigPayload(Q,!1)??{};try{return await VU($,this.sentinelToken,Y,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,Q?.orgFsConfigJson),!0}catch(X){if(X instanceof EH&&X.status===401)try{return await VU($,Z,Y,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,Q?.orgFsConfigJson),!0}catch(J){return console.warn(`[${T6}] re-bootstrap retry with claim token failed: ${J instanceof Error?J.message:String(J)}`),!1}return console.warn(`[${T6}] re-bootstrap failed: ${X instanceof Error?X.message:String(X)}`),!1}}async ensureServicePortForAdoptedSandbox($){if(!this.previewGateway||!this.previewUrlPattern)return;await vL$(this.kubeConfig,this.namespace,$,{name:"daemon",port:SU,targetPort:SU})}async ensureHttpRouteForHandle($,Z,Q){if(!this.previewGateway||!this.previewUrlPattern)return;let Y=ac4(this.previewUrlPattern,$);if(!Y)throw new vY(`Unable to derive preview hostname for ${$} from pattern: ${this.previewUrlPattern}`);let X={apiVersion:`${P41.API_GROUP}/${P41.API_VERSION}`,kind:"HTTPRoute",metadata:{name:$,namespace:this.namespace,labels:V51(Q??void 0,{[fX.role]:"claimed",[fX.sandboxHandle]:$,"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[fX.env]:this.envName}:{}})},spec:{parentRefs:[{kind:"Gateway",group:"gateway.networking.k8s.io",name:this.previewGateway.name,namespace:this.previewGateway.namespace}],hostnames:[Y],rules:[{backendRefs:[{group:"",kind:"Service",name:Z,port:SU}]}]}};await SL$(this.kubeConfig,this.namespace,X)}async deleteHttpRouteIfManaged($){if(!this.previewGateway)return;await CL$(this.kubeConfig,this.namespace,$)}async rehydrate($,Z,Q){let Y=Q.state;if(!Y.adoptedSandboxName&&!Y.podName||!Y.token)return null;let X=await BD(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!X||!M51(X))return null;let J=X.status?.sandbox?.name??Y.adoptedSandboxName??Y.podName??Z,G=await this.openAndProbeDaemon(J,Z);if(!G)return null;if(Y.daemonBootId&&Y.daemonBootId!==G.bootId){if(this.sentinelToken!==null){let W=Y.ensureOpts?await this.withFreshCredentials(Y.ensureOpts,Y.orgFsRedacted===!0):null;if(!await this.rebootstrapDaemon(G.daemonUrl,Y.token,W))return this.closeForwarder(G.daemonForward),null}else console.warn(`[${T6}] daemon restart detected (handle=${Z}): stored bootId=${Y.daemonBootId} live bootId=${G.bootId}`);await this.stateStore?.put($,{handle:Z,state:{...Y,daemonBootId:G.bootId}}).catch((W)=>console.warn(`[${T6}] bootId persist failed for ${Z}: ${W instanceof Error?W.message:String(W)}`))}return{id:$,handle:Z,adoptedSandboxName:J,tenantPoolPodBound:!1,token:Y.token,workdir:Y.workdir??YT0,daemonUrl:G.daemonUrl,daemonForward:G.daemonForward,workload:Y.workload??null,daemonBootId:G.bootId,tenant:Y.tenant??null,ensureOpts:Y.ensureOpts??null,orgFsRedacted:Y.orgFsRedacted===!0}}join($,Z,Q,Y){let X=this.sentinelToken!==null,J=X?this.tokenGenerator():I51(Y,"DAEMON_TOKEN"),G=X?gA$():I51(Y,"DAEMON_BOOT_ID");if(!J||!G)throw new vY(`claim ${Z} carries no daemon token`);return this.bind($,Z,Q,this.claimTenantPoolBinding(Q),{token:J,daemonBootId:G,workdir:YT0})}async adopt($,Z,Q){if(!M51(Q))return null;let Y=Q.status?.sandbox?.name??Z;if(this.sentinelToken!==null)return null;let X=I51(Q,"DAEMON_TOKEN");if(!X)return null;let J=await this.openAndProbeDaemon(Y,Z);if(!J)return null;let G=pc4(Q);if(this.previewGateway)await this.ensureServicePortForAdoptedSandbox(Y).catch((W)=>{console.warn(`[${T6}] Service port backfill failed for ${Z}: ${W instanceof Error?W.message:String(W)}`)}),await this.ensureHttpRouteForHandle(Z,Y,G).catch((W)=>{console.warn(`[${T6}] HTTPRoute backfill failed for ${Z}: ${W instanceof Error?W.message:String(W)}`)});return{id:$,handle:Z,adoptedSandboxName:Y,tenantPoolPodBound:!1,token:X,workdir:YT0,daemonUrl:J.daemonUrl,daemonForward:J.daemonForward,workload:null,daemonBootId:J.bootId,tenant:G,ensureOpts:null}}async openAndProbeDaemon($,Z){let Q=await this.openForwarder($,SU,Z).catch(()=>null);if(!Q)return null;let Y=`http://127.0.0.1:${Q.localPort}`,X=await nA0(Y);if(!X)return this.closeForwarder(Q),null;return{daemonForward:Q,daemonUrl:Y,bootId:X.bootId}}async getRecord($){let Z=this.records.get($);if(Z)return Z;if(!this.stateStore)return null;let Q=await this.stateStore.getByHandle($);if(!Q)return null;let Y=await this.rehydrate(Q.id,$,Q);if(Y)this.records.set($,Y);return Y}async resurrectByHandle($){if(!this.stateStore)return null;let Z=await this.stateStore.getByHandle($);if(!Z)return null;let Q=Z.state,Y=Q.ensureOpts;if(!Y)return null;let X=await this.withFreshCredentials(Y,Q.orgFsRedacted===!0);if(F3(Z.id)!==$)return null;return await this.ensure(Z.id,X),this.records.get($)??null}invalidateRecord($){let Z=this.records.get($);if(!Z)return;this.records.delete($),this.dropRecord(Z)}dropRecord($){if(this.closeForwarder($.daemonForward),this.metrics&&this.activeGauge.consume($.handle))this.metrics.active.add(-1,k51($.tenant))}recordProxyDuration($,Z,Q,Y,X){if(!this.metrics)return;this.metrics.proxyDurationMs.record(Y,{...k51(Q?.tenant??null),source:$,sandbox_handle:Q?.handle??X??"",status_code:Z||0})}composePreviewUrl($){if(this.previewUrlPattern)return sA0(this.previewUrlPattern,$.handle);return`http://127.0.0.1:${$.daemonForward.localPort}/`}toSandbox($){return{handle:$.handle,workdir:$.workdir,previewUrl:this.composePreviewUrl($),warmPoolAdopted:$.tenantPoolPodBound===!0,provider:"kubernetes"}}async persist($,Z){if(!$)return;let Q={adoptedSandboxName:Z.adoptedSandboxName,token:Z.token,workdir:Z.workdir,workload:Z.workload,daemonBootId:Z.daemonBootId,tenant:Z.tenant,...Z.ensureOpts?this.persistCredentials?{ensureOpts:Z.ensureOpts}:rc4(Z.ensureOpts,Z.orgFsRedacted===!0):{}};await $.put(Z.id,{handle:Z.handle,state:Q})}computeShutdownTime(){return new Date(Date.now()+this.idleTtlMs).toISOString()}async releaseAfter($,Z){let Q=await BD(this.kubeConfig,this.namespace,$);if(!Q)return;let Y=nc4(Q.spec?.lifecycle?.shutdownTime,new Date(Date.now()+Z));if(!Y)return;await VH0(this.kubeConfig,this.namespace,$,Y).catch((X)=>console.warn(`[${T6}] release failed for ${$}: ${X instanceof Error?X.message:String(X)}`))}async renewTtl($){let Z=await BD(this.kubeConfig,this.namespace,$);if(!Z)return;let Q=tc4(Z.spec?.lifecycle?.shutdownTime,new Date(Date.now()+this.idleTtlMs));if(!Q)return;await VH0(this.kubeConfig,this.namespace,$,Q).catch((Y)=>console.warn(`[${T6}] TTL renew failed for ${$}: ${Y instanceof Error?Y.message:String(Y)}`))}openForwarder($,Z,Q=$){if(this.forwardPort)return this.forwardPort($,Z,Q);let Y=gc4(Q,Z);return new Promise((X,J)=>{let G=(W,K)=>{let H=iA$.createServer((F)=>this.handleForwardedConnection(F,$,Z,Q));H.once("error",(F)=>{if(F.code==="EADDRINUSE"&&K<xc4){try{H.close()}catch{}let U=S51+(W-S51+1)%pA$;G(U,K+1);return}J(F)}),H.listen(W,"127.0.0.1",()=>{let F=H.address();if(!F||typeof F==="string"){H.close(),J(Error("port-forward listener failed to bind"));return}let U=F.port;X({localPort:U,close:()=>H.close((N)=>{if(N)console.warn(`[${T6}] port-forward close on :${U} errored: ${N.message}`)})})})};G(Y,0)})}handleForwardedConnection($,Z,Q,Y){let X=new Rc4,J=null,G=!1,W=()=>{if(G)return;if(G=!0,X.destroy(),J)try{J.close()}catch{}if(!$.destroyed)$.destroy()};$.pipe(X),$.on("error",W),$.on("close",W),this.portForward.portForward(this.namespace,Z,[Q],$,null,X).then((K)=>{let H=typeof K==="function"?K():K;if(!H){W();return}if(J=H,J.on("close",W),J.on("error",(F)=>{console.warn(`[${T6}] port-forward to ${Z}:${Q} dropped mid-connection: ${hA$(F)}`,JSON.stringify(C51(F))),this.invalidateRecord(Y),W()}),G)try{J.close()}catch{}}).catch((K)=>{console.warn(`[${T6}] port-forward to ${Z}:${Q} failed: ${hA$(K)}`,JSON.stringify(C51(K))),this.invalidateRecord(Y),W()})}closeForwarder($){$.close()}close(){if(this.closed)return;this.closed=!0,this.claimWatchAbort.abort();for(let $ of this.records.values())this.dropRecord($);this.records.clear()}}function fc4($){return{active:$.createUpDownCounter("studio.sandbox.active",{description:"Active sandbox count, by runner kind, owning org, and daemon impl. Cross-checks the cAdvisor-derived count from the cluster \u2014 divergence between the two indicates orphaned claims (studio deleted but K8s didn't reap) or unattributed pods.",unit:"{sandbox}"}),ensureOutcome:$.createCounter("studio.sandbox.ensure.outcome",{description:"Outcome of each ensure() call: fresh provision, resume from state-store after restart, or adopt of a cluster-side claim studio didn't know about. Cold-start ratio is the primary input for warm-pool sizing.",unit:"{call}"}),proxyDurationMs:$.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of studio-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"}),poolPods:$.createGauge("studio.sandbox.pool.pods",{description:"Tenant warm pool depth by pool and state: ready (warmed and unbound \u2014 what a claim can actually bind instantly), bound (serving a user), pending (unbound, not yet warmed), failed (gave up after repeated bootstrap failures). Alert on sustained ready=0: a pool that is always empty is doing nothing while costing N pods.",unit:"{pod}"})}}function C51($){let Z=[],Q=$;for(let Y=0;Y<5&&Q instanceof Error;Y++){let X=Q;if(Z.push({name:X.name,message:X.message,...X.code!==void 0?{code:X.code}:{},...X.errno!==void 0?{errno:X.errno}:{}}),X.cause===Q)break;Q=X.cause}if(Q!==void 0&&!(Q instanceof Error)&&Q!==null){let Y=Q,X=Y.error instanceof Error?C51(Y.error).chain:void 0;Z.push({nonError:String(Q),...typeof Y.type==="string"?{type:Y.type}:{},...typeof Y.message==="string"?{message:Y.message}:{},...Y.code!==void 0?{code:Y.code}:{},...typeof Y.reason==="string"?{reason:Y.reason}:{},...X?{error:X}:{},...X===void 0&&Y.error!==void 0?{rawError:String(Y.error)}:{},keys:Object.keys(Y)})}return{chain:Z}}function yc4(){let $=new kA0;return $.loadFromDefault(),$}function M51($){return Boolean($.status?.conditions?.some((Z)=>Z.type==="Ready"&&Z.status==="True"))}function I51($,Z){let Q=$.spec?.env;if(!Q)return null;for(let Y of Q)if(Y.name===Z&&Y.value)return Y.value;return null}function gc4($,Z){let Q=Ac4("sha256").update(`${$}:${Z}`).digest();return S51+Q.readUInt32BE(0)%pA$}function mA$($){let Z=$.slice(0,uc4);return hc4.test(Z)?Z:""}function cc4($){if($===void 0)return null;let Z=$.trim();if(Z==="")return null;if(!lc4.test(Z))throw Error(`AgentSandboxProvider: envName=${JSON.stringify(Z)} is not a valid DNS-label-safe environment name (lowercase alphanumeric or '-', starts with a letter, ends alphanumeric, \u226432 chars). Studio sets this from STUDIO_ENV; check the studio chart's configMap.`);return Z}function V51($,Z={}){let Q={...Z};if($){let Y=mA$($.orgId),X=mA$($.userId);if(Y)Q[fX.orgId]=Y;if(X)Q[fX.userId]=X}return Q}function Gf($){let Z="";for(let Q of $){let Y=Q.codePointAt(0)??0;Z+=Y<32||Y===127?" ":Q}return Z.slice(0,mc4)}function dc4($){try{let Z=new URL($);return Z.username="",Z.password="",Z.toString()}catch{return""}}function ic4($){let Z={},Q=$.tenant;if(Q?.orgSlug)Z[zH.orgSlug]=Gf(Q.orgSlug);if(Q?.orgName)Z[zH.orgName]=Gf(Q.orgName);if(Q?.userEmail)Z[zH.userEmail]=Gf(Q.userEmail);if(Q?.userName)Z[zH.userName]=Gf(Q.userName);let Y=$.repo;if(Y){if(Y.displayName)Z[zH.gitRepo]=Gf(Y.displayName);let X=dc4(Y.cloneUrl);if(X)Z[zH.gitRepoUrl]=Gf(X);let J=$.branch??Y.branch;if(J)Z[zH.gitBranch]=Gf(J)}return Z}function pc4($){let Z=$.metadata?.labels;if(!Z)return null;let Q=Z[fX.orgId],Y=Z[fX.userId];if(!Q||!Y)return null;let X=$.metadata?.annotations??{};return{orgId:Q,userId:Y,orgSlug:X[zH.orgSlug],orgName:X[zH.orgName],userEmail:X[zH.userEmail],userName:X[zH.userName]}}function nc4($,Z){if($){let Q=new Date($).getTime();if(Number.isFinite(Q)&&Q<=Z.getTime())return null}return Z.toISOString()}function tc4($,Z){if($){let Q=new Date($).getTime();if(Number.isFinite(Q)&&Q>=Z.getTime())return null}return Z.toISOString()}function k51($){return{org_id:$?.orgId??"",user_id:$?.userId??"",runner_kind:"agent-sandbox"}}async function oc4($,Z){if(!Z||!$.tenant)return $.orgFsConfigJson;try{return await Z($.tenant)??$.orgFsConfigJson}catch(Q){return console.warn(`[${T6}] org-fs credential re-mint failed: ${Q instanceof Error?Q.message:String(Q)}`),$.orgFsConfigJson}}function dA$($){try{let Z=new URL($.cloneUrl);Z.username="",Z.password="";let{submoduleCredentials:Q,credentialExpiresAt:Y,...X}=$;return{...X,cloneUrl:Z.toString()}}catch{return null}}function rc4($,Z){let{orgFsConfigJson:Q,repo:Y,extraRepos:X,...J}=$,G=J,W=Y&&dA$(Y);if(W)G.repo=W;if(X)G.extraRepos=X.map(dA$).filter((K)=>K!==null);return Q||Z?{ensureOpts:G,orgFsRedacted:!0}:{ensureOpts:G}}function sc4($){let Z={};if($.branch)Z.branch=$.branch;if($.repo)Z.repo=$.repo;if($.workload)Z.workload=$.workload;if($.env&&Object.keys($.env).length>0)Z.env=$.env;if($.tenant)Z.tenant=$.tenant;if($.cloneOnly)Z.cloneOnly=!0;if($.purpose)Z.purpose=$.purpose;if($.sandboxImage)Z.sandboxImage=$.sandboxImage;if($.orgFsConfigJson)Z.orgFsConfigJson=$.orgFsConfigJson;return Object.keys(Z).length>0?Z:null}function ac4($,Z){try{return new URL(sA0($,Z)).hostname||null}catch{return null}}var T6="AgentSandboxProvider",qc4="agent-sandbox-system",Mc4="studio-sandbox",Ic4=300000,SU=9000,uA$=3000,YT0="/app",Vc4=32,kc4,Sc4=900000,Cc4=60000,_c4=1800000,XT0=3,lA$=1800000,vc4=900000,bc4=1800000,S51=40000,pA$=1e4,xc4=256,fX,zH,hc4,uc4=63,lc4,mc4=253;var nA$=D(()=>{a$();yL$();KA$();Xf();km();kH0();d00();RA$();w10();bA$();ZT0();QT0();kc4=new Set(["DAEMON_TOKEN","DAEMON_BOOT_ID","APP_ROOT","PROXY_PORT"]);fX={role:"studio.decocms.com/role",sandboxHandle:"studio.decocms.com/sandbox-handle",orgId:"studio.decocms.com/org-id",userId:"studio.decocms.com/user-id",env:"studio.decocms.com/env"},zH={orgSlug:"studio.decocms.com/org-slug",orgName:"studio.decocms.com/org-name",userEmail:"studio.decocms.com/user-email",userName:"studio.decocms.com/user-name",gitRepo:"studio.decocms.com/git-repo",gitRepoUrl:"studio.decocms.com/git-repo-url",gitBranch:"studio.decocms.com/git-branch"},hc4=/^([A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?)?$/;lc4=/^[a-z]([a-z0-9-]{0,30}[a-z0-9])?$/});var tA$={};$6(tA$,{tenantPoolSchema:()=>MA$,tenantPoolRepoSchema:()=>L10,tenantPoolFieldsSchema:()=>P51,tenantPoolAllocations:()=>Sm,resolveTenantPoolBinding:()=>A51,renderTenantPoolWarmPools:()=>kA$,normalizeRepoUrl:()=>kU,allocationsMatchingPush:()=>R51,TenantPoolCapacityError:()=>eA0,PREVIEW_NOT_READY_HEADER:()=>_m,AgentSandboxProvider:()=>_51});var j10=D(()=>{nA$();w10()});import{z as Wf}from"zod";function JT0($){if(!$||$.trim()==="")return[];let Z=Wf.array(ec4).parse(JSON.parse($)),Q=new Set;for(let Y of Z){if(Q.has(Y.name))throw Error(`tenant pools: duplicate pool name ${Y.name}`);Q.add(Y.name)}return Z}function oA$($){let Z=kU(`https://github.com/${$.repo}`);if(!Z)throw Error(`tenant pools: bad repo ${$.repo}`);return Z}function rA$($){return $.map((Z)=>({name:Z.name,tenant:Z.orgId,size:1,image:"default",repos:[{repoUrl:oA$(Z),branch:Z.branch,workload:Z.workload,replicas:1,warmPoolName:Z.name}]}))}function v51($,Z){let Q=kU(Z.repoUrl)?.toLowerCase(),Y=$.find((J)=>J.orgId===Z.tenant&&J.branch===Z.branch&&oA$(J).toLowerCase()===Q);if(!Y)return null;let X=`https://github.com/${Y.repo}.git`;return Y.connectionId?{cloneUrl:X,connectionId:Y.connectionId}:{cloneUrl:X}}function sA$($,Z){return async(Q)=>{let Y=v51($,Q);if(!Y)return null;return Y.connectionId?Z(Y):Y.cloneUrl}}var ec4;var GT0=D(()=>{j10();ec4=Wf.object({name:Wf.string().max(63).regex(/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/,"pool name must be a DNS label (lowercase alphanumeric and '-')"),orgId:Wf.string().min(1),repo:Wf.string().regex(/^[^/\s]+\/[^/\s]+$/,"repo must be `owner/name`"),connectionId:Wf.string().min(1).optional(),branch:Wf.string().min(1).default("main"),workload:L10.shape.workload})});function g51($,Z=Date.now()){if($===void 0)return;return $===null?Z+$m4:$.getTime()}function y51($){return JSON.stringify([$.orgId,$.userId])}function aA$($,Z){let Q=kU(Z);return Q?JSON.stringify([$,Q.toLowerCase()]):null}function Qm4($,Z){return"repositoryId"in Z?$.repositoryOrgs.get(Z.repositoryId):$.connectionOrgs.get(Z.connectionId)}function eA$($){let{records:Z,now:Q}=$,Y=new Map,X=new Map,J=new Map,G=0;for(let W of $.pools)for(let{repoUrl:K,branch:H}of W.repos){let F=aA$(W.tenant,K),U=v51($.legacyPools??[],{tenant:W.tenant,repoUrl:K,branch:H});if(F&&U?.connectionId){X.set(F,{tenant:W.tenant,repoUrl:K,connectionId:U.connectionId,cloneUrl:U.cloneUrl});continue}let N=F?Z.orgRepositories.get(F):void 0;if(!F||!N){G++;continue}X.set(F,{tenant:W.tenant,repoUrl:K,repositoryId:N})}for(let W of $.sandboxes){let K=W.tenant;if(!K)continue;let H=Z.members.get(y51(K));if(H===void 0){G++;continue}for(let U of W.repos){if(Qm4(Z,U)!==K.orgId){G++;continue}let N="repositoryId"in U?{repositoryId:U.repositoryId}:{connectionId:U.connectionId,repo:U.repo.toLowerCase()},B={orgId:K.orgId,userId:K.userId};Y.set(JSON.stringify([B,N]),{tenant:B,repo:N})}let F=W.orgFsConfigExpiresAt;if(W.orgFs&&(F===null||F-Q<Zm4))J.set(y51(K),{orgId:K.orgId,userId:K.userId,orgSlug:H})}return{clones:[...Y.values()],poolClones:[...X.values()],orgFs:[...J.values()],refused:G}}async function $T$($,Z,Q){let Y=new Set,X=new Set,J=new Set,G=new Set,W=new Set(Q.map((O)=>O.tenant)),K=new Set;for(let O of Q)for(let{repoUrl:L}of O.repos){let w=IY(L);if(w)K.add(w.path.toLowerCase())}for(let O of Z){if(O.tenant)Y.add(O.tenant.orgId),X.add(O.tenant.userId);for(let L of O.repos)if("repositoryId"in L)G.add(L.repositoryId);else J.add(L.connectionId)}let[H,F,U,N]=await Promise.all([Y.size===0?[]:$.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.organizationId as orgId","member.userId as userId","organization.slug as slug"]).where("member.organizationId","in",[...Y]).where("member.userId","in",[...X]).execute(),J.size===0?[]:$.selectFrom("connections").select(["id","organization_id"]).where("id","in",[...J]).execute(),G.size===0?[]:$.selectFrom("repositories").select(["id","organization_id"]).where("id","in",[...G]).execute(),K.size===0?[]:$.selectFrom("repositories").select(["id","organization_id","provider","host","path"]).where("organization_id","in",[...W]).where((O)=>O(O.fn("lower",["path"]),"in",[...K])).execute()]),B=new Map;for(let O of N){let L=aA$(O.organization_id,Me({provider:O.provider,host:O.host,path:O.path}));if(L&&!B.has(L))B.set(L,O.id)}return{members:new Map(H.map((O)=>[y51(O),O.slug])),connectionOrgs:new Map(F.map((O)=>[O.id,O.organization_id])),repositoryOrgs:new Map(U.map((O)=>[O.id,O.organization_id])),orgRepositories:B}}function f51($){return $ instanceof Error?$.message:String($)}async function ZT$($,Z,Q){let Y=0;if($.clones.length>bm||$.poolClones.length>bm||$.orgFs.length>x51)console.warn(`[sandbox-credential-push] ${$.clones.length} clone, ${$.poolClones.length} pool clone and ${$.orgFs.length} org-fs mints planned; minting the first ${bm}, ${bm} and ${x51}`);let X=await F9($.clones.slice(0,bm),b51,async(U)=>{let N="repositoryId"in U.repo?{cloneUrl:"",repositoryId:U.repo.repositoryId}:{cloneUrl:`https://github.com/${U.repo.repo}.git`,connectionId:U.repo.connectionId};try{let B=await Z.mintCloneUrl(N,{bufferMs:WT0});return B?{tenant:U.tenant,repo:U.repo,cloneUrl:B,expiresAt:Q.now+WT0}:null}catch(B){return Y++,console.warn(`[sandbox-credential-push] clone mint failed: ${f51(B)}`),null}}),J=await F9($.poolClones.slice(0,bm),b51,async(U)=>{try{let N=await Z.mintCloneUrl("repositoryId"in U?{cloneUrl:"",repositoryId:U.repositoryId}:{cloneUrl:U.cloneUrl,connectionId:U.connectionId},{bufferMs:WT0});return N?{tenant:U.tenant,repoUrl:U.repoUrl,cloneUrl:N,expiresAt:Q.now+WT0}:null}catch(N){return Y++,console.warn(`[sandbox-credential-push] pool clone mint failed: ${f51(N)}`),null}}),G=await F9($.orgFs.slice(0,x51),b51,async(U)=>{try{let N=await Z.mintOrgFsConfig(U);return N?{tenant:{orgId:U.orgId,userId:U.userId},orgFsConfigJson:N,expiresAt:Q.now+Q.orgFsLifetimeMs}:null}catch(N){return Y++,console.warn(`[sandbox-credential-push] org-fs mint failed: ${f51(N)}`),null}}),W=X.filter((U)=>U!==null),K=J.filter((U)=>U!==null),H=G.filter((U)=>U!==null),F=[];for(let U=0;U<Math.max(W.length,K.length,H.length);U+=bj)F.push({cloneUrls:W.slice(U,U+bj),poolCloneUrls:K.slice(U,U+bj),orgFsConfigs:H.slice(U,U+bj)});return{batches:F,failed:Y}}var WT0=2700000,KT0,$m4=86400000,Zm4=86400000,b51=8,bm=2000,x51=200;var HT0=D(()=>{w41();j10();i4();a$();vj();GT0();KT0=sO$-3600000});var yX;var E10=D(()=>{yX=class yX extends Error{code;status;path;constructor($,Z,Q){super(Z.message||`Freestyle API error: ${Z.code}`);this.name="FreestyleApiError",this.code=Z.code,this.status=$,this.path=Q,Object.setPrototypeOf(this,yX.prototype)}}});function QT$(){return typeof process<"u"&&Boolean(process.versions?.node)}var FT0=($,Z)=>globalThis.fetch($,Z);async function Ym4(){if(!QT$())return null;try{return await import("undici")}catch{return null}}async function Jm4(){let $=await Ym4();if(!$)return null;let Z=new $.Agent({allowH2:!0,connections:Xm4});return(Q,Y)=>$.fetch(Q,{...Y,dispatcher:Z})}function Gm4($){return(typeof $==="string"?$:$ instanceof URL?$.href:$.url).startsWith("https:")}function YT$(){let $,Z=()=>{return $??=Jm4().then((Q)=>Q??FT0).catch(()=>FT0),$};return(Q,Y)=>Gm4(Q)?Z().then((X)=>X(Q,Y)):FT0(Q,Y)}var Xm4=4;var XT$=()=>{};function Nm4($){return new Promise((Z)=>setTimeout(Z,$))}function Bm4($){if(!$)return"";let Z=new URLSearchParams;for(let[Y,X]of Object.entries($)){if(X===void 0||X===null)continue;Z.set(Y,String(X))}let Q=Z.toString();return Q?`?${Q}`:""}function u6($){return encodeURIComponent($)}class h51{baseUrl;authenticationHeaders;fetchImpl;backgroundEligible;constructor($={}){if(this.baseUrl=($.baseUrl??Um4).replace(/\/+$/,""),!$.fetch&&!globalThis.fetch)throw Error("No fetch implementation available. Pass `fetch` in FreestyleOptions when running on a runtime without a global fetch.");if(this.fetchImpl=$.fetch??YT$(),"identityAccessToken"in $&&$.identityAccessToken){this.authenticationHeaders={[Wm4]:$.identityAccessToken},this.backgroundEligible=!1;return}if(this.backgroundEligible=!0,"stackAccessToken"in $&&$.stackAccessToken){this.authenticationHeaders={Authorization:`Bearer ${$.stackAccessToken}`,"X-Freestyle-Team-Id":$.teamId};return}let Z=$.apiKey??globalThis.process?.env?.FREESTYLE_API_KEY;if(!Z)throw Error("No Freestyle API key provided. Pass `apiKey` in FreestyleOptions or set FREESTYLE_API_KEY.");this.authenticationHeaders={Authorization:`Bearer ${Z}`}}authHeaders(){return{...this.authenticationHeaders}}url($,Z){return`${this.baseUrl}${$}${Bm4(Z)}`}async fetch($,Z={}){let Q=new Headers(Z.headers);for(let[Y,X]of Object.entries(this.authHeaders()))if(!Q.has(Y))Q.set(Y,X);return this.fetchImpl(this.absoluteUrl($),{...Z,headers:Q})}absoluteUrl($){return/^https?:\/\//i.test($)?$:`${this.baseUrl}${$}`}async request($,Z,{query:Q,body:Y,rawBody:X,signal:J}={}){let G={...this.authHeaders()};if(this.backgroundEligible)G[JT$]=String(Hm4);let W;if(X!==void 0)G["Content-Type"]="application/octet-stream",W=X;else if(Y!==void 0)G["Content-Type"]="application/json",W=JSON.stringify(Y);let K=this.url(Z,Q),H=await this.fetchImpl(K,{method:$,headers:G,body:W,signal:J});if(this.backgroundEligible&&H.status===202)try{return await this.pollBackgroundRequest(H,Z)}catch(F){if($==="GET"&&F instanceof yX&&F.code==="BACKGROUND_RESULT_UNSTORABLE"){delete G[JT$];let U=await this.fetchImpl(K,{method:$,headers:G,body:W});return this.finalize(U,Z)}throw F}return this.finalize(H,Z)}async pollBackgroundRequest($,Z){let Q=await $.json().catch(()=>({})),Y=$.headers.get(Km4)??Q.requestId,X=Q.resultUrl??(Y?`/v5/background-requests/${u6(Y)}`:void 0);if(!X)throw new yX($.status,{code:"BACKGROUND_PROTOCOL_ERROR",message:"202 Accepted carried no background request id"},Z);let J=0;for(;;){await Nm4(Fm4);let G;try{G=await this.fetch(X,{method:"GET"}),J=0}catch(W){if(++J>=5)throw W;continue}if(G.status===202)continue;return this.finalize(G,Z)}}async finalize($,Z){if(!$.ok){let Y;try{Y=await $.json()}catch{Y={code:"UNKNOWN_ERROR",message:await $.text().catch(()=>$.statusText)}}throw new yX($.status,Y,Z)}if($.status===204)return;let Q=await $.text();if(!Q)return;return JSON.parse(Q)}get($,Z){return this.request("GET",$,{query:Z})}post($,Z){return this.request("POST",$,{body:Z??{}})}patch($,Z){return this.request("PATCH",$,{body:Z??{}})}put($,Z){return this.request("PUT",$,{body:Z??{}})}putEmpty($){return this.request("PUT",$,{})}putBytes($,Z,Q,Y){return this.request("PUT",$,{query:Q,rawBody:Z,signal:Y})}async getBytes($,Z,Q={}){let Y={...this.authHeaders()};if(Q.range)Y.Range=Q.range;let X=await this.fetchImpl(this.url($,Z),{method:"GET",headers:Y,signal:Q.signal});if(!X.ok){let J;try{J=await X.json()}catch{J={code:"UNKNOWN_ERROR",message:await X.text().catch(()=>X.statusText)}}throw new yX(X.status,J,$)}return X}delete($,Z){return this.request("DELETE",$,{query:Z})}}var Wm4="x-freestyle-identity-access-token",JT$="x-freestyle-background-after-secs",Km4="x-freestyle-background-request-id",Hm4=5,Fm4=2000,Um4="https://api.freestyle.sh";var _W=D(()=>{E10();XT$()});class u51{client;verifications;certificates;placeholder;constructor($){this.client=$,this.verifications=new GT$($),this.certificates=new WT$($),this.placeholder=new KT$($)}async list(){let{domains:$}=await this.client.get("/v5/domains");return $}}class GT${client;constructor($){this.client=$}create($){return this.client.post("/v5/verifications",{domain:$})}async list($={}){let{verifications:Z}=await this.client.get("/v5/verifications",$);return Z}get($){return this.client.get(`/v5/verifications/${u6($)}`)}complete($){return this.client.putEmpty(`/v5/verifications/${u6($)}`)}delete($){return this.client.delete(`/v5/verifications/${u6($)}`)}}class WT${client;constructor($){this.client=$}async list(){let{certificates:$}=await this.client.get("/v5/certificates");return $}createWildcard($){return this.client.post("/v5/certificates/wildcard",{domain:$})}}class KT${client;constructor($){this.client=$}async get(){try{return await this.client.get("/v5/domains/placeholder")}catch($){if($ instanceof yX&&$.status===404)return null;throw $}}set($){return this.client.put("/v5/domains/placeholder",$)}delete(){return this.client.delete("/v5/domains/placeholder")}}var l51=D(()=>{_W();E10()});function a6($,Z){throw new m51($,Z)}function c51($){return Dm4.some((Z)=>$[Z]!==void 0)}function d51($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function Lm4($,Z){let Q=Z.lastIndexOf("/");if(Q<0)a6($,`${$} \`${Z}\` is not a CIDR: expected address/prefix, e.g. 203.0.113.0/24 or 2001:db8::/32`);let Y=Z.slice(0,Q),X=Z.slice(Q+1);if(!/^\d+$/.test(X))a6($,`${$} \`${Z}\`: prefix length must be a number`);let J=Number(X),G=Y.includes(":"),W=G?128:32;if(J>W)a6($,`${$} \`${Z}\`: prefix length must be 0\u2013${W}`);if(!G&&!/^\d{1,3}(\.\d{1,3}){3}$/.test(Y))a6($,`${$} \`${Z}\`: \`${Y}\` is not an IP address`)}function NT$($,Z){if(!d51($))a6(Z,`${Z} must be an object`);for(let Y of Object.keys($))if(!HT$.includes(Y))a6(`${Z}.${Y}`,`${Z} has unknown field \`${Y}\`. Expected one of: ${HT$.join(", ")}`);let Q=$;for(let Y of["vmId","vpcId","tunnelId","cidr"]){let X=Q[Y];if(X!==void 0&&(typeof X!=="string"||X.length===0))a6(`${Z}.${Y}`,`${Z}.${Y} must be a non-empty string`)}if(Q.public!==void 0&&Q.public!==!0)a6(`${Z}.public`,`${Z}.public must be true when present: it declares the public Internet. Omit the field to match something else`);if(Q.public===!0){if(Q.vmId!==void 0)a6(`${Z}.public`,`${Z} cannot combine \`public: true\` with \`vmId\`: that would mean the VM only when reached over its public address, a distinction this API does not make yet. Use \`vmId\` alone to match the VM on any path, or \`public: true\` alone to match public addresses`);if(Q.vpcId!==void 0)a6(`${Z}.public`,`${Z} cannot combine \`public: true\` with \`vpcId\`: that would mean the network's members only when reached over their public addresses, a distinction this API does not make yet. Use \`vpcId\` alone or \`public: true\` alone`);if(Q.tunnelId!==void 0)a6(`${Z}.public`,`${Z} cannot combine \`public: true\` with \`tunnelId\`: traffic through a tunnel arrives over the tunnel, not over the public Internet. Use \`tunnelId\` alone`)}if(Q.cidr!==void 0)Lm4(`${Z}.cidr`,Q.cidr);if(Q.protocol!==void 0&&!FT$.includes(Q.protocol))a6(`${Z}.protocol`,`${Z}.protocol must be one of: ${FT$.join(", ")} (got \`${String(Q.protocol)}\`)`);if(Q.port!==void 0){if(!Number.isInteger(Q.port)||Q.port<1||Q.port>65535)a6(`${Z}.port`,`${Z}.port must be an integer between 1 and 65535`);if(Q.protocol===void 0)a6(`${Z}.protocol`,`${Z}.port ${Q.port} requires ${Z}.protocol: set it to "tcp" or "udp" so the rule opens one transport rather than both`);if(!Om4.includes(Q.protocol))a6(`${Z}.port`,`${Z}.protocol "${Q.protocol}" has no ports; remove ${Z}.port ${Q.port}`)}}function OT$($,Z){if(!d51($))a6(Z||"rule",`${Z||"rule"} must be an object`);for(let Y of Object.keys($))if(!BT$.includes(Y))a6(`${Z}${Y}`,`Unknown field \`${Y}\`. Expected one of: ${BT$.join(", ")}`);let Q=$;if(Q.action===void 0)a6(`${Z}action`,`${Z}action is required. Write \`action: "allow"\` \u2014 every rule states what it does rather than defaulting to it`);if(Q.action!=="allow")a6(`${Z}action`,`${Z}action must be "allow" (got \`${String(Q.action)}\`). Only allow rules exist today`);if(Q.description!==void 0){if(typeof Q.description!=="string")a6(`${Z}description`,"description must be a string");if(Q.description.length>UT$)a6(`${Z}description`,`description is too long (${Q.description.length} characters, maximum ${UT$})`)}if(Q.source===void 0)a6(`${Z}source`,`${Z}source is required`);if(Q.destination===void 0)a6(`${Z}destination`,`${Z}destination is required`);return NT$(Q.source,`${Z}source`),NT$(Q.destination,`${Z}destination`),Q}function wm4($){let Z=OT$($,"");for(let Q of["source","destination"]){let Y=Z[Q];if(c51(Y))continue;let X=[Y.port!==void 0?`port ${Y.port}`:void 0,Y.protocol!==void 0?`protocol ${Y.protocol}`:void 0].filter(Boolean).join(", ");a6(Q,X?`${Q} only narrows traffic (${X}) without saying what it is. Add \`vmId\`, \`vpcId\`, \`tunnelId\`, \`cidr\`, or \`public: true\`. Leaving it out to mean "this VM" only works inside vms.create`:`${Q} is empty. A matcher must say what the traffic is: \`vmId\`, \`vpcId\`, \`tunnelId\`, \`cidr\`, or \`public: true\` for the public Internet`)}return Z}function UT0($,Z="VM"){if($===void 0||$===null)a6("firewall",`firewall is required on a ${Z} create. A ${Z} gets nothing implicitly, so state what it may reach \u2014 \`{ rules: [] }\` if the answer is nothing`);if(!d51($))a6("firewall","firewall must be an object with a `rules` array");for(let Y of Object.keys($))if(Y!=="rules")a6(`firewall.${Y}`,`firewall has unknown field \`${Y}\`. Expected: rules`);let Q=$.rules;if(!Array.isArray(Q))a6("firewall.rules","firewall.rules must be an array");return Q.forEach((Y,X)=>{let J=`firewall.rules[${X}].`,G=OT$(Y,J),W=c51(G.source),K=c51(G.destination);if(!W&&!K&&Z!=="network")a6(`firewall.rules[${X}]`,`firewall.rules[${X}]: both source and destination refer to the ${Z} being created, which allows nothing. Give one of them a \`vmId\`, \`vpcId\`, \`tunnelId\`, \`cidr\`, or \`public: true\``);if(W&&K)a6(`firewall.rules[${X}]`,`firewall.rules[${X}]: neither end refers to the ${Z} being created. Leave one endpoint's identity unset so it means this ${Z}, or create the rule with firewall.rules.create instead`)}),$}function DT$($){return`/v5/firewall/rules/${u6($)}`}class LT${client;constructor($){this.client=$}async create($){let Z=wm4($);return this.client.post("/v5/firewall/rules",Z)}list($={}){return this.client.get("/v5/firewall/rules",$)}get($){return this.client.get(DT$($))}delete($){return this.client.delete(DT$($))}}class i51{client;rules;constructor($){this.client=$,this.rules=new LT$($)}evaluate($){return this.client.post("/v5/firewall/evaluate",$)}}var m51,HT$,Dm4,FT$,Om4,UT$=1024,BT$;var z10=D(()=>{_W();m51=class m51 extends Error{path;constructor($,Z){super(Z);this.name="FirewallRuleValidationError",this.path=$,Object.setPrototypeOf(this,m51.prototype)}};HT$=["vmId","vpcId","tunnelId","cidr","public","port","protocol"],Dm4=["vmId","vpcId","tunnelId","cidr","public"],FT$=["tcp","udp","icmp"],Om4=["tcp","udp"];BT$=["action","source","destination","description"]});function p51($){return`/v5/identities/${u6($)}`}class wT${client;basePath;constructor($,Z){this.client=$,this.basePath=Z}create(){return this.client.post(`${this.basePath}/tokens`)}list(){return this.client.get(`${this.basePath}/tokens`)}revoke($){return this.client.delete(`${this.basePath}/tokens/${u6($)}`)}}class jT${client;basePath;constructor($,Z){this.client=$,this.basePath=Z}list(){return this.client.get(`${this.basePath}/permissions/vm`)}grant($){return this.client.post(`${this.basePath}/permissions/vm`,$)}get($){return this.client.get(`${this.basePath}/permissions/vm/${u6($)}`)}update($,Z){return this.client.patch(`${this.basePath}/permissions/vm/${u6($)}`,{allowedLinuxUsers:Z})}revoke($){return this.client.delete(`${this.basePath}/permissions/vm/${u6($)}`)}}class n51{id;tokens;permissions;client;basePath;constructor($,Z){this.client=$,this.id=Z,this.basePath=p51(Z),this.tokens=new wT$($,this.basePath),this.permissions={vm:new jT$($,this.basePath)}}data(){return this.client.get(this.basePath)}delete(){return this.client.delete(this.basePath)}}class t51{client;constructor($){this.client=$}async create($={}){let Z=await this.client.post("/v5/identities",$);return{identity:new n51(this.client,Z.id),identityId:Z.id,data:Z}}list($={}){return this.client.get("/v5/identities",$)}get($){return this.client.get(p51($))}ref($){return new n51(this.client,$)}delete($){return this.client.delete(p51($))}}var o51=D(()=>{_W()});function v1($,Z){throw new e51($,Z)}function Y7($,Z){throw new $91($,Z)}function P10($){return jm4.some((Z)=>$[Z]!==void 0)}function Mm4($){return!P10($)&&$.port===void 0}function fY($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function _T$($,Z,Q){if(typeof $!=="string"||!Am4.test($))Y7(Z,`${Z} must be a valid HTTP header name`);let Y=$.toLowerCase();if(qm4.has(Y)||Y.startsWith("x-forwarded-")||Y.startsWith("x-freestyle-")||Q&&(Y==="cookie"||Y==="set-cookie"))Y7(Z,`${Z} may not use reserved header \`${$}\``)}function Im4($,Z){if(!Array.isArray($))Y7(Z,`${Z} must be an array of header names`);if($.length>qT$)Y7(Z,`${Z} may contain at most ${qT$} names`);let Q=new Set;$.forEach((Y,X)=>{_T$(Y,`${Z}[${X}]`,!0);let J=Y.toLowerCase();if(Q.has(J))Y7(`${Z}[${X}]`,`${Z} contains duplicate header \`${Y}\``);Q.add(J)})}function IT$($){if(!fY($))Y7("forwardAuth","forwardAuth must be an object");for(let Y of Object.keys($))if(!PT$.includes(Y))Y7(Y,`Unknown field \`${Y}\`. Expected one of: ${PT$.join(", ")}`);let Z=$;if(typeof Z.url!=="string"||Z.url.length===0||Z.url.length>Tm4)Y7("url","url is required and must be an absolute HTTPS URL");let Q;try{Q=new URL(Z.url)}catch{Y7("url","url must be an absolute HTTPS URL")}if(Q.protocol!=="https:"||Q.hostname.length===0||Q.username.length>0||Q.password.length>0||Q.hash.length>0||Q.port==="0")Y7("url","url must be an absolute HTTPS URL");if(Z.headers!==void 0){if(!fY(Z.headers))Y7("headers","headers must be an object of header name to value");let Y=Object.entries(Z.headers);if(Y.length>TT$)Y7("headers",`headers may contain at most ${TT$} entries`);let X=0,J=new Set;for(let[G,W]of Y){_T$(G,`headers.${G}`,!1);let K=G.toLowerCase();if(J.has(K))Y7(`headers.${G}`,`headers contains duplicate header \`${G}\``);if(J.add(K),typeof W!=="string"||/[\0\r\n]/.test(W))Y7(`headers.${G}`,`headers.${G} must be a string`);X+=G.length+W.length}if(X>RT$)Y7("headers",`headers may contain at most ${RT$} bytes`)}if(Z.timeoutMs!==void 0&&(!Number.isInteger(Z.timeoutMs)||Z.timeoutMs<100||Z.timeoutMs>5000))Y7("timeoutMs","timeoutMs must be an integer between 100 and 5000");if(Z.protectedCookies!==void 0){if(!Array.isArray(Z.protectedCookies))Y7("protectedCookies","protectedCookies must be an array of cookie names");if(Z.protectedCookies.length>MT$)Y7("protectedCookies",`protectedCookies may contain at most ${MT$} names`);let Y=new Set;Z.protectedCookies.forEach((X,J)=>{if(typeof X!=="string"||X.length>Rm4||!Pm4.test(X))Y7(`protectedCookies[${J}]`,`protectedCookies[${J}] must be a valid HTTP cookie name`);if(Y.has(X))Y7(`protectedCookies[${J}]`,`protectedCookies contains duplicate cookie \`${X}\``);Y.add(X)})}if(Z.authResponseHeaders!==void 0)Im4(Z.authResponseHeaders,"authResponseHeaders");return Z}function Vm4($,Z){if(!fY($))v1(Z,`${Z} must be an object with an \`id\``);for(let Y of Object.keys($))if(!AT$.includes(Y))v1(`${Z}.${Y}`,`${Z} has unknown field \`${Y}\`. Expected: ${AT$.join(", ")}`);let Q=$.id;if(typeof Q!=="string"||Q.length===0)v1(`${Z}.id`,`${Z}.id is required and must be a non-empty string`)}function a51($){if(typeof $!=="string")v1("domain","domain is required and must be a string");if($==="*")return;let Z=$.startsWith("*.")?$.slice(2):$;if(Z.length===0||Z.length>Em4)v1("domain",`domain \`${$}\` is not a hostname`);let Q=Z.split(".");if(Q.length<2)v1("domain",`domain \`${$}\` must have at least two labels, e.g. acme.com`);for(let Y of Q){if(Y.length===0||Y.length>zm4)v1("domain",`domain \`${$}\` has an empty or over-long label`);if(!/^[a-z0-9-]+$/.test(Y))v1("domain",`domain \`${$}\`: labels are lowercase letters, digits, and hyphens (a \`*.\` prefix is the only wildcard)`);if(Y.startsWith("-")||Y.endsWith("-"))v1("domain",`domain \`${$}\`: a label cannot start or end with a hyphen`)}}function km4($){if(typeof $!=="string")v1("domain","domain is required and must be a string");let Z=$.lastIndexOf("@");if(Z===-1){a51($);return}let Q=$.slice(0,Z),Y=$.slice(Z+1);if(Q.length===0||Q.length>64)v1("domain",`mail route \`${$}\`: the part before \`@\` must be 1-64 characters`);if(Q.startsWith(".")||Q.endsWith(".")||Q.includes(".."))v1("domain",`mail route \`${$}\`: the part before \`@\` cannot start or end with a dot, or contain \`..\``);for(let X of Q)if(!/[a-zA-Z0-9]/.test(X)&&!VT$.includes(X))v1("domain",`mail route \`${$}\`: the part before \`@\` may use letters, digits, dots, and \`${VT$.slice(0,-1)}\` (quoted mailboxes are not supported)`);if(Y==="*")v1("domain",`mail route \`${$}\`: \`*\` is not a mail domain \u2014 name the domain the mailbox lives at`);a51(Y)}function kT$($,Z){if(!fY($))v1(Z,`${Z} must be an object`);for(let Y of Object.keys($))if(!ET$.includes(Y))v1(`${Z}.${Y}`,`${Z} has unknown field \`${Y}\`. Expected one of: ${ET$.join(", ")}`);let Q=$;for(let Y of["vmId","vpcId","host"]){let X=Q[Y];if(X!==void 0&&(typeof X!=="string"||X.length===0))v1(`${Z}.${Y}`,`${Z}.${Y} must be a non-empty string`)}if(Q.public!==void 0&&Q.public!==!0)v1(`${Z}.public`,`${Z}.public must be true when present. Omit the field to match something else`);if(Z==="source"){if(Q.host!==void 0)v1("source.host","source.host is not allowed: a source is who opens the session, not where it lands. Put `host` on the destination");if(Q.port!==void 0)v1("source.port","source.port is not allowed: a source is who opens the session, not where it lands. Put `port` on the destination");if(Q.public===!0&&(Q.vmId!==void 0||Q.vpcId!==void 0))v1("source.public","source cannot combine `public: true` with `vmId` or `vpcId`: use one alone. `public` is every client on the Internet; `vmId`/`vpcId` is a specific dialer")}else{if(Q.vpcId!==void 0)v1("destination.vpcId","destination.vpcId is not allowed: a session lands in one place, not on a whole network. Name a `vmId`, a `host`, or `public: true` for the domain's own origin. A whole network may be a source");if([Q.vmId!==void 0,Q.host!==void 0,Q.public===!0].filter(Boolean).length>1)v1("destination","destination names more than one landing: give exactly one of `vmId`, `host`, or `public: true`");if((Q.vmId!==void 0||Q.host!==void 0)&&Q.port===void 0)v1("destination.port",`destination.port is required with ${Q.vmId!==void 0?"`vmId`":"`host`"}: say which port the session lands on`)}if(Q.port!==void 0){if(!Number.isInteger(Q.port)||Q.port<1||Q.port>65535)v1(`${Z}.port`,`${Z}.port must be an integer between 1 and 65535`)}}function Sm4($){if("postgres"in $)return"postgres";if("smtp"in $)return"smtp";if("socks5"in $)return"socks5";return"http"}function Cm4($,Z){function Q(W,K,H){if(!fY(W)||Object.keys(W).some((F)=>!K.includes(F)))v1(H,`${H} must contain only ${K.join(", ")}`)}if(Q($,["region","credentials","scope"],Z),typeof $.region!=="string"||!/^[a-z0-9-]{1,63}$/.test($.region))v1(`${Z}.region`,"invalid s3.region");Q($.credentials,["accessKeyId","secretAccessKey","sessionToken"],`${Z}.credentials`);for(let W of["accessKeyId","secretAccessKey","sessionToken"]){let K=$.credentials[W];if(W==="sessionToken"&&K===void 0)continue;if(typeof K!=="string"||!/^[\x21-\x7e]{1,16384}$/.test(K))v1(`${Z}.credentials.${W}`,"invalid s3 credentials")}if(!/^[a-zA-Z0-9]+$/.test($.credentials.accessKeyId))v1(`${Z}.credentials.accessKeyId`,"invalid s3 access key id");Q($.scope,["bucket","prefix","operations"],`${Z}.scope`);let{bucket:Y,prefix:X,operations:J}=$.scope;if(typeof Y!=="string"||!/^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/.test(Y)||Y.includes(".."))v1(`${Z}.scope.bucket`,"invalid s3.scope.bucket");if(typeof X!=="string"||Buffer.byteLength(X,"utf8")>1024||/[\x00-\x1f\x7f-\x9f]/u.test(X))v1(`${Z}.scope.prefix`,"invalid s3.scope.prefix");let G=["GetObject","HeadObject","PutObject","DeleteObject","ListObjectsV2","CreateMultipartUpload","UploadPart","ListParts","CompleteMultipartUpload","AbortMultipartUpload","ListMultipartUploads"];if(!Array.isArray(J)||J.length===0||J.length>G.length||J.some((W)=>!G.includes(W))||new Set(J).size!==J.length)v1(`${Z}.scope.operations`,"s3.scope.operations must be a nonempty list of distinct supported operations")}function _m4($,Z){if(!fY($))v1(Z,`${Z} must be an object: \`{ headers: { \u2026 } }\`, \`{ postgres: { \u2026 } }\`, \`{ smtp: { \u2026 } }\` or \`{ socks5: { \u2026 } }\``);let Q=Object.keys($);if(Q.length!==1||!["headers","jsonPatch","postgres","smtp","socks5","s3"].includes(Q[0]??""))v1(Z,`${Z} must have exactly one of \`headers\`, \`jsonPatch\`, \`postgres\`, \`smtp\`, \`socks5\` or \`s3\` (got: ${Q.length===0?"nothing":Q.join(", ")})`);if(Q[0]==="s3"){Cm4($.s3,`${Z}.s3`);return}if(Q[0]==="jsonPatch"){let Y=$.jsonPatch;if(!Array.isArray(Y)||Y.length>128)v1(Z,`${Z}.jsonPatch must be an array of at most 128 operations`);let X=(W)=>typeof W==="string"&&(W===""||W.startsWith("/"))&&!/~(?:[^01]|$)/u.test(W),J=(W,K=new Set,H=0)=>{if(H>64)return!1;if(W===null||typeof W==="string"||typeof W==="boolean")return!0;if(typeof W==="number")return Number.isFinite(W);if(typeof W!=="object"||K.has(W))return!1;K.add(W);let F=(Array.isArray(W)?Array.from(W):fY(W)?Object.values(W):[void 0]).every((U)=>J(U,K,H+1));return K.delete(W),F};for(let[W,K]of Y.entries()){if(!fY(K)||!["add","remove","replace","move","copy","test"].includes(String(K.op))||!X(K.path))v1(Z,`${Z}.jsonPatch[${W}] requires a standard op and valid JSON Pointer path`);if(["move","copy"].includes(K.op)&&!X(K.from))v1(Z,`${Z}.jsonPatch[${W}].from must be a JSON Pointer`);if(["add","replace","test"].includes(K.op)&&(!Object.hasOwn(K,"value")||!J(K.value)))v1(Z,`${Z}.jsonPatch[${W}].value must be a JSON value (null is allowed)`)}let G;try{G=JSON.stringify(Y)}catch{v1(Z,"jsonPatch must be JSON serializable")}if(Buffer.byteLength(G,"utf8")>65536)v1(Z,"jsonPatch exceeds 64 KiB");return}if(Q[0]==="socks5"){let Y=$.socks5;if(!fY(Y))v1(`${Z}.socks5`,`${Z}.socks5 must be an object with \`username\` and \`password\``);for(let X of Object.keys(Y))if(!["username","password"].includes(X))v1(`${Z}.socks5.${X}`,`${Z}.socks5 has unknown field \`${X}\`. Expected: username, password`);for(let X of["username","password"])if(typeof Y[X]!=="string"||Y[X].length===0)v1(`${Z}.socks5.${X}`,`${Z}.socks5.${X} is required and must be a non-empty string`);return}if(Q[0]==="smtp"){let Y=$.smtp;if(!fY(Y))v1(`${Z}.smtp`,`${Z}.smtp must be an object with \`username\` and \`password\``);for(let X of Object.keys(Y))if(!["username","password"].includes(X))v1(`${Z}.smtp.${X}`,`${Z}.smtp has unknown field \`${X}\`. Expected: username, password`);for(let X of["username","password"])if(typeof Y[X]!=="string"||Y[X].length===0)v1(`${Z}.smtp.${X}`,`${Z}.smtp.${X} is required and must be a non-empty string`);return}if(Q[0]==="headers"){let Y=$.headers;if(!fY(Y))v1(`${Z}.headers`,`${Z}.headers must be an object of header name to value`);for(let[X,J]of Object.entries(Y))if(typeof J!=="string")v1(`${Z}.headers.${X}`,`${Z}.headers.${X} must be a string`)}else{let Y=$.postgres;if(!fY(Y))v1(`${Z}.postgres`,`${Z}.postgres must be an object with \`username\` and \`password\``);for(let J of Object.keys(Y))if(!["username","password","database"].includes(J))v1(`${Z}.postgres.${J}`,`${Z}.postgres has unknown field \`${J}\`. Expected: username, password, database`);let X=Y;for(let J of["username","password"])if(typeof X[J]!=="string"||X[J].length===0)v1(`${Z}.postgres.${J}`,`${Z}.postgres.${J} is required and must be a non-empty string`);if(X.database!==void 0&&typeof X.database!=="string")v1(`${Z}.postgres.database`,`${Z}.postgres.database must be a string`)}}function vm4($,Z){let Q=$;return Z.forEach((Y,X)=>{let J=Sm4(Y);if(Q===void 0)Q=J;else if(Q!==J)v1(`transform[${X}]`,`transform requires protocol \`${J}\` but the rule is \`${Q}\`; a rule terminates one protocol`)}),Q??"http"}function bm4($,Z){if(!fY($)||Object.keys($).some((Q)=>Q!=="method"&&Q!=="path"))v1(Z,`${Z} must be an object containing only method and path`);if($.method!==void 0&&(!Array.isArray($.method)||$.method.some((Q)=>typeof Q!=="string"||Q.length===0||/[^!#$%&'*+.^_`|~0-9A-Za-z-]/.test(Q))))v1(`${Z}.method`,`${Z}.method must be an array of HTTP method tokens`);if($.path!==void 0){let Q=$.path;if(!fY(Q)||Object.keys(Q).length!==1||typeof Q.exact!=="string"||!Q.exact.startsWith("/")||/[\s?#]/.test(Q.exact))v1(`${Z}.path`,`${Z}.path must contain exact: an absolute path without a query or fragment`)}}function vT$($,Z){if(!fY($))v1(Z||"rule",`${Z||"rule"} must be an object`);for(let H of Object.keys($))if(!ST$.includes(H))v1(`${Z}${H}`,`Unknown field \`${H}\`. Expected one of: ${ST$.join(", ")}`);let Q=$;if(Q.action===void 0)v1(`${Z}action`,`${Z}action is required. Write \`action: "allow"\` \u2014 every rule states what it does rather than defaulting to it`);if(Q.action!=="allow")v1(`${Z}action`,`${Z}action must be "allow" (got \`${String(Q.action)}\`). Only allow rules exist today`);if(Q.protocol!==void 0&&!zT$.includes(Q.protocol))v1(`${Z}protocol`,`${Z}protocol must be one of: ${zT$.join(", ")} (got \`${String(Q.protocol)}\`)`);let Y=Q.source??{},X=Q.destination??{};kT$(Y,"source"),kT$(X,"destination");let J=Q.transform??[];if(!Array.isArray(J))v1(`${Z}transform`,`${Z}transform must be an array`);J.forEach((H,F)=>_m4(H,`${Z}transform[${F}]`));let G=vm4(Q.protocol,J);if(Q.match!==void 0){if(bm4(Q.match,`${Z}match`),G!=="http"||Y.public===!0||!(X.public===!0||X.host!==void 0))v1(`${Z}match`,"match requires HTTP egress from a VM or VPC to a public origin or host")}if(J.some((H)=>("s3"in H))){if(J.length!==1||Q.match!==void 0||Y.public===!0||!(X.public===!0||X.host!==void 0)||Q.domain.includes("*"))v1(`${Z}transform`,"s3 requires a sole transform on HTTP egress to a concrete origin, without match")}let W=J.filter((H)=>("jsonPatch"in H));if(W.length>1)v1(`${Z}transform`,"a rule may carry only one jsonPatch transform");if(W.length&&(Y.public===!0||!(X.public===!0||X.host!==void 0)))v1(`${Z}transform`,"jsonPatch requires HTTP egress from a VM or VPC to a public origin or host");if(Q.forwardAuth!==void 0){Vm4(Q.forwardAuth,`${Z}forwardAuth`);let H=X.vmId!==void 0||!P10(X)&&X.port!==void 0;if(G!=="http"||Y.public!==!0||!H||Q.domain==="*")v1(`${Z}forwardAuth`,`${Z}forwardAuth is only supported on HTTP public ingress: \`{ public: true } -> { vmId, port }\``)}if(G==="smtp")km4(Q.domain);else a51(Q.domain);if((Y.vmId!==void 0||Y.vpcId!==void 0)&&X.vmId!==void 0&&J.length>0)v1(`${Z}transform`,"a VM-to-VM rule cannot carry a transform yet \u2014 remove it (only public ingress/egress rules run transforms)");if(G==="tcp"){let H=X.public===!0||X.host!==void 0,F=Y.vmId!==void 0||Y.vpcId!==void 0;if(H||F)v1(`${Z}protocol`,"a `tcp` rule is public ingress only \u2014 `{ public: true } -> { vmId, port }`. The edge splices the session without terminating it, so outbound there is nothing to broker (an outbound allow is a firewall rule, and injecting into one needs `http` or `postgres`) and inward there is no certificate to answer the source with. Give the source `public: true`, or drop `protocol` to be served as HTTPS")}else if(G==="imap"||G==="imaps"){let H=X.public===!0||X.host!==void 0,F=Y.vmId!==void 0||Y.vpcId!==void 0;if(H||F)v1(`${Z}protocol`,`an \`${G}\` rule is public ingress only \u2014 \`{ public: true } -> { vmId, port }\`. The 993 front serves mail clients reaching a VM's IMAP server; outbound there is nothing to broker (an outbound allow is a firewall rule) and inward there is no certificate to answer the source with`)}else if(G==="socks5"){let H=X.public===!0||X.host!==void 0;if(Y.public===!0||!H)v1(`${Z}protocol`,'a `socks5` rule is egress only \u2014 `{ vmId } -> { host: "gate.provider.com", port: 1080 }`. The front exists so a guest can open sessions through a proxy whose credentials it never holds; inbound there is nothing to serve, and publishing one would be an open proxy on a platform address');if(X.host===void 0)v1(`${Z}destination`,"a `socks5` rule has to name the proxy it goes through: give the destination a `host` and the `port` the provider listens on. `{ public: true }` on its own asks the edge to be the proxy, which would let the guest out on our address rather than through yours")}else if(G==="postgres"){let H=J.some((U)=>U!==null&&typeof U==="object"&&("postgres"in U)),F=X.public===!0||X.host!==void 0;if(H&&!F)v1(`${Z}transform`,"a `postgres` transform belongs on an egress rule: the edge spends a credential the guest never holds, so pointing it at your own VM would hand every client a logged-in session. Give the destination `public: true` or a `host`, or drop the transform")}else if(G==="smtp"){let H=J.some((U)=>U!==null&&typeof U==="object"&&("smtp"in U)),F=X.public===!0||X.host!==void 0;if(H&&!F)v1(`${Z}transform`,"an `smtp` transform belongs on an egress rule: the edge spends a credential the guest never holds, so pointing it at your own VM would turn it into an open relay. Give the destination `public: true` or a `host`, or drop the transform");if(typeof Q.domain==="string"&&Q.domain.includes("@")&&Y.public!==!0)v1(`${Z}domain`,`\`${Q.domain}\` names a mailbox, which only makes sense on a rule that receives mail. An egress or VM-to-VM rule names the host the guest submits through \u2014 drop the part before \`@\``)}return{...Q,source:Y,destination:X}}function xm4($,Z){if($==="source")return Mm4(Z)?"source is empty. Say who opens the session: `vmId`, `vpcId`, or `public: true`":"source only narrows the session without saying who opens it. Add `vmId`, `vpcId`, or `public: true`";return"destination is empty. Say where the session lands: `vmId` + `port`, `host` + `port`, or `public: true` for the domain's own origin"}function CT$($){let Z=vT$($,"");for(let Q of["source","destination"]){let Y=Z[Q];if(!P10(Y))v1(Q,xm4(Q,Y))}if(Z.source.public===!0&&Z.destination.public===!0)v1("destination","a rule from the public Internet to the domain's own origin allows nothing the world cannot already do. Did you mean a `vmId` destination (ingress) or a `vmId` source (egress)?");return Z}function bT$($){if(!fY($))v1("tls","tls must be an object with a `rules` array");for(let Q of Object.keys($))if(Q!=="rules")v1(`tls.${Q}`,`tls has unknown field \`${Q}\`. Expected: rules`);let Z=$.rules;if(!Array.isArray(Z))v1("tls.rules","tls.rules must be an array");return Z.forEach((Q,Y)=>{let X=`tls.rules[${Y}].`,J=vT$(Q,X),G=P10(J.source),W=P10(J.destination);if(!G&&!W)v1(`tls.rules[${Y}]`,`tls.rules[${Y}]: both source and destination refer to the VM being created, which allows nothing. Give one of them a \`vmId\`, \`vpcId\`, or \`public: true\``);if(G&&W)v1(`tls.rules[${Y}]`,`tls.rules[${Y}]: neither end refers to the VM being created. Leave one endpoint's identity unset so it means this VM, or create the rule with tls.rules.create instead`);if(!W&&J.destination.port===void 0)v1(`tls.rules[${Y}].destination.port`,`tls.rules[${Y}]: destination.port is required: say which port on this VM the session lands on`)}),$}function r51($){return`/v5/tls/${u6($)}`}function s51($){return`/v5/tls/forward-auth/${u6($)}`}class xT${client;constructor($){this.client=$}list(){return this.client.get("/v5/tls/forward-auth")}async create($){let Z=IT$($);return this.client.post("/v5/tls/forward-auth",Z)}get($){return this.client.get(s51($))}async update($,Z){let Q=IT$(Z);return this.client.put(s51($),Q)}delete($){return this.client.delete(s51($))}}class fT${client;constructor($){this.client=$}async create($){let Z=CT$($);return this.client.post("/v5/tls",Z)}list($={}){return this.client.get("/v5/tls",$)}get($){return this.client.get(r51($))}async update($,Z){let Q=CT$(Z);return this.client.put(r51($),Q)}delete($){return this.client.delete(r51($))}}class Z91{client;rules;forwardAuth;constructor($){this.client=$,this.rules=new fT$($),this.forwardAuth=new xT$($)}}var e51,$91,ET$,jm4,zT$,Em4=253,zm4=63,PT$,AT$,Pm4,Am4,Tm4=2048,TT$=32,RT$=16384,qT$=32,MT$=32,Rm4=128,qm4,VT$="!#$%&'*+-/=?^_`{|}~.",ST$;var NT0=D(()=>{_W();e51=class e51 extends Error{path;constructor($,Z){super(Z);this.name="TlsRuleValidationError",this.path=$,Object.setPrototypeOf(this,e51.prototype)}};$91=class $91 extends Error{path;constructor($,Z){super(Z);this.name="TlsForwardAuthValidationError",this.path=$,Object.setPrototypeOf(this,$91.prototype)}};ET$=["vmId","vpcId","public","host","port"],jm4=["vmId","vpcId","public","host"],zT$=["tcp","http","postgres","minecraft","smtp","imap","imaps","socks5"],PT$=["url","headers","timeoutMs","protectedCookies","authResponseHeaders"],AT$=["id"],Pm4=/^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/,Am4=/^[0-9A-Za-z-]+$/,qm4=new Set(["host","content-length","connection","keep-alive","proxy-authenticate","proxy-authorization","proxy-connection","te","trailer","transfer-encoding","upgrade"]);ST$=["action","domain","protocol","source","destination","transform","match","forwardAuth"]});function xm($){return`/v5/tunnels/${u6($)}`}function Kf($){return $.tunnelId??=$.id,$}class Q91{client;constructor($){this.client=$}list(){return this.client.get("/v5/tunnels").then(($)=>{return $.tunnels.forEach(Kf),$})}create($={}){return this.client.post("/v5/tunnels",$).then(Kf)}get($){return this.client.get(xm($)).then(Kf)}update($,Z){return this.client.patch(xm($),Z).then(Kf)}rotateKey($,Z={}){return this.client.post(`${xm($)}/rotate-key`,Z).then(Kf)}delete($){return this.client.delete(xm($))}attachVpc($,Z,Q={}){return this.client.post(`${xm($)}/vpcs/${u6(Z)}`,Q).then(Kf)}detachVpc($,Z){return this.client.delete(`${xm($)}/vpcs/${u6(Z)}`).then(Kf)}}var Y91=D(()=>{_W()});class X91{client;basePath;constructor($,Z){this.client=$,this.basePath=Z}async readFile($,Z={}){let Q=await this.openRead($,Z);return new Uint8Array(await Q.arrayBuffer())}async readTextFile($,Z={}){return await(await this.openRead($,Z)).text()}async readFileStream($,Z={}){let Q=await this.openRead($,Z);if(!Q.body)throw Error(`no response body reading ${$}`);return Q.body}async writeFile($,Z,Q={}){let Y=typeof Z==="string"?new TextEncoder().encode(Z):Z,X=Y instanceof Uint8Array?Y.byteLength:Y.size;if(X>fm4)return this.uploadInChunks($,Y,X,Q);let J=Y instanceof Uint8Array?Y:new Uint8Array(await Y.arrayBuffer());await this.client.putBytes(`${this.basePath}/fs/write`,J,{path:$,mode:Q.mode,sha256:await yT$(J)},Q.signal),Q.onProgress?.({completedBytes:X,totalBytes:X})}writeTextFile($,Z,Q={}){return this.writeFile($,Z,Q)}async readDir($){let{entries:Z}=await this.client.get(`${this.basePath}/fs/dir`,{path:$});return Z}async mkdir($){await this.client.post(`${this.basePath}/fs/mkdir`,{path:$})}async remove($){await this.client.delete(`${this.basePath}/fs/remove`,{path:$})}async exists($){let{exists:Z}=await this.client.get(`${this.basePath}/fs/exists`,{path:$});return Z}stat($){return this.client.get(`${this.basePath}/fs/stat`,{path:$})}openRead($,Z){let{offset:Q,length:Y}=Z,X;if(Q!==void 0||Y!==void 0){let J=Q??0;X=Y===void 0?`bytes=${J}-`:`bytes=${J}-${J+Y-1}`}return this.client.getBytes(`${this.basePath}/fs/read`,{path:$},{range:X,signal:Z.signal})}async uploadInChunks($,Z,Q,Y){let X=Y.chunkSize??ym4,J=Y.maxAttempts??gm4,G=Z instanceof Uint8Array?await yT$(Z):void 0,W=await this.client.post(`${this.basePath}/fs/uploads`,{path:$,size:Q,sha256:G,mode:Y.mode}),K=`${this.basePath}/fs/uploads/${W.uploadId}`;try{let H=W.receivedBytes;while(H<Q){let F=Math.min(H+X,Q),U=Z instanceof Uint8Array?Z.subarray(H,F):Z.slice(H,F);H=(await this.putChunkWithRetry(K,U,H,J,Y.signal)).receivedBytes,Y.onProgress?.({completedBytes:Math.min(H,Q),totalBytes:Q})}await this.client.post(`${K}/commit`)}catch(H){throw await this.client.delete(K).catch(()=>{}),H}}async putChunkWithRetry($,Z,Q,Y,X){let J;for(let G=1;G<=Y;G++){X?.throwIfAborted?.();try{return await this.client.putBytes($,Z,{offset:Q},X)}catch(W){if(J=W,!(!(W instanceof yX)||W.status>=500||W.status===408||W.status===409||W.status===429)||X?.aborted||G===Y)throw W;await hm4(Math.min(500*2**(G-1),8000));let H=await this.client.get($).catch(()=>{return});if(H&&H.receivedBytes>Q)return H}}throw J}}async function yT$($){let Z=globalThis.crypto?.subtle;if(!Z)return;let Q=await Z.digest("SHA-256",$);return Array.from(new Uint8Array(Q),(Y)=>Y.toString(16).padStart(2,"0")).join("")}function hm4($){return new Promise((Z)=>setTimeout(Z,$))}var fm4=8388608,ym4=16777216,gm4=5;var J91=D(()=>{E10()});function um4(){return typeof process<"u"&&Boolean(process.versions?.node)}async function gT$($,Z){if(um4()){let Y;try{Y=await import("ws")}catch{throw Error("PTY sessions need the `ws` package in Node. Install it with `npm install ws`.")}return new Y.default($,{headers:Z})}let Q=globalThis.WebSocket;if(!Q)throw Error("PTY sessions need a WebSocket client; no global WebSocket is available in this environment.");return new Q($)}function A10($,Z,Q){if($.on){$.on(Z,Q);return}$.addEventListener?.(Z,Q)}function cm4($,Z){if($&&typeof $==="object"&&"data"in $){let Q=$.data;if(typeof Q==="string")return{text:Q};if(Q instanceof ArrayBuffer)return{binary:new Uint8Array(Q)};return{}}if($ instanceof Uint8Array)return Z?{binary:$}:{text:lm4.decode($)};if(typeof $==="string")return{text:$};return{}}class G91{_sessionId;_slug;_created=!1;socket;constructor($,Z,Q={}){this.socket=$,this._sessionId=Z,A10($,"message",(Y,X)=>{let{text:J,binary:G}=cm4(Y,X);if(G){Q.onData?.(G);return}if(!J)return;let W;try{W=JSON.parse(J)}catch{return}if(W.type==="exited")Q.onExit?.(W.exitCode);else if(W.type==="error")Q.onError?.(Error(W.message));else if(W.type==="sessionInfo")this._sessionId=W.sessionId,this._slug=W.slug,this._created=W.created??!0,Q.onSessionInfo?.(W.sessionId)}),A10($,"close",(Y)=>{let X=Y;Q.onClose?.({wasClean:X?.wasClean??!0,code:X?.code??1000,reason:X?.reason??""})}),A10($,"error",(Y)=>Q.onError?.(Y))}write($){this.socket.send(typeof $==="string"?new TextEncoder().encode($):$)}resize($){this.sendControl({type:"resize",cols:$.cols,rows:$.rows})}signal($){this.sendControl({type:"signal",signal:$})}sendControl($){this.socket.send(JSON.stringify($))}detach(){this.socket.close()}get sessionId(){return this._sessionId}get slug(){return this._slug}get created(){return this._created}get readyState(){return this.socket.readyState}}function mm4($){return new Promise((Z,Q)=>{if($.readyState===1){Z();return}A10($,"open",()=>Z()),A10($,"error",(Y)=>Q(Y))})}class W91{client;basePath;constructor($,Z){this.client=$,this.basePath=Z}async open($={}){let{exec:Z,cols:Q,rows:Y,linuxUser:X,slug:J,replaceOnExit:G,onData:W,onExit:K,onClose:H,onError:F}=$,U={};if(Z!==void 0)U.exec=Z;if(Q!==void 0)U.cols=Q;if(Y!==void 0)U.rows=Y;if(X!==void 0)U.linuxUser=X;if(J!==void 0)U.slug=J;if(G!==void 0)U.replaceOnExit=String(G);let N=hT$(this.client,`${this.basePath}/pty`,U),B=this.client.authHeaders(),O=await gT$(N,B);return new Promise((L,w)=>{let j=!1,E=new G91(O,-1,{onData:W,onExit:K,onClose:(z)=>{if(!j)j=!0,w(Error("connection closed before sessionInfo"));H?.(z)},onError:(z)=>{if(!j)j=!0,w(z);F?.(z)},onSessionInfo:()=>{j=!0,L(E)}})})}async attach($){let{session:Z,linuxUser:Q,onData:Y,onExit:X,onClose:J,onError:G}=$,W=hT$(this.client,`${this.basePath}/pty/sessions/${u6(String(Z))}`,{...Q!==void 0?{linuxUser:Q}:{}}),K=this.client.authHeaders(),H=await gT$(W,K),F=new G91(H,typeof Z==="number"?Z:-1,{onData:Y,onExit:X,onClose:J,onError:G});return await mm4(H),F}list($={}){return this.client.get(`${this.basePath}/pty/sessions`,$)}close($,Z={}){return this.client.delete(`${this.basePath}/pty/sessions/${u6(String($))}`,Z)}}class K91{pty;linuxUser;constructor($,Z){this.pty=$,this.linuxUser=Z}open($={}){return this.pty.open({...$,linuxUser:this.linuxUser})}attach($){return this.pty.attach({...$,linuxUser:this.linuxUser})}list(){return this.pty.list({linuxUser:this.linuxUser})}close($){return this.pty.close($,{linuxUser:this.linuxUser})}}function hT$($,Z,Q){return $.url(Z,Q).replace(/^http/,"ws")}var lm4;var H91=D(()=>{_W();lm4=new TextDecoder});class F91{client;constructor($){this.client=$}list($={}){return this.client.get("/v5/snapshots",$)}get($){return this.client.get(`/v5/snapshots/${u6($)}`)}update($,Z){return this.client.patch(`/v5/snapshots/${u6($)}`,Z)}delete($){return this.client.delete(`/v5/snapshots/${u6($)}`)}}var U91=D(()=>{_W()});var uT$=()=>{};function N91($){return`/v5/vms/${u6($)}`}class B91{id;fs;pty;client;basePath;constructor($,Z){this.client=$,this.id=Z,this.basePath=N91(Z),this.fs=new X91($,this.basePath),this.pty=new W91($,this.basePath)}data(){return this.client.get(this.basePath)}firewallRules(){return this.client.get("/v5/firewall/rules",{vmId:this.id})}update($){return this.client.patch(this.basePath,$)}start(){return this.client.post(`${this.basePath}/start`)}pause(){return this.client.post(`${this.basePath}/pause`)}resize($){return this.client.post(`${this.basePath}/resize`,$)}delete(){return this.client.delete(this.basePath)}exec($){let Z=typeof $==="string"?{command:$}:$;return this.client.post(`${this.basePath}/exec-await`,Z)}linuxUser($){return new lT$(this,$)}snapshot($={}){return this.client.post(`${this.basePath}/snapshot`,$)}}class lT${vm;linuxUser;pty;constructor($,Z){this.vm=$,this.linuxUser=Z,this.pty=new K91($.pty,Z)}exec($){let Z=typeof $==="string"?{command:$}:$;return this.vm.exec({...Z,linuxUser:this.linuxUser})}}class D91{client;snapshots;constructor($){this.client=$,this.snapshots=new F91($)}async create($){if(UT0($.firewall,"VM"),$.tls!==void 0)bT$($.tls);let Z=await this.client.post("/v5/vms",$);return{vm:new B91(this.client,Z.id),vmId:Z.id,data:Z,firewallRules:Z.firewallRules??[],tlsRules:Z.tlsRules??[]}}list($={}){return this.client.get("/v5/vms",$)}get($){return this.client.get(N91($))}ref($){return new B91(this.client,$)}delete($){return this.client.delete(N91($))}}var O91=D(()=>{z10();NT0();_W();J91();H91();U91();uT$();J91();H91();U91()});function L91($){return`/v5/vpcs/${u6($)}`}class cT${client;basePath;constructor($,Z){this.client=$,this.basePath=Z}list(){return this.client.get(`${this.basePath}/tunnels`)}}class w91{id;tunnels;client;basePath;constructor($,Z){this.client=$,this.id=Z,this.basePath=L91(Z),this.tunnels=new cT$($,this.basePath)}data(){return this.client.get(this.basePath)}update($){return this.client.patch(this.basePath,$)}delete(){return this.client.delete(this.basePath)}}class j91{client;constructor($){this.client=$}list(){return this.client.get("/v5/vpcs")}async create($={}){if($.firewall!==void 0)UT0($.firewall,"network");let Z=await this.client.post("/v5/vpcs",$);return{vpc:new w91(this.client,Z.id),vpcId:Z.id,data:Z,firewallRules:Z.firewallRules??[]}}get($){return this.client.get(L91($))}ref($){return new w91(this.client,$)}delete($){return this.client.delete(L91($))}}var E91=D(()=>{z10();_W()});class BT0{client;vms;vpc;tunnels;firewall;tls;domains;identities;constructor($={}){this.client=new h51($),this.vms=new D91(this.client),this.vpc=new j91(this.client),this.tunnels=new Q91(this.client),this.firewall=new i51(this.client),this.tls=new Z91(this.client),this.domains=new u51(this.client),this.identities=new t51(this.client)}fetch($,Z){return this.client.fetch($,Z)}}var mT$=D(()=>{_W();l51();z10();o51();NT0();Y91();O91();E91();_W();E10();O91();E91();Y91();l51();z10();NT0();o51()});var iT$;var dT$=D(()=>{iT$={name:"@decocms/sandbox",version:"1.80.1",private:!0,type:"module",description:"Sandbox runtime for isolated Studio tool execution",scripts:{check:"tsc --noEmit",test:"bun test",build:"bun run build:typegen && bun run build:harness-runner","build:typegen":"mkdir -p dist && bun run --cwd=../typegen build && bun --cwd=../typegen pm pack --filename $PWD/dist/typegen.tgz --quiet","build:harness-runner":"mkdir -p dist && bun --cwd=../harness-runner pm pack --filename $PWD/dist/harness-runner.tgz --quiet"},exports:{"./shared":"./shared.ts","./provider":"./server/provider/index.ts","./provider/agent-sandbox":"./server/provider/agent-sandbox/index.ts","./provider/postgres-state-store":"./server/provider/postgres-state-store.ts","./provider/freestyle":"./server/provider/freestyle.ts","./provider/remote":"./server/provider/remote.ts","./provider/router":"./server/provider/router.ts","./provider/sandbox-api":"./server/provider/sandbox-api.ts","./provider/sandbox-server":"./server/provider/sandbox-server.ts","./daemon-client":"./server/daemon-client.ts","./org-fs":"./org-fs.ts","./dispatch":"./dispatch/index.ts","./dispatch/*":"./dispatch/*.ts","./proxy/http":"./proxy/http.ts","./proxy/websocket":"./proxy/websocket.ts"},dependencies:{"@decocms/shared":"workspace:*","@kubernetes/client-node":"^1.4.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0",freestyle:"0.2.16",zod:"4.3.6"},devDependencies:{"@types/bun":"latest",postgres:"^3.4.5",typescript:"^7.0.2"}}});function DT0($){let Z=$?.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of studio-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"});return async(Q,Y)=>{if(!Z)return Y();let X=performance.now(),J=(G)=>Z.record(performance.now()-X,{runner_kind:Q,source:"daemon",status_code:G});try{let G=await Y();return J(G.status),G}catch(G){throw J(0),G}}}var zD;var OT0=D(()=>{zD={kubernetes:"agent-sandbox",freestyle:"freestyle"}});var $R$={};$6($R$,{FreestyleSandboxProvider:()=>eT$});import{createHash as im4,randomBytes as pm4}from"crypto";class eT${freestyle;lookupClient;image;sidecarImage;idleTimeoutSeconds;autoDeleteSeconds;domainSuffix;timeDaemonRequest;inflight=new Jf;snapshotInflight=new Jf;lookups=new Map;releaseTimers=new Map;constructor($){this.freestyle=$.client??new BT0({apiKey:$.apiKey}),this.lookupClient=$.client??new BT0({apiKey:$.apiKey,fetch:Object.assign((Z,Q)=>fetch(Z,{...Q,signal:Q?.signal?AbortSignal.any([Q.signal,AbortSignal.timeout(rT$)]):AbortSignal.timeout(rT$)}),{preconnect:fetch.preconnect})}),this.image=$.image??`ghcr.io/decocms/studio/studio-sandbox-go:${iT$.version}`,this.sidecarImage=$.orgFsSidecarImage??tm4,this.idleTimeoutSeconds=$.idleTimeoutSeconds??900,this.autoDeleteSeconds=$.autoDeleteSeconds??259200,this.domainSuffix=$.domainSuffix??"style.dev",this.timeDaemonRequest=DT0($.meter)}async owns($){return await this.find($)!==null}daemonUrl($){return`https://${$}.${this.domainSuffix}`}async find($,Z={}){let Q=this.lookups.get($);if(!Z.refresh&&Q&&Date.now()-Q.at<(Q.found?$d4:Zd4))return Q.found;let Y=null;try{let X=await this.lookupClient.vms.get($),J=X.metadata[tT$];if(J)Y={vm:this.freestyle.vms.ref(X.id),daemon:{url:this.daemonUrl($),token:J}}}catch(X){if(!(X instanceof yX&&X.status===404))throw X}return this.remember($,Y),Y}remember($,Z){if(this.lookups.delete($),this.lookups.size>=Qd4){let Q=this.lookups.keys().next();if(!Q.done)this.lookups.delete(Q.value)}this.lookups.set($,{found:Z,at:Date.now()})}baseSnapshot(){let{image:$,sidecarImage:Z}=this,Q=`studio-sandbox-${im4("sha256").update(`${$}
+${X}`:X}var HA$,pl4;var O51=D(()=>{HA$=/[\r\n<>]/,pl4=/^[^\s@<>]+@[^\s@<>]+\.[^\s@<>]+$/});var pA0=D(()=>{a$();O51()});function tl4($){if($ instanceof TypeError)return!0;if($ instanceof Error&&!($ instanceof DOMException)&&typeof $.code==="string")return!0;if($ instanceof DOMException&&$.name==="AbortError")return!0;return!1}async function L51($,Z,Q,Y){try{return await E8(async()=>{let J=await fetch($,{...Z,signal:AbortSignal.timeout(Y)});return{status:J.status,ok:J.ok,body:await J.text()}},{maxAttempts:3,minTimeout:50,maxTimeout:500,multiplier:2,jitter:0.5,isRetriable:tl4})}catch(X){let J=X instanceof Error?X.message:String(X);throw Error(`[SANDBOX_UNREACHABLE] sandbox daemon ${Q} request failed: ${J}`,{cause:X})}}async function nA0($){try{let Z=await fetch(`${$}/health`,{signal:AbortSignal.timeout(ol4)});if(!Z.ok){try{await Z.text()}catch{}return null}let Q=await Z.json();if(typeof Q==="object"&&Q!==null&&typeof Q.bootId==="string"&&typeof Q.ready==="boolean"&&Q.setup&&typeof Q.setup.running==="boolean"&&typeof Q.setup.done==="boolean")return Q;return null}catch{return null}}async function j51($){for(let Z=0;Z<UA$;Z++){if(await nA0($)!==null)return;let Q=(Math.random()*2-1)*rl4;await z$(NA$+Q)}throw Error(`sandbox daemon at ${$} did not respond on /health within ${UA$*NA$/1000}s`)}async function VU($,Z,Q,Y,X){return sl4($,Z,"POST",Q,Y,X)}async function sl4($,Z,Q,Y,X,J){let G={...Y};if(X&&X.rotateToken!==void 0)G.auth=X;let W=await L51(`${$}/_sandbox/config`,{method:Q,headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:JSON.stringify(G)},"/_sandbox/config",J?.timeoutMs??w51);if(!W.ok)throw new EH(W.status,W.body);return DA$(W.body,"/_sandbox/config")}async function BA$($,Z,Q){let Y=await L51(`${$}/_sandbox/setup/${Q}`,{method:"POST",headers:{Authorization:`Bearer ${Z}`}},`/_sandbox/setup/${Q}`,w51);if(!Y.ok)throw Error(`sandbox daemon /_sandbox/setup/${Q} returned ${Y.status}: ${Y.body}`)}async function N10($,Z,Q){let Y=await L51(`${$}/_sandbox/orgfs-config`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:Q},"/_sandbox/orgfs-config",w51);if(!Y.ok)throw Error(`sandbox daemon /_sandbox/orgfs-config returned ${Y.status}: ${Y.body}`);return DA$(Y.body,"/_sandbox/orgfs-config")}function DA$($,Z){try{return JSON.parse($)}catch(Q){throw Error(`sandbox daemon ${Z} returned a malformed JSON body: ${$.slice(0,200)}`,{cause:Q})}}async function tA0($,Z,Q,Y){let X=new Headers(Y.headers);for(let W of al4)X.delete(W);X.set("authorization",`Bearer ${Z}`);let J=Y.method!=="GET"&&Y.method!=="HEAD",G=`${$}${Q.startsWith("/")?Q:`/${Q}`}`;return fetch(G,{method:Y.method,headers:X,body:J?Y.body:void 0,redirect:"manual",signal:Y.signal,duplex:J?"half":void 0})}var EH,ol4=500,w51=30000,UA$=25,NA$=200,rl4=50,al4;var Xf=D(()=>{pA0();a$();EH=class EH extends Error{status;constructor($,Z){super(`sandbox daemon /_sandbox/config returned ${$}: ${Z}`);this.status=$;this.name="ConfigRequestError"}};al4=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length"]});class oA0{counted=new Set;markCounted($){this.counted.add($)}consume($){return this.counted.delete($)}}class Jf{map=new Map;async run($,Z){let Q=this.map.get($);if(Q)return Q;let Y=Z();this.map.set($,Y);try{return await Y}finally{this.map.delete($)}}}function rA0($,Z,Q){if(!$)return Q(null);if(!$.withLock)return Q($);return $.withLock(Z,Q)}function B10($){if(!$.orgId||!$.virtualMcpId||!$.branch)throw Error("composeSandboxRef: orgId, virtualMcpId and branch are all required for agent refs");return`agent:${$.orgId}:${$.virtualMcpId}:${$.branch}`}function OA$($){if(!$.startsWith("agent:"))return"";let Z=$.split(":");return Z.length>=4?Z.slice(3).join(":"):""}import{hash as el4}from"crypto";function $c4($,Z=16){return el4("sha256",QL$($),"hex").slice(0,Z)}function F3($){let Z=$c4($),Q=Zc4(OA$($.projectRef));return Q?`${Q}-${Z}`:`s-${Z}`}function Zc4($){if(!$)return"";let Z=$.split("/").pop()??"",Q="",Y=!1;for(let X of Z.toLowerCase()){let J=X.charCodeAt(0),G=J>=97&&J<=122,W=J>=48&&J<=57;if(!G&&!W){Y||=Q.length>0;continue}if(Y){if(Q.length+1>=LA$)break;Q+="-",Y=!1}if(Q+=X,Q.length===LA$)break}return Q}var LA$=24;var wA$=D(()=>{D41()});function sA0($,Z){let Q=$.replace(/\/+$/,"");if(Q.includes("{handle}"))return`${Q.replace("{handle}",Z)}/`;try{let Y=new URL(Q);return Y.hostname=`${Z}.${Y.hostname}`,`${Y.toString()}/`}catch{return`${Q}/${Z}/`}}function Vm($){let Z=$.repo,Q=Z?{repository:{cloneUrl:Z.cloneUrl,repoName:Z.displayName??Qc4(Z.cloneUrl),...Z.branch?{branch:Z.branch}:{},submoduleCredentials:Z.submoduleCredentials??[]},repositories:($.extraRepos??[]).filter((K)=>!!K.directoryName).map((K)=>({cloneUrl:K.cloneUrl,repoName:K.directoryName,...K.branch?{branch:K.branch}:{},submoduleCredentials:K.submoduleCredentials??[]})),...Z.userName.trim()||Z.userEmail.trim()?{identity:{userName:Z.userName,userEmail:Z.userEmail}}:{}}:void 0,Y=$.tenant,X=Im({userName:Y?.userName,userEmail:Y?.userEmail})??void 0,J=$.packageManager?{name:$.packageManager.name,...$.packageManager.path?{path:$.packageManager.path}:{}}:void 0,G=J?{packageManager:J,runtime:$.runtime,...$.port!==void 0?{port:$.port}:{}}:void 0,W=Y?.orgId;if(!Q&&!G&&!X&&$.cloneOnly===void 0&&!W)return null;return{...Q?{git:Q}:{},...X?{operator:X}:{},...W?{orgId:W}:{},...$.cloneOnly!==void 0?{cloneOnly:$.cloneOnly}:{},...G?{application:G}:{}}}function Qc4($){try{let Z=new URL($);return Z.pathname.replace(/^\/+/,"").replace(/\.git$/,"")||Z.hostname}catch{return $}}var jA$=D(()=>{O51()});function Yc4($){try{return new URL($).username.length>0}catch{return!1}}function D10($){let Z=$.repo?.cloneUrl;if(!Z||!Yc4(Z))return null;return{git:{repository:{cloneUrl:Z}}}}var km=D(()=>{wA$();jA$()});async function*PA$($){let Z=$.now??(()=>Date.now()),Q=Z(),Y=$.schedulingTimeoutMs??Jc4,X={pod:{},sandbox:{},events:{hasPulling:!1,hasPulled:!1},startedAt:Q},J=[],G=null,W=!1,K=(E)=>{if(W)return;if(G){let z=G;G=null,z(E)}else J.push(E)},H=()=>{if(J.length>0)return Promise.resolve(J.shift());if(W)return Promise.resolve(null);return new Promise((E)=>{G=E})},F=()=>{if(W)return;if(W=!0,G){let E=G;G=null,E(null)}},U=new AbortController,N=()=>{U.abort(),F()};if($.signal)if($.signal.aborted)U.abort(),F();else $.signal.addEventListener("abort",N,{once:!0});let B=Math.max(0,Y-(Z()-Q)),O=setTimeout(()=>K("tick"),B+100),L,w=new Promise((E)=>{L=E}),j=Promise.allSettled([Wc4($.kc,$.namespace,$.claimName,U.signal,X,K,Z,L),Hc4($.kc,$.namespace,$.claimName,U.signal,X,K),Fc4($.kc,$.namespace,$.claimName,w,U.signal,X,K,Z)]);try{let E=null,z=-1,T=EA$(X,Y,Z);if(E=z51(T),!E51(T))z=zA$(T);if(yield T,E51(T))return;while(!W){if(await H()===null)break;let P=EA$(X,Y,Z);if(E51(P)){let _=z51(P);if(_!==E)E=_,yield P;return}let q=zA$(P);if(q<z)continue;let x=z51(P);if(x!==E)E=x,z=q,yield P}}finally{if(clearTimeout(O),U.abort(),$.signal)$.signal.removeEventListener("abort",N);F(),await j.catch(()=>{})}}async function AA$($,Z=Gc4){let Q=new AbortController,Y="claiming",X,J=()=>{clearTimeout(X),X=setTimeout(()=>Q.abort(),Z)};try{J();for await(let G of $(Q.signal)){if(G.kind==="ready")return;if(G.kind==="failed")throw new vY(G.message);Y=G.kind,J()}}finally{clearTimeout(X),Q.abort()}throw new Nm(`Sandbox did not become ready: no progress for ${Math.round(Z/1000)}s while ${Y}`)}function EA$($,Z,Q){let{pod:Y,sandbox:X,events:J,startedAt:G}=$;if(X.ready)return{kind:"ready"};let W=Y.containerWaitingReason;if(W==="ImagePullBackOff"||W==="ErrImagePull")return{kind:"failed",reason:"image-pull-backoff",message:"Sandbox image failed to download. The cluster may be missing pull credentials or the image tag may not exist."};if(W==="CrashLoopBackOff")return{kind:"failed",reason:"crash-loop-backoff",message:"Sandbox crashed during startup and is now in CrashLoopBackOff. Check pod logs."};if(!Y.scheduled&&J.lastFailedSchedulingAt!==void 0&&Q()-G>Z)return{kind:"failed",reason:"scheduling-timeout",message:J.failedSchedulingMessage??`Pod could not be scheduled within ${Math.round(Z/1000)}s.`};if(Y.containerRunning&&!Y.containerReady)return{kind:"warming-daemon",since:G};if(J.hasPulling&&!J.hasPulled)return{kind:"pulling-image",since:G};if(W==="ContainerCreating"||W==="PodInitializing"||Y.scheduled&&!Y.containerRunning)return{kind:"starting-container",since:G};if(Y.scheduledFalseReason==="Unschedulable"||J.lastFailedSchedulingAt!==void 0&&!Y.scheduled)return{kind:"waiting-for-capacity",since:G,message:J.failedSchedulingMessage??Y.scheduledFalseMessage,nodeClaim:J.nominatedNodeClaim};return{kind:"claiming",since:G}}function E51($){return $.kind==="ready"||$.kind==="failed"}function zA$($){switch($.kind){case"claiming":return 0;case"waiting-for-capacity":return 1;case"pulling-image":return 2;case"starting-container":return 3;case"warming-daemon":return 4;case"ready":case"failed":return 99}}function z51($){switch($.kind){case"claiming":case"pulling-image":case"starting-container":case"warming-daemon":return $.kind;case"waiting-for-capacity":return`waiting-for-capacity:${$.message??""}:${$.nodeClaim??""}`;case"ready":return"ready";case"failed":return`failed:${$.reason}:${$.message}`}}async function Wc4($,Z,Q,Y,X,J,G,W){let K=`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?watch=true&labelSelector=${encodeURIComponent(`${Xc4}=${Q}`)}`;return aA0({kc:$,path:K,signal:Y,label:`pod/${Q}`,onEvent:(H)=>{if(H.type!=="ADDED"&&H.type!=="MODIFIED")return;let F=H.object;if(F.metadata?.name)W(F.metadata.name);Kc4(F,X,G),J("pod")}})}function Kc4($,Z,Q){let X=($.status?.conditions??[]).find((G)=>G.type==="PodScheduled");if(X?.status==="True")Z.pod.scheduled=!0,Z.pod.scheduledFalseReason=void 0,Z.pod.scheduledFalseMessage=void 0;else if(X?.status==="False")Z.pod.scheduled=!1,Z.pod.scheduledFalseReason=X.reason,Z.pod.scheduledFalseMessage=X.message;let J=($.status?.containerStatuses??[]).find((G)=>G.name===dZ.MAIN_CONTAINER_NAME);if(J)Z.pod.containerWaitingReason=J.state?.waiting?.reason,Z.pod.containerRunning=!!J.state?.running,Z.pod.containerReady=J.ready===!0}async function Hc4($,Z,Q,Y,X,J){let G=`/apis/${dZ.CLAIM_API_GROUP}/${dZ.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(Z)}/${dZ.CLAIM_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${Q}`)}`;return aA0({kc:$,path:G,signal:Y,label:`sandboxclaim/${Q}`,onEvent:(W)=>{if(W.type!=="ADDED"&&W.type!=="MODIFIED")return;let H=W.object.status?.conditions?.find((F)=>F.type==="Ready");if(!H)return;if(H.status==="True")X.sandbox.ready=!0,X.sandbox.notReadyReason=void 0,X.sandbox.notReadyMessage=void 0;else X.sandbox.ready=!1,X.sandbox.notReadyReason=H.reason,X.sandbox.notReadyMessage=H.message;J("sandbox")}})}async function Fc4($,Z,Q,Y,X,J,G,W){let K=await Promise.race([Y,new Promise((F)=>{if(X.aborted){F(Q);return}X.addEventListener("abort",()=>F(Q),{once:!0})})]);if(X.aborted)return;let H=`/api/v1/namespaces/${encodeURIComponent(Z)}/events?watch=true&fieldSelector=${encodeURIComponent(`involvedObject.name=${K},involvedObject.kind=Pod`)}`;return aA0({kc:$,path:H,signal:X,label:`events/${Q}`,onEvent:(F)=>{if(F.type!=="ADDED"&&F.type!=="MODIFIED")return;let U=F.object,N=U.reason;if(!N)return;switch(N){case"Pulling":J.events.hasPulling=!0;break;case"Pulled":J.events.hasPulling=!0,J.events.hasPulled=!0;break;case"FailedScheduling":J.events.lastFailedSchedulingAt=W(),J.events.failedSchedulingMessage=U.message;break;case"Nominated":{let B=U.message?.match(/nodeclaim\/([\w-]+)/);if(B)J.events.nominatedNodeClaim=B[1];break}default:return}G("event")}})}async function TA$($){let{kc:Z,namespace:Q,labelSelector:Y,signal:X,onDelete:J}=$,G=`/apis/${dZ.CLAIM_API_GROUP}/${dZ.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(Q)}/${dZ.CLAIM_PLURAL}?watch=true&labelSelector=${encodeURIComponent(Y)}`;return aA0({kc:Z,path:G,signal:X,label:"sandboxclaim-reaper",onEvent:(W)=>{if(W.type!=="DELETED")return;let K=W.object.metadata?.name;if(K)J(K)}})}async function aA0($){let{kc:Z,path:Q,signal:Y,label:X,onEvent:J}=$,G=0;while(!Y.aborted){try{let K=await SW(Z,{method:"GET",path:Q,signal:Y,headers:{accept:"application/json"},stream:!0});if(!K.ok||!K.body){try{await K.body?.cancel()}catch{}if(K.status===401||K.status===403){console.warn(`[lifecycle-watcher] ${X} stopped: watch denied (${K.status} ${K.statusText}). `+"The kubeconfig in use cannot watch SandboxClaims \u2014 if you are running locally, "+"this provider should not be active (check STUDIO_AGENT_SANDBOX_ENABLED).");return}throw Error(`watch handshake failed: ${K.status} ${K.statusText}`)}G=0;for await(let H of bL$(K.body)){if(Y.aborted)return;try{J(H)}catch(F){console.warn(`[lifecycle-watcher] ${X} onEvent threw: ${F instanceof Error?F.message:String(F)}`)}}}catch(K){if(Y.aborted)return;let H=K instanceof Error?K.message:String(K);console.warn(`[lifecycle-watcher] ${X} watch ended: ${H}`)}if(Y.aborted)return;let W=U7(5000,250,G,2,0);G+=1,await z$(W,{signal:Y}).catch(()=>{})}}var Xc4="studio.decocms.com/sandbox-handle",Jc4=300000,Gc4=600000;var RA$=D(()=>{a$();d00();kH0()});import{createHash as Uc4}from"crypto";import{z as xX}from"zod";function kU($){let Z;try{Z=new URL($.trim())}catch{return null}if(Z.protocol!=="https:"||Z.search||Z.hash)return null;let Q=Z.pathname.replace(/\/+$/,"").replace(/\.git$/,"").replace(/\/+$/,"");return Q?`https://${Z.host.toLowerCase()}${Q}`:null}function O10($){return kU($)?.toLowerCase()??null}function Lc4($){let Z=new Set;for(let Q of $){let Y=`${O10(Q.repoUrl)??Q.repoUrl}#${Q.branch}`;if(Z.has(Y))return Q;Z.add(Y)}return null}function qA$($){return $.reduce((Z,Q)=>Z+Q.replicas,0)}function IA$($,Z){if(Z.warmPoolName)return Z.warmPoolName;let Q=Uc4("sha256").update(`${Z.repoUrl}#${Z.branch}`).digest("hex").slice(0,8);return`${$}-${Q}`}function VA$($){return Math.max(0,$.size-qA$($.repos))}function Sm($){return $.flatMap((Z)=>Z.repos.map((Q)=>({pool:Z,repo:Q,warmPoolName:IA$(Z.name,Q)})))}function wc4($,Z){return CA$(void 0,$,!0,Z)}function kA$($,{templateName:Z}){let Q=wc4(Z,$.image),Y=(X,J)=>({apiVersion:`${dZ.CLAIM_API_GROUP}/${dZ.CLAIM_API_VERSION}`,kind:"SandboxWarmPool",metadata:{name:X,labels:{[jc4]:$.name}},spec:{replicas:J,updateStrategy:{type:"OnReplenish"},sandboxTemplateRef:{name:Q}}});return[...$.repos.map((X)=>Y(IA$($.name,X),X.replicas)),Y($.name,VA$($))]}function $T0($){return $.tenant?.orgId}function A51($,Z){if(!Z.tenant)return null;let Q=$.filter((J)=>J.tenant===Z.tenant&&J.image===Z.image),Y=Z.cloneUrl?O10(Z.cloneUrl):null;if(Y){let J=Sm(Q).filter((W)=>O10(W.repo.repoUrl)===Y),G=J.find((W)=>W.repo.branch===Z.branch)??J[0];if(G)return G}let X=Q.find((J)=>VA$(J)>0);return X?{pool:X,repo:null,warmPoolName:X.name}:null}function SA$($,Z,Q){return $?.warmPoolName??(Z?Q:"none")}function CA$($,Z,Q=!1,Y){let X=Y&&Y!=="default"?`-${Y}`:"";return`${Z}${X}${$==="harness-run"||Q?"-medium":""}`}async function T51($){let Z=CA$($.purpose,$.templateName,$.tenantPool,$.sandboxImage);if(Z===$.templateName)return{name:Z,probes:$.probes};let Q=$.probes[Z]??null,Y=Q!==null&&$.now-Q.checkedAt<$.ttlMs?Q:{checkedAt:$.now,present:await $.exists(Z)},X={...$.probes,[Z]:Y};if(Y.present)return{name:Z,probes:X};if(Q?.present!==!1)$.onAbsent?.(Z);if($.sandboxImage&&$.sandboxImage!=="default")return T51({...$,sandboxImage:void 0,probes:X});return{name:$.templateName,probes:X}}function R51($,Z,Q){let Y=O10(Z);if(!Y)return[];let X=Q.replace(/^refs\/heads\//,"");return Sm($).filter(({repo:J})=>O10(J.repoUrl)===Y&&J.branch===X)}class q51{source;dirty=new Set;pods=new Map;known=new Map;constructor($){this.source=$}pools(){return this.source()}resolve($){return A51(this.pools(),$)}markDirty($,Z){let Q=R51(this.pools(),$,Z).map((Y)=>Y.warmPoolName);for(let Y of Q)this.dirty.add(Y);return Q}takeDirty($){return this.dirty.delete($)}pod($){return this.pods.get($)}setPod($,Z){this.pods.set($,Z)}retainPods($,Z){for(let[Q,Y]of this.pods)if(Y.pool===$&&!Z.has(Q))this.pods.delete(Q)}retain($){let Z=new Map($.map((Y)=>[Y.warmPoolName,Y])),Q=[...this.known.values()].filter((Y)=>!Z.has(Y.warmPoolName));for(let Y of this.dirty)if(!Z.has(Y))this.dirty.delete(Y);for(let[Y,X]of this.pods)if(!Z.has(X.pool))this.pods.delete(Y);return this.known=Z,Q}}var Nc4=54,Bc4,Dc4=2048,Oc4,L10,eA0,P51,MA$,jc4="studio.decocms.com/tenant-pool";var w10=D(()=>{i4();d00();Bc4=/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/;Oc4=xX.object({runtime:xX.enum(["node","bun","deno"]).default("node"),packageManager:xX.enum(["npm","pnpm","yarn","bun","deno"]).optional(),packageManagerPath:xX.string().optional(),devPort:xX.number().int().positive().optional()}).default({runtime:"node"}),L10=xX.object({repoUrl:xX.string().max(Dc4).transform(($,Z)=>{let Q=kU($);if(Q)return Q;return Z.addIssue({code:"custom",message:"repoUrl must be an https clone URL"}),xX.NEVER}),branch:xX.string().min(1).default("main"),workload:Oc4,replicas:xX.number().int().min(1)});eA0=class eA0 extends Error{poolName;size;allocated;constructor($,Z,Q){super(`pool ${$}: repos take ${Q} replicas, more than its size ${Z}`);this.poolName=$;this.size=Z;this.allocated=Q;this.name="TenantPoolCapacityError"}};P51=xX.object({name:xX.string().max(Nc4).regex(Bc4,"pool name must be a DNS label (lowercase alphanumeric and '-')"),tenant:xX.string().min(1).max(512),size:xX.number().int().min(1),image:GU.default("default")}),MA$=P51.extend({repos:xX.array(L10).default([])}).superRefine(($,Z)=>{let Q=Lc4($.repos);if(Q)Z.addIssue({code:"custom",path:["repos"],message:`duplicate repo allocation ${Q.repoUrl}#${Q.branch}`});let Y=qA$($.repos);if(Y>$.size)Z.addIssue({code:"custom",path:["repos"],message:new eA0($.name,$.size,Y).message})})});async function _A$($,Z,Q){let Y=new Map;for(let X of $){let J=Z(X);if(!J)continue;let G=Y.get(J);if(G)G.push(X);else Y.set(J,[X])}await Promise.allSettled([...Y.values()].map(async(X)=>{for(let J of X)await Q(J).catch(()=>{})}))}function Ec4($){try{let Z=new URL($);if(Z.hostname.toLowerCase()!=="github.com")return null;let[Q,Y]=Z.pathname.replace(/^\/+/,"").split("/"),X=Y?.replace(/\.git$/,"");return Q&&X?`${Q}/${X}`.toLowerCase():null}catch{return null}}function vA$($){if($.repositoryId)return{repositoryId:$.repositoryId};let Z=$.connectionId?Ec4($.cloneUrl):null;return $.connectionId&&Z?{connectionId:$.connectionId,repo:Z}:null}var bA$=D(()=>{w10()});async function Cm($,Z,Q,Y){let X=(G)=>tA0(G.url,G.token,Z,Q),J=!(Q.body instanceof ReadableStream);try{let G=await X($);if(G.status!==401||!J)return G;let W=await Y.unauthorized();if(!W)return G;return await G.body?.cancel().catch(()=>{}),await X(W)}catch(G){if(!J)throw G;let W=await Y.unreachable();if(!W)throw G;return X(W)}}var ZT0=D(()=>{Xf()});function yA$($,Z){return new Response(JSON.stringify(Z),{status:$,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function xA$($){let Z=new Headers;for(let[Q,Y]of $.headers.entries())if(!Pc4.includes(Q.toLowerCase()))Z.set(Q,Y);return new Response($.body,{status:$.status,statusText:$.statusText,headers:Z})}function fA$($,Z){let Q=yA$($,{error:Z});return Q.headers.set("x-sandbox-preview-not-ready","1"),Q}async function vm($,Z,Q){let Y=await Z.base();if(!Y)return fA$(404,"sandbox not found");let X=new URL($.url);if((X.pathname==="/_sandbox"||X.pathname.startsWith("/_sandbox/"))&&$.method!=="GET")return yA$(404,{error:"not found"});let G=(F)=>`${F}${X.pathname}${X.search}`,W=new Headers($.headers);for(let F of zc4)W.delete(F);let K=$.method!=="GET"&&$.method!=="HEAD",H={method:$.method,headers:W,body:K?$.body:void 0,redirect:"manual",signal:$.signal,duplex:K?"half":void 0};try{return xA$(await fetch(G(Y),H))}catch(F){let U=`${Y}${X.pathname}`;if(console.warn(`[${Q}] preview fetch to ${U} failed: ${F instanceof Error?F.message:String(F)}`),Z.invalidate(),$.method==="GET"||$.method==="HEAD"){let N=await Z.retryBase();if(N)try{return xA$(await fetch(G(N),H))}catch(B){console.warn(`[${Q}] preview fetch retry to ${U} failed: ${B instanceof Error?B.message:String(B)}`)}}return fA$(502,"sandbox daemon unreachable")}}var _m="x-sandbox-preview-not-ready",zc4,Pc4;var QT0=D(()=>{zc4=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length","upgrade"],Pc4=["connection","keep-alive","transfer-encoding","content-encoding","content-length"]});import{createHash as Ac4,randomBytes as Tc4,randomUUID as gA$}from"crypto";import*as iA$ from"net";import{PassThrough as Rc4}from"stream";function hA$($){if($ instanceof Error)return $.message;if($&&typeof $==="object"){let Z=$;if(Z.error instanceof Error)return Z.error.message;if(typeof Z.message==="string"&&Z.message)return Z.message}return String($)}function cA$($){return{pool:$.warmPoolName,org:$.pool.tenant}}class _51{records=new Map;inflight=new Jf;activeGauge=new oA0;stateStore;previewUrlPattern;kubeConfig;capacityProbe;portForward;namespace;sandboxTemplateName;envName;tokenGenerator;idleTtlMs;metrics;previewGateway;sentinelToken;mintCloneUrl;mintPoolCloneUrl;mintOrgFsConfig;forwardPort;daemonAddress;persistCredentials;tenantPools;tenantPoolRefreshMs;templateProbes={};closed=!1;claimWatchAbort=new AbortController;constructor($={}){this.stateStore=$.stateStore??null,this.previewUrlPattern=$.previewUrlPattern??null,this.kubeConfig=$.kubeConfig??yc4(),this.portForward=new a61(this.kubeConfig),this.namespace=$.namespace??qc4,this.sandboxTemplateName=$.sandboxTemplateName??Mc4,this.envName=cc4($.envName),this.tokenGenerator=$.tokenGenerator??(()=>Tc4(Vc4).toString("hex")),this.idleTtlMs=$.idleTtlMs??Sc4,this.metrics=$.meter?fc4($.meter):null,this.previewGateway=$.previewGateway&&$.previewUrlPattern?{...$.previewGateway}:null;let Z=$.sentinelToken?.trim()??"";this.sentinelToken=Z.length>0?Z:null,this.mintCloneUrl=$.mintCloneUrl,this.mintPoolCloneUrl=$.mintPoolCloneUrl,this.mintOrgFsConfig=$.mintOrgFsConfig,this.forwardPort=$.forwardPort,this.daemonAddress=$.daemonAddress??"forward",this.persistCredentials=$.persistCredentials??!0;let Q=$.tenantPools;if(this.tenantPools=this.sentinelToken===null?null:new q51(typeof Q==="function"?Q:()=>Q??[]),this.sentinelToken===null&&(typeof Q==="function"||(Q?.length??0)>0))console.warn(`[${T6}] tenant pools configured without a sentinel token \u2014 ignoring them (warm-pool mode is off)`);this.tenantPoolRefreshMs=$.tenantPoolRefreshMs??_c4,this.startClaimReaper(),this.startCredentialRefresher(),this.startTenantPoolReconciler()}startClaimReaper(){let $=["app.kubernetes.io/managed-by=studio","app.kubernetes.io/name=studio-sandbox",...this.envName?[`${fX.env}=${this.envName}`]:[]].join(",");TA$({kc:this.kubeConfig,namespace:this.namespace,labelSelector:$,signal:this.claimWatchAbort.signal,onDelete:(Z)=>this.invalidateRecord(Z)})}async ensure($,Z={}){let Q=F3($);if(Q.startsWith("s-"))throw Error(`ensure: projectRef has no slug source: ${$.projectRef}`);return this.inflight.run(Q,()=>rA0(this.stateStore,$,(Y)=>this.ensureLocked($,Q,Z,Y)))}async delete($){let Z=await this.getRecord($);if(this.records.delete($),Z)this.dropRecord(Z);if(await this.deleteHttpRouteIfManaged($).catch((Q)=>{console.warn(`[${T6}] HTTPRoute delete failed for ${$}: ${Q instanceof Error?Q.message:String(Q)}`)}),await CA(this.kubeConfig,this.namespace,$),this.stateStore)if(Z)await this.stateStore.delete(Z.id);else await this.stateStore.deleteByHandle($)}lastTermination($){return qL$(this.kubeConfig,this.namespace,fX.sandboxHandle,$,dZ.MAIN_CONTAINER_NAME)}async alive($){return await BD(this.kubeConfig,this.namespace,$)!==void 0}watchClaimLifecycle($,Z){return PA$({kc:this.kubeConfig,namespace:this.namespace,claimName:$,signal:Z})}hasSchedulableCapacity(){return this.capacityProbe??=fL$(this.kubeConfig,this.namespace),this.capacityProbe()}async getPreviewUrl($){let Z=await this.getRecord($);if(!Z)return null;return this.composePreviewUrl(Z)}async proxyDaemonRequest($,Z,Q){let Y=await this.getRecord($);if(!Y&&this.previewUrlPattern&&this.stateStore){let K=await this.stateStore.getByHandle($),H=K?.state,F=H?.token;if(K&&F){let N=`http://${H?.adoptedSandboxName??$}.${this.namespace}.svc.cluster.local:${SU}`;try{let B=await tA0(N,F,Z,Q);if(B.status!==404)return B;try{await B.body?.cancel()}catch{}}catch{}}}if(!Y)Y=await this.resurrectByHandle($);if(!Y)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let X=Y,J=performance.now(),G=0,W=(K)=>{return X=K,{url:K.daemonUrl,token:K.token}};try{let K=await Cm(W(Y),Z,Q,{unauthorized:async()=>{this.invalidateRecord($);let H=await this.getRecord($).catch(()=>null)??await this.resurrectByHandle($).catch(()=>null);return H?W(H):null},unreachable:async()=>{this.invalidateRecord($);let H=await this.resurrectByHandle($)??await this.getRecord($).catch(()=>null);return H?W(H):null}});return G=K.status,K}finally{this.recordProxyDuration("daemon",G,X,performance.now()-J)}}async adoptLiveClaim($,Z){if(this.records.has(Z))return!0;let Q=await BD(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!Q||Q.metadata?.deletionTimestamp)return!1;return await this.inflight.run(Z,async()=>{let X=this.records.get(Z);if(X)return this.toSandbox(X);let J=await this.adopt($,Z,Q);if(!J)throw Error(`cannot adopt live claim ${Z}`);return rA0(this.stateStore,$,(G)=>this.finish(J,G,!0,!0,"adopt"))}).catch(()=>null)!=null}async resolvePreviewUpstreamUrl($){if(this.previewUrlPattern)return`http://${await this.resolveServiceNameForHandle($)}.${this.namespace}.svc.cluster.local:${SU}`;let Z=await this.getRecord($);if(Z)return Z.daemonUrl;let Q=await this.resurrectByHandle($);return Q?Q.daemonUrl:null}async daemonEndpoint($){let Z=await this.getRecord($)??await this.resurrectByHandle($);if(!Z)return null;return{url:this.daemonAddress==="service"?`http://${Z.adoptedSandboxName}.${this.namespace}.svc.cluster.local:${SU}`:Z.daemonUrl,token:Z.token}}listSandboxes(){return[...this.records.values()].map(($)=>{let Z=$.ensureOpts,Q=Z?.tenant;return{handle:$.handle,tenant:Q?{orgId:Q.orgId,userId:Q.userId}:null,repos:[Z?.repo,...Z?.extraRepos??[]].filter((Y)=>Y!==void 0).map(vA$).filter((Y)=>Y!==null),orgFs:Boolean(Z?.orgFsConfigJson)||$.orgFsRedacted===!0}})}async resolveServiceNameForHandle($){let Z=this.records.get($);if(Z)return Z.adoptedSandboxName;if(this.stateStore){let Y=(await this.stateStore.getByHandle($).catch(()=>null))?.state?.adoptedSandboxName;if(Y)return Y}return $}async proxyPreviewRequest($,Z){let Q=performance.now(),Y=this.records.get($)??null,X=0;try{let J=await vm(Z,{base:()=>this.resolvePreviewUpstreamUrl($),invalidate:()=>this.invalidateRecord($),retryBase:async()=>{return await this.resurrectByHandle($).catch(()=>null)?this.resolvePreviewUpstreamUrl($):null}},T6);return X=J.status,J}finally{this.recordProxyDuration("preview",X,Y,performance.now()-Q,$)}}async ensureLocked($,Z,Q,Y){if(Q.image)console.warn(`[${T6}] opts.image ignored (template ${this.sandboxTemplateName} pins image): got ${Q.image}`);if(Y){let G=await Y.get($);if(G){let W=await this.rehydrate($,Z,G);if(W)return await this.refreshDaemonGitCredential(W,Q),await this.relayOrgFsConfig(W.daemonUrl,W.token,Q.orgFsConfigJson),this.finish(W,Y,!1,!0,"resume");await Y.delete($)}}let X=await BD(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(X)if(X.metadata?.deletionTimestamp)await n00(this.kubeConfig,this.namespace,Z).catch((G)=>{console.warn(`[${T6}] wait for terminating claim ${Z} failed: ${G instanceof Error?G.message:String(G)}`)});else if(!M51(X)){let G=await this.join($,Z,Q,X).catch((W)=>{return console.warn(`[${T6}] join of starting claim ${Z} failed, recreating: ${W instanceof Error?W.message:String(W)}`),null});if(G)return this.finish(G,Y,!0,!0,"adopt");await CA(this.kubeConfig,this.namespace,Z).catch(()=>{}),await n00(this.kubeConfig,this.namespace,Z).catch((W)=>{console.warn(`[${T6}] wait for deleted claim ${Z} failed: ${W instanceof Error?W.message:String(W)}`)})}else{let G=await this.adopt($,Z,X).catch((W)=>{return console.warn(`[${T6}] adopt ${Z} failed, recreating: ${W instanceof Error?W.message:String(W)}`),null});if(G)return await this.refreshDaemonGitCredential(G,Q),await this.relayOrgFsConfig(G.daemonUrl,G.token,Q.orgFsConfigJson),this.finish(G,Y,!0,!0,"adopt");await CA(this.kubeConfig,this.namespace,Z).catch(()=>{}),await n00(this.kubeConfig,this.namespace,Z).catch((W)=>{console.warn(`[${T6}] wait for deleted claim ${Z} failed: ${W instanceof Error?W.message:String(W)}`)})}let J=await this.provision($,Z,Q);return this.finish(J,Y,!0,!1,"fresh")}async finish($,Z,Q,Y,X){let J=this.records.get($.handle),G=J!==void 0;if(J&&J.daemonForward!==$.daemonForward)this.closeForwarder(J.daemonForward);if(this.records.set($.handle,$),Q)await this.persist(Z,$);if(Y)await VH0(this.kubeConfig,this.namespace,$.handle,this.computeShutdownTime()).catch((W)=>console.warn(`[${T6}] TTL refresh failed for ${$.handle}: ${W instanceof Error?W.message:String(W)}`));if(this.metrics){let W=k51($.tenant);if(this.metrics.ensureOutcome.add(1,{...W,outcome:X}),!G)this.metrics.active.add(1,W),this.activeGauge.markCounted($.handle)}return this.toSandbox($)}buildEnvMap($,Z){let Q={},Y=[];for(let[X,J]of Object.entries($.env??{}))if(kc4.has(X))Y.push(X);else Q[X]=J;if(Y.length>0)console.warn(`[${T6}] opts.env keys overlap reserved bootstrap names and were dropped: ${Y.join(",")}`);return{...Q,DAEMON_TOKEN:Z.token,DAEMON_BOOT_ID:Z.daemonBootId,APP_ROOT:Z.workdir,PROXY_PORT:String(SU)}}async resolveTemplateName($,Z,Q){let{name:Y,probes:X}=await T51({purpose:$,tenantPool:Z,...Q?{sandboxImage:Q}:{},templateName:this.sandboxTemplateName,probes:this.templateProbes,now:Date.now(),ttlMs:Ic4,exists:(J)=>PL$(this.kubeConfig,this.namespace,J),onAbsent:(J)=>console.warn(`[${T6}] SandboxTemplate ${J} not found (or not readable) \u2014 this claim falls back to a template without that suffix. Upgrade the sandbox-env chart to the version that renders it.`)});return this.templateProbes=X,Y}buildClaim($,Z,Q,Y,X){let J=this.sentinelToken!==null,G=J?[]:Object.entries(this.buildEnvMap(Z,Q)).sort(([H],[F])=>H<F?-1:H>F?1:0).map(([H,F])=>({name:H,value:F})),W=ic4(Z),K=Object.keys(W).length>0;return{apiVersion:`${dZ.CLAIM_API_GROUP}/${dZ.CLAIM_API_VERSION}`,kind:"SandboxClaim",metadata:{name:$,namespace:this.namespace,labels:{"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[fX.env]:this.envName}:{},...V51(Z.tenant)},...K?{annotations:W}:{}},spec:{sandboxTemplateRef:{name:X},additionalPodMetadata:{labels:V51(Z.tenant,{[fX.role]:"claimed",[fX.sandboxHandle]:$,...this.envName?{[fX.env]:this.envName}:{}}),...K?{annotations:W}:{}},env:G,warmpool:SA$(Y,J,X),lifecycle:{shutdownPolicy:"Delete",shutdownTime:this.computeShutdownTime()}}}}async provision($,Z,Q){let Y=this.tokenGenerator(),X=gA$(),J=YT0,G=this.claimTenantPoolBinding(Q),W=this.buildClaim(Z,Q,{token:Y,daemonBootId:X,workdir:J},G,await this.resolveTemplateName(Q.purpose,G!==null,Q.sandboxImage));try{await E41(this.kubeConfig,this.namespace,W)}catch(K){if(K instanceof m00)await n00(this.kubeConfig,this.namespace,Z),await E41(this.kubeConfig,this.namespace,W);else throw K}return this.bind($,Z,Q,G,{token:Y,daemonBootId:X,workdir:J})}claimTenantPoolBinding($){return this.tenantPools?.resolve({tenant:$T0($),image:$.sandboxImage??"default",cloneUrl:$.repo?.cloneUrl,branch:$.repo?.branch})??null}async bind($,Z,Q,Y,{token:X,daemonBootId:J,workdir:G}){let W;try{W=await AL$(this.kubeConfig,this.namespace,Z),await AA$((B)=>this.watchClaimLifecycle(Z,B))}catch(B){throw await CA(this.kubeConfig,this.namespace,Z).catch(()=>{}),B}try{await this.ensureServicePortForAdoptedSandbox(W),await this.ensureHttpRouteForHandle(Z,W,Q.tenant??null)}catch(B){throw await CA(this.kubeConfig,this.namespace,Z).catch(()=>{}),B}let K=await this.openForwarder(W,SU,Z),H=`http://127.0.0.1:${K.localPort}`,F=Y?.repo!=null&&W!==Z,U=this.workloadConfigPayload(Q,F),N=J;try{if(await j51(H),this.sentinelToken!==null){let B=await nA0(H);if(B)N=B.bootId;try{await VU(H,this.sentinelToken,U??{},{rotateToken:X})}catch(O){if(O instanceof EH&&O.status===401)console.warn(`[${T6}] sentinel rejected by adopted pod (handle=${Z}, sandbox=${W}): pod belongs to another claim; tearing down and reprovisioning`);throw O}}else if(U)await VU(H,X,U);await this.relayOrgFsConfig(H,X,Q.orgFsConfigJson)}catch(B){throw this.closeForwarder(K),await this.deleteHttpRouteIfManaged(Z).catch(()=>{}),await CA(this.kubeConfig,this.namespace,Z).catch(()=>{}),B}return{id:$,handle:Z,adoptedSandboxName:W,token:X,workdir:G,daemonUrl:H,daemonForward:K,workload:Q.workload??null,daemonBootId:N,tenant:Q.tenant??null,tenantPoolPodBound:F,ensureOpts:sc4(Q)}}workloadConfigPayload($,Z){return Vm({runtime:$?.workload?.runtime??"node",packageManager:$?.workload?.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:$?.repo??null,extraRepos:$?.extraRepos??[],port:$?.workload?.devPort??uA$,tenant:$?.tenant??void 0,...$?{cloneOnly:$.cloneOnly===!0&&!Z}:{}})}async relayOrgFsConfig($,Z,Q){if(!Q)return;await N10($,Z,Q).catch((Y)=>console.warn("[org-fs] sidecar config relay failed",Y))}async refreshDaemonGitCredential($,Z){let Q=D10(Z);if(!Q)return;try{await VU($.daemonUrl,$.token,Q)}catch(Y){console.warn(`[${T6}] git credential refresh failed for ${$.handle}: ${Y instanceof Error?Y.message:String(Y)}`)}}async withFreshCloneUrl($,Z={}){if(!this.mintCloneUrl)return $;try{let Q=await this.mintCloneUrl($,Z);if(!Q)return $;let{credentialExpiresAt:Y,...X}=$;return{...X,cloneUrl:Q}}catch(Q){return console.warn(`[${T6}] clone credential re-mint failed: ${Q instanceof Error?Q.message:String(Q)}`),$}}async withFreshCredentials($,Z=!1){return{...$,...$.repo?{repo:await this.withFreshCloneUrl($.repo,{tenant:$.tenant})}:{},...$.orgFsConfigJson||Z?{orgFsConfigJson:await oc4($,this.mintOrgFsConfig)}:{}}}startCredentialRefresher(){if(!this.mintCloneUrl)return;let{signal:$}=this.claimWatchAbort;(async()=>{while(!$.aborted){if(await z$(vc4,{signal:$}).catch(()=>{}),$.aborted)break;try{await this.refreshAllGitCredentials()}catch(Z){console.warn(`[${T6}] periodic credential refresh failed: ${Z instanceof Error?Z.message:String(Z)}`)}}})()}startTenantPoolReconciler(){let $=this.tenantPools;if(!$)return;let{signal:Z}=this.claimWatchAbort;(async()=>{while(!Z.aborted){try{await this.reconcileTenantPools($)}catch(Q){console.warn(`[${T6}] tenant pool reconcile failed: ${Q instanceof Error?Q.message:String(Q)}`)}await z$(Cc4,{signal:Z}).catch(()=>{})}})()}listTenantPools(){return this.tenantPools?.pools()??[]}markTenantPoolsDirty($,Z){return Promise.resolve(this.tenantPools?.markDirty($,Z)??[])}async reconcileTenantPools($){let Z=Sm($.pools());for(let Q of $.retain(Z))this.recordPoolGone(Q);for(let Q of Z){let Y=Q.warmPoolName,X=await TL$(this.kubeConfig,this.namespace,Y);if(X===null){console.warn(`[${T6}] tenant pool ${Y}: no SandboxWarmPool (or no selector yet) in ${this.namespace}`);continue}let J=$.takeDirty(Y),G=X.filter((W)=>!W.labels[fX.sandboxHandle]);$.retainPods(Y,new Set(X.map((W)=>W.uid)));for(let W of G){if(this.claimWatchAbort.signal.aborted)return;await this.warmPoolPod($,Q,W,J)}this.recordPoolDepth($,Q,X,G)}}recordPoolGone($){let Z=cA$($);for(let Q of["ready","bound","pending","failed"])this.metrics?.poolPods.record(0,{...Z,state:Q})}recordPoolDepth($,Z,Q,Y){let X=this.metrics?.poolPods;if(!X)return;let J=0,G=0;for(let K of Y){let H=$.pod(K.uid);if(!H)continue;if(H.failures>=XT0)G++;else if(H.lastConfigAt>0)J++}let W=cA$(Z);X.record(J,{...W,state:"ready"}),X.record(Q.length-Y.length,{...W,state:"bound"}),X.record(Y.length-J-G,{...W,state:"pending"}),X.record(G,{...W,state:"failed"})}async warmPoolPod($,Z,Q,Y){let X=Z.warmPoolName,{workload:J}=Z.repo,G=$.pod(Q.uid);if(G&&G.failures>=XT0){if(Date.now()-G.lastFailureAt<lA$)return;$.setPod(Q.uid,{...G,failures:0})}let W=Y||G!==void 0&&Date.now()-G.lastConfigAt>=this.tenantPoolRefreshMs;if(G&&!W)return;let K=await this.allocationCloneUrl(Z);if(!K){this.recordPoolFailure($,Q,X,"clone credential mint failed");return}let H={cloneUrl:K,branch:Z.repo.branch,userName:"",userEmail:""},F=await this.openForwarder(Q.name,SU,Q.name).catch(()=>null);if(!F){this.recordPoolFailure($,Q,X,"port-forward failed");return}let U=`http://127.0.0.1:${F.localPort}`;try{await j51(U);let N=this.sentinelToken;if(!N)return;if(!await this.isPoolPodUnbound(Q))return;let B=Vm({runtime:J.runtime,packageManager:J.packageManager?{name:J.packageManager,...J.packageManagerPath?{path:J.packageManagerPath}:{}}:null,repo:H,port:J.devPort??uA$})??{},{transition:O}=await VU(U,N,B);if(W&&O!=="bootstrap"&&await this.isPoolPodUnbound(Q))await BA$(U,N,"clone");$.setPod(Q.uid,{pool:X,lastConfigAt:Date.now(),lastFailureAt:0,failures:0}),console.log(`[${T6}] tenant pool ${X}: warmed ${Q.name} (${O})`)}catch(N){this.recordPoolFailure($,Q,X,N instanceof Error?N.message:String(N))}finally{this.closeForwarder(F)}}async allocationCloneUrl({pool:$,repo:Z}){if(!this.mintPoolCloneUrl)return`${Z.repoUrl}.git`;try{return await this.mintPoolCloneUrl({tenant:$.tenant,repoUrl:Z.repoUrl,branch:Z.branch})}catch(Q){return console.warn(`[${T6}] tenant pool clone credential mint failed: ${Q instanceof Error?Q.message:String(Q)}`),null}}isPoolPodUnbound($){return RL$(this.kubeConfig,this.namespace,$.name,fX.sandboxHandle)}recordPoolFailure($,Z,Q,Y){let X=$.pod(Z.uid),J=(X?.failures??0)+1;$.setPod(Z.uid,{pool:Q,lastConfigAt:X?.lastConfigAt??0,lastFailureAt:Date.now(),failures:J});let G=J>=XT0?` \u2014 backing off ${lA$/60000}min`:"";console.warn(`[${T6}] tenant pool ${Q}: warming ${Z.name} failed (${J}/${XT0})${G}: ${Y}`)}async refreshAllGitCredentials(){await _A$(this.records.values(),($)=>$.ensureOpts?.repo?.connectionId,async($)=>{if(this.claimWatchAbort.signal.aborted)return;let Z=$.ensureOpts?.repo;if(!Z)return;try{let Q=await this.withFreshCloneUrl(Z,{bufferMs:bc4,tenant:$.ensureOpts?.tenant});await this.refreshDaemonGitCredential($,{...$.ensureOpts,repo:Q}),$.ensureOpts={...$.ensureOpts,repo:Q}}catch(Q){throw console.warn(`[${T6}] git credential refresh failed for ${$.handle}: ${Q instanceof Error?Q.message:String(Q)}`),Q}})}async rebootstrapDaemon($,Z,Q){if(this.sentinelToken===null)return!1;let Y=this.workloadConfigPayload(Q,!1)??{};try{return await VU($,this.sentinelToken,Y,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,Q?.orgFsConfigJson),!0}catch(X){if(X instanceof EH&&X.status===401)try{return await VU($,Z,Y,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,Q?.orgFsConfigJson),!0}catch(J){return console.warn(`[${T6}] re-bootstrap retry with claim token failed: ${J instanceof Error?J.message:String(J)}`),!1}return console.warn(`[${T6}] re-bootstrap failed: ${X instanceof Error?X.message:String(X)}`),!1}}async ensureServicePortForAdoptedSandbox($){if(!this.previewGateway||!this.previewUrlPattern)return;await vL$(this.kubeConfig,this.namespace,$,{name:"daemon",port:SU,targetPort:SU})}async ensureHttpRouteForHandle($,Z,Q){if(!this.previewGateway||!this.previewUrlPattern)return;let Y=ac4(this.previewUrlPattern,$);if(!Y)throw new vY(`Unable to derive preview hostname for ${$} from pattern: ${this.previewUrlPattern}`);let X={apiVersion:`${P41.API_GROUP}/${P41.API_VERSION}`,kind:"HTTPRoute",metadata:{name:$,namespace:this.namespace,labels:V51(Q??void 0,{[fX.role]:"claimed",[fX.sandboxHandle]:$,"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[fX.env]:this.envName}:{}})},spec:{parentRefs:[{kind:"Gateway",group:"gateway.networking.k8s.io",name:this.previewGateway.name,namespace:this.previewGateway.namespace}],hostnames:[Y],rules:[{backendRefs:[{group:"",kind:"Service",name:Z,port:SU}]}]}};await SL$(this.kubeConfig,this.namespace,X)}async deleteHttpRouteIfManaged($){if(!this.previewGateway)return;await CL$(this.kubeConfig,this.namespace,$)}async rehydrate($,Z,Q){let Y=Q.state;if(!Y.adoptedSandboxName&&!Y.podName||!Y.token)return null;let X=await BD(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!X||!M51(X))return null;let J=X.status?.sandbox?.name??Y.adoptedSandboxName??Y.podName??Z,G=await this.openAndProbeDaemon(J,Z);if(!G)return null;if(Y.daemonBootId&&Y.daemonBootId!==G.bootId){if(this.sentinelToken!==null){let W=Y.ensureOpts?await this.withFreshCredentials(Y.ensureOpts,Y.orgFsRedacted===!0):null;if(!await this.rebootstrapDaemon(G.daemonUrl,Y.token,W))return this.closeForwarder(G.daemonForward),null}else console.warn(`[${T6}] daemon restart detected (handle=${Z}): stored bootId=${Y.daemonBootId} live bootId=${G.bootId}`);await this.stateStore?.put($,{handle:Z,state:{...Y,daemonBootId:G.bootId}}).catch((W)=>console.warn(`[${T6}] bootId persist failed for ${Z}: ${W instanceof Error?W.message:String(W)}`))}return{id:$,handle:Z,adoptedSandboxName:J,tenantPoolPodBound:!1,token:Y.token,workdir:Y.workdir??YT0,daemonUrl:G.daemonUrl,daemonForward:G.daemonForward,workload:Y.workload??null,daemonBootId:G.bootId,tenant:Y.tenant??null,ensureOpts:Y.ensureOpts??null,orgFsRedacted:Y.orgFsRedacted===!0}}join($,Z,Q,Y){let X=this.sentinelToken!==null,J=X?this.tokenGenerator():I51(Y,"DAEMON_TOKEN"),G=X?gA$():I51(Y,"DAEMON_BOOT_ID");if(!J||!G)throw new vY(`claim ${Z} carries no daemon token`);return this.bind($,Z,Q,this.claimTenantPoolBinding(Q),{token:J,daemonBootId:G,workdir:YT0})}async adopt($,Z,Q){if(!M51(Q))return null;let Y=Q.status?.sandbox?.name??Z;if(this.sentinelToken!==null)return null;let X=I51(Q,"DAEMON_TOKEN");if(!X)return null;let J=await this.openAndProbeDaemon(Y,Z);if(!J)return null;let G=pc4(Q);if(this.previewGateway)await this.ensureServicePortForAdoptedSandbox(Y).catch((W)=>{console.warn(`[${T6}] Service port backfill failed for ${Z}: ${W instanceof Error?W.message:String(W)}`)}),await this.ensureHttpRouteForHandle(Z,Y,G).catch((W)=>{console.warn(`[${T6}] HTTPRoute backfill failed for ${Z}: ${W instanceof Error?W.message:String(W)}`)});return{id:$,handle:Z,adoptedSandboxName:Y,tenantPoolPodBound:!1,token:X,workdir:YT0,daemonUrl:J.daemonUrl,daemonForward:J.daemonForward,workload:null,daemonBootId:J.bootId,tenant:G,ensureOpts:null}}async openAndProbeDaemon($,Z){let Q=await this.openForwarder($,SU,Z).catch(()=>null);if(!Q)return null;let Y=`http://127.0.0.1:${Q.localPort}`,X=await nA0(Y);if(!X)return this.closeForwarder(Q),null;return{daemonForward:Q,daemonUrl:Y,bootId:X.bootId}}async getRecord($){let Z=this.records.get($);if(Z)return Z;if(!this.stateStore)return null;let Q=await this.stateStore.getByHandle($);if(!Q)return null;let Y=await this.rehydrate(Q.id,$,Q);if(Y)this.records.set($,Y);return Y}async resurrectByHandle($){if(!this.stateStore)return null;let Z=await this.stateStore.getByHandle($);if(!Z)return null;let Q=Z.state,Y=Q.ensureOpts;if(!Y)return null;let X=await this.withFreshCredentials(Y,Q.orgFsRedacted===!0);if(F3(Z.id)!==$)return null;return await this.ensure(Z.id,X),this.records.get($)??null}invalidateRecord($){let Z=this.records.get($);if(!Z)return;this.records.delete($),this.dropRecord(Z)}dropRecord($){if(this.closeForwarder($.daemonForward),this.metrics&&this.activeGauge.consume($.handle))this.metrics.active.add(-1,k51($.tenant))}recordProxyDuration($,Z,Q,Y,X){if(!this.metrics)return;this.metrics.proxyDurationMs.record(Y,{...k51(Q?.tenant??null),source:$,sandbox_handle:Q?.handle??X??"",status_code:Z||0})}composePreviewUrl($){if(this.previewUrlPattern)return sA0(this.previewUrlPattern,$.handle);return`http://127.0.0.1:${$.daemonForward.localPort}/`}toSandbox($){return{handle:$.handle,workdir:$.workdir,previewUrl:this.composePreviewUrl($),warmPoolAdopted:$.tenantPoolPodBound===!0,provider:"kubernetes"}}async persist($,Z){if(!$)return;let Q={adoptedSandboxName:Z.adoptedSandboxName,token:Z.token,workdir:Z.workdir,workload:Z.workload,daemonBootId:Z.daemonBootId,tenant:Z.tenant,...Z.ensureOpts?this.persistCredentials?{ensureOpts:Z.ensureOpts}:rc4(Z.ensureOpts,Z.orgFsRedacted===!0):{}};await $.put(Z.id,{handle:Z.handle,state:Q})}computeShutdownTime(){return new Date(Date.now()+this.idleTtlMs).toISOString()}async releaseAfter($,Z){let Q=await BD(this.kubeConfig,this.namespace,$);if(!Q)return;let Y=nc4(Q.spec?.lifecycle?.shutdownTime,new Date(Date.now()+Z));if(!Y)return;await VH0(this.kubeConfig,this.namespace,$,Y).catch((X)=>console.warn(`[${T6}] release failed for ${$}: ${X instanceof Error?X.message:String(X)}`))}async renewTtl($){let Z=await BD(this.kubeConfig,this.namespace,$);if(!Z)return;let Q=tc4(Z.spec?.lifecycle?.shutdownTime,new Date(Date.now()+this.idleTtlMs));if(!Q)return;await VH0(this.kubeConfig,this.namespace,$,Q).catch((Y)=>console.warn(`[${T6}] TTL renew failed for ${$}: ${Y instanceof Error?Y.message:String(Y)}`))}openForwarder($,Z,Q=$){if(this.forwardPort)return this.forwardPort($,Z,Q);let Y=gc4(Q,Z);return new Promise((X,J)=>{let G=(W,K)=>{let H=iA$.createServer((F)=>this.handleForwardedConnection(F,$,Z,Q));H.once("error",(F)=>{if(F.code==="EADDRINUSE"&&K<xc4){try{H.close()}catch{}let U=S51+(W-S51+1)%pA$;G(U,K+1);return}J(F)}),H.listen(W,"127.0.0.1",()=>{let F=H.address();if(!F||typeof F==="string"){H.close(),J(Error("port-forward listener failed to bind"));return}let U=F.port;X({localPort:U,close:()=>H.close((N)=>{if(N)console.warn(`[${T6}] port-forward close on :${U} errored: ${N.message}`)})})})};G(Y,0)})}handleForwardedConnection($,Z,Q,Y){let X=new Rc4,J=null,G=!1,W=()=>{if(G)return;if(G=!0,X.destroy(),J)try{J.close()}catch{}if(!$.destroyed)$.destroy()};$.pipe(X),$.on("error",W),$.on("close",W),this.portForward.portForward(this.namespace,Z,[Q],$,null,X).then((K)=>{let H=typeof K==="function"?K():K;if(!H){W();return}if(J=H,J.on("close",W),J.on("error",(F)=>{console.warn(`[${T6}] port-forward to ${Z}:${Q} dropped mid-connection: ${hA$(F)}`,JSON.stringify(C51(F))),this.invalidateRecord(Y),W()}),G)try{J.close()}catch{}}).catch((K)=>{console.warn(`[${T6}] port-forward to ${Z}:${Q} failed: ${hA$(K)}`,JSON.stringify(C51(K))),this.invalidateRecord(Y),W()})}closeForwarder($){$.close()}close(){if(this.closed)return;this.closed=!0,this.claimWatchAbort.abort();for(let $ of this.records.values())this.dropRecord($);this.records.clear()}}function fc4($){return{active:$.createUpDownCounter("studio.sandbox.active",{description:"Active sandbox count, by runner kind, owning org, and daemon impl. Cross-checks the cAdvisor-derived count from the cluster \u2014 divergence between the two indicates orphaned claims (studio deleted but K8s didn't reap) or unattributed pods.",unit:"{sandbox}"}),ensureOutcome:$.createCounter("studio.sandbox.ensure.outcome",{description:"Outcome of each ensure() call: fresh provision, resume from state-store after restart, or adopt of a cluster-side claim studio didn't know about. Cold-start ratio is the primary input for warm-pool sizing.",unit:"{call}"}),proxyDurationMs:$.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of studio-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"}),poolPods:$.createGauge("studio.sandbox.pool.pods",{description:"Tenant warm pool depth by pool and state: ready (warmed and unbound \u2014 what a claim can actually bind instantly), bound (serving a user), pending (unbound, not yet warmed), failed (gave up after repeated bootstrap failures). Alert on sustained ready=0: a pool that is always empty is doing nothing while costing N pods.",unit:"{pod}"})}}function C51($){let Z=[],Q=$;for(let Y=0;Y<5&&Q instanceof Error;Y++){let X=Q;if(Z.push({name:X.name,message:X.message,...X.code!==void 0?{code:X.code}:{},...X.errno!==void 0?{errno:X.errno}:{}}),X.cause===Q)break;Q=X.cause}if(Q!==void 0&&!(Q instanceof Error)&&Q!==null){let Y=Q,X=Y.error instanceof Error?C51(Y.error).chain:void 0;Z.push({nonError:String(Q),...typeof Y.type==="string"?{type:Y.type}:{},...typeof Y.message==="string"?{message:Y.message}:{},...Y.code!==void 0?{code:Y.code}:{},...typeof Y.reason==="string"?{reason:Y.reason}:{},...X?{error:X}:{},...X===void 0&&Y.error!==void 0?{rawError:String(Y.error)}:{},keys:Object.keys(Y)})}return{chain:Z}}function yc4(){let $=new kA0;return $.loadFromDefault(),$}function M51($){return Boolean($.status?.conditions?.some((Z)=>Z.type==="Ready"&&Z.status==="True"))}function I51($,Z){let Q=$.spec?.env;if(!Q)return null;for(let Y of Q)if(Y.name===Z&&Y.value)return Y.value;return null}function gc4($,Z){let Q=Ac4("sha256").update(`${$}:${Z}`).digest();return S51+Q.readUInt32BE(0)%pA$}function mA$($){let Z=$.slice(0,uc4);return hc4.test(Z)?Z:""}function cc4($){if($===void 0)return null;let Z=$.trim();if(Z==="")return null;if(!lc4.test(Z))throw Error(`AgentSandboxProvider: envName=${JSON.stringify(Z)} is not a valid DNS-label-safe environment name (lowercase alphanumeric or '-', starts with a letter, ends alphanumeric, \u226432 chars). Studio sets this from STUDIO_ENV; check the studio chart's configMap.`);return Z}function V51($,Z={}){let Q={...Z};if($){let Y=mA$($.orgId),X=mA$($.userId);if(Y)Q[fX.orgId]=Y;if(X)Q[fX.userId]=X}return Q}function Gf($){let Z="";for(let Q of $){let Y=Q.codePointAt(0)??0;Z+=Y<32||Y===127?" ":Q}return Z.slice(0,mc4)}function dc4($){try{let Z=new URL($);return Z.username="",Z.password="",Z.toString()}catch{return""}}function ic4($){let Z={},Q=$.tenant;if(Q?.orgSlug)Z[zH.orgSlug]=Gf(Q.orgSlug);if(Q?.orgName)Z[zH.orgName]=Gf(Q.orgName);if(Q?.userEmail)Z[zH.userEmail]=Gf(Q.userEmail);if(Q?.userName)Z[zH.userName]=Gf(Q.userName);let Y=$.repo;if(Y){if(Y.displayName)Z[zH.gitRepo]=Gf(Y.displayName);let X=dc4(Y.cloneUrl);if(X)Z[zH.gitRepoUrl]=Gf(X);let J=$.branch??Y.branch;if(J)Z[zH.gitBranch]=Gf(J)}return Z}function pc4($){let Z=$.metadata?.labels;if(!Z)return null;let Q=Z[fX.orgId],Y=Z[fX.userId];if(!Q||!Y)return null;let X=$.metadata?.annotations??{};return{orgId:Q,userId:Y,orgSlug:X[zH.orgSlug],orgName:X[zH.orgName],userEmail:X[zH.userEmail],userName:X[zH.userName]}}function nc4($,Z){if($){let Q=new Date($).getTime();if(Number.isFinite(Q)&&Q<=Z.getTime())return null}return Z.toISOString()}function tc4($,Z){if($){let Q=new Date($).getTime();if(Number.isFinite(Q)&&Q>=Z.getTime())return null}return Z.toISOString()}function k51($){return{org_id:$?.orgId??"",user_id:$?.userId??"",runner_kind:"agent-sandbox"}}async function oc4($,Z){if(!Z||!$.tenant)return $.orgFsConfigJson;try{return await Z($.tenant)??$.orgFsConfigJson}catch(Q){return console.warn(`[${T6}] org-fs credential re-mint failed: ${Q instanceof Error?Q.message:String(Q)}`),$.orgFsConfigJson}}function dA$($){try{let Z=new URL($.cloneUrl);Z.username="",Z.password="";let{submoduleCredentials:Q,credentialExpiresAt:Y,...X}=$;return{...X,cloneUrl:Z.toString()}}catch{return null}}function rc4($,Z){let{orgFsConfigJson:Q,repo:Y,extraRepos:X,...J}=$,G=J,W=Y&&dA$(Y);if(W)G.repo=W;if(X)G.extraRepos=X.map(dA$).filter((K)=>K!==null);return Q||Z?{ensureOpts:G,orgFsRedacted:!0}:{ensureOpts:G}}function sc4($){let Z={};if($.branch)Z.branch=$.branch;if($.repo)Z.repo=$.repo;if($.workload)Z.workload=$.workload;if($.env&&Object.keys($.env).length>0)Z.env=$.env;if($.tenant)Z.tenant=$.tenant;if($.cloneOnly)Z.cloneOnly=!0;if($.purpose)Z.purpose=$.purpose;if($.sandboxImage)Z.sandboxImage=$.sandboxImage;if($.orgFsConfigJson)Z.orgFsConfigJson=$.orgFsConfigJson;return Object.keys(Z).length>0?Z:null}function ac4($,Z){try{return new URL(sA0($,Z)).hostname||null}catch{return null}}var T6="AgentSandboxProvider",qc4="agent-sandbox-system",Mc4="studio-sandbox",Ic4=300000,SU=9000,uA$=3000,YT0="/app",Vc4=32,kc4,Sc4=900000,Cc4=60000,_c4=1800000,XT0=3,lA$=1800000,vc4=900000,bc4=1800000,S51=40000,pA$=1e4,xc4=256,fX,zH,hc4,uc4=63,lc4,mc4=253;var nA$=D(()=>{a$();yL$();KA$();Xf();km();kH0();d00();RA$();w10();bA$();ZT0();QT0();kc4=new Set(["DAEMON_TOKEN","DAEMON_BOOT_ID","APP_ROOT","PROXY_PORT"]);fX={role:"studio.decocms.com/role",sandboxHandle:"studio.decocms.com/sandbox-handle",orgId:"studio.decocms.com/org-id",userId:"studio.decocms.com/user-id",env:"studio.decocms.com/env"},zH={orgSlug:"studio.decocms.com/org-slug",orgName:"studio.decocms.com/org-name",userEmail:"studio.decocms.com/user-email",userName:"studio.decocms.com/user-name",gitRepo:"studio.decocms.com/git-repo",gitRepoUrl:"studio.decocms.com/git-repo-url",gitBranch:"studio.decocms.com/git-branch"},hc4=/^([A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?)?$/;lc4=/^[a-z]([a-z0-9-]{0,30}[a-z0-9])?$/});var tA$={};$6(tA$,{tenantPoolSchema:()=>MA$,tenantPoolRepoSchema:()=>L10,tenantPoolFieldsSchema:()=>P51,tenantPoolAllocations:()=>Sm,resolveTenantPoolBinding:()=>A51,renderTenantPoolWarmPools:()=>kA$,normalizeRepoUrl:()=>kU,allocationsMatchingPush:()=>R51,TenantPoolCapacityError:()=>eA0,PREVIEW_NOT_READY_HEADER:()=>_m,AgentSandboxProvider:()=>_51});var j10=D(()=>{nA$();w10()});import{z as Wf}from"zod";function JT0($){if(!$||$.trim()==="")return[];let Z=Wf.array(ec4).parse(JSON.parse($)),Q=new Set;for(let Y of Z){if(Q.has(Y.name))throw Error(`tenant pools: duplicate pool name ${Y.name}`);Q.add(Y.name)}return Z}function oA$($){let Z=kU(`https://github.com/${$.repo}`);if(!Z)throw Error(`tenant pools: bad repo ${$.repo}`);return Z}function rA$($){return $.map((Z)=>({name:Z.name,tenant:Z.orgId,size:1,image:"default",repos:[{repoUrl:oA$(Z),branch:Z.branch,workload:Z.workload,replicas:1,warmPoolName:Z.name}]}))}function v51($,Z){let Q=kU(Z.repoUrl)?.toLowerCase(),Y=$.find((J)=>J.orgId===Z.tenant&&J.branch===Z.branch&&oA$(J).toLowerCase()===Q);if(!Y)return null;let X=`https://github.com/${Y.repo}.git`;return Y.connectionId?{cloneUrl:X,connectionId:Y.connectionId}:{cloneUrl:X}}function sA$($,Z){return async(Q)=>{let Y=v51($,Q);if(!Y)return null;return Y.connectionId?Z(Y):Y.cloneUrl}}var ec4;var GT0=D(()=>{j10();ec4=Wf.object({name:Wf.string().max(63).regex(/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/,"pool name must be a DNS label (lowercase alphanumeric and '-')"),orgId:Wf.string().min(1),repo:Wf.string().regex(/^[^/\s]+\/[^/\s]+$/,"repo must be `owner/name`"),connectionId:Wf.string().min(1).optional(),branch:Wf.string().min(1).default("main"),workload:L10.shape.workload})});function g51($,Z=Date.now()){if($===void 0)return;return $===null?Z+$m4:$.getTime()}function y51($){return JSON.stringify([$.orgId,$.userId])}function aA$($,Z){let Q=kU(Z);return Q?JSON.stringify([$,Q.toLowerCase()]):null}function Qm4($,Z){return"repositoryId"in Z?$.repositoryOrgs.get(Z.repositoryId):$.connectionOrgs.get(Z.connectionId)}function eA$($){let{records:Z,now:Q}=$,Y=new Map,X=new Map,J=new Map,G=0;for(let W of $.pools)for(let{repoUrl:K,branch:H}of W.repos){let F=aA$(W.tenant,K),U=v51($.legacyPools??[],{tenant:W.tenant,repoUrl:K,branch:H});if(F&&U){if(U.connectionId)X.set(F,{tenant:W.tenant,repoUrl:K,connectionId:U.connectionId,cloneUrl:U.cloneUrl});continue}let N=F?Z.orgRepositories.get(F):void 0;if(!F||!N){G++;continue}X.set(F,{tenant:W.tenant,repoUrl:K,repositoryId:N})}for(let W of $.sandboxes){let K=W.tenant;if(!K)continue;let H=Z.members.get(y51(K));if(H===void 0){G++;continue}for(let U of W.repos){if(Qm4(Z,U)!==K.orgId){G++;continue}let N="repositoryId"in U?{repositoryId:U.repositoryId}:{connectionId:U.connectionId,repo:U.repo.toLowerCase()},B={orgId:K.orgId,userId:K.userId};Y.set(JSON.stringify([B,N]),{tenant:B,repo:N})}let F=W.orgFsConfigExpiresAt;if(W.orgFs&&(F===null||F-Q<Zm4))J.set(y51(K),{orgId:K.orgId,userId:K.userId,orgSlug:H})}return{clones:[...Y.values()],poolClones:[...X.values()],orgFs:[...J.values()],refused:G}}async function $T$($,Z,Q){let Y=new Set,X=new Set,J=new Set,G=new Set,W=new Set(Q.map((O)=>O.tenant)),K=new Set;for(let O of Q)for(let{repoUrl:L}of O.repos){let w=IY(L);if(w)K.add(w.path.toLowerCase())}for(let O of Z){if(O.tenant)Y.add(O.tenant.orgId),X.add(O.tenant.userId);for(let L of O.repos)if("repositoryId"in L)G.add(L.repositoryId);else J.add(L.connectionId)}let[H,F,U,N]=await Promise.all([Y.size===0?[]:$.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.organizationId as orgId","member.userId as userId","organization.slug as slug"]).where("member.organizationId","in",[...Y]).where("member.userId","in",[...X]).execute(),J.size===0?[]:$.selectFrom("connections").select(["id","organization_id"]).where("id","in",[...J]).execute(),G.size===0?[]:$.selectFrom("repositories").select(["id","organization_id"]).where("id","in",[...G]).execute(),K.size===0?[]:$.selectFrom("repositories").select(["id","organization_id","provider","host","path"]).where("organization_id","in",[...W]).where((O)=>O(O.fn("lower",["path"]),"in",[...K])).execute()]),B=new Map;for(let O of N){let L=aA$(O.organization_id,Me({provider:O.provider,host:O.host,path:O.path}));if(L&&!B.has(L))B.set(L,O.id)}return{members:new Map(H.map((O)=>[y51(O),O.slug])),connectionOrgs:new Map(F.map((O)=>[O.id,O.organization_id])),repositoryOrgs:new Map(U.map((O)=>[O.id,O.organization_id])),orgRepositories:B}}function f51($){return $ instanceof Error?$.message:String($)}async function ZT$($,Z,Q){let Y=0;if($.clones.length>bm||$.poolClones.length>bm||$.orgFs.length>x51)console.warn(`[sandbox-credential-push] ${$.clones.length} clone, ${$.poolClones.length} pool clone and ${$.orgFs.length} org-fs mints planned; minting the first ${bm}, ${bm} and ${x51}`);let X=await F9($.clones.slice(0,bm),b51,async(U)=>{let N="repositoryId"in U.repo?{cloneUrl:"",repositoryId:U.repo.repositoryId}:{cloneUrl:`https://github.com/${U.repo.repo}.git`,connectionId:U.repo.connectionId};try{let B=await Z.mintCloneUrl(N,{bufferMs:WT0});return B?{tenant:U.tenant,repo:U.repo,cloneUrl:B,expiresAt:Q.now+WT0}:null}catch(B){return Y++,console.warn(`[sandbox-credential-push] clone mint failed: ${f51(B)}`),null}}),J=await F9($.poolClones.slice(0,bm),b51,async(U)=>{try{let N=await Z.mintCloneUrl("repositoryId"in U?{cloneUrl:"",repositoryId:U.repositoryId}:{cloneUrl:U.cloneUrl,connectionId:U.connectionId},{bufferMs:WT0});return N?{tenant:U.tenant,repoUrl:U.repoUrl,cloneUrl:N,expiresAt:Q.now+WT0}:null}catch(N){return Y++,console.warn(`[sandbox-credential-push] pool clone mint failed: ${f51(N)}`),null}}),G=await F9($.orgFs.slice(0,x51),b51,async(U)=>{try{let N=await Z.mintOrgFsConfig(U);return N?{tenant:{orgId:U.orgId,userId:U.userId},orgFsConfigJson:N,expiresAt:Q.now+Q.orgFsLifetimeMs}:null}catch(N){return Y++,console.warn(`[sandbox-credential-push] org-fs mint failed: ${f51(N)}`),null}}),W=X.filter((U)=>U!==null),K=J.filter((U)=>U!==null),H=G.filter((U)=>U!==null),F=[];for(let U=0;U<Math.max(W.length,K.length,H.length);U+=bj)F.push({cloneUrls:W.slice(U,U+bj),poolCloneUrls:K.slice(U,U+bj),orgFsConfigs:H.slice(U,U+bj)});return{batches:F,failed:Y}}var WT0=2700000,KT0,$m4=86400000,Zm4=86400000,b51=8,bm=2000,x51=200;var HT0=D(()=>{w41();j10();i4();a$();vj();GT0();KT0=sO$-3600000});var yX;var E10=D(()=>{yX=class yX extends Error{code;status;path;constructor($,Z,Q){super(Z.message||`Freestyle API error: ${Z.code}`);this.name="FreestyleApiError",this.code=Z.code,this.status=$,this.path=Q,Object.setPrototypeOf(this,yX.prototype)}}});function QT$(){return typeof process<"u"&&Boolean(process.versions?.node)}var FT0=($,Z)=>globalThis.fetch($,Z);async function Ym4(){if(!QT$())return null;try{return await import("undici")}catch{return null}}async function Jm4(){let $=await Ym4();if(!$)return null;let Z=new $.Agent({allowH2:!0,connections:Xm4});return(Q,Y)=>$.fetch(Q,{...Y,dispatcher:Z})}function Gm4($){return(typeof $==="string"?$:$ instanceof URL?$.href:$.url).startsWith("https:")}function YT$(){let $,Z=()=>{return $??=Jm4().then((Q)=>Q??FT0).catch(()=>FT0),$};return(Q,Y)=>Gm4(Q)?Z().then((X)=>X(Q,Y)):FT0(Q,Y)}var Xm4=4;var XT$=()=>{};function Nm4($){return new Promise((Z)=>setTimeout(Z,$))}function Bm4($){if(!$)return"";let Z=new URLSearchParams;for(let[Y,X]of Object.entries($)){if(X===void 0||X===null)continue;Z.set(Y,String(X))}let Q=Z.toString();return Q?`?${Q}`:""}function u6($){return encodeURIComponent($)}class h51{baseUrl;authenticationHeaders;fetchImpl;backgroundEligible;constructor($={}){if(this.baseUrl=($.baseUrl??Um4).replace(/\/+$/,""),!$.fetch&&!globalThis.fetch)throw Error("No fetch implementation available. Pass `fetch` in FreestyleOptions when running on a runtime without a global fetch.");if(this.fetchImpl=$.fetch??YT$(),"identityAccessToken"in $&&$.identityAccessToken){this.authenticationHeaders={[Wm4]:$.identityAccessToken},this.backgroundEligible=!1;return}if(this.backgroundEligible=!0,"stackAccessToken"in $&&$.stackAccessToken){this.authenticationHeaders={Authorization:`Bearer ${$.stackAccessToken}`,"X-Freestyle-Team-Id":$.teamId};return}let Z=$.apiKey??globalThis.process?.env?.FREESTYLE_API_KEY;if(!Z)throw Error("No Freestyle API key provided. Pass `apiKey` in FreestyleOptions or set FREESTYLE_API_KEY.");this.authenticationHeaders={Authorization:`Bearer ${Z}`}}authHeaders(){return{...this.authenticationHeaders}}url($,Z){return`${this.baseUrl}${$}${Bm4(Z)}`}async fetch($,Z={}){let Q=new Headers(Z.headers);for(let[Y,X]of Object.entries(this.authHeaders()))if(!Q.has(Y))Q.set(Y,X);return this.fetchImpl(this.absoluteUrl($),{...Z,headers:Q})}absoluteUrl($){return/^https?:\/\//i.test($)?$:`${this.baseUrl}${$}`}async request($,Z,{query:Q,body:Y,rawBody:X,signal:J}={}){let G={...this.authHeaders()};if(this.backgroundEligible)G[JT$]=String(Hm4);let W;if(X!==void 0)G["Content-Type"]="application/octet-stream",W=X;else if(Y!==void 0)G["Content-Type"]="application/json",W=JSON.stringify(Y);let K=this.url(Z,Q),H=await this.fetchImpl(K,{method:$,headers:G,body:W,signal:J});if(this.backgroundEligible&&H.status===202)try{return await this.pollBackgroundRequest(H,Z)}catch(F){if($==="GET"&&F instanceof yX&&F.code==="BACKGROUND_RESULT_UNSTORABLE"){delete G[JT$];let U=await this.fetchImpl(K,{method:$,headers:G,body:W});return this.finalize(U,Z)}throw F}return this.finalize(H,Z)}async pollBackgroundRequest($,Z){let Q=await $.json().catch(()=>({})),Y=$.headers.get(Km4)??Q.requestId,X=Q.resultUrl??(Y?`/v5/background-requests/${u6(Y)}`:void 0);if(!X)throw new yX($.status,{code:"BACKGROUND_PROTOCOL_ERROR",message:"202 Accepted carried no background request id"},Z);let J=0;for(;;){await Nm4(Fm4);let G;try{G=await this.fetch(X,{method:"GET"}),J=0}catch(W){if(++J>=5)throw W;continue}if(G.status===202)continue;return this.finalize(G,Z)}}async finalize($,Z){if(!$.ok){let Y;try{Y=await $.json()}catch{Y={code:"UNKNOWN_ERROR",message:await $.text().catch(()=>$.statusText)}}throw new yX($.status,Y,Z)}if($.status===204)return;let Q=await $.text();if(!Q)return;return JSON.parse(Q)}get($,Z){return this.request("GET",$,{query:Z})}post($,Z){return this.request("POST",$,{body:Z??{}})}patch($,Z){return this.request("PATCH",$,{body:Z??{}})}put($,Z){return this.request("PUT",$,{body:Z??{}})}putEmpty($){return this.request("PUT",$,{})}putBytes($,Z,Q,Y){return this.request("PUT",$,{query:Q,rawBody:Z,signal:Y})}async getBytes($,Z,Q={}){let Y={...this.authHeaders()};if(Q.range)Y.Range=Q.range;let X=await this.fetchImpl(this.url($,Z),{method:"GET",headers:Y,signal:Q.signal});if(!X.ok){let J;try{J=await X.json()}catch{J={code:"UNKNOWN_ERROR",message:await X.text().catch(()=>X.statusText)}}throw new yX(X.status,J,$)}return X}delete($,Z){return this.request("DELETE",$,{query:Z})}}var Wm4="x-freestyle-identity-access-token",JT$="x-freestyle-background-after-secs",Km4="x-freestyle-background-request-id",Hm4=5,Fm4=2000,Um4="https://api.freestyle.sh";var _W=D(()=>{E10();XT$()});class u51{client;verifications;certificates;placeholder;constructor($){this.client=$,this.verifications=new GT$($),this.certificates=new WT$($),this.placeholder=new KT$($)}async list(){let{domains:$}=await this.client.get("/v5/domains");return $}}class GT${client;constructor($){this.client=$}create($){return this.client.post("/v5/verifications",{domain:$})}async list($={}){let{verifications:Z}=await this.client.get("/v5/verifications",$);return Z}get($){return this.client.get(`/v5/verifications/${u6($)}`)}complete($){return this.client.putEmpty(`/v5/verifications/${u6($)}`)}delete($){return this.client.delete(`/v5/verifications/${u6($)}`)}}class WT${client;constructor($){this.client=$}async list(){let{certificates:$}=await this.client.get("/v5/certificates");return $}createWildcard($){return this.client.post("/v5/certificates/wildcard",{domain:$})}}class KT${client;constructor($){this.client=$}async get(){try{return await this.client.get("/v5/domains/placeholder")}catch($){if($ instanceof yX&&$.status===404)return null;throw $}}set($){return this.client.put("/v5/domains/placeholder",$)}delete(){return this.client.delete("/v5/domains/placeholder")}}var l51=D(()=>{_W();E10()});function a6($,Z){throw new m51($,Z)}function c51($){return Dm4.some((Z)=>$[Z]!==void 0)}function d51($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function Lm4($,Z){let Q=Z.lastIndexOf("/");if(Q<0)a6($,`${$} \`${Z}\` is not a CIDR: expected address/prefix, e.g. 203.0.113.0/24 or 2001:db8::/32`);let Y=Z.slice(0,Q),X=Z.slice(Q+1);if(!/^\d+$/.test(X))a6($,`${$} \`${Z}\`: prefix length must be a number`);let J=Number(X),G=Y.includes(":"),W=G?128:32;if(J>W)a6($,`${$} \`${Z}\`: prefix length must be 0\u2013${W}`);if(!G&&!/^\d{1,3}(\.\d{1,3}){3}$/.test(Y))a6($,`${$} \`${Z}\`: \`${Y}\` is not an IP address`)}function NT$($,Z){if(!d51($))a6(Z,`${Z} must be an object`);for(let Y of Object.keys($))if(!HT$.includes(Y))a6(`${Z}.${Y}`,`${Z} has unknown field \`${Y}\`. Expected one of: ${HT$.join(", ")}`);let Q=$;for(let Y of["vmId","vpcId","tunnelId","cidr"]){let X=Q[Y];if(X!==void 0&&(typeof X!=="string"||X.length===0))a6(`${Z}.${Y}`,`${Z}.${Y} must be a non-empty string`)}if(Q.public!==void 0&&Q.public!==!0)a6(`${Z}.public`,`${Z}.public must be true when present: it declares the public Internet. Omit the field to match something else`);if(Q.public===!0){if(Q.vmId!==void 0)a6(`${Z}.public`,`${Z} cannot combine \`public: true\` with \`vmId\`: that would mean the VM only when reached over its public address, a distinction this API does not make yet. Use \`vmId\` alone to match the VM on any path, or \`public: true\` alone to match public addresses`);if(Q.vpcId!==void 0)a6(`${Z}.public`,`${Z} cannot combine \`public: true\` with \`vpcId\`: that would mean the network's members only when reached over their public addresses, a distinction this API does not make yet. Use \`vpcId\` alone or \`public: true\` alone`);if(Q.tunnelId!==void 0)a6(`${Z}.public`,`${Z} cannot combine \`public: true\` with \`tunnelId\`: traffic through a tunnel arrives over the tunnel, not over the public Internet. Use \`tunnelId\` alone`)}if(Q.cidr!==void 0)Lm4(`${Z}.cidr`,Q.cidr);if(Q.protocol!==void 0&&!FT$.includes(Q.protocol))a6(`${Z}.protocol`,`${Z}.protocol must be one of: ${FT$.join(", ")} (got \`${String(Q.protocol)}\`)`);if(Q.port!==void 0){if(!Number.isInteger(Q.port)||Q.port<1||Q.port>65535)a6(`${Z}.port`,`${Z}.port must be an integer between 1 and 65535`);if(Q.protocol===void 0)a6(`${Z}.protocol`,`${Z}.port ${Q.port} requires ${Z}.protocol: set it to "tcp" or "udp" so the rule opens one transport rather than both`);if(!Om4.includes(Q.protocol))a6(`${Z}.port`,`${Z}.protocol "${Q.protocol}" has no ports; remove ${Z}.port ${Q.port}`)}}function OT$($,Z){if(!d51($))a6(Z||"rule",`${Z||"rule"} must be an object`);for(let Y of Object.keys($))if(!BT$.includes(Y))a6(`${Z}${Y}`,`Unknown field \`${Y}\`. Expected one of: ${BT$.join(", ")}`);let Q=$;if(Q.action===void 0)a6(`${Z}action`,`${Z}action is required. Write \`action: "allow"\` \u2014 every rule states what it does rather than defaulting to it`);if(Q.action!=="allow")a6(`${Z}action`,`${Z}action must be "allow" (got \`${String(Q.action)}\`). Only allow rules exist today`);if(Q.description!==void 0){if(typeof Q.description!=="string")a6(`${Z}description`,"description must be a string");if(Q.description.length>UT$)a6(`${Z}description`,`description is too long (${Q.description.length} characters, maximum ${UT$})`)}if(Q.source===void 0)a6(`${Z}source`,`${Z}source is required`);if(Q.destination===void 0)a6(`${Z}destination`,`${Z}destination is required`);return NT$(Q.source,`${Z}source`),NT$(Q.destination,`${Z}destination`),Q}function wm4($){let Z=OT$($,"");for(let Q of["source","destination"]){let Y=Z[Q];if(c51(Y))continue;let X=[Y.port!==void 0?`port ${Y.port}`:void 0,Y.protocol!==void 0?`protocol ${Y.protocol}`:void 0].filter(Boolean).join(", ");a6(Q,X?`${Q} only narrows traffic (${X}) without saying what it is. Add \`vmId\`, \`vpcId\`, \`tunnelId\`, \`cidr\`, or \`public: true\`. Leaving it out to mean "this VM" only works inside vms.create`:`${Q} is empty. A matcher must say what the traffic is: \`vmId\`, \`vpcId\`, \`tunnelId\`, \`cidr\`, or \`public: true\` for the public Internet`)}return Z}function UT0($,Z="VM"){if($===void 0||$===null)a6("firewall",`firewall is required on a ${Z} create. A ${Z} gets nothing implicitly, so state what it may reach \u2014 \`{ rules: [] }\` if the answer is nothing`);if(!d51($))a6("firewall","firewall must be an object with a `rules` array");for(let Y of Object.keys($))if(Y!=="rules")a6(`firewall.${Y}`,`firewall has unknown field \`${Y}\`. Expected: rules`);let Q=$.rules;if(!Array.isArray(Q))a6("firewall.rules","firewall.rules must be an array");return Q.forEach((Y,X)=>{let J=`firewall.rules[${X}].`,G=OT$(Y,J),W=c51(G.source),K=c51(G.destination);if(!W&&!K&&Z!=="network")a6(`firewall.rules[${X}]`,`firewall.rules[${X}]: both source and destination refer to the ${Z} being created, which allows nothing. Give one of them a \`vmId\`, \`vpcId\`, \`tunnelId\`, \`cidr\`, or \`public: true\``);if(W&&K)a6(`firewall.rules[${X}]`,`firewall.rules[${X}]: neither end refers to the ${Z} being created. Leave one endpoint's identity unset so it means this ${Z}, or create the rule with firewall.rules.create instead`)}),$}function DT$($){return`/v5/firewall/rules/${u6($)}`}class LT${client;constructor($){this.client=$}async create($){let Z=wm4($);return this.client.post("/v5/firewall/rules",Z)}list($={}){return this.client.get("/v5/firewall/rules",$)}get($){return this.client.get(DT$($))}delete($){return this.client.delete(DT$($))}}class i51{client;rules;constructor($){this.client=$,this.rules=new LT$($)}evaluate($){return this.client.post("/v5/firewall/evaluate",$)}}var m51,HT$,Dm4,FT$,Om4,UT$=1024,BT$;var z10=D(()=>{_W();m51=class m51 extends Error{path;constructor($,Z){super(Z);this.name="FirewallRuleValidationError",this.path=$,Object.setPrototypeOf(this,m51.prototype)}};HT$=["vmId","vpcId","tunnelId","cidr","public","port","protocol"],Dm4=["vmId","vpcId","tunnelId","cidr","public"],FT$=["tcp","udp","icmp"],Om4=["tcp","udp"];BT$=["action","source","destination","description"]});function p51($){return`/v5/identities/${u6($)}`}class wT${client;basePath;constructor($,Z){this.client=$,this.basePath=Z}create(){return this.client.post(`${this.basePath}/tokens`)}list(){return this.client.get(`${this.basePath}/tokens`)}revoke($){return this.client.delete(`${this.basePath}/tokens/${u6($)}`)}}class jT${client;basePath;constructor($,Z){this.client=$,this.basePath=Z}list(){return this.client.get(`${this.basePath}/permissions/vm`)}grant($){return this.client.post(`${this.basePath}/permissions/vm`,$)}get($){return this.client.get(`${this.basePath}/permissions/vm/${u6($)}`)}update($,Z){return this.client.patch(`${this.basePath}/permissions/vm/${u6($)}`,{allowedLinuxUsers:Z})}revoke($){return this.client.delete(`${this.basePath}/permissions/vm/${u6($)}`)}}class n51{id;tokens;permissions;client;basePath;constructor($,Z){this.client=$,this.id=Z,this.basePath=p51(Z),this.tokens=new wT$($,this.basePath),this.permissions={vm:new jT$($,this.basePath)}}data(){return this.client.get(this.basePath)}delete(){return this.client.delete(this.basePath)}}class t51{client;constructor($){this.client=$}async create($={}){let Z=await this.client.post("/v5/identities",$);return{identity:new n51(this.client,Z.id),identityId:Z.id,data:Z}}list($={}){return this.client.get("/v5/identities",$)}get($){return this.client.get(p51($))}ref($){return new n51(this.client,$)}delete($){return this.client.delete(p51($))}}var o51=D(()=>{_W()});function v1($,Z){throw new e51($,Z)}function Y7($,Z){throw new $91($,Z)}function P10($){return jm4.some((Z)=>$[Z]!==void 0)}function Mm4($){return!P10($)&&$.port===void 0}function fY($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function _T$($,Z,Q){if(typeof $!=="string"||!Am4.test($))Y7(Z,`${Z} must be a valid HTTP header name`);let Y=$.toLowerCase();if(qm4.has(Y)||Y.startsWith("x-forwarded-")||Y.startsWith("x-freestyle-")||Q&&(Y==="cookie"||Y==="set-cookie"))Y7(Z,`${Z} may not use reserved header \`${$}\``)}function Im4($,Z){if(!Array.isArray($))Y7(Z,`${Z} must be an array of header names`);if($.length>qT$)Y7(Z,`${Z} may contain at most ${qT$} names`);let Q=new Set;$.forEach((Y,X)=>{_T$(Y,`${Z}[${X}]`,!0);let J=Y.toLowerCase();if(Q.has(J))Y7(`${Z}[${X}]`,`${Z} contains duplicate header \`${Y}\``);Q.add(J)})}function IT$($){if(!fY($))Y7("forwardAuth","forwardAuth must be an object");for(let Y of Object.keys($))if(!PT$.includes(Y))Y7(Y,`Unknown field \`${Y}\`. Expected one of: ${PT$.join(", ")}`);let Z=$;if(typeof Z.url!=="string"||Z.url.length===0||Z.url.length>Tm4)Y7("url","url is required and must be an absolute HTTPS URL");let Q;try{Q=new URL(Z.url)}catch{Y7("url","url must be an absolute HTTPS URL")}if(Q.protocol!=="https:"||Q.hostname.length===0||Q.username.length>0||Q.password.length>0||Q.hash.length>0||Q.port==="0")Y7("url","url must be an absolute HTTPS URL");if(Z.headers!==void 0){if(!fY(Z.headers))Y7("headers","headers must be an object of header name to value");let Y=Object.entries(Z.headers);if(Y.length>TT$)Y7("headers",`headers may contain at most ${TT$} entries`);let X=0,J=new Set;for(let[G,W]of Y){_T$(G,`headers.${G}`,!1);let K=G.toLowerCase();if(J.has(K))Y7(`headers.${G}`,`headers contains duplicate header \`${G}\``);if(J.add(K),typeof W!=="string"||/[\0\r\n]/.test(W))Y7(`headers.${G}`,`headers.${G} must be a string`);X+=G.length+W.length}if(X>RT$)Y7("headers",`headers may contain at most ${RT$} bytes`)}if(Z.timeoutMs!==void 0&&(!Number.isInteger(Z.timeoutMs)||Z.timeoutMs<100||Z.timeoutMs>5000))Y7("timeoutMs","timeoutMs must be an integer between 100 and 5000");if(Z.protectedCookies!==void 0){if(!Array.isArray(Z.protectedCookies))Y7("protectedCookies","protectedCookies must be an array of cookie names");if(Z.protectedCookies.length>MT$)Y7("protectedCookies",`protectedCookies may contain at most ${MT$} names`);let Y=new Set;Z.protectedCookies.forEach((X,J)=>{if(typeof X!=="string"||X.length>Rm4||!Pm4.test(X))Y7(`protectedCookies[${J}]`,`protectedCookies[${J}] must be a valid HTTP cookie name`);if(Y.has(X))Y7(`protectedCookies[${J}]`,`protectedCookies contains duplicate cookie \`${X}\``);Y.add(X)})}if(Z.authResponseHeaders!==void 0)Im4(Z.authResponseHeaders,"authResponseHeaders");return Z}function Vm4($,Z){if(!fY($))v1(Z,`${Z} must be an object with an \`id\``);for(let Y of Object.keys($))if(!AT$.includes(Y))v1(`${Z}.${Y}`,`${Z} has unknown field \`${Y}\`. Expected: ${AT$.join(", ")}`);let Q=$.id;if(typeof Q!=="string"||Q.length===0)v1(`${Z}.id`,`${Z}.id is required and must be a non-empty string`)}function a51($){if(typeof $!=="string")v1("domain","domain is required and must be a string");if($==="*")return;let Z=$.startsWith("*.")?$.slice(2):$;if(Z.length===0||Z.length>Em4)v1("domain",`domain \`${$}\` is not a hostname`);let Q=Z.split(".");if(Q.length<2)v1("domain",`domain \`${$}\` must have at least two labels, e.g. acme.com`);for(let Y of Q){if(Y.length===0||Y.length>zm4)v1("domain",`domain \`${$}\` has an empty or over-long label`);if(!/^[a-z0-9-]+$/.test(Y))v1("domain",`domain \`${$}\`: labels are lowercase letters, digits, and hyphens (a \`*.\` prefix is the only wildcard)`);if(Y.startsWith("-")||Y.endsWith("-"))v1("domain",`domain \`${$}\`: a label cannot start or end with a hyphen`)}}function km4($){if(typeof $!=="string")v1("domain","domain is required and must be a string");let Z=$.lastIndexOf("@");if(Z===-1){a51($);return}let Q=$.slice(0,Z),Y=$.slice(Z+1);if(Q.length===0||Q.length>64)v1("domain",`mail route \`${$}\`: the part before \`@\` must be 1-64 characters`);if(Q.startsWith(".")||Q.endsWith(".")||Q.includes(".."))v1("domain",`mail route \`${$}\`: the part before \`@\` cannot start or end with a dot, or contain \`..\``);for(let X of Q)if(!/[a-zA-Z0-9]/.test(X)&&!VT$.includes(X))v1("domain",`mail route \`${$}\`: the part before \`@\` may use letters, digits, dots, and \`${VT$.slice(0,-1)}\` (quoted mailboxes are not supported)`);if(Y==="*")v1("domain",`mail route \`${$}\`: \`*\` is not a mail domain \u2014 name the domain the mailbox lives at`);a51(Y)}function kT$($,Z){if(!fY($))v1(Z,`${Z} must be an object`);for(let Y of Object.keys($))if(!ET$.includes(Y))v1(`${Z}.${Y}`,`${Z} has unknown field \`${Y}\`. Expected one of: ${ET$.join(", ")}`);let Q=$;for(let Y of["vmId","vpcId","host"]){let X=Q[Y];if(X!==void 0&&(typeof X!=="string"||X.length===0))v1(`${Z}.${Y}`,`${Z}.${Y} must be a non-empty string`)}if(Q.public!==void 0&&Q.public!==!0)v1(`${Z}.public`,`${Z}.public must be true when present. Omit the field to match something else`);if(Z==="source"){if(Q.host!==void 0)v1("source.host","source.host is not allowed: a source is who opens the session, not where it lands. Put `host` on the destination");if(Q.port!==void 0)v1("source.port","source.port is not allowed: a source is who opens the session, not where it lands. Put `port` on the destination");if(Q.public===!0&&(Q.vmId!==void 0||Q.vpcId!==void 0))v1("source.public","source cannot combine `public: true` with `vmId` or `vpcId`: use one alone. `public` is every client on the Internet; `vmId`/`vpcId` is a specific dialer")}else{if(Q.vpcId!==void 0)v1("destination.vpcId","destination.vpcId is not allowed: a session lands in one place, not on a whole network. Name a `vmId`, a `host`, or `public: true` for the domain's own origin. A whole network may be a source");if([Q.vmId!==void 0,Q.host!==void 0,Q.public===!0].filter(Boolean).length>1)v1("destination","destination names more than one landing: give exactly one of `vmId`, `host`, or `public: true`");if((Q.vmId!==void 0||Q.host!==void 0)&&Q.port===void 0)v1("destination.port",`destination.port is required with ${Q.vmId!==void 0?"`vmId`":"`host`"}: say which port the session lands on`)}if(Q.port!==void 0){if(!Number.isInteger(Q.port)||Q.port<1||Q.port>65535)v1(`${Z}.port`,`${Z}.port must be an integer between 1 and 65535`)}}function Sm4($){if("postgres"in $)return"postgres";if("smtp"in $)return"smtp";if("socks5"in $)return"socks5";return"http"}function Cm4($,Z){function Q(W,K,H){if(!fY(W)||Object.keys(W).some((F)=>!K.includes(F)))v1(H,`${H} must contain only ${K.join(", ")}`)}if(Q($,["region","credentials","scope"],Z),typeof $.region!=="string"||!/^[a-z0-9-]{1,63}$/.test($.region))v1(`${Z}.region`,"invalid s3.region");Q($.credentials,["accessKeyId","secretAccessKey","sessionToken"],`${Z}.credentials`);for(let W of["accessKeyId","secretAccessKey","sessionToken"]){let K=$.credentials[W];if(W==="sessionToken"&&K===void 0)continue;if(typeof K!=="string"||!/^[\x21-\x7e]{1,16384}$/.test(K))v1(`${Z}.credentials.${W}`,"invalid s3 credentials")}if(!/^[a-zA-Z0-9]+$/.test($.credentials.accessKeyId))v1(`${Z}.credentials.accessKeyId`,"invalid s3 access key id");Q($.scope,["bucket","prefix","operations"],`${Z}.scope`);let{bucket:Y,prefix:X,operations:J}=$.scope;if(typeof Y!=="string"||!/^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/.test(Y)||Y.includes(".."))v1(`${Z}.scope.bucket`,"invalid s3.scope.bucket");if(typeof X!=="string"||Buffer.byteLength(X,"utf8")>1024||/[\x00-\x1f\x7f-\x9f]/u.test(X))v1(`${Z}.scope.prefix`,"invalid s3.scope.prefix");let G=["GetObject","HeadObject","PutObject","DeleteObject","ListObjectsV2","CreateMultipartUpload","UploadPart","ListParts","CompleteMultipartUpload","AbortMultipartUpload","ListMultipartUploads"];if(!Array.isArray(J)||J.length===0||J.length>G.length||J.some((W)=>!G.includes(W))||new Set(J).size!==J.length)v1(`${Z}.scope.operations`,"s3.scope.operations must be a nonempty list of distinct supported operations")}function _m4($,Z){if(!fY($))v1(Z,`${Z} must be an object: \`{ headers: { \u2026 } }\`, \`{ postgres: { \u2026 } }\`, \`{ smtp: { \u2026 } }\` or \`{ socks5: { \u2026 } }\``);let Q=Object.keys($);if(Q.length!==1||!["headers","jsonPatch","postgres","smtp","socks5","s3"].includes(Q[0]??""))v1(Z,`${Z} must have exactly one of \`headers\`, \`jsonPatch\`, \`postgres\`, \`smtp\`, \`socks5\` or \`s3\` (got: ${Q.length===0?"nothing":Q.join(", ")})`);if(Q[0]==="s3"){Cm4($.s3,`${Z}.s3`);return}if(Q[0]==="jsonPatch"){let Y=$.jsonPatch;if(!Array.isArray(Y)||Y.length>128)v1(Z,`${Z}.jsonPatch must be an array of at most 128 operations`);let X=(W)=>typeof W==="string"&&(W===""||W.startsWith("/"))&&!/~(?:[^01]|$)/u.test(W),J=(W,K=new Set,H=0)=>{if(H>64)return!1;if(W===null||typeof W==="string"||typeof W==="boolean")return!0;if(typeof W==="number")return Number.isFinite(W);if(typeof W!=="object"||K.has(W))return!1;K.add(W);let F=(Array.isArray(W)?Array.from(W):fY(W)?Object.values(W):[void 0]).every((U)=>J(U,K,H+1));return K.delete(W),F};for(let[W,K]of Y.entries()){if(!fY(K)||!["add","remove","replace","move","copy","test"].includes(String(K.op))||!X(K.path))v1(Z,`${Z}.jsonPatch[${W}] requires a standard op and valid JSON Pointer path`);if(["move","copy"].includes(K.op)&&!X(K.from))v1(Z,`${Z}.jsonPatch[${W}].from must be a JSON Pointer`);if(["add","replace","test"].includes(K.op)&&(!Object.hasOwn(K,"value")||!J(K.value)))v1(Z,`${Z}.jsonPatch[${W}].value must be a JSON value (null is allowed)`)}let G;try{G=JSON.stringify(Y)}catch{v1(Z,"jsonPatch must be JSON serializable")}if(Buffer.byteLength(G,"utf8")>65536)v1(Z,"jsonPatch exceeds 64 KiB");return}if(Q[0]==="socks5"){let Y=$.socks5;if(!fY(Y))v1(`${Z}.socks5`,`${Z}.socks5 must be an object with \`username\` and \`password\``);for(let X of Object.keys(Y))if(!["username","password"].includes(X))v1(`${Z}.socks5.${X}`,`${Z}.socks5 has unknown field \`${X}\`. Expected: username, password`);for(let X of["username","password"])if(typeof Y[X]!=="string"||Y[X].length===0)v1(`${Z}.socks5.${X}`,`${Z}.socks5.${X} is required and must be a non-empty string`);return}if(Q[0]==="smtp"){let Y=$.smtp;if(!fY(Y))v1(`${Z}.smtp`,`${Z}.smtp must be an object with \`username\` and \`password\``);for(let X of Object.keys(Y))if(!["username","password"].includes(X))v1(`${Z}.smtp.${X}`,`${Z}.smtp has unknown field \`${X}\`. Expected: username, password`);for(let X of["username","password"])if(typeof Y[X]!=="string"||Y[X].length===0)v1(`${Z}.smtp.${X}`,`${Z}.smtp.${X} is required and must be a non-empty string`);return}if(Q[0]==="headers"){let Y=$.headers;if(!fY(Y))v1(`${Z}.headers`,`${Z}.headers must be an object of header name to value`);for(let[X,J]of Object.entries(Y))if(typeof J!=="string")v1(`${Z}.headers.${X}`,`${Z}.headers.${X} must be a string`)}else{let Y=$.postgres;if(!fY(Y))v1(`${Z}.postgres`,`${Z}.postgres must be an object with \`username\` and \`password\``);for(let J of Object.keys(Y))if(!["username","password","database"].includes(J))v1(`${Z}.postgres.${J}`,`${Z}.postgres has unknown field \`${J}\`. Expected: username, password, database`);let X=Y;for(let J of["username","password"])if(typeof X[J]!=="string"||X[J].length===0)v1(`${Z}.postgres.${J}`,`${Z}.postgres.${J} is required and must be a non-empty string`);if(X.database!==void 0&&typeof X.database!=="string")v1(`${Z}.postgres.database`,`${Z}.postgres.database must be a string`)}}function vm4($,Z){let Q=$;return Z.forEach((Y,X)=>{let J=Sm4(Y);if(Q===void 0)Q=J;else if(Q!==J)v1(`transform[${X}]`,`transform requires protocol \`${J}\` but the rule is \`${Q}\`; a rule terminates one protocol`)}),Q??"http"}function bm4($,Z){if(!fY($)||Object.keys($).some((Q)=>Q!=="method"&&Q!=="path"))v1(Z,`${Z} must be an object containing only method and path`);if($.method!==void 0&&(!Array.isArray($.method)||$.method.some((Q)=>typeof Q!=="string"||Q.length===0||/[^!#$%&'*+.^_`|~0-9A-Za-z-]/.test(Q))))v1(`${Z}.method`,`${Z}.method must be an array of HTTP method tokens`);if($.path!==void 0){let Q=$.path;if(!fY(Q)||Object.keys(Q).length!==1||typeof Q.exact!=="string"||!Q.exact.startsWith("/")||/[\s?#]/.test(Q.exact))v1(`${Z}.path`,`${Z}.path must contain exact: an absolute path without a query or fragment`)}}function vT$($,Z){if(!fY($))v1(Z||"rule",`${Z||"rule"} must be an object`);for(let H of Object.keys($))if(!ST$.includes(H))v1(`${Z}${H}`,`Unknown field \`${H}\`. Expected one of: ${ST$.join(", ")}`);let Q=$;if(Q.action===void 0)v1(`${Z}action`,`${Z}action is required. Write \`action: "allow"\` \u2014 every rule states what it does rather than defaulting to it`);if(Q.action!=="allow")v1(`${Z}action`,`${Z}action must be "allow" (got \`${String(Q.action)}\`). Only allow rules exist today`);if(Q.protocol!==void 0&&!zT$.includes(Q.protocol))v1(`${Z}protocol`,`${Z}protocol must be one of: ${zT$.join(", ")} (got \`${String(Q.protocol)}\`)`);let Y=Q.source??{},X=Q.destination??{};kT$(Y,"source"),kT$(X,"destination");let J=Q.transform??[];if(!Array.isArray(J))v1(`${Z}transform`,`${Z}transform must be an array`);J.forEach((H,F)=>_m4(H,`${Z}transform[${F}]`));let G=vm4(Q.protocol,J);if(Q.match!==void 0){if(bm4(Q.match,`${Z}match`),G!=="http"||Y.public===!0||!(X.public===!0||X.host!==void 0))v1(`${Z}match`,"match requires HTTP egress from a VM or VPC to a public origin or host")}if(J.some((H)=>("s3"in H))){if(J.length!==1||Q.match!==void 0||Y.public===!0||!(X.public===!0||X.host!==void 0)||Q.domain.includes("*"))v1(`${Z}transform`,"s3 requires a sole transform on HTTP egress to a concrete origin, without match")}let W=J.filter((H)=>("jsonPatch"in H));if(W.length>1)v1(`${Z}transform`,"a rule may carry only one jsonPatch transform");if(W.length&&(Y.public===!0||!(X.public===!0||X.host!==void 0)))v1(`${Z}transform`,"jsonPatch requires HTTP egress from a VM or VPC to a public origin or host");if(Q.forwardAuth!==void 0){Vm4(Q.forwardAuth,`${Z}forwardAuth`);let H=X.vmId!==void 0||!P10(X)&&X.port!==void 0;if(G!=="http"||Y.public!==!0||!H||Q.domain==="*")v1(`${Z}forwardAuth`,`${Z}forwardAuth is only supported on HTTP public ingress: \`{ public: true } -> { vmId, port }\``)}if(G==="smtp")km4(Q.domain);else a51(Q.domain);if((Y.vmId!==void 0||Y.vpcId!==void 0)&&X.vmId!==void 0&&J.length>0)v1(`${Z}transform`,"a VM-to-VM rule cannot carry a transform yet \u2014 remove it (only public ingress/egress rules run transforms)");if(G==="tcp"){let H=X.public===!0||X.host!==void 0,F=Y.vmId!==void 0||Y.vpcId!==void 0;if(H||F)v1(`${Z}protocol`,"a `tcp` rule is public ingress only \u2014 `{ public: true } -> { vmId, port }`. The edge splices the session without terminating it, so outbound there is nothing to broker (an outbound allow is a firewall rule, and injecting into one needs `http` or `postgres`) and inward there is no certificate to answer the source with. Give the source `public: true`, or drop `protocol` to be served as HTTPS")}else if(G==="imap"||G==="imaps"){let H=X.public===!0||X.host!==void 0,F=Y.vmId!==void 0||Y.vpcId!==void 0;if(H||F)v1(`${Z}protocol`,`an \`${G}\` rule is public ingress only \u2014 \`{ public: true } -> { vmId, port }\`. The 993 front serves mail clients reaching a VM's IMAP server; outbound there is nothing to broker (an outbound allow is a firewall rule) and inward there is no certificate to answer the source with`)}else if(G==="socks5"){let H=X.public===!0||X.host!==void 0;if(Y.public===!0||!H)v1(`${Z}protocol`,'a `socks5` rule is egress only \u2014 `{ vmId } -> { host: "gate.provider.com", port: 1080 }`. The front exists so a guest can open sessions through a proxy whose credentials it never holds; inbound there is nothing to serve, and publishing one would be an open proxy on a platform address');if(X.host===void 0)v1(`${Z}destination`,"a `socks5` rule has to name the proxy it goes through: give the destination a `host` and the `port` the provider listens on. `{ public: true }` on its own asks the edge to be the proxy, which would let the guest out on our address rather than through yours")}else if(G==="postgres"){let H=J.some((U)=>U!==null&&typeof U==="object"&&("postgres"in U)),F=X.public===!0||X.host!==void 0;if(H&&!F)v1(`${Z}transform`,"a `postgres` transform belongs on an egress rule: the edge spends a credential the guest never holds, so pointing it at your own VM would hand every client a logged-in session. Give the destination `public: true` or a `host`, or drop the transform")}else if(G==="smtp"){let H=J.some((U)=>U!==null&&typeof U==="object"&&("smtp"in U)),F=X.public===!0||X.host!==void 0;if(H&&!F)v1(`${Z}transform`,"an `smtp` transform belongs on an egress rule: the edge spends a credential the guest never holds, so pointing it at your own VM would turn it into an open relay. Give the destination `public: true` or a `host`, or drop the transform");if(typeof Q.domain==="string"&&Q.domain.includes("@")&&Y.public!==!0)v1(`${Z}domain`,`\`${Q.domain}\` names a mailbox, which only makes sense on a rule that receives mail. An egress or VM-to-VM rule names the host the guest submits through \u2014 drop the part before \`@\``)}return{...Q,source:Y,destination:X}}function xm4($,Z){if($==="source")return Mm4(Z)?"source is empty. Say who opens the session: `vmId`, `vpcId`, or `public: true`":"source only narrows the session without saying who opens it. Add `vmId`, `vpcId`, or `public: true`";return"destination is empty. Say where the session lands: `vmId` + `port`, `host` + `port`, or `public: true` for the domain's own origin"}function CT$($){let Z=vT$($,"");for(let Q of["source","destination"]){let Y=Z[Q];if(!P10(Y))v1(Q,xm4(Q,Y))}if(Z.source.public===!0&&Z.destination.public===!0)v1("destination","a rule from the public Internet to the domain's own origin allows nothing the world cannot already do. Did you mean a `vmId` destination (ingress) or a `vmId` source (egress)?");return Z}function bT$($){if(!fY($))v1("tls","tls must be an object with a `rules` array");for(let Q of Object.keys($))if(Q!=="rules")v1(`tls.${Q}`,`tls has unknown field \`${Q}\`. Expected: rules`);let Z=$.rules;if(!Array.isArray(Z))v1("tls.rules","tls.rules must be an array");return Z.forEach((Q,Y)=>{let X=`tls.rules[${Y}].`,J=vT$(Q,X),G=P10(J.source),W=P10(J.destination);if(!G&&!W)v1(`tls.rules[${Y}]`,`tls.rules[${Y}]: both source and destination refer to the VM being created, which allows nothing. Give one of them a \`vmId\`, \`vpcId\`, or \`public: true\``);if(G&&W)v1(`tls.rules[${Y}]`,`tls.rules[${Y}]: neither end refers to the VM being created. Leave one endpoint's identity unset so it means this VM, or create the rule with tls.rules.create instead`);if(!W&&J.destination.port===void 0)v1(`tls.rules[${Y}].destination.port`,`tls.rules[${Y}]: destination.port is required: say which port on this VM the session lands on`)}),$}function r51($){return`/v5/tls/${u6($)}`}function s51($){return`/v5/tls/forward-auth/${u6($)}`}class xT${client;constructor($){this.client=$}list(){return this.client.get("/v5/tls/forward-auth")}async create($){let Z=IT$($);return this.client.post("/v5/tls/forward-auth",Z)}get($){return this.client.get(s51($))}async update($,Z){let Q=IT$(Z);return this.client.put(s51($),Q)}delete($){return this.client.delete(s51($))}}class fT${client;constructor($){this.client=$}async create($){let Z=CT$($);return this.client.post("/v5/tls",Z)}list($={}){return this.client.get("/v5/tls",$)}get($){return this.client.get(r51($))}async update($,Z){let Q=CT$(Z);return this.client.put(r51($),Q)}delete($){return this.client.delete(r51($))}}class Z91{client;rules;forwardAuth;constructor($){this.client=$,this.rules=new fT$($),this.forwardAuth=new xT$($)}}var e51,$91,ET$,jm4,zT$,Em4=253,zm4=63,PT$,AT$,Pm4,Am4,Tm4=2048,TT$=32,RT$=16384,qT$=32,MT$=32,Rm4=128,qm4,VT$="!#$%&'*+-/=?^_`{|}~.",ST$;var NT0=D(()=>{_W();e51=class e51 extends Error{path;constructor($,Z){super(Z);this.name="TlsRuleValidationError",this.path=$,Object.setPrototypeOf(this,e51.prototype)}};$91=class $91 extends Error{path;constructor($,Z){super(Z);this.name="TlsForwardAuthValidationError",this.path=$,Object.setPrototypeOf(this,$91.prototype)}};ET$=["vmId","vpcId","public","host","port"],jm4=["vmId","vpcId","public","host"],zT$=["tcp","http","postgres","minecraft","smtp","imap","imaps","socks5"],PT$=["url","headers","timeoutMs","protectedCookies","authResponseHeaders"],AT$=["id"],Pm4=/^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/,Am4=/^[0-9A-Za-z-]+$/,qm4=new Set(["host","content-length","connection","keep-alive","proxy-authenticate","proxy-authorization","proxy-connection","te","trailer","transfer-encoding","upgrade"]);ST$=["action","domain","protocol","source","destination","transform","match","forwardAuth"]});function xm($){return`/v5/tunnels/${u6($)}`}function Kf($){return $.tunnelId??=$.id,$}class Q91{client;constructor($){this.client=$}list(){return this.client.get("/v5/tunnels").then(($)=>{return $.tunnels.forEach(Kf),$})}create($={}){return this.client.post("/v5/tunnels",$).then(Kf)}get($){return this.client.get(xm($)).then(Kf)}update($,Z){return this.client.patch(xm($),Z).then(Kf)}rotateKey($,Z={}){return this.client.post(`${xm($)}/rotate-key`,Z).then(Kf)}delete($){return this.client.delete(xm($))}attachVpc($,Z,Q={}){return this.client.post(`${xm($)}/vpcs/${u6(Z)}`,Q).then(Kf)}detachVpc($,Z){return this.client.delete(`${xm($)}/vpcs/${u6(Z)}`).then(Kf)}}var Y91=D(()=>{_W()});class X91{client;basePath;constructor($,Z){this.client=$,this.basePath=Z}async readFile($,Z={}){let Q=await this.openRead($,Z);return new Uint8Array(await Q.arrayBuffer())}async readTextFile($,Z={}){return await(await this.openRead($,Z)).text()}async readFileStream($,Z={}){let Q=await this.openRead($,Z);if(!Q.body)throw Error(`no response body reading ${$}`);return Q.body}async writeFile($,Z,Q={}){let Y=typeof Z==="string"?new TextEncoder().encode(Z):Z,X=Y instanceof Uint8Array?Y.byteLength:Y.size;if(X>fm4)return this.uploadInChunks($,Y,X,Q);let J=Y instanceof Uint8Array?Y:new Uint8Array(await Y.arrayBuffer());await this.client.putBytes(`${this.basePath}/fs/write`,J,{path:$,mode:Q.mode,sha256:await yT$(J)},Q.signal),Q.onProgress?.({completedBytes:X,totalBytes:X})}writeTextFile($,Z,Q={}){return this.writeFile($,Z,Q)}async readDir($){let{entries:Z}=await this.client.get(`${this.basePath}/fs/dir`,{path:$});return Z}async mkdir($){await this.client.post(`${this.basePath}/fs/mkdir`,{path:$})}async remove($){await this.client.delete(`${this.basePath}/fs/remove`,{path:$})}async exists($){let{exists:Z}=await this.client.get(`${this.basePath}/fs/exists`,{path:$});return Z}stat($){return this.client.get(`${this.basePath}/fs/stat`,{path:$})}openRead($,Z){let{offset:Q,length:Y}=Z,X;if(Q!==void 0||Y!==void 0){let J=Q??0;X=Y===void 0?`bytes=${J}-`:`bytes=${J}-${J+Y-1}`}return this.client.getBytes(`${this.basePath}/fs/read`,{path:$},{range:X,signal:Z.signal})}async uploadInChunks($,Z,Q,Y){let X=Y.chunkSize??ym4,J=Y.maxAttempts??gm4,G=Z instanceof Uint8Array?await yT$(Z):void 0,W=await this.client.post(`${this.basePath}/fs/uploads`,{path:$,size:Q,sha256:G,mode:Y.mode}),K=`${this.basePath}/fs/uploads/${W.uploadId}`;try{let H=W.receivedBytes;while(H<Q){let F=Math.min(H+X,Q),U=Z instanceof Uint8Array?Z.subarray(H,F):Z.slice(H,F);H=(await this.putChunkWithRetry(K,U,H,J,Y.signal)).receivedBytes,Y.onProgress?.({completedBytes:Math.min(H,Q),totalBytes:Q})}await this.client.post(`${K}/commit`)}catch(H){throw await this.client.delete(K).catch(()=>{}),H}}async putChunkWithRetry($,Z,Q,Y,X){let J;for(let G=1;G<=Y;G++){X?.throwIfAborted?.();try{return await this.client.putBytes($,Z,{offset:Q},X)}catch(W){if(J=W,!(!(W instanceof yX)||W.status>=500||W.status===408||W.status===409||W.status===429)||X?.aborted||G===Y)throw W;await hm4(Math.min(500*2**(G-1),8000));let H=await this.client.get($).catch(()=>{return});if(H&&H.receivedBytes>Q)return H}}throw J}}async function yT$($){let Z=globalThis.crypto?.subtle;if(!Z)return;let Q=await Z.digest("SHA-256",$);return Array.from(new Uint8Array(Q),(Y)=>Y.toString(16).padStart(2,"0")).join("")}function hm4($){return new Promise((Z)=>setTimeout(Z,$))}var fm4=8388608,ym4=16777216,gm4=5;var J91=D(()=>{E10()});function um4(){return typeof process<"u"&&Boolean(process.versions?.node)}async function gT$($,Z){if(um4()){let Y;try{Y=await import("ws")}catch{throw Error("PTY sessions need the `ws` package in Node. Install it with `npm install ws`.")}return new Y.default($,{headers:Z})}let Q=globalThis.WebSocket;if(!Q)throw Error("PTY sessions need a WebSocket client; no global WebSocket is available in this environment.");return new Q($)}function A10($,Z,Q){if($.on){$.on(Z,Q);return}$.addEventListener?.(Z,Q)}function cm4($,Z){if($&&typeof $==="object"&&"data"in $){let Q=$.data;if(typeof Q==="string")return{text:Q};if(Q instanceof ArrayBuffer)return{binary:new Uint8Array(Q)};return{}}if($ instanceof Uint8Array)return Z?{binary:$}:{text:lm4.decode($)};if(typeof $==="string")return{text:$};return{}}class G91{_sessionId;_slug;_created=!1;socket;constructor($,Z,Q={}){this.socket=$,this._sessionId=Z,A10($,"message",(Y,X)=>{let{text:J,binary:G}=cm4(Y,X);if(G){Q.onData?.(G);return}if(!J)return;let W;try{W=JSON.parse(J)}catch{return}if(W.type==="exited")Q.onExit?.(W.exitCode);else if(W.type==="error")Q.onError?.(Error(W.message));else if(W.type==="sessionInfo")this._sessionId=W.sessionId,this._slug=W.slug,this._created=W.created??!0,Q.onSessionInfo?.(W.sessionId)}),A10($,"close",(Y)=>{let X=Y;Q.onClose?.({wasClean:X?.wasClean??!0,code:X?.code??1000,reason:X?.reason??""})}),A10($,"error",(Y)=>Q.onError?.(Y))}write($){this.socket.send(typeof $==="string"?new TextEncoder().encode($):$)}resize($){this.sendControl({type:"resize",cols:$.cols,rows:$.rows})}signal($){this.sendControl({type:"signal",signal:$})}sendControl($){this.socket.send(JSON.stringify($))}detach(){this.socket.close()}get sessionId(){return this._sessionId}get slug(){return this._slug}get created(){return this._created}get readyState(){return this.socket.readyState}}function mm4($){return new Promise((Z,Q)=>{if($.readyState===1){Z();return}A10($,"open",()=>Z()),A10($,"error",(Y)=>Q(Y))})}class W91{client;basePath;constructor($,Z){this.client=$,this.basePath=Z}async open($={}){let{exec:Z,cols:Q,rows:Y,linuxUser:X,slug:J,replaceOnExit:G,onData:W,onExit:K,onClose:H,onError:F}=$,U={};if(Z!==void 0)U.exec=Z;if(Q!==void 0)U.cols=Q;if(Y!==void 0)U.rows=Y;if(X!==void 0)U.linuxUser=X;if(J!==void 0)U.slug=J;if(G!==void 0)U.replaceOnExit=String(G);let N=hT$(this.client,`${this.basePath}/pty`,U),B=this.client.authHeaders(),O=await gT$(N,B);return new Promise((L,w)=>{let j=!1,E=new G91(O,-1,{onData:W,onExit:K,onClose:(z)=>{if(!j)j=!0,w(Error("connection closed before sessionInfo"));H?.(z)},onError:(z)=>{if(!j)j=!0,w(z);F?.(z)},onSessionInfo:()=>{j=!0,L(E)}})})}async attach($){let{session:Z,linuxUser:Q,onData:Y,onExit:X,onClose:J,onError:G}=$,W=hT$(this.client,`${this.basePath}/pty/sessions/${u6(String(Z))}`,{...Q!==void 0?{linuxUser:Q}:{}}),K=this.client.authHeaders(),H=await gT$(W,K),F=new G91(H,typeof Z==="number"?Z:-1,{onData:Y,onExit:X,onClose:J,onError:G});return await mm4(H),F}list($={}){return this.client.get(`${this.basePath}/pty/sessions`,$)}close($,Z={}){return this.client.delete(`${this.basePath}/pty/sessions/${u6(String($))}`,Z)}}class K91{pty;linuxUser;constructor($,Z){this.pty=$,this.linuxUser=Z}open($={}){return this.pty.open({...$,linuxUser:this.linuxUser})}attach($){return this.pty.attach({...$,linuxUser:this.linuxUser})}list(){return this.pty.list({linuxUser:this.linuxUser})}close($){return this.pty.close($,{linuxUser:this.linuxUser})}}function hT$($,Z,Q){return $.url(Z,Q).replace(/^http/,"ws")}var lm4;var H91=D(()=>{_W();lm4=new TextDecoder});class F91{client;constructor($){this.client=$}list($={}){return this.client.get("/v5/snapshots",$)}get($){return this.client.get(`/v5/snapshots/${u6($)}`)}update($,Z){return this.client.patch(`/v5/snapshots/${u6($)}`,Z)}delete($){return this.client.delete(`/v5/snapshots/${u6($)}`)}}var U91=D(()=>{_W()});var uT$=()=>{};function N91($){return`/v5/vms/${u6($)}`}class B91{id;fs;pty;client;basePath;constructor($,Z){this.client=$,this.id=Z,this.basePath=N91(Z),this.fs=new X91($,this.basePath),this.pty=new W91($,this.basePath)}data(){return this.client.get(this.basePath)}firewallRules(){return this.client.get("/v5/firewall/rules",{vmId:this.id})}update($){return this.client.patch(this.basePath,$)}start(){return this.client.post(`${this.basePath}/start`)}pause(){return this.client.post(`${this.basePath}/pause`)}resize($){return this.client.post(`${this.basePath}/resize`,$)}delete(){return this.client.delete(this.basePath)}exec($){let Z=typeof $==="string"?{command:$}:$;return this.client.post(`${this.basePath}/exec-await`,Z)}linuxUser($){return new lT$(this,$)}snapshot($={}){return this.client.post(`${this.basePath}/snapshot`,$)}}class lT${vm;linuxUser;pty;constructor($,Z){this.vm=$,this.linuxUser=Z,this.pty=new K91($.pty,Z)}exec($){let Z=typeof $==="string"?{command:$}:$;return this.vm.exec({...Z,linuxUser:this.linuxUser})}}class D91{client;snapshots;constructor($){this.client=$,this.snapshots=new F91($)}async create($){if(UT0($.firewall,"VM"),$.tls!==void 0)bT$($.tls);let Z=await this.client.post("/v5/vms",$);return{vm:new B91(this.client,Z.id),vmId:Z.id,data:Z,firewallRules:Z.firewallRules??[],tlsRules:Z.tlsRules??[]}}list($={}){return this.client.get("/v5/vms",$)}get($){return this.client.get(N91($))}ref($){return new B91(this.client,$)}delete($){return this.client.delete(N91($))}}var O91=D(()=>{z10();NT0();_W();J91();H91();U91();uT$();J91();H91();U91()});function L91($){return`/v5/vpcs/${u6($)}`}class cT${client;basePath;constructor($,Z){this.client=$,this.basePath=Z}list(){return this.client.get(`${this.basePath}/tunnels`)}}class w91{id;tunnels;client;basePath;constructor($,Z){this.client=$,this.id=Z,this.basePath=L91(Z),this.tunnels=new cT$($,this.basePath)}data(){return this.client.get(this.basePath)}update($){return this.client.patch(this.basePath,$)}delete(){return this.client.delete(this.basePath)}}class j91{client;constructor($){this.client=$}list(){return this.client.get("/v5/vpcs")}async create($={}){if($.firewall!==void 0)UT0($.firewall,"network");let Z=await this.client.post("/v5/vpcs",$);return{vpc:new w91(this.client,Z.id),vpcId:Z.id,data:Z,firewallRules:Z.firewallRules??[]}}get($){return this.client.get(L91($))}ref($){return new w91(this.client,$)}delete($){return this.client.delete(L91($))}}var E91=D(()=>{z10();_W()});class BT0{client;vms;vpc;tunnels;firewall;tls;domains;identities;constructor($={}){this.client=new h51($),this.vms=new D91(this.client),this.vpc=new j91(this.client),this.tunnels=new Q91(this.client),this.firewall=new i51(this.client),this.tls=new Z91(this.client),this.domains=new u51(this.client),this.identities=new t51(this.client)}fetch($,Z){return this.client.fetch($,Z)}}var mT$=D(()=>{_W();l51();z10();o51();NT0();Y91();O91();E91();_W();E10();O91();E91();Y91();l51();z10();NT0();o51()});var iT$;var dT$=D(()=>{iT$={name:"@decocms/sandbox",version:"1.80.1",private:!0,type:"module",description:"Sandbox runtime for isolated Studio tool execution",scripts:{check:"tsc --noEmit",test:"bun test",build:"bun run build:typegen && bun run build:harness-runner","build:typegen":"mkdir -p dist && bun run --cwd=../typegen build && bun --cwd=../typegen pm pack --filename $PWD/dist/typegen.tgz --quiet","build:harness-runner":"mkdir -p dist && bun --cwd=../harness-runner pm pack --filename $PWD/dist/harness-runner.tgz --quiet"},exports:{"./shared":"./shared.ts","./provider":"./server/provider/index.ts","./provider/agent-sandbox":"./server/provider/agent-sandbox/index.ts","./provider/postgres-state-store":"./server/provider/postgres-state-store.ts","./provider/freestyle":"./server/provider/freestyle.ts","./provider/remote":"./server/provider/remote.ts","./provider/router":"./server/provider/router.ts","./provider/sandbox-api":"./server/provider/sandbox-api.ts","./provider/sandbox-server":"./server/provider/sandbox-server.ts","./daemon-client":"./server/daemon-client.ts","./org-fs":"./org-fs.ts","./dispatch":"./dispatch/index.ts","./dispatch/*":"./dispatch/*.ts","./proxy/http":"./proxy/http.ts","./proxy/websocket":"./proxy/websocket.ts"},dependencies:{"@decocms/shared":"workspace:*","@kubernetes/client-node":"^1.4.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0",freestyle:"0.2.16",zod:"4.3.6"},devDependencies:{"@types/bun":"latest",postgres:"^3.4.5",typescript:"^7.0.2"}}});function DT0($){let Z=$?.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of studio-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"});return async(Q,Y)=>{if(!Z)return Y();let X=performance.now(),J=(G)=>Z.record(performance.now()-X,{runner_kind:Q,source:"daemon",status_code:G});try{let G=await Y();return J(G.status),G}catch(G){throw J(0),G}}}var zD;var OT0=D(()=>{zD={kubernetes:"agent-sandbox",freestyle:"freestyle"}});var $R$={};$6($R$,{FreestyleSandboxProvider:()=>eT$});import{createHash as im4,randomBytes as pm4}from"crypto";class eT${freestyle;lookupClient;image;sidecarImage;idleTimeoutSeconds;autoDeleteSeconds;domainSuffix;timeDaemonRequest;inflight=new Jf;snapshotInflight=new Jf;lookups=new Map;releaseTimers=new Map;constructor($){this.freestyle=$.client??new BT0({apiKey:$.apiKey}),this.lookupClient=$.client??new BT0({apiKey:$.apiKey,fetch:Object.assign((Z,Q)=>fetch(Z,{...Q,signal:Q?.signal?AbortSignal.any([Q.signal,AbortSignal.timeout(rT$)]):AbortSignal.timeout(rT$)}),{preconnect:fetch.preconnect})}),this.image=$.image??`ghcr.io/decocms/studio/studio-sandbox-go:${iT$.version}`,this.sidecarImage=$.orgFsSidecarImage??tm4,this.idleTimeoutSeconds=$.idleTimeoutSeconds??900,this.autoDeleteSeconds=$.autoDeleteSeconds??259200,this.domainSuffix=$.domainSuffix??"style.dev",this.timeDaemonRequest=DT0($.meter)}async owns($){return await this.find($)!==null}daemonUrl($){return`https://${$}.${this.domainSuffix}`}async find($,Z={}){let Q=this.lookups.get($);if(!Z.refresh&&Q&&Date.now()-Q.at<(Q.found?$d4:Zd4))return Q.found;let Y=null;try{let X=await this.lookupClient.vms.get($),J=X.metadata[tT$];if(J)Y={vm:this.freestyle.vms.ref(X.id),daemon:{url:this.daemonUrl($),token:J}}}catch(X){if(!(X instanceof yX&&X.status===404))throw X}return this.remember($,Y),Y}remember($,Z){if(this.lookups.delete($),this.lookups.size>=Qd4){let Q=this.lookups.keys().next();if(!Q.done)this.lookups.delete(Q.value)}this.lookups.set($,{found:Z,at:Date.now()})}baseSnapshot(){let{image:$,sidecarImage:Z}=this,Q=`studio-sandbox-${im4("sha256").update(`${$}
 ${Z}`).digest("hex").slice(0,16)}`;return this.snapshotInflight.run(Q,async()=>{if(await this.snapshotExists(Q))return Q;console.log(`[${Hf}] building base snapshot ${Q} for ${$}`);let{vm:Y}=await this.freestyle.vms.create({ttlSeconds:1800,firewall:{rules:[{action:"allow",source:{},destination:{public:!0}}]}});try{await this.run(Y,`docker pull -q ${fm($)} && docker pull -q ${fm(Z)}`,{timeoutMs:z91}),await Y.snapshot({slug:Q})}catch(X){if(!await this.snapshotExists(Q))throw X}finally{await Y.delete().catch(()=>{})}return Q})}async snapshotExists($){try{return await this.freestyle.vms.snapshots.get($),!0}catch(Z){if(Z instanceof yX&&Z.status===404)return!1;throw Z}}async run($,Z,Q={}){let Y=await $.exec({command:Z,...Q});if(Y.statusCode!==0)throw Error(`${Z.split(" ",2).join(" ")} failed (${Y.statusCode??"timeout"}): ${(Y.stderr||Y.stdout||"").slice(-500)}`);return Y.stdout??""}async ensure($,Z={}){let Q=F3($);if(Q.startsWith("s-"))throw Error(`ensure: projectRef has no slug source: ${$.projectRef}`);return this.inflight.run(Q,async()=>{this.cancelRelease(Q);let Y=await this.find(Q,{refresh:!0});if(Y)await this.resume(Y,Z);else await this.create(Q,Z);return{handle:Q,workdir:T10,previewUrl:this.daemonUrl(Q),warmPoolAdopted:!1,provider:"freestyle"}})}async resume($,Z){let{state:Q}=await $.vm.data();if(Q!=="running")await $.vm.start();if(await this.waitForDaemon($.daemon.url),Z.orgFsConfigJson)await N10($.daemon.url,$.daemon.token,Z.orgFsConfigJson).catch((X)=>console.warn(`[${Hf}] org-fs relay failed`,X));let Y=D10(Z);if(Y)await VU($.daemon.url,$.daemon.token,Y).catch((X)=>console.warn(`[${Hf}] git credential refresh failed: ${aT$(X)}`))}async create($,Z){let Q=await this.baseSnapshot(),Y=pm4(24).toString("hex"),{vm:X}=await this.createVm({snapshotId:Q,slug:$,idleTimeoutSeconds:this.idleTimeoutSeconds,metadata:{[tT$]:Y,...Z.tenant?{[rm4]:Z.tenant.orgId,[sm4]:Z.tenant.userId}:{}},firewall:{rules:[{action:"allow",source:{},destination:{public:!0}}]},tls:{rules:[{action:"allow",domain:`${$}.${this.domainSuffix}`,source:{public:!0},destination:{port:LT0}}]}}),J={url:this.daemonUrl($),token:Y};try{let G={...Z.env,DAEMON_TOKEN:Y,DAEMON_BOOT_ID:crypto.randomUUID(),APP_ROOT:T10,PROXY_PORT:String(LT0),ORGFS_SIDECAR_CONFIG_PATH:`${wT0}/config.json`,ORGFS_SIDECAR_STATUS_PATH:`${wT0}/status.json`},W=Object.keys(G).map((K)=>`-e ${fm(K)}`).join(" ");if(await this.run(X,`sudo sh -c ${fm(om4)} && docker run -d --name ${nT$} --restart=always --privileged --device /dev/fuse -e APP_ROOT=${T10} -v ${ij}:${T10}/org:rshared -v ${ym}:${wT0} ${fm(this.sidecarImage)}`,{timeoutMs:z91}),await this.run(X,`docker run -d --name ${pT$} --restart=always -p ${LT0}:${LT0} -v ${ij}:${T10}/org:rslave -v ${ym}:${wT0} ${W} ${fm(this.image)}`,{env:G,timeoutMs:z91}),await this.waitForDaemon(J.url),await VU(J.url,Y,this.configPayload(Z)??{}),Z.orgFsConfigJson)await N10(J.url,Y,Z.orgFsConfigJson).catch((K)=>console.warn(`[${Hf}] org-fs relay failed`,K))}catch(G){throw await X.delete().catch(()=>{}),this.lookups.delete($),G}this.remember($,{vm:X,daemon:J})}async createVm($){try{return await this.freestyle.vms.create({...$,autoDeleteSeconds:this.autoDeleteSeconds})}catch(Z){if(!(Z instanceof yX&&Z.status===400))throw Z;return console.warn(`[${Hf}] autoDeleteSeconds=${this.autoDeleteSeconds} refused (${Z.message}); creating with the plan's cap`),this.freestyle.vms.create($)}}configPayload($){return Vm({runtime:$.workload?.runtime??"node",packageManager:$.workload?.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:$.repo??null,extraRepos:$.extraRepos??[],port:$.workload?.devPort??nm4,tenant:$.tenant,cloneOnly:$.cloneOnly===!0})}async waitForDaemon($){let Z=Date.now()+oT$;while(Date.now()<Z){if(await sT$($))return;await z$(am4)}throw Error(`sandbox daemon at ${$} did not answer /health within ${oT$/1000}s`)}async delete($){this.cancelRelease($);let Z=await this.find($,{refresh:!0});if(this.lookups.delete($),!Z)return;await Z.vm.exec({command:`docker stop -t 30 ${pT$}; docker stop -t 10 ${nT$}`,timeoutMs:60000}).catch(()=>{}),await Z.vm.delete()}async lastTermination($){return null}async alive($){return await this.find($,{refresh:!0})!==null}async*watchClaimLifecycle($,Z){let Q=Date.now();yield{kind:"claiming",since:Q};let Y=!1;while(!Z?.aborted){let X=await this.find($,{refresh:!0}).catch(()=>null);if(X){if(!Y)Y=!0,yield{kind:"warming-daemon",since:Date.now()};if(await sT$(X.daemon.url)){yield{kind:"ready"};return}}if(Date.now()-Q>Yd4){yield{kind:"failed",reason:X?"crash-loop-backoff":"claim-never-created",message:X?"the sandbox VM exists but its daemon never answered":"no sandbox VM was created"};return}await z$(1000)}}async hasSchedulableCapacity(){return!0}async getPreviewUrl($){return await this.find($)?this.daemonUrl($):null}async proxyDaemonRequest($,Z,Q){let Y=await this.find($);if(!Y)return Response.json({error:"sandbox not found"},{status:404});let X=async()=>(await this.find($,{refresh:!0}))?.daemon??null;return this.timeDaemonRequest(zD.freestyle,()=>Cm(Y.daemon,Z,Q,{unauthorized:async()=>{let J=await X();return J&&J.token!==Y.daemon.token?J:null},unreachable:X}))}async daemonEndpoint($){return(await this.find($))?.daemon??null}async adoptLiveClaim($,Z){return await this.find(Z,{refresh:!0})!==null}async resolvePreviewUpstreamUrl($){return(await this.find($))?.daemon.url??null}proxyPreviewRequest($,Z){return vm(Z,{base:()=>this.resolvePreviewUpstreamUrl($).catch(()=>null),invalidate:()=>this.lookups.delete($),retryBase:()=>this.find($,{refresh:!0}).then((Q)=>Q?.daemon.url??null).catch(()=>null)},Hf)}async markTenantPoolsDirty($,Z){return[]}async releaseAfter($,Z){this.cancelRelease($);let Q=setTimeout(()=>{this.releaseTimers.delete($),this.find($).then((Y)=>Y?.vm.pause()).catch((Y)=>console.warn(`[${Hf}] pause ${$} failed: ${aT$(Y)}`))},Z);Q.unref?.(),this.releaseTimers.set($,Q)}async renewTtl($){this.cancelRelease($)}cancelRelease($){let Z=this.releaseTimers.get($);if(Z)clearTimeout(Z);this.releaseTimers.delete($)}close(){for(let $ of this.releaseTimers.values())clearTimeout($);this.releaseTimers.clear(),this.lookups.clear()}}async function sT$($){try{let Z=await fetch(`${$}/health`,{signal:AbortSignal.timeout(em4)});return await Z.body?.cancel(),Z.ok}catch{return!1}}function fm($){return`'${$.replaceAll("'","'\\''")}'`}function aT$($){return $ instanceof Error?$.message:String($)}var Hf="FreestyleSandboxProvider",LT0=9000,T10="/app",nm4=3000,pT$="sandbox",nT$="orgfs",tm4="ghcr.io/decocms/studio/orgfs-sidecar:0.1.0",ij="/srv/sandbox/org",ym="/srv/sandbox/orgfs-ctl",wT0="/run/orgfs",om4,tT$="studio-daemon-token",rm4="studio-org-id",sm4="studio-user-id",oT$=120000,am4=500,em4=5000,z91=300000,$d4=300000,Zd4=1e4,Qd4=5000,Yd4=300000,rT$=3000;var ZR$=D(()=>{mT$();a$();dT$();Xf();km();ZT0();QT0();OT0();om4=[`mkdir -p ${ij} ${ym}`,`grep -q ' ${ij} ' /etc/fstab || printf '%s\\n' '${ij} ${ij} none bind,rshared 0 0' 'tmpfs ${ym} tmpfs uid=1000,gid=1000,mode=0755,size=1m 0 0' >> /etc/fstab`,`mountpoint -q ${ij} || mount ${ij}`,`mountpoint -q ${ym} || mount ${ym}`].join(" && ")});function R10($,Z){if($ instanceof Error)Object.assign($,{["sandboxProvider"]:Z});return $}function P91($){for(let Z=$,Q=0;Z instanceof Error&&Q<5;Q++){let Y=Z.sandboxProvider;if(Y==="kubernetes"||Y==="freestyle")return Y;Z=Z.cause}return}var A91={};$6(A91,{handleShare:()=>QR$,SandboxProviderRouter:()=>YR$});import{createHash as Xd4}from"crypto";function QR$($){let Z=Xd4("sha256").update($).digest("hex").slice(0,8);return Number.parseInt(Z,16)/4294967296}function Wd4($){return $ instanceof EH}class YR${providers;picked=new Map;strays=new Map;freestyleShare;constructor($,Z={}){this.providers=$;if(!$.kubernetes&&!$.freestyle)throw Error("SandboxProviderRouter needs at least one provider");this.freestyleShare=Math.min(1,Math.max(0,Z.freestyleShare??0))}get($){let Z=this.providers[$];if(!Z)throw Error(`sandbox provider ${$} is not configured`);return Z}remember($,Z){if(this.picked.delete($),this.picked.size>=Jd4){let Q=this.picked.keys().next();if(!Q.done)this.picked.delete(Q.value)}this.picked.set($,Z)}async providerOf($){let{kubernetes:Z,freestyle:Q}=this.providers;if(!Q)return"kubernetes";if(!Z)return"freestyle";let Y=this.picked.get($);if(Y)return Y;return await Q.owns($).catch(()=>!1)?"freestyle":"kubernetes"}async owner($){return this.get(await this.providerOf($))}async place($,Z){let{kubernetes:Q,freestyle:Y}=this.providers,X=Z.sandboxImage??"default";if(X!=="default"){if(!Q)throw Error(`sandbox image ${X} needs the kubernetes provider`);return{kind:"kubernetes",reason:Y?"image":void 0}}if(!Q)return{kind:"freestyle"};if(!Y)return{kind:"kubernetes"};let J=this.strays.get($);if(J)this.retire(J,$);if(J!=="kubernetes"&&await Q.alive($).catch(()=>!1))return{kind:"kubernetes",reason:"existing"};let G=J==="freestyle"?!1:await Y.owns($).catch(()=>null);if(G)return{kind:"freestyle",reason:"existing"};if(G===null)return{kind:"kubernetes",reason:"freestyle-unavailable"};if(Z.provider)return{kind:Z.provider,reason:"requested"};if(this.hasWarmPool(Z,X))return{kind:"kubernetes",reason:"warm-pool"};if(QR$($)<this.freestyleShare)return{kind:"freestyle",reason:"split"};return await Q.hasSchedulableCapacity().catch(()=>!1)?{kind:"kubernetes",reason:"split"}:{kind:"freestyle",reason:"capacity"}}hasWarmPool($,Z){let Q=$T0($);if(!Q)return!1;return(this.providers.kubernetes?.listTenantPools?.()??[]).some((X)=>X.tenant===Q&&X.image===Z)}async ensure($,Z={}){let{provider:Q,...Y}=Z,X=F3($),J=await this.place(X,Z);if(this.remember(X,J.kind),this.strays.get(X)===J.kind)this.strays.delete(X);let G;try{let H=await this.get(J.kind).ensure($,Y);return J.reason?{...H,placement:{reason:J.reason}}:H}catch(H){G=R10(H,J.kind)}let W=Gd4(J.kind);if(!J.reason||J.reason==="image"||Wd4(G))throw G;console.warn(`[SandboxProviderRouter] ensure ${X} failed on ${J.kind}, trying ${W}:`,G instanceof Error?G.message:String(G)),this.remember(X,W);let K;try{K=await this.get(W).ensure($,Y)}catch(H){throw this.picked.delete(X),R10(H,W)}if(J.reason==="existing")this.retire(J.kind,X);return{...K,placement:{reason:"fallback",fallbackFrom:J.kind}}}retire($,Z){this.strays.set(Z,$),E8(async()=>{if(this.strays.get(Z)===$)await this.get($).delete(Z)},{maxAttempts:3}).then(()=>{if(this.strays.get(Z)===$)this.strays.delete(Z)}).catch((Q)=>console.warn(`[SandboxProviderRouter] delete of ${$} sandbox ${Z} after fallback failed:`,Q instanceof Error?Q.message:String(Q)))}async delete($){let Z=this.strays.get($);this.strays.delete($),await Promise.all([(await this.owner($)).delete($),Z&&this.get(Z).delete($).catch(()=>{})]),this.picked.delete($)}async lastTermination($){return(await this.owner($)).lastTermination($)}async alive($){return(await this.owner($)).alive($)}async*watchClaimLifecycle($,Z){yield*(await this.owner($)).watchClaimLifecycle($,Z)}async hasSchedulableCapacity(){let{kubernetes:$,freestyle:Z}=this.providers;if(!$||Z)return!0;return $.hasSchedulableCapacity()}async getPreviewUrl($){return(await this.owner($)).getPreviewUrl($)}async proxyDaemonRequest($,Z,Q){return(await this.owner($)).proxyDaemonRequest($,Z,Q)}async adoptLiveClaim($,Z){return(await this.owner(Z)).adoptLiveClaim($,Z)}async resolvePreviewUpstreamUrl($){return(await this.owner($)).resolvePreviewUpstreamUrl($)}async proxyPreviewRequest($,Z){return(await this.owner($)).proxyPreviewRequest($,Z)}async markTenantPoolsDirty($,Z){return await this.providers.kubernetes?.markTenantPoolsDirty($,Z)??[]}async releaseAfter($,Z){await(await this.owner($)).releaseAfter($,Z)}async renewTtl($){await(await this.owner($)).renewTtl($)}async daemonEndpoint($){let Z=this.providers[await this.providerOf($)];if(!Z?.daemonEndpoint)throw Error("sandbox provider has no daemon endpoint to serve");return Z.daemonEndpoint($)}listSandboxes(){return this.providers.kubernetes?.listSandboxes?.()??[]}listTenantPools(){return this.providers.kubernetes?.listTenantPools?.()??[]}close(){this.providers.kubernetes?.close(),this.providers.freestyle?.close(),this.picked.clear(),this.strays.clear()}}var Jd4=5000,Gd4=($)=>$==="kubernetes"?"freestyle":"kubernetes";var T91=D(()=>{a$();Xf();w10();km()});var R91={};$6(R91,{toClaimPhase:()=>FR$,SandboxHostError:()=>Ff,RemoteSandboxProvider:()=>HR$});function hm($){return $ instanceof Error?$.message:String($)}function Bd4($){if(!Array.isArray($))return"";let Z=$[0];return typeof Z==="object"&&Z!==null&&"text"in Z&&typeof Z.text==="string"?Z.text:""}function Dd4($){return $ instanceof TB&&$.code===503}function Od4($,Z){let Q=null;try{Q=JSON.parse(Z)}catch{}let Y=BL$.safeParse(Q);if(!Y.success)return new Ff(`${$} failed: ${Z.slice(0,300)}`);let X=Y.data.code==="bootstrap-rejected"?new EH(Y.data.status??502,Y.data.error):new Ff(`${$}: ${Y.data.error}`);return Y.data.provider?R10(X,Y.data.provider):X}function zT0($){return{kind:"failed",reason:"unknown",message:$}}function JR$($){return $.kind==="ready"||$.kind==="failed"}function GR$($){return U7(KR$,WR$,$,2,0.5)}function jT0(...$){let Z=$.filter((Q)=>Q!==void 0);return Z.length>1?AbortSignal.any(Z):Z[0]}class HR${baseUrl;token;credentialLifetimeMs;stallMs;timeDaemonRequest;closed=new AbortController;connecting=null;sandboxes=new Map;capacity=null;capacityInFlight=null;constructor($){this.baseUrl=$.baseUrl.replace(/\/$/,""),this.token=$.token,this.credentialLifetimeMs=$.credentialLifetimeMs,this.stallMs=$.stallMs??4*GL$,this.timeDaemonRequest=DT0($.meter)}headers(){return{authorization:`Bearer ${this.token}`}}client(){return this.connecting??=(async()=>{let $=new sZ({name:"studio",version:"1.0.0"}),Z=new VF(new URL(`${this.baseUrl}/mcp`),{requestInit:{headers:this.headers()},fetch:(Q,Y)=>fetch(Q,{...Y,timeout:!1})});return await $.connect(Z,{timeout:XR$}),$})().catch(($)=>{throw this.connecting=null,$}),this.connecting}async call($,Z,Q,Y={}){let{timeoutMs:X=XR$,signal:J}=Y,G;try{G=await E8(async()=>(await this.client()).callTool({name:$,arguments:{...Z}},void 0,{timeout:X??Kd4,signal:J}),{maxAttempts:Hd4,minTimeout:WR$,maxTimeout:KR$,isRetriable:Dd4,signal:J})}catch(K){if(J?.aborted)throw J.reason;throw K instanceof P5?K.cause:K}if(G.isError)throw Od4($,Bd4(G.content));let W=Q.safeParse(G.structuredContent);if(!W.success)throw new Ff(`${$} returned a malformed result: ${W.error.message}`);return W.data}async whileHostAlive($,Z,Q){let Y=new AbortController,X=new AbortController;this.hostStall($,jT0(Y.signal,Q,this.closed.signal)??Y.signal).then((J)=>{if(J)X.abort(J)});try{return await Z(jT0(X.signal,Q,this.closed.signal)??X.signal)}finally{Y.abort()}}cached($){let Z=this.sandboxes.get($);if(!Z)return null;if(Date.now()-Z.at>Ud4)return this.sandboxes.delete($),null;return Z}remember($,Z,Q,Y){if(this.sandboxes.delete($),!Z)return;if(this.sandboxes.size>=Nd4){let X=this.sandboxes.keys().next();if(!X.done)this.sandboxes.delete(X.value)}this.sandboxes.set($,{daemon:Z,previewUrl:Q,provider:Y,at:Date.now()})}async status($,Z={}){let Q=(X,J)=>this.call(ND.status,{handle:$,resurrect:Z.resurrect??!1},FL$,{signal:X,timeoutMs:J}),Y=Z.resurrect?await this.whileHostAlive($,(X)=>Q(X,null),Z.signal):await Q(Z.signal);return this.remember($,Y.daemon,Y.previewUrl,Y.provider),Y}async daemonFor($,Z={}){if(!Z.refresh){let Q=this.cached($);if(Q)return Q.daemon}return(await this.status($,{resurrect:!0,signal:Z.signal})).daemon}async ensure($,Z={}){let{image:Q,...Y}=Z,X=F3($),J=this.credentialLifetimeMs,G=Date.now(),W=await this.whileHostAlive(X,(K)=>this.call(ND.ensure,{id:$,opts:Y,...J&&{credentialsValidUntil:{orgFsConfig:G+J.orgFsConfig}}},HL$,{timeoutMs:null,signal:K}));if(W.handle!==X)throw new Ff(`host answered ensure with ${W.handle}, expected ${X}`);return this.remember(W.handle,W.daemon,W.previewUrl,W.provider),{handle:W.handle,workdir:W.workdir,previewUrl:W.previewUrl,warmPoolAdopted:W.warmPoolAdopted,provider:W.provider,...W.placement&&{placement:W.placement}}}async delete($){this.sandboxes.delete($),await this.call(ND.delete,{handle:$},L41)}async alive($){return(await this.status($)).alive}async getPreviewUrl($){let Z=this.cached($);if(Z)return Z.previewUrl;return(await this.status($)).previewUrl}async lastTermination($){return(await this.status($)).lastTermination}async lifetime($,Z){try{await this.call(ND.lifetime,$,L41)}catch(Q){console.warn(`[${gm}] ${Z} failed: ${hm(Q)}`)}}renewTtl($){return this.lifetime({handle:$},`TTL renew for ${$}`)}releaseAfter($,Z){return this.lifetime({handle:$,graceMs:Math.max(0,Math.round(Z))},`release of ${$}`)}hasSchedulableCapacity(){let $=this.capacity;if($&&Date.now()-$.at<Fd4)return Promise.resolve($.value);return this.capacityInFlight??=this.readCapacity().finally(()=>{this.capacityInFlight=null}),this.capacityInFlight}async readCapacity(){let $=!0;try{$=(await this.call(ND.capacity,{},UL$)).schedulable}catch(Z){console.warn(`[${gm}] capacity probe failed: ${hm(Z)}`)}return this.capacity={value:$,at:Date.now()},$}async adoptLiveClaim($,Z){let Q=await this.status(Z).catch(()=>null);return Boolean(Q?.daemon)}async markTenantPoolsDirty($,Z){try{return(await this.call(ND.tenantPoolsPush,{repoUrl:$,ref:Z},NL$)).pools}catch(Q){return console.warn(`[${gm}] tenant pool push for ${$}@${Z} failed: ${hm(Q)}`),[]}}list(){return this.call(ND.list,{},wL$)}pushCredentials($){return this.call(ND.credentialsPush,$,LL$)}close(){this.closed.abort(),this.sandboxes.clear();let $=this.connecting;this.connecting=null,$?.then((Z)=>Z.close()).catch(()=>{})}async proxyDaemonRequest($,Z,Q){let Y=Q.signal,X=await this.daemonFor($,{signal:Y});if(!X)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let J=this.sandboxes.get($)?.provider??"kubernetes";return this.timeDaemonRequest(zD[J],()=>Cm(X,Z,Q,{unauthorized:async()=>{let G=await this.daemonFor($,{refresh:!0,signal:Y}).catch(()=>null);return G&&(G.token!==X.token||G.url!==X.url)?G:null},unreachable:()=>this.daemonFor($,{refresh:!0,signal:Y})}))}async resolvePreviewUpstreamUrl($,Z){return(await this.daemonFor($,{signal:Z}))?.url??null}proxyPreviewRequest($,Z){let Q=Z.signal;return vm(Z,{base:()=>this.resolvePreviewUpstreamUrl($,Q).catch((Y)=>{return console.warn(`[${gm}] preview upstream for ${$} failed: ${hm(Y)}`),null}),invalidate:()=>this.sandboxes.delete($),retryBase:()=>this.daemonFor($,{refresh:!0,signal:Q}).then((Y)=>Y?.url??null).catch(()=>null)},gm)}async*watchOnce($,Z){let Q=new URL(`${this.baseUrl}${JL$}`);Q.searchParams.set("handle",$);let Y=new AbortController,X,J=this.stallMs/2,G=()=>{clearTimeout(X),X=setTimeout(()=>Y.abort(Error(`host sent nothing for ${J/1000}s`)),J)};G();try{let W=await fetch(Q,{headers:{...this.headers(),accept:"text/event-stream"},signal:jT0(Y.signal,Z),timeout:!1});if(!W.ok||!W.body){await W.body?.cancel().catch(()=>{});let F=`watch answered ${W.status}`;throw W.status>=400&&W.status<500?new ET0(F):Error(F)}G();let K=new TextDecoder,H="";for await(let F of W.body){G(),H+=K.decode(F,{stream:!0});let U=H.indexOf(`
 
 `);while(U!==-1){let N=H.slice(0,U);H=H.slice(U+2),U=H.indexOf(`
@@ -3731,7 +3731,7 @@ ${J.join(`
 `)}`:X}function zt6($){let Z=new Set;for(let Q of $)for(let Y of Q.split(`
 `)){let X=Y.trim();if(/^Co-authored-by:\s/i.test(X))Z.add(X)}return[...Z]}var sQ8=200,Ft6=12,Nt6,Dt6=300,dC0=3;var MD1=D(()=>{Z7();a$();mC0();Nt6={aheadBy:0,behindBy:0,files:[]}});function At6($){if(!$||$.includes(".."))return!1;return Pt6.test($)}function eQ8($){return Tt6.includes($)}function ID1($){let Z=typeof $.__resolveType==="string"?$.__resolveType:null;if(!Z||!At6(Z))return null;let{__resolveType:Q,...Y}=$;return{resolveType:Z,payload:Y}}function VD1($,Z){return`${$.replace(/\/+$/,"")}/deco/invoke/${Z}`}var Pt6,Tt6;var $Y8=D(()=>{Pt6=/^[\w./@-]+$/;Tt6=["vtex/loaders/intelligentSearch/productList.ts","vtex/loaders/categories/tree.ts"]});function f60($,Z){let Q=$?.repository;if(!Q?.owner||!Q?.name)return null;if(!Q.connectionId)return Q;if(!Z.includes(Q.connectionId))return null;return Q}async function QY8($,Z,Q,Y){let X=$.organization?.id;if(!X)throw new $z(k7);let J=await Cj($.storage,X,Y);if(J&&await UD($.storage,J)){let F=await zU($,J,{forceRefresh:!0}).catch((U)=>{throw new $z(U instanceof Error?U.message:k7)});await ZY8($,Z,Q,F);return}let G=Y.connectionId??J?.legacyConnectionId;if(!G)throw new $z("Push requires a connected git account. Connect the repository's provider for this project and restart the sandbox.");await Fm({ctx:$,connectionId:G,organizationId:X,forceRefresh:!0,onLegacyMintError:(F)=>{let U=F instanceof Error?F.message:k7;throw new $z(U)}});let{cloneUrl:W,gitUserName:K,gitUserEmail:H}=await AU(G,Y.owner,Y.name,$.db,$.vault).catch((F)=>{let{code:U,message:N}=eO$(F instanceof Error?F.message:String(F));throw U?new $z(N):F});await ZY8($,Z,Q,{cloneUrl:W,gitUserName:K,gitUserEmail:H})}async function ZY8($,Z,Q,Y){let{cloneUrl:X,gitUserName:J,gitUserEmail:G}=Y,W=Tp($),K=await Z.proxyDaemonRequest(Q,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({git:{repository:{cloneUrl:X},identity:{userName:J,userEmail:G}},...W?{operator:W}:{}})});if(!K.ok){let H=await YE(K,Rt6).catch(()=>K.statusText);throw Error(`Failed to refresh sandbox git credentials (${K.status}): ${H}`)}}var Rt6=10485760,$z;var kD1=D(()=>{TW();bC0();F$0();qH0();g00();Z7();$z=class $z extends Error{constructor($){super($);this.name="GitPushAuthError"}}});function Mt6($){let Z=$.startsWith("thread:")?$.slice(7):$;if(!Z||Z.length>255||Z.includes("..")||Z.startsWith("/")||Z.endsWith("/")||Z.endsWith(".lock")||!qt6.test(Z))throw Error(`Invalid branch name: ${$}`)}function py($){return AbortSignal.any([$.req.raw.signal,AbortSignal.timeout(It6)])}async function kt6($,Z){let Q=$.var.studioContext,Y=CU(Z.branch),X=$.req.query("thread")??Y,J=X&&X===Y?Z.branchThread:X?await Q.storage.threads.get(X).catch(()=>null):null,G=J?.virtual_mcp_id===Z.virtualMcpId?J:null,W=zf(G?.metadata?.runtime);if(W)return W;let K=MR0(Z.virtualMcpMetadata),H=K==="cms"?await GD1(Q,{claimName:Z.claimName}):"alive",F=K==="cms"&&H!=="alive"?"cms":"sandbox",U=!!G&&(H==="gone"||H==="alive"&&K==="cms");if(U&&G)U$0(Q,G.id,F);if(K==="cms")console.log("sandbox proxy: no runtime stamp",{route:$.req.path,method:$.req.method,reason:G?"unstamped":"threadless",liveness:H,resolved:F,stamped:U});return F}async function St6($){let Z=$.get("vmClaim");if(Z.runner)return Z.runner;try{return await gX($.var.studioContext)}catch{return null}}function ny($){let{runner:Z}=$.get("vmClaim");if(!Z)return $.json({error:"No sandbox runner configured"},503);return Z}async function Vp($){let{virtualMcpMetadata:Z,connectionIds:Q}=$.get("vmClaim"),Y=$.var.studioContext,X=f60(Z,Q);if(!X)throw new f0({provider:"github",status:404,message:"Project has no repository"});let J=J0(Y);return Wm(Y,J.id,X)}function CD1($,Z){let Q=Z instanceof Error?Z.message:String(Z),Y=DD$(Z);if(Y!==void 0)return $.json({error:Q},429,{...G9,...Y===null?{}:{"Retry-After":String(Math.ceil(Y/1000))}});if(Z instanceof s6)return $.json({error:Q},409,G9);let X=IW(Z);if(X!==null){let J=X===404?404:X===409||X===422?409:502;return $.json({error:Q},J,G9)}return $.json({error:Q},502,G9)}async function SD1($,Z,Q){let Y;try{Y=await fetch(Z,Q)}catch{return $.json({error:"Preview unreachable"},502)}let X;try{X=await Y.text()}catch{return $.json({error:"Preview unreachable"},502)}return new Response(X,{status:Y.status,headers:{"content-type":Y.headers.get("content-type")??"application/json"}})}async function GY8($){try{let Z=await Vp($),Q=await iC0(Z,$.get("vmClaim").branch);return $.json(Q,200,G9)}catch(Z){return CD1($,Z)}}function y60($,Z){let Y=(tC0.get($)??Promise.resolve()).catch(()=>{}).then(Z),X=Y.catch(()=>{});return tC0.set($,X),X.finally(()=>{if(tC0.get($)===X)tC0.delete($)}),Y}async function NQ($,Z,Q){if(!Q?.runner&&$.get("vmClaim").runtime==="cms")return $.json({error:"sandbox not found: this session is sandbox-less"},404,G9);let Y=Q?.runner??ny($);if(Y instanceof Response)return Y;let{claimName:X,userId:J,projectRef:G}=$.get("vmClaim"),W=Q?.method??"POST",K=null,H=new Headers;if(Q?.jsonBody!==void 0)K=Q.jsonBody,H.set("content-type","application/json");else if(Q?.forwardJsonBody)K=await $.req.text(),H.set("content-type","application/json");let F=Q?.signal,U={method:W,headers:H,body:K,...F?{signal:F}:{}},N=async()=>{let B=await Y.proxyDaemonRequest(X,Z,U);if(Q?.map404to410&&B.status===404){try{await B.body?.cancel()}catch{}if(await Y.adoptLiveClaim({userId:J,projectRef:G},X))B=await Y.proxyDaemonRequest(X,Z,U);if(B.status===404){try{await B.body?.cancel()}catch{}return new Response(JSON.stringify({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."}),{status:410,headers:{"content-type":"application/json",...G9}})}}let O=await B.text(),L=Q?.redactRepoDir?Ct6(O):O,w=B.headers.get("content-type")??"application/json";return new Response(L,{status:B.status,headers:{"content-type":w,...G9}})};try{if(F){let B=N();return B.catch(()=>{}),await Promise.race([B,new Promise((L,w)=>{if(F.aborted)return w(F.reason);F.addEventListener("abort",()=>w(F.reason),{once:!0})})])}return await N()}catch(B){let O=B instanceof Error?B.message:String(B);return $.json({error:`Daemon unreachable: ${O}`},502)}}function Ct6($){try{let Z=JSON.parse($);if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&"repoDir"in Z)return JSON.stringify({...Z,repoDir:null})}catch{}return $}async function oC0($,Z,Q,Y="GET",X){let J=await $.proxyDaemonRequest(Z,Q,{method:Y,headers:new Headers,body:null});if(J.status===404&&X){try{await J.body?.cancel()}catch{}if(await $.adoptLiveClaim(X,Z))J=await $.proxyDaemonRequest(Z,Q,{method:Y,headers:new Headers,body:null})}if(J.status===404){try{await J.body?.cancel()}catch{}throw Error("SANDBOX_GONE")}let G=await J.text();if(!J.ok){let W=`Daemon error (${J.status})`;try{W=JSON.parse(G).error??W}catch{}throw Error(W)}return JSON.parse(G)}function _t6($){return WY8.includes($)}var qt6,YY8=524288,XY8=65536,It6=1e4,JY8=2000,Vt6,tC0,G9,WY8,KY8=()=>{let $=new Z1;$.use("/:virtualMcpId/:branch/*",Vt6),$.post("/:virtualMcpId/:branch/write",(Q)=>NQ(Q,"/_sandbox/write",{forwardJsonBody:!0,signal:py(Q)})),$.post("/:virtualMcpId/:branch/unlink",(Q)=>NQ(Q,"/_sandbox/unlink",{forwardJsonBody:!0,signal:py(Q)})),$.post("/:virtualMcpId/:branch/mkdir",(Q)=>NQ(Q,"/_sandbox/mkdir",{forwardJsonBody:!0,signal:py(Q)})),$.post("/:virtualMcpId/:branch/rename",(Q)=>NQ(Q,"/_sandbox/rename",{forwardJsonBody:!0,signal:py(Q)})),$.post("/:virtualMcpId/:branch/read",(Q)=>NQ(Q,"/_sandbox/read",{forwardJsonBody:!0,signal:py(Q)})),$.post("/:virtualMcpId/:branch/glob",(Q)=>NQ(Q,"/_sandbox/glob",{forwardJsonBody:!0,signal:py(Q)})),$.post("/:virtualMcpId/:branch/grep",(Q)=>NQ(Q,"/_sandbox/grep",{forwardJsonBody:!0,signal:py(Q)})),$.post("/:virtualMcpId/:branch/exec/:script",async(Q)=>{let Y=Q.req.param("script");if(!Y)return Q.json({error:"missing script name"},400);return NQ(Q,`/_sandbox/exec/${encodeURIComponent(Y)}`)}),$.post("/:virtualMcpId/:branch/exec/:script/kill",async(Q)=>{let Y=Q.req.param("script");if(!Y)return Q.json({error:"missing script name"},400);return NQ(Q,`/_sandbox/exec/${encodeURIComponent(Y)}/kill`)}),$.get("/:virtualMcpId/:branch/config",(Q)=>NQ(Q,"/_sandbox/config",{method:"GET",map404to410:!0,redactRepoDir:!0})),$.put("/:virtualMcpId/:branch/config",(Q)=>NQ(Q,"/_sandbox/config",{method:"PUT",forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/setup/:step",async(Q)=>{let Y=Q.req.param("step");if(!Y||!_t6(Y))return Q.json({error:`step must be one of: ${WY8.join(", ")}`},400);let X=Q.get("vmClaim"),J=await GD1(Q.var.studioContext,{claimName:X.claimName})==="gone"?null:await St6(Q);if(!J)return Q.json({error:"sandbox not found: nothing is running at this ref"},404,G9);if(Y==="start"){let G=J0(Q.var.studioContext),W=Xd(X.virtualMcpMetadata);try{await AR0({ctx:Q.var.studioContext,runner:J,handle:X.claimName,orgId:G.id,userId:X.callerUserId,entries:W})}catch(K){let H=K instanceof Error?K.message:String(K);return Q.json({error:`Failed to push env to daemon: ${H}`},502)}}return NQ(Q,`/_sandbox/setup/${Y}`,{signal:Q.req.raw.signal,map404to410:!0,runner:J})}),$.get("/:virtualMcpId/:branch/events",(Q)=>{let Y=Q.get("vmClaim");if(!Y.runner)return FO(Q,async(X)=>{await X.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:"No sandbox runner configured on this studio instance."})})});return JQ8(Q,{ctx:Q.var.studioContext,claimName:Y.claimName,runner:Y.runner,virtualMcpId:Y.virtualMcpId,branch:Y.branch,userId:Y.userId,projectRef:Y.projectRef,virtualMcpMetadata:Y.virtualMcpMetadata})}),$.get("/:virtualMcpId/:branch/git/status",(Q)=>{if(Q.get("vmClaim").runtime==="cms")return GY8(Q);return Z(Q)});let Z=(Q)=>NQ(Q,"/_sandbox/git/status",{method:"GET",map404to410:!0,signal:AbortSignal.any([Q.req.raw.signal,AbortSignal.timeout(JY8)])});return $.post("/:virtualMcpId/:branch/git/status",(Q)=>{if(Q.get("vmClaim").runtime==="cms")return GY8(Q);return NQ(Q,"/_sandbox/git/status",{map404to410:!0,signal:AbortSignal.any([Q.req.raw.signal,AbortSignal.timeout(JY8)])})}),$.post("/:virtualMcpId/:branch/git/diff",async(Q)=>{let Y=Q.get("vmClaim");if(Y.runtime==="cms")try{let X=await Q.req.json().catch(()=>({})),J=await Vp(Q),G=await pC0(J,Y.branch,X.base);return Q.json(G,200,G9)}catch(X){return CD1(Q,X)}return NQ(Q,"/_sandbox/git/diff",{forwardJsonBody:!0,map404to410:!0})}),$.post("/:virtualMcpId/:branch/git/publish",async(Q)=>{if(Q.get("vmClaim").runtime==="cms")return Q.json({ok:!0},200,G9);let Y=ny(Q);if(Y instanceof Response)return Y;let{claimName:X,virtualMcpMetadata:J,connectionIds:G}=Q.get("vmClaim"),W=Q.var.studioContext;return y60(X,async()=>{try{await WD1(W,Y,X);let K=f60(J,G);if(K)await QY8(W,Y,X,K)}catch(K){if(K instanceof $z)return Q.json({error:K.message},403,G9);let H=K instanceof Error?K.message:String(K);return Q.json({error:H},502,G9)}return NQ(Q,"/_sandbox/git/publish",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/discard",async(Q)=>{let Y=Q.get("vmClaim");if(Y.runtime==="cms")return y60(Y.claimName,async()=>{let X=await Q.req.json().catch(()=>({})),J=Array.isArray(X.filepaths)?X.filepaths.filter((G)=>typeof G==="string"):[];if(J.length===0)return Q.json({error:"filepaths is required"},400,G9);try{let G=await Vp(Q);return await aQ8(G,Y.branch,J),Q.json({ok:!0},200,G9)}catch(G){let W=IW(G)===409||G instanceof s6?409:502,K=G instanceof Error?G.message:String(G);return Q.json({error:K},W,G9)}});return y60(Y.claimName,()=>NQ(Q,"/_sandbox/git/discard",{forwardJsonBody:!0,map404to410:!0}))}),$.post("/:virtualMcpId/:branch/git/rebase",async(Q)=>{let Y=Q.get("vmClaim");if(Y.runtime==="cms")return y60(Y.claimName,async()=>{try{let W=await Q.req.json().catch(()=>({})),K=await Vp(Q),H=W.base??await K.getDefaultBranch();return await nC0(K,Y.branch,H),Q.json({ok:!0},200,G9)}catch(W){return CD1(Q,W)}});let X=ny(Q);if(X instanceof Response)return X;let{claimName:J}=Q.get("vmClaim"),G=Q.var.studioContext;return y60(J,async()=>{try{await WD1(G,X,J)}catch(W){let K=W instanceof Error?W.message:String(W);return Q.json({error:K},502,G9)}return NQ(Q,"/_sandbox/git/rebase",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/suggest-commit",x5({maxSize:YY8,onError:(Q)=>Q.json({error:"Payload too large"},413,G9)}),async(Q)=>{let Y=Q.get("vmClaim"),X=null;if(Y.runtime!=="cms"){let H=ny(Q);if(H instanceof Response)return H;X=H}let{claimName:J,userId:G,projectRef:W}=Y,K=Q.var.studioContext;try{let H=await Q.req.json().catch(()=>({})),F=H.status,U=H.diff,N=U!=null&&typeof U.diffs==="object"&&U.diffs!==null,[B,O]=FD1(F)&&N?[F,U]:X?await Promise.all([oC0(X,J,"/_sandbox/git/status","GET",{userId:G,projectRef:W}),oC0(X,J,"/_sandbox/git/diff","GET",{userId:G,projectRef:W})]):await(async()=>{let w=await Vp(Q);return Promise.all([iC0(w,Y.branch),pC0(w,Y.branch)])})();await oG(K,J0(K).id,"suggesting a commit message");let L=await FQ8(K,B,O);return Q.json(L,200,G9)}catch(H){let F=H instanceof Error?H.message:String(H);if(F==="SANDBOX_GONE")return Q.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,G9);return Q.json({error:F},502,G9)}}),$.post("/:virtualMcpId/:branch/git/judge-review",x5({maxSize:YY8,onError:(Q)=>Q.json({error:"Payload too large"},413,G9)}),async(Q)=>{let Y=Q.get("vmClaim"),X=null;if(Y.runtime!=="cms"){let H=ny(Q);if(H instanceof Response)return H;X=H}let{claimName:J,userId:G,projectRef:W}=Y,K=Q.var.studioContext;try{let H=await Q.req.json().catch(()=>({})),F=H.status,U=H.diff,N=U!=null&&typeof U.diffs==="object"&&U.diffs!==null,[B,O]=FD1(F)&&N?[F,U]:X?await Promise.all([oC0(X,J,"/_sandbox/git/status","GET",{userId:G,projectRef:W}),oC0(X,J,"/_sandbox/git/diff","GET",{userId:G,projectRef:W})]):await(async()=>{let w=await Vp(Q);return Promise.all([iC0(w,Y.branch),pC0(w,Y.branch)])})();await oG(K,J0(K).id,"judging whether a change needs review");let L=await NQ8(K,B,O,typeof H.language==="string"?H.language:void 0);return Q.json(L,200,G9)}catch(H){let F=H instanceof Error?H.message:String(H);if(F==="SANDBOX_GONE")return Q.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,G9);return Q.json({error:F},502,G9)}}),$.get("/:virtualMcpId/:branch/preview-fetch",async(Q)=>{let Y=ny(Q);if(Y instanceof Response)return Y;let{claimName:X}=Q.get("vmClaim"),J=Q.req.query("path");if(!J||!J.startsWith("/")||J.startsWith("//")||J.includes("..")||J.includes("\\"))return Q.json({error:"Path not allowed"},403);let G;try{G=await Y.getPreviewUrl(X)}catch{return Q.json({error:"Preview not available"},502)}if(!G)return Q.json({error:"Preview not available"},502);let W=G.replace(/\/+$/,"");return SD1(Q,`${W}${J}`)}),$.post("/:virtualMcpId/:branch/preview-invoke",x5({maxSize:XY8,onError:(Q)=>Q.json({error:"Payload too large"},413)}),async(Q)=>{let Y=ny(Q);if(Y instanceof Response)return Y;let{claimName:X}=Q.get("vmClaim"),J;try{J=await Y.getPreviewUrl(X)}catch{return Q.json({error:"Preview not available"},502)}if(!J)return Q.json({error:"Preview not available"},502);let G;try{G=await Q.req.json()}catch{return Q.json({error:"Invalid JSON body"},400)}if(!G||typeof G!=="object"||Array.isArray(G))return Q.json({error:"Invalid JSON body"},400);let W=ID1(G);if(!W)return Q.json({error:"Invalid or missing __resolveType"},400);let K=VD1(J,W.resolveType);return SD1(Q,K,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(W.payload),signal:AbortSignal.timeout(30000)})}),$.post("/:virtualMcpId/:branch/catalog-invoke",x5({maxSize:XY8,onError:(Q)=>Q.json({error:"Payload too large"},413)}),async(Q)=>{let{runner:Y,claimName:X,virtualMcpMetadata:J}=Q.get("vmClaim"),G;try{G=Y?await Y.getPreviewUrl(X):Jd(J)}catch{return Q.json({error:"Preview not available"},502)}if(!G)return Q.json({error:"Preview not available"},502);let W;try{W=await Q.req.json()}catch{return Q.json({error:"Invalid JSON body"},400)}if(!W||typeof W!=="object"||Array.isArray(W))return Q.json({error:"Invalid JSON body"},400);let K=ID1(W);if(!K)return Q.json({error:"Invalid or missing __resolveType"},400);if(!eQ8(K.resolveType))return Q.json({error:"resolveType not allowed"},403);let H=VD1(G,K.resolveType);return SD1(Q,H,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(K.payload),signal:AbortSignal.timeout(30000)})}),$};var HY8=D(()=>{J8();eW();Ap();JD1();Yd();QQ8();xW();Gd();YQ8();vW();JH();XQ8();GQ8();U71();H$0();BD1();BQ8();Z7();T5();MD1();$Y8();qR0();kD1();qt6=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;Vt6=vC0(async($,Z)=>{let Q=$.var.studioContext;try{n(Q)}catch{return $.json({error:"Unauthorized"},401)}let Y=p0(Q);if(!Y)return $.json({error:"Unauthorized"},401);let X;try{X=J0(Q)}catch{return $.json({error:"Organization scope required"},403)}let J=$.req.param("virtualMcpId"),G=$.req.param("branch");if(!J||!G)return $.json({error:"virtualMcpId and branch are required"},400);try{Mt6(G)}catch(L){let w=L instanceof Error?L.message:String(L);return $.json({error:w},400)}let W=await Q.storage.virtualMcps.findById(J);if(!W||W.organization_id!==X.id)return $.json({error:"Virtual MCP not found"},404);let K=B10({orgId:X.id,virtualMcpId:J,branch:G}),H=await x91(Q,G),F=f91(H,Y),U=ZQ8({userId:F,projectRef:K}),N=W.metadata??null,B=await kt6($,{claimName:U,branch:G,virtualMcpId:J,sandboxUserId:F,virtualMcpMetadata:N,branchThread:H});if(B==="cms")return $.set("vmClaim",{claimName:U,callerUserId:Y,runner:null,virtualMcpId:J,branch:G,userId:F,projectRef:K,virtualMcpMetadata:N,connectionIds:W.connections?.map((L)=>L.connection_id)??[],runtime:B}),Z();let O;try{O=await gX(Q)}catch{O=null}if(!O)return $.json({error:"No sandbox runner found"},404);return $.set("vmClaim",{claimName:U,callerUserId:Y,runner:O,virtualMcpId:J,branch:G,userId:F,projectRef:K,virtualMcpMetadata:N,connectionIds:W.connections?.map((L)=>L.connection_id)??[],runtime:B}),Z()});tC0=new Map;G9={"Cache-Control":"no-store, no-cache, must-revalidate",Pragma:"no-cache"};WY8=["clone","install","start"]});function FY8($,Z,Q){let Y=_D1.get($);if(!Y)Y={pending:null,running:!1},_D1.set($,Y);if(!Y.pending)Y.pending={set:new Map,del:new Set,deps:Z,resolvers:[],rejecters:[]};let X=Y.pending;X.deps=Z;for(let[G,W]of Object.entries(Q.set??{}))X.set.set(G,W),X.del.delete(G);for(let G of Q.delete??[])X.del.add(G),X.set.delete(G);let J=new Promise((G,W)=>{X.resolvers.push(G),X.rejecters.push(W)});if(!Y.running)bt6($,Y);return J}async function bt6($,Z){Z.running=!0;try{while(Z.pending){let Q=Z.pending;Z.pending=null;try{let Y=await xt6(Q);for(let X of Q.resolvers)X(Y)}catch(Y){for(let X of Q.rejecters)X(Y)}}}finally{if(Z.running=!1,!Z.pending)_D1.delete($)}}async function xt6($){let{client:Z,branch:Q,packagePath:Y}=$.deps,X=new Map;for(let J=0;;J++){let G=await Ip(Z,Q),W=await Z.listDecofileEntries(G,Y),K=TD1(W,Y),H=[],F=new Map(K.map((N)=>[N.path,{stem:N.stem,sha:N.sha}]));for(let[N,B]of $.set){let O=RD1(K,N),L=`${JSON.stringify(B,null,2)}
 `;await nQ8(Z.repo,L);let w=O[0]??`${cC0(Y)}/${LD1(N)}.json`;H.push({path:w,content:L});let j=w.slice(w.lastIndexOf("/")+1,-5);F.set(w,{stem:j,content:L});for(let E of O.slice(1))H.push({path:E,deleted:!0}),F.delete(E)}for(let N of $.del)for(let B of RD1(K,N))H.push({path:B,deleted:!0}),F.delete(B);if(H.length===0)return G;let U=Y?`${Y}/.deco/blocks.gen.json`:".deco/blocks.gen.json";if(W.some((N)=>N.type==="blob"&&N.path===U)){let N=await tQ8(Z,F.values(),X),{decofile:B,skipped:O}=k60(N);if(O.length>0)console.warn("decofile gen: dropped blocks that were not valid JSON",{repo:GH(Z.repo),branch:Q,packagePath:Y,blocks:O.map((L)=>L.key)});H.push({path:U,content:B})}try{let{sha:N}=await Z.commitFiles({branch:Q,message:ft6($),expectedHead:G,changes:H});return N}catch(N){if(!(N instanceof s6)||J>=vt6-1)throw N;await z$(U7(2000,200,J,2,0.5))}}}function ft6($){let Z=(X)=>{let J=X.slice(0,3).join(", ");return X.length>3?`${J} (+${X.length-3} more)`:J},Q=[];if($.set.size>0)Q.push(`update ${Z([...$.set.keys()])}`);if($.del.size>0)Q.push(`delete ${Z([...$.del])}`);let Y=`chore(decofile): ${Q.join("; ")}`;return D51(Y,$.deps.coAuthor)}var vt6=3,_D1;var UY8=D(()=>{pA0();fC0();i4();a$();Z7();mC0();_D1=new Map});import{createHmac as NY8,randomBytes as yt6,timingSafeEqual as gt6}from"crypto";function BY8(){if(rC0)return rC0;let $;try{let Z=E0();$=Z.studioJwtSecret??Z.betterAuthSecret}catch{$=void 0}return rC0=$?Buffer.from($):yt6(32),rC0}function vD1($){let Z=$.nowMs??Date.now(),Q={o:$.organizationId,m:$.virtualMcpId,b:$.branch,e:Math.floor((Z+ht6)/1000)},Y=Buffer.from(JSON.stringify(Q)).toString("base64url"),X=NY8("sha256",BY8()).update(Y).digest("base64url");return`${Y}.${X}`}function DY8($,Z){let Q=$.indexOf(".");if(Q<0)return!1;let Y=$.slice(0,Q),X=Buffer.from($.slice(Q+1)),J=Buffer.from(NY8("sha256",BY8()).update(Y).digest("base64url"));if(X.length!==J.length||!gt6(X,J))return!1;let G;try{G=JSON.parse(Buffer.from(Y,"base64url").toString())}catch{return!1}let W=Math.floor((Z.nowMs??Date.now())/1000);return G.o===Z.organizationId&&G.m===Z.virtualMcpId&&G.b===Z.branch&&typeof G.e==="number"&&G.e>=W}var ht6=21600000,rC0=null;var OY8=D(()=>{X$()});function sC0($){return $&&typeof $==="object"&&!Array.isArray($)?$:null}function ut6($){for(let[Z,Q]of Object.entries($)){if(!Z.startsWith("collections/blog/posts/"))continue;let Y=sC0(Q)?.__resolveType;if(typeof Y==="string"&&Y)return Y}return"blog/loaders/Blogpost.ts"}function LY8($){let Z;try{Z=sC0(JSON.parse($))}catch{return $}if(!Z)return $;let Q=ut6(Z),Y={...Z},X=0;for(let[J,G]of Object.entries(Z)){if(!J.startsWith("blog-manager/posts/"))continue;let W=sC0(G),K=W&&sC0(W.post);if(!K)continue;if(K.status==="archived")continue;if(typeof K.slug!=="string"||!K.slug)continue;let F=`collections/blog/posts/${J.slice(19)}`;if(Object.hasOwn(Y,F))continue;Y[F]={name:F,__resolveType:Q,["post"]:{...K,status:"published"}},X++}return X>0?JSON.stringify(Y):$}import{z as kp}from"zod";function ct6($){return $.length>0&&$.length<=255&&!$.includes("..")&&!$.endsWith("/")&&!$.endsWith(".lock")&&lt6.test($)}function PY8($){return $.req.header("x-forwarded-host")??new URL($.req.url).host}async function g60($){let Z=$.get("decofileScope");return Wm($.var.studioContext,Z.organizationId,Z.repository)}function h60($,Z){let Q=Z instanceof Error?Z.message:String(Z);if(Z instanceof s6)return $.json({error:Q},409);let Y=IW(Z);if(Y!==null){let X=Y===404?404:Y===409||Y===422?409:502;return $.json({error:Q},X)}return $.json({error:Q},500)}function AY8(){let $=new Z1;return $.use("/:virtualMcpId/:branch",zY8),$.use("/:virtualMcpId/:branch/*",zY8),$.get("/:virtualMcpId/:branch",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await g60(Z),X=await oQ8(Y,Q.branch,Q.packagePath,{createBranchIfMissing:!!Q.userId}),J={ETag:`"${X.sha}"`,"Cache-Control":"no-store","Access-Control-Allow-Origin":"*"};if(Z.req.header("if-none-match")===`"${X.sha}"`)return Z.body(null,304,J);if(!Q.userId)return Z.body(LY8(X.decofile),200,{...J,"content-type":"application/json"});let G=vD1({organizationId:Q.organizationId,virtualMcpId:Q.virtualMcpId,branch:Q.branch});return Z.body(`{"version":${JSON.stringify(X.sha)},"token":${JSON.stringify(G)},"apiHost":${JSON.stringify(PY8(Z))},"decofile":${X.decofile}}`,200,{...J,"content-type":"application/json"})}catch(Y){return h60(Z,Y)}}),$.get("/:virtualMcpId/:branch/meta",async(Z)=>{let Q=Z.get("decofileScope"),Y=Q.packagePath?`${Q.packagePath}/.deco/meta.gen.json`:".deco/meta.gen.json";try{let X=await g60(Z),J=await X.readFileAtRef(Q.branch,Y);if(J===null){let G=await X.getDefaultBranch();if(G!==Q.branch)J=await X.readFileAtRef(G,Y)}if(J===null)return Z.json({error:"meta.gen.json not committed"},404);return Z.body(J,200,{"content-type":"application/json","Cache-Control":"no-store","Access-Control-Allow-Origin":"*"})}catch(X){return h60(Z,X)}}),$.patch("/:virtualMcpId/:branch",dt6,async(Z)=>{let Q=Z.get("decofileScope"),Y=Z.var.studioContext,X=it6.safeParse(await Z.req.json().catch(()=>null));if(!X.success)return Z.json({error:"Invalid body",details:X.error.issues},400);let J;try{J=S60(X.data)}catch(G){if(G instanceof C60)return Z.json({error:G.message},400);throw G}for(let G of[...Object.keys(J.set??{}),...J.delete??[]])try{xC0(G)}catch(W){let K=W instanceof Error?W.message:String(W);return Z.json({error:K},400)}for(let[G,W]of Object.entries(J.set??{})){if(typeof W!=="object"||W===null||Array.isArray(W))return Z.json({error:`Block "${G}" must be a JSON object`},400);if(OD1(G))return Z.json({error:`Block key "${G}" collides with a framework resolver module and cannot be written`},400)}try{let G=await g60(Z),W=await FY8(`${Q.organizationId}/${Q.virtualMcpId}/${Q.branch}`,{client:G,branch:Q.branch,packagePath:Q.packagePath,coAuthor:Tp(Y)},J),K=vD1({organizationId:Q.organizationId,virtualMcpId:Q.virtualMcpId,branch:Q.branch});return Z.json({version:W,token:K,apiHost:PY8(Z)})}catch(G){return h60(Z,G)}}),$.post("/:virtualMcpId/:branch/publish",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await g60(Z),X=await Y.getDefaultBranch();if(X===Q.branch)return Z.json({error:"Branch is already the default branch"},400);let J=`chore(decofile): publish ${Q.branch}`;try{let G;try{G=await Y.mergeBranches(X,Q.branch,J)}catch(W){if(IW(W)!==409)throw W;await nC0(Y,Q.branch,X),G=await Y.mergeBranches(X,Q.branch,J)}return G?Z.json({result:"merged",sha:G}):Z.json({result:"up-to-date"})}catch(G){if(IW(G)===409)return Z.json({error:"merge-conflict"},409);if(IW(G)===405){let K=await Y.findOpenChangeRequest(X,Q.branch)??await Y.createChangeRequest({base:X,head:Q.branch,title:`Publish ${Q.branch}`});return Z.json({result:"pull-request",number:K.number,url:K.url})}throw G}}catch(Y){return h60(Z,Y)}}),$.get("/:virtualMcpId/:branch/status",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await g60(Z),X=await Y.getDefaultBranch();if(X===Q.branch)return Z.json({baseBranch:X,aheadBy:0,behindBy:0});try{let{aheadBy:J,behindBy:G}=await Y.compare(X,Q.branch);return Z.json({baseBranch:X,aheadBy:J,behindBy:G})}catch(J){if(IW(J)===404)return Z.json({baseBranch:X,aheadBy:0,behindBy:0});throw J}}catch(Y){return h60(Z,Y)}}),$}var lt6,wY8=500,jY8=1048576,EY8=1024,mt6=8388608,dt6,it6,zY8;var TY8=D(()=>{qR0();fC0();J8();eW();JD1();bC0();kD1();Z7();UY8();OY8();MD1();mC0();JH();lt6=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;dt6=x5({maxSize:mt6,onError:($)=>$.json({error:"Payload too large"},413)}),it6=kp.object({set:kp.record(kp.string(),kp.unknown()).optional(),delete:kp.array(kp.string()).optional()}).refine(($)=>Object.keys($.set??{}).length>0||($.delete?.length??0)>0,{message:"Patch must set or delete at least one block"}).refine(($)=>Object.keys($.set??{}).length+($.delete?.length??0)<=wY8,{message:`Patch cannot touch more than ${wY8} blocks`}).refine(($)=>Object.values($.set??{}).every((Z)=>JSON.stringify(Z).length<=jY8),{message:`Each block must be at most ${jY8} bytes`}).refine(($)=>[...Object.keys($.set??{}),...$.delete??[]].every((Z)=>Z.length<=EY8),{message:`Each block key must be at most ${EY8} characters`}),zY8=vC0(async($,Z)=>{let Q=$.var.studioContext,Y=Q.organization;if(!Y)return $.json({error:"Organization scope required"},500);let X=$.req.param("virtualMcpId"),J=$.req.param("branch");if(!X||!J)return $.json({error:"virtualMcpId and branch are required"},400);if(!ct6(J))return $.json({error:`Invalid branch name: ${J}`},400);let G=Q.auth?.user?.id??null;if(!G){let B=$.req.query("token");if(!($.req.method==="GET"&&!$.req.path.match(/\/(publish|status)$/)))return $.json({error:"Unauthorized"},401);if(!B||!DY8(B,{organizationId:Y.id,virtualMcpId:X,branch:J}))return $.json({error:"Unauthorized"},401)}if(!await IJ(Q,Y.id,"cms"))return $.json({error:"This organization's plan does not include the CMS",code:"feature_not_in_plan"},403);let W=await Q.storage.virtualMcps.findById(X);if(!W||W.organization_id!==Y.id)return $.json({error:"Virtual MCP not found"},404);let K=W.metadata??null;if(!Jd(K))return $.json({error:"Project has no preview server configured"},404);let F=W.connections?.map((B)=>B.connection_id)??[],U=f60(K,F);if(!U)return $.json({error:"Project has no repository"},404);let N=K?.runtime;return $.set("decofileScope",{organizationId:Y.id,virtualMcpId:X,branch:J,packagePath:N?.path?.replace(/^\/+|\/+$/g,"")||null,repository:U,userId:G}),Z()})});var RY8=($)=>{let Z=new Z1;if(Z.use("*",$p),Z.use("*",o68),Z.route("/",n68($.voiceSessions)),Z.route("/",cS0()),Z.route("/",C58()),Z.route("/",w58()),Z.route("/",u78()),Z.route("/",c78()),Z.route("/",_78()),Z.route("/",g78()),Z.route("/",b78()),Z.route("/",SC0()),Z.route("/tools",o78()),Z.route("/",p78()),Z.route("/",F78({kvStorage:$.kvStorage})),Z.route("/",K78()),Z.route("/fs",T78({getConnection:$.getNatsConnection})),Z.route("/sandbox",KY8()),Z.route("/decofile",AY8()),Z.route("/",k78()),Z.route("/",q78()),Z.route("/deco-sites",dS0()),Z.route("/hosting",G58()),Z.route("/monitor",B58()),Z.route("/sso",yS0()),Z.route("/",CC0({tokenStorage:$.tokenStorage,automationEventDispatcher:$.automationEventDispatcher})),Z.route("/webhooks",Z58()),$.mountDevAssets)Z.route("/dev-assets",tS0({orgFromPath:!0}));return Z.use("/mcp/:connectionId?",$.mcpAuth),Z.use("/mcp/:connectionId/ui-resource",$.mcpAuth),Z.use("/mcp/gateway/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/virtual-mcp/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/self",$.mcpAuth),Z.use("/mcp/task-run/:threadId",$.mcpAuth),Z.route("/",$88()),Z.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",$.betterAuthProtectedResourceHandler),Z.get("/mcp/.well-known/oauth-protected-resource",$.betterAuthProtectedResourceHandler),Z.route("/mcp/task-run",I78()),Z.route("/mcp",xM0()),Z.route("/mcp/self",MC0()),Z.route("/mcp",gM0()),Z.all("/oauth-proxy/:connectionId/*",$.oauthProxyHandler),Z.get("/watch",$.watchHandler),Z};var qY8=D(()=>{J8();t68();r68();qS0();Q58();MN1();W58();D58();oS0();tE();PN1();CN1();H78();U78();R78();M78();j80();BN1();hM0();rB1();V78();S78();v78();x78();eB1();l78();m78();n78();$D1();r78();ZD1();fM0();HY8();TY8()});import{z as ty}from"zod";class bD1{adapter;getConnection;kvPromise;constructor($,Z){this.adapter=$;this.getConnection=Z}kv(){let $=this.getConnection();if(!$||$.isClosed())throw new q1(503,{message:"Voice transport is unavailable"});return this.kvPromise??=new VY8.Kvm(aC0.jetstream($)).create("STUDIO_VOICE_SESSIONS",{storage:aC0.StorageType.Memory,ttl:kY8.nanos(RD),max_bytes:10485760}).catch((Z)=>{throw this.kvPromise=void 0,Z}),this.kvPromise}async conversationAgent($){let Z=await this.kv(),Q=`agent.${$.conversationKey}`,Y=Date.now()+45000;while(Date.now()<Y){let X=await Z.get(Q),J=X?.operation==="PUT"?IY8.parse(X.json()):null;if(J?.state==="ready")return J.agentId;if(J?.state==="creating"&&J.expiresAt>Date.now()){await z$(200);continue}let G=MY8.encode(JSON.stringify({state:"creating",expiresAt:Date.now()+40000})),W;try{W=X&&J?await Z.update(Q,G,X.revision):await Z.create(Q,G)}catch{await z$(200);continue}try{let K=await $.ensureConversationAgent();return await Z.update(Q,MY8.encode(JSON.stringify({state:"ready",agentId:K})),W),K}catch(K){throw await Z.delete(Q,{previousSeq:W}).catch(()=>{}),K}}throw new q1(503,{message:"Voice conversation is starting; try again"})}async createSession($){let Z=this.adapter.forConversationModel($.model),Q=await this.conversationAgent(Z);try{return{provider:"elevenlabs",conversationToken:await Z.createConversationToken(Q)}}catch(Y){let X=await this.kv(),J=`agent.${Z.conversationKey}`,G=await X.get(J),W=G?.operation==="PUT"?IY8.parse(G.json()):null;if(G&&W?.state==="ready"&&W.agentId===Q)await X.delete(J,{previousSeq:G.revision}).catch(()=>{});throw Y}}}var aC0,VY8,kY8,MY8,IY8;var SY8=D(()=>{OJ();vU();a$();aC0=C(BK(),1),VY8=C($A(),1),kY8=C(zz(),1),MY8=new TextEncoder,IY8=ty.discriminatedUnion("state",[ty.object({state:ty.literal("ready"),agentId:ty.string()}),ty.object({state:ty.literal("creating"),expiresAt:ty.number()})])});import{z as Sp}from"zod";function pt6($){return{model:$.model,instructions:`${dR$}
-Start in ${$.language==="pt"?"Brazilian Portuguese":"English"}, and follow the user's language.`,delegation:{type:"client"},audio:{output:{voice:$.voice}},store:!1}}class xD1{config;constructor($){this.config=$}async createSession(){return{provider:"openai",transport:"webrtc"}}async negotiate($){let Z=await fetch("https://api.openai.com/v1/live/sessions",{method:"POST",headers:{Authorization:`Bearer ${this.config.apiKey}`,"Content-Type":"application/json","OpenAI-Safety-Identifier":$.safetyIdentifier},body:JSON.stringify({session:pt6({...this.config,language:$.language,model:$.model}),transport:{type:"webrtc",sdp:$.sdp}}),signal:AbortSignal.timeout(15000)});if(!Z.ok)throw await Z.body?.cancel(),Error(`OpenAI Live request failed (${Z.status})`);return{sdp:Sp.object({session:Sp.object({id:Sp.string().min(1)}),transport:Sp.object({type:Sp.literal("webrtc"),sdp:Sp.string().min(1).max(1e5)})}).parse(await Z.json()).transport.sdp}}}var CY8=D(()=>{vU()});var _Y8;var vY8=D(()=>{_Y8=[{name:"delegate_to_agent",description:"Submit a complete request to the selected Studio agent. Returns after acceptance while work continues in the background. Results arrive later.",parameters:{type:"object",properties:{request:{type:"string",description:"The complete user request, with relevant conversational details. Preserve intent and constraints."}},required:["request"]}},{name:"get_agent_status",description:"Read the current chat's work status and known results. This does not track independent organization tasks; delegate fresh task-status queries to the Studio agent. Use when asked, never poll.",parameters:{type:"object",properties:{}}},{name:"stop_agent_work",description:"Request cancellation in the current chat ONLY when the user explicitly asks. Speaking over the companion is not cancellation. To stop independent tasks, delegate that request to the Studio agent.",parameters:{type:"object",properties:{}}}]});function fD1($){return{conversation_config:{agent:{first_message:"",language:"en",prompt:{prompt:cR$,llm:$.conversationModel,thinking_budget:0,max_tokens:512,tools:_Y8.map((Z)=>({...Z,type:"client",expects_response:!0,response_timeout_secs:Z.name==="delegate_to_agent"?20:5,...Z.name==="delegate_to_agent"?{execution_mode:"async",interruption_mode:"allow",pre_tool_speech:"off"}:{}}))}},asr:{provider:"scribe_realtime",quality:"high"},turn:{turn_eagerness:"normal",turn_timeout:-1,silence_end_call_timeout:-1},tts:{voice_id:$.voiceId,model_id:$.model},conversation:{max_duration_seconds:RD/1000,client_events:["audio","interruption","user_transcript","agent_response","client_tool_call","vad_score"]}},platform_settings:{auth:{enable_auth:!0},privacy:{record_voice:!1,retention_days:1,delete_audio:!0,delete_transcript_and_pii:!0},overrides:{conversation_config_override:{agent:{language:!0}}}}}}var bY8=D(()=>{vU();vY8()});import{z as nX}from"zod";import{createHash as nt6,createHmac as tt6}from"crypto";class eC0{config;conversationKey;configurationKey;constructor($){this.config=$;this.configurationKey=nt6("sha256").update(JSON.stringify(fD1($))).digest("hex"),this.conversationKey=tt6("sha256",$.apiKey).update(this.configurationKey).digest("hex")}forConversationModel($){return $===this.config.conversationModel?this:new eC0({...this.config,conversationModel:$})}async request($,Z,Q){let Y=await fetch(`https://api.elevenlabs.io/v1${$}`,{method:Z===void 0?"GET":"POST",headers:{"xi-api-key":this.config.apiKey,"Content-Type":"application/json"},body:JSON.stringify(Z),signal:Q});if(!Y.ok)throw await Y.body?.cancel(),Error(`ElevenLabs request failed (${Y.status})`);return Y}async ensureConversationAgent(){let $=`Studio voice ${this.configurationKey.slice(0,24)}`,Z=await this.request(`/convai/agents?search=${encodeURIComponent($)}&page_size=100`,void 0,AbortSignal.timeout(15000)),{agents:Q}=nX.object({agents:nX.array(nX.object({agent_id:nX.string(),name:nX.string()}))}).parse(await Z.json()),Y=Q.find((J)=>J.name===$);if(Y){let J=await this.request(`/convai/agents/${encodeURIComponent(Y.agent_id)}`,void 0,AbortSignal.timeout(15000));return nX.object({platform_settings:nX.object({auth:nX.object({enable_auth:nX.literal(!0)})})}).parse(await J.json()),Y.agent_id}let X=await this.request("/convai/agents/create",{name:$,...fD1(this.config)},AbortSignal.timeout(15000));return nX.object({agent_id:nX.string().min(1)}).parse(await X.json()).agent_id}async createConversationToken($){let Z=await this.request(`/convai/conversation/token?agent_id=${encodeURIComponent($)}`,void 0,AbortSignal.timeout(15000));return nX.object({token:nX.string().min(1)}).parse(await Z.json()).token}async createTranscriptionToken(){let $=await this.request("/single-use-token/realtime_scribe",{},AbortSignal.timeout(15000));return nX.object({token:nX.string().min(1)}).parse(await $.json()).token}synthesize($,Z){return this.request(`/text-to-speech/${encodeURIComponent(this.config.voiceId)}/stream?output_format=mp3_44100_128`,{text:$,model_id:this.config.model},AbortSignal.any([Z,AbortSignal.timeout(60000)]))}}var xY8=D(()=>{bY8()});import{createHmac as ot6,timingSafeEqual as rt6}from"crypto";import{z as Cp}from"zod";function yY8($,Z){if(!Z)throw Error("Voice requires a shared authentication secret");return ot6("sha256",Z).update(`studio-voice-session:v1:${$}`).digest("base64url")}function gY8($,Z){let Q=Buffer.from(JSON.stringify(fY8.parse($))).toString("base64url");return`${Q}.${yY8(Q,Z)}`}function hY8($,Z,Q=Date.now()){if(!Z||$.length>4096)return null;let Y=$.split(".");if(Y.length!==2)return null;let[X,J]=Y;if(!X||!J)return null;let G=Buffer.from(yY8(X,Z)),W=Buffer.from(J);if(W.length!==G.length||!rt6(W,G))return null;try{let K=fY8.safeParse(JSON.parse(Buffer.from(X,"base64url").toString()));if(!K.success||K.data.expiresAt<=Q||K.data.expiresAt>Q+RD)return null;return K.data}catch{return null}}var fY8;var uY8=D(()=>{vU();fY8=Cp.object({sessionId:Cp.string().uuid(),organizationId:Cp.string().min(1).max(256),userId:Cp.string().min(1).max(256),threadId:Cp.string().min(1).max(256),expiresAt:Cp.number().int().positive()})});import{z as yD1}from"zod";function lY8($,Z){if(Z?.voice_model!=null&&Z.voice_provider==null)throw Error("A voice model override requires a provider");let Q=Z?.voice_provider??$.voiceConversationProvider;return gD1.parse({provider:Q,model:Z?.voice_model??(Q==="openai"?$.openaiLiveModel:$.elevenlabsConversationModel)})}var gD1;var cY8=D(()=>{gD1=yD1.object({provider:yD1.enum(["elevenlabs","openai"]),model:yD1.string().trim().min(1).max(128)})});import{createHash as st6}from"crypto";import{z as _p}from"zod";function vp($){return`user.${st6("sha256").update(JSON.stringify([$.organizationId,$.userId])).digest("hex")}`}class uD1{deps;kvPromise;constructor($){this.deps=$}kv(){let $=this.deps.getConnection();if(!$||$.isClosed())throw new q1(503,{message:"Voice transport is unavailable"});return this.kvPromise??=new mY8.Kvm(Z_0.jetstream($)).create("STUDIO_VOICE_SESSIONS",{storage:Z_0.StorageType.Memory,ttl:dY8.nanos(RD),max_bytes:10485760}).catch((Z)=>{throw this.kvPromise=void 0,Z}),this.kvPromise}adapter(){if(!this.deps.adapter)throw new q1(503,{message:"Voice is not configured on this deployment"});return this.deps.adapter}async create($,Z=!1,Q="en",Y){let X;if(Z)try{X=lY8(this.deps.defaults,Y)}catch{throw new q1(503,{message:"Voice configuration is invalid"})}let J=X?this.deps.conversationAdapters[X.provider]:this.adapter();if(!J)throw new q1(503,{message:"Voice is not configured on this deployment"});let G={...$,sessionId:crypto.randomUUID(),expiresAt:Date.now()+RD},W=gY8(G,this.deps.secret),K=await this.kv(),H=vp(G),F=await K.get(H),U=F?.operation==="PUT"?$_0.parse(F.json()):null,N=hD1.encode(JSON.stringify({sessionId:G.sessionId,expiresAt:G.expiresAt,conversation:X,characters:0,requests:0}));try{if(F&&U&&U.expiresAt<=Date.now())await K.update(H,N,F.revision);else await K.create(H,N)}catch{throw new q1(409,{message:"Close your other voice session before starting a new one"})}try{if(X&&"createSession"in J){let O=await J.createSession({language:Q,model:X.model,safetyIdentifier:vp($)});return{token:W,...O,expiresAt:G.expiresAt}}let B=await this.adapter().createTranscriptionToken();return{token:W,transcriptionToken:B,expiresAt:G.expiresAt}}catch(B){throw await this.release(G),B}}authorize($,Z){let Q=hY8(Z,this.deps.secret);if(!Q||Q.organizationId!==$.organizationId||Q.userId!==$.userId||Q.threadId!==$.threadId)throw new q1(403,{message:"Invalid voice session"});return Q}async connect($,Z){let Q=this.authorize($,Z.token),Y=await this.kv(),X=vp(Q),J=await Y.get(X),G=J?.operation==="PUT"?$_0.parse(J.json()):null;if(!J||!G||G.sessionId!==Q.sessionId||G.expiresAt<=Date.now())throw new q1(403,{message:"Voice session expired"});let W=G.conversation?this.deps.conversationAdapters[G.conversation.provider]:null;if(!W?.negotiate||!G.conversation)throw new q1(409,{message:"Voice session does not support SDP negotiation"});if(G.connected)throw new q1(409,{message:"Voice session already connected"});try{await Y.update(X,hD1.encode(JSON.stringify({...G,connected:!0})),J.revision)}catch{throw new q1(409,{message:"Voice session is busy"})}return W.negotiate({sdp:Z.sdp,language:Z.language,model:G.conversation.model,safetyIdentifier:X})}async speak($,Z,Q,Y){let X=this.authorize($,Z),J=await this.kv(),G=vp(X);for(let W=0;;W++){let K=await J.get(G),H=K?.operation==="PUT"?$_0.parse(K.json()):null;if(!K||!H||H.sessionId!==X.sessionId||H.expiresAt<=Date.now())throw new q1(403,{message:"Voice session expired"});if(H.characters+Q.length>24000||H.requests>=120)throw new q1(429,{message:"Voice session speech limit reached"});try{await J.update(G,hD1.encode(JSON.stringify({...H,characters:H.characters+Q.length,requests:H.requests+1})),K.revision);break}catch{if(W>=2)throw new q1(409,{message:"Voice session is busy"})}}return this.adapter().synthesize(Q,Y)}async release($){let Z=await this.kv(),Q=await Z.get(vp($));if(Q?.operation==="PUT"&&$_0.parse(Q.json()).sessionId===$.sessionId)await Z.delete(vp($),{previousSeq:Q.revision})}async revoke($,Z){await this.release(this.authorize($,Z))}}var Z_0,mY8,dY8,$_0,hD1;var iY8=D(()=>{OJ();vU();uY8();cY8();Z_0=C(BK(),1),mY8=C($A(),1),dY8=C(zz(),1),$_0=_p.object({sessionId:_p.string().uuid(),expiresAt:_p.number(),connected:_p.boolean().optional(),conversation:gD1.optional(),characters:_p.number().int().nonnegative(),requests:_p.number().int().nonnegative()}),hD1=new TextEncoder});function at6($){return $.filter((Z)=>Z.vendors?.alias).map((Z)=>({name:Z.name,title:Z.title,description:Z.description,logo:Z.logo,category:Z.category,vendor:{alias:Z.vendors.alias,url:Z.vendors.url}}))}var et6=async($,Z)=>{if(!$.get("studioContext").auth.user?.id)return $.json({error:"Unauthorized"},401);return Z()},pY8=()=>{let $=new Z1;return $.use("*",et6),$.get("/",async(Z)=>{let Q=E0(),Y=Q.decoSupabaseUrl,X=Q.decoSupabaseServiceKey;if(!Y||!X)return Z.json({apps:[]});try{let J=await QG(Y,X,"apps?select=name,title,description,logo,category,vendors(alias,url)");return Z.json({apps:at6(J)})}catch(J){return console.error("[deco-apps] GET error:",J),Z.json({error:"Failed to fetch apps"},502)}}),$};var nY8=D(()=>{J8();X$();Ck0()});import{z as y1}from"zod";function wN($,Z="invalid_request_error",Q=null,Y=null){return{error:{message:$,type:Z,param:Q,code:Y}}}function Ho6($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let Q=$.substring(0,Z),Y=$.substring(Z+1);if(!Q||!Y)return null;return{credentialId:Q,modelId:Y}}function Fo6($,Z,Q){try{return JSON.parse($)}catch{throw new rY8(`Invalid JSON in tool call arguments for function '${Q}' (tool_call_id: ${Z}): ${$}`)}}function Uo6($){let Z={};for(let Q of $)if(Q.role==="assistant"&&Q.tool_calls)for(let Y of Q.tool_calls)Z[Y.id]=Y.function.name;return $.map((Q)=>{switch(Q.role){case"system":return{role:"system",content:Q.content};case"user":if(typeof Q.content==="string")return{role:"user",content:Q.content};return{role:"user",content:Q.content.map((X)=>{if(X.type==="text")return{type:"text",text:X.text};return{type:"image",image:X.image_url.url}})};case"assistant":if(Q.tool_calls&&Q.tool_calls.length>0)return{role:"assistant",content:Q.tool_calls.map((X)=>({type:"tool-call",toolCallId:X.id,toolName:X.function.name,input:Fo6(X.function.arguments,X.id,X.function.name)}))};return{role:"assistant",content:Q.content??""};case"tool":let Y=Z[Q.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:Q.tool_call_id,toolName:Y,output:{type:"text",value:Q.content}}]}}})}function No6($){let Z=$.map((Q)=>{let Y=Q.function.parameters?mF(Q.function.parameters):mF({type:"object",properties:{}});return[Q.function.name,n$({description:Q.function.description,inputSchema:Y})]});return Object.fromEntries(Z)}function Bo6($){if(!$)return;return{openai:{response_format:$}}}function Do6(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function tY8($,Z,Q,Y,X,J){let G={model:$,instructions:Z.filter((W)=>W.role==="system"),messages:Z.filter((W)=>W.role!=="system"),tools:Q,temperature:Y.temperature,maxOutputTokens:Y.max_tokens,topP:Y.top_p,frequencyPenalty:Y.frequency_penalty,presencePenalty:Y.presence_penalty,stopSequences:Y.stop?Array.isArray(Y.stop)?Y.stop:[Y.stop]:void 0,abortSignal:J};return X?{...G,providerOptions:X}:G}function oY8($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var $o6=256,Zo6,Qo6,Yo6,Xo6,Jo6,Go6,Wo6,Ko6,rY8,sY8,aY8;var eY8=D(()=>{y4();J8();Ap();CH();Zo6=y1.object({type:y1.literal("function"),function:y1.object({name:y1.string(),description:y1.string().optional(),parameters:y1.record(y1.string(),y1.unknown()).optional()})}),Qo6=y1.object({id:y1.string(),type:y1.literal("function"),function:y1.object({name:y1.string(),arguments:y1.string()})}),Yo6=y1.discriminatedUnion("role",[y1.object({role:y1.literal("system"),content:y1.string(),name:y1.string().optional()}),y1.object({role:y1.literal("user"),content:y1.union([y1.string(),y1.array(y1.union([y1.object({type:y1.literal("text"),text:y1.string()}),y1.object({type:y1.literal("image_url"),image_url:y1.object({url:y1.string(),detail:y1.string().optional()})})]))]),name:y1.string().optional()}),y1.object({role:y1.literal("assistant"),content:y1.string().nullable().optional(),name:y1.string().optional(),tool_calls:y1.array(Qo6).optional()}),y1.object({role:y1.literal("tool"),content:y1.string(),tool_call_id:y1.string()})]),Xo6=y1.object({type:y1.literal("text")}),Jo6=y1.object({type:y1.literal("json_object")}),Go6=y1.object({type:y1.literal("json_schema"),json_schema:y1.object({name:y1.string(),description:y1.string().optional(),schema:y1.record(y1.string(),y1.unknown()),strict:y1.boolean().optional()})}),Wo6=y1.union([Xo6,Jo6,Go6]),Ko6=y1.object({model:y1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:y1.array(Yo6),stream:y1.boolean().optional().default(!1),temperature:y1.number().min(0).max(2).optional(),max_tokens:y1.number().positive().optional(),top_p:y1.number().min(0).max(1).optional(),frequency_penalty:y1.number().min(-2).max(2).optional(),presence_penalty:y1.number().min(-2).max(2).optional(),stop:y1.union([y1.string(),y1.array(y1.string())]).optional(),tools:y1.array(Zo6).optional(),tool_choice:y1.union([y1.literal("auto"),y1.literal("none"),y1.literal("required"),y1.object({type:y1.literal("function"),function:y1.object({name:y1.string()})})]).optional(),response_format:Wo6.optional(),user:y1.string().optional()});rY8=class rY8 extends Error{constructor($){super($);this.name="MessageConversionError"}};sY8=new Z1;sY8.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("studioContext"),Q=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(wN("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(wN("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==Q)return $.json(wN("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let Y=await $.req.json(),X=Ko6.safeParse(Y);if(!X.success){let w=X.error.issues[0]??{message:"Invalid request",path:[]};return $.json(wN(`Invalid request: ${w.message}`,"invalid_request_error",w.path.length>0?w.path.join("."):null),400)}let J=X.data,G=Ho6(J.model);if(!G)return $.json(wN("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=G,{modelId:K}=G;if(!W){let j=(await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id})).find((E)=>LP(E.providerId));if(!j)return $.json(wN("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=j.id}let H;try{H=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(wN(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let F=H.aiSdk.languageModel(K),U=Uo6(J.messages),N=J.tools?No6(J.tools):void 0,B=Bo6(J.response_format),O=Do6(),L=Math.floor(Date.now()/1000);if(J.stream)return FO($,async(w)=>{let j=tY8(F,U,N,J,B,$.req.raw.signal);try{let E=Qd(j),z=!1,T=0,A="",P=async()=>{if(A.length===0)return;let q=A;A="",await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{content:q},finish_reason:null}]})})};for await(let q of E.stream){if(!z&&(q.type==="text-delta"||q.type==="tool-call"))await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),z=!0;if(q.type==="text-delta"){if(A+=q.text,A.length>=$o6)await P()}else if(q.type==="tool-call"){await P();let x=T++;await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{tool_calls:[{index:x,id:q.toolCallId,type:"function",function:{name:q.toolName,arguments:JSON.stringify(q.input)}}]},finish_reason:null}]})})}else if(q.type==="finish")await P(),await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{},finish_reason:oY8(q.finishReason)}],usage:q.totalUsage?{prompt_tokens:q.totalUsage.inputTokens??0,completion_tokens:q.totalUsage.outputTokens??0,total_tokens:q.totalUsage.totalTokens??0}:void 0})})}await P(),await w.writeSSE({data:"[DONE]"})}catch(E){let z=E;console.error("[openai-compat:stream] Error:",z.message),await w.writeSSE({data:JSON.stringify({error:{message:z.message,type:"server_error"}})})}});else{let w=tY8(F,U,N,J,B,$.req.raw.signal),j=await xU(w),E={role:"assistant",content:j.text||null};if(j.toolCalls&&j.toolCalls.length>0)E.tool_calls=j.toolCalls.map((z)=>({id:z.toolCallId,type:"function",function:{name:z.toolName,arguments:JSON.stringify("input"in z?z.input:{})}})),E.content=null;return $.json({id:O,object:"chat.completion",created:L,model:J.model,choices:[{index:0,message:E,finish_reason:oY8(j.finishReason)}],usage:{prompt_tokens:j.usage?.inputTokens??0,completion_tokens:j.usage?.outputTokens??0,total_tokens:j.usage?.totalTokens??0}})}}catch(Y){let X=Y;if(X.name==="AbortError")return $.json(wN("Request aborted","invalid_request_error"),400);if(X.name==="MessageConversionError")return $.json(wN(X.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",X.message,X.stack),$.json(wN(X.message,"server_error"),500)}});aY8=sY8});function Oo6($){if(typeof $!=="object"||$===null)return!1;let Q=$.repository?.url;return typeof Q==="string"&&Q.length>0}function $X8(){let $=new Z1;return $.use("*",async(Z,Q)=>{await Q(),Z.header("Cache-Control","private, no-store"),Z.header("Vary","Cookie")}),$.get("/",async(Z)=>{let Q=Z.get("studioContext"),Y=p0(Q);if(!Y)return Z.json({error:"Authentication required"},401);let J=(Z.req.query("site")??"").trim().toLowerCase();if(!wZ(J))return Z.json({error:"Invalid site slug"},400);let G=await Q.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.id as id","organization.slug as slug","organization.name as name","organization.metadata as metadata"]).where("member.userId","=",Y).execute(),W=[];for(let H of G){if(!H.slug||k9(H))continue;let F=await Q.storage.virtualMcps.list(H.id);for(let U of F){if(NA(U)!==J)continue;if(!Oo6(U.metadata))continue;W.push({orgSlug:H.slug,orgName:H.name??H.slug,project:{id:U.id,title:U.title,icon:U.icon??null}})}}let K={matches:W};return Z.json(K)}),$}var ZX8=D(()=>{J8();aG()});var YX8;var QX8=D(()=>{YX8={name:"decocms",version:"4.427.2",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js","db:migrate:dbos":"bun run ./dist/server/migrate-dbos.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts","migrate:dbos":"bun run src/database/migrate-dbos.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^4.0.58","@ai-sdk/google":"^4.0.76","@ai-sdk/openai":"^4.0.71","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^3.1.0","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^4.0.17","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^7.0.107","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});function jo6(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??wo6}}var XX8,wo6="https://ph.studio.decocms.com",JX8;var GX8=D(()=>{J8();Ps();gf();I9();X$();eU1();QX8();XX8=new Z1;XX8.get("/",($)=>{let Z={version:YX8.version,theme:e6$(),...dK().logo&&{logo:dK().logo},...xD()&&{internalUrl:Rp1()},...E0().enableDecoImport&&{enableDecoImport:!0},brandExtractEnabled:!!E0().firecrawlApiKey,hostingEnabled:!!E0().controlplaneRestUrl&&!!E0().controlplaneServiceToken,hostingControlPlaneGa:E0().hostingControlPlaneGa,monitorEnabled:!!E0().clickhouseAnalyticsUrl&&!!E0().clickhouseAnalyticsPassword,monitorGa:E0().monitorGa,plansEnabled:E0().plansEnabled,auth:i48(),posthog:jo6(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:AO()}};return $.header("Cache-Control","no-store"),$.json({success:!0,config:Z})});JX8=XX8});function oy($){let Z=($??"").trim().toLowerCase();return Z=Z.replace(/^https?:\/\//,""),Z=Z.replace(/^www\./,""),Z=Z.split(/[/?#]/)[0]??"",Z.replace(/\/+$/,"")}function lD1($){return(oy($).split(".")[0]||$).replace(/[-_]/g," ").split(" ").filter(Boolean).map((Q)=>Q.charAt(0).toUpperCase()+Q.slice(1)).join(" ")}function WX8($,Z=64){return`https://www.google.com/s2/favicons?domain=${encodeURIComponent(oy($))}&sz=${Z}`}function Eo6($,Z){let Q=$.trim();if(Q.length<=Z)return Q;let Y=Q.slice(0,Z-1),X=Y.lastIndexOf(" ");return`${(X>Z*0.6?Y.slice(0,X):Y).trimEnd()}\u2026`}function KX8($){let{brand:Z,domain:Q,score:Y}=$,X=typeof Y==="number"?`${Z} Deco Score \u2014 ${Math.round(Y)}/100 \xB7 decocms`:`${Z} Deco Score \xB7 decocms`,J=Eo6(`How does ${Q} really perform? See the full ${Z} Deco Score \u2014 SEO, performance, conversion & AEO signals scored by decocms.`,200);return{title:X,description:J}}import{z as E$}from"zod";var zo6,HX8;var FX8=D(()=>{zo6=E$.object({check_id:E$.string(),title:E$.string(),description:E$.string().optional(),impact:E$.string().optional(),why:E$.string().optional(),category:E$.string(),severity:E$.string(),value_band:E$.string().optional(),value_driver:E$.string().optional(),controllability:E$.string().optional(),pages:E$.array(E$.string()),tasks:E$.array(E$.string()),evidence:E$.string(),sample_scope:E$.string().optional(),sources:E$.array(E$.string())}),HX8=E$.object({domain:E$.string(),brand:E$.string(),favicon:E$.string().optional(),scanned_at:E$.string().nullable(),lang:E$.string(),score:E$.number().nullable(),band:E$.string().nullable(),totals:E$.object({measured:E$.number(),registry_total:E$.number(),passed:E$.number(),failed:E$.number(),blocked:E$.number()}),buckets:E$.array(E$.object({id:E$.enum(["critical","important","worth"]),label:E$.string(),items:E$.array(zo6)})),passing:E$.object({count:E$.number(),items:E$.array(E$.object({check_id:E$.string(),title:E$.string()}))}),not_measured:E$.object({count:E$.number(),groups:E$.array(E$.object({reason:E$.string(),label:E$.string(),count:E$.number(),checks:E$.array(E$.string())}))}),categories:E$.array(E$.object({key:E$.string(),label:E$.string(),score:E$.number().nullable(),band:E$.string().nullable(),pass:E$.number(),fail:E$.number()})),screenshots:E$.array(E$.object({url:E$.string(),page_type:E$.string().optional(),viewport:E$.enum(["desktop","mobile"]),image_url:E$.string()}))})});function UX8($,Z,Q){let Y=Q?`?${new URLSearchParams({lang:Q}).toString()}`:"";return`${jW({})}/api/v2/public/diagnostics/${encodeURIComponent($)}/onepager${Z}${Y}`}async function Q_0($,Z={}){let Q=await fetch(UX8($,"",Z.lang),{headers:{Accept:"application/json"},signal:Z.signal});if(Q.status===404)return null;if(!Q.ok)throw Error(`onepager read HTTP ${Q.status}`);return HX8.parse(await Q.json())}async function NX8($,Z={}){let Q=await fetch(UX8($,".md",Z.lang),{headers:{Accept:"text/markdown"},signal:Z.signal});if(Q.status===404)return null;if(!Q.ok)throw Error(`onepager markdown HTTP ${Q.status}`);return Q.text()}var cD1=D(()=>{FX8();iB()});import{join as BX8}from"path";async function Ao6($){try{let Z=await Q_0($,{signal:AbortSignal.timeout(Po6)});if(!Z?.scanned_at)return null;return{brand:Z.brand.trim()||lD1($),...Z.score!==null?{score:Z.score}:{}}}catch{return null}}function GG($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function To6($,Z){let Q=oy($),Y=Z?.brand?.trim()||lD1(Q),X=WX8(Q,128),G=`${(E0().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(Q)}`,{title:W,description:K}=KX8({brand:Y,domain:Q,score:Z?.score}),H=`${G}/og.png`,F=`${Y} Deco Score by decocms`;return[`<title>${GG(W)}</title>`,`<meta name="description" content="${GG(K)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${GG(W)}" />`,`<meta property="og:description" content="${GG(K)}" />`,`<meta property="og:url" content="${GG(G)}" />`,`<meta property="og:image" content="${GG(H)}" />`,'<meta property="og:image:width" content="1200" />','<meta property="og:image:height" content="630" />',`<meta property="og:image:alt" content="${GG(F)}" />`,'<meta name="twitter:card" content="summary_large_image" />',`<meta name="twitter:title" content="${GG(W)}" />`,`<meta name="twitter:description" content="${GG(K)}" />`,`<meta name="twitter:image" content="${GG(H)}" />`,`<meta name="twitter:image:alt" content="${GG(F)}" />`,`<link rel="canonical" href="${GG(G)}" />`,`<link rel="alternate" type="text/markdown" href="${GG(G)}.md" />`,`<link rel="icon" href="${GG(X)}" sizes="any" />`].join(`
+Start in ${$.language==="pt"?"Brazilian Portuguese":"English"}, and follow the user's language.`,delegation:{type:"client"},audio:{output:{voice:$.voice}},store:!1}}class xD1{config;constructor($){this.config=$}async createSession(){return{provider:"openai",transport:"webrtc"}}async negotiate($){let Z=await fetch("https://api.openai.com/v1/live/sessions",{method:"POST",headers:{Authorization:`Bearer ${this.config.apiKey}`,"Content-Type":"application/json","OpenAI-Safety-Identifier":$.safetyIdentifier},body:JSON.stringify({session:pt6({...this.config,language:$.language,model:$.model}),transport:{type:"webrtc",sdp:$.sdp}}),signal:AbortSignal.timeout(15000)});if(!Z.ok)throw await Z.body?.cancel(),Error(`OpenAI Live request failed (${Z.status})`);return{sdp:Sp.object({session:Sp.object({id:Sp.string().min(1)}),transport:Sp.object({type:Sp.literal("webrtc"),sdp:Sp.string().min(1).max(1e5)})}).parse(await Z.json()).transport.sdp}}}var CY8=D(()=>{vU()});var _Y8;var vY8=D(()=>{_Y8=[{name:"delegate_to_agent",description:"Submit a complete request to the selected Studio agent. Returns after acceptance while work continues in the background. Results arrive later.",parameters:{type:"object",properties:{request:{type:"string",description:"The complete user request, with relevant conversational details. Preserve intent and constraints."}},required:["request"]}},{name:"get_agent_status",description:"Read the current chat's work status and known results. This does not track independent organization tasks; delegate fresh task-status queries to the Studio agent. Use when asked, never poll.",parameters:{type:"object",properties:{}}},{name:"stop_agent_work",description:"Request cancellation in the current chat ONLY when the user explicitly asks. Speaking over the companion is not cancellation. To stop independent tasks, delegate that request to the Studio agent.",parameters:{type:"object",properties:{}}}]});function fD1($){return{conversation_config:{agent:{first_message:"",language:"en",prompt:{prompt:cR$,llm:$.conversationModel,thinking_budget:0,max_tokens:512,tools:_Y8.map((Z)=>({...Z,type:"client",expects_response:!0,response_timeout_secs:Z.name==="delegate_to_agent"?20:5,...Z.name==="delegate_to_agent"?{execution_mode:"async",interruption_mode:"allow",pre_tool_speech:"off"}:{}}))}},asr:{provider:"scribe_realtime",quality:"high"},turn:{turn_eagerness:"normal",turn_timeout:-1,silence_end_call_timeout:-1},tts:{voice_id:$.voiceId,model_id:$.model},conversation:{max_duration_seconds:RD/1000,client_events:["audio","interruption","user_transcript","agent_response","client_tool_call","vad_score"]}},platform_settings:{auth:{enable_auth:!0},privacy:{record_voice:!1,retention_days:1,delete_audio:!0,delete_transcript_and_pii:!0},overrides:{conversation_config_override:{agent:{language:!0}}}}}}var bY8=D(()=>{vU();vY8()});import{z as nX}from"zod";import{createHash as nt6,createHmac as tt6}from"crypto";class eC0{config;conversationKey;configurationKey;constructor($){this.config=$;this.configurationKey=nt6("sha256").update(JSON.stringify(fD1($))).digest("hex"),this.conversationKey=tt6("sha256",$.apiKey).update(this.configurationKey).digest("hex")}forConversationModel($){return $===this.config.conversationModel?this:new eC0({...this.config,conversationModel:$})}async request($,Z,Q){let Y=await fetch(`https://api.elevenlabs.io/v1${$}`,{method:Z===void 0?"GET":"POST",headers:{"xi-api-key":this.config.apiKey,"Content-Type":"application/json"},body:JSON.stringify(Z),signal:Q});if(!Y.ok)throw await Y.body?.cancel(),Error(`ElevenLabs request failed (${Y.status})`);return Y}async ensureConversationAgent(){let $=`Studio voice ${this.configurationKey.slice(0,24)}`,Z=await this.request(`/convai/agents?search=${encodeURIComponent($)}&page_size=100`,void 0,AbortSignal.timeout(15000)),{agents:Q}=nX.object({agents:nX.array(nX.object({agent_id:nX.string(),name:nX.string()}))}).parse(await Z.json()),Y=Q.find((J)=>J.name===$);if(Y){let J=await this.request(`/convai/agents/${encodeURIComponent(Y.agent_id)}`,void 0,AbortSignal.timeout(15000));return nX.object({platform_settings:nX.object({auth:nX.object({enable_auth:nX.literal(!0)})})}).parse(await J.json()),Y.agent_id}let X=await this.request("/convai/agents/create",{name:$,...fD1(this.config)},AbortSignal.timeout(15000));return nX.object({agent_id:nX.string().min(1)}).parse(await X.json()).agent_id}async createConversationToken($){let Z=await this.request(`/convai/conversation/token?agent_id=${encodeURIComponent($)}`,void 0,AbortSignal.timeout(15000));return nX.object({token:nX.string().min(1)}).parse(await Z.json()).token}async createTranscriptionToken(){let $=await this.request("/single-use-token/realtime_scribe",{},AbortSignal.timeout(15000));return nX.object({token:nX.string().min(1)}).parse(await $.json()).token}synthesize($,Z){return this.request(`/text-to-speech/${encodeURIComponent(this.config.voiceId)}/stream?output_format=mp3_44100_128`,{text:$,model_id:this.config.model},AbortSignal.any([Z,AbortSignal.timeout(60000)]))}}var xY8=D(()=>{bY8()});import{createHmac as ot6,timingSafeEqual as rt6}from"crypto";import{z as Cp}from"zod";function yY8($,Z){if(!Z)throw Error("Voice requires a shared authentication secret");return ot6("sha256",Z).update(`studio-voice-session:v1:${$}`).digest("base64url")}function gY8($,Z){let Q=Buffer.from(JSON.stringify(fY8.parse($))).toString("base64url");return`${Q}.${yY8(Q,Z)}`}function hY8($,Z,Q=Date.now()){if(!Z||$.length>4096)return null;let Y=$.split(".");if(Y.length!==2)return null;let[X,J]=Y;if(!X||!J)return null;let G=Buffer.from(yY8(X,Z)),W=Buffer.from(J);if(W.length!==G.length||!rt6(W,G))return null;try{let K=fY8.safeParse(JSON.parse(Buffer.from(X,"base64url").toString()));if(!K.success||K.data.expiresAt<=Q||K.data.expiresAt>Q+RD)return null;return K.data}catch{return null}}var fY8;var uY8=D(()=>{vU();fY8=Cp.object({sessionId:Cp.string().uuid(),organizationId:Cp.string().min(1).max(256),userId:Cp.string().min(1).max(256),threadId:Cp.string().min(1).max(256),expiresAt:Cp.number().int().positive()})});import{z as yD1}from"zod";function lY8($,Z){if(Z?.voice_model!=null&&Z.voice_provider==null)throw Error("A voice model override requires a provider");let Q=Z?.voice_provider??$.voiceConversationProvider;return gD1.parse({provider:Q,model:Z?.voice_model??(Q==="openai"?$.openaiLiveModel:$.elevenlabsConversationModel)})}var gD1;var cY8=D(()=>{gD1=yD1.object({provider:yD1.enum(["elevenlabs","openai"]),model:yD1.string().trim().min(1).max(128)})});import{createHash as st6}from"crypto";import{z as _p}from"zod";function vp($){return`user.${st6("sha256").update(JSON.stringify([$.organizationId,$.userId])).digest("hex")}`}class uD1{deps;kvPromise;constructor($){this.deps=$}kv(){let $=this.deps.getConnection();if(!$||$.isClosed())throw new q1(503,{message:"Voice transport is unavailable"});return this.kvPromise??=new mY8.Kvm(Z_0.jetstream($)).create("STUDIO_VOICE_SESSIONS",{storage:Z_0.StorageType.Memory,ttl:dY8.nanos(RD),max_bytes:10485760}).catch((Z)=>{throw this.kvPromise=void 0,Z}),this.kvPromise}adapter(){if(!this.deps.adapter)throw new q1(503,{message:"Voice is not configured on this deployment"});return this.deps.adapter}async create($,Z=!1,Q="en",Y){let X;if(Z)try{X=lY8(this.deps.defaults,Y)}catch{throw new q1(503,{message:"Voice configuration is invalid"})}let J=X?this.deps.conversationAdapters[X.provider]:this.adapter();if(!J)throw new q1(503,{message:"Voice is not configured on this deployment"});let G={...$,sessionId:crypto.randomUUID(),expiresAt:Date.now()+RD},W=gY8(G,this.deps.secret),K=await this.kv(),H=vp(G),F=await K.get(H),U=F?.operation==="PUT"?$_0.parse(F.json()):null,N=hD1.encode(JSON.stringify({sessionId:G.sessionId,expiresAt:G.expiresAt,conversation:X,characters:0,requests:0}));try{if(F&&U&&U.expiresAt<=Date.now())await K.update(H,N,F.revision);else await K.create(H,N)}catch{throw new q1(409,{message:"Close your other voice session before starting a new one"})}try{if(X&&"createSession"in J){let O=await J.createSession({language:Q,model:X.model,safetyIdentifier:vp($)});return{token:W,...O,expiresAt:G.expiresAt}}let B=await this.adapter().createTranscriptionToken();return{token:W,transcriptionToken:B,expiresAt:G.expiresAt}}catch(B){throw await this.release(G),B}}authorize($,Z){let Q=hY8(Z,this.deps.secret);if(!Q||Q.organizationId!==$.organizationId||Q.userId!==$.userId||Q.threadId!==$.threadId)throw new q1(403,{message:"Invalid voice session"});return Q}async connect($,Z){let Q=this.authorize($,Z.token),Y=await this.kv(),X=vp(Q),J=await Y.get(X),G=J?.operation==="PUT"?$_0.parse(J.json()):null;if(!J||!G||G.sessionId!==Q.sessionId||G.expiresAt<=Date.now())throw new q1(403,{message:"Voice session expired"});let W=G.conversation?this.deps.conversationAdapters[G.conversation.provider]:null;if(!W?.negotiate||!G.conversation)throw new q1(409,{message:"Voice session does not support SDP negotiation"});if(G.connected)throw new q1(409,{message:"Voice session already connected"});try{await Y.update(X,hD1.encode(JSON.stringify({...G,connected:!0})),J.revision)}catch{throw new q1(409,{message:"Voice session is busy"})}return W.negotiate({sdp:Z.sdp,language:Z.language,model:G.conversation.model,safetyIdentifier:X})}async speak($,Z,Q,Y){let X=this.authorize($,Z),J=await this.kv(),G=vp(X);for(let W=0;;W++){let K=await J.get(G),H=K?.operation==="PUT"?$_0.parse(K.json()):null;if(!K||!H||H.sessionId!==X.sessionId||H.expiresAt<=Date.now())throw new q1(403,{message:"Voice session expired"});if(H.characters+Q.length>24000||H.requests>=120)throw new q1(429,{message:"Voice session speech limit reached"});try{await J.update(G,hD1.encode(JSON.stringify({...H,characters:H.characters+Q.length,requests:H.requests+1})),K.revision);break}catch{if(W>=2)throw new q1(409,{message:"Voice session is busy"})}}return this.adapter().synthesize(Q,Y)}async release($){let Z=await this.kv(),Q=await Z.get(vp($));if(Q?.operation==="PUT"&&$_0.parse(Q.json()).sessionId===$.sessionId)await Z.delete(vp($),{previousSeq:Q.revision})}async revoke($,Z){await this.release(this.authorize($,Z))}}var Z_0,mY8,dY8,$_0,hD1;var iY8=D(()=>{OJ();vU();uY8();cY8();Z_0=C(BK(),1),mY8=C($A(),1),dY8=C(zz(),1),$_0=_p.object({sessionId:_p.string().uuid(),expiresAt:_p.number(),connected:_p.boolean().optional(),conversation:gD1.optional(),characters:_p.number().int().nonnegative(),requests:_p.number().int().nonnegative()}),hD1=new TextEncoder});function at6($){return $.filter((Z)=>Z.vendors?.alias).map((Z)=>({name:Z.name,title:Z.title,description:Z.description,logo:Z.logo,category:Z.category,vendor:{alias:Z.vendors.alias,url:Z.vendors.url}}))}var et6=async($,Z)=>{if(!$.get("studioContext").auth.user?.id)return $.json({error:"Unauthorized"},401);return Z()},pY8=()=>{let $=new Z1;return $.use("*",et6),$.get("/",async(Z)=>{let Q=E0(),Y=Q.decoSupabaseUrl,X=Q.decoSupabaseServiceKey;if(!Y||!X)return Z.json({apps:[]});try{let J=await QG(Y,X,"apps?select=name,title,description,logo,category,vendors(alias,url)");return Z.json({apps:at6(J)})}catch(J){return console.error("[deco-apps] GET error:",J),Z.json({error:"Failed to fetch apps"},502)}}),$};var nY8=D(()=>{J8();X$();Ck0()});import{z as y1}from"zod";function wN($,Z="invalid_request_error",Q=null,Y=null){return{error:{message:$,type:Z,param:Q,code:Y}}}function Ho6($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let Q=$.substring(0,Z),Y=$.substring(Z+1);if(!Q||!Y)return null;return{credentialId:Q,modelId:Y}}function Fo6($,Z,Q){try{return JSON.parse($)}catch{throw new rY8(`Invalid JSON in tool call arguments for function '${Q}' (tool_call_id: ${Z}): ${$}`)}}function Uo6($){let Z={};for(let Q of $)if(Q.role==="assistant"&&Q.tool_calls)for(let Y of Q.tool_calls)Z[Y.id]=Y.function.name;return $.map((Q)=>{switch(Q.role){case"system":return{role:"system",content:Q.content};case"user":if(typeof Q.content==="string")return{role:"user",content:Q.content};return{role:"user",content:Q.content.map((X)=>{if(X.type==="text")return{type:"text",text:X.text};return{type:"image",image:X.image_url.url}})};case"assistant":if(Q.tool_calls&&Q.tool_calls.length>0)return{role:"assistant",content:Q.tool_calls.map((X)=>({type:"tool-call",toolCallId:X.id,toolName:X.function.name,input:Fo6(X.function.arguments,X.id,X.function.name)}))};return{role:"assistant",content:Q.content??""};case"tool":let Y=Z[Q.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:Q.tool_call_id,toolName:Y,output:{type:"text",value:Q.content}}]}}})}function No6($){let Z=$.map((Q)=>{let Y=Q.function.parameters?mF(Q.function.parameters):mF({type:"object",properties:{}});return[Q.function.name,n$({description:Q.function.description,inputSchema:Y})]});return Object.fromEntries(Z)}function Bo6($){if(!$)return;return{openai:{response_format:$}}}function Do6(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function tY8($,Z,Q,Y,X,J){let G={model:$,instructions:Z.filter((W)=>W.role==="system"),messages:Z.filter((W)=>W.role!=="system"),tools:Q,temperature:Y.temperature,maxOutputTokens:Y.max_tokens,topP:Y.top_p,frequencyPenalty:Y.frequency_penalty,presencePenalty:Y.presence_penalty,stopSequences:Y.stop?Array.isArray(Y.stop)?Y.stop:[Y.stop]:void 0,abortSignal:J};return X?{...G,providerOptions:X}:G}function oY8($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var $o6=256,Zo6,Qo6,Yo6,Xo6,Jo6,Go6,Wo6,Ko6,rY8,sY8,aY8;var eY8=D(()=>{y4();J8();Ap();CH();Zo6=y1.object({type:y1.literal("function"),function:y1.object({name:y1.string(),description:y1.string().optional(),parameters:y1.record(y1.string(),y1.unknown()).optional()})}),Qo6=y1.object({id:y1.string(),type:y1.literal("function"),function:y1.object({name:y1.string(),arguments:y1.string()})}),Yo6=y1.discriminatedUnion("role",[y1.object({role:y1.literal("system"),content:y1.string(),name:y1.string().optional()}),y1.object({role:y1.literal("user"),content:y1.union([y1.string(),y1.array(y1.union([y1.object({type:y1.literal("text"),text:y1.string()}),y1.object({type:y1.literal("image_url"),image_url:y1.object({url:y1.string(),detail:y1.string().optional()})})]))]),name:y1.string().optional()}),y1.object({role:y1.literal("assistant"),content:y1.string().nullable().optional(),name:y1.string().optional(),tool_calls:y1.array(Qo6).optional()}),y1.object({role:y1.literal("tool"),content:y1.string(),tool_call_id:y1.string()})]),Xo6=y1.object({type:y1.literal("text")}),Jo6=y1.object({type:y1.literal("json_object")}),Go6=y1.object({type:y1.literal("json_schema"),json_schema:y1.object({name:y1.string(),description:y1.string().optional(),schema:y1.record(y1.string(),y1.unknown()),strict:y1.boolean().optional()})}),Wo6=y1.union([Xo6,Jo6,Go6]),Ko6=y1.object({model:y1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:y1.array(Yo6),stream:y1.boolean().optional().default(!1),temperature:y1.number().min(0).max(2).optional(),max_tokens:y1.number().positive().optional(),top_p:y1.number().min(0).max(1).optional(),frequency_penalty:y1.number().min(-2).max(2).optional(),presence_penalty:y1.number().min(-2).max(2).optional(),stop:y1.union([y1.string(),y1.array(y1.string())]).optional(),tools:y1.array(Zo6).optional(),tool_choice:y1.union([y1.literal("auto"),y1.literal("none"),y1.literal("required"),y1.object({type:y1.literal("function"),function:y1.object({name:y1.string()})})]).optional(),response_format:Wo6.optional(),user:y1.string().optional()});rY8=class rY8 extends Error{constructor($){super($);this.name="MessageConversionError"}};sY8=new Z1;sY8.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("studioContext"),Q=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(wN("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(wN("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==Q)return $.json(wN("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let Y=await $.req.json(),X=Ko6.safeParse(Y);if(!X.success){let w=X.error.issues[0]??{message:"Invalid request",path:[]};return $.json(wN(`Invalid request: ${w.message}`,"invalid_request_error",w.path.length>0?w.path.join("."):null),400)}let J=X.data,G=Ho6(J.model);if(!G)return $.json(wN("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=G,{modelId:K}=G;if(!W){let j=(await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id})).find((E)=>LP(E.providerId));if(!j)return $.json(wN("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=j.id}let H;try{H=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(wN(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let F=H.aiSdk.languageModel(K),U=Uo6(J.messages),N=J.tools?No6(J.tools):void 0,B=Bo6(J.response_format),O=Do6(),L=Math.floor(Date.now()/1000);if(J.stream)return FO($,async(w)=>{let j=tY8(F,U,N,J,B,$.req.raw.signal);try{let E=Qd(j),z=!1,T=0,A="",P=async()=>{if(A.length===0)return;let q=A;A="",await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{content:q},finish_reason:null}]})})};for await(let q of E.stream){if(!z&&(q.type==="text-delta"||q.type==="tool-call"))await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),z=!0;if(q.type==="text-delta"){if(A+=q.text,A.length>=$o6)await P()}else if(q.type==="tool-call"){await P();let x=T++;await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{tool_calls:[{index:x,id:q.toolCallId,type:"function",function:{name:q.toolName,arguments:JSON.stringify(q.input)}}]},finish_reason:null}]})})}else if(q.type==="finish")await P(),await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{},finish_reason:oY8(q.finishReason)}],usage:q.totalUsage?{prompt_tokens:q.totalUsage.inputTokens??0,completion_tokens:q.totalUsage.outputTokens??0,total_tokens:q.totalUsage.totalTokens??0}:void 0})})}await P(),await w.writeSSE({data:"[DONE]"})}catch(E){let z=E;console.error("[openai-compat:stream] Error:",z.message),await w.writeSSE({data:JSON.stringify({error:{message:z.message,type:"server_error"}})})}});else{let w=tY8(F,U,N,J,B,$.req.raw.signal),j=await xU(w),E={role:"assistant",content:j.text||null};if(j.toolCalls&&j.toolCalls.length>0)E.tool_calls=j.toolCalls.map((z)=>({id:z.toolCallId,type:"function",function:{name:z.toolName,arguments:JSON.stringify("input"in z?z.input:{})}})),E.content=null;return $.json({id:O,object:"chat.completion",created:L,model:J.model,choices:[{index:0,message:E,finish_reason:oY8(j.finishReason)}],usage:{prompt_tokens:j.usage?.inputTokens??0,completion_tokens:j.usage?.outputTokens??0,total_tokens:j.usage?.totalTokens??0}})}}catch(Y){let X=Y;if(X.name==="AbortError")return $.json(wN("Request aborted","invalid_request_error"),400);if(X.name==="MessageConversionError")return $.json(wN(X.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",X.message,X.stack),$.json(wN(X.message,"server_error"),500)}});aY8=sY8});function Oo6($){if(typeof $!=="object"||$===null)return!1;let Q=$.repository?.url;return typeof Q==="string"&&Q.length>0}function $X8(){let $=new Z1;return $.use("*",async(Z,Q)=>{await Q(),Z.header("Cache-Control","private, no-store"),Z.header("Vary","Cookie")}),$.get("/",async(Z)=>{let Q=Z.get("studioContext"),Y=p0(Q);if(!Y)return Z.json({error:"Authentication required"},401);let J=(Z.req.query("site")??"").trim().toLowerCase();if(!wZ(J))return Z.json({error:"Invalid site slug"},400);let G=await Q.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.id as id","organization.slug as slug","organization.name as name","organization.metadata as metadata"]).where("member.userId","=",Y).execute(),W=[];for(let H of G){if(!H.slug||k9(H))continue;let F=await Q.storage.virtualMcps.list(H.id);for(let U of F){if(NA(U)!==J)continue;if(!Oo6(U.metadata))continue;W.push({orgSlug:H.slug,orgName:H.name??H.slug,project:{id:U.id,title:U.title,icon:U.icon??null}})}}let K={matches:W};return Z.json(K)}),$}var ZX8=D(()=>{J8();aG()});var YX8;var QX8=D(()=>{YX8={name:"decocms",version:"4.427.4",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js","db:migrate:dbos":"bun run ./dist/server/migrate-dbos.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts","migrate:dbos":"bun run src/database/migrate-dbos.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^4.0.58","@ai-sdk/google":"^4.0.76","@ai-sdk/openai":"^4.0.71","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^3.1.0","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^4.0.17","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^7.0.107","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});function jo6(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??wo6}}var XX8,wo6="https://ph.studio.decocms.com",JX8;var GX8=D(()=>{J8();Ps();gf();I9();X$();eU1();QX8();XX8=new Z1;XX8.get("/",($)=>{let Z={version:YX8.version,theme:e6$(),...dK().logo&&{logo:dK().logo},...xD()&&{internalUrl:Rp1()},...E0().enableDecoImport&&{enableDecoImport:!0},brandExtractEnabled:!!E0().firecrawlApiKey,hostingEnabled:!!E0().controlplaneRestUrl&&!!E0().controlplaneServiceToken,hostingControlPlaneGa:E0().hostingControlPlaneGa,monitorEnabled:!!E0().clickhouseAnalyticsUrl&&!!E0().clickhouseAnalyticsPassword,monitorGa:E0().monitorGa,plansEnabled:E0().plansEnabled,auth:i48(),posthog:jo6(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:AO()}};return $.header("Cache-Control","no-store"),$.json({success:!0,config:Z})});JX8=XX8});function oy($){let Z=($??"").trim().toLowerCase();return Z=Z.replace(/^https?:\/\//,""),Z=Z.replace(/^www\./,""),Z=Z.split(/[/?#]/)[0]??"",Z.replace(/\/+$/,"")}function lD1($){return(oy($).split(".")[0]||$).replace(/[-_]/g," ").split(" ").filter(Boolean).map((Q)=>Q.charAt(0).toUpperCase()+Q.slice(1)).join(" ")}function WX8($,Z=64){return`https://www.google.com/s2/favicons?domain=${encodeURIComponent(oy($))}&sz=${Z}`}function Eo6($,Z){let Q=$.trim();if(Q.length<=Z)return Q;let Y=Q.slice(0,Z-1),X=Y.lastIndexOf(" ");return`${(X>Z*0.6?Y.slice(0,X):Y).trimEnd()}\u2026`}function KX8($){let{brand:Z,domain:Q,score:Y}=$,X=typeof Y==="number"?`${Z} Deco Score \u2014 ${Math.round(Y)}/100 \xB7 decocms`:`${Z} Deco Score \xB7 decocms`,J=Eo6(`How does ${Q} really perform? See the full ${Z} Deco Score \u2014 SEO, performance, conversion & AEO signals scored by decocms.`,200);return{title:X,description:J}}import{z as E$}from"zod";var zo6,HX8;var FX8=D(()=>{zo6=E$.object({check_id:E$.string(),title:E$.string(),description:E$.string().optional(),impact:E$.string().optional(),why:E$.string().optional(),category:E$.string(),severity:E$.string(),value_band:E$.string().optional(),value_driver:E$.string().optional(),controllability:E$.string().optional(),pages:E$.array(E$.string()),tasks:E$.array(E$.string()),evidence:E$.string(),sample_scope:E$.string().optional(),sources:E$.array(E$.string())}),HX8=E$.object({domain:E$.string(),brand:E$.string(),favicon:E$.string().optional(),scanned_at:E$.string().nullable(),lang:E$.string(),score:E$.number().nullable(),band:E$.string().nullable(),totals:E$.object({measured:E$.number(),registry_total:E$.number(),passed:E$.number(),failed:E$.number(),blocked:E$.number()}),buckets:E$.array(E$.object({id:E$.enum(["critical","important","worth"]),label:E$.string(),items:E$.array(zo6)})),passing:E$.object({count:E$.number(),items:E$.array(E$.object({check_id:E$.string(),title:E$.string()}))}),not_measured:E$.object({count:E$.number(),groups:E$.array(E$.object({reason:E$.string(),label:E$.string(),count:E$.number(),checks:E$.array(E$.string())}))}),categories:E$.array(E$.object({key:E$.string(),label:E$.string(),score:E$.number().nullable(),band:E$.string().nullable(),pass:E$.number(),fail:E$.number()})),screenshots:E$.array(E$.object({url:E$.string(),page_type:E$.string().optional(),viewport:E$.enum(["desktop","mobile"]),image_url:E$.string()}))})});function UX8($,Z,Q){let Y=Q?`?${new URLSearchParams({lang:Q}).toString()}`:"";return`${jW({})}/api/v2/public/diagnostics/${encodeURIComponent($)}/onepager${Z}${Y}`}async function Q_0($,Z={}){let Q=await fetch(UX8($,"",Z.lang),{headers:{Accept:"application/json"},signal:Z.signal});if(Q.status===404)return null;if(!Q.ok)throw Error(`onepager read HTTP ${Q.status}`);return HX8.parse(await Q.json())}async function NX8($,Z={}){let Q=await fetch(UX8($,".md",Z.lang),{headers:{Accept:"text/markdown"},signal:Z.signal});if(Q.status===404)return null;if(!Q.ok)throw Error(`onepager markdown HTTP ${Q.status}`);return Q.text()}var cD1=D(()=>{FX8();iB()});import{join as BX8}from"path";async function Ao6($){try{let Z=await Q_0($,{signal:AbortSignal.timeout(Po6)});if(!Z?.scanned_at)return null;return{brand:Z.brand.trim()||lD1($),...Z.score!==null?{score:Z.score}:{}}}catch{return null}}function GG($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function To6($,Z){let Q=oy($),Y=Z?.brand?.trim()||lD1(Q),X=WX8(Q,128),G=`${(E0().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(Q)}`,{title:W,description:K}=KX8({brand:Y,domain:Q,score:Z?.score}),H=`${G}/og.png`,F=`${Y} Deco Score by decocms`;return[`<title>${GG(W)}</title>`,`<meta name="description" content="${GG(K)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${GG(W)}" />`,`<meta property="og:description" content="${GG(K)}" />`,`<meta property="og:url" content="${GG(G)}" />`,`<meta property="og:image" content="${GG(H)}" />`,'<meta property="og:image:width" content="1200" />','<meta property="og:image:height" content="630" />',`<meta property="og:image:alt" content="${GG(F)}" />`,'<meta name="twitter:card" content="summary_large_image" />',`<meta name="twitter:title" content="${GG(W)}" />`,`<meta name="twitter:description" content="${GG(K)}" />`,`<meta name="twitter:image" content="${GG(H)}" />`,`<meta name="twitter:image:alt" content="${GG(F)}" />`,`<link rel="canonical" href="${GG(G)}" />`,`<link rel="alternate" type="text/markdown" href="${GG(G)}.md" />`,`<link rel="icon" href="${GG(X)}" sizes="any" />`].join(`
     `)}function Ro6($,Z){return $.replace(/<title>[\s\S]*?<\/title>\s*/i,"").replace(/<meta\s+name="(?:description|twitter:[^"]*)"[^>]*>\s*/gi,"").replace(/<meta\s+property="og:[^"]*"[^>]*>\s*/gi,"").replace(/<link\s+rel="icon"[^>]*>\s*/gi,"").replace("</head>",`    ${Z}
   </head>`)}function DX8($){let Z=new Z1;return Z.get("/:domain/og.png",async(Q)=>{let Y=oy(Q.req.param("domain")),X=async()=>{let J=$?Bun.file(BX8($,"report-og-fallback.png")):null;if(!J||!await J.exists())return Q.notFound();return Q.body(new Uint8Array(await J.arrayBuffer()),200,{"Content-Type":"image/png","Cache-Control":"public, max-age=0, s-maxage=3600"})};try{let J=await fetch(`${jW({})}/api/v2/public/diagnostics/${encodeURIComponent(Y)}/og.png`,{signal:AbortSignal.timeout(qo6)}),G=J.headers.get("content-type")??"";if(!J.ok||!G.startsWith("image/")||!J.body)return X();return Q.body(J.body,200,{"Content-Type":G,"Cache-Control":"public, max-age=0, s-maxage=604800"})}catch{return X()}}),Z.get("/:file{.+\\.md}",async(Q)=>{let Y=oy(Q.req.param("file").replace(/\.md$/,""));try{let X=await NX8(Y,{lang:Q.req.query("lang")?.trim()||void 0,signal:AbortSignal.timeout(Mo6)});if(X===null)return Q.text("Deco Score not found",404);return Q.body(X,200,{"Content-Type":"text/markdown; charset=utf-8","Cache-Control":"public, max-age=600, stale-while-revalidate=3600","Access-Control-Allow-Origin":"*"})}catch{return Q.text("Deco Score unavailable",502)}}),Z.get("/:domain",async(Q)=>{let Y=Q.req.param("domain"),X=$?BX8($,"index.html"):null,J=X?Bun.file(X):null;if(!J||!await J.exists())return Q.notFound();let G=await J.text();try{let W=await Ao6(oy(Y)),K=To6(Y,W);return Q.html(Ro6(G,K),200,{"Cache-Control":"public, max-age=0, s-maxage=300"})}catch{return Q.html(G)}}),Z}var Po6=2500,qo6=1e4,Mo6=1e4;var OX8=D(()=>{J8();iB();cD1();X$()});function Y_0($,Z){return fetch(`${jW({})}${$}`,Z)}async function Io6($,Z){let Q=await Q_0($,{lang:Z});if(!Q)return{status:"not_found",report:null};return Q.scanned_at?{status:"ready",report:Q}:{status:"empty",report:null}}function ko6($){let Z=typeof $==="object"&&$!==null?$:{},Q=typeof Z.domain==="string"?Z.domain.trim():"",Y=typeof Z.distinctId==="string"&&Z.distinctId.trim()&&Z.distinctId.length<=200?Z.distinctId.trim():void 0;return{domain:Q,distinctId:Y}}var Vo6,NO,LX8=async($,Z)=>{if(!$.get("reportUser"))return $.json({error:"Authentication required"},401);await Z();return},wX8;var jX8=D(()=>{J8();Z3();iB();cD1();Vo6=new Set(["complete","errored","terminated","unknown"]);NO=new Z1;NO.use("*",async($,Z)=>{let Q=await x8.api.getSession({headers:$.req.raw.headers});$.set("reportUser",Q?.user?.id?{email:Q.user.email}:void 0),await Z(),$.header("Cache-Control","private, no-store"),$.header("Vary","Cookie");return});NO.use("/link-token/*",LX8);NO.use("/suggest",LX8);NO.get("/site/:domain",async($)=>{let Z=$.req.param("domain").trim();if(!Z)return $.json({error:"domain is required"},400);let Q=$.req.query("lang")?.trim()||void 0;try{return $.json(await Io6(Z,Q))}catch{return $.json({error:"report read failed"},502)}});NO.post("/run",async($)=>{let Z=$.get("reportUser"),Q;try{Q=await $.req.json()}catch{return $.json({error:"invalid JSON"},400)}let{domain:Y,distinctId:X}=ko6(Q);if(!Y)return $.json({error:"domain is required"},400);let J=Z?.email;try{let G=await Y_0("/api/v2/diagnostics/run",{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${nw({})}`},body:JSON.stringify({url:Y,...J?{email:J}:{},distinct_id:X})});if(!G.ok)return $.json({error:`run HTTP ${G.status}`},502);let W=await G.json(),K=W.blocked?{state:"blocked"}:W.status==="fresh"?{state:"fresh"}:W.mode==="sync"?{state:"sync"}:{state:"running",id:W.id??null};return $.json(K)}catch{return $.json({error:"run failed"},502)}});NO.get("/status",async($)=>{let Z=$.req.query("id");if(!Z)return $.json({error:"id is required"},400);try{let Q=await Y_0(`/api/v2/diagnostics/status?id=${encodeURIComponent(Z)}`,{headers:{Authorization:`Bearer ${nw({})}`}});if(!Q.ok)return $.json({error:`status HTTP ${Q.status}`},502);let X=(await Q.json()).status??"unknown",J={done:Vo6.has(X),status:X};return $.json(J)}catch{return $.json({error:"status failed"},502)}});NO.get("/link-token/:id",async($)=>{let Z=$.req.param("id");try{let Q=await Y_0(`/api/v2/public/link-tokens/${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(Q.status===404)return $.json(null);if(!Q.ok)return $.json({error:`link token HTTP ${Q.status}`},502);return $.json(await Q.json())}catch{return $.json({error:"link token resolve failed"},502)}});NO.get("/suggest",async($)=>{let Z=($.req.query("q")??"").trim().slice(0,64);if(Z.length<2)return $.json({suggestions:[]});try{let Q=await Y_0(`/api/v2/public/suggest?q=${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(!Q.ok)return $.json({suggestions:[]});let Y=await Q.json();return $.json({suggestions:Array.isArray(Y.suggestions)?Y.suggestions:[]})}catch{return $.json({suggestions:[]})}});wX8=NO});var So6=1048576,mD1;var EX8=D(()=>{J8();eW();X$();gU1();mD1=new Z1;mD1.post("/webhook",x5({maxSize:So6,onError:($)=>$.json({error:"payload too large"},413)}),async($)=>{let Z=E0().stripeWebhookSecret;if(!Z)return $.json({error:"stripe billing not configured"},503);let Q=await $.req.text();if(!X48(Q,$.req.header("stripe-signature"),Z))return $.json({error:"invalid signature"},400);let X=J48(Q);if(!X)return $.json({error:"invalid payload"},400);let J=await G48(X);return console.log("stripe webhook",{eventId:X.id,type:X.type,livemode:X.livemode,...J}),$.json({received:!0})})});import{timingSafeEqual as Co6}from"crypto";function bo6($,Z,Q){if(!Z?.startsWith("sha256="))return!1;let Y=new Bun.CryptoHasher("sha256",Q).update($).digest("hex"),X=Z.slice(7);if(X.length!==Y.length)return!1;return Co6(Buffer.from(X),Buffer.from(Y))}function xo6($,Z){let Q=Z,Y=Q?.repository?.name,X=Q?.repository?.owner?.login;if(typeof Y!=="string"||typeof X!=="string")return[];let J=[];if($==="check_suite"){if(Q.action!=="completed")return[];let G=Q.check_suite?.pull_requests;for(let W of Array.isArray(G)?G:[]){let K=W?.number;if(typeof K==="number")J.push(K)}}else if($==="issue_comment"&&Q.issue?.pull_request){let G=Q.issue.number;if(typeof G==="number")J.push(G)}return[...new Set(J)].map((G)=>({repoOwner:X,repoName:Y,number:G}))}function zX8($){let Z=new Z1;return Z.post("/webhook",x5({maxSize:_o6,onError:(Q)=>Q.json({error:"payload too large"},413)}),async(Q)=>{let Y=process.env.GITHUB_WEBHOOK_SECRET;if(!Y)return Q.json({error:"github webhook not configured"},503);let X=await Q.req.text();if(!bo6(X,Q.req.header("x-hub-signature-256"),Y))return Q.json({error:"invalid signature"},400);let J=Q.req.header("x-github-event");if(J!=="push"&&!vo6.has(J??""))return Q.json({ok:!0,ignored:"event"});let G;try{G=JSON.parse(X)}catch{return Q.json({error:"invalid payload"},400)}if(J==="push"){let H=G.ref,F=G.repository?.full_name;if(!H||!F)return Q.json({ok:!0,ignored:"shape"});return I10().then((U)=>U?.markTenantPoolsDirty(`https://github.com/${F}`,H)).catch((U)=>console.warn(`[github-webhook] tenant pool refresh for ${F}@${H} failed: ${U instanceof Error?U.message:String(U)}`)),Q.json({ok:!0})}let W=xo6(J??"",G);if(W.length===0)return Q.json({ok:!0,ignored:"no-pr"});let K=await fo6($,W);return Q.json({ok:!0,refreshed:K})}),Z}async function fo6($,Z){let Q=0;for(let Y of Z){let X=$.taskBoard(),J;try{J=await X.findPrLinks(Y)}catch(G){console.error("[github-webhook] pr link lookup failed:",G);continue}for(let G of J)try{let W=await X.getById(G.taskBoardItemId,G.organizationId),K=W?await $.contextFactory()(G.organizationId,W.assignedBy??W.createdBy):null;if(!K)continue;if(await vb$(K,G.organizationId,G.taskBoardItemId)!==null)Q++}catch(W){console.error(`[github-webhook] pr card refresh failed for ${G.taskBoardItemId}:`,W)}}return Q}var _o6=5242880,vo6;var PX8=D(()=>{J8();eW();vW();C7();vo6=new Set(["check_suite","issue_comment"])});import{DBOS as iD1,SchedulerMode as yo6}from"@dbos-inc/dbos-sdk";async function ho6(){try{return await uo6()}catch($){return console.warn(`[sandbox-credential-push] push failed: ${$ instanceof Error?$.message:String($)}`),null}}async function uo6(){if(!M10())return null;let[{RemoteSandboxProvider:$},{SandboxProviderRouter:Z}]=await Promise.all([Promise.resolve().then(() => (q91(),R91)),Promise.resolve().then(() => (T91(),A91))]),Q=await I10(),Y=Q instanceof Z?Q.providers.kubernetes:Q;if(!(Y instanceof $))return null;let{db:X}=D8(),{sandboxes:J,pools:G}=await Y.list(),W=Date.now(),K=eA$({sandboxes:J,pools:G,records:await $T$(X,J,G),legacyPools:JT0(process.env.STUDIO_SANDBOX_TENANT_POOLS),now:W}),{batches:H,failed:F}=await ZT$(K,MH0(X,new UX(E0().encryptionKey)),{now:W,orgFsLifetimeMs:KT0}),U=0,N=0;for(let B of H){let O=await Y.pushCredentials(B);U+=O.stored,N+=O.kept}return{sandboxes:J.length,pushed:U,kept:N,refused:K.refused,failed:F}}async function lo6($,Z){let Q=await iD1.runStep(ho6,{name:"pushSandboxCredentials"});if(Q&&(Q.refused>0||Q.failed>0))console.warn(`[sandbox-credential-push] ${Q.sandboxes} sandboxes: pushed ${Q.pushed}, kept ${Q.kept}, refused ${Q.refused}, failed ${Q.failed}`)}function AX8(){if(dD1)return;if(!E0().agentSandboxEnabled||!M10())return;dD1=iD1.registerWorkflow(lo6,{name:"sandboxCredentialPushWorkflow"}),iD1.registerScheduled(dD1,{name:"sandboxCredentialPushWorkflow",crontab:go6,mode:yo6.ExactlyOncePerIntervalWhenActive})}var go6="1-59/10 * * * *",dD1=null;var TX8=D(()=>{SG();HL();B41();HT0();GT0();vW();X$()});function RX8($){let Z=new eD($.db,new UX($.encryptionKey)),Q=new Z1;return Q.get("/attachments/:token",async(Y)=>{let X=t_$(Y.req.param("token"));if(!X)return Y.json({error:"Invalid or expired link"},404);let J=await Z.getByOrg(X.organizationId);if(!J)return Y.json({error:"Jira is not connected"},404);let W=await new lQ(J.siteUrl,J.email,J.apiToken).downloadAttachment(X.attachmentId);if(!W.ok||!W.body)return Y.json({error:"Jira refused the download"},502);let K=new Headers;for(let H of["content-type","content-length","content-disposition"]){let F=W.headers.get(H);if(F)K.set(H,F)}return K.set("cache-control","no-store"),new Response(W.body,{status:200,headers:K})}),Q}var qX8=D(()=>{J8();HL();y71();KE();c40()});import{DBOS as Zz,SchedulerMode as co6}from"@dbos-inc/dbos-sdk";function MX8($){nD1=$}function oD1(){if(!nD1)throw Error("[jira-trigger] runtime not initialized \u2014 setJiraTriggerSweepRuntime() must run before the workflow fires");return nD1}function rD1(){let $=oD1();return new eD($.db,new UX($.encryptionKey))}async function no6($){try{let Z=await rD1().getById($);if(!Z?.enabled||!Z.boardId)return{integrationId:$,started:0};let Q=await MH(oD1().db,Z.organizationId);if(!Q)return{integrationId:$,started:0};if((await Q.storage.jiraIntegrations.listAutomations(Z.organizationId)).length===0)return{integrationId:$,started:0};let X=new lQ(Z.siteUrl,Z.email,Z.apiToken),G=`(${await X.getBoardScopeJql(Z.boardId)}) AND status CHANGED AFTER "-${do6}m"`,W=0,K;for(let H=0;H<io6;H++){let F=await X.searchIssues({jql:G,nextPageToken:K});for(let U of F.issues)if(await nH1(Q,Z,{issueId:U.id,now:Date.now()})==="started")W++;if(K=F.nextPageToken??void 0,!K)break}return{integrationId:$,started:W}}catch(Z){return{integrationId:$,started:0,error:Z instanceof Error?Z.message:String(Z)}}}async function to6($,Z){let Q=await Zz.runStep(()=>rD1().listEnabledIds(),{name:"loadJiraIntegrations"});if(Q.length===0)return;let Y=await Promise.all(Q.map((X)=>Zz.runStep(()=>no6(X),{name:`sweepJira:${X}`})));for(let X of Y)if(X.error)console.warn(`[jira-trigger] integration ${X.integrationId} failed: ${X.error}`);else if(X.started>0)console.log(`[jira-trigger] integration ${X.integrationId} started ${X.started} run(s) the webhook missed`)}async function oo6($,Z){try{let Q=await rD1().getById($);if(!Q?.enabled)return"disabled";let Y=await MH(oD1().db,Q.organizationId);if(!Y)return"disabled";let X=await nH1(Y,Q,{issueId:Z.issueId,changelogId:Z.changelogId});if(X==="started")console.log(`[jira-trigger] started a run for ${Z.issueKey} after it settled`);else if(X==="returned")console.log(`[jira-trigger] ${Z.issueKey} went back where it was before settling in "${Z.toStatus}"; no run`);return X}catch(Q){return console.error(`[jira-trigger] settling ${Z.issueKey} failed`,Q instanceof Error?Q.message:Q),"error"}}async function ro6($,Z){await Zz.sleep(bk0()+po6),await Zz.runStep(()=>oo6($,Z),{name:"settleJiraMove"})}async function IX8($,Z){if(!tD1)throw Error("[jira-trigger] settle workflow is not registered");await Zz.startWorkflow(tD1,{workflowID:`jira-settle:${$}:${Z.changelogId}`})($,Z)}function VX8(){if(pD1)return;tD1=Zz.registerWorkflow(ro6,{name:"jiraSettleWorkflow"}),pD1=Zz.registerWorkflow(to6,{name:"jiraTriggerSweepWorkflow"}),Zz.registerScheduled(pD1,{name:"jiraTriggerSweepWorkflow",crontab:mo6,mode:co6.ExactlyOncePerIntervalWhenActive})}var mo6="7-59/10 * * * *",do6=35,io6=5,po6=5000,nD1=null,tD1=null,pD1=null;var sD1=D(()=>{HL();c40();Pd();KE();iH1();xk0()});function kX8($){let Z=new eD($.db,new UX($.encryptionKey));async function Q(X,J){let G=ke$(J);if(!G)return;let W=await Z.getByWebhookSecret(X);if(!W?.enabled)return;if((await Z.listAutomations(W.organizationId)).length===0)return;await IX8(W.id,G)}let Y=new Z1;return Y.post("/webhook/:secret",x5({maxSize:so6}),async(X)=>{let J=X.req.param("secret");if(!await Z.getByWebhookSecret(J))return X.json({error:"Unknown webhook"},404);let W;try{W=await X.req.json()}catch{return X.json({error:"Body must be JSON"},400)}return Q(J,W).catch((K)=>{console.error("[jira-webhook] trigger failed",K)}),X.body(null,202)}),Y}var so6=1048576;var SX8=D(()=>{J8();eW();HL();sD1();xk0();c40()});function CX8($,Z){if(Z.startsWith("text/html")||Z.startsWith("image/svg"))$.set("Content-Security-Policy","sandbox allow-scripts allow-modals allow-same-origin")}var _X8,ao6,eo6,vX8;var bX8=D(()=>{J8();OJ();kd();lc();_X8=new Z1,ao6=["range","if-none-match","if-modified-since"],eo6=["content-type","content-length","content-range","accept-ranges","etag","last-modified"];_X8.get("/:org/files/*",async($)=>{let Z=$.get("studioContext"),Q=Z.organization?.id;if(!Z.auth?.user?.id){if(ei($))return $.redirect(`/login?next=${encodeURIComponent($.req.path)}`,302);throw new q1(401,{message:"Authentication required"})}if(!Q)throw new q1(401,{message:"Organization context required"});let Y=$.req.path.replace(/^.*\/files\//,"");if(!Y)throw new q1(400,{message:"Missing file key"});let X=await s$0(Y,Z);if(!X)throw new q1(503,{message:"Object storage not configured"});if(X.startsWith("data:")&&PW()){let K=X.match(/^data:([^;]+);base64,(.+)$/s);if(!K)throw new q1(500,{message:"Invalid data URL from storage"});let[,H,F]=K,U=Buffer.from(F,"base64"),N=new Headers({"Content-Type":H,"Cache-Control":"private, max-age=86400"});return CX8(N,H),new Response(U,{status:200,headers:N})}let J=new Headers;for(let K of ao6){let H=$.req.header(K);if(H)J.set(K,H)}let G=await fetch(X,{headers:J});if(G.status===403||G.status===404)throw new q1(404,{message:"File not found"});if(!G.ok&&G.status!==304&&G.status!==416)throw console.error(`[files] upstream storage error ${G.status} for key:`,Y),new q1(502,{message:"Upstream storage error"});let W=new Headers;for(let K of eo6){let H=G.headers.get(K);if(H)W.set(K,H)}return W.set("Cache-Control","private, max-age=86400"),CX8(W,W.get("content-type")??""),new Response(G.body,{status:G.status,headers:W})});vX8=_X8});var u60=b((ry)=>{var $r6=ry&&ry.__createBinding||(Object.create?function($,Z,Q,Y){if(Y===void 0)Y=Q;var X=Object.getOwnPropertyDescriptor(Z,Q);if(!X||("get"in X?!Z.__esModule:X.writable||X.configurable))X={enumerable:!0,get:function(){return Z[Q]}};Object.defineProperty($,Y,X)}:function($,Z,Q,Y){if(Y===void 0)Y=Q;$[Y]=Z[Q]}),Zr6=ry&&ry.__exportStar||function($,Z){for(var Q in $)if(Q!=="default"&&!Object.prototype.hasOwnProperty.call(Z,Q))$r6(Z,$,Q)};Object.defineProperty(ry,"__esModule",{value:!0});Zr6(OG(),ry)});var yX8=b((xX8)=>{Object.defineProperty(xX8,"__esModule",{value:!0});xX8.version=void 0;xX8.version="3.4.0"});var uX8=b((jN)=>{var Qr6=jN&&jN.__importDefault||function($){return $&&$.__esModule?$:{default:$}};Object.defineProperty(jN,"__esModule",{value:!0});jN.NodeTransport=jN.VERSION=void 0;jN.nodeResolveHost=Kr6;var s5=u60(),Yr6=M0("net"),aD1=M0("tls"),Xr6=M0("path"),gX8=M0("fs"),Jr6=Qr6(M0("dns")),Gr6=yX8();jN.VERSION=Gr6.version;var Wr6="nats.js";class hX8{socket;version;lang;yields=[];signal=(0,s5.deferred)();closedNotification=(0,s5.deferred)();options;connected=!1;tlsName="";done=!1;closeError;constructor(){this.lang=Wr6,this.version=jN.VERSION}async connect($,Z){this.tlsName=$.tlsName,this.options=Z;let{tls:Q}=this.options,{handshakeFirst:Y}=Q||{};try{if(Y===!0)this.socket=await this.tlsFirst($);else this.socket=await this.dial($);if(this.done)this.socket?.destroy();let X=await this.peekInfo();(0,s5.checkOptions)(X,Z);let{tls_required:J,tls_available:G}=X,W=G===!0&&Z.tls!==null;if(!Y&&(J||W))this.socket=await this.startTLS();if(this.done)this.socket?.destroy();if(J&&this.socket.encrypted!==!0)throw s5.errors.InvalidArgumentError.format("tls","is not available on this server");return this.connected=!0,this.setupHandlers(),this.signal.resolve(),Promise.resolve()}catch(X){let J=X;if(!J)J=new s5.errors.ConnectionError("error connecting - node provided an undefined error");let{code:G}=J,W=G==="ECONNREFUSED"?new s5.errors.ConnectionError("connection refused",{cause:J}):J;throw this.socket?.destroy(),W}}dial($){let Z=(0,s5.deferred)(),Q,Y=(0,Yr6.createConnection)($.port,$.hostname,()=>{Z.resolve(Y),Y.removeAllListeners()});return Y.on("error",(X)=>{Q=X}),Y.on("close",()=>{Y.removeAllListeners(),Z.reject(Q)}),Y.setNoDelay(!0),Z}get isClosed(){return this.done}close($){return this._closed($,!1)}peekInfo(){let $=(0,s5.deferred)(),Z;return this.socket.on("data",(Q)=>{this.yields.push(Q);let Y=s5.DataBuffer.concat(...this.yields),X=(0,s5.extractProtocolMessage)(Y);if(X!=="")try{let J=s5.INFO.exec(X);if(!J)throw Error("unexpected response from server");let G=JSON.parse(J[1]);$.resolve(G)}catch(J){$.reject(J)}finally{this.socket.removeAllListeners()}}),this.socket.on("error",(Q)=>{Z=Q}),this.socket.on("close",()=>{this.socket.removeAllListeners(),$.reject(Z)}),$}loadFile($){if(!$)return Promise.resolve();let Z=(0,s5.deferred)();try{if($=(0,Xr6.resolve)($),!(0,gX8.existsSync)($))Z.reject(Error(`${$} doesn't exist`));(0,gX8.readFile)($,(Q,Y)=>{if(Q)return Z.reject(Q);Z.resolve(Y)})}catch(Q){Z.reject(Q)}return Z}async loadClientCerts(){let $={},{certFile:Z,cert:Q,caFile:Y,ca:X,keyFile:J,key:G}=this.options.tls;try{if(Z){let W=await this.loadFile(Z);if(W)$.cert=W}else if(Q)$.cert=Q;if(J){let W=await this.loadFile(J);if(W)$.key=W}else if(G)$.key=G;if(Y){let W=await this.loadFile(Y);if(W)$.ca=[W]}else if(X)$.ca=X;return Promise.resolve($)}catch(W){return Promise.reject(W)}}async tlsFirst($){let Z,Q={servername:this.tlsName,rejectUnauthorized:!0};if(this.socket)Q.socket=this.socket;if(typeof this.options.tls==="object")try{let X=await this.loadClientCerts()||{};Q=(0,s5.extend)(Q,this.options.tls,X)}catch(X){return Promise.reject(new s5.errors.ConnectionError(X.message,{cause:X}))}let Y=(0,s5.deferred)();try{let X=(0,aD1.connect)($.port,$.hostname,Q,()=>{X.removeAllListeners(),Y.resolve(X)});X.on("error",(J)=>{Z=J}),X.on("secureConnect",()=>{if(Q.rejectUnauthorized===!1)return;if(!X.authorized)throw X.authorizationError}),X.on("close",()=>{Y.reject(Z),X.removeAllListeners()}),X.setNoDelay(!0)}catch(X){Y.reject(new s5.errors.ConnectionError(X.message,{cause:X}))}return Y}async startTLS(){let $,Z={socket:this.socket,servername:this.tlsName,rejectUnauthorized:!0};if(typeof this.options.tls==="object")try{let Y=await this.loadClientCerts()||{};Z=(0,s5.extend)(Z,this.options.tls,Y)}catch(Y){return Promise.reject(new s5.errors.ConnectionError(Y.message,{cause:Y}))}let Q=(0,s5.deferred)();try{let Y=(0,aD1.connect)(Z,()=>{Y.removeAllListeners(),Q.resolve(Y)});Y.on("error",(X)=>{$=X}),Y.on("secureConnect",()=>{if(Z.rejectUnauthorized===!1)return;if(!Y.authorized)throw Y.authorizationError}),Y.on("close",()=>{Q.reject($),Y.removeAllListeners()})}catch(Y){Q.reject(new s5.errors.ConnectionError(Y.message,{cause:Y}))}return Q}setupHandlers(){let $;this.socket.on("data",(Z)=>{return this.yields.push(Z),this.signal.resolve()}),this.socket.on("error",(Z)=>{$=Z}),this.socket.on("end",()=>{if(this.socket?.destroyed)return;this.socket?.write(new Uint8Array(0),()=>{this.socket?.end()})}),this.socket.on("close",()=>{this._closed($,!1)})}[Symbol.asyncIterator](){return this.iterate()}async*iterate(){while(!0){if(this.yields.length===0)await this.signal;let $=this.yields;this.yields=[];for(let Z=0;Z<$.length;Z++){if(this.options.debug)console.info(`> ${(0,s5.render)($[Z])}`);yield $[Z]}if(this.done)break;else if(this.yields.length===0)$.length=0,this.yields=$,this.signal=(0,s5.deferred)()}}discard(){if(this.done=!0,this.socket)try{this.socket.removeAllListeners(),this.socket.destroy()}catch{}}disconnect(){this._closed(void 0,!0).then().catch()}isEncrypted(){return this.socket instanceof aD1.TLSSocket}_send($){if(this.isClosed||this.socket===void 0)return Promise.resolve();if(this.options.debug)console.info(`< ${(0,s5.render)($)}`);let Z=(0,s5.deferred)();try{this.socket.write($,(Q)=>{if(Q){if(this.options.debug)console.error(`!!! ${(0,s5.render)($)}: ${Q}`);return Z.reject(Q)}return Z.resolve()})}catch(Q){if(this.options.debug)console.error(`!!! ${(0,s5.render)($)}: ${Q}`);Z.reject(Q)}return Z}send($){this._send($).catch((Q)=>{})}async _closed($,Z=!0){if(!this.connected)return;if(this.done){this.socket?.destroy();return}if(this.closeError=$,!$&&this.socket&&Z)try{await this._send(new TextEncoder().encode(""))}catch(Q){if(this.options.debug)console.log("transport close terminated with an error",Q)}try{if(this.socket)this.socket.removeAllListeners(),this.socket?.destroy(),this.socket=void 0}catch(Q){console.log(Q)}this.done=!0,this.closedNotification.resolve(this.closeError)}closed(){return this.closedNotification}}jN.NodeTransport=hX8;function Kr6($){let Z=(0,s5.deferred)();return Jr6.default.lookup($,{all:!0},(Q,Y)=>{if(Q){Z.reject(Q);return}let X=[];for(let J of Y)X.push(J.address);if(X.length===0)X.push($);Z.resolve(X)}),Z}});var iX8=b((dX8)=>{Object.defineProperty(dX8,"__esModule",{value:!0});dX8.connect=Hr6;var lX8=uX8(),cX8=u60(),mX8=u60();function Hr6($={}){if((0,mX8.hasWsProtocol)($))return Promise.reject(mX8.errors.InvalidArgumentError.format("servers","node client doesn't support websockets, use the 'wsconnect' function instead"));return(0,cX8.setTransportFactory)({factory:()=>{return new lX8.NodeTransport},dnsResolveFn:lX8.nodeResolveHost}),cX8.NatsConnectionImpl.connect($)}});var pX8=b((BO)=>{var Ur6=BO&&BO.__createBinding||(Object.create?function($,Z,Q,Y){if(Y===void 0)Y=Q;var X=Object.getOwnPropertyDescriptor(Z,Q);if(!X||("get"in X?!Z.__esModule:X.writable||X.configurable))X={enumerable:!0,get:function(){return Z[Q]}};Object.defineProperty($,Y,X)}:function($,Z,Q,Y){if(Y===void 0)Y=Q;$[Y]=Z[Q]}),Nr6=BO&&BO.__exportStar||function($,Z){for(var Q in $)if(Q!=="default"&&!Object.prototype.hasOwnProperty.call(Z,Q))Ur6(Z,$,Q)};Object.defineProperty(BO,"__esModule",{value:!0});BO.connect=void 0;var Br6=iX8();Object.defineProperty(BO,"connect",{enumerable:!0,get:function(){return Br6.connect}});Nr6(u60(),BO)});function rX8($){let Z=$?.connectFn??wr6,Q=null,Y=null,X=!1,J=!1,G=!1,W=[];function K(){return Q!==null&&!Q.isClosed()&&!Q.isDraining()&&!G}function H(){console.log(`[NatsProvider] fireReady: ${W.length} callbacks`);for(let N of W)try{N()}catch{}}function F(N){(async()=>{for await(let B of N.status())if(B.type==="disconnect")console.log("[NatsProvider] Disconnected"),G=!0;else if(B.type==="reconnect")console.log("[NatsProvider] Reconnected, re-firing ready callbacks"),G=!1,Y=null,H()})().catch(()=>{})}async function U(N,B){let O=0;while(!J)try{Q=await Z({servers:N,timeout:Lr6,reconnect:!0,maxReconnectAttempts:-1,...B?{authenticator:B}:{}}),console.log(`[NatsProvider] Connected to ${Q.getServer()} after ${O} attempt(s)`),Y=null,G=!1,F(Q),H();return}catch{O++;let L=U7(Or6,Dr6,O-1,2,0.5);await z$(L)}}return{init(N,B){if(X)return;X=!0,J=!1;let O=B?.creds?nX8.credsAuthenticator(new TextEncoder().encode(B.creds)):void 0;U(N,O).catch(()=>{})},isConnected(){return K()},getConnection(){return K()?Q:null},getJetStream(){if(!K())return null;if(!Y)Y=oX8.jetstream(Q);return Y},onReady(N){if(W.push(N),K())try{N()}catch{}},async drain(){if(J=!0,X=!1,Y=null,G=!1,Q){let N=Q;Q=null,await N.drain().catch(()=>{})}}}}function wr6($){return tX8.connect($)}var nX8,tX8,oX8,Dr6=100,Or6=3000,Lr6=3000;var sX8=D(()=>{a$();nX8=C(zz(),1),tX8=C(pX8(),1),oX8=C(BK(),1)});function X_0($){let Z=$?.ttlMs??60000,Q=$?.maxSize??1e4,Y=$?.updateRecencyOnGet??!1,X=new Map;function J(){if(X.size<=Q)return;let G=Date.now();for(let[W,K]of X)if(K.expiresAt<=G)X.delete(W);while(X.size>Q){let W=X.keys().next().value;if(W===void 0)break;X.delete(W)}}return{get(G){let W=X.get(G);if(!W)return;if(W.expiresAt<=Date.now()){X.delete(G);return}if(Y)X.delete(G),X.set(G,W);return W.value},set(G,W){X.delete(G),X.set(G,{value:W,expiresAt:Date.now()+Z}),J()},delete(G){X.delete(G)},clear(){X.clear()},size(){return X.size}}}function J_0($,Z){return`${$}.${Z}`}class eD1{cache;constructor($){this.cache=X_0({ttlMs:$?.ttlMs??jr6,maxSize:$?.maxSize??Er6})}async get($,Z){return this.cache.get(J_0($,Z))??null}async set($,Z,Q){this.cache.set(J_0($,Z),Q)}async invalidate($,Z){this.cache.delete(J_0($,Z)),this.cache.delete(J_0($,`${Z}:decisions`))}teardown(){this.cache.clear()}}var jr6=600000,Er6=5000;var aX8=()=>{};function G_0($,Z){return`${$}:${Z}`}function $O1($){let Z=X_0({ttlMs:$?.ttlMs??zr6,maxSize:$?.maxSize??Pr6}),Q=$?.getConnection,Y=crypto.randomUUID(),X=new TextEncoder,J=new TextDecoder,G=null;function W(K,H){let F=Q?.();if(!F)return;try{F.publish(eX8,X.encode(JSON.stringify({organizationId:K,keyId:H,originId:Y})))}catch(U){console.warn("[ProviderKeyCache] Publish failed (non-critical):",U)}}return{get(K,H){return Z.get(G_0(K,H))},set(K,H,F){Z.set(G_0(K,H),F)},invalidate(K,H){Z.delete(G_0(K,H)),W(K,H)},start(){if(G)return;let K=Q?.();if(!K)return;G=K.subscribe(eX8),(async()=>{for await(let H of G)try{let F=JSON.parse(J.decode(H.data));if(F.originId===Y)continue;Z.delete(G_0(F.organizationId,F.keyId))}catch{}})().catch(console.error)},teardown(){G?.unsubscribe(),G=null,Z.clear()}}}var eX8="studio.ai-provider-keys.invalidate",zr6=30000,Pr6=5000;var $J8=()=>{};class ZO1{options;subscription=null;onCancel=null;encoder=new TextEncoder;originId=crypto.randomUUID();constructor($){this.options=$}async start($){if($)this.onCancel=$;if(this.subscription)return;if(!this.onCancel)return;let Z=this.options.getConnection();if(!Z)return;let Q=new TextDecoder,Y=Z.subscribe("studio.decopilot.cancel");this.subscription=Y,(async()=>{for await(let X of Y)try{let J=JSON.parse(Q.decode(X.data));if(J.originId===this.originId)continue;this.onCancel?.(J.taskId)}catch{}})().catch(console.error)}broadcast($){if(/[.*>\s]/.test($)){console.warn("[NatsCancelBroadcast] Invalid threadId, skipping broadcast");return}this.onCancel?.($);try{let Z=this.options.getConnection();if(!Z)return;let Q=this.encoder.encode(JSON.stringify({taskId:$,originId:this.originId}));Z.publish("studio.decopilot.cancel",Q)}catch(Z){console.warn("[NatsCancelBroadcast] Publish failed (non-critical):",Z)}}async stop(){this.subscription?.unsubscribe(),this.subscription=null,this.onCancel=null}}var ZJ8=($)=>{let Z;return()=>Z??=$()},QO1,YO1;var QJ8=D(()=>{k6();QO1=ZJ8(()=>e1.createHistogram("decopilot.stream.encode_ms",{description:"Per-chunk JSON.stringify+encode time for decopilot stream",unit:"ms"})),YO1=ZJ8(()=>e1.createCounter("decopilot.stream.published_chunks",{description:"Logical decopilot stream chunks published to JetStream",unit:"{chunks}"}))});function Vr6($=JJ8){return{name:iU,subjects:[`${mY1}.>`],storage:iH.StorageType.File,max_age:Rr6,max_bytes:Mr6,max_msgs_per_subject:Ir6,discard:iH.DiscardPolicy.Old,retention:iH.RetentionPolicy.Limits,duplicate_window:qr6,num_replicas:$}}class GJ8{chunks=0;encodeMs=0;maxMs=0;bytes=0;windowStart=performance.now();constructor(){setInterval(()=>this.flush(),1e4).unref?.()}record($,Z){if(this.chunks++,this.encodeMs+=$,$>this.maxMs)this.maxMs=$;this.bytes+=Z}flush(){let $=performance.now(),Z=$-this.windowStart;if(this.chunks>0&&Z>0)console.warn(JSON.stringify({msg:"stream-encode-trace",windowMs:Math.round(Z),chunks:this.chunks,encodeMs:Math.round(this.encodeMs),pctOfLoop:+(this.encodeMs/Z*100).toFixed(1),maxChunkMs:+this.maxMs.toFixed(2),mbEncoded:+(this.bytes/1048576).toFixed(2)}));this.chunks=0,this.encodeMs=0,this.maxMs=0,this.bytes=0,this.windowStart=$}}function YJ8($){let Z=XJ8.headers();for(let[Q,Y]of Object.entries($))Z.set(Q,Y);return Z}function _r6($,Z){let Q=0;return{publish(Y,X,J,G){Y.publish(X,J,G?{headers:G}:void 0).catch((W)=>{if(Q++,Tr6().add(1,{"org.id":Z??"unknown"}),Q===1||Q%100===0)console.warn(`[Decopilot] JetStream publish failed for thread ${$} (${Q} total):`,W)})},get errorCount(){return Q}}}function vr6($,Z){return $.info?.cluster?Z:1}function br6($){if(!($ instanceof Error))return!1;if(/non-clustered/i.test($.message))return!0;return/replicas?\b/i.test($.message)&&/not supported|can ?not|exceed|insufficient|greater than/i.test($.message)}class XO1{options;js=null;jsm=null;constructor($){this.options=$}async init(){let $=this.options.getConnection();if(!$){console.log("[Decopilot] StreamBuffer.init skipped: NATS not connected yet");return}let Z=async(Y,X)=>{let J=Vr6(X);try{await Y.streams.info(iU),await Y.streams.update(iU,J)}catch(G){if(G instanceof Error&&G.message.includes("stream not found"))await Y.streams.add(J),await Y.streams.update(iU,J);else if(G instanceof Error&&/can ?not change.*storage|storage type/i.test(G.message))await Y.streams.delete(iU),await Y.streams.add(J);else throw G}},Q=await E8(async()=>{let Y=this.options.getJetStreamManager?await this.options.getJetStreamManager():await iH.jetstreamManager($),X=vr6($,JJ8);try{await Z(Y,X)}catch(J){if(X<=1||!br6(J))throw J;console.warn(`[Decopilot] StreamBuffer: NATS rejected num_replicas=${X} (${J.message}); falling back to an unreplicated stream`),await Z(Y,1)}return Y},{maxAttempts:5,minTimeout:250,maxTimeout:4000,jitter:0.5,isRetriable:gd});this.js=this.options.getJetStream(),this.jsm=Q,console.log(`[Decopilot] StreamBuffer.init ${this.js?"ready":"degraded (js=null)"}`)}pump($,Z,Q,Y){let X=this.js;if(!X)return console.warn(`[Decopilot] pump: JetStream client unavailable for thread ${Z}; chunks NOT published to NATS`),Promise.resolve();let J=_r6(Z,Y),G=!1,W=()=>{if(G)return;G=!0;let H=wy$(Z);X.publish(H.subject,H.data).catch(()=>{})};Q.addEventListener("abort",W,{once:!0});let K=(H)=>{let F=performance.now(),U=iY1(H,{runId:Z}),N=performance.now()-F;QO1().record(N),YO1().add(1,{"org.id":Y??"unknown"}),Cr6?.record(N,U.reduce((B,O)=>B+O.data.length,0));for(let B of U)J.publish(X,B.subject,B.data,B.headers?YJ8(B.headers):void 0)};return(async()=>{let H=$.getReader(),F=0,U=0,N;try{while(!0){let{done:B,value:O}=await H.read();if(B)break;if(K(O),U++,++F>=64)F=0,await new Promise((L)=>setImmediate(L))}}catch(B){N=B,console.warn(`[Decopilot] stream pump error for thread ${Z}:`,B?.message??B)}finally{if(H.releaseLock(),W(),Sr6)console.warn(JSON.stringify({msg:"decopilot-stream-diag",event:"pump-done",taskId:Z,publishedChunks:U,publishErrors:J.errorCount}))}if(N!==void 0)throw N})()}async publishSerialized($,Z){try{return await E8(()=>$.publish(Z.subject,Z.data,{...Z.headers?{headers:YJ8(Z.headers)}:{},...Z.msgId?{msgID:Z.msgId}:{}}),{maxAttempts:6,minTimeout:250,maxTimeout:5000,jitter:0.5,isRetriable:gd}),!0}catch(Q){return console.error(`[Decopilot] publish failed after retries subject=${Z.subject}`,Q),!1}}async publishRawChunk($,Z,Q){let Y=this.js;if(!Y)return!1;let X=performance.now(),J=iY1(Z,{runId:$,dedup:Q});QO1().record(performance.now()-X),YO1().add(1);for(let G of J)if(!await this.publishSerialized(Y,G))return!1;return!0}async publishDone($,Z,Q){let Y=this.js;if(!Y)return!1;let X=Ly$({runId:$,fenceToken:Z,finalSeq:Q});return await this.publishSerialized(Y,X)}async createTailStream($,Z,Q){let Y=this.js;if(!Y)return console.warn(`[Decopilot] createTailStream: JetStream client unavailable for thread ${$}; no live tail`),null;let X=Q?.deliverPolicy==="new"?iH.DeliverPolicy.New:iH.DeliverPolicy.All,J=Q?.closeOnDone??!1,G=LE($),W;try{W=await E8(async()=>{return(await Y.consumers.get(iU,{filter_subjects:G,deliver_policy:X})).consume()},{maxAttempts:6,minTimeout:250,maxTimeout:5000,jitter:0.5,isRetriable:gd})}catch(L){return console.warn("[Decopilot] JetStream tail unavailable (non-critical):",L?.message??L),null}let F=QM0({messages:async function*(){try{for await(let L of W)yield{subject:L.subject,data:L.data,headers:L.headers}}finally{W.stop()}}(),onCancel:()=>W.stop()}).pipeThrough(aq0()).pipeThrough(eq0()).getReader(),U=!1,N=()=>{if(U)return;U=!0;try{F.releaseLock()}catch{}},B=!1,O=()=>{if(B)return;B=!0,W.stop(),F.cancel().catch(()=>{}),N()};return Z?.addEventListener("abort",O,{once:!0}),new ReadableStream({async pull(L){for(;;){let{done:w,value:j}=await F.read();if(w){O(),L.close();return}let E=j;if(E.kind==="done"){if(J){O(),L.close();return}continue}L.enqueue(E.chunk);return}},cancel(){O()}})}purge($){if(!this.jsm)return;this.jsm.streams.purge(iU,{filter:LE($)}).catch(()=>{})}teardown(){this.js=null,this.jsm=null}}var iH,XJ8,Ar6=($)=>{let Z;return()=>Z??=$()},Tr6,Rr6=86400000000000,qr6=120000000000,Mr6=4294967296,JJ8,Ir6=500000,kr6,Sr6,Cr6;var WJ8=D(()=>{a$();pY1();YM0();$M0();k6();QJ8();iH=C(BK(),1),XJ8=C(zz(),1),Tr6=Ar6(()=>e1.createCounter("decopilot.stream.publish_errors",{description:"Number of JetStream publish failures for decopilot stream chunks",unit:"{errors}"})),JJ8=Math.max(1,Number(process.env.DECOPILOT_STREAM_REPLICAS??3)||3);kr6=process.env.STREAM_ENCODE_TRACE==="1",Sr6=process.env.DECOPILOT_STREAM_TRACE==="1";Cr6=kr6?new GJ8:null});function W_0($,Z,Q,Y){if(!Y)return!1;return $.emit(Z,NF(Q,Y.status,{title:Y.title??void 0,virtualMcpId:Y.virtual_mcp_id??void 0,createdBy:Y.created_by??void 0,triggerId:Y.trigger_id??null,branch:Y.branch??null,harnessId:Y.harness_id??void 0,createdAt:Y.created_at,updatedAt:Y.updated_at})),!0}var KJ8=D(()=>{p8()});class JO1{storage;options;timer=null;constructor($,Z={}){this.storage=$;this.options=Z}start(){if(this.timer)return;let $=this.options.intervalMs??300000;this.timer=setInterval(()=>{this.runOnce()},$)}async runOnce(){let $=this.options.staleAfterMs??3600000;try{let Z=await this.storage.sweepAbandoned($);if(Z>0)console.log(`[async-research-sweeper] marked ${Z} stale jobs as abandoned`);return Z}catch(Z){return console.error("[async-research-sweeper] sweep failed",Z),0}}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}function xr6($,Z,Q={}){let Y=$.startsWith("thread:")?AH($,Q):$;return[...new Set([Z,Y].filter((X)=>!!X))]}async function GO1($,Z){let Q=Z.organizationId;try{let Y=await $.storage.taskBoard.linkedThreadIds(Z.id,Q);for(let X of Y){let J=await _U($,X);if(!J?.owner||!J?.name)continue;let G=await $.storage.threads.get(X),W=await um($,{threadId:X,runBranch:G?.branch}),K=await b00($,Q,H41(J)).catch(()=>null);if(!K){console.warn(`[task-board] no credential for ${J.owner}/${J.name} \u2014 `+`cannot look up ${Z.id}'s change request by branch`);continue}let H=xr6(W,await TT0($,X),{flat:Uf(K.repo.provider)});for(let F of H){let U=await K.readForBranch(F).catch(()=>null);if(!U)continue;return await $.storage.taskBoard.linkPr({taskBoardItemId:Z.id,organizationId:Q,url:U.url,prNumber:U.number,repo:K.repo}),await $.storage.taskBoard.openReviewCycleIfInProgress(Z.id,Q),await O3(Q).catch(()=>{}),console.log(`[task-board] ${Z.id}: linked ${U.url} found on branch ${F}`),!0}}}catch(Y){console.error("[task-board] PR lookup by branch failed",Y)}return!1}var HJ8=D(()=>{Z7();xW();C7()});async function FJ8($,Z,Q){let Y=Z.organizationId;if(!uX(Z))return!1;if(!vf(Q))return!1;if(await $.storage.taskBoard.hasHumanRejectedDone(Z.id,Y))return!1;let X=await $.storage.organizationSettings.get(Y),J=LU(X?.flags),G=await $.storage.taskBoard.update(Z.id,Y,{status:J},Z.updatedBy);return await $5($,{taskBoardItemId:Z.id,action:"status_changed",actorId:null,data:{from:Z.status,to:J,reason:"pr_merged"}}),L8(Y,G),console.log(`[task-board-review-sweeper] ${Z.id}: linked PR already merged \u2014 moved to ${J}`),!0}var UJ8=D(()=>{x4();cY();Td();IH();P9()});function cr6($){return $ instanceof kX}function NJ8($,Z){return Z-$>=ur6}class WO1{taskBoard;contextFactory;billing;options;timer=null;running=!1;cursor=null;constructor($,Z,Q,Y={}){this.taskBoard=$;this.contextFactory=Z;this.billing=Q;this.options=Y}start(){if(this.timer)return;let $=this.options.intervalMs??fr6;this.timer=setInterval(()=>{this.runOnce()},$),this.timer.unref()}async runOnce(){if(this.running)return 0;this.running=!0;let $=0;try{let Z=this.options.batchSize??gr6,Q=this.options.itemIntervalMs??yr6,Y=new Date(Date.now()-Q),X=await this.taskBoard.listItemsPendingReview(Z,this.cursor,Y),J=X.at(-1);this.cursor=X.length===Z&&J?{updatedAt:J.updatedAt,id:J.id}:null;for(let{id:G,organizationId:W}of X)try{if(await this.reconcileItem(G,W,Y))$++}catch(K){console.error(`[task-board-review-sweeper] ${G} failed`,K)}await this.reapNeverStartedThreads(Z),$+=await this.dispatchDueRetries(Z),await this.reactToUnhandledFailures(Z),$+=await this.settleFinishedRunsWithoutPr(Z,Y)}catch(Z){console.error("[task-board-review-sweeper] sweep failed",Z)}finally{this.running=!1}return $}async reapNeverStartedThreads($){try{let Z=await this.taskBoard.failNeverStartedLinkedThreads($,new Date(Date.now()-C71),aQ1);for(let Q of Z)console.warn(`[task-board-review-sweeper] failed never-started thread ${Q.threadId} on ${Q.itemId}`)}catch(Z){console.error("[task-board-review-sweeper] reaping failed",Z)}}async reactToUnhandledFailures($){let Z=await this.taskBoard.listItemsStuckAfterFailure($,new Date(Date.now()-lr6));for(let{id:Q,organizationId:Y,threadId:X}of Z)try{console.warn(`[task-board-review-sweeper] reacting to an unhandled failure on ${Q}`),await oQ1(this.taskBoard,X,Y),await rQ1(this.taskBoard,this.billing,X,Y)}catch(J){console.error(`[task-board-review-sweeper] unhandled-failure reaction for ${Q} failed`,J)}}async settleFinishedRunsWithoutPr($,Z){let Q=0,Y=await this.taskBoard.listItemsFinishedWithoutPr($,Z);for(let{id:X,organizationId:J,finishedAt:G}of Y)try{if(!await this.taskBoard.claimSweep(X,J,Z))continue;let W=await this.taskBoard.getById(X,J);if(!W||W.status!==R$.progress||uX(W)||W.assigneeId!==R8)continue;let K=await this.contextFactory(J,W.assignedBy??W.createdBy);if(!K)continue;if(await GO1(K,W)){if(await this.taskBoard.clearSweepBudget(X,J),await this.reconcileItem(X,J,Z))Q++;continue}if(!NJ8(G.getTime(),Date.now()))continue;let H="the run finished without opening a pull request \u2014 there is "+"nothing for a reviewer to review",F=await this.taskBoard.advanceToReviewIfInProgress(X,J,W.updatedBy);if(!F)continue;await this.taskBoard.recordActivity({taskBoardItemId:X,action:"status_changed",actorId:null,data:{from:R$.progress,to:R$.review,reason:H}}).catch(()=>{}),L8(J,F),await VH(K,F,H)}catch(W){console.error(`[task-board-review-sweeper] settling finished run on ${X} failed`,W)}return Q}async dispatchDueRetries($){let Z=0,Q=await this.taskBoard.listItemsDueForRetry($,new Date);for(let{id:Y,organizationId:X,attempts:J}of Q)try{if(!await this.taskBoard.claimDueRetry(Y,X,new Date))continue;let G=await this.taskBoard.getById(Y,X);if(!G||G.status!==R$.progress||G.assigneeId!==R8)continue;let W=await this.contextFactory(X,G.assignedBy??G.createdBy);if(!W)continue;await kH(W,G,{runClass:"retry"}),Z++,console.warn(`[task-board-review-sweeper] re-dispatched ${Y} after a failure (attempt ${J})`)}catch(G){if(console.error(`[task-board-review-sweeper] retry dispatch for ${Y} failed`,G),cr6(G)){await this.returnToTodo(Y,X,G instanceof Error?G.message:String(G));continue}await this.taskBoard.scheduleRunRetry(Y,X,J,new Date(Date.now()+hr6)).catch((W)=>console.error(`[task-board-review-sweeper] re-arming ${Y} failed`,W))}return Z}async returnToTodo($,Z,Q){try{let Y=await this.taskBoard.getById($,Z);if(!Y||Y.status!==R$.progress)return;let X=await this.taskBoard.returnToTodoAfterFailure($,Z,Y.updatedBy);if(!X)return;await this.taskBoard.recordActivity({taskBoardItemId:$,action:"status_changed",actorId:null,data:{from:"in_progress",to:"todo",reason:Q}}).catch(()=>{}),L8(Z,X)}catch(Y){console.error(`[task-board-review-sweeper] returning ${$} to todo failed`,Y)}}async handOffReviewWithoutPr($,Z){let Q=await this.taskBoard.listActivity(Z.id,Z.organizationId);if(!NJ8(XD(Q,Z.reviewCycleStartedAt),Date.now()))return;await VH($,Z,"no pull request is linked to this task \u2014 there is nothing for a "+"reviewer to review")}async reconcileItem($,Z,Q){if(!await this.taskBoard.claimSweep($,Z,Q))return!1;let Y=await this.taskBoard.getById($,Z);if(!Y)return!1;if(!uX(Y))return!1;let X=Y.assigneeId===R8,J=await this.taskBoard.listPrs($,Z),G=await this.contextFactory(Z,Y.assignedBy??Y.createdBy);if(!G)return!1;if(J.length===0){if(await GO1(G,Y))J=await this.taskBoard.listPrs($,Z);if(J.length===0){if(X)await this.handOffReviewWithoutPr(G,Y);return!1}}let W=await Promise.all(J.map(async(K)=>({...K,...await Md(Z,K)})));if(W.every((K)=>K.state===null))console.warn(`[task-board-review-sweeper] ${$}: no live PR state from GitHub (${W.length} PR(s)) \u2014 proceeding on unknown`);if(await FJ8(G,Y,W))return!0;if(await zg$(G,Y))return!0;if(await this.resolveConflictFromSweep(G,Y,W))return!0;if(!X)return!1;if(!iQ1(W))return!1;return await Rd(G,Y,{previewMatchesHead:pQ1(W)}),!0}async resolveConflictFromSweep($,Z,Q){let Y=Q.find((X)=>X.state!=="closed"&&X.conflict===!0);if(!Y)return!1;return await NE($,Z.organizationId,Z,{pr:{number:Y.number,url:Y.url},conflict:!0}).catch((X)=>{return console.error("[task-board-review-sweeper] conflict resolve failed",X),!1})}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}var fr6=60000,yr6=300000,gr6=50,hr6=60000,ur6=900000,lr6=120000;var BJ8=D(()=>{x4();Dq0();HJ8();mU();K80();IH();UJ8();P9();MW();eQ1();C7();b$0();qd()});import{readdir as mr6,rm as K_0}from"fs/promises";import{join as H_0}from"path";async function F_0($){let Z=new Date;Z.setUTCDate(Z.getUTCDate()-dr6),Z.setUTCHours(0,0,0,0);let Q=0;try{let Y=await sy($);for(let X of Y)if(/^\d{4}$/.test(X))Q+=await DJ8($,X,Z);else if(!X.startsWith(".")){let J=H_0($,X),G=await sy(J);for(let K of G){if(!/^\d{4}$/.test(K))continue;Q+=await DJ8(J,K,Z)}if((await sy(J)).length===0)await K_0(J,{recursive:!0,force:!0})}}catch(Y){console.warn("monitoring retention cleanup failed:",Y)}return Q}async function DJ8($,Z,Q){let Y=0,X=H_0($,Z),J=await sy(X);for(let W of J){if(!/^\d{2}$/.test(W))continue;let K=H_0(X,W),H=await sy(K);for(let U of H){if(!/^\d{2}$/.test(U))continue;let N=new Date(`${Z}-${W}-${U}T00:00:00Z`);if(isNaN(N.getTime()))continue;if(N<Q){let B=H_0(K,U);await K_0(B,{recursive:!0,force:!0}),Y++}}if((await sy(K)).length===0)await K_0(K,{recursive:!0,force:!0})}if((await sy(X)).length===0)await K_0(X,{recursive:!0,force:!0});return Y}async function sy($){try{return(await mr6($)).filter((Q)=>!Q.startsWith("."))}catch{return[]}}var dr6=30;var KO1=()=>{};import{DBOS as HO1,SchedulerMode as ir6}from"@dbos-inc/dbos-sdk";async function nr6(){let $=[JK(),Gg(),qN()],Z=0;for(let Q of $)try{Z+=await F_0(Q)}catch(Y){console.error("[monitoring-retention] cleanup failed:",Y)}return console.log(`[monitoring-retention] deleted ${Z} day-dir(s) across ${$.length} signal dir(s)`),{deleted:Z,dirs:$.length}}async function tr6($,Z){await HO1.runStep(()=>nr6(),{name:"monitoringRetention"})}function LJ8(){if(OJ8)return;OJ8=!0;let $=HO1.registerWorkflow(tr6,{name:"monitoringRetentionWorkflow"});HO1.registerScheduled($,{name:"monitoringRetentionWorkflow",crontab:pr6,mode:ir6.ExactlyOncePerIntervalWhenActive})}var pr6="23 4 * * *",OJ8=!1;var wJ8=D(()=>{_3();KO1()});function jJ8($){return async(Z,Q)=>{let Y=await $.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.role","organization.id as orgId","organization.slug as orgSlug","organization.name as orgName"]).where("member.userId","=",Q).where("member.organizationId","=",Z).executeTakeFirst();if(!Y)return console.warn(`[automationContextFactory] User ${Q} not found in org ${Z} \u2014 returning null`),null;let X=await cQ.create();X.auth.user={id:Q,role:Y.role},X.organization={id:Y.orgId,slug:Y.orgSlug,name:Y.orgName};let J=await HA($.db,Z,Y.role);return X.boundAuth=SU1({auth:X.authInstance,headers:new Headers,role:Y.role,permissions:J,userId:Q}),X.access=new oP(Q,void 0,X.boundAuth,Y.role,"self"),UE(X,{id:Y.orgId,slug:Y.orgSlug}),X}}var EJ8=D(()=>{bK();BU()});function or6(){return[{name:"Postgres",status:"pending",port:0},{name:"NATS",status:"pending",port:0}]}function rr6(){return{services:or6(),migrationsStatus:"pending",serverUrl:null,logs:[]}}function ar6(){for(let $ of sr6)$()}function zJ8($){let Z=[...FO1.logs,$];FO1={...FO1,logs:Z.length>500?Z.slice(-500):Z},ar6()}function UO1(){return er6}var FO1,sr6,er6=!1;var NO1=D(()=>{FO1=rr6(),sr6=new Set});import{EventEmitter as $s6}from"events";var BO1;var PJ8=D(()=>{NO1();BO1=new $s6;BO1.on("request",($)=>{zJ8($)})});function AJ8(){return async($,Z)=>{let Q=Date.now(),Y=$.req.method,X=$.req.path;if(X==="/api/auth/get-session"||X.includes("favicon")){await Z();return}let J="",G=!1;if(X.startsWith("/mcp")&&Y==="POST"){G=!0;try{if($.req.header("Content-Type")?.includes("application/json")){let N=await $.req.raw.clone().json();if(N.method==="tools/call"&&N.params?.name){let B=bp(N.params.name),O=N.params.arguments||{},L=Object.keys(O).map((j)=>bp(j)),w=L.length>0?L.slice(0,3).join(",")+(L.length>3?"\u2026":""):"";J=`${W9.tool}${B}${W9.dim}(${w})${W9.reset}`}else if(N.method)J=`${W9.dim}${bp(N.method)}${W9.reset}`}}catch{}}let W=bp(X);if(X.startsWith("/mcp/conn_")){let F=X.split("/")[2]??"";W=`/mcp/${W9.mcp}${bp(F.slice(0,12))}\u2026${W9.reset}`}else if(X==="/mcp")W=`${W9.mcp}/mcp${W9.reset}`;else if(X==="/mcp/registry")W=`${W9.mcp}/mcp/registry${W9.reset}`;let K=Qs6(Y),H=G?"\u25C0":"\u2190";if(!UO1())console.log(`${W9.dim}${H}${W9.reset} ${K}${Y}${W9.reset} ${W}${J?` ${J}`:""}`);try{await Z()}finally{let F=Date.now()-Q,U=$.res.status,N=Zs6(U),B=F<1000?`${F}ms`:`${(F/1000).toFixed(1)}s`,O=G?"\u25B6":"\u2192";if(!UO1())console.log(`${W9.dim}${O}${W9.reset} ${K}${Y}${W9.reset} ${W}${J?` ${J}`:""} ${N}${U}${W9.reset} ${W9.duration}${B}${W9.reset}`);BO1.emit("request",{method:Y,path:bp(X),status:U,duration:F,timestamp:new Date})}}}var W9,Zs6=($)=>{if($>=500)return W9.serverError;if($>=400)return W9.clientError;if($>=300)return W9.redirect;return W9.ok},Qs6=($)=>{return W9[$]||W9.reset},bp=($)=>{return $.replace(/\r/g,"").replace(/\n/g,"").replace(/\x1b\[[0-9;]*m/g,"").replace(/[\x00-\x1f\x7f-\x9f]/g,"")};var TJ8=D(()=>{NO1();PJ8();W9={reset:"\x1B[0m",dim:"\x1B[2m",bold:"\x1B[1m",GET:"\x1B[36m",POST:"\x1B[33m",PUT:"\x1B[35m",DELETE:"\x1B[31m",ok:"\x1B[32m",redirect:"\x1B[36m",clientError:"\x1B[33m",serverError:"\x1B[31m",mcp:"\x1B[35m",tool:"\x1B[96m",duration:"\x1B[90m"}});import{createHmac as IJ8}from"crypto";import{mkdir as Ys6,readdir as Xs6,rm as RJ8,stat as VJ8}from"fs/promises";import{join as OO1,relative as Js6}from"path";import{z as Q8}from"zod";function SJ8($){let Z=$.replace(/[^a-zA-Z0-9_-]/g,"_");return OO1(Gs6,Z)}function CJ8($){return $.replace(/^\/+/,"").replace(/\.\./g,"")}function DO1($,Z){let Q=SJ8($),Y=CJ8(Z);return OO1(Q,Y)}function Ws6($,Z,Q,Y){let X=E0().encryptionKey||"dev-secret",J=`${$}:${Z}:${Q}:${Y}`;return IJ8("sha256",X).update(J).digest("hex")}function MJ8($,Z,Q,Y,X){let J=Math.floor(Date.now()/1000)+Y,G=Ws6(Z,Q,J,X),W=new URL(`/api/dev-assets/${Z}/${CJ8(Q)}`,$);return W.searchParams.set("expires",J.toString()),W.searchParams.set("signature",G),W.searchParams.set("method",X),W.toString()}function _J8($,Z,Q){let Y=`${$}:${Z.getTime()}:${Q}`;return`"${IJ8("md5","etag").update(Y).digest("hex")}"`}async function vJ8($,Z,Q,Y,X){try{let J=await Xs6($,{withFileTypes:!0});for(let G of J){let W=OO1($,G.name),H=Js6(Z,W).replace(/\\/g,"/");if(Q&&!H.startsWith(Q))continue;if(G.isDirectory())if(Y){let F=H+"/";if(!Q||F.startsWith(Q)){if(!(Q?H.slice(Q.length):H).includes("/"))X.commonPrefixes.add(F)}}else await vJ8(W,Z,Q,Y,X);else if(G.isFile()){if(Y&&Q){let F=H.slice(Q.length);if(F.includes(Y)){let U=F.indexOf(Y),N=Q+F.slice(0,U+1);X.commonPrefixes.add(N);continue}}try{let F=await VJ8(W);X.objects.push({key:H,size:F.size,lastModified:F.mtime.toISOString(),etag:_J8(W,F.mtime,F.size)})}catch{}}}}catch{}}function bJ8($,Z){let Y=J0($).id;return[{name:"LIST_OBJECTS",description:"List objects in the local assets directory with pagination support",inputSchema:Q8.object({prefix:Q8.string().optional(),maxKeys:Q8.number().optional().default(1000),continuationToken:Q8.string().optional(),delimiter:Q8.string().optional()}),outputSchema:Q8.object({objects:Q8.array(Q8.object({key:Q8.string(),size:Q8.number(),lastModified:Q8.string(),etag:Q8.string()})),nextContinuationToken:Q8.string().optional(),isTruncated:Q8.boolean(),commonPrefixes:Q8.array(Q8.string()).optional()}),handler:async(X)=>{let J=X,G=J.prefix||"",W=J.maxKeys??1000,K=J.delimiter,H=J.continuationToken,F=SJ8(Y);await Ys6(F,{recursive:!0});let U={objects:[],commonPrefixes:new Set};await vJ8(F,F,G,K,U),U.objects.sort((w,j)=>w.key.localeCompare(j.key));let N=0;if(H){if(N=U.objects.findIndex((w)=>w.key>H),N===-1)N=U.objects.length}let B=U.objects.slice(N,N+W),O=N+W<U.objects.length,L=O?B[B.length-1]?.key:void 0;return{objects:B,isTruncated:O,nextContinuationToken:L,commonPrefixes:Array.from(U.commonPrefixes).sort()}}},{name:"GET_OBJECT_METADATA",description:"Get metadata for a file in the local assets directory",inputSchema:Q8.object({key:Q8.string()}),outputSchema:Q8.object({contentType:Q8.string().optional(),contentLength:Q8.number(),lastModified:Q8.string(),etag:Q8.string(),metadata:Q8.record(Q8.string(),Q8.string()).optional()}),handler:async(X)=>{let J=X,G=DO1(Y,J.key),W=await VJ8(G);return{contentType:kN1(J.key),contentLength:W.size,lastModified:W.mtime.toISOString(),etag:_J8(G,W.mtime,W.size)}}},{name:"GET_PRESIGNED_URL",description:"Generate a presigned URL for downloading a file from local storage",inputSchema:Q8.object({key:Q8.string(),expiresIn:Q8.number().optional()}),outputSchema:Q8.object({url:Q8.string(),expiresIn:Q8.number()}),handler:async(X)=>{let J=X,G=tD(J.expiresIn,qJ8);return{url:MJ8(Z,Y,J.key,G,"GET"),expiresIn:G}}},{name:"PUT_PRESIGNED_URL",description:"Generate a presigned URL for uploading a file to local storage",inputSchema:Q8.object({key:Q8.string(),expiresIn:Q8.number().optional(),contentType:Q8.string().optional()}),outputSchema:Q8.object({url:Q8.string(),expiresIn:Q8.number()}),handler:async(X)=>{let J=X,G=tD(J.expiresIn,qJ8);return{url:MJ8(Z,Y,J.key,G,"PUT"),expiresIn:G}}},{name:"DELETE_OBJECT",description:"Delete a single file from local storage",inputSchema:Q8.object({key:Q8.string()}),outputSchema:Q8.object({success:Q8.boolean(),key:Q8.string()}),handler:async(X)=>{let J=X,G=DO1(Y,J.key);try{return await RJ8(G),{success:!0,key:J.key}}catch{return{success:!1,key:J.key}}}},{name:"DELETE_OBJECTS",description:"Delete multiple files from local storage",inputSchema:Q8.object({keys:Q8.array(Q8.string()).max(1000)}),outputSchema:Q8.object({deleted:Q8.array(Q8.string()),errors:Q8.array(Q8.object({key:Q8.string(),message:Q8.string()}))}),handler:async(X)=>{let J=X,G=[],W=[];return await Promise.all(J.keys.map(async(K)=>{let H=DO1(Y,K);try{await RJ8(H),G.push(K)}catch(F){W.push({key:K,message:F instanceof Error?F.message:"Unknown error"})}})),{deleted:G,errors:W}}}]}async function LO1($,Z,Q){let Y=bJ8(Z,Q),X=new Yw({name:"dev-assets-mcp",version:"1.0.0"},{capabilities:{tools:{}},jsonSchemaValidator:vZ});for(let G of Y){let W="shape"in G.inputSchema?G.inputSchema.shape:Q8.object({}).shape,K=G.outputSchema&&"shape"in G.outputSchema?G.outputSchema.shape:Q8.object({}).shape;X.registerTool(G.name,{description:G.description??"",inputSchema:W,outputSchema:K,annotations:G.annotations,_meta:G._meta},async(H)=>{try{let F=await G.handler(H);return{content:[{type:"text",text:JSON.stringify(F)}],structuredContent:F}}catch(F){return{content:[{type:"text",text:`Error: ${F.message}`}],isError:!0}}})}let J=new z3({enableJsonResponse:$.headers.get("Accept")?.includes("application/json")??!1});return await X.connect(J),mW(X,J,$,"mcp:dev-assets")}async function xJ8($,Z,Q,Y){let J=bJ8(Q,Y).find((G)=>G.name===$);if(!J)return{content:[{type:"text",text:`Tool not found: ${$}`}],isError:!0};try{let G=await J.handler(Z);return{content:[{type:"text",text:JSON.stringify(G)}]}}catch(G){return{content:[{type:"text",text:G instanceof Error?G.message:String(G)}],isError:!0}}}var Gs6="./data/assets",qJ8=3600,kJ8,fJ8;var yJ8=D(()=>{X$();id();J8();IJ0();dd();NJ();oD();oS0();kJ8=new Z1;kJ8.all("/",async($)=>{let Z=$.get("studioContext"),Q=new URL($.req.url),Y=`${Q.protocol}//${Q.host}`;return LO1($.req.raw,Z,Y)});fJ8=kJ8});var gJ8={};$6(gJ8,{mountDevRoutes:()=>Ks6});function Ks6($,Z){$.all("/mcp/:connectionId{.*_dev-assets$}",Z,async(Y)=>{let X=Y.get("studioContext"),J=new URL(Y.req.url),G=`${J.protocol}//${J.host}`;return LO1(Y.req.raw,X,G)}),$.all("/mcp/:connectionId{.*_dev-assets$}/call-tool/:toolName",Z,async(Y)=>{let X=Y.get("studioContext"),J=new URL(Y.req.url),G=`${J.protocol}//${J.host}`,W=Y.req.param("toolName");if(!W)return Y.json({error:"Missing tool name"},400);let K=await Y.req.json(),H=await xJ8(W,K,X,G);if(H.isError)return Y.json(H.content,500);return Y.json(H.content)}),$.use("/mcp/dev-assets",Z),$.route("/mcp/dev-assets",fJ8);let Q=new Z1;Q.use("*",mH({mountPath:"/api/dev-assets"})),Q.route("/",tS0({orgFromPath:!1})),$.route("/api/dev-assets",Q)}var hJ8=D(()=>{J8();AN1();oS0();yJ8()});var oJ8={};$6(oJ8,{watchHandler:()=>tJ8,resolveCorsOrigin:()=>pJ8,isSsoExemptPath:()=>dJ8,isAllowedOAuthRedirectUri:()=>nJ8,createApp:()=>js6});import{readFileSync as Hs6}from"fs";import{PrometheusSerializer as Fs6}from"@opentelemetry/exporter-prometheus";import{DBOS as DO}from"@dbos-inc/dbos-sdk";import{oAuthDiscoveryMetadata as Bs6,oAuthProtectedResourceMetadata as Ds6}from"better-auth/plugins";async function Us6($){let Z=$.connect(),Q;try{Q=await Promise.race([Z,lJ8(uJ8)])}catch{return Z.then((Y)=>Y.release(!0)).catch(()=>{}),!1}try{return await Promise.race([Q.query("SELECT 1"),lJ8(uJ8)]),Q.release(),!0}catch{return Q.release(!0),!1}}function lJ8($){return new Promise((Z,Q)=>setTimeout(()=>Q(Error("pg health-check timeout")),$))}function dJ8($){return $.startsWith("/api/org-sso/")||/^\/api\/[^/]+\/sso\//.test($)||$.startsWith("/api/auth/")||$.startsWith("/api/tools/management")||$.startsWith("/oauth-proxy/")||/^\/api\/[^/]+\/oauth-proxy\//.test($)||$.startsWith(`${bS0}/`)||$.startsWith(`${VS0}/`)}function iJ8($){return $==="local.studio.decocms.com"}function pJ8($,{baseUrl:Z,requestOrigin:Q}){let Y;try{Y=new URL($).hostname}catch{return null}if(Y==="localhost"||Y==="127.0.0.1")return $;if(iJ8(Y))return $;let X=Z??Q;try{if(new URL(X).origin===$)return $}catch{}return null}function nJ8($,Z){return $.origin===new URL(Z).origin||$.hostname==="localhost"||iJ8($.hostname)}async function js6($={}){let Z=$.database??D8(),Q=!1;_5.stop().catch((K0)=>{console.error("[SSEHub] Error stopping previous broadcast (HMR cleanup):",K0)});let Y,X,J,G,W=new eD1,K,H,F,U=null;if($.disableNats)K=$O1(),Y={get:async()=>null,set:async()=>{},invalidate:async()=>{},teardown:()=>{}},X=null,J=null,G=new w80,H={start:async()=>{},broadcast:()=>{},stop:async()=>{}},F={init:async()=>{},pump:(K0)=>{return(async()=>{let H0=K0.getReader();try{while(!0){let{done:R0}=await H0.read();if(R0)break}}catch{}finally{H0.releaseLock()}})()},publishRawChunk:async()=>!1,publishDone:async()=>!1,createTailStream:async()=>null,purge:()=>{},teardown:()=>{}};else{U=rX8();let K0=E0().natsCredsPath,H0;if(K0)try{H0=Hs6(K0,"utf8")}catch(w8){console.error(`[app] failed to read NATS_CREDS at ${K0}; connecting anonymously`,w8)}U.init(E0().natsUrls,H0?{creds:H0}:void 0);let R0=e11()?new f11({getJetStream:()=>U.getJetStream()}):null;R0?.init().catch(()=>{}),Y=R0;let A0=new n91({getJetStream:()=>U.getJetStream()});A0.init().catch(()=>{}),X=A0;let D1=new xf(hQ1,{getJetStream:()=>U.getJetStream()}),x$=new xf(x$0,{getJetStream:()=>U.getJetStream()});D1.init().catch(()=>{}),x$.init().catch(()=>{}),J={reads:D1,cards:x$};let i$=new VJ1({getJetStream:()=>U.getJetStream()});i$.init().catch(()=>{}),G=i$,K=$O1({getConnection:()=>U.getConnection()}),H=new ZO1({getConnection:()=>U.getConnection()}),F=new XO1({getConnection:()=>U.getConnection(),getJetStream:()=>U.getJetStream()}),M48(U),U.onReady(()=>{R0?.init().catch((w8)=>{console.error("[McpListCache] Deferred init failed:",w8)}),A0.init().catch((w8)=>{console.error("[SkillCatalogCache] Deferred init failed:",w8)}),D1.init().catch((w8)=>{console.error("[PrReadCache] Deferred init failed:",w8)}),x$.init().catch((w8)=>{console.error("[PrCardCache] Deferred init failed:",w8)}),i$.init().catch((w8)=>{console.error("[ConnectionCircuitStore] Deferred init failed:",w8)}),K.start(),SN$(()=>U.getConnection()),F.init().catch((w8)=>{console.warn("[Decopilot] StreamBuffer init failed (late-join disabled):",w8)})})}if(Qz)await Qz();y11(Y),o91(X),uQ1(J),kJ1(G);let B={storage:new ph(Z.db),sseHub:_5,onThreadFinished:async(K0,H0)=>Vd(new D3(Z.db),K0,H0,new kG(Z.db))},O=new aY1(B),L=new h40(Z.db),w=new JO1(L);w.start(),jg$(H),H.start((K0)=>{lq0(K0),O.execute({type:"CANCEL",taskId:K0}).catch((H0)=>{console.error("[Decopilot] CancelBroadcast execute failed:",H0)})}).catch((K0)=>{console.error("[Decopilot] CancelBroadcast start failed:",K0)}),U?.onReady(()=>{H.start().catch((K0)=>{console.error("[CancelBroadcast] Deferred start failed:",K0)})});let j=()=>U?.getConnection()??null;wN1(j),U?.onReady(()=>wN1(j)),FG1(j),U?.onReady(()=>FG1(j)),F.init().catch((K0)=>{console.warn("[Decopilot] StreamBuffer init failed, attach/late-join disabled:",K0)}),Qz=async()=>{await O.stopAll(),O.dispose(),w.dispose(),H.stop().catch(()=>{}),l68(),F.teardown(),Y?.teardown(),X?.teardown(),J?.reads.teardown(),J?.cards.teardown(),W.teardown(),K.teardown(),CN$(),G.teardown(),y11(null),o91(null),uQ1(null),kJ1(null)};let E=new Z1;if(E.use("*",qJ1({enabled:(K0)=>ai(K0,"debug")==="1"})),E.use("*",__0),E.use("/*",P48({origin:(K0,H0)=>pJ8(K0,{baseUrl:E0().baseUrl,requestOrigin:new URL(H0.req.url).origin}),credentials:!0,allowMethods:["GET","POST","PUT","DELETE","OPTIONS"],allowHeaders:["Content-Type","Authorization","mcp-protocol-version"],exposeHeaders:["WWW-Authenticate"]})),E.use("*",async(K0,H0)=>{if(await H0(),K0.req.path.includes("/files/"))return;if(K0.req.path.includes("/fs/")&&K0.req.path.endsWith("/read"))return;K0.header("X-Frame-Options","DENY"),K0.header("Content-Security-Policy","frame-ancestors 'none'")}),!E0().noTui)E.use("*",AJ8());E.use("*",async(K0,H0)=>{if(await H0(),dp(K0.req.path))return;if(K0.res.status>=500){let A0=await K0.res.clone().text();console.error(`[5xx Response] ${K0.req.method} ${K0.req.path} - ${K0.res.status}:`,A0)}}),E.get(aY.HEALTH,(K0)=>{if(Q)return K0.json({status:"shutting_down"},503);return K0.json({status:"ok"})}),E.get(aY.HEALTH_LIVE,(K0)=>{return K0.json({status:"ok"})}),E.get(aY.HEALTH_READY,async(K0)=>{if(Q)return K0.json({status:"shutting_down"},503);let H0={};if(H0.postgres={status:await Us6(Z.pool)?"up":"down"},U)H0.nats=U.isConnected()?{status:"up"}:{status:"down"};else H0.nats={status:"down"};let R0=H0.postgres.status==="up",A0=R0?200:503;return K0.json({status:R0?"ready":"not_ready",services:H0},A0)}),E.get(aY.METRICS,async(K0)=>{try{let H0=await f_0.collect(),R0=Ns6.serialize(H0.resourceMetrics);return K0.text(R0,200,{"Content-Type":"text/plain; version=0.0.4; charset=utf-8"})}catch(H0){return console.error("Failed to collect metrics:",H0),K0.text("# Error collecting metrics",500)}});let z=1800000;E.get(`${aY.DBOS_QUEUE_DEPTH_PREFIX}:queueName`,async(K0)=>{let H0=K0.req.param("queueName");if(!Os6.has(H0))return K0.json({error:`Unknown queue: ${H0}`},404);let[R0,A0]=await Promise.all([DO.listQueuedWorkflows({queueName:H0,status:"ENQUEUED",loadInput:!1,loadOutput:!1}),DO.listQueuedWorkflows({queueName:H0,status:"PENDING",loadInput:!1,loadOutput:!1,dequeuedAfter:new Date(Date.now()-z).toISOString()})]);return K0.json({queue_length:R0.length,in_flight:A0.length})}),E.route("/api/config",JX8),E.route("/api/_reports",wX8),E.route("/api/_stripe",mD1),E.route("/api/_github",zX8({taskBoard:()=>i,contextFactory:()=>g})),E.route("/api/_git",Gp);let T={db:Z.db,encryptionKey:E0().encryptionKey};E.route("/api/_jira",kX8(T)),E.route("/api/_jira",RX8(T)),E.route("/report",DX8($.clientDir)),E.route("/api/auth/custom",p48),E.route("/api/auth/desktop",r48),E.all("/api/auth/admin/*",V68),E.all("/api/auth/*",async(K0)=>{return await x8.handler(K0.req.raw)});let A=e$8();A.use("/.well-known/oauth-protected-resource/mcp/:connectionId",a40),A.use("/mcp/:connectionId/.well-known/oauth-protected-resource",a40),E.route("/",A),E.get("/.well-known/oauth-protected-resource/api/:org/mcp/:connectionId",x40),E.route("/",X88()),E.use("/oauth-proxy/:connectionId/*",a40),E.all("/oauth-proxy/:connectionId/*",cJ8);let P=async(K0)=>{let R0=await Ls6()(K0.req.raw),A0=await R0.json();return Response.json(A0,R0)};E.use("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",a40),E.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",P);let q=async(K0)=>{let R0=await ws6()(K0.req.raw),A0=await R0.json();return Response.json(A0,R0)};E.get("/.well-known/oauth-authorization-server/*/:gateway?/:connectionId?",q);let x=T48({ttlMs:120000}),_=await t88({db:Z.db,auth:x8,encryption:{key:E0().encryptionKey},observability:{tracer:TO,meter:e1},modelListCache:W,providerKeyCache:K,memberRoleCache:x});cQ.set(_),Bp1({db:Z.db,baseUrl:m5()}),o88({db:Z.db}),e88({db:Z.db}),W48({db:Z.db}),MX8({db:Z.db,encryptionKey:E0().encryptionKey}),rv$({db:Z.db}),B48({db:Z.db}),Eb$({db:Z.db});let V=DX0(Z.db),y=new Rr(Z.db),g=jJ8({db:Z.db});PJ1({storage:V,studioContextFactory:g}),KX1({systemDatabaseUrl:Xs0(E0().databaseUrl,E0().databasePgSsl),studioContextFactory:g,deps:{runRegistry:O,cancelBroadcast:H,streamBuffer:F,sseHub:_5}}),ZX1({dispatchRunFn:Hy$,studioContextFactory:g,deps:{runRegistry:O,cancelBroadcast:H,streamBuffer:F,sseHub:_5}});let l=new ph(Z.db),i=new D3(Z.db),p=new kG(Z.db),U0=new WO1(i,g,p);if(E0().taskBoardReviewSweeperEnabled){U0.start();let K0=Qz;Qz=async()=>{await K0?.(),U0.dispose()}}Sy$({getJetStream:()=>U?.getJetStream()??null,getJetStreamManager:async()=>{let K0=U?.getConnection();return K0?await mJ8.jetstreamManager(K0):null},messageParts:l.messageParts(),resolveRun:async(K0)=>{let H0=await Z.db.selectFrom("threads").select(["organization_id","created_by","message_storage_version","status","run_fence_token","title"]).where("id","=",K0).executeTakeFirst();return H0?{orgId:H0.organization_id,createdBy:H0.created_by,version:H0.message_storage_version??1,status:H0.status,runFenceToken:H0.run_fence_token,title:H0.title??null}:null},completeRunIfNotCompleted:async(K0,H0)=>{let R0=await l.completeRunIfNotCompleted(K0,H0);if(W_0(_5,H0,K0,R0),R0)await Vd(i,K0,H0,p);return R0},markRunRequiresAction:async(K0,H0)=>{let R0=await l.requiresActionIfInProgress(K0,H0);return W_0(_5,H0,K0,R0),R0},markRunFailed:async(K0,H0,R0,A0)=>{let D1=await l.markRunFailed(K0,H0,R0,A0);if(W_0(_5,H0,K0,D1),D1)await Vd(i,K0,H0,p);return D1},clearSynthesizedError:async(K0,H0)=>{await l.messageParts().replaceMessageParts(K0,OE(K0,H0),[])},persistTitle:(K0,H0,R0)=>l.update(K0,H0,{title:R0}),onTitleUpdated:async({runId:K0,orgId:H0,title:R0})=>{let A0=await l.get(K0,H0).catch(()=>null);_5.emit(H0,NF(K0,A0?.status??"in_progress",{title:R0,virtualMcpId:A0?.virtual_mcp_id??void 0,createdBy:A0?.created_by,triggerId:A0?.trigger_id,branch:A0?.branch??null,harnessId:A0?.harness_id??void 0,createdAt:A0?.created_at,updatedAt:A0?.updated_at}))},bumpProgress:async({runId:K0,orgId:H0})=>{await l.bumpProgress(K0,H0)},recordCompleted:async({runId:K0,orgId:H0,distinctId:R0,usage:A0})=>{f1.capture({distinctId:R0,event:"chat_message_completed",groups:{organization:H0},properties:{organization_id:H0,thread_id:K0,transport:"projector",input_tokens:A0.inputTokens,output_tokens:A0.outputTokens,total_tokens:A0.totalTokens}})},recordFailed:async({runId:K0,orgId:H0,distinctId:R0,reason:A0,kind:D1})=>{f1.capture({distinctId:R0,event:"chat_message_failed",groups:{organization:H0},properties:{organization_id:H0,thread_id:K0,transport:"projector",error_category:D1,error_message:A0}})},purgeRun:async(K0)=>{F.purge(K0)}}),xf$({studioContextFactory:g,systemDatabaseUrl:Xs0(E0().databaseUrl,E0().databasePgSsl),streamBuffer:F}),LJ8(),Dp1(),s88(),Z48(),H48(),VX8(),Zb$(),O48(),zb$(),AX8();let v0=async(K0,H0,R0)=>{let A0=await V.findById(K0,H0);if(!A0)throw Error("Automation not found");return RJ1({automationId:A0.id,organizationId:A0.organization_id,triggerId:null})},G0=new Xp(V,({automation:K0,trigger:H0,contextMessages:R0,idempotencyKey:A0})=>L80({automationId:K0.id,organizationId:K0.organization_id,triggerId:H0.id,contextMessages:R0},{idempotencyKey:A0})),N0=[JK(),Gg(),qN()];for(let K0 of N0)F_0(K0).then(()=>{}).catch((H0)=>console.error("[monitoring] Retention cleanup failed:",H0));let o=()=>x8.api.deleteAllExpiredApiKeys().catch((K0)=>console.error("[auth] Expired API key cleanup failed:",K0));o(),setInterval(o,86400000).unref(),E.use("*",async(K0,H0)=>{if(S_0(K0.req.path))return H0();let R0={measure:async(D1,x$)=>{cW(K0,D1);try{return await x$()}finally{P3(K0,D1)}}},A0=await cQ.create(K0.req.raw,{timings:R0});A0.automationRunner=v0,K0.set("studioContext",A0);try{await H0()}finally{let D1=A0.pendingRevalidations;if(D1.length>0)Promise.race([Promise.allSettled(D1),z$(30000)]).catch((i$)=>console.error("[studio] revalidation cleanup error:",i$))}}),E.use("/api/:org/decopilot/*",$p),E.use("/api/:org/v1/*",$p),E.use("/api/:org/files/*",$p),E.use("*",async(K0,H0)=>{if(dJ8(K0.req.path))return H0();let R0=K0.get("studioContext");if(!R0?.organization?.id||!R0?.auth?.user?.id)return H0();if(!(await R0.storage.orgSsoConfig.getByOrgId(R0.organization.id))?.enforced)return H0();if(!await R0.storage.orgSsoSessions.isValid(R0.auth.user.id,R0.organization.id))return K0.json({error:"SSO authentication required for this organization"},403);return H0()});let $0=new Z1;$0.use("*",mH({mountPath:"/api/org-sso"})),$0.route("/",yS0()),E.route("/api/org-sso",$0),E.get("/api/tools/management",(K0)=>{return K0.json({tools:hn0,grouped:tP()})}),E.use("/mcp/*",async(K0,H0)=>{cW(K0,"mcp");try{return await H0()}finally{P3(K0,"mcp")}});let Z0=async(K0,H0)=>{let R0=K0.var.studioContext;if(!R0.auth.user?.id&&!R0.auth.apiKey?.id){let A0=new URL(K0.req.url),D1=K0.req.header("x-forwarded-proto")?.split(",")[0]?.trim(),x$=D1?`${D1}://${A0.host}`:A0.origin;return K0.res=new Response(null,{status:401,headers:{"WWW-Authenticate":`Bearer realm="mcp",resource_metadata="${x$}${A0.pathname}/.well-known/oauth-protected-resource"`}})}return await H0()};if(E.use("/mcp/:connectionId?",Z0),E.use("/mcp/gateway/:virtualMcpId?",Z0),E.use("/mcp/virtual-mcp/:virtualMcpId?",Z0),E.use("/mcp/self",Z0),PW()){let{mountDevRoutes:K0}=(hJ8(),j_0(gJ8));K0(E,Z0)}let r=new Z1;r.use("*",mH({mountPath:"/mcp"})),r.route("/",xM0()),E.route("/mcp",r);let Y0=new Z1;Y0.use("*",mH({mountPath:"/mcp/self"})),Y0.route("/",MC0()),E.route("/mcp/self",Y0);let d0=new Z1;d0.use("*",mH({mountPath:"/mcp"})),d0.route("/",gM0()),E.route("/mcp",d0),E.use("/api/:org/models/*",async(K0,H0)=>{cW(K0,"llm_models");try{return await H0()}finally{P3(K0,"llm_models")}});let S0=m68({cancelBroadcast:H,streamBuffer:F,runRegistry:O});E.route("/api",S0),E.route("/api",vX8);let W1=new Z1;W1.use("*",mH({mountPath:"/api"})),W1.route("/",SC0()),E.route("/api",W1),E.route("/api",aY8);let u0=new Z1;u0.use("*",mH({mountPath:"/api"})),u0.route("/",CC0({tokenStorage:y,automationEventDispatcher:G0})),E.route("/api",u0);let L0=new Mr(Z.db),j0=new Z1;j0.use("*",mH({mountPath:"/api"})),j0.route("/",cS0()),E.route("/api",j0),E.route("/api/deco-sites",X58()),E.route("/api/deco-apps",pY8());let l0=new Z1;l0.use("*",mH({mountPath:"/api/deco-sites"})),l0.route("/",dS0()),E.route("/api/deco-sites",l0),E.route(bS0,k68()),E.route(f78,h78()),E.route("/api/_editor-resolve",$X8()),E.route(a48,e48()),E.route(VS0,H68());let O1=E0(),Q1=O1.elevenlabsApiKey?new eC0({apiKey:O1.elevenlabsApiKey,model:O1.elevenlabsVoiceModel,conversationModel:O1.elevenlabsConversationModel,voiceId:O1.elevenlabsVoiceId}):null,_0={openai:O1.openaiLiveApiKey?new xD1({apiKey:O1.openaiLiveApiKey,voice:O1.openaiLiveVoice}):null,elevenlabs:Q1?new bD1(Q1,()=>U?.getConnection()??null):null},m0=new uD1({adapter:Q1,conversationAdapters:_0,defaults:O1,secret:O1.studioJwtSecret??O1.betterAuthSecret,getConnection:()=>U?.getConnection()??null}),i0=RY8({voiceSessions:m0,kvStorage:L0,runRegistry:O,streamBuffer:F,sseHub:_5,cancelBroadcast:H,tokenStorage:y,automationEventDispatcher:G0,mountDevAssets:PW(),mcpAuth:Z0,oauthProxyHandler:cJ8,watchHandler:tJ8,betterAuthProtectedResourceHandler:P,getNatsConnection:()=>U?.getConnection()??null});return E.route("/api/:org",i0),E.notFound((K0)=>{return K0.json({error:"Not Found",path:K0.req.path},404)}),E.onError(i68),Object.assign(E,{markShuttingDown:()=>{Q=!0},shutdown:async()=>{if(console.log("[shutdown] Stopping workers..."),await Promise.allSettled([_5.stop(),Qz?Promise.resolve(Qz()).finally(()=>{Qz=null}):Promise.resolve()]),U)await U.drain().catch((K0)=>console.error("[shutdown] NATS drain error:",K0));console.log("[shutdown] Flushing telemetry..."),await oX().catch((K0)=>console.error("[shutdown] Telemetry flush error:",K0)),console.log("[shutdown] Closing database..."),await OZ$(Z).catch((K0)=>console.error("[shutdown] Database close error:",K0)),console.log("[shutdown] Cleanup complete.")},initDbos:async()=>{await DO.registerQueue(C3,{partitionQueue:!0,concurrency:jJ1,minPollingIntervalMs:EJ1}),await DO.registerQueue(S3,{partitionQueue:!0,concurrency:GX1,priorityEnabled:!0}),await DO.registerQueue(TN,{workerConcurrency:E0().decopilotMaxConcurrentHostedRuns,priorityEnabled:!0}),await DO.registerQueue(RN,{workerConcurrency:E0().sandboxMaxConcurrentHostedRuns,priorityEnabled:!0}),await DO.registerQueue(PO,{partitionQueue:!0,concurrency:bf$}),await DO.registerQueue(Wz,jb$),await TN1(V),await Promise.allSettled(["automations-gate","automations-global","jira-push"].map((K0)=>DO.deleteQueue(K0))),await zJ1(Z.pool),fY$().catch((K0)=>{console.error("[studio-pack-backfill] failed:",K0)}),Op1().catch((K0)=>{console.error("[org-fs] public-sets boot sync kick failed:",K0)})}})}var mJ8,uJ8=5000,Qz=null,cJ8=async($)=>{let Z=$.req.param("connectionId");if(!Z)return $.json({error:"Missing connectionId"},400);let Q=$.req.path.split("/").filter(Boolean),Y=Q[Q.length-1],X=$.get("studioContext");if(!X)X=await cQ.create($.req.raw),$.set("studioContext",X);let J=$.req.param("org")?X.organization?.id:void 0,G=await X.storage.connections.findById(Z,J);if(!G?.connection_url)return $.json({error:"Connection not found"},404);if(Y==="register"&&G.oauth_config?.clientId){let y=await $.req.json().catch(()=>({}));return $.json({...typeof y==="object"&&y!==null?y:{},client_id:G.oauth_config.clientId,...G.oauth_config.clientSecret?{client_secret:G.oauth_config.clientSecret}:{},client_secret_expires_at:0})}let W=await ti(G.connection_url),K,H=new URL(G.connection_url),U=(typeof G.metadata?.oauthResource==="string"&&G.metadata.oauthResource.length>0?G.metadata.oauthResource:void 0)??G.connection_url;if(W.ok)K=(await W.json()).authorization_servers?.[0];if(!K)K=H.origin;let N=await f40(K);if(!N.ok)return $.json({error:"Failed to get auth server metadata"},502);let B=await N.json(),O;if(Y==="authorize")O=B.authorization_endpoint;else if(Y==="token")O=B.token_endpoint;else if(Y==="register")O=B.registration_endpoint;if(!O)return $.json({error:`Unknown OAuth endpoint: ${Y}`},404);let L=Y88(O);if(L)return L;let w=new URL(O),j=new URL($.req.url);if(w.search=j.search,Y==="authorize"){let y=w.searchParams.get("redirect_uri");if(y){let g=E0().baseUrl??j.origin;try{if(!nJ8(new URL(y),g))return $.json({error:"invalid_request",error_description:"redirect_uri is not allowed"},400)}catch{return $.json({error:"invalid_request",error_description:"redirect_uri is malformed"},400)}w.searchParams.set("redirect_uri",y)}if(w.searchParams.has("resource"))w.searchParams.set("resource",U);if(w48(G.connection_url))w.searchParams.set("auto_personal","true"),w.searchParams.set("force_new","true");return $.redirect(w.toString(),302)}let E={Accept:$.req.header("Accept")||"application/json"},z=$.req.header("Content-Type");if(z)E["Content-Type"]=z;let T=$.req.header("Authorization");if(T)E.Authorization=T;let A,P=null,q=null;if($.req.method!=="GET"&&$.req.method!=="HEAD")if(Y==="token"&&z?.includes("application/x-www-form-urlencoded")){if(T?.toLowerCase().startsWith("basic "))try{let p=atob(T.slice(6).trim()),U0=p.indexOf(":");if(U0!==-1){let v0=decodeURIComponent(p.slice(0,U0)),G0=decodeURIComponent(p.slice(U0+1));P=v0||null,q=G0||null}}catch{}let y=await $.req.formData();if(y.has("resource"))y.set("resource",U);let g=y.get("client_id"),l=y.get("client_secret");if(typeof g==="string"&&g)P=g;if(typeof l==="string"&&l)q=l;let i=new URLSearchParams;for(let[p,U0]of y.entries())i.append(p,U0.toString());A=i.toString()}else if(Y==="register"&&z?.toLowerCase().includes("application/json")){let y=await X.db.selectFrom("organization").select(["id","slug","name"]).where("id","=",G.organization_id).executeTakeFirst(),g=await $.req.text(),l={};try{l=g?JSON.parse(g):{}}catch{A=g}let i=typeof l==="object"&&l!==null&&!Array.isArray(l);if(A===void 0&&!i)A=g;if(A===void 0){let p=l,U0=p.metadata&&typeof p.metadata==="object"?p.metadata:{};p.metadata={...U0,organization_id:G.organization_id,...y?.slug?{organization_slug:y.slug}:{},...y?.name?{organization_name:y.name}:{}},A=JSON.stringify(p),E["Content-Type"]="application/json"}}else A=$.req.raw.body??void 0;let x=await fetch(w.toString(),{method:$.req.method,headers:E,body:A,duplex:"half",redirect:"manual"}),_=new Headers,V=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];for(let[y,g]of x.headers.entries())if(!V.includes(y.toLowerCase()))_.set(y,g);if(Y==="token"&&x.ok){let y=await x.text();try{let g=JSON.parse(y);if(typeof g.access_token==="string"&&g.access_token){let l=typeof g.expires_in==="number"?new Date(Date.now()+g.expires_in*1000):null,i=null;try{i=await oi(G.connection_url)??O}catch{i=O}let p={connectionId:Z,accessToken:g.access_token,refreshToken:typeof g.refresh_token==="string"?g.refresh_token:null,scope:typeof g.scope==="string"?g.scope:null,expiresAt:l,clientId:P,clientSecret:q,tokenEndpoint:i};await new w9(X.db,X.vault).upsert(p)}}catch(g){console.error("[oauth-proxy] failed to persist downstream token:",g)}return new Response(y,{status:x.status,statusText:x.statusText,headers:_})}return new Response(x.body,{status:x.status,statusText:x.statusText,headers:_})},tJ8=async($)=>{let Z=$.var.studioContext,Q=Z.auth.user?.id??Z.auth.apiKey?.userId;if(!Q)return $.json({error:"Unauthorized"},401);let Y=Z.organization?.id;if(!Y)return $.json({error:"organization id missing"},400);let X=$.req.query("types"),J=X?X.split(",").map((H)=>H.trim()).filter(Boolean):null,G=$.req.query("scope")==="all";if(G&&(!lU(Y)||!await cU(Z)))return $.json({error:"forbidden"},403);let W=G?aR0:Y;if(G)_D({action:"watch_all_orgs",actorUserId:Q,actorOrgId:Y,targetOrgId:"all"});let K=crypto.randomUUID();return FO($,async(H)=>{if(await H.writeSSE({event:"connected",data:JSON.stringify({listenerId:K,organizationId:Y,typePatterns:J,connectedAt:new Date().toISOString()})}),!_5.add({id:K,organizationId:W,typePatterns:J?.length?J:null,push:(N,B)=>{H.writeSSE({id:N.id,event:N.type,data:JSON.stringify(G?{...N,organizationId:B}:N)}).catch(()=>{_5.remove(W,K)})}})){await H.writeSSE({event:"error",data:JSON.stringify({error:"Too many connections",message:"SSE connection limit reached. Try again later."})});return}let U=setInterval(()=>{H.writeSSE({event:"keepalive",data:""}).catch(()=>{clearInterval(U),_5.remove(W,K)})},30000);await new Promise((N)=>{H.onAbort(()=>{clearInterval(U),_5.remove(W,K),N()})})})},Ns6,Os6,Ls6=()=>Ds6(x8),ws6=()=>Bs6(x8);var rJ8=D(()=>{a$();X$();Lp1();a88();Q48();F48();A80();AQ1();L48();b$0();I9();lc();p8();J8();TS0();A48();MJ1();Z3();BU();pU1();SG();k6();G6();eU1();s48();$68();F68();JN1();S68();BN1();zN1();PN1();HH();WS0();AN1();p68();qS0();qY8();SY8();CY8();xY8();iY8();MN1();nY8();fM0();j80();eY8();hM0();ZD1();ZX8();eB1();GX8();OX8();jX8();EX8();PX8();TX8();qX8();SX8();sD1();CN1();bX8();$D1();rB1();Q50();sX8();SJ();fT0();cQ1();ne();oe();CJ1();aX8();$J8();jN1();WJ8();eY1();KJ8();Go();kr();CD();P9();BU1();BJ8();wJ8();$30();KO1();_3();RN1();SD();rY1();$30();sq0();qn0();Mn0();EJ8();nu();TJ8();Ap();pU1();zd();fd();cq0();mJ8=C(BK(),1);Ns6=new Fs6,Os6=new Set([C3,S3,TN,RN,PO,Wz])});var $G8={};$6($G8,{resolveClientDir:()=>qs6,resolveAssetPathWithTraversalCheck:()=>eJ8,isPathWithinDirectory:()=>aJ8,createAssetHandler:()=>Ms6});import{resolve as l60,dirname as Es6,join as zs6,extname as Ps6,basename as As6,sep as sJ8}from"path";function Ts6($,Z){if($===Z||As6($)==="index.html")return{"Cache-Control":"no-cache"};if($.includes(`${sJ8}assets${sJ8}`))return{"Cache-Control":"public, max-age=31536000, immutable"};return{}}function aJ8($,Z){let Q=l60(Z),Y=l60($);return Y===Q||Y.startsWith(Q+"/")}function eJ8({requestPath:$,clientDir:Z}){let Q=$.startsWith("/")?$.slice(1):$,Y=l60(Z,Q);if(!aJ8(Y,Z))return null;return Y}function qs6($,Z="../client"){let Q=new URL($),Y=Es6(Q.pathname);return l60(Y,Z)}function Ms6($={}){let{env:Z="production",clientDir:Q=Rs6,isServerPath:Y=()=>!1}=$;if(Z==="development")return async function(J){return null};return async function(J){if(J.method!=="GET")return null;let G=new URL(J.url),W;try{W=decodeURIComponent(G.pathname)}catch{return null}if(Y(W))return null;let K=eJ8({requestPath:W,clientDir:Q});if(!K)return null;let H=zs6(K,"index.html"),F=l60(Q,"index.html"),U=J.headers.get("accept"),B=U?.includes("text/html")||U?.includes("*/*")&&["",".html"].includes(Ps6(K))?[H,F]:[];for(let O of[K,...B])try{let L=Bun.file(O);if(await L.exists())return new Response(L,{headers:Ts6(O,F)})}catch{}if(W.includes("/assets/"))return new Response("Not Found",{status:404,headers:{"Cache-Control":"no-store"}});return null}}var Rs6="./dist/client";var ZG8=()=>{};var QG8={};$6(QG8,{tryUpgradePreviewWs:()=>vs6,tryHandlePreviewHttp:()=>_s6,previewWebSocketHandler:()=>bs6,parsePreviewBaseDomain:()=>Cs6,isPreviewWsData:()=>U_0,extractHandleFromHost:()=>wO1});function ks6($){if($.method!=="GET")return!1;return($.headers.get("accept")??"").includes("text/html")}function Ss6(){return new Response(Vs6,{status:503,headers:{"content-type":"text/html; charset=utf-8","cache-control":"no-store","retry-after":"1","access-control-allow-origin":"*"}})}function Cs6($){if(!$||$.trim()==="")return null;let Z=$.includes("{handle}")?$.replace("{handle}","__handle__"):$,Q;try{Q=new URL(Z)}catch{return null}let Y=Q.hostname;if($.includes("{handle}")){let X=Y.indexOf(".");if(X<=0||X===Y.length-1)return null;return Y.slice(X+1)}return Y}function wO1($,Z){if(!$||!Z)return null;let Q=$.indexOf(":"),Y=(Q>=0?$.slice(0,Q):$).toLowerCase(),J=`.${Z.toLowerCase().replace(/^\.+|\.+$/g,"")}`;if(!Y.endsWith(J))return null;let G=Y.slice(0,Y.length-J.length);if(!G||G.includes("."))return null;return G}async function _s6($,Z){let Q=wO1($.headers.get("host"),Z.baseDomain);if(!Q)return null;let Y=await Z.getRunner();if(!Y)return m60(503,"preview proxy not configured");let X=await Y.proxyPreviewRequest(Q,$);if(X.headers.get(_m)&&ks6($))return Ss6();return X.headers.delete(_m),X}function m60($,Z){return new Response(JSON.stringify({error:Z}),{status:$,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function U_0($){return typeof $==="object"&&$!==null&&$.kind==="preview"}async function vs6($,Z,Q){if(($.headers.get("upgrade")??"").toLowerCase()!=="websocket")return null;let Y=wO1($.headers.get("host"),Q.baseDomain);if(!Y)return null;let X=await Q.getRunner();if(!X)return m60(503,"preview proxy not configured");let J=await X.resolvePreviewUpstreamUrl(Y);if(!J)return m60(404,"sandbox not found");let G=new URL($.url);if(G.pathname.startsWith("/_sandbox"))return m60(404,"not found");let W=`${J.replace(/^http/,"ws")}${G.pathname}${G.search}`,K=$.headers.get("sec-websocket-protocol"),H=K?K.split(",").map((N)=>N.trim()).filter(Boolean):[],F={kind:"preview",upstreamUrl:W,upstreamProtocols:H,pending:[],upstream:null,closed:!1};if(!Z.upgrade($,{data:F}))return m60(426,"upgrade failed");return}function c60($,Z,Q,Y){if(Z.closed)return;Z.closed=!0;try{$.close(Q,Y)}catch{}try{Z.upstream?.close()}catch{}}var Is6=256,Vs6='<!DOCTYPE html><html><head><meta charset="utf-8"><title>Connecting\u2026</title><style>body{font-family:system-ui,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0;background:#fafafa;color:#555}div{text-align:center;max-width:420px;padding:24px}h3{margin:0 0 8px}p{margin:0;font-size:14px;color:#999;line-height:1.5}</style></head><body><div><h3>Connecting to sandbox\u2026</h3><p>Waiting for the sandbox to come online. This page refreshes automatically.</p></div><script>setTimeout(function(){window.location.reload()},1500)</script></body></html>',bs6;var YG8=D(()=>{j10();bs6={open($){let Z=$.data;if(!U_0(Z))return;let Q;try{Q=Z.upstreamProtocols.length>0?new WebSocket(Z.upstreamUrl,Z.upstreamProtocols):new WebSocket(Z.upstreamUrl)}catch(Y){console.warn(`[preview-ws] failed to dial upstream ${Z.upstreamUrl}: ${Y instanceof Error?Y.message:String(Y)}`),c60($,Z,1011,"upstream connect failed");return}Q.binaryType="arraybuffer",Z.upstream=Q,Q.addEventListener("open",()=>{while(Z.pending.length>0){let Y=Z.pending.shift();if(Y!==void 0)Q.send(Y)}}),Q.addEventListener("message",(Y)=>{if(Z.closed)return;$.send(Y.data)}),Q.addEventListener("close",(Y)=>{c60($,Z,Y.code||1000,Y.reason||"")}),Q.addEventListener("error",()=>{c60($,Z,1011,"upstream error")})},message($,Z){let Q=$.data;if(!U_0(Q))return;let Y=Q.upstream;if(Y&&Y.readyState===WebSocket.OPEN){Y.send(Z);return}if(Q.pending.length>=Is6){c60($,Q,1011,"preview ws backlog overflow");return}Q.pending.push(Z)},close($){let Z=$.data;if(!U_0(Z))return;c60($,Z,1000,"")}}});var WG8={};$6(WG8,{printBanner:()=>fs6,bannerLines:()=>GG8,BANNER_LINES:()=>XG8,BANNER_GRADIENT:()=>JG8});function xs6($){let Z=Number.parseInt($.slice(1),16);return[Z>>16&255,Z>>8&255,Z&255]}function GG8($){let Z=XG8.map((Q,Y)=>{let[X,J,G]=xs6(JG8[Y]);return`\x1B[38;2;${X};${J};${G}m${Q}\x1B[39m`});if($!==void 0)Z.push(`\x1B[2m  v${$}\x1B[22m`);return Z}function fs6($){console.log("");for(let Z of GG8($))console.log(Z);console.log("")}var XG8,JG8;var KG8=D(()=>{XG8=[" \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588     \u2588\u2588\u2588\u2588\u2588\u2588\u2588   ","\u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588 "," \u2591\u2588\u2588\u2588   \u2591\u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588  \u2588 \u2591  \u2588\u2588\u2588     \u2591\u2591\u2591  \u2588\u2588\u2588     \u2591\u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2588\u2588\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2591\u2591\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2588\u2588\u2588  \u2591\u2588\u2588\u2588 \u2591   \u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588 "," \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588  \u2591\u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2591  ","\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591     \u2591\u2591\u2591\u2591\u2591\u2591\u2591   "],JG8=["#00ff64","#00ee5e","#00dc56","#00c84e","#00b444","#00a03c","#008832","#006e28"]});a$();var SO1="13";function CO1($){return{name:"decocms",systemDatabaseUrl:$.systemDatabaseUrl,systemDatabaseSchemaName:"dbos",systemDatabasePoolSize:$.poolSize,runAdminServer:!1,executorID:$.executorID,applicationVersion:SO1,...$.listenQueues!==void 0?{listenQueues:$.listenQueues}:{}}}a$();import MG8 from"pg";var _O1=8314027461559302n,IG8=600000,VG8=500;async function vO1($,Z){let{databaseUrl:Q,lockTimeoutMs:Y=IG8}=$,X=$.log??((K)=>console.log(K)),J=new MG8.Client({connectionString:Q});await J.connect();let G=Date.now(),W=!1;try{while(!W){if(W=(await J.query("SELECT pg_try_advisory_lock($1) AS locked",[_O1.toString()])).rows[0]?.locked===!0,W)break;if(Date.now()-G>=Y)throw Error(`Timed out after ${Y}ms waiting for the DBOS migration lock. Another process is still migrating the dbos schema; this pod will restart and retry.`);await z$(VG8)}let K=Date.now()-G;if(K>1000)X(`[dbos] waited ${K}ms for the migration lock; another process migrated first`);return await Z()}finally{if(W)try{await J.query("SELECT pg_advisory_unlock($1)",[_O1.toString()])}catch{}await J.end().catch(()=>{})}}X$();A_0();k6();function M38(){let $=(process.env.BUN_OPTIONS??"").split(/\s+/).filter(Boolean);return[...process.argv.slice(1),...$]}function h_0($,Z){for(let Q=0;Q<$.length;Q++){let Y=$[Q];if(Y===void 0)continue;if(Y===Z)return $[Q+1];if(Y.startsWith(`${Z}=`))return Y.slice(Z.length+1)}return}function LL1(){let $=M38();if($.includes("--cpu-prof")){console.log(JSON.stringify({msg:"cpu-profiling-active",dir:h_0($,"--cpu-prof-dir")??process.cwd(),name:h_0($,"--cpu-prof-name"),markdown:$.includes("--cpu-prof-md"),intervalUs:Number(h_0($,"--cpu-prof-interval")??1000),note:"profile is written on process exit"}));return}if(process.env.CPU_PROFILE)console.warn(JSON.stringify({msg:"cpu-profiling-requested-but-inactive",hint:'CPU profiling is a Bun launch flag. Set BUN_OPTIONS="--cpu-prof --cpu-prof-md --cpu-prof-dir=/tmp" before starting the process.'}))}c_0();var J50;function qL1(){if(process.env.HEAP_WATCH!=="1")return()=>{};let $=Number(process.env.HEAP_WATCH_INTERVAL_MS??60000),Z=async()=>{let Q=Fz();if(!Q)return;let Y={};try{let{heapStats:X}=await import("bun:jsc"),J=X(),G=Object.entries(J.objectTypeCounts).sort((W,K)=>K[1]-W[1]).slice(0,20);Y={objectCount:J.objectCount,heapSize:J.heapSize,top:Object.fromEntries(G)}}catch{}console.log(JSON.stringify({msg:"heap-watch",ts:new Date().toISOString(),uptimeS:Math.round(process.uptime()),rss:Q.rss,heapUsed:Q.heapUsed,heapTotal:Q.heapTotal,external:Q.external,arrayBuffers:Q.arrayBuffers,...Y}))};return Z().catch(()=>{}),J50=setInterval(()=>void Z().catch(()=>{}),$),J50.unref?.(),process.on("SIGUSR2",()=>{try{let Q=Bun.generateHeapSnapshot("v8"),Y=typeof Q==="string"?Q:JSON.stringify(Q),X=`/tmp/heap-${process.pid}-${Date.now()}.heapsnapshot`;Bun.write(X,Y),console.log(JSON.stringify({msg:"heap-snapshot-written",path:X}))}catch(Q){console.error("[heap-watch] snapshot failed:",Q)}}),()=>{if(J50)clearInterval(J50)}}import*as k38 from"bun:jsc";var{startSamplingProfiler:S38,samplingProfilerStackTraces:C38}=k38;function ML1(){if(process.env.STALL_WATCHDOG!=="1")return()=>{};let $=Number(process.env.STALL_WATCHDOG_MS??100),Z=Number(process.env.STALL_WATCHDOG_TICK_MS??50);try{S38()}catch(J){return console.error("[stall-watchdog] failed to start sampling profiler:",J),()=>{}}let Q,Y=performance.now()+Z,X=()=>{let J=performance.now(),G=J-Y;Y=J+Z;let W=[];try{W=C38()?.traces??[]}catch{}if(G>$&&W.length>0){let K=new Map;for(let F of W){let U=F.frames.find((O)=>O.sourceURL&&!/Unknown Executable/.test(O.category??""))??F.frames[0];if(!U)continue;let N=(U.sourceURL??"?").replace(/^.*\/node_modules\//,"node_modules/"),B=`${U.name??"?"} @ ${N}:${U.line??"?"}`;K.set(B,(K.get(B)??0)+1)}let H=[...K.entries()].sort((F,U)=>U[1]-F[1]).slice(0,8).map(([F,U])=>({frame:F,count:U}));console.warn(JSON.stringify({msg:"stall-stack",ts:new Date().toISOString(),lagMs:Math.round(G),samplesInWindow:W.length,top:H}))}Q=setTimeout(X,Z),Q.unref?.()};return Q=setTimeout(X,Z),Q.unref?.(),()=>{if(Q)clearTimeout(Q)}}function IL1(){LL1();let $=[qL1(),RL1(),ML1()];return()=>{for(let Z of $)Z()}}import{existsSync as ds6}from"fs";var WG=E0();BL1();var{DBOS:d60,DBOSClient:ys6}=await import("@dbos-inc/dbos-sdk");function TO1($,Z){if(!Z)return $;let Q=new URL($);if(!Q.searchParams.has("sslmode"))Q.searchParams.set("sslmode","verify-full");return Q.toString()}var gs6=[C3,S3,TN,RN,PO,Wz],hs6=WG.dispatchRole==="worker"?gs6:WG.dispatchRole==="api"?[]:void 0;d60.setConfig(CO1({systemDatabaseUrl:TO1(WG.databaseUrl,WG.databasePgSsl),poolSize:WG.dbosPoolSize,executorID:WG.podName,listenQueues:hs6}));var{createApp:us6}=await Promise.resolve().then(() => (rJ8(),oJ8)),{isServerPath:ls6}=await Promise.resolve().then(() => (Q50(),rO1)),{createAssetHandler:cs6,resolveClientDir:BG8}=await Promise.resolve().then(() => (ZG8(),$G8)),ms6=WG.port,HG8=BG8(import.meta.url,"../client"),DG8=ds6(HG8)?HG8:BG8(import.meta.url,"../dist/client"),is6=cs6({clientDir:DG8,isServerPath:ls6}),ps6={"X-Frame-Options":"DENY","Content-Security-Policy":"frame-ancestors 'none'"};function ns6($){let Z=new Headers($.headers);for(let[Q,Y]of Object.entries(ps6))Z.set(Q,Y);return new Response($.body,{status:$.status,statusText:$.statusText,headers:Z})}var{parsePreviewBaseDomain:ts6,tryHandlePreviewHttp:os6,tryUpgradePreviewWs:rs6,previewWebSocketHandler:jO1,isPreviewWsData:EO1}=await Promise.resolve().then(() => (YG8(),QG8)),{getOrInitSharedRunner:OG8}=await Promise.resolve().then(() => (vW(),DR$)),LG8=ts6(process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN),FG8={baseDomain:LG8??"",getRunner:OG8};if(process.env.STUDIO_SANDBOX_TENANT_POOLS?.trim())OG8().catch(($)=>{console.warn("[lifecycle] eager sandbox provider init for tenant pools failed:",$ instanceof Error?$.message:String($))});var N_0=await us6({clientDir:DG8}),zO1=process.env.DBOS_CONDUCTOR_KEY?.trim(),UG8=process.env.DBOS_CONDUCTOR_URL?.trim();await vO1({databaseUrl:TO1(WG.databaseUrl,WG.databasePgSsl)},()=>d60.launch({...zO1?{conductorKey:zO1}:{},...zO1&&UG8?{conductorURL:UG8}:{}}));console.log(`[dbos] application version: ${d60.applicationVersion}`);var PO1=5,AO1=0;await E8(async()=>{AO1++;try{return await N_0.initDbos()}catch($){let Z=AO1>=PO1?"giving up":"retrying";throw console.warn(`[dbos] initDbos attempt ${AO1}/${PO1} failed, ${Z}`,$),$}},{maxAttempts:PO1,minTimeout:1000,maxTimeout:1e4,jitter:0.5});if(!WG.isCli){let{bannerLines:$}=await Promise.resolve().then(() => (KG8(),WG8));console.log("");for(let Z of $())console.log(Z)}var ss6=Bun.serve({idleTimeout:0,port:ms6,hostname:"0.0.0.0",fetch:async($,Z)=>{if(LG8){let Y=await rs6($,Z,FG8);if(Y===void 0)return;if(Y)return Y;let X=await os6($,FG8);if(X)return X}let Q=await is6($);if(Q)return ns6(Q);return N_0.fetch($,{server:Z})},websocket:{open($){if(EO1($.data))jO1.open($)},message($,Z){if(EO1($.data))jO1.message($,Z)},close($){if(EO1($.data))jO1.close($)}},development:!1}),as6=IL1();if(WG.localMode)Promise.resolve().then(() => (gf(),kq0)).then(async({seedLocalMode:$,markSeedComplete:Z,healLocalJwks:Q})=>{try{let Y=await Q();if(Y>0)console.log(`[local-mode] cleared ${Y} undecryptable JWKS key(s); Better Auth will generate a fresh one`);let X=await $()}catch(Y){console.error("Failed to seed local mode:",Y)}finally{Z()}}).catch(async($)=>{console.error("Failed to load local-mode module:",$);try{let{markSeedComplete:Z}=await Promise.resolve().then(() => (gf(),kq0));Z()}catch{}});var NG8=!1;async function es6($){let Z;try{Z=await ys6.create({systemDatabaseUrl:TO1(WG.databaseUrl,WG.databasePgSsl),systemDatabaseSchemaName:"dbos"});let Q=await Z.listWorkflows({status:"PENDING",queueName:S3,executorId:$,loadInput:!1,loadOutput:!1});if(Q.length===0){console.log(`[shutdown] no in-flight thread-gate gates to hand off (executor ${$})`);return}let Y=Q.map((X)=>X.workflowID);await Z.resumeWorkflows(Y,{queueName:S3}),console.log(`[shutdown] re-enqueued ${Y.length} in-flight thread-gate gate(s) for re-adoption by a live executor (from ${$}):`,Y)}catch(Q){console.error("[shutdown] thread-gate handoff failed:",Q)}finally{await Z?.destroy().catch(()=>{})}}async function B_0($){if(NG8)return;NG8=!0,console.log(`
 [shutdown] Received ${$}, shutting down gracefully...`);let Z=Number(process.env.SHUTDOWN_GRACE_SECONDS??60)*1000,Q=Math.max(Z-5000,1e4),Y=setTimeout(()=>{console.error(`[shutdown] Timed out after ${Q}ms, forcing exit.`),process.exit(1)},Q);Y.unref?.();let X=0;try{as6(),N_0.markShuttingDown();let J=xO1(WG.dispatchRole,Q,process.env.SHUTDOWN_DRAIN_MS);await z$(J),await ss6.stop(!0);let G=d60.executorID;await d60.shutdown(),await es6(G),await N_0.shutdown()}catch(J){console.error("[shutdown] Error during shutdown:",J),X=1}clearTimeout(Y),process.exit(X)}process.on("SIGTERM",()=>B_0("SIGTERM"));process.on("SIGINT",()=>B_0("SIGINT"));process.on("SIGHUP",()=>B_0("SIGHUP"));process.on("unhandledRejection",($)=>{console.error("[process] Unhandled rejection:",$)});process.on("uncaughtException",($)=>{console.error("[process] Uncaught exception:",$),B_0("uncaughtException")});