decocms 4.433.0 → 4.435.0

package/dist/server/server.js

@@ -1201,7 +1201,7 @@ Caused by: ${Z.stack}`}};zm=class zm extends vY{constructor($,Z){super($,Z);this
 `).filter((Z)=>!/^Co-authored-by:\s/i.test(Z)).join(`
 `).trimEnd()}function Fc4($){let Z=$.userName.trim(),Q=$.userEmail?.trim();if(Q)return`Co-authored-by: ${Z} <${Q}>`;return`Co-authored-by: ${Z}`}function j51($,Z){let Q=xm(Z);if(!Q)return $;let Y=zA$($),X=Fc4(Q);if(Y.includes(X))return Y;let J=Y.trimEnd();return J.length>0?`${J}
 
-${X}`:X}var EA$,Hc4;var E51=D(()=>{EA$=/[\r\n<>]/,Hc4=/^[^\s@<>]+@[^\s@<>]+\.[^\s@<>]+$/});var tA0=D(()=>{a$();E51()});function Uc4($){if($ instanceof TypeError)return!0;if($ instanceof Error&&!($ instanceof DOMException)&&typeof $.code==="string")return!0;if($ instanceof DOMException&&$.name==="AbortError")return!0;return!1}async function z51($,Z,Q,Y){try{return await E8(async()=>{let J=await fetch($,{...Z,signal:AbortSignal.timeout(Y)});return{status:J.status,ok:J.ok,body:await J.text()}},{maxAttempts:3,minTimeout:50,maxTimeout:500,multiplier:2,jitter:0.5,isRetriable:Uc4})}catch(X){let J=X instanceof Error?X.message:String(X);throw Error(`[SANDBOX_UNREACHABLE] sandbox daemon ${Q} request failed: ${J}`,{cause:X})}}async function oA0($){try{let Z=await fetch(`${$}/health`,{signal:AbortSignal.timeout(Nc4)});if(!Z.ok){try{await Z.text()}catch{}return null}let Q=await Z.json();if(typeof Q==="object"&&Q!==null&&typeof Q.bootId==="string"&&typeof Q.ready==="boolean"&&Q.setup&&typeof Q.setup.running==="boolean"&&typeof Q.setup.done==="boolean")return Q;return null}catch{return null}}async function A51($){for(let Z=0;Z<PA$;Z++){if(await oA0($)!==null)return;let Q=(Math.random()*2-1)*Bc4;await O$(AA$+Q)}throw Error(`sandbox daemon at ${$} did not respond on /health within ${PA$*AA$/1000}s`)}async function CU($,Z,Q,Y,X){return Dc4($,Z,"POST",Q,Y,X)}async function Dc4($,Z,Q,Y,X,J){let G={...Y};if(X&&X.rotateToken!==void 0)G.auth=X;let W=await z51(`${$}/_sandbox/config`,{method:Q,headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:JSON.stringify(G)},"/_sandbox/config",J?.timeoutMs??P51);if(!W.ok)throw new PH(W.status,W.body);return RA$(W.body,"/_sandbox/config")}async function TA$($,Z,Q){let Y=await z51(`${$}/_sandbox/setup/${Q}`,{method:"POST",headers:{Authorization:`Bearer ${Z}`}},`/_sandbox/setup/${Q}`,P51);if(!Y.ok)throw Error(`sandbox daemon /_sandbox/setup/${Q} returned ${Y.status}: ${Y.body}`)}async function z10($,Z,Q){let Y=await z51(`${$}/_sandbox/orgfs-config`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:Q},"/_sandbox/orgfs-config",P51);if(!Y.ok)throw Error(`sandbox daemon /_sandbox/orgfs-config returned ${Y.status}: ${Y.body}`);return RA$(Y.body,"/_sandbox/orgfs-config")}function RA$($,Z){try{return JSON.parse($)}catch(Q){throw Error(`sandbox daemon ${Z} returned a malformed JSON body: ${$.slice(0,200)}`,{cause:Q})}}async function rA0($,Z,Q,Y){let X=new Headers(Y.headers);for(let W of Oc4)X.delete(W);X.set("authorization",`Bearer ${Z}`);let J=Y.method!=="GET"&&Y.method!=="HEAD",G=`${$}${Q.startsWith("/")?Q:`/${Q}`}`;return fetch(G,{method:Y.method,headers:X,body:J?Y.body:void 0,redirect:"manual",signal:Y.signal,duplex:J?"half":void 0})}var PH,Nc4=500,P51=30000,PA$=25,AA$=200,Bc4=50,Oc4;var Gf=D(()=>{tA0();a$();PH=class PH extends Error{status;constructor($,Z){super(`sandbox daemon /_sandbox/config returned ${$}: ${Z}`);this.status=$;this.name="ConfigRequestError"}};Oc4=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length"]});class sA0{counted=new Set;markCounted($){this.counted.add($)}consume($){return this.counted.delete($)}}class Wf{map=new Map;async run($,Z){let Q=this.map.get($);if(Q)return Q;let Y=Z();this.map.set($,Y);try{return await Y}finally{this.map.delete($)}}}function aA0($,Z,Q){if(!$)return Q(null);if(!$.withLock)return Q($);return $.withLock(Z,Q)}function P10($){if(!$.orgId||!$.virtualMcpId||!$.branch)throw Error("composeSandboxRef: orgId, virtualMcpId and branch are all required for agent refs");return`agent:${$.orgId}:${$.virtualMcpId}:${$.branch}`}function qA$($){if(!$.startsWith("agent:"))return"";let Z=$.split(":");return Z.length>=4?Z.slice(3).join(":"):""}import{hash as Lc4}from"crypto";function wc4($,Z=16){return Lc4("sha256",NL$($),"hex").slice(0,Z)}function F3($){let Z=wc4($),Q=jc4(qA$($.projectRef));return Q?`${Q}-${Z}`:`s-${Z}`}function jc4($){if(!$)return"";let Z=$.split("/").pop()??"",Q="",Y=!1;for(let X of Z.toLowerCase()){let J=X.charCodeAt(0),G=J>=97&&J<=122,W=J>=48&&J<=57;if(!G&&!W){Y||=Q.length>0;continue}if(Y){if(Q.length+1>=MA$)break;Q+="-",Y=!1}if(Q+=X,Q.length===MA$)break}return Q}var MA$=24;var IA$=D(()=>{j41()});function eA0($,Z){let Q=$.replace(/\/+$/,"");if(Q.includes("{handle}"))return`${Q.replace("{handle}",Z)}/`;try{let Y=new URL(Q);return Y.hostname=`${Z}.${Y.hostname}`,`${Y.toString()}/`}catch{return`${Q}/${Z}/`}}function fm($){let Z=$.repo,Q=Z?{repository:{cloneUrl:Z.cloneUrl,repoName:Z.displayName??Ec4(Z.cloneUrl),...Z.branch?{branch:Z.branch}:{},submoduleCredentials:Z.submoduleCredentials??[]},repositories:($.extraRepos??[]).filter((K)=>!!K.directoryName).map((K)=>({cloneUrl:K.cloneUrl,repoName:K.directoryName,...K.branch?{branch:K.branch}:{},submoduleCredentials:K.submoduleCredentials??[]})),...Z.userName.trim()||Z.userEmail.trim()?{identity:{userName:Z.userName,userEmail:Z.userEmail}}:{}}:void 0,Y=$.tenant,X=xm({userName:Y?.userName,userEmail:Y?.userEmail})??void 0,J=$.packageManager?{name:$.packageManager.name,...$.packageManager.path?{path:$.packageManager.path}:{}}:void 0,G=J?{packageManager:J,runtime:$.runtime,...$.port!==void 0?{port:$.port}:{}}:void 0,W=Y?.orgId;if(!Q&&!G&&!X&&$.cloneOnly===void 0&&!W)return null;return{...Q?{git:Q}:{},...X?{operator:X}:{},...W?{orgId:W}:{},...$.cloneOnly!==void 0?{cloneOnly:$.cloneOnly}:{},...G?{application:G}:{}}}function Ec4($){try{let Z=new URL($);return Z.pathname.replace(/^\/+/,"").replace(/\.git$/,"")||Z.hostname}catch{return $}}var VA$=D(()=>{E51()});function zc4($){try{return new URL($).username.length>0}catch{return!1}}function A10($){let Z=$.repo?.cloneUrl;if(!Z||!zc4(Z))return null;return{git:{repository:{cloneUrl:Z}}}}var ym=D(()=>{IA$();VA$()});async function*CA$($){let Z=$.now??(()=>Date.now()),Q=Z(),Y=$.schedulingTimeoutMs??Ac4,X={pod:{},sandbox:{},events:{hasPulling:!1,hasPulled:!1},startedAt:Q},J=[],G=null,W=!1,K=(E)=>{if(W)return;if(G){let z=G;G=null,z(E)}else J.push(E)},H=()=>{if(J.length>0)return Promise.resolve(J.shift());if(W)return Promise.resolve(null);return new Promise((E)=>{G=E})},F=()=>{if(W)return;if(W=!0,G){let E=G;G=null,E(null)}},U=new AbortController,N=()=>{U.abort(),F()};if($.signal)if($.signal.aborted)U.abort(),F();else $.signal.addEventListener("abort",N,{once:!0});let B=Math.max(0,Y-(Z()-Q)),O=setTimeout(()=>K("tick"),B+100),L,w=new Promise((E)=>{L=E}),j=Promise.allSettled([Rc4($.kc,$.namespace,$.claimName,U.signal,X,K,Z,L),Mc4($.kc,$.namespace,$.claimName,U.signal,X,K),Ic4($.kc,$.namespace,$.claimName,w,U.signal,X,K,Z)]);try{let E=null,z=-1,T=kA$(X,Y,Z);if(E=R51(T),!T51(T))z=SA$(T);if(yield T,T51(T))return;while(!W){if(await H()===null)break;let P=kA$(X,Y,Z);if(T51(P)){let _=R51(P);if(_!==E)E=_,yield P;return}let q=SA$(P);if(q<z)continue;let x=R51(P);if(x!==E)E=x,z=q,yield P}}finally{if(clearTimeout(O),U.abort(),$.signal)$.signal.removeEventListener("abort",N);F(),await j.catch(()=>{})}}async function _A$($,Z=Tc4){let Q=new AbortController,Y="claiming",X,J=()=>{clearTimeout(X),X=setTimeout(()=>Q.abort(),Z)};try{J();for await(let G of $(Q.signal)){if(G.kind==="ready")return;if(G.kind==="failed")throw new vY(G.message);Y=G.kind,J()}}finally{clearTimeout(X),Q.abort()}throw new zm(`Sandbox did not become ready: no progress for ${Math.round(Z/1000)}s while ${Y}`)}function kA$($,Z,Q){let{pod:Y,sandbox:X,events:J,startedAt:G}=$;if(X.ready)return{kind:"ready"};let W=Y.containerWaitingReason;if(W==="ImagePullBackOff"||W==="ErrImagePull")return{kind:"failed",reason:"image-pull-backoff",message:"Sandbox image failed to download. The cluster may be missing pull credentials or the image tag may not exist."};if(W==="CrashLoopBackOff")return{kind:"failed",reason:"crash-loop-backoff",message:"Sandbox crashed during startup and is now in CrashLoopBackOff. Check pod logs."};if(!Y.scheduled&&J.lastFailedSchedulingAt!==void 0&&Q()-G>Z)return{kind:"failed",reason:"scheduling-timeout",message:J.failedSchedulingMessage??`Pod could not be scheduled within ${Math.round(Z/1000)}s.`};if(Y.containerRunning&&!Y.containerReady)return{kind:"warming-daemon",since:G};if(J.hasPulling&&!J.hasPulled)return{kind:"pulling-image",since:G};if(W==="ContainerCreating"||W==="PodInitializing"||Y.scheduled&&!Y.containerRunning)return{kind:"starting-container",since:G};if(Y.scheduledFalseReason==="Unschedulable"||J.lastFailedSchedulingAt!==void 0&&!Y.scheduled)return{kind:"waiting-for-capacity",since:G,message:J.failedSchedulingMessage??Y.scheduledFalseMessage,nodeClaim:J.nominatedNodeClaim};return{kind:"claiming",since:G}}function T51($){return $.kind==="ready"||$.kind==="failed"}function SA$($){switch($.kind){case"claiming":return 0;case"waiting-for-capacity":return 1;case"pulling-image":return 2;case"starting-container":return 3;case"warming-daemon":return 4;case"ready":case"failed":return 99}}function R51($){switch($.kind){case"claiming":case"pulling-image":case"starting-container":case"warming-daemon":return $.kind;case"waiting-for-capacity":return`waiting-for-capacity:${$.message??""}:${$.nodeClaim??""}`;case"ready":return"ready";case"failed":return`failed:${$.reason}:${$.message}`}}async function Rc4($,Z,Q,Y,X,J,G,W){let K=`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?watch=true&labelSelector=${encodeURIComponent(`${Pc4}=${Q}`)}`;return $T0({kc:$,path:K,signal:Y,label:`pod/${Q}`,onEvent:(H)=>{if(H.type!=="ADDED"&&H.type!=="MODIFIED")return;let F=H.object;if(F.metadata?.name)W(F.metadata.name);qc4(F,X,G),J("pod")}})}function qc4($,Z,Q){let X=($.status?.conditions??[]).find((G)=>G.type==="PodScheduled");if(X?.status==="True")Z.pod.scheduled=!0,Z.pod.scheduledFalseReason=void 0,Z.pod.scheduledFalseMessage=void 0;else if(X?.status==="False")Z.pod.scheduled=!1,Z.pod.scheduledFalseReason=X.reason,Z.pod.scheduledFalseMessage=X.message;let J=($.status?.containerStatuses??[]).find((G)=>G.name===dZ.MAIN_CONTAINER_NAME);if(J)Z.pod.containerWaitingReason=J.state?.waiting?.reason,Z.pod.containerRunning=!!J.state?.running,Z.pod.containerReady=J.ready===!0}async function Mc4($,Z,Q,Y,X,J){let G=`/apis/${dZ.CLAIM_API_GROUP}/${dZ.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(Z)}/${dZ.CLAIM_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${Q}`)}`;return $T0({kc:$,path:G,signal:Y,label:`sandboxclaim/${Q}`,onEvent:(W)=>{if(W.type!=="ADDED"&&W.type!=="MODIFIED")return;let H=W.object.status?.conditions?.find((F)=>F.type==="Ready");if(!H)return;if(H.status==="True")X.sandbox.ready=!0,X.sandbox.notReadyReason=void 0,X.sandbox.notReadyMessage=void 0;else X.sandbox.ready=!1,X.sandbox.notReadyReason=H.reason,X.sandbox.notReadyMessage=H.message;J("sandbox")}})}async function Ic4($,Z,Q,Y,X,J,G,W){let K=await Promise.race([Y,new Promise((F)=>{if(X.aborted){F(Q);return}X.addEventListener("abort",()=>F(Q),{once:!0})})]);if(X.aborted)return;let H=`/api/v1/namespaces/${encodeURIComponent(Z)}/events?watch=true&fieldSelector=${encodeURIComponent(`involvedObject.name=${K},involvedObject.kind=Pod`)}`;return $T0({kc:$,path:H,signal:X,label:`events/${Q}`,onEvent:(F)=>{if(F.type!=="ADDED"&&F.type!=="MODIFIED")return;let U=F.object,N=U.reason;if(!N)return;switch(N){case"Pulling":J.events.hasPulling=!0;break;case"Pulled":J.events.hasPulling=!0,J.events.hasPulled=!0;break;case"FailedScheduling":J.events.lastFailedSchedulingAt=W(),J.events.failedSchedulingMessage=U.message;break;case"Nominated":{let B=U.message?.match(/nodeclaim\/([\w-]+)/);if(B)J.events.nominatedNodeClaim=B[1];break}default:return}G("event")}})}async function vA$($){let{kc:Z,namespace:Q,labelSelector:Y,signal:X,onDelete:J}=$,G=`/apis/${dZ.CLAIM_API_GROUP}/${dZ.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(Q)}/${dZ.CLAIM_PLURAL}?watch=true&labelSelector=${encodeURIComponent(Y)}`;return $T0({kc:Z,path:G,signal:X,label:"sandboxclaim-reaper",onEvent:(W)=>{if(W.type!=="DELETED")return;let K=W.object.metadata?.name;if(K)J(K)}})}async function $T0($){let{kc:Z,path:Q,signal:Y,label:X,onEvent:J}=$,G=0;while(!Y.aborted){try{let K=await bW(Z,{method:"GET",path:Q,signal:Y,headers:{accept:"application/json"},stream:!0});if(!K.ok||!K.body){try{await K.body?.cancel()}catch{}if(K.status===401||K.status===403){console.warn(`[lifecycle-watcher] ${X} stopped: watch denied (${K.status} ${K.statusText}). `+"The kubeconfig in use cannot watch SandboxClaims \u2014 if you are running locally, "+"this provider should not be active (check STUDIO_AGENT_SANDBOX_ENABLED).");return}throw Error(`watch handshake failed: ${K.status} ${K.statusText}`)}G=0;for await(let H of dL$(K.body)){if(Y.aborted)return;try{J(H)}catch(F){console.warn(`[lifecycle-watcher] ${X} onEvent threw: ${F instanceof Error?F.message:String(F)}`)}}}catch(K){if(Y.aborted)return;let H=K instanceof Error?K.message:String(K);console.warn(`[lifecycle-watcher] ${X} watch ended: ${H}`)}if(Y.aborted)return;let W=B7(5000,250,G,2,0);G+=1,await O$(W,{signal:Y}).catch(()=>{})}}var Pc4="studio.decocms.com/sandbox-handle",Ac4=300000,Tc4=600000;var bA$=D(()=>{a$();a00();CH0()});import{createHash as Vc4}from"crypto";import{z as xX}from"zod";function _U($){let Z;try{Z=new URL($.trim())}catch{return null}if(Z.protocol!=="https:"||Z.search||Z.hash)return null;let Q=Z.pathname.replace(/\/+$/,"").replace(/\.git$/,"").replace(/\/+$/,"");return Q?`https://${Z.host.toLowerCase()}${Q}`:null}function T10($){return _U($)?.toLowerCase()??null}function vc4($){let Z=new Set;for(let Q of $){let Y=`${T10(Q.repoUrl)??Q.repoUrl}#${Q.branch}`;if(Z.has(Y))return Q;Z.add(Y)}return null}function xA$($){return $.reduce((Z,Q)=>Z+Q.replicas,0)}function yA$($,Z){if(Z.warmPoolName)return Z.warmPoolName;let Q=Vc4("sha256").update(`${Z.repoUrl}#${Z.branch}`).digest("hex").slice(0,8);return`${$}-${Q}`}function gA$($){return Math.max(0,$.size-xA$($.repos))}function gm($){return $.flatMap((Z)=>Z.repos.map((Q)=>({pool:Z,repo:Q,warmPoolName:yA$(Z.name,Q)})))}function bc4($,Z){return lA$(void 0,$,!0,Z)}function hA$($,{templateName:Z}){let Q=bc4(Z,$.image),Y=(X,J)=>({apiVersion:`${dZ.CLAIM_API_GROUP}/${dZ.CLAIM_API_VERSION}`,kind:"SandboxWarmPool",metadata:{name:X,labels:{[xc4]:$.name}},spec:{replicas:J,updateStrategy:{type:"OnReplenish"},sandboxTemplateRef:{name:Q}}});return[...$.repos.map((X)=>Y(yA$($.name,X),X.replicas)),Y($.name,gA$($))]}function QT0($){return $.tenant?.orgId}function M51($,Z){if(!Z.tenant)return null;let Q=$.filter((J)=>J.tenant===Z.tenant&&J.image===Z.image),Y=Z.cloneUrl?T10(Z.cloneUrl):null;if(Y){let J=gm(Q).filter((W)=>T10(W.repo.repoUrl)===Y),G=J.find((W)=>W.repo.branch===Z.branch)??J[0];if(G)return G}let X=Q.find((J)=>gA$(J)>0);return X?{pool:X,repo:null,warmPoolName:X.name}:null}function uA$($,Z,Q){return $?.warmPoolName??(Z?Q:"none")}function lA$($,Z,Q=!1,Y){let X=Y&&Y!=="default"?`-${Y}`:"";return`${Z}${X}${$==="harness-run"||Q?"-medium":""}`}async function I51($){let Z=lA$($.purpose,$.templateName,$.tenantPool,$.sandboxImage);if(Z===$.templateName)return{name:Z,probes:$.probes};let Q=$.probes[Z]??null,Y=Q!==null&&$.now-Q.checkedAt<$.ttlMs?Q:{checkedAt:$.now,present:await $.exists(Z)},X={...$.probes,[Z]:Y};if(Y.present)return{name:Z,probes:X};if(Q?.present!==!1)$.onAbsent?.(Z);if($.sandboxImage&&$.sandboxImage!=="default")return I51({...$,sandboxImage:void 0,probes:X});return{name:$.templateName,probes:X}}function V51($,Z,Q){let Y=T10(Z);if(!Y)return[];let X=Q.replace(/^refs\/heads\//,"");return gm($).filter(({repo:J})=>T10(J.repoUrl)===Y&&J.branch===X)}class k51{source;dirty=new Set;pods=new Map;known=new Map;constructor($){this.source=$}pools(){return this.source()}resolve($){return M51(this.pools(),$)}markDirty($,Z){let Q=V51(this.pools(),$,Z).map((Y)=>Y.warmPoolName);for(let Y of Q)this.dirty.add(Y);return Q}takeDirty($){return this.dirty.delete($)}pod($){return this.pods.get($)}setPod($,Z){this.pods.set($,Z)}retainPods($,Z){for(let[Q,Y]of this.pods)if(Y.pool===$&&!Z.has(Q))this.pods.delete(Q)}retain($){let Z=new Map($.map((Y)=>[Y.warmPoolName,Y])),Q=[...this.known.values()].filter((Y)=>!Z.has(Y.warmPoolName));for(let Y of this.dirty)if(!Z.has(Y))this.dirty.delete(Y);for(let[Y,X]of this.pods)if(!Z.has(X.pool))this.pods.delete(Y);return this.known=Z,Q}}var kc4=54,Sc4,Cc4=2048,_c4,R10,ZT0,q51,fA$,xc4="studio.decocms.com/tenant-pool";var q10=D(()=>{i4();a00();Sc4=/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/;_c4=xX.object({runtime:xX.enum(["node","bun","deno"]).default("node"),packageManager:xX.enum(["npm","pnpm","yarn","bun","deno"]).optional(),packageManagerPath:xX.string().optional(),devPort:xX.number().int().positive().optional()}).default({runtime:"node"}),R10=xX.object({repoUrl:xX.string().max(Cc4).transform(($,Z)=>{let Q=_U($);if(Q)return Q;return Z.addIssue({code:"custom",message:"repoUrl must be an https clone URL"}),xX.NEVER}),branch:xX.string().min(1).default("main"),workload:_c4,replicas:xX.number().int().min(1)});ZT0=class ZT0 extends Error{poolName;size;allocated;constructor($,Z,Q){super(`pool ${$}: repos take ${Q} replicas, more than its size ${Z}`);this.poolName=$;this.size=Z;this.allocated=Q;this.name="TenantPoolCapacityError"}};q51=xX.object({name:xX.string().max(kc4).regex(Sc4,"pool name must be a DNS label (lowercase alphanumeric and '-')"),tenant:xX.string().min(1).max(512),size:xX.number().int().min(1),image:FU.default("default")}),fA$=q51.extend({repos:xX.array(R10).default([])}).superRefine(($,Z)=>{let Q=vc4($.repos);if(Q)Z.addIssue({code:"custom",path:["repos"],message:`duplicate repo allocation ${Q.repoUrl}#${Q.branch}`});let Y=xA$($.repos);if(Y>$.size)Z.addIssue({code:"custom",path:["repos"],message:new ZT0($.name,$.size,Y).message})})});async function cA$($,Z,Q){let Y=new Map;for(let X of $){let J=Z(X);if(!J)continue;let G=Y.get(J);if(G)G.push(X);else Y.set(J,[X])}await Promise.allSettled([...Y.values()].map(async(X)=>{for(let J of X)await Q(J).catch(()=>{})}))}function fc4($){try{let Z=new URL($);if(Z.hostname.toLowerCase()!=="github.com")return null;let[Q,Y]=Z.pathname.replace(/^\/+/,"").split("/"),X=Y?.replace(/\.git$/,"");return Q&&X?`${Q}/${X}`.toLowerCase():null}catch{return null}}function mA$($){if($.repositoryId)return{repositoryId:$.repositoryId};let Z=$.connectionId?fc4($.cloneUrl):null;return $.connectionId&&Z?{connectionId:$.connectionId,repo:Z}:null}var dA$=D(()=>{q10()});async function hm($,Z,Q,Y){let X=(G)=>rA0(G.url,G.token,Z,Q),J=!(Q.body instanceof ReadableStream);try{let G=await X($);if(G.status!==401||!J)return G;let W=await Y.unauthorized();if(!W)return G;return await G.body?.cancel().catch(()=>{}),await X(W)}catch(G){if(!J)throw G;let W=await Y.unreachable();if(!W)throw G;return X(W)}}var YT0=D(()=>{Gf()});function nA$($,Z){return new Response(JSON.stringify(Z),{status:$,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function iA$($){let Z=new Headers;for(let[Q,Y]of $.headers.entries())if(!gc4.includes(Q.toLowerCase()))Z.set(Q,Y);return new Response($.body,{status:$.status,statusText:$.statusText,headers:Z})}function pA$($,Z){let Q=nA$($,{error:Z});return Q.headers.set("x-sandbox-preview-not-ready","1"),Q}async function lm($,Z,Q){let Y=await Z.base();if(!Y)return pA$(404,"sandbox not found");let X=new URL($.url);if((X.pathname==="/_sandbox"||X.pathname.startsWith("/_sandbox/"))&&$.method!=="GET")return nA$(404,{error:"not found"});let G=(F)=>`${F}${X.pathname}${X.search}`,W=new Headers($.headers);for(let F of yc4)W.delete(F);let K=$.method!=="GET"&&$.method!=="HEAD",H={method:$.method,headers:W,body:K?$.body:void 0,redirect:"manual",signal:$.signal,duplex:K?"half":void 0};try{return iA$(await fetch(G(Y),H))}catch(F){let U=`${Y}${X.pathname}`;if(console.warn(`[${Q}] preview fetch to ${U} failed: ${F instanceof Error?F.message:String(F)}`),Z.invalidate(),$.method==="GET"||$.method==="HEAD"){let N=await Z.retryBase();if(N)try{return iA$(await fetch(G(N),H))}catch(B){console.warn(`[${Q}] preview fetch retry to ${U} failed: ${B instanceof Error?B.message:String(B)}`)}}return pA$(502,"sandbox daemon unreachable")}}var um="x-sandbox-preview-not-ready",yc4,gc4;var XT0=D(()=>{yc4=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length","upgrade"],gc4=["connection","keep-alive","transfer-encoding","content-encoding","content-length"]});import{createHash as hc4,randomBytes as uc4,randomUUID as tA$}from"crypto";import*as ZT$ from"net";import{PassThrough as lc4}from"stream";function oA$($){if($ instanceof Error)return $.message;if($&&typeof $==="object"){let Z=$;if(Z.error instanceof Error)return Z.error.message;if(typeof Z.message==="string"&&Z.message)return Z.message}return String($)}function aA$($){return{pool:$.warmPoolName,org:$.pool.tenant}}class f51{records=new Map;inflight=new Wf;activeGauge=new sA0;stateStore;previewUrlPattern;kubeConfig;capacityProbe;portForward;namespace;sandboxTemplateName;envName;tokenGenerator;idleTtlMs;metrics;previewGateway;sentinelToken;mintCloneUrl;mintPoolCloneUrl;mintOrgFsConfig;forwardPort;daemonAddress;persistCredentials;tenantPools;tenantPoolRefreshMs;templateProbes={};closed=!1;claimWatchAbort=new AbortController;constructor($={}){this.stateStore=$.stateStore??null,this.previewUrlPattern=$.previewUrlPattern??null,this.kubeConfig=$.kubeConfig??$m4(),this.portForward=new Q51(this.kubeConfig),this.namespace=$.namespace??cc4,this.sandboxTemplateName=$.sandboxTemplateName??mc4,this.envName=Jm4($.envName),this.tokenGenerator=$.tokenGenerator??(()=>uc4(ic4).toString("hex")),this.idleTtlMs=$.idleTtlMs??nc4,this.metrics=$.meter?ec4($.meter):null,this.previewGateway=$.previewGateway&&$.previewUrlPattern?{...$.previewGateway}:null;let Z=$.sentinelToken?.trim()??"";this.sentinelToken=Z.length>0?Z:null,this.mintCloneUrl=$.mintCloneUrl,this.mintPoolCloneUrl=$.mintPoolCloneUrl,this.mintOrgFsConfig=$.mintOrgFsConfig,this.forwardPort=$.forwardPort,this.daemonAddress=$.daemonAddress??"forward",this.persistCredentials=$.persistCredentials??!0;let Q=$.tenantPools;if(this.tenantPools=this.sentinelToken===null?null:new k51(typeof Q==="function"?Q:()=>Q??[]),this.sentinelToken===null&&(typeof Q==="function"||(Q?.length??0)>0))console.warn(`[${T6}] tenant pools configured without a sentinel token \u2014 ignoring them (warm-pool mode is off)`);this.tenantPoolRefreshMs=$.tenantPoolRefreshMs??oc4,this.startClaimReaper(),this.startCredentialRefresher(),this.startTenantPoolReconciler()}startClaimReaper(){let $=["app.kubernetes.io/managed-by=studio","app.kubernetes.io/name=studio-sandbox",...this.envName?[`${fX.env}=${this.envName}`]:[]].join(",");vA$({kc:this.kubeConfig,namespace:this.namespace,labelSelector:$,signal:this.claimWatchAbort.signal,onDelete:(Z)=>this.invalidateRecord(Z)})}async ensure($,Z={}){let Q=F3($);if(Q.startsWith("s-"))throw Error(`ensure: projectRef has no slug source: ${$.projectRef}`);return this.inflight.run(Q,()=>aA0(this.stateStore,$,(Y)=>this.ensureLocked($,Q,Z,Y)))}async delete($){let Z=await this.getRecord($);if(this.records.delete($),Z)this.dropRecord(Z);if(await this.deleteHttpRouteIfManaged($).catch((Q)=>{console.warn(`[${T6}] HTTPRoute delete failed for ${$}: ${Q instanceof Error?Q.message:String(Q)}`)}),await vA(this.kubeConfig,this.namespace,$),this.stateStore)if(Z)await this.stateStore.delete(Z.id);else await this.stateStore.deleteByHandle($)}lastTermination($){return xL$(this.kubeConfig,this.namespace,fX.sandboxHandle,$,dZ.MAIN_CONTAINER_NAME)}async alive($){return await wD(this.kubeConfig,this.namespace,$)!==void 0}watchClaimLifecycle($,Z){return CA$({kc:this.kubeConfig,namespace:this.namespace,claimName:$,signal:Z})}hasSchedulableCapacity(){return this.capacityProbe??=pL$(this.kubeConfig,this.namespace),this.capacityProbe()}async getPreviewUrl($){let Z=await this.getRecord($);if(!Z)return null;return this.composePreviewUrl(Z)}async proxyDaemonRequest($,Z,Q){let Y=await this.getRecord($);if(!Y&&this.previewUrlPattern&&this.stateStore){let K=await this.stateStore.getByHandle($),H=K?.state,F=H?.token;if(K&&F){let N=`http://${H?.adoptedSandboxName??$}.${this.namespace}.svc.cluster.local:${vU}`;try{let B=await rA0(N,F,Z,Q);if(B.status!==404)return B;try{await B.body?.cancel()}catch{}}catch{}}}if(!Y)Y=await this.resurrectByHandle($);if(!Y)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let X=Y,J=performance.now(),G=0,W=(K)=>{return X=K,{url:K.daemonUrl,token:K.token}};try{let K=await hm(W(Y),Z,Q,{unauthorized:async()=>{this.invalidateRecord($);let H=await this.getRecord($).catch(()=>null)??await this.resurrectByHandle($).catch(()=>null);return H?W(H):null},unreachable:async()=>{this.invalidateRecord($);let H=await this.resurrectByHandle($)??await this.getRecord($).catch(()=>null);return H?W(H):null}});return G=K.status,K}finally{this.recordProxyDuration("daemon",G,X,performance.now()-J)}}async adoptLiveClaim($,Z){if(this.records.has(Z))return!0;let Q=await wD(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!Q||Q.metadata?.deletionTimestamp)return!1;return await this.inflight.run(Z,async()=>{let X=this.records.get(Z);if(X)return this.toSandbox(X);let J=await this.adopt($,Z,Q);if(!J)throw Error(`cannot adopt live claim ${Z}`);return aA0(this.stateStore,$,(G)=>this.finish(J,G,!0,!0,"adopt"))}).catch(()=>null)!=null}async resolvePreviewUpstreamUrl($){if(this.previewUrlPattern)return`http://${await this.resolveServiceNameForHandle($)}.${this.namespace}.svc.cluster.local:${vU}`;let Z=await this.getRecord($);if(Z)return Z.daemonUrl;let Q=await this.resurrectByHandle($);return Q?Q.daemonUrl:null}async daemonEndpoint($){let Z=await this.getRecord($)??await this.resurrectByHandle($);if(!Z)return null;return{url:this.daemonAddress==="service"?`http://${Z.adoptedSandboxName}.${this.namespace}.svc.cluster.local:${vU}`:Z.daemonUrl,token:Z.token}}listSandboxes(){return[...this.records.values()].map(($)=>{let Z=$.ensureOpts,Q=Z?.tenant;return{handle:$.handle,tenant:Q?{orgId:Q.orgId,userId:Q.userId}:null,repos:[Z?.repo,...Z?.extraRepos??[]].filter((Y)=>Y!==void 0).map(mA$).filter((Y)=>Y!==null),orgFs:Boolean(Z?.orgFsConfigJson)||$.orgFsRedacted===!0}})}async resolveServiceNameForHandle($){let Z=this.records.get($);if(Z)return Z.adoptedSandboxName;if(this.stateStore){let Y=(await this.stateStore.getByHandle($).catch(()=>null))?.state?.adoptedSandboxName;if(Y)return Y}return $}async proxyPreviewRequest($,Z){let Q=performance.now(),Y=this.records.get($)??null,X=0;try{let J=await lm(Z,{base:()=>this.resolvePreviewUpstreamUrl($),invalidate:()=>this.invalidateRecord($),retryBase:async()=>{return await this.resurrectByHandle($).catch(()=>null)?this.resolvePreviewUpstreamUrl($):null}},T6);return X=J.status,J}finally{this.recordProxyDuration("preview",X,Y,performance.now()-Q,$)}}async ensureLocked($,Z,Q,Y){if(Q.image)console.warn(`[${T6}] opts.image ignored (template ${this.sandboxTemplateName} pins image): got ${Q.image}`);if(Y){let G=await Y.get($);if(G){let W=await this.rehydrate($,Z,G);if(W)return await this.refreshDaemonGitCredential(W,Q),await this.relayOrgFsConfig(W.daemonUrl,W.token,Q.orgFsConfigJson),this.finish(W,Y,!1,!0,"resume");await Y.delete($)}}let X=await wD(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(X)if(X.metadata?.deletionTimestamp)await Z10(this.kubeConfig,this.namespace,Z).catch((G)=>{console.warn(`[${T6}] wait for terminating claim ${Z} failed: ${G instanceof Error?G.message:String(G)}`)});else if(!S51(X)){let G=await this.join($,Z,Q,X).catch((W)=>{return console.warn(`[${T6}] join of starting claim ${Z} failed, recreating: ${W instanceof Error?W.message:String(W)}`),null});if(G)return this.finish(G,Y,!0,!0,"adopt");await vA(this.kubeConfig,this.namespace,Z).catch(()=>{}),await Z10(this.kubeConfig,this.namespace,Z).catch((W)=>{console.warn(`[${T6}] wait for deleted claim ${Z} failed: ${W instanceof Error?W.message:String(W)}`)})}else{let G=await this.adopt($,Z,X).catch((W)=>{return console.warn(`[${T6}] adopt ${Z} failed, recreating: ${W instanceof Error?W.message:String(W)}`),null});if(G)return await this.refreshDaemonGitCredential(G,Q),await this.relayOrgFsConfig(G.daemonUrl,G.token,Q.orgFsConfigJson),this.finish(G,Y,!0,!0,"adopt");await vA(this.kubeConfig,this.namespace,Z).catch(()=>{}),await Z10(this.kubeConfig,this.namespace,Z).catch((W)=>{console.warn(`[${T6}] wait for deleted claim ${Z} failed: ${W instanceof Error?W.message:String(W)}`)})}let J=await this.provision($,Z,Q);return this.finish(J,Y,!0,!1,"fresh")}async finish($,Z,Q,Y,X){let J=this.records.get($.handle),G=J!==void 0;if(J&&J.daemonForward!==$.daemonForward)this.closeForwarder(J.daemonForward);if(this.records.set($.handle,$),Q)await this.persist(Z,$);if(Y)await SH0(this.kubeConfig,this.namespace,$.handle,this.computeShutdownTime()).catch((W)=>console.warn(`[${T6}] TTL refresh failed for ${$.handle}: ${W instanceof Error?W.message:String(W)}`));if(this.metrics){let W=v51($.tenant);if(this.metrics.ensureOutcome.add(1,{...W,outcome:X}),!G)this.metrics.active.add(1,W),this.activeGauge.markCounted($.handle)}return this.toSandbox($)}buildEnvMap($,Z){let Q={},Y=[];for(let[X,J]of Object.entries($.env??{}))if(pc4.has(X))Y.push(X);else Q[X]=J;if(Y.length>0)console.warn(`[${T6}] opts.env keys overlap reserved bootstrap names and were dropped: ${Y.join(",")}`);return{...Q,DAEMON_TOKEN:Z.token,DAEMON_BOOT_ID:Z.daemonBootId,APP_ROOT:Z.workdir,PROXY_PORT:String(vU)}}async resolveTemplateName($,Z,Q){let{name:Y,probes:X}=await I51({purpose:$,tenantPool:Z,...Q?{sandboxImage:Q}:{},templateName:this.sandboxTemplateName,probes:this.templateProbes,now:Date.now(),ttlMs:dc4,exists:(J)=>CL$(this.kubeConfig,this.namespace,J),onAbsent:(J)=>console.warn(`[${T6}] SandboxTemplate ${J} not found (or not readable) \u2014 this claim falls back to a template without that suffix. Upgrade the sandbox-env chart to the version that renders it.`)});return this.templateProbes=X,Y}buildClaim($,Z,Q,Y,X){let J=this.sentinelToken!==null,G=J?[]:Object.entries(this.buildEnvMap(Z,Q)).sort(([H],[F])=>H<F?-1:H>F?1:0).map(([H,F])=>({name:H,value:F})),W=Km4(Z),K=Object.keys(W).length>0;return{apiVersion:`${dZ.CLAIM_API_GROUP}/${dZ.CLAIM_API_VERSION}`,kind:"SandboxClaim",metadata:{name:$,namespace:this.namespace,labels:{"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[fX.env]:this.envName}:{},..._51(Z.tenant)},...K?{annotations:W}:{}},spec:{sandboxTemplateRef:{name:X},additionalPodMetadata:{labels:_51(Z.tenant,{[fX.role]:"claimed",[fX.sandboxHandle]:$,...this.envName?{[fX.env]:this.envName}:{}}),...K?{annotations:W}:{}},env:G,warmpool:uA$(Y,J,X),lifecycle:{shutdownPolicy:"Delete",shutdownTime:this.computeShutdownTime()}}}}async provision($,Z,Q){let Y=this.tokenGenerator(),X=tA$(),J=JT0,G=this.claimTenantPoolBinding(Q),W=this.buildClaim(Z,Q,{token:Y,daemonBootId:X,workdir:J},G,await this.resolveTemplateName(Q.purpose,G!==null,Q.sandboxImage));try{await T41(this.kubeConfig,this.namespace,W)}catch(K){if(K instanceof s00)await Z10(this.kubeConfig,this.namespace,Z),await T41(this.kubeConfig,this.namespace,W);else throw K}return this.bind($,Z,Q,G,{token:Y,daemonBootId:X,workdir:J})}claimTenantPoolBinding($){return this.tenantPools?.resolve({tenant:QT0($),image:$.sandboxImage??"default",cloneUrl:$.repo?.cloneUrl,branch:$.repo?.branch})??null}async bind($,Z,Q,Y,{token:X,daemonBootId:J,workdir:G}){let W;try{W=await _L$(this.kubeConfig,this.namespace,Z),await _A$((B)=>this.watchClaimLifecycle(Z,B))}catch(B){throw await vA(this.kubeConfig,this.namespace,Z).catch(()=>{}),B}try{await this.ensureServicePortForAdoptedSandbox(W),await this.ensureHttpRouteForHandle(Z,W,Q.tenant??null)}catch(B){throw await vA(this.kubeConfig,this.namespace,Z).catch(()=>{}),B}let K=await this.openForwarder(W,vU,Z),H=`http://127.0.0.1:${K.localPort}`,F=Y?.repo!=null&&W!==Z,U=this.workloadConfigPayload(Q,F),N=J;try{if(await A51(H),this.sentinelToken!==null){let B=await oA0(H);if(B)N=B.bootId;try{await CU(H,this.sentinelToken,U??{},{rotateToken:X})}catch(O){if(O instanceof PH&&O.status===401)console.warn(`[${T6}] sentinel rejected by adopted pod (handle=${Z}, sandbox=${W}): pod belongs to another claim; tearing down and reprovisioning`);throw O}}else if(U)await CU(H,X,U);await this.relayOrgFsConfig(H,X,Q.orgFsConfigJson)}catch(B){throw this.closeForwarder(K),await this.deleteHttpRouteIfManaged(Z).catch(()=>{}),await vA(this.kubeConfig,this.namespace,Z).catch(()=>{}),B}return{id:$,handle:Z,adoptedSandboxName:W,token:X,workdir:G,daemonUrl:H,daemonForward:K,workload:Q.workload??null,daemonBootId:N,tenant:Q.tenant??null,tenantPoolPodBound:F,ensureOpts:Dm4(Q)}}workloadConfigPayload($,Z){return fm({runtime:$?.workload?.runtime??"node",packageManager:$?.workload?.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:$?.repo??null,extraRepos:$?.extraRepos??[],port:$?.workload?.devPort??rA$,tenant:$?.tenant??void 0,...$?{cloneOnly:$.cloneOnly===!0&&!Z}:{}})}async relayOrgFsConfig($,Z,Q){if(!Q)return;await z10($,Z,Q).catch((Y)=>console.warn("[org-fs] sidecar config relay failed",Y))}async refreshDaemonGitCredential($,Z){let Q=A10(Z);if(!Q)return;try{await CU($.daemonUrl,$.token,Q)}catch(Y){console.warn(`[${T6}] git credential refresh failed for ${$.handle}: ${Y instanceof Error?Y.message:String(Y)}`)}}async withFreshCloneUrl($,Z={}){if(!this.mintCloneUrl)return $;try{let Q=await this.mintCloneUrl($,Z);if(!Q)return $;let{credentialExpiresAt:Y,...X}=$;return{...X,cloneUrl:Q}}catch(Q){return console.warn(`[${T6}] clone credential re-mint failed: ${Q instanceof Error?Q.message:String(Q)}`),$}}async withFreshCredentials($,Z=!1){return{...$,...$.repo?{repo:await this.withFreshCloneUrl($.repo,{tenant:$.tenant})}:{},...$.orgFsConfigJson||Z?{orgFsConfigJson:await Nm4($,this.mintOrgFsConfig)}:{}}}startCredentialRefresher(){if(!this.mintCloneUrl)return;let{signal:$}=this.claimWatchAbort;(async()=>{while(!$.aborted){if(await O$(rc4,{signal:$}).catch(()=>{}),$.aborted)break;try{await this.refreshAllGitCredentials()}catch(Z){console.warn(`[${T6}] periodic credential refresh failed: ${Z instanceof Error?Z.message:String(Z)}`)}}})()}startTenantPoolReconciler(){let $=this.tenantPools;if(!$)return;let{signal:Z}=this.claimWatchAbort;(async()=>{while(!Z.aborted){try{await this.reconcileTenantPools($)}catch(Q){console.warn(`[${T6}] tenant pool reconcile failed: ${Q instanceof Error?Q.message:String(Q)}`)}await O$(tc4,{signal:Z}).catch(()=>{})}})()}listTenantPools(){return this.tenantPools?.pools()??[]}markTenantPoolsDirty($,Z){return Promise.resolve(this.tenantPools?.markDirty($,Z)??[])}async reconcileTenantPools($){let Z=gm($.pools());for(let Q of $.retain(Z))this.recordPoolGone(Q);for(let Q of Z){let Y=Q.warmPoolName,X=await vL$(this.kubeConfig,this.namespace,Y);if(X===null){console.warn(`[${T6}] tenant pool ${Y}: no SandboxWarmPool (or no selector yet) in ${this.namespace}`);continue}let J=$.takeDirty(Y),G=X.filter((W)=>!W.labels[fX.sandboxHandle]);$.retainPods(Y,new Set(X.map((W)=>W.uid)));for(let W of G){if(this.claimWatchAbort.signal.aborted)return;await this.warmPoolPod($,Q,W,J)}this.recordPoolDepth($,Q,X,G)}}recordPoolGone($){let Z=aA$($);for(let Q of["ready","bound","pending","failed"])this.metrics?.poolPods.record(0,{...Z,state:Q})}recordPoolDepth($,Z,Q,Y){let X=this.metrics?.poolPods;if(!X)return;let J=0,G=0;for(let K of Y){let H=$.pod(K.uid);if(!H)continue;if(H.failures>=GT0)G++;else if(H.lastConfigAt>0)J++}let W=aA$(Z);X.record(J,{...W,state:"ready"}),X.record(Q.length-Y.length,{...W,state:"bound"}),X.record(Y.length-J-G,{...W,state:"pending"}),X.record(G,{...W,state:"failed"})}async warmPoolPod($,Z,Q,Y){let X=Z.warmPoolName,{workload:J}=Z.repo,G=$.pod(Q.uid);if(G&&G.failures>=GT0){if(Date.now()-G.lastFailureAt<sA$)return;$.setPod(Q.uid,{...G,failures:0})}let W=Y||G!==void 0&&Date.now()-G.lastConfigAt>=this.tenantPoolRefreshMs;if(G&&!W)return;let K=await this.allocationCloneUrl(Z);if(!K){this.recordPoolFailure($,Q,X,"clone credential mint failed");return}let H={cloneUrl:K,branch:Z.repo.branch,userName:"",userEmail:""},F=await this.openForwarder(Q.name,vU,Q.name).catch(()=>null);if(!F){this.recordPoolFailure($,Q,X,"port-forward failed");return}let U=`http://127.0.0.1:${F.localPort}`;try{await A51(U);let N=this.sentinelToken;if(!N)return;if(!await this.isPoolPodUnbound(Q))return;let B=fm({runtime:J.runtime,packageManager:J.packageManager?{name:J.packageManager,...J.packageManagerPath?{path:J.packageManagerPath}:{}}:null,repo:H,port:J.devPort??rA$})??{},{transition:O}=await CU(U,N,B);if(W&&O!=="bootstrap"&&await this.isPoolPodUnbound(Q))await TA$(U,N,"clone");$.setPod(Q.uid,{pool:X,lastConfigAt:Date.now(),lastFailureAt:0,failures:0}),console.log(`[${T6}] tenant pool ${X}: warmed ${Q.name} (${O})`)}catch(N){this.recordPoolFailure($,Q,X,N instanceof Error?N.message:String(N))}finally{this.closeForwarder(F)}}async allocationCloneUrl({pool:$,repo:Z}){if(!this.mintPoolCloneUrl)return`${Z.repoUrl}.git`;try{return await this.mintPoolCloneUrl({tenant:$.tenant,repoUrl:Z.repoUrl,branch:Z.branch})}catch(Q){return console.warn(`[${T6}] tenant pool clone credential mint failed: ${Q instanceof Error?Q.message:String(Q)}`),null}}isPoolPodUnbound($){return bL$(this.kubeConfig,this.namespace,$.name,fX.sandboxHandle)}recordPoolFailure($,Z,Q,Y){let X=$.pod(Z.uid),J=(X?.failures??0)+1;$.setPod(Z.uid,{pool:Q,lastConfigAt:X?.lastConfigAt??0,lastFailureAt:Date.now(),failures:J});let G=J>=GT0?` \u2014 backing off ${sA$/60000}min`:"";console.warn(`[${T6}] tenant pool ${Q}: warming ${Z.name} failed (${J}/${GT0})${G}: ${Y}`)}async refreshAllGitCredentials(){await cA$(this.records.values(),($)=>$.ensureOpts?.repo?.connectionId,async($)=>{if(this.claimWatchAbort.signal.aborted)return;let Z=$.ensureOpts?.repo;if(!Z)return;try{let Q=await this.withFreshCloneUrl(Z,{bufferMs:sc4,tenant:$.ensureOpts?.tenant});await this.refreshDaemonGitCredential($,{...$.ensureOpts,repo:Q}),$.ensureOpts={...$.ensureOpts,repo:Q}}catch(Q){throw console.warn(`[${T6}] git credential refresh failed for ${$.handle}: ${Q instanceof Error?Q.message:String(Q)}`),Q}})}async rebootstrapDaemon($,Z,Q){if(this.sentinelToken===null)return!1;let Y=this.workloadConfigPayload(Q,!1)??{};try{return await CU($,this.sentinelToken,Y,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,Q?.orgFsConfigJson),!0}catch(X){if(X instanceof PH&&X.status===401)try{return await CU($,Z,Y,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,Q?.orgFsConfigJson),!0}catch(J){return console.warn(`[${T6}] re-bootstrap retry with claim token failed: ${J instanceof Error?J.message:String(J)}`),!1}return console.warn(`[${T6}] re-bootstrap failed: ${X instanceof Error?X.message:String(X)}`),!1}}async ensureServicePortForAdoptedSandbox($){if(!this.previewGateway||!this.previewUrlPattern)return;await mL$(this.kubeConfig,this.namespace,$,{name:"daemon",port:vU,targetPort:vU})}async ensureHttpRouteForHandle($,Z,Q){if(!this.previewGateway||!this.previewUrlPattern)return;let Y=Om4(this.previewUrlPattern,$);if(!Y)throw new vY(`Unable to derive preview hostname for ${$} from pattern: ${this.previewUrlPattern}`);let X={apiVersion:`${q41.API_GROUP}/${q41.API_VERSION}`,kind:"HTTPRoute",metadata:{name:$,namespace:this.namespace,labels:_51(Q??void 0,{[fX.role]:"claimed",[fX.sandboxHandle]:$,"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[fX.env]:this.envName}:{}})},spec:{parentRefs:[{kind:"Gateway",group:"gateway.networking.k8s.io",name:this.previewGateway.name,namespace:this.previewGateway.namespace}],hostnames:[Y],rules:[{backendRefs:[{group:"",kind:"Service",name:Z,port:vU}]}]}};await uL$(this.kubeConfig,this.namespace,X)}async deleteHttpRouteIfManaged($){if(!this.previewGateway)return;await lL$(this.kubeConfig,this.namespace,$)}async rehydrate($,Z,Q){let Y=Q.state;if(!Y.adoptedSandboxName&&!Y.podName||!Y.token)return null;let X=await wD(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!X||!S51(X))return null;let J=X.status?.sandbox?.name??Y.adoptedSandboxName??Y.podName??Z,G=await this.openAndProbeDaemon(J,Z);if(!G)return null;if(Y.daemonBootId&&Y.daemonBootId!==G.bootId){if(this.sentinelToken!==null){let W=Y.ensureOpts?await this.withFreshCredentials(Y.ensureOpts,Y.orgFsRedacted===!0):null;if(!await this.rebootstrapDaemon(G.daemonUrl,Y.token,W))return this.closeForwarder(G.daemonForward),null}else console.warn(`[${T6}] daemon restart detected (handle=${Z}): stored bootId=${Y.daemonBootId} live bootId=${G.bootId}`);await this.stateStore?.put($,{handle:Z,state:{...Y,daemonBootId:G.bootId}}).catch((W)=>console.warn(`[${T6}] bootId persist failed for ${Z}: ${W instanceof Error?W.message:String(W)}`))}return{id:$,handle:Z,adoptedSandboxName:J,tenantPoolPodBound:!1,token:Y.token,workdir:Y.workdir??JT0,daemonUrl:G.daemonUrl,daemonForward:G.daemonForward,workload:Y.workload??null,daemonBootId:G.bootId,tenant:Y.tenant??null,ensureOpts:Y.ensureOpts??null,orgFsRedacted:Y.orgFsRedacted===!0}}join($,Z,Q,Y){let X=this.sentinelToken!==null,J=X?this.tokenGenerator():C51(Y,"DAEMON_TOKEN"),G=X?tA$():C51(Y,"DAEMON_BOOT_ID");if(!J||!G)throw new vY(`claim ${Z} carries no daemon token`);return this.bind($,Z,Q,this.claimTenantPoolBinding(Q),{token:J,daemonBootId:G,workdir:JT0})}async adopt($,Z,Q){if(!S51(Q))return null;let Y=Q.status?.sandbox?.name??Z;if(this.sentinelToken!==null)return null;let X=C51(Q,"DAEMON_TOKEN");if(!X)return null;let J=await this.openAndProbeDaemon(Y,Z);if(!J)return null;let G=Hm4(Q);if(this.previewGateway)await this.ensureServicePortForAdoptedSandbox(Y).catch((W)=>{console.warn(`[${T6}] Service port backfill failed for ${Z}: ${W instanceof Error?W.message:String(W)}`)}),await this.ensureHttpRouteForHandle(Z,Y,G).catch((W)=>{console.warn(`[${T6}] HTTPRoute backfill failed for ${Z}: ${W instanceof Error?W.message:String(W)}`)});return{id:$,handle:Z,adoptedSandboxName:Y,tenantPoolPodBound:!1,token:X,workdir:JT0,daemonUrl:J.daemonUrl,daemonForward:J.daemonForward,workload:null,daemonBootId:J.bootId,tenant:G,ensureOpts:null}}async openAndProbeDaemon($,Z){let Q=await this.openForwarder($,vU,Z).catch(()=>null);if(!Q)return null;let Y=`http://127.0.0.1:${Q.localPort}`,X=await oA0(Y);if(!X)return this.closeForwarder(Q),null;return{daemonForward:Q,daemonUrl:Y,bootId:X.bootId}}async getRecord($){let Z=this.records.get($);if(Z)return Z;if(!this.stateStore)return null;let Q=await this.stateStore.getByHandle($);if(!Q)return null;let Y=await this.rehydrate(Q.id,$,Q);if(Y)this.records.set($,Y);return Y}async resurrectByHandle($){if(!this.stateStore)return null;let Z=await this.stateStore.getByHandle($);if(!Z)return null;let Q=Z.state,Y=Q.ensureOpts;if(!Y)return null;let X=await this.withFreshCredentials(Y,Q.orgFsRedacted===!0);if(F3(Z.id)!==$)return null;return await this.ensure(Z.id,X),this.records.get($)??null}invalidateRecord($){let Z=this.records.get($);if(!Z)return;this.records.delete($),this.dropRecord(Z)}dropRecord($){if(this.closeForwarder($.daemonForward),this.metrics&&this.activeGauge.consume($.handle))this.metrics.active.add(-1,v51($.tenant))}recordProxyDuration($,Z,Q,Y,X){if(!this.metrics)return;this.metrics.proxyDurationMs.record(Y,{...v51(Q?.tenant??null),source:$,sandbox_handle:Q?.handle??X??"",status_code:Z||0})}composePreviewUrl($){if(this.previewUrlPattern)return eA0(this.previewUrlPattern,$.handle);return`http://127.0.0.1:${$.daemonForward.localPort}/`}toSandbox($){return{handle:$.handle,workdir:$.workdir,previewUrl:this.composePreviewUrl($),warmPoolAdopted:$.tenantPoolPodBound===!0,provider:"kubernetes"}}async persist($,Z){if(!$)return;let Q={adoptedSandboxName:Z.adoptedSandboxName,token:Z.token,workdir:Z.workdir,workload:Z.workload,daemonBootId:Z.daemonBootId,tenant:Z.tenant,...Z.ensureOpts?this.persistCredentials?{ensureOpts:Z.ensureOpts}:Bm4(Z.ensureOpts,Z.orgFsRedacted===!0):{}};await $.put(Z.id,{handle:Z.handle,state:Q})}computeShutdownTime(){return new Date(Date.now()+this.idleTtlMs).toISOString()}async releaseAfter($,Z){let Q=await wD(this.kubeConfig,this.namespace,$);if(!Q)return;let Y=Fm4(Q.spec?.lifecycle?.shutdownTime,new Date(Date.now()+Z));if(!Y)return;await SH0(this.kubeConfig,this.namespace,$,Y).catch((X)=>console.warn(`[${T6}] release failed for ${$}: ${X instanceof Error?X.message:String(X)}`))}async renewTtl($){let Z=await wD(this.kubeConfig,this.namespace,$);if(!Z)return;let Q=Um4(Z.spec?.lifecycle?.shutdownTime,new Date(Date.now()+this.idleTtlMs));if(!Q)return;await SH0(this.kubeConfig,this.namespace,$,Q).catch((Y)=>console.warn(`[${T6}] TTL renew failed for ${$}: ${Y instanceof Error?Y.message:String(Y)}`))}openForwarder($,Z,Q=$){if(this.forwardPort)return this.forwardPort($,Z,Q);let Y=Zm4(Q,Z);return new Promise((X,J)=>{let G=(W,K)=>{let H=ZT$.createServer((F)=>this.handleForwardedConnection(F,$,Z,Q));H.once("error",(F)=>{if(F.code==="EADDRINUSE"&&K<ac4){try{H.close()}catch{}let U=b51+(W-b51+1)%QT$;G(U,K+1);return}J(F)}),H.listen(W,"127.0.0.1",()=>{let F=H.address();if(!F||typeof F==="string"){H.close(),J(Error("port-forward listener failed to bind"));return}let U=F.port;X({localPort:U,close:()=>H.close((N)=>{if(N)console.warn(`[${T6}] port-forward close on :${U} errored: ${N.message}`)})})})};G(Y,0)})}handleForwardedConnection($,Z,Q,Y){let X=new lc4,J=null,G=!1,W=()=>{if(G)return;if(G=!0,X.destroy(),J)try{J.close()}catch{}if(!$.destroyed)$.destroy()};$.pipe(X),$.on("error",W),$.on("close",W),this.portForward.portForward(this.namespace,Z,[Q],$,null,X).then((K)=>{let H=typeof K==="function"?K():K;if(!H){W();return}if(J=H,J.on("close",W),J.on("error",(F)=>{console.warn(`[${T6}] port-forward to ${Z}:${Q} dropped mid-connection: ${oA$(F)}`,JSON.stringify(x51(F))),this.invalidateRecord(Y),W()}),G)try{J.close()}catch{}}).catch((K)=>{console.warn(`[${T6}] port-forward to ${Z}:${Q} failed: ${oA$(K)}`,JSON.stringify(x51(K))),this.invalidateRecord(Y),W()})}closeForwarder($){$.close()}close(){if(this.closed)return;this.closed=!0,this.claimWatchAbort.abort();for(let $ of this.records.values())this.dropRecord($);this.records.clear()}}function ec4($){return{active:$.createUpDownCounter("studio.sandbox.active",{description:"Active sandbox count, by runner kind, owning org, and daemon impl. Cross-checks the cAdvisor-derived count from the cluster \u2014 divergence between the two indicates orphaned claims (studio deleted but K8s didn't reap) or unattributed pods.",unit:"{sandbox}"}),ensureOutcome:$.createCounter("studio.sandbox.ensure.outcome",{description:"Outcome of each ensure() call: fresh provision, resume from state-store after restart, or adopt of a cluster-side claim studio didn't know about. Cold-start ratio is the primary input for warm-pool sizing.",unit:"{call}"}),proxyDurationMs:$.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of studio-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"}),poolPods:$.createGauge("studio.sandbox.pool.pods",{description:"Tenant warm pool depth by pool and state: ready (warmed and unbound \u2014 what a claim can actually bind instantly), bound (serving a user), pending (unbound, not yet warmed), failed (gave up after repeated bootstrap failures). Alert on sustained ready=0: a pool that is always empty is doing nothing while costing N pods.",unit:"{pod}"})}}function x51($){let Z=[],Q=$;for(let Y=0;Y<5&&Q instanceof Error;Y++){let X=Q;if(Z.push({name:X.name,message:X.message,...X.code!==void 0?{code:X.code}:{},...X.errno!==void 0?{errno:X.errno}:{}}),X.cause===Q)break;Q=X.cause}if(Q!==void 0&&!(Q instanceof Error)&&Q!==null){let Y=Q,X=Y.error instanceof Error?x51(Y.error).chain:void 0;Z.push({nonError:String(Q),...typeof Y.type==="string"?{type:Y.type}:{},...typeof Y.message==="string"?{message:Y.message}:{},...Y.code!==void 0?{code:Y.code}:{},...typeof Y.reason==="string"?{reason:Y.reason}:{},...X?{error:X}:{},...X===void 0&&Y.error!==void 0?{rawError:String(Y.error)}:{},keys:Object.keys(Y)})}return{chain:Z}}function $m4(){let $=new CA0;return $.loadFromDefault(),$}function S51($){return Boolean($.status?.conditions?.some((Z)=>Z.type==="Ready"&&Z.status==="True"))}function C51($,Z){let Q=$.spec?.env;if(!Q)return null;for(let Y of Q)if(Y.name===Z&&Y.value)return Y.value;return null}function Zm4($,Z){let Q=hc4("sha256").update(`${$}:${Z}`).digest();return b51+Q.readUInt32BE(0)%QT$}function eA$($){let Z=$.slice(0,Ym4);return Qm4.test(Z)?Z:""}function Jm4($){if($===void 0)return null;let Z=$.trim();if(Z==="")return null;if(!Xm4.test(Z))throw Error(`AgentSandboxProvider: envName=${JSON.stringify(Z)} is not a valid DNS-label-safe environment name (lowercase alphanumeric or '-', starts with a letter, ends alphanumeric, \u226432 chars). Studio sets this from STUDIO_ENV; check the studio chart's configMap.`);return Z}function _51($,Z={}){let Q={...Z};if($){let Y=eA$($.orgId),X=eA$($.userId);if(Y)Q[fX.orgId]=Y;if(X)Q[fX.userId]=X}return Q}function Kf($){let Z="";for(let Q of $){let Y=Q.codePointAt(0)??0;Z+=Y<32||Y===127?" ":Q}return Z.slice(0,Gm4)}function Wm4($){try{let Z=new URL($);return Z.username="",Z.password="",Z.toString()}catch{return""}}function Km4($){let Z={},Q=$.tenant;if(Q?.orgSlug)Z[AH.orgSlug]=Kf(Q.orgSlug);if(Q?.orgName)Z[AH.orgName]=Kf(Q.orgName);if(Q?.userEmail)Z[AH.userEmail]=Kf(Q.userEmail);if(Q?.userName)Z[AH.userName]=Kf(Q.userName);let Y=$.repo;if(Y){if(Y.displayName)Z[AH.gitRepo]=Kf(Y.displayName);let X=Wm4(Y.cloneUrl);if(X)Z[AH.gitRepoUrl]=Kf(X);let J=$.branch??Y.branch;if(J)Z[AH.gitBranch]=Kf(J)}return Z}function Hm4($){let Z=$.metadata?.labels;if(!Z)return null;let Q=Z[fX.orgId],Y=Z[fX.userId];if(!Q||!Y)return null;let X=$.metadata?.annotations??{};return{orgId:Q,userId:Y,orgSlug:X[AH.orgSlug],orgName:X[AH.orgName],userEmail:X[AH.userEmail],userName:X[AH.userName]}}function Fm4($,Z){if($){let Q=new Date($).getTime();if(Number.isFinite(Q)&&Q<=Z.getTime())return null}return Z.toISOString()}function Um4($,Z){if($){let Q=new Date($).getTime();if(Number.isFinite(Q)&&Q>=Z.getTime())return null}return Z.toISOString()}function v51($){return{org_id:$?.orgId??"",user_id:$?.userId??"",runner_kind:"agent-sandbox"}}async function Nm4($,Z){if(!Z||!$.tenant)return $.orgFsConfigJson;try{return await Z($.tenant)??$.orgFsConfigJson}catch(Q){return console.warn(`[${T6}] org-fs credential re-mint failed: ${Q instanceof Error?Q.message:String(Q)}`),$.orgFsConfigJson}}function $T$($){try{let Z=new URL($.cloneUrl);Z.username="",Z.password="";let{submoduleCredentials:Q,credentialExpiresAt:Y,...X}=$;return{...X,cloneUrl:Z.toString()}}catch{return null}}function Bm4($,Z){let{orgFsConfigJson:Q,repo:Y,extraRepos:X,...J}=$,G=J,W=Y&&$T$(Y);if(W)G.repo=W;if(X)G.extraRepos=X.map($T$).filter((K)=>K!==null);return Q||Z?{ensureOpts:G,orgFsRedacted:!0}:{ensureOpts:G}}function Dm4($){let Z={};if($.branch)Z.branch=$.branch;if($.repo)Z.repo=$.repo;if($.workload)Z.workload=$.workload;if($.env&&Object.keys($.env).length>0)Z.env=$.env;if($.tenant)Z.tenant=$.tenant;if($.cloneOnly)Z.cloneOnly=!0;if($.purpose)Z.purpose=$.purpose;if($.sandboxImage)Z.sandboxImage=$.sandboxImage;if($.orgFsConfigJson)Z.orgFsConfigJson=$.orgFsConfigJson;return Object.keys(Z).length>0?Z:null}function Om4($,Z){try{return new URL(eA0($,Z)).hostname||null}catch{return null}}var T6="AgentSandboxProvider",cc4="agent-sandbox-system",mc4="studio-sandbox",dc4=300000,vU=9000,rA$=3000,JT0="/app",ic4=32,pc4,nc4=900000,tc4=60000,oc4=1800000,GT0=3,sA$=1800000,rc4=900000,sc4=1800000,b51=40000,QT$=1e4,ac4=256,fX,AH,Qm4,Ym4=63,Xm4,Gm4=253;var YT$=D(()=>{a$();nL$();jA$();Gf();ym();CH0();a00();bA$();q10();dA$();YT0();XT0();pc4=new Set(["DAEMON_TOKEN","DAEMON_BOOT_ID","APP_ROOT","PROXY_PORT"]);fX={role:"studio.decocms.com/role",sandboxHandle:"studio.decocms.com/sandbox-handle",orgId:"studio.decocms.com/org-id",userId:"studio.decocms.com/user-id",env:"studio.decocms.com/env"},AH={orgSlug:"studio.decocms.com/org-slug",orgName:"studio.decocms.com/org-name",userEmail:"studio.decocms.com/user-email",userName:"studio.decocms.com/user-name",gitRepo:"studio.decocms.com/git-repo",gitRepoUrl:"studio.decocms.com/git-repo-url",gitBranch:"studio.decocms.com/git-branch"},Qm4=/^([A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?)?$/;Xm4=/^[a-z]([a-z0-9-]{0,30}[a-z0-9])?$/});var XT$={};$6(XT$,{tenantPoolSchema:()=>fA$,tenantPoolRepoSchema:()=>R10,tenantPoolFieldsSchema:()=>q51,tenantPoolAllocations:()=>gm,resolveTenantPoolBinding:()=>M51,renderTenantPoolWarmPools:()=>hA$,normalizeRepoUrl:()=>_U,allocationsMatchingPush:()=>V51,TenantPoolCapacityError:()=>ZT0,PREVIEW_NOT_READY_HEADER:()=>um,AgentSandboxProvider:()=>f51});var M10=D(()=>{YT$();q10()});import{z as Hf}from"zod";function WT0($){if(!$||$.trim()==="")return[];let Z=Hf.array(Lm4).parse(JSON.parse($)),Q=new Set;for(let Y of Z){if(Q.has(Y.name))throw Error(`tenant pools: duplicate pool name ${Y.name}`);Q.add(Y.name)}return Z}function JT$($){let Z=_U(`https://github.com/${$.repo}`);if(!Z)throw Error(`tenant pools: bad repo ${$.repo}`);return Z}function GT$($){return $.map((Z)=>({name:Z.name,tenant:Z.orgId,size:1,image:"default",repos:[{repoUrl:JT$(Z),branch:Z.branch,workload:Z.workload,replicas:1,warmPoolName:Z.name}]}))}function y51($,Z){let Q=_U(Z.repoUrl)?.toLowerCase(),Y=$.find((J)=>J.orgId===Z.tenant&&J.branch===Z.branch&&JT$(J).toLowerCase()===Q);if(!Y)return null;let X=`https://github.com/${Y.repo}.git`;return Y.connectionId?{cloneUrl:X,connectionId:Y.connectionId}:{cloneUrl:X}}function WT$($,Z){return async(Q)=>{let Y=y51($,Q);if(!Y)return null;return Y.connectionId?Z(Y):Y.cloneUrl}}var Lm4;var KT0=D(()=>{M10();Lm4=Hf.object({name:Hf.string().max(63).regex(/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/,"pool name must be a DNS label (lowercase alphanumeric and '-')"),orgId:Hf.string().min(1),repo:Hf.string().regex(/^[^/\s]+\/[^/\s]+$/,"repo must be `owner/name`"),connectionId:Hf.string().min(1).optional(),branch:Hf.string().min(1).default("main"),workload:R10.shape.workload})});function c51($,Z=Date.now()){if($===void 0)return;return $===null?Z+wm4:$.getTime()}function l51($){return JSON.stringify([$.orgId,$.userId])}function KT$($,Z){let Q=_U(Z);return Q?JSON.stringify([$,Q.toLowerCase()]):null}function Em4($,Z){return"repositoryId"in Z?$.repositoryOrgs.get(Z.repositoryId):$.connectionOrgs.get(Z.connectionId)}function HT$($){let{records:Z,now:Q}=$,Y=new Map,X=new Map,J=new Map,G=0;for(let W of $.pools)for(let{repoUrl:K,branch:H}of W.repos){let F=KT$(W.tenant,K),U=y51($.legacyPools??[],{tenant:W.tenant,repoUrl:K,branch:H});if(F&&U){if(U.connectionId)X.set(F,{tenant:W.tenant,repoUrl:K,connectionId:U.connectionId,cloneUrl:U.cloneUrl});continue}let N=F?Z.orgRepositories.get(F):void 0;if(!F||!N){G++;continue}X.set(F,{tenant:W.tenant,repoUrl:K,repositoryId:N})}for(let W of $.sandboxes){let K=W.tenant;if(!K)continue;let H=Z.members.get(l51(K));if(H===void 0){G++;continue}for(let U of W.repos){if(Em4(Z,U)!==K.orgId){G++;continue}let N="repositoryId"in U?{repositoryId:U.repositoryId}:{connectionId:U.connectionId,repo:U.repo.toLowerCase()},B={orgId:K.orgId,userId:K.userId};Y.set(JSON.stringify([B,N]),{tenant:B,repo:N})}let F=W.orgFsConfigExpiresAt;if(W.orgFs&&(F===null||F-Q<jm4))J.set(l51(K),{orgId:K.orgId,userId:K.userId,orgSlug:H})}return{clones:[...Y.values()],poolClones:[...X.values()],orgFs:[...J.values()],refused:G}}async function FT$($,Z,Q){let Y=new Set,X=new Set,J=new Set,G=new Set,W=new Set(Q.map((O)=>O.tenant)),K=new Set;for(let O of Q)for(let{repoUrl:L}of O.repos){let w=IY(L);if(w)K.add(w.path.toLowerCase())}for(let O of Z){if(O.tenant)Y.add(O.tenant.orgId),X.add(O.tenant.userId);for(let L of O.repos)if("repositoryId"in L)G.add(L.repositoryId);else J.add(L.connectionId)}let[H,F,U,N]=await Promise.all([Y.size===0?[]:$.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.organizationId as orgId","member.userId as userId","organization.slug as slug"]).where("member.organizationId","in",[...Y]).where("member.userId","in",[...X]).execute(),J.size===0?[]:$.selectFrom("connections").select(["id","organization_id"]).where("id","in",[...J]).execute(),G.size===0?[]:$.selectFrom("repositories").select(["id","organization_id"]).where("id","in",[...G]).execute(),K.size===0?[]:$.selectFrom("repositories").select(["id","organization_id","provider","host","path"]).where("organization_id","in",[...W]).where((O)=>O(O.fn("lower",["path"]),"in",[...K])).execute()]),B=new Map;for(let O of N){let L=KT$(O.organization_id,be({provider:O.provider,host:O.host,path:O.path}));if(L&&!B.has(L))B.set(L,O.id)}return{members:new Map(H.map((O)=>[l51(O),O.slug])),connectionOrgs:new Map(F.map((O)=>[O.id,O.organization_id])),repositoryOrgs:new Map(U.map((O)=>[O.id,O.organization_id])),orgRepositories:B}}function u51($){return $ instanceof Error?$.message:String($)}async function UT$($,Z,Q){let Y=0;if($.clones.length>cm||$.poolClones.length>cm||$.orgFs.length>h51)console.warn(`[sandbox-credential-push] ${$.clones.length} clone, ${$.poolClones.length} pool clone and ${$.orgFs.length} org-fs mints planned; minting the first ${cm}, ${cm} and ${h51}`);let X=await F9($.clones.slice(0,cm),g51,async(U)=>{let N="repositoryId"in U.repo?{cloneUrl:"",repositoryId:U.repo.repositoryId}:{cloneUrl:`https://github.com/${U.repo.repo}.git`,connectionId:U.repo.connectionId};try{let B=await Z.mintCloneUrl(N,{bufferMs:HT0});return B?{tenant:U.tenant,repo:U.repo,cloneUrl:B,expiresAt:Q.now+HT0}:null}catch(B){return Y++,console.warn(`[sandbox-credential-push] clone mint failed: ${u51(B)}`),null}}),J=await F9($.poolClones.slice(0,cm),g51,async(U)=>{try{let N=await Z.mintCloneUrl("repositoryId"in U?{cloneUrl:"",repositoryId:U.repositoryId}:{cloneUrl:U.cloneUrl,connectionId:U.connectionId},{bufferMs:HT0});return N?{tenant:U.tenant,repoUrl:U.repoUrl,cloneUrl:N,expiresAt:Q.now+HT0}:null}catch(N){return Y++,console.warn(`[sandbox-credential-push] pool clone mint failed: ${u51(N)}`),null}}),G=await F9($.orgFs.slice(0,h51),g51,async(U)=>{try{let N=await Z.mintOrgFsConfig(U);return N?{tenant:{orgId:U.orgId,userId:U.userId},orgFsConfigJson:N,expiresAt:Q.now+Q.orgFsLifetimeMs}:null}catch(N){return Y++,console.warn(`[sandbox-credential-push] org-fs mint failed: ${u51(N)}`),null}}),W=X.filter((U)=>U!==null),K=J.filter((U)=>U!==null),H=G.filter((U)=>U!==null),F=[];for(let U=0;U<Math.max(W.length,K.length,H.length);U+=fj)F.push({cloneUrls:W.slice(U,U+fj),poolCloneUrls:K.slice(U,U+fj),orgFsConfigs:H.slice(U,U+fj)});return{batches:F,failed:Y}}var HT0=2700000,FT0,wm4=86400000,jm4=86400000,g51=8,cm=2000,h51=200;var UT0=D(()=>{P41();M10();i4();a$();OD();KT0();FT0=WL$-3600000});var yX;var I10=D(()=>{yX=class yX extends Error{code;status;path;constructor($,Z,Q){super(Z.message||`Freestyle API error: ${Z.code}`);this.name="FreestyleApiError",this.code=Z.code,this.status=$,this.path=Q,Object.setPrototypeOf(this,yX.prototype)}}});function NT$(){return typeof process<"u"&&Boolean(process.versions?.node)}var NT0=($,Z)=>globalThis.fetch($,Z);async function zm4(){if(!NT$())return null;try{return await import("undici")}catch{return null}}async function Am4(){let $=await zm4();if(!$)return null;let Z=new $.Agent({allowH2:!0,connections:Pm4});return(Q,Y)=>$.fetch(Q,{...Y,dispatcher:Z})}function Tm4($){return(typeof $==="string"?$:$ instanceof URL?$.href:$.url).startsWith("https:")}function BT$(){let $,Z=()=>{return $??=Am4().then((Q)=>Q??NT0).catch(()=>NT0),$};return(Q,Y)=>Tm4(Q)?Z().then((X)=>X(Q,Y)):NT0(Q,Y)}var Pm4=4;var DT$=()=>{};function km4($){return new Promise((Z)=>setTimeout(Z,$))}function Sm4($){if(!$)return"";let Z=new URLSearchParams;for(let[Y,X]of Object.entries($)){if(X===void 0||X===null)continue;Z.set(Y,String(X))}let Q=Z.toString();return Q?`?${Q}`:""}function u6($){return encodeURIComponent($)}class m51{baseUrl;authenticationHeaders;fetchImpl;backgroundEligible;constructor($={}){if(this.baseUrl=($.baseUrl??Vm4).replace(/\/+$/,""),!$.fetch&&!globalThis.fetch)throw Error("No fetch implementation available. Pass `fetch` in FreestyleOptions when running on a runtime without a global fetch.");if(this.fetchImpl=$.fetch??BT$(),"identityAccessToken"in $&&$.identityAccessToken){this.authenticationHeaders={[Rm4]:$.identityAccessToken},this.backgroundEligible=!1;return}if(this.backgroundEligible=!0,"stackAccessToken"in $&&$.stackAccessToken){this.authenticationHeaders={Authorization:`Bearer ${$.stackAccessToken}`,"X-Freestyle-Team-Id":$.teamId};return}let Z=$.apiKey??globalThis.process?.env?.FREESTYLE_API_KEY;if(!Z)throw Error("No Freestyle API key provided. Pass `apiKey` in FreestyleOptions or set FREESTYLE_API_KEY.");this.authenticationHeaders={Authorization:`Bearer ${Z}`}}authHeaders(){return{...this.authenticationHeaders}}url($,Z){return`${this.baseUrl}${$}${Sm4(Z)}`}async fetch($,Z={}){let Q=new Headers(Z.headers);for(let[Y,X]of Object.entries(this.authHeaders()))if(!Q.has(Y))Q.set(Y,X);return this.fetchImpl(this.absoluteUrl($),{...Z,headers:Q})}absoluteUrl($){return/^https?:\/\//i.test($)?$:`${this.baseUrl}${$}`}async request($,Z,{query:Q,body:Y,rawBody:X,signal:J}={}){let G={...this.authHeaders()};if(this.backgroundEligible)G[OT$]=String(Mm4);let W;if(X!==void 0)G["Content-Type"]="application/octet-stream",W=X;else if(Y!==void 0)G["Content-Type"]="application/json",W=JSON.stringify(Y);let K=this.url(Z,Q),H=await this.fetchImpl(K,{method:$,headers:G,body:W,signal:J});if(this.backgroundEligible&&H.status===202)try{return await this.pollBackgroundRequest(H,Z)}catch(F){if($==="GET"&&F instanceof yX&&F.code==="BACKGROUND_RESULT_UNSTORABLE"){delete G[OT$];let U=await this.fetchImpl(K,{method:$,headers:G,body:W});return this.finalize(U,Z)}throw F}return this.finalize(H,Z)}async pollBackgroundRequest($,Z){let Q=await $.json().catch(()=>({})),Y=$.headers.get(qm4)??Q.requestId,X=Q.resultUrl??(Y?`/v5/background-requests/${u6(Y)}`:void 0);if(!X)throw new yX($.status,{code:"BACKGROUND_PROTOCOL_ERROR",message:"202 Accepted carried no background request id"},Z);let J=0;for(;;){await km4(Im4);let G;try{G=await this.fetch(X,{method:"GET"}),J=0}catch(W){if(++J>=5)throw W;continue}if(G.status===202)continue;return this.finalize(G,Z)}}async finalize($,Z){if(!$.ok){let Y;try{Y=await $.json()}catch{Y={code:"UNKNOWN_ERROR",message:await $.text().catch(()=>$.statusText)}}throw new yX($.status,Y,Z)}if($.status===204)return;let Q=await $.text();if(!Q)return;return JSON.parse(Q)}get($,Z){return this.request("GET",$,{query:Z})}post($,Z){return this.request("POST",$,{body:Z??{}})}patch($,Z){return this.request("PATCH",$,{body:Z??{}})}put($,Z){return this.request("PUT",$,{body:Z??{}})}putEmpty($){return this.request("PUT",$,{})}putBytes($,Z,Q,Y){return this.request("PUT",$,{query:Q,rawBody:Z,signal:Y})}async getBytes($,Z,Q={}){let Y={...this.authHeaders()};if(Q.range)Y.Range=Q.range;let X=await this.fetchImpl(this.url($,Z),{method:"GET",headers:Y,signal:Q.signal});if(!X.ok){let J;try{J=await X.json()}catch{J={code:"UNKNOWN_ERROR",message:await X.text().catch(()=>X.statusText)}}throw new yX(X.status,J,$)}return X}delete($,Z){return this.request("DELETE",$,{query:Z})}}var Rm4="x-freestyle-identity-access-token",OT$="x-freestyle-background-after-secs",qm4="x-freestyle-background-request-id",Mm4=5,Im4=2000,Vm4="https://api.freestyle.sh";var fW=D(()=>{I10();DT$()});class d51{client;verifications;certificates;placeholder;constructor($){this.client=$,this.verifications=new LT$($),this.certificates=new wT$($),this.placeholder=new jT$($)}async list(){let{domains:$}=await this.client.get("/v5/domains");return $}}class LT${client;constructor($){this.client=$}create($){return this.client.post("/v5/verifications",{domain:$})}async list($={}){let{verifications:Z}=await this.client.get("/v5/verifications",$);return Z}get($){return this.client.get(`/v5/verifications/${u6($)}`)}complete($){return this.client.putEmpty(`/v5/verifications/${u6($)}`)}delete($){return this.client.delete(`/v5/verifications/${u6($)}`)}}class wT${client;constructor($){this.client=$}async list(){let{certificates:$}=await this.client.get("/v5/certificates");return $}createWildcard($){return this.client.post("/v5/certificates/wildcard",{domain:$})}}class jT${client;constructor($){this.client=$}async get(){try{return await this.client.get("/v5/domains/placeholder")}catch($){if($ instanceof yX&&$.status===404)return null;throw $}}set($){return this.client.put("/v5/domains/placeholder",$)}delete(){return this.client.delete("/v5/domains/placeholder")}}var i51=D(()=>{fW();I10()});function a6($,Z){throw new n51($,Z)}function p51($){return Cm4.some((Z)=>$[Z]!==void 0)}function t51($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function vm4($,Z){let Q=Z.lastIndexOf("/");if(Q<0)a6($,`${$} \`${Z}\` is not a CIDR: expected address/prefix, e.g. 203.0.113.0/24 or 2001:db8::/32`);let Y=Z.slice(0,Q),X=Z.slice(Q+1);if(!/^\d+$/.test(X))a6($,`${$} \`${Z}\`: prefix length must be a number`);let J=Number(X),G=Y.includes(":"),W=G?128:32;if(J>W)a6($,`${$} \`${Z}\`: prefix length must be 0\u2013${W}`);if(!G&&!/^\d{1,3}(\.\d{1,3}){3}$/.test(Y))a6($,`${$} \`${Z}\`: \`${Y}\` is not an IP address`)}function AT$($,Z){if(!t51($))a6(Z,`${Z} must be an object`);for(let Y of Object.keys($))if(!ET$.includes(Y))a6(`${Z}.${Y}`,`${Z} has unknown field \`${Y}\`. Expected one of: ${ET$.join(", ")}`);let Q=$;for(let Y of["vmId","vpcId","tunnelId","cidr"]){let X=Q[Y];if(X!==void 0&&(typeof X!=="string"||X.length===0))a6(`${Z}.${Y}`,`${Z}.${Y} must be a non-empty string`)}if(Q.public!==void 0&&Q.public!==!0)a6(`${Z}.public`,`${Z}.public must be true when present: it declares the public Internet. Omit the field to match something else`);if(Q.public===!0){if(Q.vmId!==void 0)a6(`${Z}.public`,`${Z} cannot combine \`public: true\` with \`vmId\`: that would mean the VM only when reached over its public address, a distinction this API does not make yet. Use \`vmId\` alone to match the VM on any path, or \`public: true\` alone to match public addresses`);if(Q.vpcId!==void 0)a6(`${Z}.public`,`${Z} cannot combine \`public: true\` with \`vpcId\`: that would mean the network's members only when reached over their public addresses, a distinction this API does not make yet. Use \`vpcId\` alone or \`public: true\` alone`);if(Q.tunnelId!==void 0)a6(`${Z}.public`,`${Z} cannot combine \`public: true\` with \`tunnelId\`: traffic through a tunnel arrives over the tunnel, not over the public Internet. Use \`tunnelId\` alone`)}if(Q.cidr!==void 0)vm4(`${Z}.cidr`,Q.cidr);if(Q.protocol!==void 0&&!zT$.includes(Q.protocol))a6(`${Z}.protocol`,`${Z}.protocol must be one of: ${zT$.join(", ")} (got \`${String(Q.protocol)}\`)`);if(Q.port!==void 0){if(!Number.isInteger(Q.port)||Q.port<1||Q.port>65535)a6(`${Z}.port`,`${Z}.port must be an integer between 1 and 65535`);if(Q.protocol===void 0)a6(`${Z}.protocol`,`${Z}.port ${Q.port} requires ${Z}.protocol: set it to "tcp" or "udp" so the rule opens one transport rather than both`);if(!_m4.includes(Q.protocol))a6(`${Z}.port`,`${Z}.protocol "${Q.protocol}" has no ports; remove ${Z}.port ${Q.port}`)}}function qT$($,Z){if(!t51($))a6(Z||"rule",`${Z||"rule"} must be an object`);for(let Y of Object.keys($))if(!TT$.includes(Y))a6(`${Z}${Y}`,`Unknown field \`${Y}\`. Expected one of: ${TT$.join(", ")}`);let Q=$;if(Q.action===void 0)a6(`${Z}action`,`${Z}action is required. Write \`action: "allow"\` \u2014 every rule states what it does rather than defaulting to it`);if(Q.action!=="allow")a6(`${Z}action`,`${Z}action must be "allow" (got \`${String(Q.action)}\`). Only allow rules exist today`);if(Q.description!==void 0){if(typeof Q.description!=="string")a6(`${Z}description`,"description must be a string");if(Q.description.length>PT$)a6(`${Z}description`,`description is too long (${Q.description.length} characters, maximum ${PT$})`)}if(Q.source===void 0)a6(`${Z}source`,`${Z}source is required`);if(Q.destination===void 0)a6(`${Z}destination`,`${Z}destination is required`);return AT$(Q.source,`${Z}source`),AT$(Q.destination,`${Z}destination`),Q}function bm4($){let Z=qT$($,"");for(let Q of["source","destination"]){let Y=Z[Q];if(p51(Y))continue;let X=[Y.port!==void 0?`port ${Y.port}`:void 0,Y.protocol!==void 0?`protocol ${Y.protocol}`:void 0].filter(Boolean).join(", ");a6(Q,X?`${Q} only narrows traffic (${X}) without saying what it is. Add \`vmId\`, \`vpcId\`, \`tunnelId\`, \`cidr\`, or \`public: true\`. Leaving it out to mean "this VM" only works inside vms.create`:`${Q} is empty. A matcher must say what the traffic is: \`vmId\`, \`vpcId\`, \`tunnelId\`, \`cidr\`, or \`public: true\` for the public Internet`)}return Z}function BT0($,Z="VM"){if($===void 0||$===null)a6("firewall",`firewall is required on a ${Z} create. A ${Z} gets nothing implicitly, so state what it may reach \u2014 \`{ rules: [] }\` if the answer is nothing`);if(!t51($))a6("firewall","firewall must be an object with a `rules` array");for(let Y of Object.keys($))if(Y!=="rules")a6(`firewall.${Y}`,`firewall has unknown field \`${Y}\`. Expected: rules`);let Q=$.rules;if(!Array.isArray(Q))a6("firewall.rules","firewall.rules must be an array");return Q.forEach((Y,X)=>{let J=`firewall.rules[${X}].`,G=qT$(Y,J),W=p51(G.source),K=p51(G.destination);if(!W&&!K&&Z!=="network")a6(`firewall.rules[${X}]`,`firewall.rules[${X}]: both source and destination refer to the ${Z} being created, which allows nothing. Give one of them a \`vmId\`, \`vpcId\`, \`tunnelId\`, \`cidr\`, or \`public: true\``);if(W&&K)a6(`firewall.rules[${X}]`,`firewall.rules[${X}]: neither end refers to the ${Z} being created. Leave one endpoint's identity unset so it means this ${Z}, or create the rule with firewall.rules.create instead`)}),$}function RT$($){return`/v5/firewall/rules/${u6($)}`}class MT${client;constructor($){this.client=$}async create($){let Z=bm4($);return this.client.post("/v5/firewall/rules",Z)}list($={}){return this.client.get("/v5/firewall/rules",$)}get($){return this.client.get(RT$($))}delete($){return this.client.delete(RT$($))}}class o51{client;rules;constructor($){this.client=$,this.rules=new MT$($)}evaluate($){return this.client.post("/v5/firewall/evaluate",$)}}var n51,ET$,Cm4,zT$,_m4,PT$=1024,TT$;var V10=D(()=>{fW();n51=class n51 extends Error{path;constructor($,Z){super(Z);this.name="FirewallRuleValidationError",this.path=$,Object.setPrototypeOf(this,n51.prototype)}};ET$=["vmId","vpcId","tunnelId","cidr","public","port","protocol"],Cm4=["vmId","vpcId","tunnelId","cidr","public"],zT$=["tcp","udp","icmp"],_m4=["tcp","udp"];TT$=["action","source","destination","description"]});function r51($){return`/v5/identities/${u6($)}`}class IT${client;basePath;constructor($,Z){this.client=$,this.basePath=Z}create(){return this.client.post(`${this.basePath}/tokens`)}list(){return this.client.get(`${this.basePath}/tokens`)}revoke($){return this.client.delete(`${this.basePath}/tokens/${u6($)}`)}}class VT${client;basePath;constructor($,Z){this.client=$,this.basePath=Z}list(){return this.client.get(`${this.basePath}/permissions/vm`)}grant($){return this.client.post(`${this.basePath}/permissions/vm`,$)}get($){return this.client.get(`${this.basePath}/permissions/vm/${u6($)}`)}update($,Z){return this.client.patch(`${this.basePath}/permissions/vm/${u6($)}`,{allowedLinuxUsers:Z})}revoke($){return this.client.delete(`${this.basePath}/permissions/vm/${u6($)}`)}}class s51{id;tokens;permissions;client;basePath;constructor($,Z){this.client=$,this.id=Z,this.basePath=r51(Z),this.tokens=new IT$($,this.basePath),this.permissions={vm:new VT$($,this.basePath)}}data(){return this.client.get(this.basePath)}delete(){return this.client.delete(this.basePath)}}class a51{client;constructor($){this.client=$}async create($={}){let Z=await this.client.post("/v5/identities",$);return{identity:new s51(this.client,Z.id),identityId:Z.id,data:Z}}list($={}){return this.client.get("/v5/identities",$)}get($){return this.client.get(r51($))}ref($){return new s51(this.client,$)}delete($){return this.client.delete(r51($))}}var e51=D(()=>{fW()});function v1($,Z){throw new Y91($,Z)}function X7($,Z){throw new X91($,Z)}function k10($){return xm4.some((Z)=>$[Z]!==void 0)}function mm4($){return!k10($)&&$.port===void 0}function fY($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function cT$($,Z,Q){if(typeof $!=="string"||!hm4.test($))X7(Z,`${Z} must be a valid HTTP header name`);let Y=$.toLowerCase();if(cm4.has(Y)||Y.startsWith("x-forwarded-")||Y.startsWith("x-freestyle-")||Q&&(Y==="cookie"||Y==="set-cookie"))X7(Z,`${Z} may not use reserved header \`${$}\``)}function dm4($,Z){if(!Array.isArray($))X7(Z,`${Z} must be an array of header names`);if($.length>xT$)X7(Z,`${Z} may contain at most ${xT$} names`);let Q=new Set;$.forEach((Y,X)=>{cT$(Y,`${Z}[${X}]`,!0);let J=Y.toLowerCase();if(Q.has(J))X7(`${Z}[${X}]`,`${Z} contains duplicate header \`${Y}\``);Q.add(J)})}function yT$($){if(!fY($))X7("forwardAuth","forwardAuth must be an object");for(let Y of Object.keys($))if(!CT$.includes(Y))X7(Y,`Unknown field \`${Y}\`. Expected one of: ${CT$.join(", ")}`);let Z=$;if(typeof Z.url!=="string"||Z.url.length===0||Z.url.length>um4)X7("url","url is required and must be an absolute HTTPS URL");let Q;try{Q=new URL(Z.url)}catch{X7("url","url must be an absolute HTTPS URL")}if(Q.protocol!=="https:"||Q.hostname.length===0||Q.username.length>0||Q.password.length>0||Q.hash.length>0||Q.port==="0")X7("url","url must be an absolute HTTPS URL");if(Z.headers!==void 0){if(!fY(Z.headers))X7("headers","headers must be an object of header name to value");let Y=Object.entries(Z.headers);if(Y.length>vT$)X7("headers",`headers may contain at most ${vT$} entries`);let X=0,J=new Set;for(let[G,W]of Y){cT$(G,`headers.${G}`,!1);let K=G.toLowerCase();if(J.has(K))X7(`headers.${G}`,`headers contains duplicate header \`${G}\``);if(J.add(K),typeof W!=="string"||/[\0\r\n]/.test(W))X7(`headers.${G}`,`headers.${G} must be a string`);X+=G.length+W.length}if(X>bT$)X7("headers",`headers may contain at most ${bT$} bytes`)}if(Z.timeoutMs!==void 0&&(!Number.isInteger(Z.timeoutMs)||Z.timeoutMs<100||Z.timeoutMs>5000))X7("timeoutMs","timeoutMs must be an integer between 100 and 5000");if(Z.protectedCookies!==void 0){if(!Array.isArray(Z.protectedCookies))X7("protectedCookies","protectedCookies must be an array of cookie names");if(Z.protectedCookies.length>fT$)X7("protectedCookies",`protectedCookies may contain at most ${fT$} names`);let Y=new Set;Z.protectedCookies.forEach((X,J)=>{if(typeof X!=="string"||X.length>lm4||!gm4.test(X))X7(`protectedCookies[${J}]`,`protectedCookies[${J}] must be a valid HTTP cookie name`);if(Y.has(X))X7(`protectedCookies[${J}]`,`protectedCookies contains duplicate cookie \`${X}\``);Y.add(X)})}if(Z.authResponseHeaders!==void 0)dm4(Z.authResponseHeaders,"authResponseHeaders");return Z}function im4($,Z){if(!fY($))v1(Z,`${Z} must be an object with an \`id\``);for(let Y of Object.keys($))if(!_T$.includes(Y))v1(`${Z}.${Y}`,`${Z} has unknown field \`${Y}\`. Expected: ${_T$.join(", ")}`);let Q=$.id;if(typeof Q!=="string"||Q.length===0)v1(`${Z}.id`,`${Z}.id is required and must be a non-empty string`)}function Q91($){if(typeof $!=="string")v1("domain","domain is required and must be a string");if($==="*")return;let Z=$.startsWith("*.")?$.slice(2):$;if(Z.length===0||Z.length>fm4)v1("domain",`domain \`${$}\` is not a hostname`);let Q=Z.split(".");if(Q.length<2)v1("domain",`domain \`${$}\` must have at least two labels, e.g. acme.com`);for(let Y of Q){if(Y.length===0||Y.length>ym4)v1("domain",`domain \`${$}\` has an empty or over-long label`);if(!/^[a-z0-9-]+$/.test(Y))v1("domain",`domain \`${$}\`: labels are lowercase letters, digits, and hyphens (a \`*.\` prefix is the only wildcard)`);if(Y.startsWith("-")||Y.endsWith("-"))v1("domain",`domain \`${$}\`: a label cannot start or end with a hyphen`)}}function pm4($){if(typeof $!=="string")v1("domain","domain is required and must be a string");let Z=$.lastIndexOf("@");if(Z===-1){Q91($);return}let Q=$.slice(0,Z),Y=$.slice(Z+1);if(Q.length===0||Q.length>64)v1("domain",`mail route \`${$}\`: the part before \`@\` must be 1-64 characters`);if(Q.startsWith(".")||Q.endsWith(".")||Q.includes(".."))v1("domain",`mail route \`${$}\`: the part before \`@\` cannot start or end with a dot, or contain \`..\``);for(let X of Q)if(!/[a-zA-Z0-9]/.test(X)&&!gT$.includes(X))v1("domain",`mail route \`${$}\`: the part before \`@\` may use letters, digits, dots, and \`${gT$.slice(0,-1)}\` (quoted mailboxes are not supported)`);if(Y==="*")v1("domain",`mail route \`${$}\`: \`*\` is not a mail domain \u2014 name the domain the mailbox lives at`);Q91(Y)}function hT$($,Z){if(!fY($))v1(Z,`${Z} must be an object`);for(let Y of Object.keys($))if(!kT$.includes(Y))v1(`${Z}.${Y}`,`${Z} has unknown field \`${Y}\`. Expected one of: ${kT$.join(", ")}`);let Q=$;for(let Y of["vmId","vpcId","host"]){let X=Q[Y];if(X!==void 0&&(typeof X!=="string"||X.length===0))v1(`${Z}.${Y}`,`${Z}.${Y} must be a non-empty string`)}if(Q.public!==void 0&&Q.public!==!0)v1(`${Z}.public`,`${Z}.public must be true when present. Omit the field to match something else`);if(Z==="source"){if(Q.host!==void 0)v1("source.host","source.host is not allowed: a source is who opens the session, not where it lands. Put `host` on the destination");if(Q.port!==void 0)v1("source.port","source.port is not allowed: a source is who opens the session, not where it lands. Put `port` on the destination");if(Q.public===!0&&(Q.vmId!==void 0||Q.vpcId!==void 0))v1("source.public","source cannot combine `public: true` with `vmId` or `vpcId`: use one alone. `public` is every client on the Internet; `vmId`/`vpcId` is a specific dialer")}else{if(Q.vpcId!==void 0)v1("destination.vpcId","destination.vpcId is not allowed: a session lands in one place, not on a whole network. Name a `vmId`, a `host`, or `public: true` for the domain's own origin. A whole network may be a source");if([Q.vmId!==void 0,Q.host!==void 0,Q.public===!0].filter(Boolean).length>1)v1("destination","destination names more than one landing: give exactly one of `vmId`, `host`, or `public: true`");if((Q.vmId!==void 0||Q.host!==void 0)&&Q.port===void 0)v1("destination.port",`destination.port is required with ${Q.vmId!==void 0?"`vmId`":"`host`"}: say which port the session lands on`)}if(Q.port!==void 0){if(!Number.isInteger(Q.port)||Q.port<1||Q.port>65535)v1(`${Z}.port`,`${Z}.port must be an integer between 1 and 65535`)}}function nm4($){if("postgres"in $)return"postgres";if("smtp"in $)return"smtp";if("socks5"in $)return"socks5";return"http"}function tm4($,Z){function Q(W,K,H){if(!fY(W)||Object.keys(W).some((F)=>!K.includes(F)))v1(H,`${H} must contain only ${K.join(", ")}`)}if(Q($,["region","credentials","scope"],Z),typeof $.region!=="string"||!/^[a-z0-9-]{1,63}$/.test($.region))v1(`${Z}.region`,"invalid s3.region");Q($.credentials,["accessKeyId","secretAccessKey","sessionToken"],`${Z}.credentials`);for(let W of["accessKeyId","secretAccessKey","sessionToken"]){let K=$.credentials[W];if(W==="sessionToken"&&K===void 0)continue;if(typeof K!=="string"||!/^[\x21-\x7e]{1,16384}$/.test(K))v1(`${Z}.credentials.${W}`,"invalid s3 credentials")}if(!/^[a-zA-Z0-9]+$/.test($.credentials.accessKeyId))v1(`${Z}.credentials.accessKeyId`,"invalid s3 access key id");Q($.scope,["bucket","prefix","operations"],`${Z}.scope`);let{bucket:Y,prefix:X,operations:J}=$.scope;if(typeof Y!=="string"||!/^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/.test(Y)||Y.includes(".."))v1(`${Z}.scope.bucket`,"invalid s3.scope.bucket");if(typeof X!=="string"||Buffer.byteLength(X,"utf8")>1024||/[\x00-\x1f\x7f-\x9f]/u.test(X))v1(`${Z}.scope.prefix`,"invalid s3.scope.prefix");let G=["GetObject","HeadObject","PutObject","DeleteObject","ListObjectsV2","CreateMultipartUpload","UploadPart","ListParts","CompleteMultipartUpload","AbortMultipartUpload","ListMultipartUploads"];if(!Array.isArray(J)||J.length===0||J.length>G.length||J.some((W)=>!G.includes(W))||new Set(J).size!==J.length)v1(`${Z}.scope.operations`,"s3.scope.operations must be a nonempty list of distinct supported operations")}function om4($,Z){if(!fY($))v1(Z,`${Z} must be an object: \`{ headers: { \u2026 } }\`, \`{ postgres: { \u2026 } }\`, \`{ smtp: { \u2026 } }\` or \`{ socks5: { \u2026 } }\``);let Q=Object.keys($);if(Q.length!==1||!["headers","jsonPatch","postgres","smtp","socks5","s3"].includes(Q[0]??""))v1(Z,`${Z} must have exactly one of \`headers\`, \`jsonPatch\`, \`postgres\`, \`smtp\`, \`socks5\` or \`s3\` (got: ${Q.length===0?"nothing":Q.join(", ")})`);if(Q[0]==="s3"){tm4($.s3,`${Z}.s3`);return}if(Q[0]==="jsonPatch"){let Y=$.jsonPatch;if(!Array.isArray(Y)||Y.length>128)v1(Z,`${Z}.jsonPatch must be an array of at most 128 operations`);let X=(W)=>typeof W==="string"&&(W===""||W.startsWith("/"))&&!/~(?:[^01]|$)/u.test(W),J=(W,K=new Set,H=0)=>{if(H>64)return!1;if(W===null||typeof W==="string"||typeof W==="boolean")return!0;if(typeof W==="number")return Number.isFinite(W);if(typeof W!=="object"||K.has(W))return!1;K.add(W);let F=(Array.isArray(W)?Array.from(W):fY(W)?Object.values(W):[void 0]).every((U)=>J(U,K,H+1));return K.delete(W),F};for(let[W,K]of Y.entries()){if(!fY(K)||!["add","remove","replace","move","copy","test"].includes(String(K.op))||!X(K.path))v1(Z,`${Z}.jsonPatch[${W}] requires a standard op and valid JSON Pointer path`);if(["move","copy"].includes(K.op)&&!X(K.from))v1(Z,`${Z}.jsonPatch[${W}].from must be a JSON Pointer`);if(["add","replace","test"].includes(K.op)&&(!Object.hasOwn(K,"value")||!J(K.value)))v1(Z,`${Z}.jsonPatch[${W}].value must be a JSON value (null is allowed)`)}let G;try{G=JSON.stringify(Y)}catch{v1(Z,"jsonPatch must be JSON serializable")}if(Buffer.byteLength(G,"utf8")>65536)v1(Z,"jsonPatch exceeds 64 KiB");return}if(Q[0]==="socks5"){let Y=$.socks5;if(!fY(Y))v1(`${Z}.socks5`,`${Z}.socks5 must be an object with \`username\` and \`password\``);for(let X of Object.keys(Y))if(!["username","password"].includes(X))v1(`${Z}.socks5.${X}`,`${Z}.socks5 has unknown field \`${X}\`. Expected: username, password`);for(let X of["username","password"])if(typeof Y[X]!=="string"||Y[X].length===0)v1(`${Z}.socks5.${X}`,`${Z}.socks5.${X} is required and must be a non-empty string`);return}if(Q[0]==="smtp"){let Y=$.smtp;if(!fY(Y))v1(`${Z}.smtp`,`${Z}.smtp must be an object with \`username\` and \`password\``);for(let X of Object.keys(Y))if(!["username","password"].includes(X))v1(`${Z}.smtp.${X}`,`${Z}.smtp has unknown field \`${X}\`. Expected: username, password`);for(let X of["username","password"])if(typeof Y[X]!=="string"||Y[X].length===0)v1(`${Z}.smtp.${X}`,`${Z}.smtp.${X} is required and must be a non-empty string`);return}if(Q[0]==="headers"){let Y=$.headers;if(!fY(Y))v1(`${Z}.headers`,`${Z}.headers must be an object of header name to value`);for(let[X,J]of Object.entries(Y))if(typeof J!=="string")v1(`${Z}.headers.${X}`,`${Z}.headers.${X} must be a string`)}else{let Y=$.postgres;if(!fY(Y))v1(`${Z}.postgres`,`${Z}.postgres must be an object with \`username\` and \`password\``);for(let J of Object.keys(Y))if(!["username","password","database"].includes(J))v1(`${Z}.postgres.${J}`,`${Z}.postgres has unknown field \`${J}\`. Expected: username, password, database`);let X=Y;for(let J of["username","password"])if(typeof X[J]!=="string"||X[J].length===0)v1(`${Z}.postgres.${J}`,`${Z}.postgres.${J} is required and must be a non-empty string`);if(X.database!==void 0&&typeof X.database!=="string")v1(`${Z}.postgres.database`,`${Z}.postgres.database must be a string`)}}function rm4($,Z){let Q=$;return Z.forEach((Y,X)=>{let J=nm4(Y);if(Q===void 0)Q=J;else if(Q!==J)v1(`transform[${X}]`,`transform requires protocol \`${J}\` but the rule is \`${Q}\`; a rule terminates one protocol`)}),Q??"http"}function sm4($,Z){if(!fY($)||Object.keys($).some((Q)=>Q!=="method"&&Q!=="path"))v1(Z,`${Z} must be an object containing only method and path`);if($.method!==void 0&&(!Array.isArray($.method)||$.method.some((Q)=>typeof Q!=="string"||Q.length===0||/[^!#$%&'*+.^_`|~0-9A-Za-z-]/.test(Q))))v1(`${Z}.method`,`${Z}.method must be an array of HTTP method tokens`);if($.path!==void 0){let Q=$.path;if(!fY(Q)||Object.keys(Q).length!==1||typeof Q.exact!=="string"||!Q.exact.startsWith("/")||/[\s?#]/.test(Q.exact))v1(`${Z}.path`,`${Z}.path must contain exact: an absolute path without a query or fragment`)}}function mT$($,Z){if(!fY($))v1(Z||"rule",`${Z||"rule"} must be an object`);for(let H of Object.keys($))if(!uT$.includes(H))v1(`${Z}${H}`,`Unknown field \`${H}\`. Expected one of: ${uT$.join(", ")}`);let Q=$;if(Q.action===void 0)v1(`${Z}action`,`${Z}action is required. Write \`action: "allow"\` \u2014 every rule states what it does rather than defaulting to it`);if(Q.action!=="allow")v1(`${Z}action`,`${Z}action must be "allow" (got \`${String(Q.action)}\`). Only allow rules exist today`);if(Q.protocol!==void 0&&!ST$.includes(Q.protocol))v1(`${Z}protocol`,`${Z}protocol must be one of: ${ST$.join(", ")} (got \`${String(Q.protocol)}\`)`);let Y=Q.source??{},X=Q.destination??{};hT$(Y,"source"),hT$(X,"destination");let J=Q.transform??[];if(!Array.isArray(J))v1(`${Z}transform`,`${Z}transform must be an array`);J.forEach((H,F)=>om4(H,`${Z}transform[${F}]`));let G=rm4(Q.protocol,J);if(Q.match!==void 0){if(sm4(Q.match,`${Z}match`),G!=="http"||Y.public===!0||!(X.public===!0||X.host!==void 0))v1(`${Z}match`,"match requires HTTP egress from a VM or VPC to a public origin or host")}if(J.some((H)=>("s3"in H))){if(J.length!==1||Q.match!==void 0||Y.public===!0||!(X.public===!0||X.host!==void 0)||Q.domain.includes("*"))v1(`${Z}transform`,"s3 requires a sole transform on HTTP egress to a concrete origin, without match")}let W=J.filter((H)=>("jsonPatch"in H));if(W.length>1)v1(`${Z}transform`,"a rule may carry only one jsonPatch transform");if(W.length&&(Y.public===!0||!(X.public===!0||X.host!==void 0)))v1(`${Z}transform`,"jsonPatch requires HTTP egress from a VM or VPC to a public origin or host");if(Q.forwardAuth!==void 0){im4(Q.forwardAuth,`${Z}forwardAuth`);let H=X.vmId!==void 0||!k10(X)&&X.port!==void 0;if(G!=="http"||Y.public!==!0||!H||Q.domain==="*")v1(`${Z}forwardAuth`,`${Z}forwardAuth is only supported on HTTP public ingress: \`{ public: true } -> { vmId, port }\``)}if(G==="smtp")pm4(Q.domain);else Q91(Q.domain);if((Y.vmId!==void 0||Y.vpcId!==void 0)&&X.vmId!==void 0&&J.length>0)v1(`${Z}transform`,"a VM-to-VM rule cannot carry a transform yet \u2014 remove it (only public ingress/egress rules run transforms)");if(G==="tcp"){let H=X.public===!0||X.host!==void 0,F=Y.vmId!==void 0||Y.vpcId!==void 0;if(H||F)v1(`${Z}protocol`,"a `tcp` rule is public ingress only \u2014 `{ public: true } -> { vmId, port }`. The edge splices the session without terminating it, so outbound there is nothing to broker (an outbound allow is a firewall rule, and injecting into one needs `http` or `postgres`) and inward there is no certificate to answer the source with. Give the source `public: true`, or drop `protocol` to be served as HTTPS")}else if(G==="imap"||G==="imaps"){let H=X.public===!0||X.host!==void 0,F=Y.vmId!==void 0||Y.vpcId!==void 0;if(H||F)v1(`${Z}protocol`,`an \`${G}\` rule is public ingress only \u2014 \`{ public: true } -> { vmId, port }\`. The 993 front serves mail clients reaching a VM's IMAP server; outbound there is nothing to broker (an outbound allow is a firewall rule) and inward there is no certificate to answer the source with`)}else if(G==="socks5"){let H=X.public===!0||X.host!==void 0;if(Y.public===!0||!H)v1(`${Z}protocol`,'a `socks5` rule is egress only \u2014 `{ vmId } -> { host: "gate.provider.com", port: 1080 }`. The front exists so a guest can open sessions through a proxy whose credentials it never holds; inbound there is nothing to serve, and publishing one would be an open proxy on a platform address');if(X.host===void 0)v1(`${Z}destination`,"a `socks5` rule has to name the proxy it goes through: give the destination a `host` and the `port` the provider listens on. `{ public: true }` on its own asks the edge to be the proxy, which would let the guest out on our address rather than through yours")}else if(G==="postgres"){let H=J.some((U)=>U!==null&&typeof U==="object"&&("postgres"in U)),F=X.public===!0||X.host!==void 0;if(H&&!F)v1(`${Z}transform`,"a `postgres` transform belongs on an egress rule: the edge spends a credential the guest never holds, so pointing it at your own VM would hand every client a logged-in session. Give the destination `public: true` or a `host`, or drop the transform")}else if(G==="smtp"){let H=J.some((U)=>U!==null&&typeof U==="object"&&("smtp"in U)),F=X.public===!0||X.host!==void 0;if(H&&!F)v1(`${Z}transform`,"an `smtp` transform belongs on an egress rule: the edge spends a credential the guest never holds, so pointing it at your own VM would turn it into an open relay. Give the destination `public: true` or a `host`, or drop the transform");if(typeof Q.domain==="string"&&Q.domain.includes("@")&&Y.public!==!0)v1(`${Z}domain`,`\`${Q.domain}\` names a mailbox, which only makes sense on a rule that receives mail. An egress or VM-to-VM rule names the host the guest submits through \u2014 drop the part before \`@\``)}return{...Q,source:Y,destination:X}}function am4($,Z){if($==="source")return mm4(Z)?"source is empty. Say who opens the session: `vmId`, `vpcId`, or `public: true`":"source only narrows the session without saying who opens it. Add `vmId`, `vpcId`, or `public: true`";return"destination is empty. Say where the session lands: `vmId` + `port`, `host` + `port`, or `public: true` for the domain's own origin"}function lT$($){let Z=mT$($,"");for(let Q of["source","destination"]){let Y=Z[Q];if(!k10(Y))v1(Q,am4(Q,Y))}if(Z.source.public===!0&&Z.destination.public===!0)v1("destination","a rule from the public Internet to the domain's own origin allows nothing the world cannot already do. Did you mean a `vmId` destination (ingress) or a `vmId` source (egress)?");return Z}function dT$($){if(!fY($))v1("tls","tls must be an object with a `rules` array");for(let Q of Object.keys($))if(Q!=="rules")v1(`tls.${Q}`,`tls has unknown field \`${Q}\`. Expected: rules`);let Z=$.rules;if(!Array.isArray(Z))v1("tls.rules","tls.rules must be an array");return Z.forEach((Q,Y)=>{let X=`tls.rules[${Y}].`,J=mT$(Q,X),G=k10(J.source),W=k10(J.destination);if(!G&&!W)v1(`tls.rules[${Y}]`,`tls.rules[${Y}]: both source and destination refer to the VM being created, which allows nothing. Give one of them a \`vmId\`, \`vpcId\`, or \`public: true\``);if(G&&W)v1(`tls.rules[${Y}]`,`tls.rules[${Y}]: neither end refers to the VM being created. Leave one endpoint's identity unset so it means this VM, or create the rule with tls.rules.create instead`);if(!W&&J.destination.port===void 0)v1(`tls.rules[${Y}].destination.port`,`tls.rules[${Y}]: destination.port is required: say which port on this VM the session lands on`)}),$}function $91($){return`/v5/tls/${u6($)}`}function Z91($){return`/v5/tls/forward-auth/${u6($)}`}class iT${client;constructor($){this.client=$}list(){return this.client.get("/v5/tls/forward-auth")}async create($){let Z=yT$($);return this.client.post("/v5/tls/forward-auth",Z)}get($){return this.client.get(Z91($))}async update($,Z){let Q=yT$(Z);return this.client.put(Z91($),Q)}delete($){return this.client.delete(Z91($))}}class pT${client;constructor($){this.client=$}async create($){let Z=lT$($);return this.client.post("/v5/tls",Z)}list($={}){return this.client.get("/v5/tls",$)}get($){return this.client.get($91($))}async update($,Z){let Q=lT$(Z);return this.client.put($91($),Q)}delete($){return this.client.delete($91($))}}class J91{client;rules;forwardAuth;constructor($){this.client=$,this.rules=new pT$($),this.forwardAuth=new iT$($)}}var Y91,X91,kT$,xm4,ST$,fm4=253,ym4=63,CT$,_T$,gm4,hm4,um4=2048,vT$=32,bT$=16384,xT$=32,fT$=32,lm4=128,cm4,gT$="!#$%&'*+-/=?^_`{|}~.",uT$;var DT0=D(()=>{fW();Y91=class Y91 extends Error{path;constructor($,Z){super(Z);this.name="TlsRuleValidationError",this.path=$,Object.setPrototypeOf(this,Y91.prototype)}};X91=class X91 extends Error{path;constructor($,Z){super(Z);this.name="TlsForwardAuthValidationError",this.path=$,Object.setPrototypeOf(this,X91.prototype)}};kT$=["vmId","vpcId","public","host","port"],xm4=["vmId","vpcId","public","host"],ST$=["tcp","http","postgres","minecraft","smtp","imap","imaps","socks5"],CT$=["url","headers","timeoutMs","protectedCookies","authResponseHeaders"],_T$=["id"],gm4=/^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/,hm4=/^[0-9A-Za-z-]+$/,cm4=new Set(["host","content-length","connection","keep-alive","proxy-authenticate","proxy-authorization","proxy-connection","te","trailer","transfer-encoding","upgrade"]);uT$=["action","domain","protocol","source","destination","transform","match","forwardAuth"]});function mm($){return`/v5/tunnels/${u6($)}`}function Ff($){return $.tunnelId??=$.id,$}class G91{client;constructor($){this.client=$}list(){return this.client.get("/v5/tunnels").then(($)=>{return $.tunnels.forEach(Ff),$})}create($={}){return this.client.post("/v5/tunnels",$).then(Ff)}get($){return this.client.get(mm($)).then(Ff)}update($,Z){return this.client.patch(mm($),Z).then(Ff)}rotateKey($,Z={}){return this.client.post(`${mm($)}/rotate-key`,Z).then(Ff)}delete($){return this.client.delete(mm($))}attachVpc($,Z,Q={}){return this.client.post(`${mm($)}/vpcs/${u6(Z)}`,Q).then(Ff)}detachVpc($,Z){return this.client.delete(`${mm($)}/vpcs/${u6(Z)}`).then(Ff)}}var W91=D(()=>{fW()});class K91{client;basePath;constructor($,Z){this.client=$,this.basePath=Z}async readFile($,Z={}){let Q=await this.openRead($,Z);return new Uint8Array(await Q.arrayBuffer())}async readTextFile($,Z={}){return await(await this.openRead($,Z)).text()}async readFileStream($,Z={}){let Q=await this.openRead($,Z);if(!Q.body)throw Error(`no response body reading ${$}`);return Q.body}async writeFile($,Z,Q={}){let Y=typeof Z==="string"?new TextEncoder().encode(Z):Z,X=Y instanceof Uint8Array?Y.byteLength:Y.size;if(X>em4)return this.uploadInChunks($,Y,X,Q);let J=Y instanceof Uint8Array?Y:new Uint8Array(await Y.arrayBuffer());await this.client.putBytes(`${this.basePath}/fs/write`,J,{path:$,mode:Q.mode,sha256:await nT$(J)},Q.signal),Q.onProgress?.({completedBytes:X,totalBytes:X})}writeTextFile($,Z,Q={}){return this.writeFile($,Z,Q)}async readDir($){let{entries:Z}=await this.client.get(`${this.basePath}/fs/dir`,{path:$});return Z}async mkdir($){await this.client.post(`${this.basePath}/fs/mkdir`,{path:$})}async remove($){await this.client.delete(`${this.basePath}/fs/remove`,{path:$})}async exists($){let{exists:Z}=await this.client.get(`${this.basePath}/fs/exists`,{path:$});return Z}stat($){return this.client.get(`${this.basePath}/fs/stat`,{path:$})}openRead($,Z){let{offset:Q,length:Y}=Z,X;if(Q!==void 0||Y!==void 0){let J=Q??0;X=Y===void 0?`bytes=${J}-`:`bytes=${J}-${J+Y-1}`}return this.client.getBytes(`${this.basePath}/fs/read`,{path:$},{range:X,signal:Z.signal})}async uploadInChunks($,Z,Q,Y){let X=Y.chunkSize??$d4,J=Y.maxAttempts??Zd4,G=Z instanceof Uint8Array?await nT$(Z):void 0,W=await this.client.post(`${this.basePath}/fs/uploads`,{path:$,size:Q,sha256:G,mode:Y.mode}),K=`${this.basePath}/fs/uploads/${W.uploadId}`;try{let H=W.receivedBytes;while(H<Q){let F=Math.min(H+X,Q),U=Z instanceof Uint8Array?Z.subarray(H,F):Z.slice(H,F);H=(await this.putChunkWithRetry(K,U,H,J,Y.signal)).receivedBytes,Y.onProgress?.({completedBytes:Math.min(H,Q),totalBytes:Q})}await this.client.post(`${K}/commit`)}catch(H){throw await this.client.delete(K).catch(()=>{}),H}}async putChunkWithRetry($,Z,Q,Y,X){let J;for(let G=1;G<=Y;G++){X?.throwIfAborted?.();try{return await this.client.putBytes($,Z,{offset:Q},X)}catch(W){if(J=W,!(!(W instanceof yX)||W.status>=500||W.status===408||W.status===409||W.status===429)||X?.aborted||G===Y)throw W;await Qd4(Math.min(500*2**(G-1),8000));let H=await this.client.get($).catch(()=>{return});if(H&&H.receivedBytes>Q)return H}}throw J}}async function nT$($){let Z=globalThis.crypto?.subtle;if(!Z)return;let Q=await Z.digest("SHA-256",$);return Array.from(new Uint8Array(Q),(Y)=>Y.toString(16).padStart(2,"0")).join("")}function Qd4($){return new Promise((Z)=>setTimeout(Z,$))}var em4=8388608,$d4=16777216,Zd4=5;var H91=D(()=>{I10()});function Yd4(){return typeof process<"u"&&Boolean(process.versions?.node)}async function tT$($,Z){if(Yd4()){let Y;try{Y=await import("ws")}catch{throw Error("PTY sessions need the `ws` package in Node. Install it with `npm install ws`.")}return new Y.default($,{headers:Z})}let Q=globalThis.WebSocket;if(!Q)throw Error("PTY sessions need a WebSocket client; no global WebSocket is available in this environment.");return new Q($)}function S10($,Z,Q){if($.on){$.on(Z,Q);return}$.addEventListener?.(Z,Q)}function Jd4($,Z){if($&&typeof $==="object"&&"data"in $){let Q=$.data;if(typeof Q==="string")return{text:Q};if(Q instanceof ArrayBuffer)return{binary:new Uint8Array(Q)};return{}}if($ instanceof Uint8Array)return Z?{binary:$}:{text:Xd4.decode($)};if(typeof $==="string")return{text:$};return{}}class F91{_sessionId;_slug;_created=!1;socket;constructor($,Z,Q={}){this.socket=$,this._sessionId=Z,S10($,"message",(Y,X)=>{let{text:J,binary:G}=Jd4(Y,X);if(G){Q.onData?.(G);return}if(!J)return;let W;try{W=JSON.parse(J)}catch{return}if(W.type==="exited")Q.onExit?.(W.exitCode);else if(W.type==="error")Q.onError?.(Error(W.message));else if(W.type==="sessionInfo")this._sessionId=W.sessionId,this._slug=W.slug,this._created=W.created??!0,Q.onSessionInfo?.(W.sessionId)}),S10($,"close",(Y)=>{let X=Y;Q.onClose?.({wasClean:X?.wasClean??!0,code:X?.code??1000,reason:X?.reason??""})}),S10($,"error",(Y)=>Q.onError?.(Y))}write($){this.socket.send(typeof $==="string"?new TextEncoder().encode($):$)}resize($){this.sendControl({type:"resize",cols:$.cols,rows:$.rows})}signal($){this.sendControl({type:"signal",signal:$})}sendControl($){this.socket.send(JSON.stringify($))}detach(){this.socket.close()}get sessionId(){return this._sessionId}get slug(){return this._slug}get created(){return this._created}get readyState(){return this.socket.readyState}}function Gd4($){return new Promise((Z,Q)=>{if($.readyState===1){Z();return}S10($,"open",()=>Z()),S10($,"error",(Y)=>Q(Y))})}class U91{client;basePath;constructor($,Z){this.client=$,this.basePath=Z}async open($={}){let{exec:Z,cols:Q,rows:Y,linuxUser:X,slug:J,replaceOnExit:G,onData:W,onExit:K,onClose:H,onError:F}=$,U={};if(Z!==void 0)U.exec=Z;if(Q!==void 0)U.cols=Q;if(Y!==void 0)U.rows=Y;if(X!==void 0)U.linuxUser=X;if(J!==void 0)U.slug=J;if(G!==void 0)U.replaceOnExit=String(G);let N=oT$(this.client,`${this.basePath}/pty`,U),B=this.client.authHeaders(),O=await tT$(N,B);return new Promise((L,w)=>{let j=!1,E=new F91(O,-1,{onData:W,onExit:K,onClose:(z)=>{if(!j)j=!0,w(Error("connection closed before sessionInfo"));H?.(z)},onError:(z)=>{if(!j)j=!0,w(z);F?.(z)},onSessionInfo:()=>{j=!0,L(E)}})})}async attach($){let{session:Z,linuxUser:Q,onData:Y,onExit:X,onClose:J,onError:G}=$,W=oT$(this.client,`${this.basePath}/pty/sessions/${u6(String(Z))}`,{...Q!==void 0?{linuxUser:Q}:{}}),K=this.client.authHeaders(),H=await tT$(W,K),F=new F91(H,typeof Z==="number"?Z:-1,{onData:Y,onExit:X,onClose:J,onError:G});return await Gd4(H),F}list($={}){return this.client.get(`${this.basePath}/pty/sessions`,$)}close($,Z={}){return this.client.delete(`${this.basePath}/pty/sessions/${u6(String($))}`,Z)}}class N91{pty;linuxUser;constructor($,Z){this.pty=$,this.linuxUser=Z}open($={}){return this.pty.open({...$,linuxUser:this.linuxUser})}attach($){return this.pty.attach({...$,linuxUser:this.linuxUser})}list(){return this.pty.list({linuxUser:this.linuxUser})}close($){return this.pty.close($,{linuxUser:this.linuxUser})}}function oT$($,Z,Q){return $.url(Z,Q).replace(/^http/,"ws")}var Xd4;var B91=D(()=>{fW();Xd4=new TextDecoder});class D91{client;constructor($){this.client=$}list($={}){return this.client.get("/v5/snapshots",$)}get($){return this.client.get(`/v5/snapshots/${u6($)}`)}update($,Z){return this.client.patch(`/v5/snapshots/${u6($)}`,Z)}delete($){return this.client.delete(`/v5/snapshots/${u6($)}`)}}var O91=D(()=>{fW()});var rT$=()=>{};function L91($){return`/v5/vms/${u6($)}`}class w91{id;fs;pty;client;basePath;constructor($,Z){this.client=$,this.id=Z,this.basePath=L91(Z),this.fs=new K91($,this.basePath),this.pty=new U91($,this.basePath)}data(){return this.client.get(this.basePath)}firewallRules(){return this.client.get("/v5/firewall/rules",{vmId:this.id})}update($){return this.client.patch(this.basePath,$)}start(){return this.client.post(`${this.basePath}/start`)}pause(){return this.client.post(`${this.basePath}/pause`)}resize($){return this.client.post(`${this.basePath}/resize`,$)}delete(){return this.client.delete(this.basePath)}exec($){let Z=typeof $==="string"?{command:$}:$;return this.client.post(`${this.basePath}/exec-await`,Z)}linuxUser($){return new sT$(this,$)}snapshot($={}){return this.client.post(`${this.basePath}/snapshot`,$)}}class sT${vm;linuxUser;pty;constructor($,Z){this.vm=$,this.linuxUser=Z,this.pty=new N91($.pty,Z)}exec($){let Z=typeof $==="string"?{command:$}:$;return this.vm.exec({...Z,linuxUser:this.linuxUser})}}class j91{client;snapshots;constructor($){this.client=$,this.snapshots=new D91($)}async create($){if(BT0($.firewall,"VM"),$.tls!==void 0)dT$($.tls);let Z=await this.client.post("/v5/vms",$);return{vm:new w91(this.client,Z.id),vmId:Z.id,data:Z,firewallRules:Z.firewallRules??[],tlsRules:Z.tlsRules??[]}}list($={}){return this.client.get("/v5/vms",$)}get($){return this.client.get(L91($))}ref($){return new w91(this.client,$)}delete($){return this.client.delete(L91($))}}var E91=D(()=>{V10();DT0();fW();H91();B91();O91();rT$();H91();B91();O91()});function z91($){return`/v5/vpcs/${u6($)}`}class aT${client;basePath;constructor($,Z){this.client=$,this.basePath=Z}list(){return this.client.get(`${this.basePath}/tunnels`)}}class P91{id;tunnels;client;basePath;constructor($,Z){this.client=$,this.id=Z,this.basePath=z91(Z),this.tunnels=new aT$($,this.basePath)}data(){return this.client.get(this.basePath)}update($){return this.client.patch(this.basePath,$)}delete(){return this.client.delete(this.basePath)}}class A91{client;constructor($){this.client=$}list(){return this.client.get("/v5/vpcs")}async create($={}){if($.firewall!==void 0)BT0($.firewall,"network");let Z=await this.client.post("/v5/vpcs",$);return{vpc:new P91(this.client,Z.id),vpcId:Z.id,data:Z,firewallRules:Z.firewallRules??[]}}get($){return this.client.get(z91($))}ref($){return new P91(this.client,$)}delete($){return this.client.delete(z91($))}}var T91=D(()=>{V10();fW()});class OT0{client;vms;vpc;tunnels;firewall;tls;domains;identities;constructor($={}){this.client=new m51($),this.vms=new j91(this.client),this.vpc=new A91(this.client),this.tunnels=new G91(this.client),this.firewall=new o51(this.client),this.tls=new J91(this.client),this.domains=new d51(this.client),this.identities=new a51(this.client)}fetch($,Z){return this.client.fetch($,Z)}}var eT$=D(()=>{fW();i51();V10();e51();DT0();W91();E91();T91();fW();I10();E91();T91();W91();i51();V10();DT0();e51()});var ZR$;var $R$=D(()=>{ZR$={name:"@decocms/sandbox",version:"1.80.4",private:!0,type:"module",description:"Sandbox runtime for isolated Studio tool execution",scripts:{check:"tsc --noEmit",test:"bun test",build:"bun run build:typegen && bun run build:harness-runner","build:typegen":"mkdir -p dist && bun run --cwd=../typegen build && bun --cwd=../typegen pm pack --filename $PWD/dist/typegen.tgz --quiet","build:harness-runner":"mkdir -p dist && bun --cwd=../harness-runner pm pack --filename $PWD/dist/harness-runner.tgz --quiet"},exports:{"./shared":"./shared.ts","./provider":"./server/provider/index.ts","./provider/agent-sandbox":"./server/provider/agent-sandbox/index.ts","./provider/postgres-state-store":"./server/provider/postgres-state-store.ts","./provider/freestyle":"./server/provider/freestyle.ts","./provider/remote":"./server/provider/remote.ts","./provider/router":"./server/provider/router.ts","./provider/sandbox-api":"./server/provider/sandbox-api.ts","./provider/sandbox-server":"./server/provider/sandbox-server.ts","./daemon-client":"./server/daemon-client.ts","./org-fs":"./org-fs.ts","./dispatch":"./dispatch/index.ts","./dispatch/*":"./dispatch/*.ts","./proxy/http":"./proxy/http.ts","./proxy/websocket":"./proxy/websocket.ts"},dependencies:{"@decocms/shared":"workspace:*","@kubernetes/client-node":"^1.4.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0",freestyle:"0.2.16",zod:"4.3.6"},devDependencies:{"@types/bun":"latest",postgres:"^3.4.5",typescript:"^7.0.2"}}});function LT0($){let Z=$?.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of studio-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"});return async(Q,Y)=>{if(!Z)return Y();let X=performance.now(),J=(G)=>Z.record(performance.now()-X,{runner_kind:Q,source:"daemon",status_code:G});try{let G=await Y();return J(G.status),G}catch(G){throw J(0),G}}}var RD;var wT0=D(()=>{RD={kubernetes:"agent-sandbox",freestyle:"freestyle"}});var FR$={};$6(FR$,{FreestyleSandboxProvider:()=>HR$});import{createHash as Kd4,randomBytes as Hd4}from"crypto";class HR${freestyle;lookupClient;image;sidecarImage;idleTimeoutSeconds;autoDeleteSeconds;domainSuffix;timeDaemonRequest;inflight=new Wf;snapshotInflight=new Wf;lookups=new Map;releaseTimers=new Map;constructor($){this.freestyle=$.client??new OT0({apiKey:$.apiKey}),this.lookupClient=$.client??new OT0({apiKey:$.apiKey,fetch:Object.assign((Z,Q)=>fetch(Z,{...Q,signal:Q?.signal?AbortSignal.any([Q.signal,AbortSignal.timeout(GR$)]):AbortSignal.timeout(GR$)}),{preconnect:fetch.preconnect})}),this.image=$.image??`ghcr.io/decocms/studio/studio-sandbox-go:${ZR$.version}`,this.sidecarImage=$.orgFsSidecarImage??Ud4,this.idleTimeoutSeconds=$.idleTimeoutSeconds??300,this.autoDeleteSeconds=$.autoDeleteSeconds??86400,this.domainSuffix=$.domainSuffix??"style.dev",this.timeDaemonRequest=LT0($.meter)}async owns($){return await this.find($)!==null}daemonUrl($){return`https://${$}.${this.domainSuffix}`}async find($,Z={}){let Q=this.lookups.get($);if(!Z.refresh&&Q&&Date.now()-Q.at<(Q.found?wd4:jd4))return Q.found;let Y=null;try{let X=await this.lookupClient.vms.get($),J=X.metadata[XR$];if(J)Y={vm:this.freestyle.vms.ref(X.id),daemon:{url:this.daemonUrl($),token:J}}}catch(X){if(!(X instanceof yX&&X.status===404))throw X}return this.remember($,Y),Y}remember($,Z){if(this.lookups.delete($),this.lookups.size>=Ed4){let Q=this.lookups.keys().next();if(!Q.done)this.lookups.delete(Q.value)}this.lookups.set($,{found:Z,at:Date.now()})}baseSnapshot(){let{image:$,sidecarImage:Z}=this,Q=`studio-sandbox-${Kd4("sha256").update(`${$}
+${X}`:X}var EA$,Hc4;var E51=D(()=>{EA$=/[\r\n<>]/,Hc4=/^[^\s@<>]+@[^\s@<>]+\.[^\s@<>]+$/});var tA0=D(()=>{a$();E51()});function Uc4($){if($ instanceof TypeError)return!0;if($ instanceof Error&&!($ instanceof DOMException)&&typeof $.code==="string")return!0;if($ instanceof DOMException&&$.name==="AbortError")return!0;return!1}async function z51($,Z,Q,Y){try{return await E8(async()=>{let J=await fetch($,{...Z,signal:AbortSignal.timeout(Y)});return{status:J.status,ok:J.ok,body:await J.text()}},{maxAttempts:3,minTimeout:50,maxTimeout:500,multiplier:2,jitter:0.5,isRetriable:Uc4})}catch(X){let J=X instanceof Error?X.message:String(X);throw Error(`[SANDBOX_UNREACHABLE] sandbox daemon ${Q} request failed: ${J}`,{cause:X})}}async function oA0($){try{let Z=await fetch(`${$}/health`,{signal:AbortSignal.timeout(Nc4)});if(!Z.ok){try{await Z.text()}catch{}return null}let Q=await Z.json();if(typeof Q==="object"&&Q!==null&&typeof Q.bootId==="string"&&typeof Q.ready==="boolean"&&Q.setup&&typeof Q.setup.running==="boolean"&&typeof Q.setup.done==="boolean")return Q;return null}catch{return null}}async function A51($){for(let Z=0;Z<PA$;Z++){if(await oA0($)!==null)return;let Q=(Math.random()*2-1)*Bc4;await O$(AA$+Q)}throw Error(`sandbox daemon at ${$} did not respond on /health within ${PA$*AA$/1000}s`)}async function CU($,Z,Q,Y,X){return Dc4($,Z,"POST",Q,Y,X)}async function Dc4($,Z,Q,Y,X,J){let G={...Y};if(X&&X.rotateToken!==void 0)G.auth=X;let W=await z51(`${$}/_sandbox/config`,{method:Q,headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:JSON.stringify(G)},"/_sandbox/config",J?.timeoutMs??P51);if(!W.ok)throw new PH(W.status,W.body);return RA$(W.body,"/_sandbox/config")}async function TA$($,Z,Q){let Y=await z51(`${$}/_sandbox/setup/${Q}`,{method:"POST",headers:{Authorization:`Bearer ${Z}`}},`/_sandbox/setup/${Q}`,P51);if(!Y.ok)throw Error(`sandbox daemon /_sandbox/setup/${Q} returned ${Y.status}: ${Y.body}`)}async function z10($,Z,Q){let Y=await z51(`${$}/_sandbox/orgfs-config`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:Q},"/_sandbox/orgfs-config",P51);if(!Y.ok)throw Error(`sandbox daemon /_sandbox/orgfs-config returned ${Y.status}: ${Y.body}`);return RA$(Y.body,"/_sandbox/orgfs-config")}function RA$($,Z){try{return JSON.parse($)}catch(Q){throw Error(`sandbox daemon ${Z} returned a malformed JSON body: ${$.slice(0,200)}`,{cause:Q})}}async function rA0($,Z,Q,Y){let X=new Headers(Y.headers);for(let W of Oc4)X.delete(W);X.set("authorization",`Bearer ${Z}`);let J=Y.method!=="GET"&&Y.method!=="HEAD",G=`${$}${Q.startsWith("/")?Q:`/${Q}`}`;return fetch(G,{method:Y.method,headers:X,body:J?Y.body:void 0,redirect:"manual",signal:Y.signal,duplex:J?"half":void 0})}var PH,Nc4=500,P51=30000,PA$=25,AA$=200,Bc4=50,Oc4;var Gf=D(()=>{tA0();a$();PH=class PH extends Error{status;constructor($,Z){super(`sandbox daemon /_sandbox/config returned ${$}: ${Z}`);this.status=$;this.name="ConfigRequestError"}};Oc4=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length"]});class sA0{counted=new Set;markCounted($){this.counted.add($)}consume($){return this.counted.delete($)}}class Wf{map=new Map;async run($,Z){let Q=this.map.get($);if(Q)return Q;let Y=Z();this.map.set($,Y);try{return await Y}finally{this.map.delete($)}}}function aA0($,Z,Q){if(!$)return Q(null);if(!$.withLock)return Q($);return $.withLock(Z,Q)}function P10($){if(!$.orgId||!$.virtualMcpId||!$.branch)throw Error("composeSandboxRef: orgId, virtualMcpId and branch are all required for agent refs");return`agent:${$.orgId}:${$.virtualMcpId}:${$.branch}`}function qA$($){if(!$.startsWith("agent:"))return"";let Z=$.split(":");return Z.length>=4?Z.slice(3).join(":"):""}import{hash as Lc4}from"crypto";function wc4($,Z=16){return Lc4("sha256",NL$($),"hex").slice(0,Z)}function F3($){let Z=wc4($),Q=jc4(qA$($.projectRef));return Q?`${Q}-${Z}`:`s-${Z}`}function jc4($){if(!$)return"";let Z=$.split("/").pop()??"",Q="",Y=!1;for(let X of Z.toLowerCase()){let J=X.charCodeAt(0),G=J>=97&&J<=122,W=J>=48&&J<=57;if(!G&&!W){Y||=Q.length>0;continue}if(Y){if(Q.length+1>=MA$)break;Q+="-",Y=!1}if(Q+=X,Q.length===MA$)break}return Q}var MA$=24;var IA$=D(()=>{j41()});function eA0($,Z){let Q=$.replace(/\/+$/,"");if(Q.includes("{handle}"))return`${Q.replace("{handle}",Z)}/`;try{let Y=new URL(Q);return Y.hostname=`${Z}.${Y.hostname}`,`${Y.toString()}/`}catch{return`${Q}/${Z}/`}}function fm($){let Z=$.repo,Q=Z?{repository:{cloneUrl:Z.cloneUrl,repoName:Z.displayName??Ec4(Z.cloneUrl),...Z.branch?{branch:Z.branch}:{},submoduleCredentials:Z.submoduleCredentials??[]},repositories:($.extraRepos??[]).filter((K)=>!!K.directoryName).map((K)=>({cloneUrl:K.cloneUrl,repoName:K.directoryName,...K.branch?{branch:K.branch}:{},submoduleCredentials:K.submoduleCredentials??[]})),...Z.userName.trim()||Z.userEmail.trim()?{identity:{userName:Z.userName,userEmail:Z.userEmail}}:{}}:void 0,Y=$.tenant,X=xm({userName:Y?.userName,userEmail:Y?.userEmail})??void 0,J=$.packageManager?{name:$.packageManager.name,...$.packageManager.path?{path:$.packageManager.path}:{}}:void 0,G=J?{packageManager:J,runtime:$.runtime,...$.port!==void 0?{port:$.port}:{}}:void 0,W=Y?.orgId;if(!Q&&!G&&!X&&$.cloneOnly===void 0&&!W)return null;return{...Q?{git:Q}:{},...X?{operator:X}:{},...W?{orgId:W}:{},...$.cloneOnly!==void 0?{cloneOnly:$.cloneOnly}:{},...G?{application:G}:{}}}function Ec4($){try{let Z=new URL($);return Z.pathname.replace(/^\/+/,"").replace(/\.git$/,"")||Z.hostname}catch{return $}}var VA$=D(()=>{E51()});function zc4($){try{return new URL($).username.length>0}catch{return!1}}function A10($){let Z=$.repo?.cloneUrl;if(!Z||!zc4(Z))return null;return{git:{repository:{cloneUrl:Z}}}}var ym=D(()=>{IA$();VA$()});async function*CA$($){let Z=$.now??(()=>Date.now()),Q=Z(),Y=$.schedulingTimeoutMs??Ac4,X={pod:{},sandbox:{},events:{hasPulling:!1,hasPulled:!1},startedAt:Q},J=[],G=null,W=!1,K=(E)=>{if(W)return;if(G){let z=G;G=null,z(E)}else J.push(E)},H=()=>{if(J.length>0)return Promise.resolve(J.shift());if(W)return Promise.resolve(null);return new Promise((E)=>{G=E})},F=()=>{if(W)return;if(W=!0,G){let E=G;G=null,E(null)}},U=new AbortController,N=()=>{U.abort(),F()};if($.signal)if($.signal.aborted)U.abort(),F();else $.signal.addEventListener("abort",N,{once:!0});let B=Math.max(0,Y-(Z()-Q)),O=setTimeout(()=>K("tick"),B+100),L,w=new Promise((E)=>{L=E}),j=Promise.allSettled([Rc4($.kc,$.namespace,$.claimName,U.signal,X,K,Z,L),Mc4($.kc,$.namespace,$.claimName,U.signal,X,K),Ic4($.kc,$.namespace,$.claimName,w,U.signal,X,K,Z)]);try{let E=null,z=-1,T=kA$(X,Y,Z);if(E=R51(T),!T51(T))z=SA$(T);if(yield T,T51(T))return;while(!W){if(await H()===null)break;let P=kA$(X,Y,Z);if(T51(P)){let _=R51(P);if(_!==E)E=_,yield P;return}let q=SA$(P);if(q<z)continue;let x=R51(P);if(x!==E)E=x,z=q,yield P}}finally{if(clearTimeout(O),U.abort(),$.signal)$.signal.removeEventListener("abort",N);F(),await j.catch(()=>{})}}async function _A$($,Z=Tc4){let Q=new AbortController,Y="claiming",X,J=()=>{clearTimeout(X),X=setTimeout(()=>Q.abort(),Z)};try{J();for await(let G of $(Q.signal)){if(G.kind==="ready")return;if(G.kind==="failed")throw new vY(G.message);Y=G.kind,J()}}finally{clearTimeout(X),Q.abort()}throw new zm(`Sandbox did not become ready: no progress for ${Math.round(Z/1000)}s while ${Y}`)}function kA$($,Z,Q){let{pod:Y,sandbox:X,events:J,startedAt:G}=$;if(X.ready)return{kind:"ready"};let W=Y.containerWaitingReason;if(W==="ImagePullBackOff"||W==="ErrImagePull")return{kind:"failed",reason:"image-pull-backoff",message:"Sandbox image failed to download. The cluster may be missing pull credentials or the image tag may not exist."};if(W==="CrashLoopBackOff")return{kind:"failed",reason:"crash-loop-backoff",message:"Sandbox crashed during startup and is now in CrashLoopBackOff. Check pod logs."};if(!Y.scheduled&&J.lastFailedSchedulingAt!==void 0&&Q()-G>Z)return{kind:"failed",reason:"scheduling-timeout",message:J.failedSchedulingMessage??`Pod could not be scheduled within ${Math.round(Z/1000)}s.`};if(Y.containerRunning&&!Y.containerReady)return{kind:"warming-daemon",since:G};if(J.hasPulling&&!J.hasPulled)return{kind:"pulling-image",since:G};if(W==="ContainerCreating"||W==="PodInitializing"||Y.scheduled&&!Y.containerRunning)return{kind:"starting-container",since:G};if(Y.scheduledFalseReason==="Unschedulable"||J.lastFailedSchedulingAt!==void 0&&!Y.scheduled)return{kind:"waiting-for-capacity",since:G,message:J.failedSchedulingMessage??Y.scheduledFalseMessage,nodeClaim:J.nominatedNodeClaim};return{kind:"claiming",since:G}}function T51($){return $.kind==="ready"||$.kind==="failed"}function SA$($){switch($.kind){case"claiming":return 0;case"waiting-for-capacity":return 1;case"pulling-image":return 2;case"starting-container":return 3;case"warming-daemon":return 4;case"ready":case"failed":return 99}}function R51($){switch($.kind){case"claiming":case"pulling-image":case"starting-container":case"warming-daemon":return $.kind;case"waiting-for-capacity":return`waiting-for-capacity:${$.message??""}:${$.nodeClaim??""}`;case"ready":return"ready";case"failed":return`failed:${$.reason}:${$.message}`}}async function Rc4($,Z,Q,Y,X,J,G,W){let K=`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?watch=true&labelSelector=${encodeURIComponent(`${Pc4}=${Q}`)}`;return $T0({kc:$,path:K,signal:Y,label:`pod/${Q}`,onEvent:(H)=>{if(H.type!=="ADDED"&&H.type!=="MODIFIED")return;let F=H.object;if(F.metadata?.name)W(F.metadata.name);qc4(F,X,G),J("pod")}})}function qc4($,Z,Q){let X=($.status?.conditions??[]).find((G)=>G.type==="PodScheduled");if(X?.status==="True")Z.pod.scheduled=!0,Z.pod.scheduledFalseReason=void 0,Z.pod.scheduledFalseMessage=void 0;else if(X?.status==="False")Z.pod.scheduled=!1,Z.pod.scheduledFalseReason=X.reason,Z.pod.scheduledFalseMessage=X.message;let J=($.status?.containerStatuses??[]).find((G)=>G.name===dZ.MAIN_CONTAINER_NAME);if(J)Z.pod.containerWaitingReason=J.state?.waiting?.reason,Z.pod.containerRunning=!!J.state?.running,Z.pod.containerReady=J.ready===!0}async function Mc4($,Z,Q,Y,X,J){let G=`/apis/${dZ.CLAIM_API_GROUP}/${dZ.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(Z)}/${dZ.CLAIM_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${Q}`)}`;return $T0({kc:$,path:G,signal:Y,label:`sandboxclaim/${Q}`,onEvent:(W)=>{if(W.type!=="ADDED"&&W.type!=="MODIFIED")return;let H=W.object.status?.conditions?.find((F)=>F.type==="Ready");if(!H)return;if(H.status==="True")X.sandbox.ready=!0,X.sandbox.notReadyReason=void 0,X.sandbox.notReadyMessage=void 0;else X.sandbox.ready=!1,X.sandbox.notReadyReason=H.reason,X.sandbox.notReadyMessage=H.message;J("sandbox")}})}async function Ic4($,Z,Q,Y,X,J,G,W){let K=await Promise.race([Y,new Promise((F)=>{if(X.aborted){F(Q);return}X.addEventListener("abort",()=>F(Q),{once:!0})})]);if(X.aborted)return;let H=`/api/v1/namespaces/${encodeURIComponent(Z)}/events?watch=true&fieldSelector=${encodeURIComponent(`involvedObject.name=${K},involvedObject.kind=Pod`)}`;return $T0({kc:$,path:H,signal:X,label:`events/${Q}`,onEvent:(F)=>{if(F.type!=="ADDED"&&F.type!=="MODIFIED")return;let U=F.object,N=U.reason;if(!N)return;switch(N){case"Pulling":J.events.hasPulling=!0;break;case"Pulled":J.events.hasPulling=!0,J.events.hasPulled=!0;break;case"FailedScheduling":J.events.lastFailedSchedulingAt=W(),J.events.failedSchedulingMessage=U.message;break;case"Nominated":{let B=U.message?.match(/nodeclaim\/([\w-]+)/);if(B)J.events.nominatedNodeClaim=B[1];break}default:return}G("event")}})}async function vA$($){let{kc:Z,namespace:Q,labelSelector:Y,signal:X,onDelete:J}=$,G=`/apis/${dZ.CLAIM_API_GROUP}/${dZ.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(Q)}/${dZ.CLAIM_PLURAL}?watch=true&labelSelector=${encodeURIComponent(Y)}`;return $T0({kc:Z,path:G,signal:X,label:"sandboxclaim-reaper",onEvent:(W)=>{if(W.type!=="DELETED")return;let K=W.object.metadata?.name;if(K)J(K)}})}async function $T0($){let{kc:Z,path:Q,signal:Y,label:X,onEvent:J}=$,G=0;while(!Y.aborted){try{let K=await bW(Z,{method:"GET",path:Q,signal:Y,headers:{accept:"application/json"},stream:!0});if(!K.ok||!K.body){try{await K.body?.cancel()}catch{}if(K.status===401||K.status===403){console.warn(`[lifecycle-watcher] ${X} stopped: watch denied (${K.status} ${K.statusText}). `+"The kubeconfig in use cannot watch SandboxClaims \u2014 if you are running locally, "+"this provider should not be active (check STUDIO_AGENT_SANDBOX_ENABLED).");return}throw Error(`watch handshake failed: ${K.status} ${K.statusText}`)}G=0;for await(let H of dL$(K.body)){if(Y.aborted)return;try{J(H)}catch(F){console.warn(`[lifecycle-watcher] ${X} onEvent threw: ${F instanceof Error?F.message:String(F)}`)}}}catch(K){if(Y.aborted)return;let H=K instanceof Error?K.message:String(K);console.warn(`[lifecycle-watcher] ${X} watch ended: ${H}`)}if(Y.aborted)return;let W=B7(5000,250,G,2,0);G+=1,await O$(W,{signal:Y}).catch(()=>{})}}var Pc4="studio.decocms.com/sandbox-handle",Ac4=300000,Tc4=600000;var bA$=D(()=>{a$();a00();CH0()});import{createHash as Vc4}from"crypto";import{z as xX}from"zod";function _U($){let Z;try{Z=new URL($.trim())}catch{return null}if(Z.protocol!=="https:"||Z.search||Z.hash)return null;let Q=Z.pathname.replace(/\/+$/,"").replace(/\.git$/,"").replace(/\/+$/,"");return Q?`https://${Z.host.toLowerCase()}${Q}`:null}function T10($){return _U($)?.toLowerCase()??null}function vc4($){let Z=new Set;for(let Q of $){let Y=`${T10(Q.repoUrl)??Q.repoUrl}#${Q.branch}`;if(Z.has(Y))return Q;Z.add(Y)}return null}function xA$($){return $.reduce((Z,Q)=>Z+Q.replicas,0)}function yA$($,Z){if(Z.warmPoolName)return Z.warmPoolName;let Q=Vc4("sha256").update(`${Z.repoUrl}#${Z.branch}`).digest("hex").slice(0,8);return`${$}-${Q}`}function gA$($){return Math.max(0,$.size-xA$($.repos))}function gm($){return $.flatMap((Z)=>Z.repos.map((Q)=>({pool:Z,repo:Q,warmPoolName:yA$(Z.name,Q)})))}function bc4($,Z){return lA$(void 0,$,!0,Z)}function hA$($,{templateName:Z}){let Q=bc4(Z,$.image),Y=(X,J)=>({apiVersion:`${dZ.CLAIM_API_GROUP}/${dZ.CLAIM_API_VERSION}`,kind:"SandboxWarmPool",metadata:{name:X,labels:{[xc4]:$.name}},spec:{replicas:J,updateStrategy:{type:"OnReplenish"},sandboxTemplateRef:{name:Q}}});return[...$.repos.map((X)=>Y(yA$($.name,X),X.replicas)),Y($.name,gA$($))]}function QT0($){return $.tenant?.orgId}function M51($,Z){if(!Z.tenant)return null;let Q=$.filter((J)=>J.tenant===Z.tenant&&J.image===Z.image),Y=Z.cloneUrl?T10(Z.cloneUrl):null;if(Y){let J=gm(Q).filter((W)=>T10(W.repo.repoUrl)===Y),G=J.find((W)=>W.repo.branch===Z.branch)??J[0];if(G)return G}let X=Q.find((J)=>gA$(J)>0);return X?{pool:X,repo:null,warmPoolName:X.name}:null}function uA$($,Z,Q){return $?.warmPoolName??(Z?Q:"none")}function lA$($,Z,Q=!1,Y){let X=Y&&Y!=="default"?`-${Y}`:"";return`${Z}${X}${$==="harness-run"||Q?"-medium":""}`}async function I51($){let Z=lA$($.purpose,$.templateName,$.tenantPool,$.sandboxImage);if(Z===$.templateName)return{name:Z,probes:$.probes};let Q=$.probes[Z]??null,Y=Q!==null&&$.now-Q.checkedAt<$.ttlMs?Q:{checkedAt:$.now,present:await $.exists(Z)},X={...$.probes,[Z]:Y};if(Y.present)return{name:Z,probes:X};if(Q?.present!==!1)$.onAbsent?.(Z);if($.sandboxImage&&$.sandboxImage!=="default")return I51({...$,sandboxImage:void 0,probes:X});return{name:$.templateName,probes:X}}function V51($,Z,Q){let Y=T10(Z);if(!Y)return[];let X=Q.replace(/^refs\/heads\//,"");return gm($).filter(({repo:J})=>T10(J.repoUrl)===Y&&J.branch===X)}class k51{source;dirty=new Set;pods=new Map;known=new Map;constructor($){this.source=$}pools(){return this.source()}resolve($){return M51(this.pools(),$)}markDirty($,Z){let Q=V51(this.pools(),$,Z).map((Y)=>Y.warmPoolName);for(let Y of Q)this.dirty.add(Y);return Q}takeDirty($){return this.dirty.delete($)}pod($){return this.pods.get($)}setPod($,Z){this.pods.set($,Z)}retainPods($,Z){for(let[Q,Y]of this.pods)if(Y.pool===$&&!Z.has(Q))this.pods.delete(Q)}retain($){let Z=new Map($.map((Y)=>[Y.warmPoolName,Y])),Q=[...this.known.values()].filter((Y)=>!Z.has(Y.warmPoolName));for(let Y of this.dirty)if(!Z.has(Y))this.dirty.delete(Y);for(let[Y,X]of this.pods)if(!Z.has(X.pool))this.pods.delete(Y);return this.known=Z,Q}}var kc4=54,Sc4,Cc4=2048,_c4,R10,ZT0,q51,fA$,xc4="studio.decocms.com/tenant-pool";var q10=D(()=>{i4();a00();Sc4=/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/;_c4=xX.object({runtime:xX.enum(["node","bun","deno"]).default("node"),packageManager:xX.enum(["npm","pnpm","yarn","bun","deno"]).optional(),packageManagerPath:xX.string().optional(),devPort:xX.number().int().positive().optional()}).default({runtime:"node"}),R10=xX.object({repoUrl:xX.string().max(Cc4).transform(($,Z)=>{let Q=_U($);if(Q)return Q;return Z.addIssue({code:"custom",message:"repoUrl must be an https clone URL"}),xX.NEVER}),branch:xX.string().min(1).default("main"),workload:_c4,replicas:xX.number().int().min(1)});ZT0=class ZT0 extends Error{poolName;size;allocated;constructor($,Z,Q){super(`pool ${$}: repos take ${Q} replicas, more than its size ${Z}`);this.poolName=$;this.size=Z;this.allocated=Q;this.name="TenantPoolCapacityError"}};q51=xX.object({name:xX.string().max(kc4).regex(Sc4,"pool name must be a DNS label (lowercase alphanumeric and '-')"),tenant:xX.string().min(1).max(512),size:xX.number().int().min(1),image:FU.default("default")}),fA$=q51.extend({repos:xX.array(R10).default([])}).superRefine(($,Z)=>{let Q=vc4($.repos);if(Q)Z.addIssue({code:"custom",path:["repos"],message:`duplicate repo allocation ${Q.repoUrl}#${Q.branch}`});let Y=xA$($.repos);if(Y>$.size)Z.addIssue({code:"custom",path:["repos"],message:new ZT0($.name,$.size,Y).message})})});async function cA$($,Z,Q){let Y=new Map;for(let X of $){let J=Z(X);if(!J)continue;let G=Y.get(J);if(G)G.push(X);else Y.set(J,[X])}await Promise.allSettled([...Y.values()].map(async(X)=>{for(let J of X)await Q(J).catch(()=>{})}))}function fc4($){try{let Z=new URL($);if(Z.hostname.toLowerCase()!=="github.com")return null;let[Q,Y]=Z.pathname.replace(/^\/+/,"").split("/"),X=Y?.replace(/\.git$/,"");return Q&&X?`${Q}/${X}`.toLowerCase():null}catch{return null}}function mA$($){if($.repositoryId)return{repositoryId:$.repositoryId};let Z=$.connectionId?fc4($.cloneUrl):null;return $.connectionId&&Z?{connectionId:$.connectionId,repo:Z}:null}var dA$=D(()=>{q10()});async function hm($,Z,Q,Y){let X=(G)=>rA0(G.url,G.token,Z,Q),J=!(Q.body instanceof ReadableStream);try{let G=await X($);if(G.status!==401||!J)return G;let W=await Y.unauthorized();if(!W)return G;return await G.body?.cancel().catch(()=>{}),await X(W)}catch(G){if(!J)throw G;let W=await Y.unreachable();if(!W)throw G;return X(W)}}var YT0=D(()=>{Gf()});function nA$($,Z){return new Response(JSON.stringify(Z),{status:$,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function iA$($){let Z=new Headers;for(let[Q,Y]of $.headers.entries())if(!gc4.includes(Q.toLowerCase()))Z.set(Q,Y);return new Response($.body,{status:$.status,statusText:$.statusText,headers:Z})}function pA$($,Z){let Q=nA$($,{error:Z});return Q.headers.set("x-sandbox-preview-not-ready","1"),Q}async function lm($,Z,Q){let Y=await Z.base();if(!Y)return pA$(404,"sandbox not found");let X=new URL($.url);if((X.pathname==="/_sandbox"||X.pathname.startsWith("/_sandbox/"))&&$.method!=="GET")return nA$(404,{error:"not found"});let G=(F)=>`${F}${X.pathname}${X.search}`,W=new Headers($.headers);for(let F of yc4)W.delete(F);let K=$.method!=="GET"&&$.method!=="HEAD",H={method:$.method,headers:W,body:K?$.body:void 0,redirect:"manual",signal:$.signal,duplex:K?"half":void 0};try{return iA$(await fetch(G(Y),H))}catch(F){let U=`${Y}${X.pathname}`;if(console.warn(`[${Q}] preview fetch to ${U} failed: ${F instanceof Error?F.message:String(F)}`),Z.invalidate(),$.method==="GET"||$.method==="HEAD"){let N=await Z.retryBase();if(N)try{return iA$(await fetch(G(N),H))}catch(B){console.warn(`[${Q}] preview fetch retry to ${U} failed: ${B instanceof Error?B.message:String(B)}`)}}return pA$(502,"sandbox daemon unreachable")}}var um="x-sandbox-preview-not-ready",yc4,gc4;var XT0=D(()=>{yc4=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length","upgrade"],gc4=["connection","keep-alive","transfer-encoding","content-encoding","content-length"]});import{createHash as hc4,randomBytes as uc4,randomUUID as tA$}from"crypto";import*as ZT$ from"net";import{PassThrough as lc4}from"stream";function oA$($){if($ instanceof Error)return $.message;if($&&typeof $==="object"){let Z=$;if(Z.error instanceof Error)return Z.error.message;if(typeof Z.message==="string"&&Z.message)return Z.message}return String($)}function aA$($){return{pool:$.warmPoolName,org:$.pool.tenant}}class f51{records=new Map;inflight=new Wf;activeGauge=new sA0;stateStore;previewUrlPattern;kubeConfig;capacityProbe;portForward;namespace;sandboxTemplateName;envName;tokenGenerator;idleTtlMs;metrics;previewGateway;sentinelToken;mintCloneUrl;mintPoolCloneUrl;mintOrgFsConfig;forwardPort;daemonAddress;persistCredentials;tenantPools;tenantPoolRefreshMs;templateProbes={};closed=!1;claimWatchAbort=new AbortController;constructor($={}){this.stateStore=$.stateStore??null,this.previewUrlPattern=$.previewUrlPattern??null,this.kubeConfig=$.kubeConfig??$m4(),this.portForward=new Q51(this.kubeConfig),this.namespace=$.namespace??cc4,this.sandboxTemplateName=$.sandboxTemplateName??mc4,this.envName=Jm4($.envName),this.tokenGenerator=$.tokenGenerator??(()=>uc4(ic4).toString("hex")),this.idleTtlMs=$.idleTtlMs??nc4,this.metrics=$.meter?ec4($.meter):null,this.previewGateway=$.previewGateway&&$.previewUrlPattern?{...$.previewGateway}:null;let Z=$.sentinelToken?.trim()??"";this.sentinelToken=Z.length>0?Z:null,this.mintCloneUrl=$.mintCloneUrl,this.mintPoolCloneUrl=$.mintPoolCloneUrl,this.mintOrgFsConfig=$.mintOrgFsConfig,this.forwardPort=$.forwardPort,this.daemonAddress=$.daemonAddress??"forward",this.persistCredentials=$.persistCredentials??!0;let Q=$.tenantPools;if(this.tenantPools=this.sentinelToken===null?null:new k51(typeof Q==="function"?Q:()=>Q??[]),this.sentinelToken===null&&(typeof Q==="function"||(Q?.length??0)>0))console.warn(`[${T6}] tenant pools configured without a sentinel token \u2014 ignoring them (warm-pool mode is off)`);this.tenantPoolRefreshMs=$.tenantPoolRefreshMs??oc4,this.startClaimReaper(),this.startCredentialRefresher(),this.startTenantPoolReconciler()}startClaimReaper(){let $=["app.kubernetes.io/managed-by=studio","app.kubernetes.io/name=studio-sandbox",...this.envName?[`${fX.env}=${this.envName}`]:[]].join(",");vA$({kc:this.kubeConfig,namespace:this.namespace,labelSelector:$,signal:this.claimWatchAbort.signal,onDelete:(Z)=>this.invalidateRecord(Z)})}async ensure($,Z={}){let Q=F3($);if(Q.startsWith("s-"))throw Error(`ensure: projectRef has no slug source: ${$.projectRef}`);return this.inflight.run(Q,()=>aA0(this.stateStore,$,(Y)=>this.ensureLocked($,Q,Z,Y)))}async delete($){let Z=await this.getRecord($);if(this.records.delete($),Z)this.dropRecord(Z);if(await this.deleteHttpRouteIfManaged($).catch((Q)=>{console.warn(`[${T6}] HTTPRoute delete failed for ${$}: ${Q instanceof Error?Q.message:String(Q)}`)}),await vA(this.kubeConfig,this.namespace,$),this.stateStore)if(Z)await this.stateStore.delete(Z.id);else await this.stateStore.deleteByHandle($)}lastTermination($){return xL$(this.kubeConfig,this.namespace,fX.sandboxHandle,$,dZ.MAIN_CONTAINER_NAME)}async alive($){return await wD(this.kubeConfig,this.namespace,$)!==void 0}watchClaimLifecycle($,Z){return CA$({kc:this.kubeConfig,namespace:this.namespace,claimName:$,signal:Z})}hasSchedulableCapacity(){return this.capacityProbe??=pL$(this.kubeConfig,this.namespace),this.capacityProbe()}async getPreviewUrl($){let Z=await this.getRecord($);if(!Z)return null;return this.composePreviewUrl(Z)}async proxyDaemonRequest($,Z,Q){let Y=await this.getRecord($);if(!Y&&this.previewUrlPattern&&this.stateStore){let K=await this.stateStore.getByHandle($),H=K?.state,F=H?.token;if(K&&F){let N=`http://${H?.adoptedSandboxName??$}.${this.namespace}.svc.cluster.local:${vU}`;try{let B=await rA0(N,F,Z,Q);if(B.status!==404)return B;try{await B.body?.cancel()}catch{}}catch{}}}if(!Y)Y=await this.resurrectByHandle($);if(!Y)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let X=Y,J=performance.now(),G=0,W=(K)=>{return X=K,{url:K.daemonUrl,token:K.token}};try{let K=await hm(W(Y),Z,Q,{unauthorized:async()=>{this.invalidateRecord($);let H=await this.getRecord($).catch(()=>null)??await this.resurrectByHandle($).catch(()=>null);return H?W(H):null},unreachable:async()=>{this.invalidateRecord($);let H=await this.resurrectByHandle($)??await this.getRecord($).catch(()=>null);return H?W(H):null}});return G=K.status,K}finally{this.recordProxyDuration("daemon",G,X,performance.now()-J)}}async adoptLiveClaim($,Z){if(this.records.has(Z))return!0;let Q=await wD(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!Q||Q.metadata?.deletionTimestamp)return!1;return await this.inflight.run(Z,async()=>{let X=this.records.get(Z);if(X)return this.toSandbox(X);let J=await this.adopt($,Z,Q);if(!J)throw Error(`cannot adopt live claim ${Z}`);return aA0(this.stateStore,$,(G)=>this.finish(J,G,!0,!0,"adopt"))}).catch(()=>null)!=null}async resolvePreviewUpstreamUrl($){if(this.previewUrlPattern)return`http://${await this.resolveServiceNameForHandle($)}.${this.namespace}.svc.cluster.local:${vU}`;let Z=await this.getRecord($);if(Z)return Z.daemonUrl;let Q=await this.resurrectByHandle($);return Q?Q.daemonUrl:null}async daemonEndpoint($){let Z=await this.getRecord($)??await this.resurrectByHandle($);if(!Z)return null;return{url:this.daemonAddress==="service"?`http://${Z.adoptedSandboxName}.${this.namespace}.svc.cluster.local:${vU}`:Z.daemonUrl,token:Z.token}}listSandboxes(){return[...this.records.values()].map(($)=>{let Z=$.ensureOpts,Q=Z?.tenant;return{handle:$.handle,tenant:Q?{orgId:Q.orgId,userId:Q.userId}:null,repos:[Z?.repo,...Z?.extraRepos??[]].filter((Y)=>Y!==void 0).map(mA$).filter((Y)=>Y!==null),orgFs:Boolean(Z?.orgFsConfigJson)||$.orgFsRedacted===!0}})}async resolveServiceNameForHandle($){let Z=this.records.get($);if(Z)return Z.adoptedSandboxName;if(this.stateStore){let Y=(await this.stateStore.getByHandle($).catch(()=>null))?.state?.adoptedSandboxName;if(Y)return Y}return $}async proxyPreviewRequest($,Z){let Q=performance.now(),Y=this.records.get($)??null,X=0;try{let J=await lm(Z,{base:()=>this.resolvePreviewUpstreamUrl($),invalidate:()=>this.invalidateRecord($),retryBase:async()=>{return await this.resurrectByHandle($).catch(()=>null)?this.resolvePreviewUpstreamUrl($):null}},T6);return X=J.status,J}finally{this.recordProxyDuration("preview",X,Y,performance.now()-Q,$)}}async ensureLocked($,Z,Q,Y){if(Q.image)console.warn(`[${T6}] opts.image ignored (template ${this.sandboxTemplateName} pins image): got ${Q.image}`);if(Y){let G=await Y.get($);if(G){let W=await this.rehydrate($,Z,G);if(W)return await this.refreshDaemonGitCredential(W,Q),await this.relayOrgFsConfig(W.daemonUrl,W.token,Q.orgFsConfigJson),this.finish(W,Y,!1,!0,"resume");await Y.delete($)}}let X=await wD(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(X)if(X.metadata?.deletionTimestamp)await Z10(this.kubeConfig,this.namespace,Z).catch((G)=>{console.warn(`[${T6}] wait for terminating claim ${Z} failed: ${G instanceof Error?G.message:String(G)}`)});else if(!S51(X)){let G=await this.join($,Z,Q,X).catch((W)=>{return console.warn(`[${T6}] join of starting claim ${Z} failed, recreating: ${W instanceof Error?W.message:String(W)}`),null});if(G)return this.finish(G,Y,!0,!0,"adopt");await vA(this.kubeConfig,this.namespace,Z).catch(()=>{}),await Z10(this.kubeConfig,this.namespace,Z).catch((W)=>{console.warn(`[${T6}] wait for deleted claim ${Z} failed: ${W instanceof Error?W.message:String(W)}`)})}else{let G=await this.adopt($,Z,X).catch((W)=>{return console.warn(`[${T6}] adopt ${Z} failed, recreating: ${W instanceof Error?W.message:String(W)}`),null});if(G)return await this.refreshDaemonGitCredential(G,Q),await this.relayOrgFsConfig(G.daemonUrl,G.token,Q.orgFsConfigJson),this.finish(G,Y,!0,!0,"adopt");await vA(this.kubeConfig,this.namespace,Z).catch(()=>{}),await Z10(this.kubeConfig,this.namespace,Z).catch((W)=>{console.warn(`[${T6}] wait for deleted claim ${Z} failed: ${W instanceof Error?W.message:String(W)}`)})}let J=await this.provision($,Z,Q);return this.finish(J,Y,!0,!1,"fresh")}async finish($,Z,Q,Y,X){let J=this.records.get($.handle),G=J!==void 0;if(J&&J.daemonForward!==$.daemonForward)this.closeForwarder(J.daemonForward);if(this.records.set($.handle,$),Q)await this.persist(Z,$);if(Y)await SH0(this.kubeConfig,this.namespace,$.handle,this.computeShutdownTime()).catch((W)=>console.warn(`[${T6}] TTL refresh failed for ${$.handle}: ${W instanceof Error?W.message:String(W)}`));if(this.metrics){let W=v51($.tenant);if(this.metrics.ensureOutcome.add(1,{...W,outcome:X}),!G)this.metrics.active.add(1,W),this.activeGauge.markCounted($.handle)}return this.toSandbox($)}buildEnvMap($,Z){let Q={},Y=[];for(let[X,J]of Object.entries($.env??{}))if(pc4.has(X))Y.push(X);else Q[X]=J;if(Y.length>0)console.warn(`[${T6}] opts.env keys overlap reserved bootstrap names and were dropped: ${Y.join(",")}`);return{...Q,DAEMON_TOKEN:Z.token,DAEMON_BOOT_ID:Z.daemonBootId,APP_ROOT:Z.workdir,PROXY_PORT:String(vU)}}async resolveTemplateName($,Z,Q){let{name:Y,probes:X}=await I51({purpose:$,tenantPool:Z,...Q?{sandboxImage:Q}:{},templateName:this.sandboxTemplateName,probes:this.templateProbes,now:Date.now(),ttlMs:dc4,exists:(J)=>CL$(this.kubeConfig,this.namespace,J),onAbsent:(J)=>console.warn(`[${T6}] SandboxTemplate ${J} not found (or not readable) \u2014 this claim falls back to a template without that suffix. Upgrade the sandbox-env chart to the version that renders it.`)});return this.templateProbes=X,Y}buildClaim($,Z,Q,Y,X){let J=this.sentinelToken!==null,G=J?[]:Object.entries(this.buildEnvMap(Z,Q)).sort(([H],[F])=>H<F?-1:H>F?1:0).map(([H,F])=>({name:H,value:F})),W=Km4(Z),K=Object.keys(W).length>0;return{apiVersion:`${dZ.CLAIM_API_GROUP}/${dZ.CLAIM_API_VERSION}`,kind:"SandboxClaim",metadata:{name:$,namespace:this.namespace,labels:{"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[fX.env]:this.envName}:{},..._51(Z.tenant)},...K?{annotations:W}:{}},spec:{sandboxTemplateRef:{name:X},additionalPodMetadata:{labels:_51(Z.tenant,{[fX.role]:"claimed",[fX.sandboxHandle]:$,...this.envName?{[fX.env]:this.envName}:{}}),...K?{annotations:W}:{}},env:G,warmpool:uA$(Y,J,X),lifecycle:{shutdownPolicy:"Delete",shutdownTime:this.computeShutdownTime()}}}}async provision($,Z,Q){let Y=this.tokenGenerator(),X=tA$(),J=JT0,G=this.claimTenantPoolBinding(Q),W=this.buildClaim(Z,Q,{token:Y,daemonBootId:X,workdir:J},G,await this.resolveTemplateName(Q.purpose,G!==null,Q.sandboxImage));try{await T41(this.kubeConfig,this.namespace,W)}catch(K){if(K instanceof s00)await Z10(this.kubeConfig,this.namespace,Z),await T41(this.kubeConfig,this.namespace,W);else throw K}return this.bind($,Z,Q,G,{token:Y,daemonBootId:X,workdir:J})}claimTenantPoolBinding($){return this.tenantPools?.resolve({tenant:QT0($),image:$.sandboxImage??"default",cloneUrl:$.repo?.cloneUrl,branch:$.repo?.branch})??null}async bind($,Z,Q,Y,{token:X,daemonBootId:J,workdir:G}){let W;try{W=await _L$(this.kubeConfig,this.namespace,Z),await _A$((B)=>this.watchClaimLifecycle(Z,B))}catch(B){throw await vA(this.kubeConfig,this.namespace,Z).catch(()=>{}),B}try{await this.ensureServicePortForAdoptedSandbox(W),await this.ensureHttpRouteForHandle(Z,W,Q.tenant??null)}catch(B){throw await vA(this.kubeConfig,this.namespace,Z).catch(()=>{}),B}let K=await this.openForwarder(W,vU,Z),H=`http://127.0.0.1:${K.localPort}`,F=Y?.repo!=null&&W!==Z,U=this.workloadConfigPayload(Q,F),N=J;try{if(await A51(H),this.sentinelToken!==null){let B=await oA0(H);if(B)N=B.bootId;try{await CU(H,this.sentinelToken,U??{},{rotateToken:X})}catch(O){if(O instanceof PH&&O.status===401)console.warn(`[${T6}] sentinel rejected by adopted pod (handle=${Z}, sandbox=${W}): pod belongs to another claim; tearing down and reprovisioning`);throw O}}else if(U)await CU(H,X,U);await this.relayOrgFsConfig(H,X,Q.orgFsConfigJson)}catch(B){throw this.closeForwarder(K),await this.deleteHttpRouteIfManaged(Z).catch(()=>{}),await vA(this.kubeConfig,this.namespace,Z).catch(()=>{}),B}return{id:$,handle:Z,adoptedSandboxName:W,token:X,workdir:G,daemonUrl:H,daemonForward:K,workload:Q.workload??null,daemonBootId:N,tenant:Q.tenant??null,tenantPoolPodBound:F,ensureOpts:Dm4(Q)}}workloadConfigPayload($,Z){return fm({runtime:$?.workload?.runtime??"node",packageManager:$?.workload?.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:$?.repo??null,extraRepos:$?.extraRepos??[],port:$?.workload?.devPort??rA$,tenant:$?.tenant??void 0,...$?{cloneOnly:$.cloneOnly===!0&&!Z}:{}})}async relayOrgFsConfig($,Z,Q){if(!Q)return;await z10($,Z,Q).catch((Y)=>console.warn("[org-fs] sidecar config relay failed",Y))}async refreshDaemonGitCredential($,Z){let Q=A10(Z);if(!Q)return;try{await CU($.daemonUrl,$.token,Q)}catch(Y){console.warn(`[${T6}] git credential refresh failed for ${$.handle}: ${Y instanceof Error?Y.message:String(Y)}`)}}async withFreshCloneUrl($,Z={}){if(!this.mintCloneUrl)return $;try{let Q=await this.mintCloneUrl($,Z);if(!Q)return $;let{credentialExpiresAt:Y,...X}=$;return{...X,cloneUrl:Q}}catch(Q){return console.warn(`[${T6}] clone credential re-mint failed: ${Q instanceof Error?Q.message:String(Q)}`),$}}async withFreshCredentials($,Z=!1){return{...$,...$.repo?{repo:await this.withFreshCloneUrl($.repo,{tenant:$.tenant})}:{},...$.orgFsConfigJson||Z?{orgFsConfigJson:await Nm4($,this.mintOrgFsConfig)}:{}}}startCredentialRefresher(){if(!this.mintCloneUrl)return;let{signal:$}=this.claimWatchAbort;(async()=>{while(!$.aborted){if(await O$(rc4,{signal:$}).catch(()=>{}),$.aborted)break;try{await this.refreshAllGitCredentials()}catch(Z){console.warn(`[${T6}] periodic credential refresh failed: ${Z instanceof Error?Z.message:String(Z)}`)}}})()}startTenantPoolReconciler(){let $=this.tenantPools;if(!$)return;let{signal:Z}=this.claimWatchAbort;(async()=>{while(!Z.aborted){try{await this.reconcileTenantPools($)}catch(Q){console.warn(`[${T6}] tenant pool reconcile failed: ${Q instanceof Error?Q.message:String(Q)}`)}await O$(tc4,{signal:Z}).catch(()=>{})}})()}listTenantPools(){return this.tenantPools?.pools()??[]}markTenantPoolsDirty($,Z){return Promise.resolve(this.tenantPools?.markDirty($,Z)??[])}async reconcileTenantPools($){let Z=gm($.pools());for(let Q of $.retain(Z))this.recordPoolGone(Q);for(let Q of Z){let Y=Q.warmPoolName,X=await vL$(this.kubeConfig,this.namespace,Y);if(X===null){console.warn(`[${T6}] tenant pool ${Y}: no SandboxWarmPool (or no selector yet) in ${this.namespace}`);continue}let J=$.takeDirty(Y),G=X.filter((W)=>!W.labels[fX.sandboxHandle]);$.retainPods(Y,new Set(X.map((W)=>W.uid)));for(let W of G){if(this.claimWatchAbort.signal.aborted)return;await this.warmPoolPod($,Q,W,J)}this.recordPoolDepth($,Q,X,G)}}recordPoolGone($){let Z=aA$($);for(let Q of["ready","bound","pending","failed"])this.metrics?.poolPods.record(0,{...Z,state:Q})}recordPoolDepth($,Z,Q,Y){let X=this.metrics?.poolPods;if(!X)return;let J=0,G=0;for(let K of Y){let H=$.pod(K.uid);if(!H)continue;if(H.failures>=GT0)G++;else if(H.lastConfigAt>0)J++}let W=aA$(Z);X.record(J,{...W,state:"ready"}),X.record(Q.length-Y.length,{...W,state:"bound"}),X.record(Y.length-J-G,{...W,state:"pending"}),X.record(G,{...W,state:"failed"})}async warmPoolPod($,Z,Q,Y){let X=Z.warmPoolName,{workload:J}=Z.repo,G=$.pod(Q.uid);if(G&&G.failures>=GT0){if(Date.now()-G.lastFailureAt<sA$)return;$.setPod(Q.uid,{...G,failures:0})}let W=Y||G!==void 0&&Date.now()-G.lastConfigAt>=this.tenantPoolRefreshMs;if(G&&!W)return;let K=await this.allocationCloneUrl(Z);if(!K){this.recordPoolFailure($,Q,X,"clone credential mint failed");return}let H={cloneUrl:K,branch:Z.repo.branch,userName:"",userEmail:""},F=await this.openForwarder(Q.name,vU,Q.name).catch(()=>null);if(!F){this.recordPoolFailure($,Q,X,"port-forward failed");return}let U=`http://127.0.0.1:${F.localPort}`;try{await A51(U);let N=this.sentinelToken;if(!N)return;if(!await this.isPoolPodUnbound(Q))return;let B=fm({runtime:J.runtime,packageManager:J.packageManager?{name:J.packageManager,...J.packageManagerPath?{path:J.packageManagerPath}:{}}:null,repo:H,port:J.devPort??rA$})??{},{transition:O}=await CU(U,N,B);if(W&&O!=="bootstrap"&&await this.isPoolPodUnbound(Q))await TA$(U,N,"clone");$.setPod(Q.uid,{pool:X,lastConfigAt:Date.now(),lastFailureAt:0,failures:0}),console.log(`[${T6}] tenant pool ${X}: warmed ${Q.name} (${O})`)}catch(N){this.recordPoolFailure($,Q,X,N instanceof Error?N.message:String(N))}finally{this.closeForwarder(F)}}async allocationCloneUrl({pool:$,repo:Z}){if(!this.mintPoolCloneUrl)return`${Z.repoUrl}.git`;try{return await this.mintPoolCloneUrl({tenant:$.tenant,repoUrl:Z.repoUrl,branch:Z.branch})}catch(Q){return console.warn(`[${T6}] tenant pool clone credential mint failed: ${Q instanceof Error?Q.message:String(Q)}`),null}}isPoolPodUnbound($){return bL$(this.kubeConfig,this.namespace,$.name,fX.sandboxHandle)}recordPoolFailure($,Z,Q,Y){let X=$.pod(Z.uid),J=(X?.failures??0)+1;$.setPod(Z.uid,{pool:Q,lastConfigAt:X?.lastConfigAt??0,lastFailureAt:Date.now(),failures:J});let G=J>=GT0?` \u2014 backing off ${sA$/60000}min`:"";console.warn(`[${T6}] tenant pool ${Q}: warming ${Z.name} failed (${J}/${GT0})${G}: ${Y}`)}async refreshAllGitCredentials(){await cA$(this.records.values(),($)=>$.ensureOpts?.repo?.connectionId,async($)=>{if(this.claimWatchAbort.signal.aborted)return;let Z=$.ensureOpts?.repo;if(!Z)return;try{let Q=await this.withFreshCloneUrl(Z,{bufferMs:sc4,tenant:$.ensureOpts?.tenant});await this.refreshDaemonGitCredential($,{...$.ensureOpts,repo:Q}),$.ensureOpts={...$.ensureOpts,repo:Q}}catch(Q){throw console.warn(`[${T6}] git credential refresh failed for ${$.handle}: ${Q instanceof Error?Q.message:String(Q)}`),Q}})}async rebootstrapDaemon($,Z,Q){if(this.sentinelToken===null)return!1;let Y=this.workloadConfigPayload(Q,!1)??{};try{return await CU($,this.sentinelToken,Y,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,Q?.orgFsConfigJson),!0}catch(X){if(X instanceof PH&&X.status===401)try{return await CU($,Z,Y,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,Q?.orgFsConfigJson),!0}catch(J){return console.warn(`[${T6}] re-bootstrap retry with claim token failed: ${J instanceof Error?J.message:String(J)}`),!1}return console.warn(`[${T6}] re-bootstrap failed: ${X instanceof Error?X.message:String(X)}`),!1}}async ensureServicePortForAdoptedSandbox($){if(!this.previewGateway||!this.previewUrlPattern)return;await mL$(this.kubeConfig,this.namespace,$,{name:"daemon",port:vU,targetPort:vU})}async ensureHttpRouteForHandle($,Z,Q){if(!this.previewGateway||!this.previewUrlPattern)return;let Y=Om4(this.previewUrlPattern,$);if(!Y)throw new vY(`Unable to derive preview hostname for ${$} from pattern: ${this.previewUrlPattern}`);let X={apiVersion:`${q41.API_GROUP}/${q41.API_VERSION}`,kind:"HTTPRoute",metadata:{name:$,namespace:this.namespace,labels:_51(Q??void 0,{[fX.role]:"claimed",[fX.sandboxHandle]:$,"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[fX.env]:this.envName}:{}})},spec:{parentRefs:[{kind:"Gateway",group:"gateway.networking.k8s.io",name:this.previewGateway.name,namespace:this.previewGateway.namespace}],hostnames:[Y],rules:[{backendRefs:[{group:"",kind:"Service",name:Z,port:vU}]}]}};await uL$(this.kubeConfig,this.namespace,X)}async deleteHttpRouteIfManaged($){if(!this.previewGateway)return;await lL$(this.kubeConfig,this.namespace,$)}async rehydrate($,Z,Q){let Y=Q.state;if(!Y.adoptedSandboxName&&!Y.podName||!Y.token)return null;let X=await wD(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!X||!S51(X))return null;let J=X.status?.sandbox?.name??Y.adoptedSandboxName??Y.podName??Z,G=await this.openAndProbeDaemon(J,Z);if(!G)return null;if(Y.daemonBootId&&Y.daemonBootId!==G.bootId){if(this.sentinelToken!==null){let W=Y.ensureOpts?await this.withFreshCredentials(Y.ensureOpts,Y.orgFsRedacted===!0):null;if(!await this.rebootstrapDaemon(G.daemonUrl,Y.token,W))return this.closeForwarder(G.daemonForward),null}else console.warn(`[${T6}] daemon restart detected (handle=${Z}): stored bootId=${Y.daemonBootId} live bootId=${G.bootId}`);await this.stateStore?.put($,{handle:Z,state:{...Y,daemonBootId:G.bootId}}).catch((W)=>console.warn(`[${T6}] bootId persist failed for ${Z}: ${W instanceof Error?W.message:String(W)}`))}return{id:$,handle:Z,adoptedSandboxName:J,tenantPoolPodBound:!1,token:Y.token,workdir:Y.workdir??JT0,daemonUrl:G.daemonUrl,daemonForward:G.daemonForward,workload:Y.workload??null,daemonBootId:G.bootId,tenant:Y.tenant??null,ensureOpts:Y.ensureOpts??null,orgFsRedacted:Y.orgFsRedacted===!0}}join($,Z,Q,Y){let X=this.sentinelToken!==null,J=X?this.tokenGenerator():C51(Y,"DAEMON_TOKEN"),G=X?tA$():C51(Y,"DAEMON_BOOT_ID");if(!J||!G)throw new vY(`claim ${Z} carries no daemon token`);return this.bind($,Z,Q,this.claimTenantPoolBinding(Q),{token:J,daemonBootId:G,workdir:JT0})}async adopt($,Z,Q){if(!S51(Q))return null;let Y=Q.status?.sandbox?.name??Z;if(this.sentinelToken!==null)return null;let X=C51(Q,"DAEMON_TOKEN");if(!X)return null;let J=await this.openAndProbeDaemon(Y,Z);if(!J)return null;let G=Hm4(Q);if(this.previewGateway)await this.ensureServicePortForAdoptedSandbox(Y).catch((W)=>{console.warn(`[${T6}] Service port backfill failed for ${Z}: ${W instanceof Error?W.message:String(W)}`)}),await this.ensureHttpRouteForHandle(Z,Y,G).catch((W)=>{console.warn(`[${T6}] HTTPRoute backfill failed for ${Z}: ${W instanceof Error?W.message:String(W)}`)});return{id:$,handle:Z,adoptedSandboxName:Y,tenantPoolPodBound:!1,token:X,workdir:JT0,daemonUrl:J.daemonUrl,daemonForward:J.daemonForward,workload:null,daemonBootId:J.bootId,tenant:G,ensureOpts:null}}async openAndProbeDaemon($,Z){let Q=await this.openForwarder($,vU,Z).catch(()=>null);if(!Q)return null;let Y=`http://127.0.0.1:${Q.localPort}`,X=await oA0(Y);if(!X)return this.closeForwarder(Q),null;return{daemonForward:Q,daemonUrl:Y,bootId:X.bootId}}async getRecord($){let Z=this.records.get($);if(Z)return Z;if(!this.stateStore)return null;let Q=await this.stateStore.getByHandle($);if(!Q)return null;let Y=await this.rehydrate(Q.id,$,Q);if(Y)this.records.set($,Y);return Y}async resurrectByHandle($){if(!this.stateStore)return null;let Z=await this.stateStore.getByHandle($);if(!Z)return null;let Q=Z.state,Y=Q.ensureOpts;if(!Y)return null;let X=await this.withFreshCredentials(Y,Q.orgFsRedacted===!0);if(F3(Z.id)!==$)return null;return await this.ensure(Z.id,X),this.records.get($)??null}invalidateRecord($){let Z=this.records.get($);if(!Z)return;this.records.delete($),this.dropRecord(Z)}dropRecord($){if(this.closeForwarder($.daemonForward),this.metrics&&this.activeGauge.consume($.handle))this.metrics.active.add(-1,v51($.tenant))}recordProxyDuration($,Z,Q,Y,X){if(!this.metrics)return;this.metrics.proxyDurationMs.record(Y,{...v51(Q?.tenant??null),source:$,sandbox_handle:Q?.handle??X??"",status_code:Z||0})}composePreviewUrl($){if(this.previewUrlPattern)return eA0(this.previewUrlPattern,$.handle);return`http://127.0.0.1:${$.daemonForward.localPort}/`}toSandbox($){return{handle:$.handle,workdir:$.workdir,previewUrl:this.composePreviewUrl($),warmPoolAdopted:$.tenantPoolPodBound===!0,provider:"kubernetes"}}async persist($,Z){if(!$)return;let Q={adoptedSandboxName:Z.adoptedSandboxName,token:Z.token,workdir:Z.workdir,workload:Z.workload,daemonBootId:Z.daemonBootId,tenant:Z.tenant,...Z.ensureOpts?this.persistCredentials?{ensureOpts:Z.ensureOpts}:Bm4(Z.ensureOpts,Z.orgFsRedacted===!0):{}};await $.put(Z.id,{handle:Z.handle,state:Q})}computeShutdownTime(){return new Date(Date.now()+this.idleTtlMs).toISOString()}async releaseAfter($,Z){let Q=await wD(this.kubeConfig,this.namespace,$);if(!Q)return;let Y=Fm4(Q.spec?.lifecycle?.shutdownTime,new Date(Date.now()+Z));if(!Y)return;await SH0(this.kubeConfig,this.namespace,$,Y).catch((X)=>console.warn(`[${T6}] release failed for ${$}: ${X instanceof Error?X.message:String(X)}`))}async renewTtl($){let Z=await wD(this.kubeConfig,this.namespace,$);if(!Z)return;let Q=Um4(Z.spec?.lifecycle?.shutdownTime,new Date(Date.now()+this.idleTtlMs));if(!Q)return;await SH0(this.kubeConfig,this.namespace,$,Q).catch((Y)=>console.warn(`[${T6}] TTL renew failed for ${$}: ${Y instanceof Error?Y.message:String(Y)}`))}openForwarder($,Z,Q=$){if(this.forwardPort)return this.forwardPort($,Z,Q);let Y=Zm4(Q,Z);return new Promise((X,J)=>{let G=(W,K)=>{let H=ZT$.createServer((F)=>this.handleForwardedConnection(F,$,Z,Q));H.once("error",(F)=>{if(F.code==="EADDRINUSE"&&K<ac4){try{H.close()}catch{}let U=b51+(W-b51+1)%QT$;G(U,K+1);return}J(F)}),H.listen(W,"127.0.0.1",()=>{let F=H.address();if(!F||typeof F==="string"){H.close(),J(Error("port-forward listener failed to bind"));return}let U=F.port;X({localPort:U,close:()=>H.close((N)=>{if(N)console.warn(`[${T6}] port-forward close on :${U} errored: ${N.message}`)})})})};G(Y,0)})}handleForwardedConnection($,Z,Q,Y){let X=new lc4,J=null,G=!1,W=()=>{if(G)return;if(G=!0,X.destroy(),J)try{J.close()}catch{}if(!$.destroyed)$.destroy()};$.pipe(X),$.on("error",W),$.on("close",W),this.portForward.portForward(this.namespace,Z,[Q],$,null,X).then((K)=>{let H=typeof K==="function"?K():K;if(!H){W();return}if(J=H,J.on("close",W),J.on("error",(F)=>{console.warn(`[${T6}] port-forward to ${Z}:${Q} dropped mid-connection: ${oA$(F)}`,JSON.stringify(x51(F))),this.invalidateRecord(Y),W()}),G)try{J.close()}catch{}}).catch((K)=>{console.warn(`[${T6}] port-forward to ${Z}:${Q} failed: ${oA$(K)}`,JSON.stringify(x51(K))),this.invalidateRecord(Y),W()})}closeForwarder($){$.close()}close(){if(this.closed)return;this.closed=!0,this.claimWatchAbort.abort();for(let $ of this.records.values())this.dropRecord($);this.records.clear()}}function ec4($){return{active:$.createUpDownCounter("studio.sandbox.active",{description:"Active sandbox count, by runner kind, owning org, and daemon impl. Cross-checks the cAdvisor-derived count from the cluster \u2014 divergence between the two indicates orphaned claims (studio deleted but K8s didn't reap) or unattributed pods.",unit:"{sandbox}"}),ensureOutcome:$.createCounter("studio.sandbox.ensure.outcome",{description:"Outcome of each ensure() call: fresh provision, resume from state-store after restart, or adopt of a cluster-side claim studio didn't know about. Cold-start ratio is the primary input for warm-pool sizing.",unit:"{call}"}),proxyDurationMs:$.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of studio-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"}),poolPods:$.createGauge("studio.sandbox.pool.pods",{description:"Tenant warm pool depth by pool and state: ready (warmed and unbound \u2014 what a claim can actually bind instantly), bound (serving a user), pending (unbound, not yet warmed), failed (gave up after repeated bootstrap failures). Alert on sustained ready=0: a pool that is always empty is doing nothing while costing N pods.",unit:"{pod}"})}}function x51($){let Z=[],Q=$;for(let Y=0;Y<5&&Q instanceof Error;Y++){let X=Q;if(Z.push({name:X.name,message:X.message,...X.code!==void 0?{code:X.code}:{},...X.errno!==void 0?{errno:X.errno}:{}}),X.cause===Q)break;Q=X.cause}if(Q!==void 0&&!(Q instanceof Error)&&Q!==null){let Y=Q,X=Y.error instanceof Error?x51(Y.error).chain:void 0;Z.push({nonError:String(Q),...typeof Y.type==="string"?{type:Y.type}:{},...typeof Y.message==="string"?{message:Y.message}:{},...Y.code!==void 0?{code:Y.code}:{},...typeof Y.reason==="string"?{reason:Y.reason}:{},...X?{error:X}:{},...X===void 0&&Y.error!==void 0?{rawError:String(Y.error)}:{},keys:Object.keys(Y)})}return{chain:Z}}function $m4(){let $=new CA0;return $.loadFromDefault(),$}function S51($){return Boolean($.status?.conditions?.some((Z)=>Z.type==="Ready"&&Z.status==="True"))}function C51($,Z){let Q=$.spec?.env;if(!Q)return null;for(let Y of Q)if(Y.name===Z&&Y.value)return Y.value;return null}function Zm4($,Z){let Q=hc4("sha256").update(`${$}:${Z}`).digest();return b51+Q.readUInt32BE(0)%QT$}function eA$($){let Z=$.slice(0,Ym4);return Qm4.test(Z)?Z:""}function Jm4($){if($===void 0)return null;let Z=$.trim();if(Z==="")return null;if(!Xm4.test(Z))throw Error(`AgentSandboxProvider: envName=${JSON.stringify(Z)} is not a valid DNS-label-safe environment name (lowercase alphanumeric or '-', starts with a letter, ends alphanumeric, \u226432 chars). Studio sets this from STUDIO_ENV; check the studio chart's configMap.`);return Z}function _51($,Z={}){let Q={...Z};if($){let Y=eA$($.orgId),X=eA$($.userId);if(Y)Q[fX.orgId]=Y;if(X)Q[fX.userId]=X}return Q}function Kf($){let Z="";for(let Q of $){let Y=Q.codePointAt(0)??0;Z+=Y<32||Y===127?" ":Q}return Z.slice(0,Gm4)}function Wm4($){try{let Z=new URL($);return Z.username="",Z.password="",Z.toString()}catch{return""}}function Km4($){let Z={},Q=$.tenant;if(Q?.orgSlug)Z[AH.orgSlug]=Kf(Q.orgSlug);if(Q?.orgName)Z[AH.orgName]=Kf(Q.orgName);if(Q?.userEmail)Z[AH.userEmail]=Kf(Q.userEmail);if(Q?.userName)Z[AH.userName]=Kf(Q.userName);let Y=$.repo;if(Y){if(Y.displayName)Z[AH.gitRepo]=Kf(Y.displayName);let X=Wm4(Y.cloneUrl);if(X)Z[AH.gitRepoUrl]=Kf(X);let J=$.branch??Y.branch;if(J)Z[AH.gitBranch]=Kf(J)}return Z}function Hm4($){let Z=$.metadata?.labels;if(!Z)return null;let Q=Z[fX.orgId],Y=Z[fX.userId];if(!Q||!Y)return null;let X=$.metadata?.annotations??{};return{orgId:Q,userId:Y,orgSlug:X[AH.orgSlug],orgName:X[AH.orgName],userEmail:X[AH.userEmail],userName:X[AH.userName]}}function Fm4($,Z){if($){let Q=new Date($).getTime();if(Number.isFinite(Q)&&Q<=Z.getTime())return null}return Z.toISOString()}function Um4($,Z){if($){let Q=new Date($).getTime();if(Number.isFinite(Q)&&Q>=Z.getTime())return null}return Z.toISOString()}function v51($){return{org_id:$?.orgId??"",user_id:$?.userId??"",runner_kind:"agent-sandbox"}}async function Nm4($,Z){if(!Z||!$.tenant)return $.orgFsConfigJson;try{return await Z($.tenant)??$.orgFsConfigJson}catch(Q){return console.warn(`[${T6}] org-fs credential re-mint failed: ${Q instanceof Error?Q.message:String(Q)}`),$.orgFsConfigJson}}function $T$($){try{let Z=new URL($.cloneUrl);Z.username="",Z.password="";let{submoduleCredentials:Q,credentialExpiresAt:Y,...X}=$;return{...X,cloneUrl:Z.toString()}}catch{return null}}function Bm4($,Z){let{orgFsConfigJson:Q,repo:Y,extraRepos:X,...J}=$,G=J,W=Y&&$T$(Y);if(W)G.repo=W;if(X)G.extraRepos=X.map($T$).filter((K)=>K!==null);return Q||Z?{ensureOpts:G,orgFsRedacted:!0}:{ensureOpts:G}}function Dm4($){let Z={};if($.branch)Z.branch=$.branch;if($.repo)Z.repo=$.repo;if($.workload)Z.workload=$.workload;if($.env&&Object.keys($.env).length>0)Z.env=$.env;if($.tenant)Z.tenant=$.tenant;if($.cloneOnly)Z.cloneOnly=!0;if($.purpose)Z.purpose=$.purpose;if($.sandboxImage)Z.sandboxImage=$.sandboxImage;if($.orgFsConfigJson)Z.orgFsConfigJson=$.orgFsConfigJson;return Object.keys(Z).length>0?Z:null}function Om4($,Z){try{return new URL(eA0($,Z)).hostname||null}catch{return null}}var T6="AgentSandboxProvider",cc4="agent-sandbox-system",mc4="studio-sandbox",dc4=300000,vU=9000,rA$=3000,JT0="/app",ic4=32,pc4,nc4=900000,tc4=60000,oc4=1800000,GT0=3,sA$=1800000,rc4=900000,sc4=1800000,b51=40000,QT$=1e4,ac4=256,fX,AH,Qm4,Ym4=63,Xm4,Gm4=253;var YT$=D(()=>{a$();nL$();jA$();Gf();ym();CH0();a00();bA$();q10();dA$();YT0();XT0();pc4=new Set(["DAEMON_TOKEN","DAEMON_BOOT_ID","APP_ROOT","PROXY_PORT"]);fX={role:"studio.decocms.com/role",sandboxHandle:"studio.decocms.com/sandbox-handle",orgId:"studio.decocms.com/org-id",userId:"studio.decocms.com/user-id",env:"studio.decocms.com/env"},AH={orgSlug:"studio.decocms.com/org-slug",orgName:"studio.decocms.com/org-name",userEmail:"studio.decocms.com/user-email",userName:"studio.decocms.com/user-name",gitRepo:"studio.decocms.com/git-repo",gitRepoUrl:"studio.decocms.com/git-repo-url",gitBranch:"studio.decocms.com/git-branch"},Qm4=/^([A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?)?$/;Xm4=/^[a-z]([a-z0-9-]{0,30}[a-z0-9])?$/});var XT$={};$6(XT$,{tenantPoolSchema:()=>fA$,tenantPoolRepoSchema:()=>R10,tenantPoolFieldsSchema:()=>q51,tenantPoolAllocations:()=>gm,resolveTenantPoolBinding:()=>M51,renderTenantPoolWarmPools:()=>hA$,normalizeRepoUrl:()=>_U,allocationsMatchingPush:()=>V51,TenantPoolCapacityError:()=>ZT0,PREVIEW_NOT_READY_HEADER:()=>um,AgentSandboxProvider:()=>f51});var M10=D(()=>{YT$();q10()});import{z as Hf}from"zod";function WT0($){if(!$||$.trim()==="")return[];let Z=Hf.array(Lm4).parse(JSON.parse($)),Q=new Set;for(let Y of Z){if(Q.has(Y.name))throw Error(`tenant pools: duplicate pool name ${Y.name}`);Q.add(Y.name)}return Z}function JT$($){let Z=_U(`https://github.com/${$.repo}`);if(!Z)throw Error(`tenant pools: bad repo ${$.repo}`);return Z}function GT$($){return $.map((Z)=>({name:Z.name,tenant:Z.orgId,size:1,image:"default",repos:[{repoUrl:JT$(Z),branch:Z.branch,workload:Z.workload,replicas:1,warmPoolName:Z.name}]}))}function y51($,Z){let Q=_U(Z.repoUrl)?.toLowerCase(),Y=$.find((J)=>J.orgId===Z.tenant&&J.branch===Z.branch&&JT$(J).toLowerCase()===Q);if(!Y)return null;let X=`https://github.com/${Y.repo}.git`;return Y.connectionId?{cloneUrl:X,connectionId:Y.connectionId}:{cloneUrl:X}}function WT$($,Z){return async(Q)=>{let Y=y51($,Q);if(!Y)return null;return Y.connectionId?Z(Y):Y.cloneUrl}}var Lm4;var KT0=D(()=>{M10();Lm4=Hf.object({name:Hf.string().max(63).regex(/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/,"pool name must be a DNS label (lowercase alphanumeric and '-')"),orgId:Hf.string().min(1),repo:Hf.string().regex(/^[^/\s]+\/[^/\s]+$/,"repo must be `owner/name`"),connectionId:Hf.string().min(1).optional(),branch:Hf.string().min(1).default("main"),workload:R10.shape.workload})});function c51($,Z=Date.now()){if($===void 0)return;return $===null?Z+wm4:$.getTime()}function l51($){return JSON.stringify([$.orgId,$.userId])}function KT$($,Z){let Q=_U(Z);return Q?JSON.stringify([$,Q.toLowerCase()]):null}function Em4($,Z){return"repositoryId"in Z?$.repositoryOrgs.get(Z.repositoryId):$.connectionOrgs.get(Z.connectionId)}function HT$($){let{records:Z,now:Q}=$,Y=new Map,X=new Map,J=new Map,G=0;for(let W of $.pools)for(let{repoUrl:K,branch:H}of W.repos){let F=KT$(W.tenant,K),U=y51($.legacyPools??[],{tenant:W.tenant,repoUrl:K,branch:H});if(F&&U){if(U.connectionId)X.set(F,{tenant:W.tenant,repoUrl:K,connectionId:U.connectionId,cloneUrl:U.cloneUrl});continue}let N=F?Z.orgRepositories.get(F):void 0;if(!F||!N){G++;continue}X.set(F,{tenant:W.tenant,repoUrl:K,repositoryId:N})}for(let W of $.sandboxes){let K=W.tenant;if(!K)continue;let H=Z.members.get(l51(K));if(H===void 0){G++;continue}for(let U of W.repos){if(Em4(Z,U)!==K.orgId){G++;continue}let N="repositoryId"in U?{repositoryId:U.repositoryId}:{connectionId:U.connectionId,repo:U.repo.toLowerCase()},B={orgId:K.orgId,userId:K.userId};Y.set(JSON.stringify([B,N]),{tenant:B,repo:N})}let F=W.orgFsConfigExpiresAt;if(W.orgFs&&(F===null||F-Q<jm4))J.set(l51(K),{orgId:K.orgId,userId:K.userId,orgSlug:H})}return{clones:[...Y.values()],poolClones:[...X.values()],orgFs:[...J.values()],refused:G}}async function FT$($,Z,Q){let Y=new Set,X=new Set,J=new Set,G=new Set,W=new Set(Q.map((O)=>O.tenant)),K=new Set;for(let O of Q)for(let{repoUrl:L}of O.repos){let w=IY(L);if(w)K.add(w.path.toLowerCase())}for(let O of Z){if(O.tenant)Y.add(O.tenant.orgId),X.add(O.tenant.userId);for(let L of O.repos)if("repositoryId"in L)G.add(L.repositoryId);else J.add(L.connectionId)}let[H,F,U,N]=await Promise.all([Y.size===0?[]:$.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.organizationId as orgId","member.userId as userId","organization.slug as slug"]).where("member.organizationId","in",[...Y]).where("member.userId","in",[...X]).execute(),J.size===0?[]:$.selectFrom("connections").select(["id","organization_id"]).where("id","in",[...J]).execute(),G.size===0?[]:$.selectFrom("repositories").select(["id","organization_id"]).where("id","in",[...G]).execute(),K.size===0?[]:$.selectFrom("repositories").select(["id","organization_id","provider","host","path"]).where("organization_id","in",[...W]).where((O)=>O(O.fn("lower",["path"]),"in",[...K])).execute()]),B=new Map;for(let O of N){let L=KT$(O.organization_id,be({provider:O.provider,host:O.host,path:O.path}));if(L&&!B.has(L))B.set(L,O.id)}return{members:new Map(H.map((O)=>[l51(O),O.slug])),connectionOrgs:new Map(F.map((O)=>[O.id,O.organization_id])),repositoryOrgs:new Map(U.map((O)=>[O.id,O.organization_id])),orgRepositories:B}}function u51($){return $ instanceof Error?$.message:String($)}async function UT$($,Z,Q){let Y=0;if($.clones.length>cm||$.poolClones.length>cm||$.orgFs.length>h51)console.warn(`[sandbox-credential-push] ${$.clones.length} clone, ${$.poolClones.length} pool clone and ${$.orgFs.length} org-fs mints planned; minting the first ${cm}, ${cm} and ${h51}`);let X=await F9($.clones.slice(0,cm),g51,async(U)=>{let N="repositoryId"in U.repo?{cloneUrl:"",repositoryId:U.repo.repositoryId}:{cloneUrl:`https://github.com/${U.repo.repo}.git`,connectionId:U.repo.connectionId};try{let B=await Z.mintCloneUrl(N,{bufferMs:HT0});return B?{tenant:U.tenant,repo:U.repo,cloneUrl:B,expiresAt:Q.now+HT0}:null}catch(B){return Y++,console.warn(`[sandbox-credential-push] clone mint failed: ${u51(B)}`),null}}),J=await F9($.poolClones.slice(0,cm),g51,async(U)=>{try{let N=await Z.mintCloneUrl("repositoryId"in U?{cloneUrl:"",repositoryId:U.repositoryId}:{cloneUrl:U.cloneUrl,connectionId:U.connectionId},{bufferMs:HT0});return N?{tenant:U.tenant,repoUrl:U.repoUrl,cloneUrl:N,expiresAt:Q.now+HT0}:null}catch(N){return Y++,console.warn(`[sandbox-credential-push] pool clone mint failed: ${u51(N)}`),null}}),G=await F9($.orgFs.slice(0,h51),g51,async(U)=>{try{let N=await Z.mintOrgFsConfig(U);return N?{tenant:{orgId:U.orgId,userId:U.userId},orgFsConfigJson:N,expiresAt:Q.now+Q.orgFsLifetimeMs}:null}catch(N){return Y++,console.warn(`[sandbox-credential-push] org-fs mint failed: ${u51(N)}`),null}}),W=X.filter((U)=>U!==null),K=J.filter((U)=>U!==null),H=G.filter((U)=>U!==null),F=[];for(let U=0;U<Math.max(W.length,K.length,H.length);U+=fj)F.push({cloneUrls:W.slice(U,U+fj),poolCloneUrls:K.slice(U,U+fj),orgFsConfigs:H.slice(U,U+fj)});return{batches:F,failed:Y}}var HT0=2700000,FT0,wm4=86400000,jm4=86400000,g51=8,cm=2000,h51=200;var UT0=D(()=>{P41();M10();i4();a$();OD();KT0();FT0=WL$-3600000});var yX;var I10=D(()=>{yX=class yX extends Error{code;status;path;constructor($,Z,Q){super(Z.message||`Freestyle API error: ${Z.code}`);this.name="FreestyleApiError",this.code=Z.code,this.status=$,this.path=Q,Object.setPrototypeOf(this,yX.prototype)}}});function NT$(){return typeof process<"u"&&Boolean(process.versions?.node)}var NT0=($,Z)=>globalThis.fetch($,Z);async function zm4(){if(!NT$())return null;try{return await import("undici")}catch{return null}}async function Am4(){let $=await zm4();if(!$)return null;let Z=new $.Agent({allowH2:!0,connections:Pm4});return(Q,Y)=>$.fetch(Q,{...Y,dispatcher:Z})}function Tm4($){return(typeof $==="string"?$:$ instanceof URL?$.href:$.url).startsWith("https:")}function BT$(){let $,Z=()=>{return $??=Am4().then((Q)=>Q??NT0).catch(()=>NT0),$};return(Q,Y)=>Tm4(Q)?Z().then((X)=>X(Q,Y)):NT0(Q,Y)}var Pm4=4;var DT$=()=>{};function km4($){return new Promise((Z)=>setTimeout(Z,$))}function Sm4($){if(!$)return"";let Z=new URLSearchParams;for(let[Y,X]of Object.entries($)){if(X===void 0||X===null)continue;Z.set(Y,String(X))}let Q=Z.toString();return Q?`?${Q}`:""}function u6($){return encodeURIComponent($)}class m51{baseUrl;authenticationHeaders;fetchImpl;backgroundEligible;constructor($={}){if(this.baseUrl=($.baseUrl??Vm4).replace(/\/+$/,""),!$.fetch&&!globalThis.fetch)throw Error("No fetch implementation available. Pass `fetch` in FreestyleOptions when running on a runtime without a global fetch.");if(this.fetchImpl=$.fetch??BT$(),"identityAccessToken"in $&&$.identityAccessToken){this.authenticationHeaders={[Rm4]:$.identityAccessToken},this.backgroundEligible=!1;return}if(this.backgroundEligible=!0,"stackAccessToken"in $&&$.stackAccessToken){this.authenticationHeaders={Authorization:`Bearer ${$.stackAccessToken}`,"X-Freestyle-Team-Id":$.teamId};return}let Z=$.apiKey??globalThis.process?.env?.FREESTYLE_API_KEY;if(!Z)throw Error("No Freestyle API key provided. Pass `apiKey` in FreestyleOptions or set FREESTYLE_API_KEY.");this.authenticationHeaders={Authorization:`Bearer ${Z}`}}authHeaders(){return{...this.authenticationHeaders}}url($,Z){return`${this.baseUrl}${$}${Sm4(Z)}`}async fetch($,Z={}){let Q=new Headers(Z.headers);for(let[Y,X]of Object.entries(this.authHeaders()))if(!Q.has(Y))Q.set(Y,X);return this.fetchImpl(this.absoluteUrl($),{...Z,headers:Q})}absoluteUrl($){return/^https?:\/\//i.test($)?$:`${this.baseUrl}${$}`}async request($,Z,{query:Q,body:Y,rawBody:X,signal:J}={}){let G={...this.authHeaders()};if(this.backgroundEligible)G[OT$]=String(Mm4);let W;if(X!==void 0)G["Content-Type"]="application/octet-stream",W=X;else if(Y!==void 0)G["Content-Type"]="application/json",W=JSON.stringify(Y);let K=this.url(Z,Q),H=await this.fetchImpl(K,{method:$,headers:G,body:W,signal:J});if(this.backgroundEligible&&H.status===202)try{return await this.pollBackgroundRequest(H,Z)}catch(F){if($==="GET"&&F instanceof yX&&F.code==="BACKGROUND_RESULT_UNSTORABLE"){delete G[OT$];let U=await this.fetchImpl(K,{method:$,headers:G,body:W});return this.finalize(U,Z)}throw F}return this.finalize(H,Z)}async pollBackgroundRequest($,Z){let Q=await $.json().catch(()=>({})),Y=$.headers.get(qm4)??Q.requestId,X=Q.resultUrl??(Y?`/v5/background-requests/${u6(Y)}`:void 0);if(!X)throw new yX($.status,{code:"BACKGROUND_PROTOCOL_ERROR",message:"202 Accepted carried no background request id"},Z);let J=0;for(;;){await km4(Im4);let G;try{G=await this.fetch(X,{method:"GET"}),J=0}catch(W){if(++J>=5)throw W;continue}if(G.status===202)continue;return this.finalize(G,Z)}}async finalize($,Z){if(!$.ok){let Y;try{Y=await $.json()}catch{Y={code:"UNKNOWN_ERROR",message:await $.text().catch(()=>$.statusText)}}throw new yX($.status,Y,Z)}if($.status===204)return;let Q=await $.text();if(!Q)return;return JSON.parse(Q)}get($,Z){return this.request("GET",$,{query:Z})}post($,Z){return this.request("POST",$,{body:Z??{}})}patch($,Z){return this.request("PATCH",$,{body:Z??{}})}put($,Z){return this.request("PUT",$,{body:Z??{}})}putEmpty($){return this.request("PUT",$,{})}putBytes($,Z,Q,Y){return this.request("PUT",$,{query:Q,rawBody:Z,signal:Y})}async getBytes($,Z,Q={}){let Y={...this.authHeaders()};if(Q.range)Y.Range=Q.range;let X=await this.fetchImpl(this.url($,Z),{method:"GET",headers:Y,signal:Q.signal});if(!X.ok){let J;try{J=await X.json()}catch{J={code:"UNKNOWN_ERROR",message:await X.text().catch(()=>X.statusText)}}throw new yX(X.status,J,$)}return X}delete($,Z){return this.request("DELETE",$,{query:Z})}}var Rm4="x-freestyle-identity-access-token",OT$="x-freestyle-background-after-secs",qm4="x-freestyle-background-request-id",Mm4=5,Im4=2000,Vm4="https://api.freestyle.sh";var fW=D(()=>{I10();DT$()});class d51{client;verifications;certificates;placeholder;constructor($){this.client=$,this.verifications=new LT$($),this.certificates=new wT$($),this.placeholder=new jT$($)}async list(){let{domains:$}=await this.client.get("/v5/domains");return $}}class LT${client;constructor($){this.client=$}create($){return this.client.post("/v5/verifications",{domain:$})}async list($={}){let{verifications:Z}=await this.client.get("/v5/verifications",$);return Z}get($){return this.client.get(`/v5/verifications/${u6($)}`)}complete($){return this.client.putEmpty(`/v5/verifications/${u6($)}`)}delete($){return this.client.delete(`/v5/verifications/${u6($)}`)}}class wT${client;constructor($){this.client=$}async list(){let{certificates:$}=await this.client.get("/v5/certificates");return $}createWildcard($){return this.client.post("/v5/certificates/wildcard",{domain:$})}}class jT${client;constructor($){this.client=$}async get(){try{return await this.client.get("/v5/domains/placeholder")}catch($){if($ instanceof yX&&$.status===404)return null;throw $}}set($){return this.client.put("/v5/domains/placeholder",$)}delete(){return this.client.delete("/v5/domains/placeholder")}}var i51=D(()=>{fW();I10()});function a6($,Z){throw new n51($,Z)}function p51($){return Cm4.some((Z)=>$[Z]!==void 0)}function t51($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function vm4($,Z){let Q=Z.lastIndexOf("/");if(Q<0)a6($,`${$} \`${Z}\` is not a CIDR: expected address/prefix, e.g. 203.0.113.0/24 or 2001:db8::/32`);let Y=Z.slice(0,Q),X=Z.slice(Q+1);if(!/^\d+$/.test(X))a6($,`${$} \`${Z}\`: prefix length must be a number`);let J=Number(X),G=Y.includes(":"),W=G?128:32;if(J>W)a6($,`${$} \`${Z}\`: prefix length must be 0\u2013${W}`);if(!G&&!/^\d{1,3}(\.\d{1,3}){3}$/.test(Y))a6($,`${$} \`${Z}\`: \`${Y}\` is not an IP address`)}function AT$($,Z){if(!t51($))a6(Z,`${Z} must be an object`);for(let Y of Object.keys($))if(!ET$.includes(Y))a6(`${Z}.${Y}`,`${Z} has unknown field \`${Y}\`. Expected one of: ${ET$.join(", ")}`);let Q=$;for(let Y of["vmId","vpcId","tunnelId","cidr"]){let X=Q[Y];if(X!==void 0&&(typeof X!=="string"||X.length===0))a6(`${Z}.${Y}`,`${Z}.${Y} must be a non-empty string`)}if(Q.public!==void 0&&Q.public!==!0)a6(`${Z}.public`,`${Z}.public must be true when present: it declares the public Internet. Omit the field to match something else`);if(Q.public===!0){if(Q.vmId!==void 0)a6(`${Z}.public`,`${Z} cannot combine \`public: true\` with \`vmId\`: that would mean the VM only when reached over its public address, a distinction this API does not make yet. Use \`vmId\` alone to match the VM on any path, or \`public: true\` alone to match public addresses`);if(Q.vpcId!==void 0)a6(`${Z}.public`,`${Z} cannot combine \`public: true\` with \`vpcId\`: that would mean the network's members only when reached over their public addresses, a distinction this API does not make yet. Use \`vpcId\` alone or \`public: true\` alone`);if(Q.tunnelId!==void 0)a6(`${Z}.public`,`${Z} cannot combine \`public: true\` with \`tunnelId\`: traffic through a tunnel arrives over the tunnel, not over the public Internet. Use \`tunnelId\` alone`)}if(Q.cidr!==void 0)vm4(`${Z}.cidr`,Q.cidr);if(Q.protocol!==void 0&&!zT$.includes(Q.protocol))a6(`${Z}.protocol`,`${Z}.protocol must be one of: ${zT$.join(", ")} (got \`${String(Q.protocol)}\`)`);if(Q.port!==void 0){if(!Number.isInteger(Q.port)||Q.port<1||Q.port>65535)a6(`${Z}.port`,`${Z}.port must be an integer between 1 and 65535`);if(Q.protocol===void 0)a6(`${Z}.protocol`,`${Z}.port ${Q.port} requires ${Z}.protocol: set it to "tcp" or "udp" so the rule opens one transport rather than both`);if(!_m4.includes(Q.protocol))a6(`${Z}.port`,`${Z}.protocol "${Q.protocol}" has no ports; remove ${Z}.port ${Q.port}`)}}function qT$($,Z){if(!t51($))a6(Z||"rule",`${Z||"rule"} must be an object`);for(let Y of Object.keys($))if(!TT$.includes(Y))a6(`${Z}${Y}`,`Unknown field \`${Y}\`. Expected one of: ${TT$.join(", ")}`);let Q=$;if(Q.action===void 0)a6(`${Z}action`,`${Z}action is required. Write \`action: "allow"\` \u2014 every rule states what it does rather than defaulting to it`);if(Q.action!=="allow")a6(`${Z}action`,`${Z}action must be "allow" (got \`${String(Q.action)}\`). Only allow rules exist today`);if(Q.description!==void 0){if(typeof Q.description!=="string")a6(`${Z}description`,"description must be a string");if(Q.description.length>PT$)a6(`${Z}description`,`description is too long (${Q.description.length} characters, maximum ${PT$})`)}if(Q.source===void 0)a6(`${Z}source`,`${Z}source is required`);if(Q.destination===void 0)a6(`${Z}destination`,`${Z}destination is required`);return AT$(Q.source,`${Z}source`),AT$(Q.destination,`${Z}destination`),Q}function bm4($){let Z=qT$($,"");for(let Q of["source","destination"]){let Y=Z[Q];if(p51(Y))continue;let X=[Y.port!==void 0?`port ${Y.port}`:void 0,Y.protocol!==void 0?`protocol ${Y.protocol}`:void 0].filter(Boolean).join(", ");a6(Q,X?`${Q} only narrows traffic (${X}) without saying what it is. Add \`vmId\`, \`vpcId\`, \`tunnelId\`, \`cidr\`, or \`public: true\`. Leaving it out to mean "this VM" only works inside vms.create`:`${Q} is empty. A matcher must say what the traffic is: \`vmId\`, \`vpcId\`, \`tunnelId\`, \`cidr\`, or \`public: true\` for the public Internet`)}return Z}function BT0($,Z="VM"){if($===void 0||$===null)a6("firewall",`firewall is required on a ${Z} create. A ${Z} gets nothing implicitly, so state what it may reach \u2014 \`{ rules: [] }\` if the answer is nothing`);if(!t51($))a6("firewall","firewall must be an object with a `rules` array");for(let Y of Object.keys($))if(Y!=="rules")a6(`firewall.${Y}`,`firewall has unknown field \`${Y}\`. Expected: rules`);let Q=$.rules;if(!Array.isArray(Q))a6("firewall.rules","firewall.rules must be an array");return Q.forEach((Y,X)=>{let J=`firewall.rules[${X}].`,G=qT$(Y,J),W=p51(G.source),K=p51(G.destination);if(!W&&!K&&Z!=="network")a6(`firewall.rules[${X}]`,`firewall.rules[${X}]: both source and destination refer to the ${Z} being created, which allows nothing. Give one of them a \`vmId\`, \`vpcId\`, \`tunnelId\`, \`cidr\`, or \`public: true\``);if(W&&K)a6(`firewall.rules[${X}]`,`firewall.rules[${X}]: neither end refers to the ${Z} being created. Leave one endpoint's identity unset so it means this ${Z}, or create the rule with firewall.rules.create instead`)}),$}function RT$($){return`/v5/firewall/rules/${u6($)}`}class MT${client;constructor($){this.client=$}async create($){let Z=bm4($);return this.client.post("/v5/firewall/rules",Z)}list($={}){return this.client.get("/v5/firewall/rules",$)}get($){return this.client.get(RT$($))}delete($){return this.client.delete(RT$($))}}class o51{client;rules;constructor($){this.client=$,this.rules=new MT$($)}evaluate($){return this.client.post("/v5/firewall/evaluate",$)}}var n51,ET$,Cm4,zT$,_m4,PT$=1024,TT$;var V10=D(()=>{fW();n51=class n51 extends Error{path;constructor($,Z){super(Z);this.name="FirewallRuleValidationError",this.path=$,Object.setPrototypeOf(this,n51.prototype)}};ET$=["vmId","vpcId","tunnelId","cidr","public","port","protocol"],Cm4=["vmId","vpcId","tunnelId","cidr","public"],zT$=["tcp","udp","icmp"],_m4=["tcp","udp"];TT$=["action","source","destination","description"]});function r51($){return`/v5/identities/${u6($)}`}class IT${client;basePath;constructor($,Z){this.client=$,this.basePath=Z}create(){return this.client.post(`${this.basePath}/tokens`)}list(){return this.client.get(`${this.basePath}/tokens`)}revoke($){return this.client.delete(`${this.basePath}/tokens/${u6($)}`)}}class VT${client;basePath;constructor($,Z){this.client=$,this.basePath=Z}list(){return this.client.get(`${this.basePath}/permissions/vm`)}grant($){return this.client.post(`${this.basePath}/permissions/vm`,$)}get($){return this.client.get(`${this.basePath}/permissions/vm/${u6($)}`)}update($,Z){return this.client.patch(`${this.basePath}/permissions/vm/${u6($)}`,{allowedLinuxUsers:Z})}revoke($){return this.client.delete(`${this.basePath}/permissions/vm/${u6($)}`)}}class s51{id;tokens;permissions;client;basePath;constructor($,Z){this.client=$,this.id=Z,this.basePath=r51(Z),this.tokens=new IT$($,this.basePath),this.permissions={vm:new VT$($,this.basePath)}}data(){return this.client.get(this.basePath)}delete(){return this.client.delete(this.basePath)}}class a51{client;constructor($){this.client=$}async create($={}){let Z=await this.client.post("/v5/identities",$);return{identity:new s51(this.client,Z.id),identityId:Z.id,data:Z}}list($={}){return this.client.get("/v5/identities",$)}get($){return this.client.get(r51($))}ref($){return new s51(this.client,$)}delete($){return this.client.delete(r51($))}}var e51=D(()=>{fW()});function v1($,Z){throw new Y91($,Z)}function X7($,Z){throw new X91($,Z)}function k10($){return xm4.some((Z)=>$[Z]!==void 0)}function mm4($){return!k10($)&&$.port===void 0}function fY($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function cT$($,Z,Q){if(typeof $!=="string"||!hm4.test($))X7(Z,`${Z} must be a valid HTTP header name`);let Y=$.toLowerCase();if(cm4.has(Y)||Y.startsWith("x-forwarded-")||Y.startsWith("x-freestyle-")||Q&&(Y==="cookie"||Y==="set-cookie"))X7(Z,`${Z} may not use reserved header \`${$}\``)}function dm4($,Z){if(!Array.isArray($))X7(Z,`${Z} must be an array of header names`);if($.length>xT$)X7(Z,`${Z} may contain at most ${xT$} names`);let Q=new Set;$.forEach((Y,X)=>{cT$(Y,`${Z}[${X}]`,!0);let J=Y.toLowerCase();if(Q.has(J))X7(`${Z}[${X}]`,`${Z} contains duplicate header \`${Y}\``);Q.add(J)})}function yT$($){if(!fY($))X7("forwardAuth","forwardAuth must be an object");for(let Y of Object.keys($))if(!CT$.includes(Y))X7(Y,`Unknown field \`${Y}\`. Expected one of: ${CT$.join(", ")}`);let Z=$;if(typeof Z.url!=="string"||Z.url.length===0||Z.url.length>um4)X7("url","url is required and must be an absolute HTTPS URL");let Q;try{Q=new URL(Z.url)}catch{X7("url","url must be an absolute HTTPS URL")}if(Q.protocol!=="https:"||Q.hostname.length===0||Q.username.length>0||Q.password.length>0||Q.hash.length>0||Q.port==="0")X7("url","url must be an absolute HTTPS URL");if(Z.headers!==void 0){if(!fY(Z.headers))X7("headers","headers must be an object of header name to value");let Y=Object.entries(Z.headers);if(Y.length>vT$)X7("headers",`headers may contain at most ${vT$} entries`);let X=0,J=new Set;for(let[G,W]of Y){cT$(G,`headers.${G}`,!1);let K=G.toLowerCase();if(J.has(K))X7(`headers.${G}`,`headers contains duplicate header \`${G}\``);if(J.add(K),typeof W!=="string"||/[\0\r\n]/.test(W))X7(`headers.${G}`,`headers.${G} must be a string`);X+=G.length+W.length}if(X>bT$)X7("headers",`headers may contain at most ${bT$} bytes`)}if(Z.timeoutMs!==void 0&&(!Number.isInteger(Z.timeoutMs)||Z.timeoutMs<100||Z.timeoutMs>5000))X7("timeoutMs","timeoutMs must be an integer between 100 and 5000");if(Z.protectedCookies!==void 0){if(!Array.isArray(Z.protectedCookies))X7("protectedCookies","protectedCookies must be an array of cookie names");if(Z.protectedCookies.length>fT$)X7("protectedCookies",`protectedCookies may contain at most ${fT$} names`);let Y=new Set;Z.protectedCookies.forEach((X,J)=>{if(typeof X!=="string"||X.length>lm4||!gm4.test(X))X7(`protectedCookies[${J}]`,`protectedCookies[${J}] must be a valid HTTP cookie name`);if(Y.has(X))X7(`protectedCookies[${J}]`,`protectedCookies contains duplicate cookie \`${X}\``);Y.add(X)})}if(Z.authResponseHeaders!==void 0)dm4(Z.authResponseHeaders,"authResponseHeaders");return Z}function im4($,Z){if(!fY($))v1(Z,`${Z} must be an object with an \`id\``);for(let Y of Object.keys($))if(!_T$.includes(Y))v1(`${Z}.${Y}`,`${Z} has unknown field \`${Y}\`. Expected: ${_T$.join(", ")}`);let Q=$.id;if(typeof Q!=="string"||Q.length===0)v1(`${Z}.id`,`${Z}.id is required and must be a non-empty string`)}function Q91($){if(typeof $!=="string")v1("domain","domain is required and must be a string");if($==="*")return;let Z=$.startsWith("*.")?$.slice(2):$;if(Z.length===0||Z.length>fm4)v1("domain",`domain \`${$}\` is not a hostname`);let Q=Z.split(".");if(Q.length<2)v1("domain",`domain \`${$}\` must have at least two labels, e.g. acme.com`);for(let Y of Q){if(Y.length===0||Y.length>ym4)v1("domain",`domain \`${$}\` has an empty or over-long label`);if(!/^[a-z0-9-]+$/.test(Y))v1("domain",`domain \`${$}\`: labels are lowercase letters, digits, and hyphens (a \`*.\` prefix is the only wildcard)`);if(Y.startsWith("-")||Y.endsWith("-"))v1("domain",`domain \`${$}\`: a label cannot start or end with a hyphen`)}}function pm4($){if(typeof $!=="string")v1("domain","domain is required and must be a string");let Z=$.lastIndexOf("@");if(Z===-1){Q91($);return}let Q=$.slice(0,Z),Y=$.slice(Z+1);if(Q.length===0||Q.length>64)v1("domain",`mail route \`${$}\`: the part before \`@\` must be 1-64 characters`);if(Q.startsWith(".")||Q.endsWith(".")||Q.includes(".."))v1("domain",`mail route \`${$}\`: the part before \`@\` cannot start or end with a dot, or contain \`..\``);for(let X of Q)if(!/[a-zA-Z0-9]/.test(X)&&!gT$.includes(X))v1("domain",`mail route \`${$}\`: the part before \`@\` may use letters, digits, dots, and \`${gT$.slice(0,-1)}\` (quoted mailboxes are not supported)`);if(Y==="*")v1("domain",`mail route \`${$}\`: \`*\` is not a mail domain \u2014 name the domain the mailbox lives at`);Q91(Y)}function hT$($,Z){if(!fY($))v1(Z,`${Z} must be an object`);for(let Y of Object.keys($))if(!kT$.includes(Y))v1(`${Z}.${Y}`,`${Z} has unknown field \`${Y}\`. Expected one of: ${kT$.join(", ")}`);let Q=$;for(let Y of["vmId","vpcId","host"]){let X=Q[Y];if(X!==void 0&&(typeof X!=="string"||X.length===0))v1(`${Z}.${Y}`,`${Z}.${Y} must be a non-empty string`)}if(Q.public!==void 0&&Q.public!==!0)v1(`${Z}.public`,`${Z}.public must be true when present. Omit the field to match something else`);if(Z==="source"){if(Q.host!==void 0)v1("source.host","source.host is not allowed: a source is who opens the session, not where it lands. Put `host` on the destination");if(Q.port!==void 0)v1("source.port","source.port is not allowed: a source is who opens the session, not where it lands. Put `port` on the destination");if(Q.public===!0&&(Q.vmId!==void 0||Q.vpcId!==void 0))v1("source.public","source cannot combine `public: true` with `vmId` or `vpcId`: use one alone. `public` is every client on the Internet; `vmId`/`vpcId` is a specific dialer")}else{if(Q.vpcId!==void 0)v1("destination.vpcId","destination.vpcId is not allowed: a session lands in one place, not on a whole network. Name a `vmId`, a `host`, or `public: true` for the domain's own origin. A whole network may be a source");if([Q.vmId!==void 0,Q.host!==void 0,Q.public===!0].filter(Boolean).length>1)v1("destination","destination names more than one landing: give exactly one of `vmId`, `host`, or `public: true`");if((Q.vmId!==void 0||Q.host!==void 0)&&Q.port===void 0)v1("destination.port",`destination.port is required with ${Q.vmId!==void 0?"`vmId`":"`host`"}: say which port the session lands on`)}if(Q.port!==void 0){if(!Number.isInteger(Q.port)||Q.port<1||Q.port>65535)v1(`${Z}.port`,`${Z}.port must be an integer between 1 and 65535`)}}function nm4($){if("postgres"in $)return"postgres";if("smtp"in $)return"smtp";if("socks5"in $)return"socks5";return"http"}function tm4($,Z){function Q(W,K,H){if(!fY(W)||Object.keys(W).some((F)=>!K.includes(F)))v1(H,`${H} must contain only ${K.join(", ")}`)}if(Q($,["region","credentials","scope"],Z),typeof $.region!=="string"||!/^[a-z0-9-]{1,63}$/.test($.region))v1(`${Z}.region`,"invalid s3.region");Q($.credentials,["accessKeyId","secretAccessKey","sessionToken"],`${Z}.credentials`);for(let W of["accessKeyId","secretAccessKey","sessionToken"]){let K=$.credentials[W];if(W==="sessionToken"&&K===void 0)continue;if(typeof K!=="string"||!/^[\x21-\x7e]{1,16384}$/.test(K))v1(`${Z}.credentials.${W}`,"invalid s3 credentials")}if(!/^[a-zA-Z0-9]+$/.test($.credentials.accessKeyId))v1(`${Z}.credentials.accessKeyId`,"invalid s3 access key id");Q($.scope,["bucket","prefix","operations"],`${Z}.scope`);let{bucket:Y,prefix:X,operations:J}=$.scope;if(typeof Y!=="string"||!/^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/.test(Y)||Y.includes(".."))v1(`${Z}.scope.bucket`,"invalid s3.scope.bucket");if(typeof X!=="string"||Buffer.byteLength(X,"utf8")>1024||/[\x00-\x1f\x7f-\x9f]/u.test(X))v1(`${Z}.scope.prefix`,"invalid s3.scope.prefix");let G=["GetObject","HeadObject","PutObject","DeleteObject","ListObjectsV2","CreateMultipartUpload","UploadPart","ListParts","CompleteMultipartUpload","AbortMultipartUpload","ListMultipartUploads"];if(!Array.isArray(J)||J.length===0||J.length>G.length||J.some((W)=>!G.includes(W))||new Set(J).size!==J.length)v1(`${Z}.scope.operations`,"s3.scope.operations must be a nonempty list of distinct supported operations")}function om4($,Z){if(!fY($))v1(Z,`${Z} must be an object: \`{ headers: { \u2026 } }\`, \`{ postgres: { \u2026 } }\`, \`{ smtp: { \u2026 } }\` or \`{ socks5: { \u2026 } }\``);let Q=Object.keys($);if(Q.length!==1||!["headers","jsonPatch","postgres","smtp","socks5","s3"].includes(Q[0]??""))v1(Z,`${Z} must have exactly one of \`headers\`, \`jsonPatch\`, \`postgres\`, \`smtp\`, \`socks5\` or \`s3\` (got: ${Q.length===0?"nothing":Q.join(", ")})`);if(Q[0]==="s3"){tm4($.s3,`${Z}.s3`);return}if(Q[0]==="jsonPatch"){let Y=$.jsonPatch;if(!Array.isArray(Y)||Y.length>128)v1(Z,`${Z}.jsonPatch must be an array of at most 128 operations`);let X=(W)=>typeof W==="string"&&(W===""||W.startsWith("/"))&&!/~(?:[^01]|$)/u.test(W),J=(W,K=new Set,H=0)=>{if(H>64)return!1;if(W===null||typeof W==="string"||typeof W==="boolean")return!0;if(typeof W==="number")return Number.isFinite(W);if(typeof W!=="object"||K.has(W))return!1;K.add(W);let F=(Array.isArray(W)?Array.from(W):fY(W)?Object.values(W):[void 0]).every((U)=>J(U,K,H+1));return K.delete(W),F};for(let[W,K]of Y.entries()){if(!fY(K)||!["add","remove","replace","move","copy","test"].includes(String(K.op))||!X(K.path))v1(Z,`${Z}.jsonPatch[${W}] requires a standard op and valid JSON Pointer path`);if(["move","copy"].includes(K.op)&&!X(K.from))v1(Z,`${Z}.jsonPatch[${W}].from must be a JSON Pointer`);if(["add","replace","test"].includes(K.op)&&(!Object.hasOwn(K,"value")||!J(K.value)))v1(Z,`${Z}.jsonPatch[${W}].value must be a JSON value (null is allowed)`)}let G;try{G=JSON.stringify(Y)}catch{v1(Z,"jsonPatch must be JSON serializable")}if(Buffer.byteLength(G,"utf8")>65536)v1(Z,"jsonPatch exceeds 64 KiB");return}if(Q[0]==="socks5"){let Y=$.socks5;if(!fY(Y))v1(`${Z}.socks5`,`${Z}.socks5 must be an object with \`username\` and \`password\``);for(let X of Object.keys(Y))if(!["username","password"].includes(X))v1(`${Z}.socks5.${X}`,`${Z}.socks5 has unknown field \`${X}\`. Expected: username, password`);for(let X of["username","password"])if(typeof Y[X]!=="string"||Y[X].length===0)v1(`${Z}.socks5.${X}`,`${Z}.socks5.${X} is required and must be a non-empty string`);return}if(Q[0]==="smtp"){let Y=$.smtp;if(!fY(Y))v1(`${Z}.smtp`,`${Z}.smtp must be an object with \`username\` and \`password\``);for(let X of Object.keys(Y))if(!["username","password"].includes(X))v1(`${Z}.smtp.${X}`,`${Z}.smtp has unknown field \`${X}\`. Expected: username, password`);for(let X of["username","password"])if(typeof Y[X]!=="string"||Y[X].length===0)v1(`${Z}.smtp.${X}`,`${Z}.smtp.${X} is required and must be a non-empty string`);return}if(Q[0]==="headers"){let Y=$.headers;if(!fY(Y))v1(`${Z}.headers`,`${Z}.headers must be an object of header name to value`);for(let[X,J]of Object.entries(Y))if(typeof J!=="string")v1(`${Z}.headers.${X}`,`${Z}.headers.${X} must be a string`)}else{let Y=$.postgres;if(!fY(Y))v1(`${Z}.postgres`,`${Z}.postgres must be an object with \`username\` and \`password\``);for(let J of Object.keys(Y))if(!["username","password","database"].includes(J))v1(`${Z}.postgres.${J}`,`${Z}.postgres has unknown field \`${J}\`. Expected: username, password, database`);let X=Y;for(let J of["username","password"])if(typeof X[J]!=="string"||X[J].length===0)v1(`${Z}.postgres.${J}`,`${Z}.postgres.${J} is required and must be a non-empty string`);if(X.database!==void 0&&typeof X.database!=="string")v1(`${Z}.postgres.database`,`${Z}.postgres.database must be a string`)}}function rm4($,Z){let Q=$;return Z.forEach((Y,X)=>{let J=nm4(Y);if(Q===void 0)Q=J;else if(Q!==J)v1(`transform[${X}]`,`transform requires protocol \`${J}\` but the rule is \`${Q}\`; a rule terminates one protocol`)}),Q??"http"}function sm4($,Z){if(!fY($)||Object.keys($).some((Q)=>Q!=="method"&&Q!=="path"))v1(Z,`${Z} must be an object containing only method and path`);if($.method!==void 0&&(!Array.isArray($.method)||$.method.some((Q)=>typeof Q!=="string"||Q.length===0||/[^!#$%&'*+.^_`|~0-9A-Za-z-]/.test(Q))))v1(`${Z}.method`,`${Z}.method must be an array of HTTP method tokens`);if($.path!==void 0){let Q=$.path;if(!fY(Q)||Object.keys(Q).length!==1||typeof Q.exact!=="string"||!Q.exact.startsWith("/")||/[\s?#]/.test(Q.exact))v1(`${Z}.path`,`${Z}.path must contain exact: an absolute path without a query or fragment`)}}function mT$($,Z){if(!fY($))v1(Z||"rule",`${Z||"rule"} must be an object`);for(let H of Object.keys($))if(!uT$.includes(H))v1(`${Z}${H}`,`Unknown field \`${H}\`. Expected one of: ${uT$.join(", ")}`);let Q=$;if(Q.action===void 0)v1(`${Z}action`,`${Z}action is required. Write \`action: "allow"\` \u2014 every rule states what it does rather than defaulting to it`);if(Q.action!=="allow")v1(`${Z}action`,`${Z}action must be "allow" (got \`${String(Q.action)}\`). Only allow rules exist today`);if(Q.protocol!==void 0&&!ST$.includes(Q.protocol))v1(`${Z}protocol`,`${Z}protocol must be one of: ${ST$.join(", ")} (got \`${String(Q.protocol)}\`)`);let Y=Q.source??{},X=Q.destination??{};hT$(Y,"source"),hT$(X,"destination");let J=Q.transform??[];if(!Array.isArray(J))v1(`${Z}transform`,`${Z}transform must be an array`);J.forEach((H,F)=>om4(H,`${Z}transform[${F}]`));let G=rm4(Q.protocol,J);if(Q.match!==void 0){if(sm4(Q.match,`${Z}match`),G!=="http"||Y.public===!0||!(X.public===!0||X.host!==void 0))v1(`${Z}match`,"match requires HTTP egress from a VM or VPC to a public origin or host")}if(J.some((H)=>("s3"in H))){if(J.length!==1||Q.match!==void 0||Y.public===!0||!(X.public===!0||X.host!==void 0)||Q.domain.includes("*"))v1(`${Z}transform`,"s3 requires a sole transform on HTTP egress to a concrete origin, without match")}let W=J.filter((H)=>("jsonPatch"in H));if(W.length>1)v1(`${Z}transform`,"a rule may carry only one jsonPatch transform");if(W.length&&(Y.public===!0||!(X.public===!0||X.host!==void 0)))v1(`${Z}transform`,"jsonPatch requires HTTP egress from a VM or VPC to a public origin or host");if(Q.forwardAuth!==void 0){im4(Q.forwardAuth,`${Z}forwardAuth`);let H=X.vmId!==void 0||!k10(X)&&X.port!==void 0;if(G!=="http"||Y.public!==!0||!H||Q.domain==="*")v1(`${Z}forwardAuth`,`${Z}forwardAuth is only supported on HTTP public ingress: \`{ public: true } -> { vmId, port }\``)}if(G==="smtp")pm4(Q.domain);else Q91(Q.domain);if((Y.vmId!==void 0||Y.vpcId!==void 0)&&X.vmId!==void 0&&J.length>0)v1(`${Z}transform`,"a VM-to-VM rule cannot carry a transform yet \u2014 remove it (only public ingress/egress rules run transforms)");if(G==="tcp"){let H=X.public===!0||X.host!==void 0,F=Y.vmId!==void 0||Y.vpcId!==void 0;if(H||F)v1(`${Z}protocol`,"a `tcp` rule is public ingress only \u2014 `{ public: true } -> { vmId, port }`. The edge splices the session without terminating it, so outbound there is nothing to broker (an outbound allow is a firewall rule, and injecting into one needs `http` or `postgres`) and inward there is no certificate to answer the source with. Give the source `public: true`, or drop `protocol` to be served as HTTPS")}else if(G==="imap"||G==="imaps"){let H=X.public===!0||X.host!==void 0,F=Y.vmId!==void 0||Y.vpcId!==void 0;if(H||F)v1(`${Z}protocol`,`an \`${G}\` rule is public ingress only \u2014 \`{ public: true } -> { vmId, port }\`. The 993 front serves mail clients reaching a VM's IMAP server; outbound there is nothing to broker (an outbound allow is a firewall rule) and inward there is no certificate to answer the source with`)}else if(G==="socks5"){let H=X.public===!0||X.host!==void 0;if(Y.public===!0||!H)v1(`${Z}protocol`,'a `socks5` rule is egress only \u2014 `{ vmId } -> { host: "gate.provider.com", port: 1080 }`. The front exists so a guest can open sessions through a proxy whose credentials it never holds; inbound there is nothing to serve, and publishing one would be an open proxy on a platform address');if(X.host===void 0)v1(`${Z}destination`,"a `socks5` rule has to name the proxy it goes through: give the destination a `host` and the `port` the provider listens on. `{ public: true }` on its own asks the edge to be the proxy, which would let the guest out on our address rather than through yours")}else if(G==="postgres"){let H=J.some((U)=>U!==null&&typeof U==="object"&&("postgres"in U)),F=X.public===!0||X.host!==void 0;if(H&&!F)v1(`${Z}transform`,"a `postgres` transform belongs on an egress rule: the edge spends a credential the guest never holds, so pointing it at your own VM would hand every client a logged-in session. Give the destination `public: true` or a `host`, or drop the transform")}else if(G==="smtp"){let H=J.some((U)=>U!==null&&typeof U==="object"&&("smtp"in U)),F=X.public===!0||X.host!==void 0;if(H&&!F)v1(`${Z}transform`,"an `smtp` transform belongs on an egress rule: the edge spends a credential the guest never holds, so pointing it at your own VM would turn it into an open relay. Give the destination `public: true` or a `host`, or drop the transform");if(typeof Q.domain==="string"&&Q.domain.includes("@")&&Y.public!==!0)v1(`${Z}domain`,`\`${Q.domain}\` names a mailbox, which only makes sense on a rule that receives mail. An egress or VM-to-VM rule names the host the guest submits through \u2014 drop the part before \`@\``)}return{...Q,source:Y,destination:X}}function am4($,Z){if($==="source")return mm4(Z)?"source is empty. Say who opens the session: `vmId`, `vpcId`, or `public: true`":"source only narrows the session without saying who opens it. Add `vmId`, `vpcId`, or `public: true`";return"destination is empty. Say where the session lands: `vmId` + `port`, `host` + `port`, or `public: true` for the domain's own origin"}function lT$($){let Z=mT$($,"");for(let Q of["source","destination"]){let Y=Z[Q];if(!k10(Y))v1(Q,am4(Q,Y))}if(Z.source.public===!0&&Z.destination.public===!0)v1("destination","a rule from the public Internet to the domain's own origin allows nothing the world cannot already do. Did you mean a `vmId` destination (ingress) or a `vmId` source (egress)?");return Z}function dT$($){if(!fY($))v1("tls","tls must be an object with a `rules` array");for(let Q of Object.keys($))if(Q!=="rules")v1(`tls.${Q}`,`tls has unknown field \`${Q}\`. Expected: rules`);let Z=$.rules;if(!Array.isArray(Z))v1("tls.rules","tls.rules must be an array");return Z.forEach((Q,Y)=>{let X=`tls.rules[${Y}].`,J=mT$(Q,X),G=k10(J.source),W=k10(J.destination);if(!G&&!W)v1(`tls.rules[${Y}]`,`tls.rules[${Y}]: both source and destination refer to the VM being created, which allows nothing. Give one of them a \`vmId\`, \`vpcId\`, or \`public: true\``);if(G&&W)v1(`tls.rules[${Y}]`,`tls.rules[${Y}]: neither end refers to the VM being created. Leave one endpoint's identity unset so it means this VM, or create the rule with tls.rules.create instead`);if(!W&&J.destination.port===void 0)v1(`tls.rules[${Y}].destination.port`,`tls.rules[${Y}]: destination.port is required: say which port on this VM the session lands on`)}),$}function $91($){return`/v5/tls/${u6($)}`}function Z91($){return`/v5/tls/forward-auth/${u6($)}`}class iT${client;constructor($){this.client=$}list(){return this.client.get("/v5/tls/forward-auth")}async create($){let Z=yT$($);return this.client.post("/v5/tls/forward-auth",Z)}get($){return this.client.get(Z91($))}async update($,Z){let Q=yT$(Z);return this.client.put(Z91($),Q)}delete($){return this.client.delete(Z91($))}}class pT${client;constructor($){this.client=$}async create($){let Z=lT$($);return this.client.post("/v5/tls",Z)}list($={}){return this.client.get("/v5/tls",$)}get($){return this.client.get($91($))}async update($,Z){let Q=lT$(Z);return this.client.put($91($),Q)}delete($){return this.client.delete($91($))}}class J91{client;rules;forwardAuth;constructor($){this.client=$,this.rules=new pT$($),this.forwardAuth=new iT$($)}}var Y91,X91,kT$,xm4,ST$,fm4=253,ym4=63,CT$,_T$,gm4,hm4,um4=2048,vT$=32,bT$=16384,xT$=32,fT$=32,lm4=128,cm4,gT$="!#$%&'*+-/=?^_`{|}~.",uT$;var DT0=D(()=>{fW();Y91=class Y91 extends Error{path;constructor($,Z){super(Z);this.name="TlsRuleValidationError",this.path=$,Object.setPrototypeOf(this,Y91.prototype)}};X91=class X91 extends Error{path;constructor($,Z){super(Z);this.name="TlsForwardAuthValidationError",this.path=$,Object.setPrototypeOf(this,X91.prototype)}};kT$=["vmId","vpcId","public","host","port"],xm4=["vmId","vpcId","public","host"],ST$=["tcp","http","postgres","minecraft","smtp","imap","imaps","socks5"],CT$=["url","headers","timeoutMs","protectedCookies","authResponseHeaders"],_T$=["id"],gm4=/^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/,hm4=/^[0-9A-Za-z-]+$/,cm4=new Set(["host","content-length","connection","keep-alive","proxy-authenticate","proxy-authorization","proxy-connection","te","trailer","transfer-encoding","upgrade"]);uT$=["action","domain","protocol","source","destination","transform","match","forwardAuth"]});function mm($){return`/v5/tunnels/${u6($)}`}function Ff($){return $.tunnelId??=$.id,$}class G91{client;constructor($){this.client=$}list(){return this.client.get("/v5/tunnels").then(($)=>{return $.tunnels.forEach(Ff),$})}create($={}){return this.client.post("/v5/tunnels",$).then(Ff)}get($){return this.client.get(mm($)).then(Ff)}update($,Z){return this.client.patch(mm($),Z).then(Ff)}rotateKey($,Z={}){return this.client.post(`${mm($)}/rotate-key`,Z).then(Ff)}delete($){return this.client.delete(mm($))}attachVpc($,Z,Q={}){return this.client.post(`${mm($)}/vpcs/${u6(Z)}`,Q).then(Ff)}detachVpc($,Z){return this.client.delete(`${mm($)}/vpcs/${u6(Z)}`).then(Ff)}}var W91=D(()=>{fW()});class K91{client;basePath;constructor($,Z){this.client=$,this.basePath=Z}async readFile($,Z={}){let Q=await this.openRead($,Z);return new Uint8Array(await Q.arrayBuffer())}async readTextFile($,Z={}){return await(await this.openRead($,Z)).text()}async readFileStream($,Z={}){let Q=await this.openRead($,Z);if(!Q.body)throw Error(`no response body reading ${$}`);return Q.body}async writeFile($,Z,Q={}){let Y=typeof Z==="string"?new TextEncoder().encode(Z):Z,X=Y instanceof Uint8Array?Y.byteLength:Y.size;if(X>em4)return this.uploadInChunks($,Y,X,Q);let J=Y instanceof Uint8Array?Y:new Uint8Array(await Y.arrayBuffer());await this.client.putBytes(`${this.basePath}/fs/write`,J,{path:$,mode:Q.mode,sha256:await nT$(J)},Q.signal),Q.onProgress?.({completedBytes:X,totalBytes:X})}writeTextFile($,Z,Q={}){return this.writeFile($,Z,Q)}async readDir($){let{entries:Z}=await this.client.get(`${this.basePath}/fs/dir`,{path:$});return Z}async mkdir($){await this.client.post(`${this.basePath}/fs/mkdir`,{path:$})}async remove($){await this.client.delete(`${this.basePath}/fs/remove`,{path:$})}async exists($){let{exists:Z}=await this.client.get(`${this.basePath}/fs/exists`,{path:$});return Z}stat($){return this.client.get(`${this.basePath}/fs/stat`,{path:$})}openRead($,Z){let{offset:Q,length:Y}=Z,X;if(Q!==void 0||Y!==void 0){let J=Q??0;X=Y===void 0?`bytes=${J}-`:`bytes=${J}-${J+Y-1}`}return this.client.getBytes(`${this.basePath}/fs/read`,{path:$},{range:X,signal:Z.signal})}async uploadInChunks($,Z,Q,Y){let X=Y.chunkSize??$d4,J=Y.maxAttempts??Zd4,G=Z instanceof Uint8Array?await nT$(Z):void 0,W=await this.client.post(`${this.basePath}/fs/uploads`,{path:$,size:Q,sha256:G,mode:Y.mode}),K=`${this.basePath}/fs/uploads/${W.uploadId}`;try{let H=W.receivedBytes;while(H<Q){let F=Math.min(H+X,Q),U=Z instanceof Uint8Array?Z.subarray(H,F):Z.slice(H,F);H=(await this.putChunkWithRetry(K,U,H,J,Y.signal)).receivedBytes,Y.onProgress?.({completedBytes:Math.min(H,Q),totalBytes:Q})}await this.client.post(`${K}/commit`)}catch(H){throw await this.client.delete(K).catch(()=>{}),H}}async putChunkWithRetry($,Z,Q,Y,X){let J;for(let G=1;G<=Y;G++){X?.throwIfAborted?.();try{return await this.client.putBytes($,Z,{offset:Q},X)}catch(W){if(J=W,!(!(W instanceof yX)||W.status>=500||W.status===408||W.status===409||W.status===429)||X?.aborted||G===Y)throw W;await Qd4(Math.min(500*2**(G-1),8000));let H=await this.client.get($).catch(()=>{return});if(H&&H.receivedBytes>Q)return H}}throw J}}async function nT$($){let Z=globalThis.crypto?.subtle;if(!Z)return;let Q=await Z.digest("SHA-256",$);return Array.from(new Uint8Array(Q),(Y)=>Y.toString(16).padStart(2,"0")).join("")}function Qd4($){return new Promise((Z)=>setTimeout(Z,$))}var em4=8388608,$d4=16777216,Zd4=5;var H91=D(()=>{I10()});function Yd4(){return typeof process<"u"&&Boolean(process.versions?.node)}async function tT$($,Z){if(Yd4()){let Y;try{Y=await import("ws")}catch{throw Error("PTY sessions need the `ws` package in Node. Install it with `npm install ws`.")}return new Y.default($,{headers:Z})}let Q=globalThis.WebSocket;if(!Q)throw Error("PTY sessions need a WebSocket client; no global WebSocket is available in this environment.");return new Q($)}function S10($,Z,Q){if($.on){$.on(Z,Q);return}$.addEventListener?.(Z,Q)}function Jd4($,Z){if($&&typeof $==="object"&&"data"in $){let Q=$.data;if(typeof Q==="string")return{text:Q};if(Q instanceof ArrayBuffer)return{binary:new Uint8Array(Q)};return{}}if($ instanceof Uint8Array)return Z?{binary:$}:{text:Xd4.decode($)};if(typeof $==="string")return{text:$};return{}}class F91{_sessionId;_slug;_created=!1;socket;constructor($,Z,Q={}){this.socket=$,this._sessionId=Z,S10($,"message",(Y,X)=>{let{text:J,binary:G}=Jd4(Y,X);if(G){Q.onData?.(G);return}if(!J)return;let W;try{W=JSON.parse(J)}catch{return}if(W.type==="exited")Q.onExit?.(W.exitCode);else if(W.type==="error")Q.onError?.(Error(W.message));else if(W.type==="sessionInfo")this._sessionId=W.sessionId,this._slug=W.slug,this._created=W.created??!0,Q.onSessionInfo?.(W.sessionId)}),S10($,"close",(Y)=>{let X=Y;Q.onClose?.({wasClean:X?.wasClean??!0,code:X?.code??1000,reason:X?.reason??""})}),S10($,"error",(Y)=>Q.onError?.(Y))}write($){this.socket.send(typeof $==="string"?new TextEncoder().encode($):$)}resize($){this.sendControl({type:"resize",cols:$.cols,rows:$.rows})}signal($){this.sendControl({type:"signal",signal:$})}sendControl($){this.socket.send(JSON.stringify($))}detach(){this.socket.close()}get sessionId(){return this._sessionId}get slug(){return this._slug}get created(){return this._created}get readyState(){return this.socket.readyState}}function Gd4($){return new Promise((Z,Q)=>{if($.readyState===1){Z();return}S10($,"open",()=>Z()),S10($,"error",(Y)=>Q(Y))})}class U91{client;basePath;constructor($,Z){this.client=$,this.basePath=Z}async open($={}){let{exec:Z,cols:Q,rows:Y,linuxUser:X,slug:J,replaceOnExit:G,onData:W,onExit:K,onClose:H,onError:F}=$,U={};if(Z!==void 0)U.exec=Z;if(Q!==void 0)U.cols=Q;if(Y!==void 0)U.rows=Y;if(X!==void 0)U.linuxUser=X;if(J!==void 0)U.slug=J;if(G!==void 0)U.replaceOnExit=String(G);let N=oT$(this.client,`${this.basePath}/pty`,U),B=this.client.authHeaders(),O=await tT$(N,B);return new Promise((L,w)=>{let j=!1,E=new F91(O,-1,{onData:W,onExit:K,onClose:(z)=>{if(!j)j=!0,w(Error("connection closed before sessionInfo"));H?.(z)},onError:(z)=>{if(!j)j=!0,w(z);F?.(z)},onSessionInfo:()=>{j=!0,L(E)}})})}async attach($){let{session:Z,linuxUser:Q,onData:Y,onExit:X,onClose:J,onError:G}=$,W=oT$(this.client,`${this.basePath}/pty/sessions/${u6(String(Z))}`,{...Q!==void 0?{linuxUser:Q}:{}}),K=this.client.authHeaders(),H=await tT$(W,K),F=new F91(H,typeof Z==="number"?Z:-1,{onData:Y,onExit:X,onClose:J,onError:G});return await Gd4(H),F}list($={}){return this.client.get(`${this.basePath}/pty/sessions`,$)}close($,Z={}){return this.client.delete(`${this.basePath}/pty/sessions/${u6(String($))}`,Z)}}class N91{pty;linuxUser;constructor($,Z){this.pty=$,this.linuxUser=Z}open($={}){return this.pty.open({...$,linuxUser:this.linuxUser})}attach($){return this.pty.attach({...$,linuxUser:this.linuxUser})}list(){return this.pty.list({linuxUser:this.linuxUser})}close($){return this.pty.close($,{linuxUser:this.linuxUser})}}function oT$($,Z,Q){return $.url(Z,Q).replace(/^http/,"ws")}var Xd4;var B91=D(()=>{fW();Xd4=new TextDecoder});class D91{client;constructor($){this.client=$}list($={}){return this.client.get("/v5/snapshots",$)}get($){return this.client.get(`/v5/snapshots/${u6($)}`)}update($,Z){return this.client.patch(`/v5/snapshots/${u6($)}`,Z)}delete($){return this.client.delete(`/v5/snapshots/${u6($)}`)}}var O91=D(()=>{fW()});var rT$=()=>{};function L91($){return`/v5/vms/${u6($)}`}class w91{id;fs;pty;client;basePath;constructor($,Z){this.client=$,this.id=Z,this.basePath=L91(Z),this.fs=new K91($,this.basePath),this.pty=new U91($,this.basePath)}data(){return this.client.get(this.basePath)}firewallRules(){return this.client.get("/v5/firewall/rules",{vmId:this.id})}update($){return this.client.patch(this.basePath,$)}start(){return this.client.post(`${this.basePath}/start`)}pause(){return this.client.post(`${this.basePath}/pause`)}resize($){return this.client.post(`${this.basePath}/resize`,$)}delete(){return this.client.delete(this.basePath)}exec($){let Z=typeof $==="string"?{command:$}:$;return this.client.post(`${this.basePath}/exec-await`,Z)}linuxUser($){return new sT$(this,$)}snapshot($={}){return this.client.post(`${this.basePath}/snapshot`,$)}}class sT${vm;linuxUser;pty;constructor($,Z){this.vm=$,this.linuxUser=Z,this.pty=new N91($.pty,Z)}exec($){let Z=typeof $==="string"?{command:$}:$;return this.vm.exec({...Z,linuxUser:this.linuxUser})}}class j91{client;snapshots;constructor($){this.client=$,this.snapshots=new D91($)}async create($){if(BT0($.firewall,"VM"),$.tls!==void 0)dT$($.tls);let Z=await this.client.post("/v5/vms",$);return{vm:new w91(this.client,Z.id),vmId:Z.id,data:Z,firewallRules:Z.firewallRules??[],tlsRules:Z.tlsRules??[]}}list($={}){return this.client.get("/v5/vms",$)}get($){return this.client.get(L91($))}ref($){return new w91(this.client,$)}delete($){return this.client.delete(L91($))}}var E91=D(()=>{V10();DT0();fW();H91();B91();O91();rT$();H91();B91();O91()});function z91($){return`/v5/vpcs/${u6($)}`}class aT${client;basePath;constructor($,Z){this.client=$,this.basePath=Z}list(){return this.client.get(`${this.basePath}/tunnels`)}}class P91{id;tunnels;client;basePath;constructor($,Z){this.client=$,this.id=Z,this.basePath=z91(Z),this.tunnels=new aT$($,this.basePath)}data(){return this.client.get(this.basePath)}update($){return this.client.patch(this.basePath,$)}delete(){return this.client.delete(this.basePath)}}class A91{client;constructor($){this.client=$}list(){return this.client.get("/v5/vpcs")}async create($={}){if($.firewall!==void 0)BT0($.firewall,"network");let Z=await this.client.post("/v5/vpcs",$);return{vpc:new P91(this.client,Z.id),vpcId:Z.id,data:Z,firewallRules:Z.firewallRules??[]}}get($){return this.client.get(z91($))}ref($){return new P91(this.client,$)}delete($){return this.client.delete(z91($))}}var T91=D(()=>{V10();fW()});class OT0{client;vms;vpc;tunnels;firewall;tls;domains;identities;constructor($={}){this.client=new m51($),this.vms=new j91(this.client),this.vpc=new A91(this.client),this.tunnels=new G91(this.client),this.firewall=new o51(this.client),this.tls=new J91(this.client),this.domains=new d51(this.client),this.identities=new a51(this.client)}fetch($,Z){return this.client.fetch($,Z)}}var eT$=D(()=>{fW();i51();V10();e51();DT0();W91();E91();T91();fW();I10();E91();T91();W91();i51();V10();DT0();e51()});var ZR$;var $R$=D(()=>{ZR$={name:"@decocms/sandbox",version:"1.81.0",private:!0,type:"module",description:"Sandbox runtime for isolated Studio tool execution",scripts:{check:"tsc --noEmit",test:"bun test",build:"bun run build:typegen && bun run build:harness-runner","build:typegen":"mkdir -p dist && bun run --cwd=../typegen build && bun --cwd=../typegen pm pack --filename $PWD/dist/typegen.tgz --quiet","build:harness-runner":"mkdir -p dist && bun --cwd=../harness-runner pm pack --filename $PWD/dist/harness-runner.tgz --quiet"},exports:{"./shared":"./shared.ts","./provider":"./server/provider/index.ts","./provider/agent-sandbox":"./server/provider/agent-sandbox/index.ts","./provider/postgres-state-store":"./server/provider/postgres-state-store.ts","./provider/freestyle":"./server/provider/freestyle.ts","./provider/remote":"./server/provider/remote.ts","./provider/router":"./server/provider/router.ts","./provider/sandbox-api":"./server/provider/sandbox-api.ts","./provider/sandbox-server":"./server/provider/sandbox-server.ts","./daemon-client":"./server/daemon-client.ts","./org-fs":"./org-fs.ts","./dispatch":"./dispatch/index.ts","./dispatch/*":"./dispatch/*.ts","./proxy/http":"./proxy/http.ts","./proxy/websocket":"./proxy/websocket.ts"},dependencies:{"@decocms/shared":"workspace:*","@kubernetes/client-node":"^1.4.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0",freestyle:"0.2.16",zod:"4.3.6"},devDependencies:{"@types/bun":"latest",postgres:"^3.4.5",typescript:"^7.0.2"}}});function LT0($){let Z=$?.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of studio-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"});return async(Q,Y)=>{if(!Z)return Y();let X=performance.now(),J=(G)=>Z.record(performance.now()-X,{runner_kind:Q,source:"daemon",status_code:G});try{let G=await Y();return J(G.status),G}catch(G){throw J(0),G}}}var RD;var wT0=D(()=>{RD={kubernetes:"agent-sandbox",freestyle:"freestyle"}});var FR$={};$6(FR$,{FreestyleSandboxProvider:()=>HR$});import{createHash as Kd4,randomBytes as Hd4}from"crypto";class HR${freestyle;lookupClient;image;sidecarImage;idleTimeoutSeconds;autoDeleteSeconds;domainSuffix;timeDaemonRequest;inflight=new Wf;snapshotInflight=new Wf;lookups=new Map;releaseTimers=new Map;constructor($){this.freestyle=$.client??new OT0({apiKey:$.apiKey}),this.lookupClient=$.client??new OT0({apiKey:$.apiKey,fetch:Object.assign((Z,Q)=>fetch(Z,{...Q,signal:Q?.signal?AbortSignal.any([Q.signal,AbortSignal.timeout(GR$)]):AbortSignal.timeout(GR$)}),{preconnect:fetch.preconnect})}),this.image=$.image??`ghcr.io/decocms/studio/studio-sandbox-go:${ZR$.version}`,this.sidecarImage=$.orgFsSidecarImage??Ud4,this.idleTimeoutSeconds=$.idleTimeoutSeconds??300,this.autoDeleteSeconds=$.autoDeleteSeconds??86400,this.domainSuffix=$.domainSuffix??"style.dev",this.timeDaemonRequest=LT0($.meter)}async owns($){return await this.find($)!==null}daemonUrl($){return`https://${$}.${this.domainSuffix}`}async find($,Z={}){let Q=this.lookups.get($);if(!Z.refresh&&Q&&Date.now()-Q.at<(Q.found?wd4:jd4))return Q.found;let Y=null;try{let X=await this.lookupClient.vms.get($),J=X.metadata[XR$];if(J)Y={vm:this.freestyle.vms.ref(X.id),daemon:{url:this.daemonUrl($),token:J}}}catch(X){if(!(X instanceof yX&&X.status===404))throw X}return this.remember($,Y),Y}remember($,Z){if(this.lookups.delete($),this.lookups.size>=Ed4){let Q=this.lookups.keys().next();if(!Q.done)this.lookups.delete(Q.value)}this.lookups.set($,{found:Z,at:Date.now()})}baseSnapshot(){let{image:$,sidecarImage:Z}=this,Q=`studio-sandbox-${Kd4("sha256").update(`${$}
 ${Z}`).digest("hex").slice(0,16)}`;return this.snapshotInflight.run(Q,async()=>{if(await this.snapshotExists(Q))return Q;console.log(`[${Uf}] building base snapshot ${Q} for ${$}`);let{vm:Y}=await this.freestyle.vms.create({ttlSeconds:1800,firewall:{rules:[{action:"allow",source:{},destination:{public:!0}}]}});try{await this.run(Y,`docker pull -q ${dm($)} && docker pull -q ${dm(Z)}`,{timeoutMs:R91}),await Y.snapshot({slug:Q})}catch(X){if(!await this.snapshotExists(Q))throw X}finally{await Y.delete().catch(()=>{})}return Q})}async snapshotExists($){try{return await this.freestyle.vms.snapshots.get($),!0}catch(Z){if(Z instanceof yX&&Z.status===404)return!1;throw Z}}async run($,Z,Q={}){let Y=await $.exec({command:Z,...Q});if(Y.statusCode!==0)throw Error(`${Z.split(" ",2).join(" ")} failed (${Y.statusCode??"timeout"}): ${(Y.stderr||Y.stdout||"").slice(-500)}`);return Y.stdout??""}async ensure($,Z={}){let Q=F3($);if(Q.startsWith("s-"))throw Error(`ensure: projectRef has no slug source: ${$.projectRef}`);return this.inflight.run(Q,async()=>{this.cancelRelease(Q);let Y=await this.find(Q,{refresh:!0});if(Y)await this.resume(Y,Z);else await this.create(Q,Z);return{handle:Q,workdir:C10,previewUrl:this.daemonUrl(Q),warmPoolAdopted:!1,provider:"freestyle"}})}async resume($,Z){let{state:Q}=await $.vm.data();if(Q!=="running")await $.vm.start();if(await this.waitForDaemon($.daemon.url),Z.orgFsConfigJson)await z10($.daemon.url,$.daemon.token,Z.orgFsConfigJson).catch((X)=>console.warn(`[${Uf}] org-fs relay failed`,X));let Y=A10(Z);if(Y)await CU($.daemon.url,$.daemon.token,Y).catch((X)=>console.warn(`[${Uf}] git credential refresh failed: ${KR$(X)}`))}async create($,Z){let Q=await this.baseSnapshot(),Y=Hd4(24).toString("hex"),{vm:X}=await this.createVm({snapshotId:Q,slug:$,idleTimeoutSeconds:this.idleTimeoutSeconds,metadata:{[XR$]:Y,...Z.tenant?{[Bd4]:Z.tenant.orgId,[Dd4]:Z.tenant.userId}:{}},firewall:{rules:[{action:"allow",source:{},destination:{public:!0}}]},tls:{rules:[{action:"allow",domain:`${$}.${this.domainSuffix}`,source:{public:!0},destination:{port:jT0}}]}}),J={url:this.daemonUrl($),token:Y};try{let G={...Z.env,DAEMON_TOKEN:Y,DAEMON_BOOT_ID:crypto.randomUUID(),APP_ROOT:C10,PROXY_PORT:String(jT0),ORGFS_SIDECAR_CONFIG_PATH:`${ET0}/config.json`,ORGFS_SIDECAR_STATUS_PATH:`${ET0}/status.json`},W=Object.keys(G).map((K)=>`-e ${dm(K)}`).join(" ");if(await this.run(X,`sudo sh -c ${dm(Nd4)} && docker run -d --name ${YR$} --restart=always --privileged --device /dev/fuse -e APP_ROOT=${C10} -e ORGFS_FEED_IDLE_MS=60000 -v ${nj}:${C10}/org:rshared -v ${im}:${ET0} ${dm(this.sidecarImage)}`,{timeoutMs:R91}),await this.run(X,`docker run -d --name ${QR$} --restart=always -p ${jT0}:${jT0} -v ${nj}:${C10}/org:rslave -v ${im}:${ET0} ${W} ${dm(this.image)}`,{env:G,timeoutMs:R91}),await this.waitForDaemon(J.url),await CU(J.url,Y,this.configPayload(Z)??{}),Z.orgFsConfigJson)await z10(J.url,Y,Z.orgFsConfigJson).catch((K)=>console.warn(`[${Uf}] org-fs relay failed`,K))}catch(G){throw await X.delete().catch(()=>{}),this.lookups.delete($),G}this.remember($,{vm:X,daemon:J})}async createVm($){try{return await this.freestyle.vms.create({...$,autoDeleteSeconds:this.autoDeleteSeconds})}catch(Z){if(!(Z instanceof yX&&Z.status===400))throw Z;return console.warn(`[${Uf}] autoDeleteSeconds=${this.autoDeleteSeconds} refused (${Z.message}); creating with the plan's cap`),this.freestyle.vms.create($)}}configPayload($){return fm({runtime:$.workload?.runtime??"node",packageManager:$.workload?.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:$.repo??null,extraRepos:$.extraRepos??[],port:$.workload?.devPort??Fd4,tenant:$.tenant,cloneOnly:$.cloneOnly===!0})}async waitForDaemon($){let Z=Date.now()+JR$;while(Date.now()<Z){if(await WR$($))return;await O$(Od4)}throw Error(`sandbox daemon at ${$} did not answer /health within ${JR$/1000}s`)}async delete($){this.cancelRelease($);let Z=await this.find($,{refresh:!0});if(this.lookups.delete($),!Z)return;await Z.vm.exec({command:`docker stop -t 30 ${QR$}; docker stop -t 10 ${YR$}`,timeoutMs:60000}).catch(()=>{}),await Z.vm.delete()}async lastTermination($){return null}async alive($){return await this.find($,{refresh:!0})!==null}async*watchClaimLifecycle($,Z){let Q=Date.now();yield{kind:"claiming",since:Q};let Y=!1;while(!Z?.aborted){let X=await this.find($,{refresh:!0}).catch(()=>null);if(X){if(!Y)Y=!0,yield{kind:"warming-daemon",since:Date.now()};if(await WR$(X.daemon.url)){yield{kind:"ready"};return}}if(Date.now()-Q>zd4){yield{kind:"failed",reason:X?"crash-loop-backoff":"claim-never-created",message:X?"the sandbox VM exists but its daemon never answered":"no sandbox VM was created"};return}await O$(1000)}}async hasSchedulableCapacity(){return!0}async getPreviewUrl($){return await this.find($)?this.daemonUrl($):null}async proxyDaemonRequest($,Z,Q){let Y=await this.find($);if(!Y)return Response.json({error:"sandbox not found"},{status:404});let X=async()=>(await this.find($,{refresh:!0}))?.daemon??null;return this.timeDaemonRequest(RD.freestyle,()=>hm(Y.daemon,Z,Q,{unauthorized:async()=>{let J=await X();return J&&J.token!==Y.daemon.token?J:null},unreachable:X}))}async daemonEndpoint($){return(await this.find($))?.daemon??null}async adoptLiveClaim($,Z){return await this.find(Z,{refresh:!0})!==null}async resolvePreviewUpstreamUrl($){return(await this.find($))?.daemon.url??null}proxyPreviewRequest($,Z){return lm(Z,{base:()=>this.resolvePreviewUpstreamUrl($).catch(()=>null),invalidate:()=>this.lookups.delete($),retryBase:()=>this.find($,{refresh:!0}).then((Q)=>Q?.daemon.url??null).catch(()=>null)},Uf)}async markTenantPoolsDirty($,Z){return[]}async releaseAfter($,Z){this.cancelRelease($);let Q=setTimeout(()=>{this.releaseTimers.delete($),this.find($).then((Y)=>Y?.vm.pause()).catch((Y)=>console.warn(`[${Uf}] pause ${$} failed: ${KR$(Y)}`))},Z);Q.unref?.(),this.releaseTimers.set($,Q)}async renewTtl($){this.cancelRelease($)}cancelRelease($){let Z=this.releaseTimers.get($);if(Z)clearTimeout(Z);this.releaseTimers.delete($)}close(){for(let $ of this.releaseTimers.values())clearTimeout($);this.releaseTimers.clear(),this.lookups.clear()}}async function WR$($){try{let Z=await fetch(`${$}/health`,{signal:AbortSignal.timeout(Ld4)});return await Z.body?.cancel(),Z.ok}catch{return!1}}function dm($){return`'${$.replaceAll("'","'\\''")}'`}function KR$($){return $ instanceof Error?$.message:String($)}var Uf="FreestyleSandboxProvider",jT0=9000,C10="/app",Fd4=3000,QR$="sandbox",YR$="orgfs",Ud4="ghcr.io/decocms/studio/orgfs-sidecar:0.2.0",nj="/srv/sandbox/org",im="/srv/sandbox/orgfs-ctl",ET0="/run/orgfs",Nd4,XR$="studio-daemon-token",Bd4="studio-org-id",Dd4="studio-user-id",JR$=120000,Od4=500,Ld4=5000,R91=300000,wd4=300000,jd4=1e4,Ed4=5000,zd4=300000,GR$=3000;var UR$=D(()=>{eT$();a$();$R$();Gf();ym();YT0();XT0();wT0();Nd4=[`mkdir -p ${nj} ${im}`,`grep -q ' ${nj} ' /etc/fstab || printf '%s\\n' '${nj} ${nj} none bind,rshared 0 0' 'tmpfs ${im} tmpfs uid=1000,gid=1000,mode=0755,size=1m 0 0' >> /etc/fstab`,`mountpoint -q ${nj} || mount ${nj}`,`mountpoint -q ${im} || mount ${im}`].join(" && ")});function _10($,Z){if($ instanceof Error)Object.assign($,{["sandboxProvider"]:Z});return $}function q91($){for(let Z=$,Q=0;Z instanceof Error&&Q<5;Q++){let Y=Z.sandboxProvider;if(Y==="kubernetes"||Y==="freestyle")return Y;Z=Z.cause}return}var M91={};$6(M91,{handleShare:()=>NR$,SandboxProviderRouter:()=>BR$});import{createHash as Pd4}from"crypto";function NR$($){let Z=Pd4("sha256").update($).digest("hex").slice(0,8);return Number.parseInt(Z,16)/4294967296}function Rd4($){return $ instanceof PH}class BR${providers;picked=new Map;strays=new Map;freestyleShare;constructor($,Z={}){this.providers=$;if(!$.kubernetes&&!$.freestyle)throw Error("SandboxProviderRouter needs at least one provider");this.freestyleShare=Math.min(1,Math.max(0,Z.freestyleShare??0))}get($){let Z=this.providers[$];if(!Z)throw Error(`sandbox provider ${$} is not configured`);return Z}remember($,Z){if(this.picked.delete($),this.picked.size>=Ad4){let Q=this.picked.keys().next();if(!Q.done)this.picked.delete(Q.value)}this.picked.set($,Z)}async providerOf($){let{kubernetes:Z,freestyle:Q}=this.providers;if(!Q)return"kubernetes";if(!Z)return"freestyle";let Y=this.picked.get($);if(Y)return Y;return await Q.owns($).catch(()=>!1)?"freestyle":"kubernetes"}async owner($){return this.get(await this.providerOf($))}async place($,Z){let{kubernetes:Q,freestyle:Y}=this.providers,X=Z.sandboxImage??"default";if(X!=="default"){if(!Q)throw Error(`sandbox image ${X} needs the kubernetes provider`);return{kind:"kubernetes",reason:Y?"image":void 0}}if(!Q)return{kind:"freestyle"};if(!Y)return{kind:"kubernetes"};let J=this.strays.get($);if(J)this.retire(J,$);if(J!=="kubernetes"&&await Q.alive($).catch(()=>!1))return{kind:"kubernetes",reason:"existing"};let G=J==="freestyle"?!1:await Y.owns($).catch(()=>null);if(G)return{kind:"freestyle",reason:"existing"};if(G===null)return{kind:"kubernetes",reason:"freestyle-unavailable"};if(Z.provider)return{kind:Z.provider,reason:"requested"};if(this.hasWarmPool(Z,X))return{kind:"kubernetes",reason:"warm-pool"};if(NR$($)<this.freestyleShare)return{kind:"freestyle",reason:"split"};return await Q.hasSchedulableCapacity().catch(()=>!1)?{kind:"kubernetes",reason:"split"}:{kind:"freestyle",reason:"capacity"}}hasWarmPool($,Z){let Q=QT0($);if(!Q)return!1;return(this.providers.kubernetes?.listTenantPools?.()??[]).some((X)=>X.tenant===Q&&X.image===Z)}async ensure($,Z={}){let{provider:Q,...Y}=Z,X=F3($),J=await this.place(X,Z);if(this.remember(X,J.kind),this.strays.get(X)===J.kind)this.strays.delete(X);let G;try{let H=await this.get(J.kind).ensure($,Y);return J.reason?{...H,placement:{reason:J.reason}}:H}catch(H){G=_10(H,J.kind)}let W=Td4(J.kind);if(!J.reason||J.reason==="image"||Rd4(G))throw G;console.warn(`[SandboxProviderRouter] ensure ${X} failed on ${J.kind}, trying ${W}:`,G instanceof Error?G.message:String(G)),this.remember(X,W);let K;try{K=await this.get(W).ensure($,Y)}catch(H){throw this.picked.delete(X),_10(H,W)}if(J.reason==="existing")this.retire(J.kind,X);return{...K,placement:{reason:"fallback",fallbackFrom:J.kind}}}retire($,Z){this.strays.set(Z,$),E8(async()=>{if(this.strays.get(Z)===$)await this.get($).delete(Z)},{maxAttempts:3}).then(()=>{if(this.strays.get(Z)===$)this.strays.delete(Z)}).catch((Q)=>console.warn(`[SandboxProviderRouter] delete of ${$} sandbox ${Z} after fallback failed:`,Q instanceof Error?Q.message:String(Q)))}async delete($){let Z=this.strays.get($);this.strays.delete($),await Promise.all([(await this.owner($)).delete($),Z&&this.get(Z).delete($).catch(()=>{})]),this.picked.delete($)}async lastTermination($){return(await this.owner($)).lastTermination($)}async alive($){return(await this.owner($)).alive($)}async*watchClaimLifecycle($,Z){yield*(await this.owner($)).watchClaimLifecycle($,Z)}async hasSchedulableCapacity(){let{kubernetes:$,freestyle:Z}=this.providers;if(!$||Z)return!0;return $.hasSchedulableCapacity()}async getPreviewUrl($){return(await this.owner($)).getPreviewUrl($)}async proxyDaemonRequest($,Z,Q){return(await this.owner($)).proxyDaemonRequest($,Z,Q)}async adoptLiveClaim($,Z){return(await this.owner(Z)).adoptLiveClaim($,Z)}async resolvePreviewUpstreamUrl($){return(await this.owner($)).resolvePreviewUpstreamUrl($)}async proxyPreviewRequest($,Z){return(await this.owner($)).proxyPreviewRequest($,Z)}async markTenantPoolsDirty($,Z){return await this.providers.kubernetes?.markTenantPoolsDirty($,Z)??[]}async releaseAfter($,Z){await(await this.owner($)).releaseAfter($,Z)}async renewTtl($){await(await this.owner($)).renewTtl($)}async daemonEndpoint($){let Z=this.providers[await this.providerOf($)];if(!Z?.daemonEndpoint)throw Error("sandbox provider has no daemon endpoint to serve");return Z.daemonEndpoint($)}listSandboxes(){return this.providers.kubernetes?.listSandboxes?.()??[]}listTenantPools(){return this.providers.kubernetes?.listTenantPools?.()??[]}close(){this.providers.kubernetes?.close(),this.providers.freestyle?.close(),this.picked.clear(),this.strays.clear()}}var Ad4=5000,Td4=($)=>$==="kubernetes"?"freestyle":"kubernetes";var I91=D(()=>{a$();Gf();q10();ym()});var V91={};$6(V91,{toClaimPhase:()=>zR$,SandboxHostError:()=>Nf,RemoteSandboxProvider:()=>ER$});function nm($){return $ instanceof Error?$.message:String($)}function Cd4($){if(!Array.isArray($))return"";let Z=$[0];return typeof Z==="object"&&Z!==null&&"text"in Z&&typeof Z.text==="string"?Z.text:""}function _d4($){return $ instanceof MB&&$.code===503}function vd4($,Z){let Q=null;try{Q=JSON.parse(Z)}catch{}let Y=TL$.safeParse(Q);if(!Y.success)return new Nf(`${$} failed: ${Z.slice(0,300)}`);let X=Y.data.code==="bootstrap-rejected"?new PH(Y.data.status??502,Y.data.error):new Nf(`${$}: ${Y.data.error}`);return Y.data.provider?_10(X,Y.data.provider):X}function AT0($){return{kind:"failed",reason:"unknown",message:$}}function OR$($){return $.kind==="ready"||$.kind==="failed"}function LR$($){return B7(jR$,wR$,$,2,0.5)}function zT0(...$){let Z=$.filter((Q)=>Q!==void 0);return Z.length>1?AbortSignal.any(Z):Z[0]}class ER${baseUrl;token;credentialLifetimeMs;stallMs;timeDaemonRequest;closed=new AbortController;connecting=null;sandboxes=new Map;capacity=null;capacityInFlight=null;constructor($){this.baseUrl=$.baseUrl.replace(/\/$/,""),this.token=$.token,this.credentialLifetimeMs=$.credentialLifetimeMs,this.stallMs=$.stallMs??4*LL$,this.timeDaemonRequest=LT0($.meter)}headers(){return{authorization:`Bearer ${this.token}`}}client(){return this.connecting??=(async()=>{let $=new aZ({name:"studio",version:"1.0.0"}),Z=new CF(new URL(`${this.baseUrl}/mcp`),{requestInit:{headers:this.headers()},fetch:(Q,Y)=>fetch(Q,{...Y,timeout:!1})});return await $.connect(Z,{timeout:DR$}),$})().catch(($)=>{throw this.connecting=null,$}),this.connecting}async call($,Z,Q,Y={}){let{timeoutMs:X=DR$,signal:J}=Y,G;try{G=await E8(async()=>(await this.client()).callTool({name:$,arguments:{...Z}},void 0,{timeout:X??qd4,signal:J}),{maxAttempts:Md4,minTimeout:wR$,maxTimeout:jR$,jitter:Id4,isRetriable:_d4,signal:J})}catch(K){if(J?.aborted)throw J.reason;throw K instanceof P5?K.cause:K}if(G.isError)throw vd4($,Cd4(G.content));let W=Q.safeParse(G.structuredContent);if(!W.success)throw new Nf(`${$} returned a malformed result: ${W.error.message}`);return W.data}async whileHostAlive($,Z,Q){let Y=new AbortController,X=new AbortController;this.hostStall($,zT0(Y.signal,Q,this.closed.signal)??Y.signal).then((J)=>{if(J)X.abort(J)});try{return await Z(zT0(X.signal,Q,this.closed.signal)??X.signal)}finally{Y.abort()}}cached($){let Z=this.sandboxes.get($);if(!Z)return null;if(Date.now()-Z.at>kd4)return this.sandboxes.delete($),null;return Z}remember($,Z,Q,Y){if(this.sandboxes.delete($),!Z)return;if(this.sandboxes.size>=Sd4){let X=this.sandboxes.keys().next();if(!X.done)this.sandboxes.delete(X.value)}this.sandboxes.set($,{daemon:Z,previewUrl:Q,provider:Y,at:Date.now()})}async status($,Z={}){let Q=(X,J)=>this.call(LD.status,{handle:$,resurrect:Z.resurrect??!1},zL$,{signal:X,timeoutMs:J}),Y=Z.resurrect?await this.whileHostAlive($,(X)=>Q(X,null),Z.signal):await Q(Z.signal);return this.remember($,Y.daemon,Y.previewUrl,Y.provider),Y}async daemonFor($,Z={}){if(!Z.refresh){let Q=this.cached($);if(Q)return Q.daemon}return(await this.status($,{resurrect:!0,signal:Z.signal})).daemon}async ensure($,Z={}){let{image:Q,...Y}=Z,X=F3($),J=this.credentialLifetimeMs,G=Date.now(),W=await this.whileHostAlive(X,(K)=>this.call(LD.ensure,{id:$,opts:Y,...J&&{credentialsValidUntil:{orgFsConfig:G+J.orgFsConfig}}},EL$,{timeoutMs:null,signal:K}));if(W.handle!==X)throw new Nf(`host answered ensure with ${W.handle}, expected ${X}`);return this.remember(W.handle,W.daemon,W.previewUrl,W.provider),{handle:W.handle,workdir:W.workdir,previewUrl:W.previewUrl,warmPoolAdopted:W.warmPoolAdopted,provider:W.provider,...W.placement&&{placement:W.placement}}}async delete($){this.sandboxes.delete($),await this.call(LD.delete,{handle:$},z41)}async alive($){return(await this.status($)).alive}async getPreviewUrl($){let Z=this.cached($);if(Z)return Z.previewUrl;return(await this.status($)).previewUrl}async lastTermination($){return(await this.status($)).lastTermination}async lifetime($,Z){try{await this.call(LD.lifetime,$,z41)}catch(Q){console.warn(`[${pm}] ${Z} failed: ${nm(Q)}`)}}renewTtl($){return this.lifetime({handle:$},`TTL renew for ${$}`)}releaseAfter($,Z){return this.lifetime({handle:$,graceMs:Math.max(0,Math.round(Z))},`release of ${$}`)}hasSchedulableCapacity(){let $=this.capacity;if($&&Date.now()-$.at<Vd4)return Promise.resolve($.value);return this.capacityInFlight??=this.readCapacity().finally(()=>{this.capacityInFlight=null}),this.capacityInFlight}async readCapacity(){let $=!0;try{$=(await this.call(LD.capacity,{},PL$)).schedulable}catch(Z){console.warn(`[${pm}] capacity probe failed: ${nm(Z)}`)}return this.capacity={value:$,at:Date.now()},$}async adoptLiveClaim($,Z){let Q=await this.status(Z).catch(()=>null);return Boolean(Q?.daemon)}async markTenantPoolsDirty($,Z){try{return(await this.call(LD.tenantPoolsPush,{repoUrl:$,ref:Z},AL$)).pools}catch(Q){return console.warn(`[${pm}] tenant pool push for ${$}@${Z} failed: ${nm(Q)}`),[]}}list(){return this.call(LD.list,{},IL$)}pushCredentials($){return this.call(LD.credentialsPush,$,ML$)}close(){this.closed.abort(),this.sandboxes.clear();let $=this.connecting;this.connecting=null,$?.then((Z)=>Z.close()).catch(()=>{})}async proxyDaemonRequest($,Z,Q){let Y=Q.signal,X=await this.daemonFor($,{signal:Y});if(!X)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let J=this.sandboxes.get($)?.provider??"kubernetes";return this.timeDaemonRequest(RD[J],()=>hm(X,Z,Q,{unauthorized:async()=>{let G=await this.daemonFor($,{refresh:!0,signal:Y}).catch(()=>null);return G&&(G.token!==X.token||G.url!==X.url)?G:null},unreachable:()=>this.daemonFor($,{refresh:!0,signal:Y})}))}async resolvePreviewUpstreamUrl($,Z){return(await this.daemonFor($,{signal:Z}))?.url??null}proxyPreviewRequest($,Z){let Q=Z.signal;return lm(Z,{base:()=>this.resolvePreviewUpstreamUrl($,Q).catch((Y)=>{return console.warn(`[${pm}] preview upstream for ${$} failed: ${nm(Y)}`),null}),invalidate:()=>this.sandboxes.delete($),retryBase:()=>this.daemonFor($,{refresh:!0,signal:Q}).then((Y)=>Y?.url??null).catch(()=>null)},pm)}async*watchOnce($,Z){let Q=new URL(`${this.baseUrl}${OL$}`);Q.searchParams.set("handle",$);let Y=new AbortController,X,J=this.stallMs/2,G=()=>{clearTimeout(X),X=setTimeout(()=>Y.abort(Error(`host sent nothing for ${J/1000}s`)),J)};G();try{let W=await fetch(Q,{headers:{...this.headers(),accept:"text/event-stream"},signal:zT0(Y.signal,Z),timeout:!1});if(!W.ok||!W.body){await W.body?.cancel().catch(()=>{});let F=`watch answered ${W.status}`;throw W.status>=400&&W.status<500?new PT0(F):Error(F)}G();let K=new TextDecoder,H="";for await(let F of W.body){G(),H+=K.decode(F,{stream:!0});let U=H.indexOf(`
 
 `);while(U!==-1){let N=H.slice(0,U);H=H.slice(U+2),U=H.indexOf(`
@@ -1602,13 +1602,13 @@ ${X}`:X}case"media":return"";case"mediaSingle":case"mediaGroup":return zd(cU(Q),
                   then max(up.metadata->'models'->'thinking'->>'provider')
                 end`.as("provider")]).whereRef("up.thread_id","=","link.thread_id").where("up.kind","=","finish").as("cost"),(G)=>G.onTrue()).select((G)=>["cost.usd as costUsd","cost.provider as costProvider","link.task_board_item_id as taskId","link.thread_id as threadId","link.created_at as createdAt","t.status as status","t.failure_kind as failureKind","t.title as title","t.virtual_mcp_id as virtualMcpId","t.metadata as metadata","t.updated_at as updatedAt","t.last_progress_at as lastProgressAt","lastmsg.payload as lastMessagePayload",G.or([G.exists(G.selectFrom("thread_message_parts as mp").select("mp.id").whereRef("mp.thread_id","=","link.thread_id")),G.exists(G.selectFrom("thread_messages as tm").select("tm.id").whereRef("tm.thread_id","=","link.thread_id"))]).as("hasMessages")]).where("link.organization_id","=",Q).where("link.task_board_item_id","in",Y).orderBy("link.created_at","desc").execute(),J=new Map;for(let G of X){let W={threadId:G.threadId,virtualMcpId:G.virtualMcpId??null,status:G.status??null,failureKind:G.failureKind??null,title:G.title??null,lastMessage:Nb$(G.lastMessagePayload),hasPreview:S$6(G.metadata),hasMessages:!!G.hasMessages,lastActiveAt:_$6(G.updatedAt,G.lastProgressAt),costUsd:C$6(G.costUsd),costProvider:G.costProvider??null,createdAt:G.createdAt instanceof Date?G.createdAt.toISOString():G.createdAt},K=J.get(G.taskId);if(K)K.push(W);else J.set(G.taskId,[W])}for(let G of Z)G.threads=J.get(G.id)??[]}async attachTags($,Z){let Q=Z.map((J)=>J.id),Y=await $.selectFrom("task_board_item_tags as link").innerJoin("organization_tags as tag","tag.id","link.id").select(["link.task_board_item_id as taskId","link.created_by as createdBy","link.created_at as createdAt","tag.id as id","tag.name as name","tag.color as color"]).where("link.task_board_item_id","in",Q).orderBy("tag.name","asc").execute(),X=new Map;for(let J of Y){let G={id:J.id,name:J.name,color:J.color??null,createdBy:J.createdBy,createdAt:J.createdAt instanceof Date?J.createdAt.toISOString():J.createdAt},W=X.get(J.taskId);if(W)W.push(G);else X.set(J.taskId,[G])}for(let J of Z)J.tags=X.get(J.id)??[]}async attachActivityFields($,Z){let Q=Z.map((J)=>J.id),Y=await $.selectFrom("task_board_activity").select(["task_board_item_id as taskId","action","data","occurred_at"]).where("task_board_item_id","in",Q).where("action","in",["status_changed","review_approved","review_changes_requested"]).orderBy("occurred_at","asc").execute(),X=new Map;for(let J of Y){let G={action:J.action,data:J.data??null,occurredAt:J.occurred_at instanceof Date?J.occurred_at.toISOString():J.occurred_at},W=X.get(J.taskId);if(W)W.push(G);else X.set(J.taskId,[G])}for(let J of Z){let G=X.get(J.id)??[];J.statusSince=FD$(G,J.status,J.createdAt);let W=J.reviewCycleStartedAt,K=wj(G,{cycleStartedAt:W}),H=wj(G,{cycleStartedAt:W,verifiedOnly:!0});J.reviewVerdicts=VW.flatMap((F)=>{let U=K.get(F);if(!U)return[];return[{reviewer:F,verdict:U,verified:H.get(F)==="approved"}]})}}async recordActivity($){await this.db.insertInto("task_board_activity").values({id:i8("act"),task_board_item_id:$.taskBoardItemId,action:$.action,actor_id:$.actorId,data:$.data?JSON.stringify($.data):null,occurred_at:new Date().toISOString()}).execute(),await this.fanOut([$])}async fanOut($){for(let Z of $){let Q=I$6(Z.action);if(!Q)continue;await Id({db:this.db,taskBoardItemId:Z.taskBoardItemId,type:Q,actorId:Z.actorId,alsoSubscribe:Z.alsoSubscribe})}}async resolveReviewClaimByToken($,Z){let Q=await this.db.selectFrom("task_board_review_claims").select(["reviewer","cycle_at"]).where("task_board_item_id","=",$).where("token","=",Z).executeTakeFirst();return Q?{reviewer:Q.reviewer,cycleAt:Q.cycle_at}:null}async recordActivities($){if($.length===0)return;let Z=new Date().toISOString(),Q=[];for(let Y of $)if(!(V$6.has(Y.action)&&await this.touchRecentActivity(Y,Z)))Q.push(Y);if(Q.length===0)return;await this.db.insertInto("task_board_activity").values(Q.map((Y)=>({id:i8("act"),task_board_item_id:Y.taskBoardItemId,action:Y.action,actor_id:Y.actorId,data:Y.data?JSON.stringify(Y.data):null,occurred_at:Z}))).execute(),await this.fanOut(Q)}async touchRecentActivity($,Z){let Q=new Date(Date.parse(Z)-k$6).toISOString();return((await this.db.updateTable("task_board_activity").set({occurred_at:new Date(Z)}).where("id","=",this.db.selectFrom("task_board_activity").select("id").where("task_board_item_id","=",$.taskBoardItemId).where("action","=",$.action).where((X)=>$.actorId===null?X("actor_id","is",null):X("actor_id","=",$.actorId)).where("occurred_at",">=",new Date(Q)).orderBy("occurred_at","desc").limit(1)).executeTakeFirst()).numUpdatedRows??0n)>0n}async listActivity($,Z){return(await this.db.selectFrom("task_board_activity as a").innerJoin("task_board_items as item","item.id","a.task_board_item_id").selectAll("a").where("item.organization_id","=",Z).where("a.task_board_item_id","=",$).orderBy("a.occurred_at","asc").execute()).map((Y)=>({id:Y.id,taskBoardItemId:Y.task_board_item_id,action:Y.action,actorId:Y.actor_id,data:typeof Y.data==="string"?JSON.parse(Y.data):Y.data??{},occurredAt:Y.occurred_at instanceof Date?Y.occurred_at.toISOString():Y.occurred_at}))}async hasHumanRejectedDone($,Z){let Q=hX`a.data->>'from'`,Y=hX`a.data->>'reason'`,X="a.actor_id";return await this.db.selectFrom("task_board_activity as a").innerJoin("task_board_items as item","item.id","a.task_board_item_id").select("a.id").where("item.organization_id","=",Z).where("a.task_board_item_id","=",$).where("a.action","=","status_changed").where("a.actor_id","is not",null).where(Q,"in",["done","merged"]).where(Y,"is",null).limit(1).executeTakeFirst()!==void 0}async listComments($,Z){return(await this.db.selectFrom("task_board_comments as c").innerJoin("task_board_items as item","item.id","c.task_board_item_id").selectAll("c").where("item.organization_id","=",Z).where("c.task_board_item_id","=",$).orderBy("c.created_at","asc").execute()).map((Y)=>Jq0(Y))}async createComment($){if(!await this.db.selectFrom("task_board_items").select("id").where("id","=",$.taskBoardItemId).where("organization_id","=",$.organizationId).executeTakeFirst())return null;let Q=null;if($.parentId){let X=await this.db.selectFrom("task_board_comments").select(["id","parent_id"]).where("id","=",$.parentId).where("task_board_item_id","=",$.taskBoardItemId).executeTakeFirst();if(!X)return null;Q=X.parent_id??X.id}let Y=await this.db.insertInto("task_board_comments").values({id:i8("cmt"),task_board_item_id:$.taskBoardItemId,parent_id:Q,author_id:$.authorId,thread_id:$.threadId??null,body:$.body}).returningAll().executeTakeFirstOrThrow();return Jq0(Y)}async updateComment($){let Z=await this.commentInOrg($.id,$.organizationId);if(!Z)return null;if($.body!==void 0&&Z.authorId!==$.callerId)return null;if($.resolved!==void 0&&Z.parentId!==null)return null;let Q=await this.db.updateTable("task_board_comments").set({...$.body===void 0?{}:{body:$.body},...$.resolved===void 0?{}:{resolved:$.resolved},updated_at:new Date().toISOString()}).where("id","=",$.id).returningAll().executeTakeFirst();return Q?Jq0(Q):null}async deleteComment($,Z,Q){let Y=await this.commentInOrg($,Z);if(!Y)return!1;if(Y.authorId!==Q&&Y.authorId!==R8)return!1;return await this.db.deleteFrom("task_board_comments").where("id","=",$).execute(),!0}async getComment($,Z){let Q=await this.db.selectFrom("task_board_comments as c").innerJoin("task_board_items as item","item.id","c.task_board_item_id").selectAll("c").where("c.id","=",$).where("item.organization_id","=",Z).executeTakeFirst();return Q?Jq0(Q):null}async commentInOrg($,Z){let Q=await this.db.selectFrom("task_board_comments as c").innerJoin("task_board_items as item","item.id","c.task_board_item_id").select(["c.id","c.author_id","c.parent_id"]).where("c.id","=",$).where("item.organization_id","=",Z).executeTakeFirst();return Q?{authorId:Q.author_id,parentId:Q.parent_id}:null}itemFromDbRow($){return{id:$.id,organizationId:$.organization_id,title:$.title,description:$.description,status:$.status,priority:$.priority,type:$.type??T81,assigneeId:$.assignee_id,assignedBy:$.assigned_by,repo:$.repo,repositoryId:$.repository_id??null,dueDate:$.due_date instanceof Date?$.due_date.toISOString():$.due_date,externalUrl:$.external_url??null,previewRoutes:$.preview_routes??[],source:$.source??null,sortOrder:$.sort_order,keySeq:$.key_seq,retryAttempts:$.retry_attempts??0,reviewCycleStartedAt:$.review_cycle_started_at instanceof Date?$.review_cycle_started_at.toISOString():$.review_cycle_started_at??null,threads:[],tags:[],reviewVerdicts:[],statusSince:null,createdBy:$.created_by,createdAt:$.created_at instanceof Date?$.created_at.toISOString():$.created_at,updatedBy:$.updated_by,updatedAt:$.updated_at instanceof Date?$.updated_at.toISOString():$.updated_at}}}var M$6,V$6,k$6=600000,Bb$,y$0,v$6;var xD=D(()=>{at();i4();kW();FY();x4();x4();uR0();$q0();Xq0();Do();M$6=new Set(eR0);V$6=new Set(["description_changed","title_changed"]);Bb$=new Set(["in_progress","in_review"]),y$0=new Set(["completed","failed","expired"]);v$6=[...oK0,"done"]});function NE($){if($==null)return null;if(typeof $==="string")return v11($);let Z;try{Z=JSON.stringify($)}catch{return null}return Z?v11(Z):null}function g$0($){return{repo:eW0($.url)?.repo??IY($.url)??lc($.repoOwner,$.repoName),repositoryId:$.repositoryId,connectionId:$.connectionId}}var bf=D(()=>{i4()});function h$0($){return $.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;")}function b$6($){let Z=qd($.orgSlug,$.keySeq),Q=Z??$.title,Y=Z?`${$.baseUrl}/${encodeURIComponent($.orgSlug)}/t/${encodeURIComponent(Z)}`:null,X=$.prs.map((J)=>`<p style="margin:0 0 8px 0;"><a href="${h$0(J.url)}" style="color:#141413;">Review ${h$0(J.repo)} #${J.number}</a></p>`).join("");return{subject:`${Q} is ready for your review`,html:vG({preheader:`${Q} has a pull request waiting for you.`,heading:"Ready for your review",subheading:Y?`<a href="${Y}" style="color:#141413;">${h$0(Q)}</a> \u2014 ${h$0($.title)}`:h$0($.title),body:X})}}function x$6(){let $=pK().auth,Z=$.emailProviders??[],Q=$.inviteEmailProviderId?_G(Z,$.inviteEmailProviderId):Z[0];return Q?CG(Q):null}async function Db$($,Z){try{let Q=await $.storage.organizationSettings.get(Z.organizationId);if(!jZ(Q?.flags,"home_task_intake_enabled"))return;if(!Z.createdBy)return;let Y=await $.storage.taskBoard.listPrs(Z.id,Z.organizationId);if(Y.length===0)return;let X=await $.db.selectFrom("user").innerJoin("member","member.userId","user.id").select("user.email as email").where("user.id","=",Z.createdBy).where("member.organizationId","=",Z.organizationId).executeTakeFirst();if(!X?.email)return;let J=await $.db.selectFrom("organization").select("slug").where("id","=",Z.organizationId).executeTakeFirst();if(!J?.slug)return;let G=x$6();if(!G)return;let{subject:W,html:K}=b$6({title:Z.title,orgSlug:J.slug,keySeq:Z.keySeq,prs:Y.map((H)=>({url:H.url,repo:`${H.repoOwner}/${H.repoName}`,number:H.number})),baseUrl:WZ()});await G({to:X.email,subject:W,html:K})}catch(Q){console.error(`[task-board] PR-ready email for ${Z.id} failed`,Q)}}var Ob$=D(()=>{Qq0();t9();w2();ks();I9()});function dU($){return!!$&&E0().taskBoardAdminOrgIds.includes($)}async function SQ1($,Z){let Q=E0().taskBoardAdminOrgIds;if(!Z||Q.length===0)return!1;return!!await $.selectFrom("member").select(["id"]).where("userId","=",Z).where("organizationId","in",Q).executeTakeFirst()}async function iU($){if(!$.db)return!1;return SQ1($.db,$.auth?.user?.id)}function fD($){console.log("task_board_admin_action",$)}var Vd=D(()=>{X$()});async function VH($,Z){let Q=await $.selectFrom("organization").select(["id","slug","name"]).where("id","=",Z).executeTakeFirst();if(!Q)return null;let Y=await cQ.create();return Y.organization={id:Q.id,slug:Q.slug,name:Q.name},BE(Y,{id:Q.id,slug:Q.slug}),Y}var kd=D(()=>{wU()});import{z as f$6}from"zod";async function h$6($,Z,Q){if(!dU($.organization?.id)||!await iU($))throw Error("Not allowed to act on another organization (the `org` parameter needs an admin org)");let Y=await $.storage.taskBoardAnalytics.resolveOrgRef(Z);if(!Y)throw Error(`Organization not found: ${Z}`);let X=await VH($.db,Y.id);if(!X)throw Error(`Organization not found: ${Z}`);return fD({action:"tool_org_override",actorUserId:$.auth?.user?.id,actorOrgId:$.organization?.id,targetOrgId:Y.id,tool:Q}),X.auth=$.auth,X.boundAuth=$.boundAuth,X.access=$.access,X}function Sd($){let Z=$;return{...$,description:`${$.description}${g$6}`,inputSchema:Z.inputSchema.extend(y$6),execute:async(Q,Y)=>{let{org:X,...J}=Q??{};if(!X)return Z.execute(Q,Y);return Z.execute(J,await h$6(Y,X,$.name))}}}var y$6,g$6;var Gq0=D(()=>{Vd();kd();y$6={org:f$6.string().optional().describe("Org slug or id to read instead of the current one. Requires membership of an admin org; omit for the current org.")},g$6=" Pass `org` to read ANOTHER organization's board instead of the current "+"one \u2014 call TASK_BOARD_ADMIN_ORG_LIST first for the organizations you may "+"name (an empty list means none, and `org` will be refused)."});import{z as Wq0}from"zod";async function $5($,Z){try{await $.storage.taskBoard.recordActivity(Z)}catch(Q){console.error("[task-board] activity log write failed",Q)}}async function Lb$($,Z){if(Z.length===0)return;try{await $.storage.taskBoard.recordActivities(Z)}catch(Q){console.error("[task-board] activity log write failed",Q)}}var u$6,CQ1;var cY=D(()=>{k0();cJ();Gq0();u$6=c({name:"TASK_BOARD_ACTIVITY_LIST",description:"List a task board item's change history (timeline, oldest first).",annotations:{title:"List Task Activity",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:Wq0.object({taskBoardItemId:Wq0.string()}),outputSchema:Wq0.object({activity:Wq0.array(gR$)}),handler:async($,Z)=>{n(Z),await Z.access.check();let Q=Z.organization?.id;if(!Q)throw Error("Organization ID required (no active organization in context)");return{activity:await Z.storage.taskBoard.listActivity($.taskBoardItemId,Q)}}}),CQ1=Sd(u$6)});function xf($){if($.length===0)return!1;let Z=new Map;for(let Q of $){let Y=`${Q.repoOwner}/${Q.repoName}`.toLowerCase(),X=Z.get(Y);if(X)X.push(Q);else Z.set(Y,[Q])}return[...Z.values()].every(l$6)}function l$6($){return $.some((Z)=>Z.merged===!0)&&$.every((Z)=>Z.merged===!0||Z.state==="closed")}async function c$6($,Z,Q,Y){let X=await $.storage.taskBoard.getById(Q,Z);if(!X||X.status!=="done")return!1;let J=await $.storage.taskBoard.listPrs(Q,Z),G=await Promise.all(J.map(async(H)=>({...H,...await Y($,Z,H)})));if(!xf(G))return!1;let W=R$.archive,K=await $.storage.taskBoard.update(Q,Z,{status:W},X.updatedBy);return await $5($,{taskBoardItemId:Q,action:"status_changed",actorId:null,data:{from:"done",to:W,reason:"merged_pr_auto_archive"}}),L8(Z,K),!0}async function wb$($,Z,Q,Y=Hq0){let X=0;for(let J of Q)try{if(await c$6($,Z,J,Y))X+=1}catch(G){console.error(`[task-board-archive] ${J} failed`,G)}return{archived:X}}function Kq0($){let Z=new Map;for(let{id:Q,organizationId:Y}of $){let X=Z.get(Y);if(X)X.push(Q);else Z.set(Y,[Q])}return[...Z].map(([Q,Y])=>({organizationId:Q,itemIds:Y}))}var Cd=D(()=>{x4();cY();v7();P9()});function ff($){let Z=d$6[$];if(Z===void 0)throw Error(`Unknown board column "${$}"`);return Z}function _Q1($){return jb$.includes($)}function Eb$($,Z){return ff(Z)>ff($)}function Uq0($,Z){return ff($)<=ff(Z)}function Pb$($){return $==="done"||jb$.includes($)}function uX($){if(ff($.status)>Fq0.in_review)return!1;return $.status===R$.review||Boolean($.reviewCycleStartedAt)}var m$6,Fq0,d$6,jb$,zb$;var kH=D(()=>{x4();m$6=Object.fromEntries(OH.map(($,Z)=>[$,Z])),Fq0=m$6,d$6=Fq0;jb$=oK0;zb$=new Set(["in_review","approved"])});function Nq0($){return $===""?"Your Studio tools are registered under their bare names: a tool named `JIRA_COMMENT_ADD` is called exactly that.":"Your Studio tools are namespaced `mcp__studio__`: where an instruction names a tool `JIRA_COMMENT_ADD`, the tool you actually call is `mcp__studio__JIRA_COMMENT_ADD`. Don't search for the unprefixed name."}function Bq0($){return $.replace(/\/api\/[^/\s)]+\/fs\/([^/\s)]+)\/read\?path=([^)\s]+)/g,(Z,Q,Y)=>{let X,J;try{X=decodeURIComponent(Q),J=decodeURIComponent(Y)}catch{return Z}let G=(W)=>W.startsWith("/")||W.split("/").includes("..");if(G(X)||G(J))return Z;return vW(X,J)})}function Dq0($,Z){return Z===$?null:"The image and file links in that description are real paths in this sandbox, not URLs \u2014 `Read` them. A screenshot the task points at is usually the clearest statement of what it wants."}var vQ1=D(()=>{OD()});function i$6($,Z){let Q=Z?.repositoryId,Y=Z?.repo;if(Q){let X=$.filter((J)=>J.repository?.id===Q);if(X.length>0)return X}if(Y)return $.filter((X)=>`${X.owner}/${X.name}`.toLowerCase()===Y.toLowerCase());return Q?[]:$}function p$6($,Z){if($=i$6($,Z),$.length!==1)return null;let Q=$[0];return{id:Q.id,owner:Q.owner,name:Q.name,url:Q.webUrl,provider:Q.provider,...Q.connectionId?{connectionId:Q.connectionId}:{},...Q.repository?{repositoryId:Q.repository.id}:{},...Q.installationId!==void 0?{installationId:Q.installationId}:{}}}async function Lq0($,Z,Q){if(!MO())return console.warn(`[task-board] claude-code skipped for org ${Z}: `+"hosted sandbox unavailable \u2014 running Decopilot"),null;try{let Y=await xj($,Z),X=p$6(Y,Q);if(X)return{repo:X};if(Y.length===0)return console.warn(`[task-board] claude-code skipped for org ${Z}: `+"no importable repos \u2014 running Decopilot"),null;return console.warn(`[task-board] claude-code for org ${Z}: ${Y.length} importable repos \u2014 the run picks one with TASK_ADD_REPO`),{choices:Y.map((J)=>({id:J.id,repo:`${J.owner}/${J.name}`}))}}catch(Y){return console.warn("[task-board] repo lookup for claude-code failed",Y),null}}function Oq0($){let Z=$?.others??[];if(Z.length===0)return[];return[`This issue spans ${Z.length+1} repositories, and it has an open pull request in each of the others too:`,...Z.map((Q)=>`- ${Q.repo}: pull request #${Q.number} (${Q.url}) on branch \`${Q.head}\`. After cloning that repository, run \`git fetch origin +refs/heads/${Q.head}:refs/remotes/origin/${Q.head} && git checkout -B ${Q.head} origin/${Q.head}\` BEFORE editing (the clone is single-branch, so a bare \`git fetch origin ${Q.head}\` creates no branch to check out), and push to update that SAME pull request \u2014 do NOT open a new one there.`),"A change that only lands on one side is worse than none: if you cannot update them all, update none and say why."]}function Ab$($,Z,Q){let Y=YU$(Z?.provider??"github"),X=Q?.source?.kind==="jira",J=[Q?.instruction?.trim()||(X?"":`You've been assigned this task. Complete it and finish with a ${Y.changeRequest} if it makes sense (like a coding task) or is explicitly requested.`),"","You are running AUTONOMOUSLY \u2014 no human is watching, so drive this to "+"completion yourself. Make reasonable decisions and move on; do not stop to ask for confirmation.","",`Title: ${$.title}`];if($.description){let G=Bq0($.description);J.push("","Description:",G);let W=Dq0($.description,G);if(W)J.push("",W)}if(J.push("",Z?`The repository ${Z.owner}/${Z.name} is already cloned at your working directory, on its own branch. It is hosted on ${Y.name}, so ${Y.cli?`\`git\` and \`${Y.cli}\` are`:"`git` is"} authenticated there${Y.cli?"":" (Bitbucket has no CLI; `$BITBUCKET_TOKEN` is the bearer for its REST API)"}. ${D00}`:["Your working directory is EMPTY: this organization has several repositories, so nothing has been cloned yet. FIRST call `mcp__studio__TASK_ADD_REPO` with the id of the repository this task is about. It clones that repository into your working directory and waits for the checkout, so once it returns the repository is there on its own branch, with `git` and that repository's own CLI authenticated. Do not read files or run `git` before it returns; there is nothing there yet.","","Repositories in this organization:",...(Q?.repoChoices??[]).map((G)=>`- ${G.repo} (id: ${G.id})`),Q?.repoChoices?.length?"Start with the one the task is about. If it turns out to need a change in "+"another of them too, call `mcp__studio__TASK_ADD_REPO` again \u2014 repositories "+"accumulate, so a second call adds a checkout beside the first rather than replacing it. Each lands in its own directory and keeps its own git remote, so open one change request per repository you changed.":"Call `mcp__studio__TASK_ADD_REPO` with no arguments to list them."].join(`
 `),"",n$6,""),Q?.resolveConflict&&Q.pr)J.push(`Pull request #${Q.pr.number} (${Q.pr.url}) is approved but has a MERGE CONFLICT with its base branch.`,`Check that branch out (\`${f11(Z?.provider??"github",Q.pr.number)}\`), merge or rebase the base branch into it, resolve the conflicts, and push to update the SAME ${Y.changeRequest} \u2014 do NOT open a new one. Resolve by preserving BOTH sides' intent; never blindly discard either side, and change only what the conflict requires.`,"");else if(Q?.feedback)J.push(Q.pr?`A reviewer requested changes on pull request #${Q.pr.number} (${Q.pr.url}):`:"A reviewer requested changes on your previous work:",Q.feedback,Q.pr?`Check that branch out (\`${f11(Z?.provider??"github",Q.pr.number)}\`) before editing, address the feedback, then push to update the SAME ${Y.changeRequest} \u2014 do NOT open a new one.`:"Address this feedback.",...Oq0(Q.pr),"");else if(Q?.pr)J.push(`This task already has an open pull request #${Q.pr.number} (${Q.pr.url}), and you are already on its branch.`,"Continue that work: commit and push to update the SAME pull request \u2014 do NOT open a new one. If it already does everything the task asks, say so and stop rather than changing it.",...Oq0(Q.pr),"");if(X)return J.push(Nq0("mcp__studio__"),""),J.join(`
-`).trimStart();return J.push("How to finish:","- Make the change, commit it, push the branch, and open a pull request"+(Q?.pr?" \u2014 or push to the existing one, per the instruction above.":"."),"- Change only what the task needs. Don't refactor around it.","- The change must be REACHABLE from the surface the task names: edit the component that route actually renders, not one that merely looks like the right place. A change nothing imports is the most common reason a task comes back rejected.","- Before handing over, VERIFY the task's outcome LOCALLY, in the sandbox: exercise the affected code path and confirm the behaviour actually happens. A green test suite is not the bar. Do NOT wait for, or verify against, the PR's deploy preview \u2014 a reviewer checks that after you hand over.",'- A browser is installed globally, NOT in the repo\'s `node_modules` \u2014 don\'t go looking for playwright there. `qa-screenshot <url> <path>.png [--mobile] [--full] [--selector=<css>]` renders any URL (localhost included) in headless Chromium, runs the page\'s JS, and writes a file you must then `Read` \u2014 a screenshot you never opened is not verification. Write screenshots under `/app/org/output/` and EMBED them in your task comment as markdown images, `![home](/app/org/output/qa/home.png)` \u2014 only that form renders on the card; a bare path or a code span shows the reader nothing. To INTERACT (click, fill, `document.elementFromPoint`), write a throwaway node script: `const { chromium } = require("/usr/local/lib/node_modules/playwright-core"); chromium.launch({ executablePath: "/usr/bin/chromium", args: ["--no-sandbox"] })`.',`- Open the ${Y.changeRequest} from the branch you were given \u2014 the board finds it by that branch. Don't move the work to a differently-named one.`),J.push(`- If your change adds or edits pages a person can open, report their paths with \`mcp__studio__TASK_BOARD_ITEM_UPDATE\` (id "${$.id}", \`previewRoutes: ["/some-page"]\`) \u2014 paths only, no host. The card joins them onto the deploy preview so a reviewer opens the page directly. Skip it when the change has no visible route.`,'- If the task turns out to need no code change, do NOT open a PR: explain why in a comment on the task (`mcp__studio__TASK_BOARD_COMMENT_CREATE`) and move it to "done". There is nothing for a reviewer to review, so leaving it for one would strand it.',`- Anything a reviewer should know (a decision you made, something you found and deliberately left alone, a question) goes on the task as a comment: \`mcp__studio__TASK_BOARD_COMMENT_CREATE\` with taskBoardItemId "${$.id}". Read what's already there first with \`mcp__studio__TASK_BOARD_COMMENT_LIST\` \u2014 a comment may be addressed to you.`,"",`(task id: ${$.id})`),J.join(`
+`).trimStart();return J.push("How to finish:","- Make the change, commit it, push the branch, and open a pull request"+(Q?.pr?" \u2014 or push to the existing one, per the instruction above.":"."),"- Change only what the task needs. Don't refactor around it.","- The change must be REACHABLE from the surface the task names: edit the component that route actually renders, not one that merely looks like the right place. A change nothing imports is the most common reason a task comes back rejected.","- Before handing over, VERIFY the task's outcome LOCALLY, in the sandbox: exercise the affected code path and confirm the behaviour actually happens. A green test suite is not the bar. Do NOT wait for, or verify against, the PR's deploy preview \u2014 a reviewer checks that after you hand over.",'- A browser is installed globally, NOT in the repo\'s `node_modules` \u2014 don\'t go looking for playwright there. `qa-screenshot <url> <path>.png [--mobile] [--full] [--selector=<css>]` renders any URL (localhost included) in headless Chromium, runs the page\'s JS, and writes a file you must then `Read` \u2014 a screenshot you never opened is not verification. Write screenshots under `/app/org/output/` and EMBED them in your task comment as markdown images, `![home](/app/org/output/qa/home.png)` \u2014 only that form renders on the card; a bare path or a code span shows the reader nothing. To INTERACT (click, fill, `document.elementFromPoint`), write a throwaway node script: `const { chromium } = require("/usr/local/lib/node_modules/playwright-core"); chromium.launch({ executablePath: "/usr/bin/chromium", args: ["--no-sandbox"] })`. Add `--engine=webkit` (WebKit, Safari\'s engine) when a mobile scroll, snap or animation quirk could be engine-specific, or when asked to check Safari; to script it, `webkit` from the same playwright-core with `browser.newContext(devices["iPhone 13"])`. It is not a real iPhone or Mac: report it as "checked in WebKit", not as tested on iOS or Safari.',`- Open the ${Y.changeRequest} from the branch you were given \u2014 the board finds it by that branch. Don't move the work to a differently-named one.`),J.push(`- If your change adds or edits pages a person can open, report their paths with \`mcp__studio__TASK_BOARD_ITEM_UPDATE\` (id "${$.id}", \`previewRoutes: ["/some-page"]\`) \u2014 paths only, no host. The card joins them onto the deploy preview so a reviewer opens the page directly. Skip it when the change has no visible route.`,'- If the task turns out to need no code change, do NOT open a PR: explain why in a comment on the task (`mcp__studio__TASK_BOARD_COMMENT_CREATE`) and move it to "done". There is nothing for a reviewer to review, so leaving it for one would strand it.',`- Anything a reviewer should know (a decision you made, something you found and deliberately left alone, a question) goes on the task as a comment: \`mcp__studio__TASK_BOARD_COMMENT_CREATE\` with taskBoardItemId "${$.id}". Read what's already there first with \`mcp__studio__TASK_BOARD_COMMENT_LIST\` \u2014 a comment may be addressed to you.`,"",`(task id: ${$.id})`),J.join(`
 `)}var n$6;var bQ1=D(()=>{m00();i4();x4();X$();vQ1();n$6='Each checkout is authenticated for ITS OWN host: use `gh` inside a GitHub repository and `glab` inside a GitLab one (`glab mr create` is the counterpart of `gh pr create`). Bitbucket has no CLI: inside a Bitbucket repository open pull requests through the Studio tools or the REST API with `curl -H "Authorization: Bearer $BITBUCKET_TOKEN"` against api.bitbucket.org. A run can hold several at once, so pick the one that matches the repository '+"you are standing in \u2014 check its remote with `git remote get-url origin` if "+"you are unsure."});import{createHmac as t$6,timingSafeEqual as o$6}from"crypto";function xQ1($,Z,Q){return`rtok_${t$6("sha256",cR0()).update(`${$}:${Z}:${Q.toISOString()}`).digest("base64url")}`}function Tb$($,Z,Q,Y){let X=Buffer.from($),J=Buffer.from(xQ1(Z,Q,Y));return X.length===J.length&&o$6(X,J)}var fQ1=D(()=>{c71()});import{createHash as r$6}from"crypto";function u$0($,Z){if($.status===null||Rb$.has($.status))return!1;return!k$0({updated_at:$.lastActiveAt,last_progress_at:null},Z)}function yQ1($,Z){return $.threads.some((Q)=>!VW.some((Y)=>Lj(Q.title,Y))&&u$0(Q,Z))}function e$6($,Z){return Z-$>=a$6}function $86($,Z,Q,Y){if($||Z!==!1)return!1;return e$6(Q,Y)}async function _d($,Z,Q){let Y=await $.storage.organizationSettings.get(Z.organizationId),X=Q?.kinds??GD(Y?.flags);if(X.length===0)return[];if(yQ1(Z,Date.now()))return[];let J=jZ(Y?.flags,"cheap_reviewer_model")?"reviewer":"default",G=await $.storage.taskBoard.listActivity(Z.id,Z.organizationId),W=Z.reviewCycleStartedAt,K=WD(G,W),H=new Date(K),F=wj(G,{cycleStartedAt:W}),U=[];return await Promise.all(X.map(async(N)=>{let B=F.has(N);if(!B){let w=W86(G,K),j=G86(Z,N,K,w);if(j){await U86($,Z,N,j).catch((E)=>console.error(`[task-board] ${N} verdict nudge failed`,E));return}if(H86(w,Date.now()))return}if(X86(Z,N,K,Date.now(),B)){await SH($,Z,`${EU[N]} failed ${gQ1} times on `+"this review \u2014 it will not be retried");return}if(Q?.previewMatchesHead===!1){if($86(B,Q.previewMatchesHead,K,Date.now()))await SH($,Z,"the pull request's deploy preview is not showing its latest commit (its checks never went green), so the Reviewer cannot verify this change against what the PR actually does");return}if(J86(Z,N,K,Date.now(),B))return;let O=Z86(Z,N,K,Date.now(),B);if(await D86($,Z,N,H,O,J).catch((w)=>{return console.error(`[task-board] ${N} reviewer enqueue failed`,w),!1}))U.push(N)})),U}function Z86($,Z,Q,Y=Date.now(),X=!0){return $.threads.filter((J)=>Lj(J.title,Z)&&hQ1(J,Y,X)&&new Date(J.createdAt).getTime()>=Q).length}function Q86($,Z){if(!$||!Z||!("choices"in Z))return null;return Z.choices.find((Q)=>Q.repo===$)?.id??null}function Y86($,Z,Q){let Y=$.threads.filter((X)=>Lj(X.title,Z)&&X.status==="completed"&&new Date(X.createdAt).getTime()<Q).map((X)=>new Date(X.lastActiveAt).getTime()).filter((X)=>Number.isFinite(X));return Y.length===0?0:Math.max(...Y)}function hQ1($,Z,Q=!0){if($.status==="failed")return!0;if($.status!==null&&Rb$.has($.status))return!Q;return $.status!==null&&!u$0($,Z)}function qb$($,Z,Q,Y=Date.now()){return $.threads.filter((X)=>{if(!Lj(X.title,Z))return!1;return u$0(X,Y)||new Date(X.createdAt).getTime()>=Q})}function X86($,Z,Q,Y=Date.now(),X=!0){let J=qb$($,Z,Q,Y);return J.length>0&&J.every((G)=>hQ1(G,Y,X))&&J.length>=gQ1}function J86($,Z,Q,Y=Date.now(),X=!0){let J=qb$($,Z,Q,Y);if(J.length===0)return!1;if(J.some((W)=>u$0(W,Y)))return!0;let G=J.filter((W)=>hQ1(W,Y,X));if(G.length>=gQ1)return!0;return G.length!==J.length}function G86($,Z,Q,Y,X=Date.now()){return $.threads.find((J)=>Lj(J.title,Z)&&J.status==="completed"&&!u$0(J,X)&&new Date(J.createdAt).getTime()>=Q&&!Y.has(J.threadId))??null}function W86($,Z){let Q=new Map;for(let Y of $){if(Y.action!=="review_verdict_requested")continue;let X=new Date(Y.occurredAt).getTime();if(X<Z)continue;let J=Y.data?.threadId;if(typeof J==="string")Q.set(J,X)}return Q}function H86($,Z){for(let Q of $.values())if(Z-Q<K86)return!0;return!1}function F86($){return[`Your ${EU[$]} run ended without recording a decision, so the task is stuck: nothing ships and nobody is told why. A review that reaches no verdict is not a review.`,"","Do exactly ONE thing in this run and then stop:","- Call `TASK_BOARD_REVIEW_DECISION` now, with the verdict your review already reached and notes that say what you checked.","- Approve ONLY if you actually exercised the change and it holds. If you could not finish \u2014 a check never came back, a preview never rendered, you ran out of room \u2014 `request_changes` and say exactly what is unresolved. That hands the card to a person, which is the correct outcome for an unfinished review.","- Do NOT re-run the review, do NOT change any code, and do NOT wait on any background task: whatever you know right now is the verdict."].join(`
 `)}async function U86($,Z,Q,Y){let X=await $.storage.threads.get(Y.threadId);if(!X||X.message_storage_version!==2)return;await $.storage.taskBoard.recordActivity({taskBoardItemId:Z.id,action:"review_verdict_requested",actorId:null,data:{reviewer:Q,threadId:Y.threadId}}),console.warn(`[task-board] ${Q} reviewer on ${Z.id} completed with no verdict \u2014 `+"asking for one"),await Td($,Z,X,{messageId:`review-verdict-${Y.threadId}`,prompt:F86(Q),workflowID:`review-verdict:${Y.threadId}`,runClass:"reviewer"})}function N86($,Z,Q,Y){return`review:${$}:${Z}:${Q.toISOString()}:${Y}`}function B86($){return`thrd_${r$6("sha256").update($).digest("hex").slice(0,32)}`}async function D86($,Z,Q,Y,X,J){let G=Z.organizationId,W=xQ1(Z.id,Q,Y),K=await Lq0($,G,{repositoryId:Z.repositoryId,repo:Z.repo}),H=K&&"repo"in K?K.repo:null,F=K!==null,U=Y86(Z,Q,Y.getTime()),N=Q86(Z.repo,K),B=F?"mcp__studio__TASK_BOARD_ITEM_PRS_GET":"TASK_BOARD_ITEM_PRS_GET",O=F?"mcp__studio__TASK_BOARD_REVIEW_DECISION":"TASK_BOARD_REVIEW_DECISION",L=F?"mcp__studio__TASK_BOARD_COMMENT_CREATE":"TASK_BOARD_COMMENT_CREATE",w=F?"mcp__studio__TASK_BOARD_COMMENT_LIST":"TASK_BOARD_COMMENT_LIST",j=[s$6[Q],"","You are running AUTONOMOUSLY \u2014 no human is watching this run. Making the "+'approve / request-changes call IS your job; you are the decision-maker, not an assistant asking a human to decide. NEVER use `user_ask` to ask whether to approve, or to confirm an obvious call ("Approve the PR?"). Reserve `user_ask` for a genuine, unresolvable blocker only a human can clear (e.g. a missing credential, or a requirement so ambiguous you '+"truly cannot judge the outcome) \u2014 that should be rare. When in doubt "+"between asking and deciding, DECIDE.","","Do NOT merge the pull request \u2014 the board does that itself once your "+"approval is in. Pushing fixes to the PR's own branch is expected of you; opening a second pull request, force-pushing, or touching any other ref is not."].join(`
 `),E=Z.description&&F?Bq0(Z.description):Z.description,z=Z.description&&E?Dq0(Z.description,E):null,T=[...F?[]:[j,""],`Task title: ${Z.title}`,E?`
 Task description:
 ${E}
-`:"",...z?[z,""]:[],"How to work:",`- Call \`${B}\` with the task id below to find the pull request under review.`,H?`- The repository ${H.owner}/${H.name} is already cloned at your working directory and \`git\` and its CLI (\`gh\` for GitHub, \`glab\` for GitLab; Bitbucket has no CLI \u2014 use the REST API with \`curl\` and \`$BITBUCKET_TOKEN\`) are authenticated \u2014 check the PR's branch out there to inspect / exercise the change. ${D00}`:F?`- Your working directory is EMPTY. Call \`mcp__studio__TASK_ADD_REPO\` ${N?`with id \`${N}\` (${Z.repo}) FIRST \u2014 do NOT call it with no arguments, that only lists the org's repositories and costs you a turn.`:"with the id of the PR's repository FIRST;"} it clones the repository and waits for the checkout, and \`git\` and its CLI are authenticated once it returns. ${D00}`:"- Load the PR's repository to inspect / exercise the change.",`- ${KD$}`,...U>0?[`- This is a RE-REVIEW. You already reviewed an earlier version of this pull request and asked for changes, and there are more commits since (a human re-delegated the card, or your own fixes from that round are in the history). Read your own previous notes with \`${w}\`, then review WHAT MOVED SINCE \u2014 \`gh pr diff <number>\` still shows the whole PR, so narrow it with \`git log --since='${new Date(U).toISOString()}' --oneline\` and diff only those commits. Confirm your earlier notes were addressed and check the new commits for their own problems. Do NOT re-read the parts of the PR you already cleared.`]:[],"- Fix the issues you find on the PR's branch, run the repository's own checks, and push to that same PR. You are the last automated run on this task \u2014 nothing picks up findings you only describe.",`- THEN exercise the change. If the PR has a deploy \`previewUrl\` (from \`${B}\`), use it \u2014 re-read it after your push so you get the preview of YOUR commit, wait for it if it is still building, and deep-link to the page/route the task affects (not root). If there is NO preview, exercise it in the sandbox instead: run the repository's own checks, and for a UI change build and serve it locally and capture it (a Flutter app runs on an Android emulator, but only on the Android sandbox image \u2014 see the \`flutter-app\` skill). Either way, if you cannot exercise it at all, do NOT approve \u2014 \`request_changes\` saying which path you tried and what blocked it.`,"- For a VISUAL change, capture before/after by running `qa-screenshot <url> /app/org/output/qa/<name>.png [--mobile] [--full] [--selector=<css>] [--console]` (headless Chromium, baked into the sandbox; also works against a dev server you started on localhost \u2014 none is running by default, this pod is a checkout). Choose the framing: default is the top viewport, `--full` is the whole page, and `--selector='<css>'` frames just the component you changed (best for a focused before/after). Add `--mobile` too for a responsive change, and `--console` to catch the runtime errors a screenshot alone reports as a pass. WRITE them under `/app/org/output/` \u2014 that's what surfaces them on the task. Then `Read` the files to actually LOOK at them: a screenshot you never opened is not verification. To INTERACT with a page \u2014 click, hit-test with `document.elementFromPoint`, fill a form \u2014 `qa-screenshot` is not enough, but the browser it drives is yours: write a throwaway node script that requires the global playwright-core: `const { chromium } = require(\"/usr/local/lib/node_modules/playwright-core\"); chromium.launch({ executablePath: \"/usr/bin/chromium\", args: [\"--no-sandbox\"] })`. Do NOT report a check as impossible because Playwright is missing \u2014 it is installed.",`- Record what you validated with \`${L}\` (scenarios + pass/fail, the exact URL + viewport, and anything you couldn't verify) BEFORE your decision. EMBED the before/after shots inline as markdown images referencing their /app/org/output path, and put each before/after PAIR in a two-column table so they render side by side, e.g.:
+`:"",...z?[z,""]:[],"How to work:",`- Call \`${B}\` with the task id below to find the pull request under review.`,H?`- The repository ${H.owner}/${H.name} is already cloned at your working directory and \`git\` and its CLI (\`gh\` for GitHub, \`glab\` for GitLab; Bitbucket has no CLI \u2014 use the REST API with \`curl\` and \`$BITBUCKET_TOKEN\`) are authenticated \u2014 check the PR's branch out there to inspect / exercise the change. ${D00}`:F?`- Your working directory is EMPTY. Call \`mcp__studio__TASK_ADD_REPO\` ${N?`with id \`${N}\` (${Z.repo}) FIRST \u2014 do NOT call it with no arguments, that only lists the org's repositories and costs you a turn.`:"with the id of the PR's repository FIRST;"} it clones the repository and waits for the checkout, and \`git\` and its CLI are authenticated once it returns. ${D00}`:"- Load the PR's repository to inspect / exercise the change.",`- ${KD$}`,...U>0?[`- This is a RE-REVIEW. You already reviewed an earlier version of this pull request and asked for changes, and there are more commits since (a human re-delegated the card, or your own fixes from that round are in the history). Read your own previous notes with \`${w}\`, then review WHAT MOVED SINCE \u2014 \`gh pr diff <number>\` still shows the whole PR, so narrow it with \`git log --since='${new Date(U).toISOString()}' --oneline\` and diff only those commits. Confirm your earlier notes were addressed and check the new commits for their own problems. Do NOT re-read the parts of the PR you already cleared.`]:[],"- Fix the issues you find on the PR's branch, run the repository's own checks, and push to that same PR. You are the last automated run on this task \u2014 nothing picks up findings you only describe.",`- THEN exercise the change. If the PR has a deploy \`previewUrl\` (from \`${B}\`), use it \u2014 re-read it after your push so you get the preview of YOUR commit, wait for it if it is still building, and deep-link to the page/route the task affects (not root). If there is NO preview, exercise it in the sandbox instead: run the repository's own checks, and for a UI change build and serve it locally and capture it (a Flutter app runs on an Android emulator, but only on the Android sandbox image \u2014 see the \`flutter-app\` skill). Either way, if you cannot exercise it at all, do NOT approve \u2014 \`request_changes\` saying which path you tried and what blocked it.`,"- For a VISUAL change, capture before/after by running `qa-screenshot <url> /app/org/output/qa/<name>.png [--mobile] [--full] [--selector=<css>] [--console]` (headless Chromium, baked into the sandbox; also works against a dev server you started on localhost \u2014 none is running by default, this pod is a checkout). Choose the framing: default is the top viewport, `--full` is the whole page, and `--selector='<css>'` frames just the component you changed (best for a focused before/after). Add `--mobile` too for a responsive change, and `--console` to catch the runtime errors a screenshot alone reports as a pass. WRITE them under `/app/org/output/` \u2014 that's what surfaces them on the task. Then `Read` the files to actually LOOK at them: a screenshot you never opened is not verification. To INTERACT with a page \u2014 click, hit-test with `document.elementFromPoint`, fill a form \u2014 `qa-screenshot` is not enough, but the browser it drives is yours: write a throwaway node script that requires the global playwright-core: `const { chromium } = require(\"/usr/local/lib/node_modules/playwright-core\"); chromium.launch({ executablePath: \"/usr/bin/chromium\", args: [\"--no-sandbox\"] })`. Do NOT report a check as impossible because Playwright is missing \u2014 it is installed. Add `--engine=webkit` (WebKit, Safari's engine) when a mobile scroll, snap or animation quirk could be engine-specific, or when asked to check Safari; to script it, `webkit` from the same playwright-core with `browser.newContext(devices[\"iPhone 13\"])`. It is not a real iPhone or Mac: report it as \"checked in WebKit\", not as tested on iOS or Safari.",`- Record what you validated with \`${L}\` (scenarios + pass/fail, the exact URL + viewport, and anything you couldn't verify) BEFORE your decision. EMBED the before/after shots inline as markdown images referencing their /app/org/output path, and put each before/after PAIR in a two-column table so they render side by side, e.g.:
 
 | Before | After |
 | --- | --- |
@@ -3734,7 +3734,7 @@ ${J.join(`
 `)}`:X}function yt6($){let Z=new Set;for(let Q of $)for(let Y of Q.split(`
 `)){let X=Y.trim();if(/^Co-authored-by:\s/i.test(X))Z.add(X)}return[...Z]}var UY8=200,It6=12,kt6,Ct6=300,tC0=3;var _D1=D(()=>{Q7();a$();nC0();kt6={aheadBy:0,behindBy:0,files:[]}});function ht6($){if(!$||$.includes(".."))return!1;return gt6.test($)}function BY8($){return ut6.includes($)}function vD1($){let Z=typeof $.__resolveType==="string"?$.__resolveType:null;if(!Z||!ht6(Z))return null;let{__resolveType:Q,...Y}=$;return{resolveType:Z,payload:Y}}function bD1($,Z){return`${$.replace(/\/+$/,"")}/deco/invoke/${Z}`}var gt6,ut6;var DY8=D(()=>{gt6=/^[\w./@-]+$/;ut6=["vtex/loaders/intelligentSearch/productList.ts","vtex/loaders/categories/tree.ts"]});function m60($,Z){let Q=$?.repository;if(!Q?.owner||!Q?.name)return null;if(!Q.connectionId)return Q;if(!Z.includes(Q.connectionId))return null;return Q}async function LY8($,Z,Q,Y){let X=$.organization?.id;if(!X)throw new Qz(C7);let J=await bj($.storage,X,Y);if(J&&await DD($.storage,J)){let F=await RU($,J,{forceRefresh:!0}).catch((U)=>{throw new Qz(U instanceof Error?U.message:C7)});await OY8($,Z,Q,F);return}let G=Y.connectionId??J?.legacyConnectionId;if(!G)throw new Qz("Push requires a connected git account. Connect the repository's provider for this project and restart the sandbox.");await jm({ctx:$,connectionId:G,organizationId:X,forceRefresh:!0,onLegacyMintError:(F)=>{let U=F instanceof Error?F.message:C7;throw new Qz(U)}});let{cloneUrl:W,gitUserName:K,gitUserEmail:H}=await qU(G,Y.owner,Y.name,$.db,$.vault).catch((F)=>{let{code:U,message:N}=HL$(F instanceof Error?F.message:String(F));throw U?new Qz(N):F});await OY8($,Z,Q,{cloneUrl:W,gitUserName:K,gitUserEmail:H})}async function OY8($,Z,Q,Y){let{cloneUrl:X,gitUserName:J,gitUserEmail:G}=Y,W=Cp($),K=await Z.proxyDaemonRequest(Q,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({git:{repository:{cloneUrl:X},identity:{userName:J,userEmail:G}},...W?{operator:W}:{}})});if(!K.ok){let H=await JE(K,lt6).catch(()=>K.statusText);throw Error(`Failed to refresh sandbox git credentials (${K.status}): ${H}`)}}var lt6=10485760,Qz;var xD1=D(()=>{MW();gC0();j$0();IH0();p00();Q7();Qz=class Qz extends Error{constructor($){super($);this.name="GitPushAuthError"}}});function mt6($){let Z=$.startsWith("thread:")?$.slice(7):$;if(!Z||Z.length>255||Z.includes("..")||Z.startsWith("/")||Z.endsWith("/")||Z.endsWith(".lock")||!ct6.test(Z))throw Error(`Invalid branch name: ${$}`)}function ty($){return AbortSignal.any([$.req.raw.signal,AbortSignal.timeout(dt6)])}async function pt6($,Z){let Q=$.var.studioContext,Y=bU(Z.branch),X=$.req.query("thread")??Y,J=X&&X===Y?Z.branchThread:X?await Q.storage.threads.get(X).catch(()=>null):null,G=J?.virtual_mcp_id===Z.virtualMcpId?J:null,W=Af(G?.metadata?.runtime);if(W)return W;let K=kR0(Z.virtualMcpMetadata),H=K==="cms"?await ND1(Q,{claimName:Z.claimName}):"alive",F=K==="cms"&&H!=="alive"?"cms":"sandbox",U=!!G&&(H==="gone"||H==="alive"&&K==="cms");if(U&&G)E$0(Q,G.id,F);if(K==="cms")console.log("sandbox proxy: no runtime stamp",{route:$.req.path,method:$.req.method,reason:G?"unstamped":"threadless",liveness:H,resolved:F,stamped:U});return F}async function nt6($){let Z=$.get("vmClaim");if(Z.runner)return Z.runner;try{return await gX($.var.studioContext)}catch{return null}}function oy($){let{runner:Z}=$.get("vmClaim");if(!Z)return $.json({error:"No sandbox runner configured"},503);return Z}async function fp($){let{virtualMcpMetadata:Z,connectionIds:Q}=$.get("vmClaim"),Y=$.var.studioContext,X=m60(Z,Q);if(!X)throw new f0({provider:"github",status:404,message:"Project has no repository"});let J=J0(Y);return Om(Y,J.id,X)}function yD1($,Z){let Q=Z instanceof Error?Z.message:String(Z),Y=RD$(Z);if(Y!==void 0)return $.json({error:Q},429,{...G9,...Y===null?{}:{"Retry-After":String(Math.ceil(Y/1000))}});if(Z instanceof s6)return $.json({error:Q},409,G9);let X=SW(Z);if(X!==null){let J=X===404?404:X===409||X===422?409:502;return $.json({error:Q},J,G9)}return $.json({error:Q},502,G9)}async function fD1($,Z,Q){let Y;try{Y=await fetch(Z,Q)}catch{return $.json({error:"Preview unreachable"},502)}let X;try{X=await Y.text()}catch{return $.json({error:"Preview unreachable"},502)}return new Response(X,{status:Y.status,headers:{"content-type":Y.headers.get("content-type")??"application/json"}})}async function zY8($){try{let Z=await fp($),Q=await oC0(Z,$.get("vmClaim").branch);return $.json(Q,200,G9)}catch(Z){return yD1($,Z)}}function d60($,Z){let Y=(aC0.get($)??Promise.resolve()).catch(()=>{}).then(Z),X=Y.catch(()=>{});return aC0.set($,X),X.finally(()=>{if(aC0.get($)===X)aC0.delete($)}),Y}async function NQ($,Z,Q){if(!Q?.runner&&$.get("vmClaim").runtime==="cms")return $.json({error:"sandbox not found: this session is sandbox-less"},404,G9);let Y=Q?.runner??oy($);if(Y instanceof Response)return Y;let{claimName:X,userId:J,projectRef:G}=$.get("vmClaim"),W=Q?.method??"POST",K=null,H=new Headers;if(Q?.jsonBody!==void 0)K=Q.jsonBody,H.set("content-type","application/json");else if(Q?.forwardJsonBody)K=await $.req.text(),H.set("content-type","application/json");let F=Q?.signal,U={method:W,headers:H,body:K,...F?{signal:F}:{}},N=async()=>{let B=await Y.proxyDaemonRequest(X,Z,U);if(Q?.map404to410&&B.status===404){try{await B.body?.cancel()}catch{}if(await Y.adoptLiveClaim({userId:J,projectRef:G},X))B=await Y.proxyDaemonRequest(X,Z,U);if(B.status===404){try{await B.body?.cancel()}catch{}return new Response(JSON.stringify({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."}),{status:410,headers:{"content-type":"application/json",...G9}})}}let O=await B.text(),L=Q?.redactRepoDir?tt6(O):O,w=B.headers.get("content-type")??"application/json";return new Response(L,{status:B.status,headers:{"content-type":w,...G9}})};try{if(F){let B=N();return B.catch(()=>{}),await Promise.race([B,new Promise((L,w)=>{if(F.aborted)return w(F.reason);F.addEventListener("abort",()=>w(F.reason),{once:!0})})])}return await N()}catch(B){let O=B instanceof Error?B.message:String(B);return $.json({error:`Daemon unreachable: ${O}`},502)}}function tt6($){try{let Z=JSON.parse($);if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&"repoDir"in Z)return JSON.stringify({...Z,repoDir:null})}catch{}return $}async function eC0($,Z,Q,Y="GET",X){let J=await $.proxyDaemonRequest(Z,Q,{method:Y,headers:new Headers,body:null});if(J.status===404&&X){try{await J.body?.cancel()}catch{}if(await $.adoptLiveClaim(X,Z))J=await $.proxyDaemonRequest(Z,Q,{method:Y,headers:new Headers,body:null})}if(J.status===404){try{await J.body?.cancel()}catch{}throw Error("SANDBOX_GONE")}let G=await J.text();if(!J.ok){let W=`Daemon error (${J.status})`;try{W=JSON.parse(G).error??W}catch{}throw Error(W)}return JSON.parse(G)}function ot6($){return PY8.includes($)}var ct6,wY8=524288,jY8=65536,dt6=1e4,EY8=2000,it6,aC0,G9,PY8,AY8=()=>{let $=new Z1;$.use("/:virtualMcpId/:branch/*",it6),$.post("/:virtualMcpId/:branch/write",(Q)=>NQ(Q,"/_sandbox/write",{forwardJsonBody:!0,signal:ty(Q)})),$.post("/:virtualMcpId/:branch/unlink",(Q)=>NQ(Q,"/_sandbox/unlink",{forwardJsonBody:!0,signal:ty(Q)})),$.post("/:virtualMcpId/:branch/mkdir",(Q)=>NQ(Q,"/_sandbox/mkdir",{forwardJsonBody:!0,signal:ty(Q)})),$.post("/:virtualMcpId/:branch/rename",(Q)=>NQ(Q,"/_sandbox/rename",{forwardJsonBody:!0,signal:ty(Q)})),$.post("/:virtualMcpId/:branch/read",(Q)=>NQ(Q,"/_sandbox/read",{forwardJsonBody:!0,signal:ty(Q)})),$.post("/:virtualMcpId/:branch/glob",(Q)=>NQ(Q,"/_sandbox/glob",{forwardJsonBody:!0,signal:ty(Q)})),$.post("/:virtualMcpId/:branch/grep",(Q)=>NQ(Q,"/_sandbox/grep",{forwardJsonBody:!0,signal:ty(Q)})),$.post("/:virtualMcpId/:branch/exec/:script",async(Q)=>{let Y=Q.req.param("script");if(!Y)return Q.json({error:"missing script name"},400);return NQ(Q,`/_sandbox/exec/${encodeURIComponent(Y)}`)}),$.post("/:virtualMcpId/:branch/exec/:script/kill",async(Q)=>{let Y=Q.req.param("script");if(!Y)return Q.json({error:"missing script name"},400);return NQ(Q,`/_sandbox/exec/${encodeURIComponent(Y)}/kill`)}),$.get("/:virtualMcpId/:branch/config",(Q)=>NQ(Q,"/_sandbox/config",{method:"GET",map404to410:!0,redactRepoDir:!0})),$.put("/:virtualMcpId/:branch/config",(Q)=>NQ(Q,"/_sandbox/config",{method:"PUT",forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/setup/:step",async(Q)=>{let Y=Q.req.param("step");if(!Y||!ot6(Y))return Q.json({error:`step must be one of: ${PY8.join(", ")}`},400);let X=Q.get("vmClaim"),J=await ND1(Q.var.studioContext,{claimName:X.claimName})==="gone"?null:await nt6(Q);if(!J)return Q.json({error:"sandbox not found: nothing is running at this ref"},404,G9);if(Y==="start"){let G=J0(Q.var.studioContext),W=Nd(X.virtualMcpMetadata);try{await qR0({ctx:Q.var.studioContext,runner:J,handle:X.claimName,orgId:G.id,userId:X.callerUserId,entries:W})}catch(K){let H=K instanceof Error?K.message:String(K);return Q.json({error:`Failed to push env to daemon: ${H}`},502)}}return NQ(Q,`/_sandbox/setup/${Y}`,{signal:Q.req.raw.signal,map404to410:!0,runner:J})}),$.get("/:virtualMcpId/:branch/events",(Q)=>{let Y=Q.get("vmClaim");if(!Y.runner)return DO(Q,async(X)=>{await X.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:"No sandbox runner configured on this studio instance."})})});return EQ8(Q,{ctx:Q.var.studioContext,claimName:Y.claimName,runner:Y.runner,virtualMcpId:Y.virtualMcpId,branch:Y.branch,userId:Y.userId,projectRef:Y.projectRef,virtualMcpMetadata:Y.virtualMcpMetadata})}),$.get("/:virtualMcpId/:branch/git/status",(Q)=>{if(Q.get("vmClaim").runtime==="cms")return zY8(Q);return Z(Q)});let Z=(Q)=>NQ(Q,"/_sandbox/git/status",{method:"GET",map404to410:!0,signal:AbortSignal.any([Q.req.raw.signal,AbortSignal.timeout(EY8)])});return $.post("/:virtualMcpId/:branch/git/status",(Q)=>{if(Q.get("vmClaim").runtime==="cms")return zY8(Q);return NQ(Q,"/_sandbox/git/status",{map404to410:!0,signal:AbortSignal.any([Q.req.raw.signal,AbortSignal.timeout(EY8)])})}),$.post("/:virtualMcpId/:branch/git/diff",async(Q)=>{let Y=Q.get("vmClaim");if(Y.runtime==="cms")try{let X=await Q.req.json().catch(()=>({})),J=await fp(Q),G=await rC0(J,Y.branch,X.base);return Q.json(G,200,G9)}catch(X){return yD1(Q,X)}return NQ(Q,"/_sandbox/git/diff",{forwardJsonBody:!0,map404to410:!0})}),$.post("/:virtualMcpId/:branch/git/publish",async(Q)=>{if(Q.get("vmClaim").runtime==="cms")return Q.json({ok:!0},200,G9);let Y=oy(Q);if(Y instanceof Response)return Y;let{claimName:X,virtualMcpMetadata:J,connectionIds:G}=Q.get("vmClaim"),W=Q.var.studioContext;return d60(X,async()=>{try{await BD1(W,Y,X);let K=m60(J,G);if(K)await LY8(W,Y,X,K)}catch(K){if(K instanceof Qz)return Q.json({error:K.message},403,G9);let H=K instanceof Error?K.message:String(K);return Q.json({error:H},502,G9)}return NQ(Q,"/_sandbox/git/publish",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/discard",async(Q)=>{let Y=Q.get("vmClaim");if(Y.runtime==="cms")return d60(Y.claimName,async()=>{let X=await Q.req.json().catch(()=>({})),J=Array.isArray(X.filepaths)?X.filepaths.filter((G)=>typeof G==="string"):[];if(J.length===0)return Q.json({error:"filepaths is required"},400,G9);try{let G=await fp(Q);return await NY8(G,Y.branch,J),Q.json({ok:!0},200,G9)}catch(G){let W=SW(G)===409||G instanceof s6?409:502,K=G instanceof Error?G.message:String(G);return Q.json({error:K},W,G9)}});return d60(Y.claimName,()=>NQ(Q,"/_sandbox/git/discard",{forwardJsonBody:!0,map404to410:!0}))}),$.post("/:virtualMcpId/:branch/git/rebase",async(Q)=>{let Y=Q.get("vmClaim");if(Y.runtime==="cms")return d60(Y.claimName,async()=>{try{let W=await Q.req.json().catch(()=>({})),K=await fp(Q),H=W.base??await K.getDefaultBranch();return await sC0(K,Y.branch,H),Q.json({ok:!0},200,G9)}catch(W){return yD1(Q,W)}});let X=oy(Q);if(X instanceof Response)return X;let{claimName:J}=Q.get("vmClaim"),G=Q.var.studioContext;return d60(J,async()=>{try{await BD1(G,X,J)}catch(W){let K=W instanceof Error?W.message:String(W);return Q.json({error:K},502,G9)}return NQ(Q,"/_sandbox/git/rebase",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/suggest-commit",x5({maxSize:wY8,onError:(Q)=>Q.json({error:"Payload too large"},413,G9)}),async(Q)=>{let Y=Q.get("vmClaim"),X=null;if(Y.runtime!=="cms"){let H=oy(Q);if(H instanceof Response)return H;X=H}let{claimName:J,userId:G,projectRef:W}=Y,K=Q.var.studioContext;try{let H=await Q.req.json().catch(()=>({})),F=H.status,U=H.diff,N=U!=null&&typeof U.diffs==="object"&&U.diffs!==null,[B,O]=LD1(F)&&N?[F,U]:X?await Promise.all([eC0(X,J,"/_sandbox/git/status","GET",{userId:G,projectRef:W}),eC0(X,J,"/_sandbox/git/diff","GET",{userId:G,projectRef:W})]):await(async()=>{let w=await fp(Q);return Promise.all([oC0(w,Y.branch),rC0(w,Y.branch)])})();await oG(K,J0(K).id,"suggesting a commit message");let L=await RQ8(K,B,O);return Q.json(L,200,G9)}catch(H){let F=H instanceof Error?H.message:String(H);if(F==="SANDBOX_GONE")return Q.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,G9);return Q.json({error:F},502,G9)}}),$.post("/:virtualMcpId/:branch/git/judge-review",x5({maxSize:wY8,onError:(Q)=>Q.json({error:"Payload too large"},413,G9)}),async(Q)=>{let Y=Q.get("vmClaim"),X=null;if(Y.runtime!=="cms"){let H=oy(Q);if(H instanceof Response)return H;X=H}let{claimName:J,userId:G,projectRef:W}=Y,K=Q.var.studioContext;try{let H=await Q.req.json().catch(()=>({})),F=H.status,U=H.diff,N=U!=null&&typeof U.diffs==="object"&&U.diffs!==null,[B,O]=LD1(F)&&N?[F,U]:X?await Promise.all([eC0(X,J,"/_sandbox/git/status","GET",{userId:G,projectRef:W}),eC0(X,J,"/_sandbox/git/diff","GET",{userId:G,projectRef:W})]):await(async()=>{let w=await fp(Q);return Promise.all([oC0(w,Y.branch),rC0(w,Y.branch)])})();await oG(K,J0(K).id,"judging whether a change needs review");let L=await MQ8(K,B,O,typeof H.language==="string"?H.language:void 0);return Q.json(L,200,G9)}catch(H){let F=H instanceof Error?H.message:String(H);if(F==="SANDBOX_GONE")return Q.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,G9);return Q.json({error:F},502,G9)}}),$.get("/:virtualMcpId/:branch/preview-fetch",async(Q)=>{let Y=oy(Q);if(Y instanceof Response)return Y;let{claimName:X}=Q.get("vmClaim"),J=Q.req.query("path");if(!J||!J.startsWith("/")||J.startsWith("//")||J.includes("..")||J.includes("\\"))return Q.json({error:"Path not allowed"},403);let G;try{G=await Y.getPreviewUrl(X)}catch{return Q.json({error:"Preview not available"},502)}if(!G)return Q.json({error:"Preview not available"},502);let W=G.replace(/\/+$/,"");return fD1(Q,`${W}${J}`)}),$.post("/:virtualMcpId/:branch/preview-invoke",x5({maxSize:jY8,onError:(Q)=>Q.json({error:"Payload too large"},413)}),async(Q)=>{let Y=oy(Q);if(Y instanceof Response)return Y;let{claimName:X}=Q.get("vmClaim"),J;try{J=await Y.getPreviewUrl(X)}catch{return Q.json({error:"Preview not available"},502)}if(!J)return Q.json({error:"Preview not available"},502);let G;try{G=await Q.req.json()}catch{return Q.json({error:"Invalid JSON body"},400)}if(!G||typeof G!=="object"||Array.isArray(G))return Q.json({error:"Invalid JSON body"},400);let W=vD1(G);if(!W)return Q.json({error:"Invalid or missing __resolveType"},400);let K=bD1(J,W.resolveType);return fD1(Q,K,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(W.payload),signal:AbortSignal.timeout(30000)})}),$.post("/:virtualMcpId/:branch/catalog-invoke",x5({maxSize:jY8,onError:(Q)=>Q.json({error:"Payload too large"},413)}),async(Q)=>{let{runner:Y,claimName:X,virtualMcpMetadata:J}=Q.get("vmClaim"),G;try{G=Y?await Y.getPreviewUrl(X):Bd(J)}catch{return Q.json({error:"Preview not available"},502)}if(!G)return Q.json({error:"Preview not available"},502);let W;try{W=await Q.req.json()}catch{return Q.json({error:"Invalid JSON body"},400)}if(!W||typeof W!=="object"||Array.isArray(W))return Q.json({error:"Invalid JSON body"},400);let K=vD1(W);if(!K)return Q.json({error:"Invalid or missing __resolveType"},400);if(!BY8(K.resolveType))return Q.json({error:"resolveType not allowed"},403);let H=bD1(G,K.resolveType);return fD1(Q,H,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(K.payload),signal:AbortSignal.timeout(30000)})}),$};var TY8=D(()=>{J8();QK();Sp();UD1();Ud();LQ8();hW();Dd();wQ8();yW();WH();jQ8();zQ8();w71();w$0();ED1();IQ8();Q7();T5();_D1();DY8();VR0();xD1();ct6=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;it6=yC0(async($,Z)=>{let Q=$.var.studioContext;try{n(Q)}catch{return $.json({error:"Unauthorized"},401)}let Y=i0(Q);if(!Y)return $.json({error:"Unauthorized"},401);let X;try{X=J0(Q)}catch{return $.json({error:"Organization scope required"},403)}let J=$.req.param("virtualMcpId"),G=$.req.param("branch");if(!J||!G)return $.json({error:"virtualMcpId and branch are required"},400);try{mt6(G)}catch(L){let w=L instanceof Error?L.message:String(L);return $.json({error:w},400)}let W=await Q.storage.virtualMcps.findById(J);if(!W||W.organization_id!==X.id)return $.json({error:"Virtual MCP not found"},404);let K=P10({orgId:X.id,virtualMcpId:J,branch:G}),H=await h91(Q,G),F=u91(H,Y),U=OQ8({userId:F,projectRef:K}),N=W.metadata??null,B=await pt6($,{claimName:U,branch:G,virtualMcpId:J,sandboxUserId:F,virtualMcpMetadata:N,branchThread:H});if(B==="cms")return $.set("vmClaim",{claimName:U,callerUserId:Y,runner:null,virtualMcpId:J,branch:G,userId:F,projectRef:K,virtualMcpMetadata:N,connectionIds:W.connections?.map((L)=>L.connection_id)??[],runtime:B}),Z();let O;try{O=await gX(Q)}catch{O=null}if(!O)return $.json({error:"No sandbox runner found"},404);return $.set("vmClaim",{claimName:U,callerUserId:Y,runner:O,virtualMcpId:J,branch:G,userId:F,projectRef:K,virtualMcpMetadata:N,connectionIds:W.connections?.map((L)=>L.connection_id)??[],runtime:B}),Z()});aC0=new Map;G9={"Cache-Control":"no-store, no-cache, must-revalidate",Pragma:"no-cache"};PY8=["clone","install","start"]});function RY8($,Z,Q){let Y=gD1.get($);if(!Y)Y={pending:null,running:!1},gD1.set($,Y);if(!Y.pending)Y.pending={set:new Map,del:new Set,deps:Z,resolvers:[],rejecters:[]};let X=Y.pending;X.deps=Z;for(let[G,W]of Object.entries(Q.set??{}))X.set.set(G,W),X.del.delete(G);for(let G of Q.delete??[])X.del.add(G),X.set.delete(G);let J=new Promise((G,W)=>{X.resolvers.push(G),X.rejecters.push(W)});if(!Y.running)st6($,Y);return J}async function st6($,Z){Z.running=!0;try{while(Z.pending){let Q=Z.pending;Z.pending=null;try{let Y=await at6(Q);for(let X of Q.resolvers)X(Y)}catch(Y){for(let X of Q.rejecters)X(Y)}}}finally{if(Z.running=!1,!Z.pending)gD1.delete($)}}async function at6($){let{client:Z,branch:Q,packagePath:Y}=$.deps,X=new Map;for(let J=0;;J++){let G=await xp(Z,Q),W=await Z.listDecofileEntries(G,Y),K=kD1(W,Y),H=[],F=new Map(K.map((N)=>[N.path,{stem:N.stem,sha:N.sha}]));for(let[N,B]of $.set){let O=SD1(K,N),L=`${JSON.stringify(B,null,2)}
 `;await WY8(Z.repo,L);let w=O[0]??`${pC0(Y)}/${AD1(N)}.json`;H.push({path:w,content:L});let j=w.slice(w.lastIndexOf("/")+1,-5);F.set(w,{stem:j,content:L});for(let E of O.slice(1))H.push({path:E,deleted:!0}),F.delete(E)}for(let N of $.del)for(let B of SD1(K,N))H.push({path:B,deleted:!0}),F.delete(B);if(H.length===0)return G;let U=Y?`${Y}/.deco/blocks.gen.json`:".deco/blocks.gen.json";if(W.some((N)=>N.type==="blob"&&N.path===U)){let N=await KY8(Z,F.values(),X),{decofile:B,skipped:O}=f60(N);if(O.length>0)console.warn("decofile gen: dropped blocks that were not valid JSON",{repo:KH(Z.repo),branch:Q,packagePath:Y,blocks:O.map((L)=>L.key)});H.push({path:U,content:B})}try{let{sha:N}=await Z.commitFiles({branch:Q,message:et6($),expectedHead:G,changes:H});return N}catch(N){if(!(N instanceof s6)||J>=rt6-1)throw N;await O$(B7(2000,200,J,2,0.5))}}}function et6($){let Z=(X)=>{let J=X.slice(0,3).join(", ");return X.length>3?`${J} (+${X.length-3} more)`:J},Q=[];if($.set.size>0)Q.push(`update ${Z([...$.set.keys()])}`);if($.del.size>0)Q.push(`delete ${Z([...$.del])}`);let Y=`chore(decofile): ${Q.join("; ")}`;return j51(Y,$.deps.coAuthor)}var rt6=3,gD1;var qY8=D(()=>{tA0();uC0();i4();a$();Q7();nC0();gD1=new Map});import{createHmac as MY8,randomBytes as $o6,timingSafeEqual as Zo6}from"crypto";function IY8(){if($_0)return $_0;let $;try{let Z=E0();$=Z.studioJwtSecret??Z.betterAuthSecret}catch{$=void 0}return $_0=$?Buffer.from($):$o6(32),$_0}function hD1($){let Z=$.nowMs??Date.now(),Q={o:$.organizationId,m:$.virtualMcpId,b:$.branch,e:Math.floor((Z+Qo6)/1000)},Y=Buffer.from(JSON.stringify(Q)).toString("base64url"),X=MY8("sha256",IY8()).update(Y).digest("base64url");return`${Y}.${X}`}function VY8($,Z){let Q=$.indexOf(".");if(Q<0)return!1;let Y=$.slice(0,Q),X=Buffer.from($.slice(Q+1)),J=Buffer.from(MY8("sha256",IY8()).update(Y).digest("base64url"));if(X.length!==J.length||!Zo6(X,J))return!1;let G;try{G=JSON.parse(Buffer.from(Y,"base64url").toString())}catch{return!1}let W=Math.floor((Z.nowMs??Date.now())/1000);return G.o===Z.organizationId&&G.m===Z.virtualMcpId&&G.b===Z.branch&&typeof G.e==="number"&&G.e>=W}var Qo6=21600000,$_0=null;var kY8=D(()=>{X$()});function Z_0($){return $&&typeof $==="object"&&!Array.isArray($)?$:null}function Yo6($){for(let[Z,Q]of Object.entries($)){if(!Z.startsWith("collections/blog/posts/"))continue;let Y=Z_0(Q)?.__resolveType;if(typeof Y==="string"&&Y)return Y}return"blog/loaders/Blogpost.ts"}function SY8($){let Z;try{Z=Z_0(JSON.parse($))}catch{return $}if(!Z)return $;let Q=Yo6(Z),Y={...Z},X=0;for(let[J,G]of Object.entries(Z)){if(!J.startsWith("blog-manager/posts/"))continue;let W=Z_0(G),K=W&&Z_0(W.post);if(!K)continue;if(K.status==="archived")continue;if(typeof K.slug!=="string"||!K.slug)continue;let F=`collections/blog/posts/${J.slice(19)}`;if(Object.hasOwn(Y,F))continue;Y[F]={name:F,__resolveType:Q,["post"]:{...K,status:"published"}},X++}return X>0?JSON.stringify(Y):$}import{z as yp}from"zod";function Jo6($){return $.length>0&&$.length<=255&&!$.includes("..")&&!$.endsWith("/")&&!$.endsWith(".lock")&&Xo6.test($)}function xY8($){return $.req.header("x-forwarded-host")??new URL($.req.url).host}async function i60($){let Z=$.get("decofileScope");return Om($.var.studioContext,Z.organizationId,Z.repository)}function p60($,Z){let Q=Z instanceof Error?Z.message:String(Z);if(Z instanceof s6)return $.json({error:Q},409);let Y=SW(Z);if(Y!==null){let X=Y===404?404:Y===409||Y===422?409:502;return $.json({error:Q},X)}return $.json({error:Q},500)}function fY8(){let $=new Z1;return $.use("/:virtualMcpId/:branch",bY8),$.use("/:virtualMcpId/:branch/*",bY8),$.get("/:virtualMcpId/:branch",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await i60(Z),X=await HY8(Y,Q.branch,Q.packagePath,{createBranchIfMissing:!!Q.userId}),J={ETag:`"${X.sha}"`,"Cache-Control":"no-store","Access-Control-Allow-Origin":"*"};if(Z.req.header("if-none-match")===`"${X.sha}"`)return Z.body(null,304,J);if(!Q.userId)return Z.body(SY8(X.decofile),200,{...J,"content-type":"application/json"});let G=hD1({organizationId:Q.organizationId,virtualMcpId:Q.virtualMcpId,branch:Q.branch});return Z.body(`{"version":${JSON.stringify(X.sha)},"token":${JSON.stringify(G)},"apiHost":${JSON.stringify(xY8(Z))},"decofile":${X.decofile}}`,200,{...J,"content-type":"application/json"})}catch(Y){return p60(Z,Y)}}),$.get("/:virtualMcpId/:branch/meta",async(Z)=>{let Q=Z.get("decofileScope"),Y=Q.packagePath?`${Q.packagePath}/.deco/meta.gen.json`:".deco/meta.gen.json";try{let X=await i60(Z),J=await X.readFileAtRef(Q.branch,Y);if(J===null){let G=await X.getDefaultBranch();if(G!==Q.branch)J=await X.readFileAtRef(G,Y)}if(J===null)return Z.json({error:"meta.gen.json not committed"},404);return Z.body(J,200,{"content-type":"application/json","Cache-Control":"no-store","Access-Control-Allow-Origin":"*"})}catch(X){return p60(Z,X)}}),$.patch("/:virtualMcpId/:branch",Wo6,async(Z)=>{let Q=Z.get("decofileScope"),Y=Z.var.studioContext,X=Ko6.safeParse(await Z.req.json().catch(()=>null));if(!X.success)return Z.json({error:"Invalid body",details:X.error.issues},400);let J;try{J=y60(X.data)}catch(G){if(G instanceof g60)return Z.json({error:G.message},400);throw G}for(let G of[...Object.keys(J.set??{}),...J.delete??[]])try{hC0(G)}catch(W){let K=W instanceof Error?W.message:String(W);return Z.json({error:K},400)}for(let[G,W]of Object.entries(J.set??{})){if(typeof W!=="object"||W===null||Array.isArray(W))return Z.json({error:`Block "${G}" must be a JSON object`},400);if(PD1(G))return Z.json({error:`Block key "${G}" collides with a framework resolver module and cannot be written`},400)}try{let G=await i60(Z),W=await RY8(`${Q.organizationId}/${Q.virtualMcpId}/${Q.branch}`,{client:G,branch:Q.branch,packagePath:Q.packagePath,coAuthor:Cp(Y)},J),K=hD1({organizationId:Q.organizationId,virtualMcpId:Q.virtualMcpId,branch:Q.branch});return Z.json({version:W,token:K,apiHost:xY8(Z)})}catch(G){return p60(Z,G)}}),$.post("/:virtualMcpId/:branch/publish",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await i60(Z),X=await Y.getDefaultBranch();if(X===Q.branch)return Z.json({error:"Branch is already the default branch"},400);let J=`chore(decofile): publish ${Q.branch}`;try{let G;try{G=await Y.mergeBranches(X,Q.branch,J)}catch(W){if(SW(W)!==409)throw W;await sC0(Y,Q.branch,X),G=await Y.mergeBranches(X,Q.branch,J)}return G?Z.json({result:"merged",sha:G}):Z.json({result:"up-to-date"})}catch(G){if(SW(G)===409)return Z.json({error:"merge-conflict"},409);if(SW(G)===405){let K=await Y.findOpenChangeRequest(X,Q.branch)??await Y.createChangeRequest({base:X,head:Q.branch,title:`Publish ${Q.branch}`});return Z.json({result:"pull-request",number:K.number,url:K.url})}throw G}}catch(Y){return p60(Z,Y)}}),$.get("/:virtualMcpId/:branch/status",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await i60(Z),X=await Y.getDefaultBranch();if(X===Q.branch)return Z.json({baseBranch:X,aheadBy:0,behindBy:0});try{let{aheadBy:J,behindBy:G}=await Y.compare(X,Q.branch);return Z.json({baseBranch:X,aheadBy:J,behindBy:G})}catch(J){if(SW(J)===404)return Z.json({baseBranch:X,aheadBy:0,behindBy:0});throw J}}catch(Y){return p60(Z,Y)}}),$}var Xo6,CY8=500,_Y8=1048576,vY8=1024,Go6=8388608,Wo6,Ko6,bY8;var yY8=D(()=>{VR0();uC0();J8();QK();UD1();gC0();xD1();Q7();qY8();kY8();_D1();nC0();WH();Xo6=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;Wo6=x5({maxSize:Go6,onError:($)=>$.json({error:"Payload too large"},413)}),Ko6=yp.object({set:yp.record(yp.string(),yp.unknown()).optional(),delete:yp.array(yp.string()).optional()}).refine(($)=>Object.keys($.set??{}).length>0||($.delete?.length??0)>0,{message:"Patch must set or delete at least one block"}).refine(($)=>Object.keys($.set??{}).length+($.delete?.length??0)<=CY8,{message:`Patch cannot touch more than ${CY8} blocks`}).refine(($)=>Object.values($.set??{}).every((Z)=>JSON.stringify(Z).length<=_Y8),{message:`Each block must be at most ${_Y8} bytes`}).refine(($)=>[...Object.keys($.set??{}),...$.delete??[]].every((Z)=>Z.length<=vY8),{message:`Each block key must be at most ${vY8} characters`}),bY8=yC0(async($,Z)=>{let Q=$.var.studioContext,Y=Q.organization;if(!Y)return $.json({error:"Organization scope required"},500);let X=$.req.param("virtualMcpId"),J=$.req.param("branch");if(!X||!J)return $.json({error:"virtualMcpId and branch are required"},400);if(!Jo6(J))return $.json({error:`Invalid branch name: ${J}`},400);let G=Q.auth?.user?.id??null;if(!G){let B=$.req.query("token");if(!($.req.method==="GET"&&!$.req.path.match(/\/(publish|status)$/)))return $.json({error:"Unauthorized"},401);if(!B||!VY8(B,{organizationId:Y.id,virtualMcpId:X,branch:J}))return $.json({error:"Unauthorized"},401)}if(!await IJ(Q,Y.id,"cms"))return $.json({error:"This organization's plan does not include the CMS",code:"feature_not_in_plan"},403);let W=await Q.storage.virtualMcps.findById(X);if(!W||W.organization_id!==Y.id)return $.json({error:"Virtual MCP not found"},404);let K=W.metadata??null;if(!Bd(K))return $.json({error:"Project has no preview server configured"},404);let F=W.connections?.map((B)=>B.connection_id)??[],U=m60(K,F);if(!U)return $.json({error:"Project has no repository"},404);let N=K?.runtime;return $.set("decofileScope",{organizationId:Y.id,virtualMcpId:X,branch:J,packagePath:N?.path?.replace(/^\/+|\/+$/g,"")||null,repository:U,userId:G}),Z()})});var gY8=($)=>{let Z=new Z1;if(Z.use("*",Kp),Z.use("*",H58),Z.route("/",W58($.voiceSessions)),Z.route("/",pS0()),Z.route("/",i58()),Z.route("/",C58()),Z.route("/",$Q8()),Z.route("/",QQ8()),Z.route("/",p78()),Z.route("/",a78()),Z.route("/",t78()),Z.route("/",bC0()),Z.route("/tools",HQ8()),Z.route("/",GQ8()),Z.route("/",R78({kvStorage:$.kvStorage})),Z.route("/",A78()),Z.route("/fs",y78({getConnection:$.getNatsConnection})),Z.route("/sandbox",AY8()),Z.route("/decofile",fY8()),Z.route("/",m78()),Z.route("/",h78()),Z.route("/deco-sites",tS0()),Z.route("/hosting",z58()),Z.route("/monitor",I58()),Z.route("/sso",lS0()),Z.route("/",xC0({tokenStorage:$.tokenStorage,automationEventDispatcher:$.automationEventDispatcher})),Z.route("/webhooks",O58()),$.mountDevAssets)Z.route("/dev-assets",aS0({orgFromPath:!0}));return Z.use("/mcp/:connectionId?",$.mcpAuth),Z.use("/mcp/:connectionId/ui-resource",$.mcpAuth),Z.use("/mcp/gateway/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/virtual-mcp/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/self",$.mcpAuth),Z.use("/mcp/task-run/:threadId",$.mcpAuth),Z.route("/",U88()),Z.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",$.betterAuthProtectedResourceHandler),Z.get("/mcp/.well-known/oauth-protected-resource",$.betterAuthProtectedResourceHandler),Z.route("/mcp/task-run",l78()),Z.route("/mcp",gM0()),Z.route("/mcp/self",SC0()),Z.route("/mcp",lM0()),Z.all("/oauth-proxy/:connectionId/*",$.oauthProxyHandler),Z.get("/watch",$.watchHandler),Z};var hY8=D(()=>{J8();K58();F58();SS0();L58();_N1();P58();V58();eS0();rE();IN1();yN1();T78();q78();g78();u78();M80();EN1();cM0();QD1();c78();d78();n78();o78();JD1();ZQ8();YQ8();WQ8();GD1();FQ8();WD1();hM0();TY8();yY8()});import{z as ry}from"zod";class uD1{adapter;getConnection;kvPromise;constructor($,Z){this.adapter=$;this.getConnection=Z}kv(){let $=this.getConnection();if(!$||$.isClosed())throw new q1(503,{message:"Voice transport is unavailable"});return this.kvPromise??=new cY8.Kvm(Q_0.jetstream($)).create("STUDIO_VOICE_SESSIONS",{storage:Q_0.StorageType.Memory,ttl:mY8.nanos(VD),max_bytes:10485760}).catch((Z)=>{throw this.kvPromise=void 0,Z}),this.kvPromise}async conversationAgent($){let Z=await this.kv(),Q=`agent.${$.conversationKey}`,Y=Date.now()+45000;while(Date.now()<Y){let X=await Z.get(Q),J=X?.operation==="PUT"?lY8.parse(X.json()):null;if(J?.state==="ready")return J.agentId;if(J?.state==="creating"&&J.expiresAt>Date.now()){await O$(200);continue}let G=uY8.encode(JSON.stringify({state:"creating",expiresAt:Date.now()+40000})),W;try{W=X&&J?await Z.update(Q,G,X.revision):await Z.create(Q,G)}catch{await O$(200);continue}try{let K=await $.ensureConversationAgent();return await Z.update(Q,uY8.encode(JSON.stringify({state:"ready",agentId:K})),W),K}catch(K){throw await Z.delete(Q,{previousSeq:W}).catch(()=>{}),K}}throw new q1(503,{message:"Voice conversation is starting; try again"})}async createSession($){let Z=this.adapter.forConversationModel($.model),Q=await this.conversationAgent(Z);try{return{provider:"elevenlabs",conversationToken:await Z.createConversationToken(Q)}}catch(Y){let X=await this.kv(),J=`agent.${Z.conversationKey}`,G=await X.get(J),W=G?.operation==="PUT"?lY8.parse(G.json()):null;if(G&&W?.state==="ready"&&W.agentId===Q)await X.delete(J,{previousSeq:G.revision}).catch(()=>{});throw Y}}}var Q_0,cY8,mY8,uY8,lY8;var dY8=D(()=>{OJ();fU();a$();Q_0=C(LK(),1),cY8=C(YA(),1),mY8=C(Az(),1),uY8=new TextEncoder,lY8=ry.discriminatedUnion("state",[ry.object({state:ry.literal("ready"),agentId:ry.string()}),ry.object({state:ry.literal("creating"),expiresAt:ry.number()})])});import{z as gp}from"zod";function Ho6($){return{model:$.model,instructions:`${$q$}
-Start in ${$.language==="pt"?"Brazilian Portuguese":"English"}, and follow the user's language.`,delegation:{type:"client"},audio:{output:{voice:$.voice}},store:!1}}class lD1{config;constructor($){this.config=$}async createSession(){return{provider:"openai",transport:"webrtc"}}async negotiate($){let Z=await fetch("https://api.openai.com/v1/live/sessions",{method:"POST",headers:{Authorization:`Bearer ${this.config.apiKey}`,"Content-Type":"application/json","OpenAI-Safety-Identifier":$.safetyIdentifier},body:JSON.stringify({session:Ho6({...this.config,language:$.language,model:$.model}),transport:{type:"webrtc",sdp:$.sdp}}),signal:AbortSignal.timeout(15000)});if(!Z.ok)throw await Z.body?.cancel(),Error(`OpenAI Live request failed (${Z.status})`);return{sdp:gp.object({session:gp.object({id:gp.string().min(1)}),transport:gp.object({type:gp.literal("webrtc"),sdp:gp.string().min(1).max(1e5)})}).parse(await Z.json()).transport.sdp}}}var iY8=D(()=>{fU()});var pY8;var nY8=D(()=>{pY8=[{name:"delegate_to_agent",description:"Submit a complete request to the selected Studio agent. Returns after acceptance while work continues in the background. Results arrive later.",parameters:{type:"object",properties:{request:{type:"string",description:"The complete user request, with relevant conversational details. Preserve intent and constraints."}},required:["request"]}},{name:"get_agent_status",description:"Read the current chat's work status and known results. This does not track independent organization tasks; delegate fresh task-status queries to the Studio agent. Use when asked, never poll.",parameters:{type:"object",properties:{}}},{name:"stop_agent_work",description:"Request cancellation in the current chat ONLY when the user explicitly asks. Speaking over the companion is not cancellation. To stop independent tasks, delegate that request to the Studio agent.",parameters:{type:"object",properties:{}}}]});function cD1($){return{conversation_config:{agent:{first_message:"",language:"en",prompt:{prompt:aR$,llm:$.conversationModel,thinking_budget:0,max_tokens:512,tools:pY8.map((Z)=>({...Z,type:"client",expects_response:!0,response_timeout_secs:Z.name==="delegate_to_agent"?20:5,...Z.name==="delegate_to_agent"?{execution_mode:"async",interruption_mode:"allow",pre_tool_speech:"off"}:{}}))}},asr:{provider:"scribe_realtime",quality:"high"},turn:{turn_eagerness:"normal",turn_timeout:-1,silence_end_call_timeout:-1},tts:{voice_id:$.voiceId,model_id:$.model},conversation:{max_duration_seconds:VD/1000,client_events:["audio","interruption","user_transcript","agent_response","client_tool_call","vad_score"]}},platform_settings:{auth:{enable_auth:!0},privacy:{record_voice:!1,retention_days:1,delete_audio:!0,delete_transcript_and_pii:!0},overrides:{conversation_config_override:{agent:{language:!0}}}}}}var tY8=D(()=>{fU();nY8()});import{z as nX}from"zod";import{createHash as Fo6,createHmac as Uo6}from"crypto";class Y_0{config;conversationKey;configurationKey;constructor($){this.config=$;this.configurationKey=Fo6("sha256").update(JSON.stringify(cD1($))).digest("hex"),this.conversationKey=Uo6("sha256",$.apiKey).update(this.configurationKey).digest("hex")}forConversationModel($){return $===this.config.conversationModel?this:new Y_0({...this.config,conversationModel:$})}async request($,Z,Q){let Y=await fetch(`https://api.elevenlabs.io/v1${$}`,{method:Z===void 0?"GET":"POST",headers:{"xi-api-key":this.config.apiKey,"Content-Type":"application/json"},body:JSON.stringify(Z),signal:Q});if(!Y.ok)throw await Y.body?.cancel(),Error(`ElevenLabs request failed (${Y.status})`);return Y}async ensureConversationAgent(){let $=`Studio voice ${this.configurationKey.slice(0,24)}`,Z=await this.request(`/convai/agents?search=${encodeURIComponent($)}&page_size=100`,void 0,AbortSignal.timeout(15000)),{agents:Q}=nX.object({agents:nX.array(nX.object({agent_id:nX.string(),name:nX.string()}))}).parse(await Z.json()),Y=Q.find((J)=>J.name===$);if(Y){let J=await this.request(`/convai/agents/${encodeURIComponent(Y.agent_id)}`,void 0,AbortSignal.timeout(15000));return nX.object({platform_settings:nX.object({auth:nX.object({enable_auth:nX.literal(!0)})})}).parse(await J.json()),Y.agent_id}let X=await this.request("/convai/agents/create",{name:$,...cD1(this.config)},AbortSignal.timeout(15000));return nX.object({agent_id:nX.string().min(1)}).parse(await X.json()).agent_id}async createConversationToken($){let Z=await this.request(`/convai/conversation/token?agent_id=${encodeURIComponent($)}`,void 0,AbortSignal.timeout(15000));return nX.object({token:nX.string().min(1)}).parse(await Z.json()).token}async createTranscriptionToken(){let $=await this.request("/single-use-token/realtime_scribe",{},AbortSignal.timeout(15000));return nX.object({token:nX.string().min(1)}).parse(await $.json()).token}synthesize($,Z){return this.request(`/text-to-speech/${encodeURIComponent(this.config.voiceId)}/stream?output_format=mp3_44100_128`,{text:$,model_id:this.config.model},AbortSignal.any([Z,AbortSignal.timeout(60000)]))}}var oY8=D(()=>{tY8()});import{createHmac as No6,timingSafeEqual as Bo6}from"crypto";import{z as hp}from"zod";function sY8($,Z){if(!Z)throw Error("Voice requires a shared authentication secret");return No6("sha256",Z).update(`studio-voice-session:v1:${$}`).digest("base64url")}function aY8($,Z){let Q=Buffer.from(JSON.stringify(rY8.parse($))).toString("base64url");return`${Q}.${sY8(Q,Z)}`}function eY8($,Z,Q=Date.now()){if(!Z||$.length>4096)return null;let Y=$.split(".");if(Y.length!==2)return null;let[X,J]=Y;if(!X||!J)return null;let G=Buffer.from(sY8(X,Z)),W=Buffer.from(J);if(W.length!==G.length||!Bo6(W,G))return null;try{let K=rY8.safeParse(JSON.parse(Buffer.from(X,"base64url").toString()));if(!K.success||K.data.expiresAt<=Q||K.data.expiresAt>Q+VD)return null;return K.data}catch{return null}}var rY8;var $X8=D(()=>{fU();rY8=hp.object({sessionId:hp.string().uuid(),organizationId:hp.string().min(1).max(256),userId:hp.string().min(1).max(256),threadId:hp.string().min(1).max(256),expiresAt:hp.number().int().positive()})});import{z as mD1}from"zod";function ZX8($,Z){if(Z?.voice_model!=null&&Z.voice_provider==null)throw Error("A voice model override requires a provider");let Q=Z?.voice_provider??$.voiceConversationProvider;return dD1.parse({provider:Q,model:Z?.voice_model??(Q==="openai"?$.openaiLiveModel:$.elevenlabsConversationModel)})}var dD1;var QX8=D(()=>{dD1=mD1.object({provider:mD1.enum(["elevenlabs","openai"]),model:mD1.string().trim().min(1).max(128)})});import{createHash as Do6}from"crypto";import{z as up}from"zod";function lp($){return`user.${Do6("sha256").update(JSON.stringify([$.organizationId,$.userId])).digest("hex")}`}class pD1{deps;kvPromise;constructor($){this.deps=$}kv(){let $=this.deps.getConnection();if(!$||$.isClosed())throw new q1(503,{message:"Voice transport is unavailable"});return this.kvPromise??=new YX8.Kvm(J_0.jetstream($)).create("STUDIO_VOICE_SESSIONS",{storage:J_0.StorageType.Memory,ttl:XX8.nanos(VD),max_bytes:10485760}).catch((Z)=>{throw this.kvPromise=void 0,Z}),this.kvPromise}adapter(){if(!this.deps.adapter)throw new q1(503,{message:"Voice is not configured on this deployment"});return this.deps.adapter}async create($,Z=!1,Q="en",Y){let X;if(Z)try{X=ZX8(this.deps.defaults,Y)}catch{throw new q1(503,{message:"Voice configuration is invalid"})}let J=X?this.deps.conversationAdapters[X.provider]:this.adapter();if(!J)throw new q1(503,{message:"Voice is not configured on this deployment"});let G={...$,sessionId:crypto.randomUUID(),expiresAt:Date.now()+VD},W=aY8(G,this.deps.secret),K=await this.kv(),H=lp(G),F=await K.get(H),U=F?.operation==="PUT"?X_0.parse(F.json()):null,N=iD1.encode(JSON.stringify({sessionId:G.sessionId,expiresAt:G.expiresAt,conversation:X,characters:0,requests:0}));try{if(F&&U&&U.expiresAt<=Date.now())await K.update(H,N,F.revision);else await K.create(H,N)}catch{throw new q1(409,{message:"Close your other voice session before starting a new one"})}try{if(X&&"createSession"in J){let O=await J.createSession({language:Q,model:X.model,safetyIdentifier:lp($)});return{token:W,...O,expiresAt:G.expiresAt}}let B=await this.adapter().createTranscriptionToken();return{token:W,transcriptionToken:B,expiresAt:G.expiresAt}}catch(B){throw await this.release(G),B}}authorize($,Z){let Q=eY8(Z,this.deps.secret);if(!Q||Q.organizationId!==$.organizationId||Q.userId!==$.userId||Q.threadId!==$.threadId)throw new q1(403,{message:"Invalid voice session"});return Q}async connect($,Z){let Q=this.authorize($,Z.token),Y=await this.kv(),X=lp(Q),J=await Y.get(X),G=J?.operation==="PUT"?X_0.parse(J.json()):null;if(!J||!G||G.sessionId!==Q.sessionId||G.expiresAt<=Date.now())throw new q1(403,{message:"Voice session expired"});let W=G.conversation?this.deps.conversationAdapters[G.conversation.provider]:null;if(!W?.negotiate||!G.conversation)throw new q1(409,{message:"Voice session does not support SDP negotiation"});if(G.connected)throw new q1(409,{message:"Voice session already connected"});try{await Y.update(X,iD1.encode(JSON.stringify({...G,connected:!0})),J.revision)}catch{throw new q1(409,{message:"Voice session is busy"})}return W.negotiate({sdp:Z.sdp,language:Z.language,model:G.conversation.model,safetyIdentifier:X})}async speak($,Z,Q,Y){let X=this.authorize($,Z),J=await this.kv(),G=lp(X);for(let W=0;;W++){let K=await J.get(G),H=K?.operation==="PUT"?X_0.parse(K.json()):null;if(!K||!H||H.sessionId!==X.sessionId||H.expiresAt<=Date.now())throw new q1(403,{message:"Voice session expired"});if(H.characters+Q.length>24000||H.requests>=120)throw new q1(429,{message:"Voice session speech limit reached"});try{await J.update(G,iD1.encode(JSON.stringify({...H,characters:H.characters+Q.length,requests:H.requests+1})),K.revision);break}catch{if(W>=2)throw new q1(409,{message:"Voice session is busy"})}}return this.adapter().synthesize(Q,Y)}async release($){let Z=await this.kv(),Q=await Z.get(lp($));if(Q?.operation==="PUT"&&X_0.parse(Q.json()).sessionId===$.sessionId)await Z.delete(lp($),{previousSeq:Q.revision})}async revoke($,Z){await this.release(this.authorize($,Z))}}var J_0,YX8,XX8,X_0,iD1;var JX8=D(()=>{OJ();fU();$X8();QX8();J_0=C(LK(),1),YX8=C(YA(),1),XX8=C(Az(),1),X_0=up.object({sessionId:up.string().uuid(),expiresAt:up.number(),connected:up.boolean().optional(),conversation:dD1.optional(),characters:up.number().int().nonnegative(),requests:up.number().int().nonnegative()}),iD1=new TextEncoder});function Oo6($){return $.filter((Z)=>Z.vendors?.alias).map((Z)=>({name:Z.name,title:Z.title,description:Z.description,logo:Z.logo,category:Z.category,vendor:{alias:Z.vendors.alias,url:Z.vendors.url}}))}var Lo6=async($,Z)=>{if(!$.get("studioContext").auth.user?.id)return $.json({error:"Unauthorized"},401);return Z()},GX8=()=>{let $=new Z1;return $.use("*",Lo6),$.get("/",async(Z)=>{let Q=E0(),Y=Q.decoSupabaseUrl,X=Q.decoSupabaseServiceKey;if(!Y||!X)return Z.json({apps:[]});try{let J=await QG(Y,X,"apps?select=name,title,description,logo,category,vendors(alias,url)");return Z.json({apps:Oo6(J)})}catch(J){return console.error("[deco-apps] GET error:",J),Z.json({error:"Failed to fetch apps"},502)}}),$};var WX8=D(()=>{J8();X$();bk0()});import{z as y1}from"zod";function zN($,Z="invalid_request_error",Q=null,Y=null){return{error:{message:$,type:Z,param:Q,code:Y}}}function Mo6($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let Q=$.substring(0,Z),Y=$.substring(Z+1);if(!Q||!Y)return null;return{credentialId:Q,modelId:Y}}function Io6($,Z,Q){try{return JSON.parse($)}catch{throw new FX8(`Invalid JSON in tool call arguments for function '${Q}' (tool_call_id: ${Z}): ${$}`)}}function Vo6($){let Z={};for(let Q of $)if(Q.role==="assistant"&&Q.tool_calls)for(let Y of Q.tool_calls)Z[Y.id]=Y.function.name;return $.map((Q)=>{switch(Q.role){case"system":return{role:"system",content:Q.content};case"user":if(typeof Q.content==="string")return{role:"user",content:Q.content};return{role:"user",content:Q.content.map((X)=>{if(X.type==="text")return{type:"text",text:X.text};return{type:"image",image:X.image_url.url}})};case"assistant":if(Q.tool_calls&&Q.tool_calls.length>0)return{role:"assistant",content:Q.tool_calls.map((X)=>({type:"tool-call",toolCallId:X.id,toolName:X.function.name,input:Io6(X.function.arguments,X.id,X.function.name)}))};return{role:"assistant",content:Q.content??""};case"tool":let Y=Z[Q.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:Q.tool_call_id,toolName:Y,output:{type:"text",value:Q.content}}]}}})}function ko6($){let Z=$.map((Q)=>{let Y=Q.function.parameters?nF(Q.function.parameters):nF({type:"object",properties:{}});return[Q.function.name,n$({description:Q.function.description,inputSchema:Y})]});return Object.fromEntries(Z)}function So6($){if(!$)return;return{openai:{response_format:$}}}function Co6(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function KX8($,Z,Q,Y,X,J){let G={model:$,instructions:Z.filter((W)=>W.role==="system"),messages:Z.filter((W)=>W.role!=="system"),tools:Q,temperature:Y.temperature,maxOutputTokens:Y.max_tokens,topP:Y.top_p,frequencyPenalty:Y.frequency_penalty,presencePenalty:Y.presence_penalty,stopSequences:Y.stop?Array.isArray(Y.stop)?Y.stop:[Y.stop]:void 0,abortSignal:J};return X?{...G,providerOptions:X}:G}function HX8($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var wo6=256,jo6,Eo6,zo6,Po6,Ao6,To6,Ro6,qo6,FX8,UX8,NX8;var BX8=D(()=>{y4();J8();Sp();vH();jo6=y1.object({type:y1.literal("function"),function:y1.object({name:y1.string(),description:y1.string().optional(),parameters:y1.record(y1.string(),y1.unknown()).optional()})}),Eo6=y1.object({id:y1.string(),type:y1.literal("function"),function:y1.object({name:y1.string(),arguments:y1.string()})}),zo6=y1.discriminatedUnion("role",[y1.object({role:y1.literal("system"),content:y1.string(),name:y1.string().optional()}),y1.object({role:y1.literal("user"),content:y1.union([y1.string(),y1.array(y1.union([y1.object({type:y1.literal("text"),text:y1.string()}),y1.object({type:y1.literal("image_url"),image_url:y1.object({url:y1.string(),detail:y1.string().optional()})})]))]),name:y1.string().optional()}),y1.object({role:y1.literal("assistant"),content:y1.string().nullable().optional(),name:y1.string().optional(),tool_calls:y1.array(Eo6).optional()}),y1.object({role:y1.literal("tool"),content:y1.string(),tool_call_id:y1.string()})]),Po6=y1.object({type:y1.literal("text")}),Ao6=y1.object({type:y1.literal("json_object")}),To6=y1.object({type:y1.literal("json_schema"),json_schema:y1.object({name:y1.string(),description:y1.string().optional(),schema:y1.record(y1.string(),y1.unknown()),strict:y1.boolean().optional()})}),Ro6=y1.union([Po6,Ao6,To6]),qo6=y1.object({model:y1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:y1.array(zo6),stream:y1.boolean().optional().default(!1),temperature:y1.number().min(0).max(2).optional(),max_tokens:y1.number().positive().optional(),top_p:y1.number().min(0).max(1).optional(),frequency_penalty:y1.number().min(-2).max(2).optional(),presence_penalty:y1.number().min(-2).max(2).optional(),stop:y1.union([y1.string(),y1.array(y1.string())]).optional(),tools:y1.array(jo6).optional(),tool_choice:y1.union([y1.literal("auto"),y1.literal("none"),y1.literal("required"),y1.object({type:y1.literal("function"),function:y1.object({name:y1.string()})})]).optional(),response_format:Ro6.optional(),user:y1.string().optional()});FX8=class FX8 extends Error{constructor($){super($);this.name="MessageConversionError"}};UX8=new Z1;UX8.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("studioContext"),Q=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(zN("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(zN("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==Q)return $.json(zN("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let Y=await $.req.json(),X=qo6.safeParse(Y);if(!X.success){let w=X.error.issues[0]??{message:"Invalid request",path:[]};return $.json(zN(`Invalid request: ${w.message}`,"invalid_request_error",w.path.length>0?w.path.join("."):null),400)}let J=X.data,G=Mo6(J.model);if(!G)return $.json(zN("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=G,{modelId:K}=G;if(!W){let j=(await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id})).find((E)=>jP(E.providerId));if(!j)return $.json(zN("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=j.id}let H;try{H=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(zN(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let F=H.aiSdk.languageModel(K),U=Vo6(J.messages),N=J.tools?ko6(J.tools):void 0,B=So6(J.response_format),O=Co6(),L=Math.floor(Date.now()/1000);if(J.stream)return DO($,async(w)=>{let j=KX8(F,U,N,J,B,$.req.raw.signal);try{let E=Fd(j),z=!1,T=0,A="",P=async()=>{if(A.length===0)return;let q=A;A="",await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{content:q},finish_reason:null}]})})};for await(let q of E.stream){if(!z&&(q.type==="text-delta"||q.type==="tool-call"))await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),z=!0;if(q.type==="text-delta"){if(A+=q.text,A.length>=wo6)await P()}else if(q.type==="tool-call"){await P();let x=T++;await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{tool_calls:[{index:x,id:q.toolCallId,type:"function",function:{name:q.toolName,arguments:JSON.stringify(q.input)}}]},finish_reason:null}]})})}else if(q.type==="finish")await P(),await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{},finish_reason:HX8(q.finishReason)}],usage:q.totalUsage?{prompt_tokens:q.totalUsage.inputTokens??0,completion_tokens:q.totalUsage.outputTokens??0,total_tokens:q.totalUsage.totalTokens??0}:void 0})})}await P(),await w.writeSSE({data:"[DONE]"})}catch(E){let z=E;console.error("[openai-compat:stream] Error:",z.message),await w.writeSSE({data:JSON.stringify({error:{message:z.message,type:"server_error"}})})}});else{let w=KX8(F,U,N,J,B,$.req.raw.signal),j=await gU(w),E={role:"assistant",content:j.text||null};if(j.toolCalls&&j.toolCalls.length>0)E.tool_calls=j.toolCalls.map((z)=>({id:z.toolCallId,type:"function",function:{name:z.toolName,arguments:JSON.stringify("input"in z?z.input:{})}})),E.content=null;return $.json({id:O,object:"chat.completion",created:L,model:J.model,choices:[{index:0,message:E,finish_reason:HX8(j.finishReason)}],usage:{prompt_tokens:j.usage?.inputTokens??0,completion_tokens:j.usage?.outputTokens??0,total_tokens:j.usage?.totalTokens??0}})}}catch(Y){let X=Y;if(X.name==="AbortError")return $.json(zN("Request aborted","invalid_request_error"),400);if(X.name==="MessageConversionError")return $.json(zN(X.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",X.message,X.stack),$.json(zN(X.message,"server_error"),500)}});NX8=UX8});function _o6($){if(typeof $!=="object"||$===null)return!1;let Q=$.repository?.url;return typeof Q==="string"&&Q.length>0}function DX8(){let $=new Z1;return $.use("*",async(Z,Q)=>{await Q(),Z.header("Cache-Control","private, no-store"),Z.header("Vary","Cookie")}),$.get("/",async(Z)=>{let Q=Z.get("studioContext"),Y=i0(Q);if(!Y)return Z.json({error:"Authentication required"},401);let J=(Z.req.query("site")??"").trim().toLowerCase();if(!wZ(J))return Z.json({error:"Invalid site slug"},400);let G=await Q.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.id as id","organization.slug as slug","organization.name as name","organization.metadata as metadata"]).where("member.userId","=",Y).execute(),W=[];for(let H of G){if(!H.slug||k9(H))continue;let F=await Q.storage.virtualMcps.list(H.id);for(let U of F){if(OA(U)!==J)continue;if(!_o6(U.metadata))continue;W.push({orgSlug:H.slug,orgName:H.name??H.slug,project:{id:U.id,title:U.title,icon:U.icon??null}})}}let K={matches:W};return Z.json(K)}),$}var OX8=D(()=>{J8();aG()});var wX8;var LX8=D(()=>{wX8={name:"decocms",version:"4.433.0",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js","db:migrate:dbos":"bun run ./dist/server/migrate-dbos.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts","migrate:dbos":"bun run src/database/migrate-dbos.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^4.0.58","@ai-sdk/google":"^4.0.76","@ai-sdk/openai":"^4.0.71","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^3.1.0","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^4.0.17","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^7.0.107","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});function xo6(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??bo6}}var jX8,bo6="https://ph.studio.decocms.com",EX8;var zX8=D(()=>{J8();ks();uf();I9();X$();JN1();LX8();jX8=new Z1;jX8.get("/",($)=>{let Z={version:wX8.version,theme:K5$(),...pK().logo&&{logo:pK().logo},...hD()&&{internalUrl:Sp1()},...E0().enableDecoImport&&{enableDecoImport:!0},brandExtractEnabled:!!E0().firecrawlApiKey,hostingEnabled:!!E0().controlplaneRestUrl&&!!E0().controlplaneServiceToken,hostingControlPlaneGa:E0().hostingControlPlaneGa,monitorEnabled:!!E0().clickhouseAnalyticsUrl&&!!E0().clickhouseAnalyticsPassword,monitorGa:E0().monitorGa,plansEnabled:E0().plansEnabled,auth:Y68(),posthog:xo6(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:MO()}};return $.header("Cache-Control","no-store"),$.json({success:!0,config:Z})});EX8=jX8});function sy($){let Z=($??"").trim().toLowerCase();return Z=Z.replace(/^https?:\/\//,""),Z=Z.replace(/^www\./,""),Z=Z.split(/[/?#]/)[0]??"",Z.replace(/\/+$/,"")}function nD1($){return(sy($).split(".")[0]||$).replace(/[-_]/g," ").split(" ").filter(Boolean).map((Q)=>Q.charAt(0).toUpperCase()+Q.slice(1)).join(" ")}function PX8($,Z=64){return`https://www.google.com/s2/favicons?domain=${encodeURIComponent(sy($))}&sz=${Z}`}function fo6($,Z){let Q=$.trim();if(Q.length<=Z)return Q;let Y=Q.slice(0,Z-1),X=Y.lastIndexOf(" ");return`${(X>Z*0.6?Y.slice(0,X):Y).trimEnd()}\u2026`}function AX8($){let{brand:Z,domain:Q,score:Y}=$,X=typeof Y==="number"?`${Z} Deco Score \u2014 ${Math.round(Y)}/100 \xB7 decocms`:`${Z} Deco Score \xB7 decocms`,J=fo6(`How does ${Q} really perform? See the full ${Z} Deco Score \u2014 SEO, performance, conversion & AEO signals scored by decocms.`,200);return{title:X,description:J}}import{z as z$}from"zod";var yo6,TX8;var RX8=D(()=>{yo6=z$.object({check_id:z$.string(),title:z$.string(),description:z$.string().optional(),impact:z$.string().optional(),why:z$.string().optional(),category:z$.string(),severity:z$.string(),value_band:z$.string().optional(),value_driver:z$.string().optional(),controllability:z$.string().optional(),pages:z$.array(z$.string()),tasks:z$.array(z$.string()),evidence:z$.string(),sample_scope:z$.string().optional(),sources:z$.array(z$.string())}),TX8=z$.object({domain:z$.string(),brand:z$.string(),favicon:z$.string().optional(),scanned_at:z$.string().nullable(),lang:z$.string(),score:z$.number().nullable(),band:z$.string().nullable(),totals:z$.object({measured:z$.number(),registry_total:z$.number(),passed:z$.number(),failed:z$.number(),blocked:z$.number()}),buckets:z$.array(z$.object({id:z$.enum(["critical","important","worth"]),label:z$.string(),items:z$.array(yo6)})),passing:z$.object({count:z$.number(),items:z$.array(z$.object({check_id:z$.string(),title:z$.string()}))}),not_measured:z$.object({count:z$.number(),groups:z$.array(z$.object({reason:z$.string(),label:z$.string(),count:z$.number(),checks:z$.array(z$.string())}))}),categories:z$.array(z$.object({key:z$.string(),label:z$.string(),score:z$.number().nullable(),band:z$.string().nullable(),pass:z$.number(),fail:z$.number()})),screenshots:z$.array(z$.object({url:z$.string(),page_type:z$.string().optional(),viewport:z$.enum(["desktop","mobile"]),image_url:z$.string()}))})});function qX8($,Z,Q){let Y=Q?`?${new URLSearchParams({lang:Q}).toString()}`:"";return`${PW({})}/api/v2/public/diagnostics/${encodeURIComponent($)}/onepager${Z}${Y}`}async function G_0($,Z={}){let Q=await fetch(qX8($,"",Z.lang),{headers:{Accept:"application/json"},signal:Z.signal});if(Q.status===404)return null;if(!Q.ok)throw Error(`onepager read HTTP ${Q.status}`);return TX8.parse(await Q.json())}async function MX8($,Z={}){let Q=await fetch(qX8($,".md",Z.lang),{headers:{Accept:"text/markdown"},signal:Z.signal});if(Q.status===404)return null;if(!Q.ok)throw Error(`onepager markdown HTTP ${Q.status}`);return Q.text()}var tD1=D(()=>{RX8();tB()});import{join as IX8}from"path";async function ho6($){try{let Z=await G_0($,{signal:AbortSignal.timeout(go6)});if(!Z?.scanned_at)return null;return{brand:Z.brand.trim()||nD1($),...Z.score!==null?{score:Z.score}:{}}}catch{return null}}function GG($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function uo6($,Z){let Q=sy($),Y=Z?.brand?.trim()||nD1(Q),X=PX8(Q,128),G=`${(E0().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(Q)}`,{title:W,description:K}=AX8({brand:Y,domain:Q,score:Z?.score}),H=`${G}/og.png`,F=`${Y} Deco Score by decocms`;return[`<title>${GG(W)}</title>`,`<meta name="description" content="${GG(K)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${GG(W)}" />`,`<meta property="og:description" content="${GG(K)}" />`,`<meta property="og:url" content="${GG(G)}" />`,`<meta property="og:image" content="${GG(H)}" />`,'<meta property="og:image:width" content="1200" />','<meta property="og:image:height" content="630" />',`<meta property="og:image:alt" content="${GG(F)}" />`,'<meta name="twitter:card" content="summary_large_image" />',`<meta name="twitter:title" content="${GG(W)}" />`,`<meta name="twitter:description" content="${GG(K)}" />`,`<meta name="twitter:image" content="${GG(H)}" />`,`<meta name="twitter:image:alt" content="${GG(F)}" />`,`<link rel="canonical" href="${GG(G)}" />`,`<link rel="alternate" type="text/markdown" href="${GG(G)}.md" />`,`<link rel="icon" href="${GG(X)}" sizes="any" />`].join(`
+Start in ${$.language==="pt"?"Brazilian Portuguese":"English"}, and follow the user's language.`,delegation:{type:"client"},audio:{output:{voice:$.voice}},store:!1}}class lD1{config;constructor($){this.config=$}async createSession(){return{provider:"openai",transport:"webrtc"}}async negotiate($){let Z=await fetch("https://api.openai.com/v1/live/sessions",{method:"POST",headers:{Authorization:`Bearer ${this.config.apiKey}`,"Content-Type":"application/json","OpenAI-Safety-Identifier":$.safetyIdentifier},body:JSON.stringify({session:Ho6({...this.config,language:$.language,model:$.model}),transport:{type:"webrtc",sdp:$.sdp}}),signal:AbortSignal.timeout(15000)});if(!Z.ok)throw await Z.body?.cancel(),Error(`OpenAI Live request failed (${Z.status})`);return{sdp:gp.object({session:gp.object({id:gp.string().min(1)}),transport:gp.object({type:gp.literal("webrtc"),sdp:gp.string().min(1).max(1e5)})}).parse(await Z.json()).transport.sdp}}}var iY8=D(()=>{fU()});var pY8;var nY8=D(()=>{pY8=[{name:"delegate_to_agent",description:"Submit a complete request to the selected Studio agent. Returns after acceptance while work continues in the background. Results arrive later.",parameters:{type:"object",properties:{request:{type:"string",description:"The complete user request, with relevant conversational details. Preserve intent and constraints."}},required:["request"]}},{name:"get_agent_status",description:"Read the current chat's work status and known results. This does not track independent organization tasks; delegate fresh task-status queries to the Studio agent. Use when asked, never poll.",parameters:{type:"object",properties:{}}},{name:"stop_agent_work",description:"Request cancellation in the current chat ONLY when the user explicitly asks. Speaking over the companion is not cancellation. To stop independent tasks, delegate that request to the Studio agent.",parameters:{type:"object",properties:{}}}]});function cD1($){return{conversation_config:{agent:{first_message:"",language:"en",prompt:{prompt:aR$,llm:$.conversationModel,thinking_budget:0,max_tokens:512,tools:pY8.map((Z)=>({...Z,type:"client",expects_response:!0,response_timeout_secs:Z.name==="delegate_to_agent"?20:5,...Z.name==="delegate_to_agent"?{execution_mode:"async",interruption_mode:"allow",pre_tool_speech:"off"}:{}}))}},asr:{provider:"scribe_realtime",quality:"high"},turn:{turn_eagerness:"normal",turn_timeout:-1,silence_end_call_timeout:-1},tts:{voice_id:$.voiceId,model_id:$.model},conversation:{max_duration_seconds:VD/1000,client_events:["audio","interruption","user_transcript","agent_response","client_tool_call","vad_score"]}},platform_settings:{auth:{enable_auth:!0},privacy:{record_voice:!1,retention_days:1,delete_audio:!0,delete_transcript_and_pii:!0},overrides:{conversation_config_override:{agent:{language:!0}}}}}}var tY8=D(()=>{fU();nY8()});import{z as nX}from"zod";import{createHash as Fo6,createHmac as Uo6}from"crypto";class Y_0{config;conversationKey;configurationKey;constructor($){this.config=$;this.configurationKey=Fo6("sha256").update(JSON.stringify(cD1($))).digest("hex"),this.conversationKey=Uo6("sha256",$.apiKey).update(this.configurationKey).digest("hex")}forConversationModel($){return $===this.config.conversationModel?this:new Y_0({...this.config,conversationModel:$})}async request($,Z,Q){let Y=await fetch(`https://api.elevenlabs.io/v1${$}`,{method:Z===void 0?"GET":"POST",headers:{"xi-api-key":this.config.apiKey,"Content-Type":"application/json"},body:JSON.stringify(Z),signal:Q});if(!Y.ok)throw await Y.body?.cancel(),Error(`ElevenLabs request failed (${Y.status})`);return Y}async ensureConversationAgent(){let $=`Studio voice ${this.configurationKey.slice(0,24)}`,Z=await this.request(`/convai/agents?search=${encodeURIComponent($)}&page_size=100`,void 0,AbortSignal.timeout(15000)),{agents:Q}=nX.object({agents:nX.array(nX.object({agent_id:nX.string(),name:nX.string()}))}).parse(await Z.json()),Y=Q.find((J)=>J.name===$);if(Y){let J=await this.request(`/convai/agents/${encodeURIComponent(Y.agent_id)}`,void 0,AbortSignal.timeout(15000));return nX.object({platform_settings:nX.object({auth:nX.object({enable_auth:nX.literal(!0)})})}).parse(await J.json()),Y.agent_id}let X=await this.request("/convai/agents/create",{name:$,...cD1(this.config)},AbortSignal.timeout(15000));return nX.object({agent_id:nX.string().min(1)}).parse(await X.json()).agent_id}async createConversationToken($){let Z=await this.request(`/convai/conversation/token?agent_id=${encodeURIComponent($)}`,void 0,AbortSignal.timeout(15000));return nX.object({token:nX.string().min(1)}).parse(await Z.json()).token}async createTranscriptionToken(){let $=await this.request("/single-use-token/realtime_scribe",{},AbortSignal.timeout(15000));return nX.object({token:nX.string().min(1)}).parse(await $.json()).token}synthesize($,Z){return this.request(`/text-to-speech/${encodeURIComponent(this.config.voiceId)}/stream?output_format=mp3_44100_128`,{text:$,model_id:this.config.model},AbortSignal.any([Z,AbortSignal.timeout(60000)]))}}var oY8=D(()=>{tY8()});import{createHmac as No6,timingSafeEqual as Bo6}from"crypto";import{z as hp}from"zod";function sY8($,Z){if(!Z)throw Error("Voice requires a shared authentication secret");return No6("sha256",Z).update(`studio-voice-session:v1:${$}`).digest("base64url")}function aY8($,Z){let Q=Buffer.from(JSON.stringify(rY8.parse($))).toString("base64url");return`${Q}.${sY8(Q,Z)}`}function eY8($,Z,Q=Date.now()){if(!Z||$.length>4096)return null;let Y=$.split(".");if(Y.length!==2)return null;let[X,J]=Y;if(!X||!J)return null;let G=Buffer.from(sY8(X,Z)),W=Buffer.from(J);if(W.length!==G.length||!Bo6(W,G))return null;try{let K=rY8.safeParse(JSON.parse(Buffer.from(X,"base64url").toString()));if(!K.success||K.data.expiresAt<=Q||K.data.expiresAt>Q+VD)return null;return K.data}catch{return null}}var rY8;var $X8=D(()=>{fU();rY8=hp.object({sessionId:hp.string().uuid(),organizationId:hp.string().min(1).max(256),userId:hp.string().min(1).max(256),threadId:hp.string().min(1).max(256),expiresAt:hp.number().int().positive()})});import{z as mD1}from"zod";function ZX8($,Z){if(Z?.voice_model!=null&&Z.voice_provider==null)throw Error("A voice model override requires a provider");let Q=Z?.voice_provider??$.voiceConversationProvider;return dD1.parse({provider:Q,model:Z?.voice_model??(Q==="openai"?$.openaiLiveModel:$.elevenlabsConversationModel)})}var dD1;var QX8=D(()=>{dD1=mD1.object({provider:mD1.enum(["elevenlabs","openai"]),model:mD1.string().trim().min(1).max(128)})});import{createHash as Do6}from"crypto";import{z as up}from"zod";function lp($){return`user.${Do6("sha256").update(JSON.stringify([$.organizationId,$.userId])).digest("hex")}`}class pD1{deps;kvPromise;constructor($){this.deps=$}kv(){let $=this.deps.getConnection();if(!$||$.isClosed())throw new q1(503,{message:"Voice transport is unavailable"});return this.kvPromise??=new YX8.Kvm(J_0.jetstream($)).create("STUDIO_VOICE_SESSIONS",{storage:J_0.StorageType.Memory,ttl:XX8.nanos(VD),max_bytes:10485760}).catch((Z)=>{throw this.kvPromise=void 0,Z}),this.kvPromise}adapter(){if(!this.deps.adapter)throw new q1(503,{message:"Voice is not configured on this deployment"});return this.deps.adapter}async create($,Z=!1,Q="en",Y){let X;if(Z)try{X=ZX8(this.deps.defaults,Y)}catch{throw new q1(503,{message:"Voice configuration is invalid"})}let J=X?this.deps.conversationAdapters[X.provider]:this.adapter();if(!J)throw new q1(503,{message:"Voice is not configured on this deployment"});let G={...$,sessionId:crypto.randomUUID(),expiresAt:Date.now()+VD},W=aY8(G,this.deps.secret),K=await this.kv(),H=lp(G),F=await K.get(H),U=F?.operation==="PUT"?X_0.parse(F.json()):null,N=iD1.encode(JSON.stringify({sessionId:G.sessionId,expiresAt:G.expiresAt,conversation:X,characters:0,requests:0}));try{if(F&&U&&U.expiresAt<=Date.now())await K.update(H,N,F.revision);else await K.create(H,N)}catch{throw new q1(409,{message:"Close your other voice session before starting a new one"})}try{if(X&&"createSession"in J){let O=await J.createSession({language:Q,model:X.model,safetyIdentifier:lp($)});return{token:W,...O,expiresAt:G.expiresAt}}let B=await this.adapter().createTranscriptionToken();return{token:W,transcriptionToken:B,expiresAt:G.expiresAt}}catch(B){throw await this.release(G),B}}authorize($,Z){let Q=eY8(Z,this.deps.secret);if(!Q||Q.organizationId!==$.organizationId||Q.userId!==$.userId||Q.threadId!==$.threadId)throw new q1(403,{message:"Invalid voice session"});return Q}async connect($,Z){let Q=this.authorize($,Z.token),Y=await this.kv(),X=lp(Q),J=await Y.get(X),G=J?.operation==="PUT"?X_0.parse(J.json()):null;if(!J||!G||G.sessionId!==Q.sessionId||G.expiresAt<=Date.now())throw new q1(403,{message:"Voice session expired"});let W=G.conversation?this.deps.conversationAdapters[G.conversation.provider]:null;if(!W?.negotiate||!G.conversation)throw new q1(409,{message:"Voice session does not support SDP negotiation"});if(G.connected)throw new q1(409,{message:"Voice session already connected"});try{await Y.update(X,iD1.encode(JSON.stringify({...G,connected:!0})),J.revision)}catch{throw new q1(409,{message:"Voice session is busy"})}return W.negotiate({sdp:Z.sdp,language:Z.language,model:G.conversation.model,safetyIdentifier:X})}async speak($,Z,Q,Y){let X=this.authorize($,Z),J=await this.kv(),G=lp(X);for(let W=0;;W++){let K=await J.get(G),H=K?.operation==="PUT"?X_0.parse(K.json()):null;if(!K||!H||H.sessionId!==X.sessionId||H.expiresAt<=Date.now())throw new q1(403,{message:"Voice session expired"});if(H.characters+Q.length>24000||H.requests>=120)throw new q1(429,{message:"Voice session speech limit reached"});try{await J.update(G,iD1.encode(JSON.stringify({...H,characters:H.characters+Q.length,requests:H.requests+1})),K.revision);break}catch{if(W>=2)throw new q1(409,{message:"Voice session is busy"})}}return this.adapter().synthesize(Q,Y)}async release($){let Z=await this.kv(),Q=await Z.get(lp($));if(Q?.operation==="PUT"&&X_0.parse(Q.json()).sessionId===$.sessionId)await Z.delete(lp($),{previousSeq:Q.revision})}async revoke($,Z){await this.release(this.authorize($,Z))}}var J_0,YX8,XX8,X_0,iD1;var JX8=D(()=>{OJ();fU();$X8();QX8();J_0=C(LK(),1),YX8=C(YA(),1),XX8=C(Az(),1),X_0=up.object({sessionId:up.string().uuid(),expiresAt:up.number(),connected:up.boolean().optional(),conversation:dD1.optional(),characters:up.number().int().nonnegative(),requests:up.number().int().nonnegative()}),iD1=new TextEncoder});function Oo6($){return $.filter((Z)=>Z.vendors?.alias).map((Z)=>({name:Z.name,title:Z.title,description:Z.description,logo:Z.logo,category:Z.category,vendor:{alias:Z.vendors.alias,url:Z.vendors.url}}))}var Lo6=async($,Z)=>{if(!$.get("studioContext").auth.user?.id)return $.json({error:"Unauthorized"},401);return Z()},GX8=()=>{let $=new Z1;return $.use("*",Lo6),$.get("/",async(Z)=>{let Q=E0(),Y=Q.decoSupabaseUrl,X=Q.decoSupabaseServiceKey;if(!Y||!X)return Z.json({apps:[]});try{let J=await QG(Y,X,"apps?select=name,title,description,logo,category,vendors(alias,url)");return Z.json({apps:Oo6(J)})}catch(J){return console.error("[deco-apps] GET error:",J),Z.json({error:"Failed to fetch apps"},502)}}),$};var WX8=D(()=>{J8();X$();bk0()});import{z as y1}from"zod";function zN($,Z="invalid_request_error",Q=null,Y=null){return{error:{message:$,type:Z,param:Q,code:Y}}}function Mo6($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let Q=$.substring(0,Z),Y=$.substring(Z+1);if(!Q||!Y)return null;return{credentialId:Q,modelId:Y}}function Io6($,Z,Q){try{return JSON.parse($)}catch{throw new FX8(`Invalid JSON in tool call arguments for function '${Q}' (tool_call_id: ${Z}): ${$}`)}}function Vo6($){let Z={};for(let Q of $)if(Q.role==="assistant"&&Q.tool_calls)for(let Y of Q.tool_calls)Z[Y.id]=Y.function.name;return $.map((Q)=>{switch(Q.role){case"system":return{role:"system",content:Q.content};case"user":if(typeof Q.content==="string")return{role:"user",content:Q.content};return{role:"user",content:Q.content.map((X)=>{if(X.type==="text")return{type:"text",text:X.text};return{type:"image",image:X.image_url.url}})};case"assistant":if(Q.tool_calls&&Q.tool_calls.length>0)return{role:"assistant",content:Q.tool_calls.map((X)=>({type:"tool-call",toolCallId:X.id,toolName:X.function.name,input:Io6(X.function.arguments,X.id,X.function.name)}))};return{role:"assistant",content:Q.content??""};case"tool":let Y=Z[Q.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:Q.tool_call_id,toolName:Y,output:{type:"text",value:Q.content}}]}}})}function ko6($){let Z=$.map((Q)=>{let Y=Q.function.parameters?nF(Q.function.parameters):nF({type:"object",properties:{}});return[Q.function.name,n$({description:Q.function.description,inputSchema:Y})]});return Object.fromEntries(Z)}function So6($){if(!$)return;return{openai:{response_format:$}}}function Co6(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function KX8($,Z,Q,Y,X,J){let G={model:$,instructions:Z.filter((W)=>W.role==="system"),messages:Z.filter((W)=>W.role!=="system"),tools:Q,temperature:Y.temperature,maxOutputTokens:Y.max_tokens,topP:Y.top_p,frequencyPenalty:Y.frequency_penalty,presencePenalty:Y.presence_penalty,stopSequences:Y.stop?Array.isArray(Y.stop)?Y.stop:[Y.stop]:void 0,abortSignal:J};return X?{...G,providerOptions:X}:G}function HX8($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var wo6=256,jo6,Eo6,zo6,Po6,Ao6,To6,Ro6,qo6,FX8,UX8,NX8;var BX8=D(()=>{y4();J8();Sp();vH();jo6=y1.object({type:y1.literal("function"),function:y1.object({name:y1.string(),description:y1.string().optional(),parameters:y1.record(y1.string(),y1.unknown()).optional()})}),Eo6=y1.object({id:y1.string(),type:y1.literal("function"),function:y1.object({name:y1.string(),arguments:y1.string()})}),zo6=y1.discriminatedUnion("role",[y1.object({role:y1.literal("system"),content:y1.string(),name:y1.string().optional()}),y1.object({role:y1.literal("user"),content:y1.union([y1.string(),y1.array(y1.union([y1.object({type:y1.literal("text"),text:y1.string()}),y1.object({type:y1.literal("image_url"),image_url:y1.object({url:y1.string(),detail:y1.string().optional()})})]))]),name:y1.string().optional()}),y1.object({role:y1.literal("assistant"),content:y1.string().nullable().optional(),name:y1.string().optional(),tool_calls:y1.array(Eo6).optional()}),y1.object({role:y1.literal("tool"),content:y1.string(),tool_call_id:y1.string()})]),Po6=y1.object({type:y1.literal("text")}),Ao6=y1.object({type:y1.literal("json_object")}),To6=y1.object({type:y1.literal("json_schema"),json_schema:y1.object({name:y1.string(),description:y1.string().optional(),schema:y1.record(y1.string(),y1.unknown()),strict:y1.boolean().optional()})}),Ro6=y1.union([Po6,Ao6,To6]),qo6=y1.object({model:y1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:y1.array(zo6),stream:y1.boolean().optional().default(!1),temperature:y1.number().min(0).max(2).optional(),max_tokens:y1.number().positive().optional(),top_p:y1.number().min(0).max(1).optional(),frequency_penalty:y1.number().min(-2).max(2).optional(),presence_penalty:y1.number().min(-2).max(2).optional(),stop:y1.union([y1.string(),y1.array(y1.string())]).optional(),tools:y1.array(jo6).optional(),tool_choice:y1.union([y1.literal("auto"),y1.literal("none"),y1.literal("required"),y1.object({type:y1.literal("function"),function:y1.object({name:y1.string()})})]).optional(),response_format:Ro6.optional(),user:y1.string().optional()});FX8=class FX8 extends Error{constructor($){super($);this.name="MessageConversionError"}};UX8=new Z1;UX8.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("studioContext"),Q=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(zN("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(zN("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==Q)return $.json(zN("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let Y=await $.req.json(),X=qo6.safeParse(Y);if(!X.success){let w=X.error.issues[0]??{message:"Invalid request",path:[]};return $.json(zN(`Invalid request: ${w.message}`,"invalid_request_error",w.path.length>0?w.path.join("."):null),400)}let J=X.data,G=Mo6(J.model);if(!G)return $.json(zN("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=G,{modelId:K}=G;if(!W){let j=(await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id})).find((E)=>jP(E.providerId));if(!j)return $.json(zN("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=j.id}let H;try{H=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(zN(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let F=H.aiSdk.languageModel(K),U=Vo6(J.messages),N=J.tools?ko6(J.tools):void 0,B=So6(J.response_format),O=Co6(),L=Math.floor(Date.now()/1000);if(J.stream)return DO($,async(w)=>{let j=KX8(F,U,N,J,B,$.req.raw.signal);try{let E=Fd(j),z=!1,T=0,A="",P=async()=>{if(A.length===0)return;let q=A;A="",await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{content:q},finish_reason:null}]})})};for await(let q of E.stream){if(!z&&(q.type==="text-delta"||q.type==="tool-call"))await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),z=!0;if(q.type==="text-delta"){if(A+=q.text,A.length>=wo6)await P()}else if(q.type==="tool-call"){await P();let x=T++;await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{tool_calls:[{index:x,id:q.toolCallId,type:"function",function:{name:q.toolName,arguments:JSON.stringify(q.input)}}]},finish_reason:null}]})})}else if(q.type==="finish")await P(),await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{},finish_reason:HX8(q.finishReason)}],usage:q.totalUsage?{prompt_tokens:q.totalUsage.inputTokens??0,completion_tokens:q.totalUsage.outputTokens??0,total_tokens:q.totalUsage.totalTokens??0}:void 0})})}await P(),await w.writeSSE({data:"[DONE]"})}catch(E){let z=E;console.error("[openai-compat:stream] Error:",z.message),await w.writeSSE({data:JSON.stringify({error:{message:z.message,type:"server_error"}})})}});else{let w=KX8(F,U,N,J,B,$.req.raw.signal),j=await gU(w),E={role:"assistant",content:j.text||null};if(j.toolCalls&&j.toolCalls.length>0)E.tool_calls=j.toolCalls.map((z)=>({id:z.toolCallId,type:"function",function:{name:z.toolName,arguments:JSON.stringify("input"in z?z.input:{})}})),E.content=null;return $.json({id:O,object:"chat.completion",created:L,model:J.model,choices:[{index:0,message:E,finish_reason:HX8(j.finishReason)}],usage:{prompt_tokens:j.usage?.inputTokens??0,completion_tokens:j.usage?.outputTokens??0,total_tokens:j.usage?.totalTokens??0}})}}catch(Y){let X=Y;if(X.name==="AbortError")return $.json(zN("Request aborted","invalid_request_error"),400);if(X.name==="MessageConversionError")return $.json(zN(X.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",X.message,X.stack),$.json(zN(X.message,"server_error"),500)}});NX8=UX8});function _o6($){if(typeof $!=="object"||$===null)return!1;let Q=$.repository?.url;return typeof Q==="string"&&Q.length>0}function DX8(){let $=new Z1;return $.use("*",async(Z,Q)=>{await Q(),Z.header("Cache-Control","private, no-store"),Z.header("Vary","Cookie")}),$.get("/",async(Z)=>{let Q=Z.get("studioContext"),Y=i0(Q);if(!Y)return Z.json({error:"Authentication required"},401);let J=(Z.req.query("site")??"").trim().toLowerCase();if(!wZ(J))return Z.json({error:"Invalid site slug"},400);let G=await Q.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.id as id","organization.slug as slug","organization.name as name","organization.metadata as metadata"]).where("member.userId","=",Y).execute(),W=[];for(let H of G){if(!H.slug||k9(H))continue;let F=await Q.storage.virtualMcps.list(H.id);for(let U of F){if(OA(U)!==J)continue;if(!_o6(U.metadata))continue;W.push({orgSlug:H.slug,orgName:H.name??H.slug,project:{id:U.id,title:U.title,icon:U.icon??null}})}}let K={matches:W};return Z.json(K)}),$}var OX8=D(()=>{J8();aG()});var wX8;var LX8=D(()=>{wX8={name:"decocms",version:"4.435.0",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js","db:migrate:dbos":"bun run ./dist/server/migrate-dbos.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts","migrate:dbos":"bun run src/database/migrate-dbos.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^4.0.58","@ai-sdk/google":"^4.0.76","@ai-sdk/openai":"^4.0.71","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^3.1.0","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^4.0.17","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^7.0.107","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});function xo6(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??bo6}}var jX8,bo6="https://ph.studio.decocms.com",EX8;var zX8=D(()=>{J8();ks();uf();I9();X$();JN1();LX8();jX8=new Z1;jX8.get("/",($)=>{let Z={version:wX8.version,theme:K5$(),...pK().logo&&{logo:pK().logo},...hD()&&{internalUrl:Sp1()},...E0().enableDecoImport&&{enableDecoImport:!0},brandExtractEnabled:!!E0().firecrawlApiKey,hostingEnabled:!!E0().controlplaneRestUrl&&!!E0().controlplaneServiceToken,hostingControlPlaneGa:E0().hostingControlPlaneGa,monitorEnabled:!!E0().clickhouseAnalyticsUrl&&!!E0().clickhouseAnalyticsPassword,monitorGa:E0().monitorGa,plansEnabled:E0().plansEnabled,auth:Y68(),posthog:xo6(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:MO()}};return $.header("Cache-Control","no-store"),$.json({success:!0,config:Z})});EX8=jX8});function sy($){let Z=($??"").trim().toLowerCase();return Z=Z.replace(/^https?:\/\//,""),Z=Z.replace(/^www\./,""),Z=Z.split(/[/?#]/)[0]??"",Z.replace(/\/+$/,"")}function nD1($){return(sy($).split(".")[0]||$).replace(/[-_]/g," ").split(" ").filter(Boolean).map((Q)=>Q.charAt(0).toUpperCase()+Q.slice(1)).join(" ")}function PX8($,Z=64){return`https://www.google.com/s2/favicons?domain=${encodeURIComponent(sy($))}&sz=${Z}`}function fo6($,Z){let Q=$.trim();if(Q.length<=Z)return Q;let Y=Q.slice(0,Z-1),X=Y.lastIndexOf(" ");return`${(X>Z*0.6?Y.slice(0,X):Y).trimEnd()}\u2026`}function AX8($){let{brand:Z,domain:Q,score:Y}=$,X=typeof Y==="number"?`${Z} Deco Score \u2014 ${Math.round(Y)}/100 \xB7 decocms`:`${Z} Deco Score \xB7 decocms`,J=fo6(`How does ${Q} really perform? See the full ${Z} Deco Score \u2014 SEO, performance, conversion & AEO signals scored by decocms.`,200);return{title:X,description:J}}import{z as z$}from"zod";var yo6,TX8;var RX8=D(()=>{yo6=z$.object({check_id:z$.string(),title:z$.string(),description:z$.string().optional(),impact:z$.string().optional(),why:z$.string().optional(),category:z$.string(),severity:z$.string(),value_band:z$.string().optional(),value_driver:z$.string().optional(),controllability:z$.string().optional(),pages:z$.array(z$.string()),tasks:z$.array(z$.string()),evidence:z$.string(),sample_scope:z$.string().optional(),sources:z$.array(z$.string())}),TX8=z$.object({domain:z$.string(),brand:z$.string(),favicon:z$.string().optional(),scanned_at:z$.string().nullable(),lang:z$.string(),score:z$.number().nullable(),band:z$.string().nullable(),totals:z$.object({measured:z$.number(),registry_total:z$.number(),passed:z$.number(),failed:z$.number(),blocked:z$.number()}),buckets:z$.array(z$.object({id:z$.enum(["critical","important","worth"]),label:z$.string(),items:z$.array(yo6)})),passing:z$.object({count:z$.number(),items:z$.array(z$.object({check_id:z$.string(),title:z$.string()}))}),not_measured:z$.object({count:z$.number(),groups:z$.array(z$.object({reason:z$.string(),label:z$.string(),count:z$.number(),checks:z$.array(z$.string())}))}),categories:z$.array(z$.object({key:z$.string(),label:z$.string(),score:z$.number().nullable(),band:z$.string().nullable(),pass:z$.number(),fail:z$.number()})),screenshots:z$.array(z$.object({url:z$.string(),page_type:z$.string().optional(),viewport:z$.enum(["desktop","mobile"]),image_url:z$.string()}))})});function qX8($,Z,Q){let Y=Q?`?${new URLSearchParams({lang:Q}).toString()}`:"";return`${PW({})}/api/v2/public/diagnostics/${encodeURIComponent($)}/onepager${Z}${Y}`}async function G_0($,Z={}){let Q=await fetch(qX8($,"",Z.lang),{headers:{Accept:"application/json"},signal:Z.signal});if(Q.status===404)return null;if(!Q.ok)throw Error(`onepager read HTTP ${Q.status}`);return TX8.parse(await Q.json())}async function MX8($,Z={}){let Q=await fetch(qX8($,".md",Z.lang),{headers:{Accept:"text/markdown"},signal:Z.signal});if(Q.status===404)return null;if(!Q.ok)throw Error(`onepager markdown HTTP ${Q.status}`);return Q.text()}var tD1=D(()=>{RX8();tB()});import{join as IX8}from"path";async function ho6($){try{let Z=await G_0($,{signal:AbortSignal.timeout(go6)});if(!Z?.scanned_at)return null;return{brand:Z.brand.trim()||nD1($),...Z.score!==null?{score:Z.score}:{}}}catch{return null}}function GG($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function uo6($,Z){let Q=sy($),Y=Z?.brand?.trim()||nD1(Q),X=PX8(Q,128),G=`${(E0().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(Q)}`,{title:W,description:K}=AX8({brand:Y,domain:Q,score:Z?.score}),H=`${G}/og.png`,F=`${Y} Deco Score by decocms`;return[`<title>${GG(W)}</title>`,`<meta name="description" content="${GG(K)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${GG(W)}" />`,`<meta property="og:description" content="${GG(K)}" />`,`<meta property="og:url" content="${GG(G)}" />`,`<meta property="og:image" content="${GG(H)}" />`,'<meta property="og:image:width" content="1200" />','<meta property="og:image:height" content="630" />',`<meta property="og:image:alt" content="${GG(F)}" />`,'<meta name="twitter:card" content="summary_large_image" />',`<meta name="twitter:title" content="${GG(W)}" />`,`<meta name="twitter:description" content="${GG(K)}" />`,`<meta name="twitter:image" content="${GG(H)}" />`,`<meta name="twitter:image:alt" content="${GG(F)}" />`,`<link rel="canonical" href="${GG(G)}" />`,`<link rel="alternate" type="text/markdown" href="${GG(G)}.md" />`,`<link rel="icon" href="${GG(X)}" sizes="any" />`].join(`
     `)}function lo6($,Z){return $.replace(/<title>[\s\S]*?<\/title>\s*/i,"").replace(/<meta\s+name="(?:description|twitter:[^"]*)"[^>]*>\s*/gi,"").replace(/<meta\s+property="og:[^"]*"[^>]*>\s*/gi,"").replace(/<link\s+rel="icon"[^>]*>\s*/gi,"").replace("</head>",`    ${Z}
   </head>`)}function VX8($){let Z=new Z1;return Z.get("/:domain/og.png",async(Q)=>{let Y=sy(Q.req.param("domain")),X=async()=>{let J=$?Bun.file(IX8($,"report-og-fallback.png")):null;if(!J||!await J.exists())return Q.notFound();return Q.body(new Uint8Array(await J.arrayBuffer()),200,{"Content-Type":"image/png","Cache-Control":"public, max-age=0, s-maxage=3600"})};try{let J=await fetch(`${PW({})}/api/v2/public/diagnostics/${encodeURIComponent(Y)}/og.png`,{signal:AbortSignal.timeout(co6)}),G=J.headers.get("content-type")??"";if(!J.ok||!G.startsWith("image/")||!J.body)return X();return Q.body(J.body,200,{"Content-Type":G,"Cache-Control":"public, max-age=0, s-maxage=604800"})}catch{return X()}}),Z.get("/:file{.+\\.md}",async(Q)=>{let Y=sy(Q.req.param("file").replace(/\.md$/,""));try{let X=await MX8(Y,{lang:Q.req.query("lang")?.trim()||void 0,signal:AbortSignal.timeout(mo6)});if(X===null)return Q.text("Deco Score not found",404);return Q.body(X,200,{"Content-Type":"text/markdown; charset=utf-8","Cache-Control":"public, max-age=600, stale-while-revalidate=3600","Access-Control-Allow-Origin":"*"})}catch{return Q.text("Deco Score unavailable",502)}}),Z.get("/:domain",async(Q)=>{let Y=Q.req.param("domain"),X=$?IX8($,"index.html"):null,J=X?Bun.file(X):null;if(!J||!await J.exists())return Q.notFound();let G=await J.text();try{let W=await ho6(sy(Y)),K=uo6(Y,W);return Q.html(lo6(G,K),200,{"Cache-Control":"public, max-age=0, s-maxage=300"})}catch{return Q.html(G)}}),Z}var go6=2500,co6=1e4,mo6=1e4;var kX8=D(()=>{J8();tB();tD1();X$()});function W_0($,Z){return fetch(`${PW({})}${$}`,Z)}async function do6($,Z){let Q=await G_0($,{lang:Z});if(!Q)return{status:"not_found",report:null};return Q.scanned_at?{status:"ready",report:Q}:{status:"empty",report:null}}function po6($){let Z=typeof $==="object"&&$!==null?$:{},Q=typeof Z.domain==="string"?Z.domain.trim():"",Y=typeof Z.distinctId==="string"&&Z.distinctId.trim()&&Z.distinctId.length<=200?Z.distinctId.trim():void 0;return{domain:Q,distinctId:Y}}var io6,LO,SX8=async($,Z)=>{if(!$.get("reportUser"))return $.json({error:"Authentication required"},401);await Z();return},CX8;var _X8=D(()=>{J8();Z3();tB();tD1();io6=new Set(["complete","errored","terminated","unknown"]);LO=new Z1;LO.use("*",async($,Z)=>{let Q=await x8.api.getSession({headers:$.req.raw.headers});$.set("reportUser",Q?.user?.id?{email:Q.user.email}:void 0),await Z(),$.header("Cache-Control","private, no-store"),$.header("Vary","Cookie");return});LO.use("/link-token/*",SX8);LO.use("/suggest",SX8);LO.get("/site/:domain",async($)=>{let Z=$.req.param("domain").trim();if(!Z)return $.json({error:"domain is required"},400);let Q=$.req.query("lang")?.trim()||void 0;try{return $.json(await do6(Z,Q))}catch{return $.json({error:"report read failed"},502)}});LO.post("/run",async($)=>{let Z=$.get("reportUser"),Q;try{Q=await $.req.json()}catch{return $.json({error:"invalid JSON"},400)}let{domain:Y,distinctId:X}=po6(Q);if(!Y)return $.json({error:"domain is required"},400);let J=Z?.email;try{let G=await W_0("/api/v2/diagnostics/run",{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${rw({})}`},body:JSON.stringify({url:Y,...J?{email:J}:{},distinct_id:X})});if(!G.ok)return $.json({error:`run HTTP ${G.status}`},502);let W=await G.json(),K=W.blocked?{state:"blocked"}:W.status==="fresh"?{state:"fresh"}:W.mode==="sync"?{state:"sync"}:{state:"running",id:W.id??null};return $.json(K)}catch{return $.json({error:"run failed"},502)}});LO.get("/status",async($)=>{let Z=$.req.query("id");if(!Z)return $.json({error:"id is required"},400);try{let Q=await W_0(`/api/v2/diagnostics/status?id=${encodeURIComponent(Z)}`,{headers:{Authorization:`Bearer ${rw({})}`}});if(!Q.ok)return $.json({error:`status HTTP ${Q.status}`},502);let X=(await Q.json()).status??"unknown",J={done:io6.has(X),status:X};return $.json(J)}catch{return $.json({error:"status failed"},502)}});LO.get("/link-token/:id",async($)=>{let Z=$.req.param("id");try{let Q=await W_0(`/api/v2/public/link-tokens/${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(Q.status===404)return $.json(null);if(!Q.ok)return $.json({error:`link token HTTP ${Q.status}`},502);return $.json(await Q.json())}catch{return $.json({error:"link token resolve failed"},502)}});LO.get("/suggest",async($)=>{let Z=($.req.query("q")??"").trim().slice(0,64);if(Z.length<2)return $.json({suggestions:[]});try{let Q=await W_0(`/api/v2/public/suggest?q=${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(!Q.ok)return $.json({suggestions:[]});let Y=await Q.json();return $.json({suggestions:Array.isArray(Y.suggestions)?Y.suggestions:[]})}catch{return $.json({suggestions:[]})}});CX8=LO});var no6=1048576,oD1;var vX8=D(()=>{J8();QK();X$();dU1();oD1=new Z1;oD1.post("/webhook",x5({maxSize:no6,onError:($)=>$.json({error:"payload too large"},413)}),async($)=>{let Z=E0().stripeWebhookSecret;if(!Z)return $.json({error:"stripe billing not configured"},503);let Q=await $.req.text();if(!L48(Q,$.req.header("stripe-signature"),Z))return $.json({error:"invalid signature"},400);let X=w48(Q);if(!X)return $.json({error:"invalid payload"},400);let J=await j48(X);return console.log("stripe webhook",{eventId:X.id,type:X.type,livemode:X.livemode,...J}),$.json({received:!0})})});import{timingSafeEqual as to6}from"crypto";function so6($,Z,Q){if(!Z?.startsWith("sha256="))return!1;let Y=new Bun.CryptoHasher("sha256",Q).update($).digest("hex"),X=Z.slice(7);if(X.length!==Y.length)return!1;return to6(Buffer.from(X),Buffer.from(Y))}function ao6($,Z){let Q=Z,Y=Q?.repository?.name,X=Q?.repository?.owner?.login;if(typeof Y!=="string"||typeof X!=="string")return[];let J=[];if($==="check_suite"){if(Q.action!=="completed")return[];let G=Q.check_suite?.pull_requests;for(let W of Array.isArray(G)?G:[]){let K=W?.number;if(typeof K==="number")J.push(K)}}else if($==="issue_comment"&&Q.issue?.pull_request){let G=Q.issue.number;if(typeof G==="number")J.push(G)}return[...new Set(J)].map((G)=>({repoOwner:X,repoName:Y,number:G}))}function bX8($){let Z=new Z1;return Z.post("/webhook",x5({maxSize:oo6,onError:(Q)=>Q.json({error:"payload too large"},413)}),async(Q)=>{let Y=process.env.GITHUB_WEBHOOK_SECRET;if(!Y)return Q.json({error:"github webhook not configured"},503);let X=await Q.req.text();if(!so6(X,Q.req.header("x-hub-signature-256"),Y))return Q.json({error:"invalid signature"},400);let J=Q.req.header("x-github-event");if(J!=="push"&&!ro6.has(J??""))return Q.json({ok:!0,ignored:"event"});let G;try{G=JSON.parse(X)}catch{return Q.json({error:"invalid payload"},400)}if(J==="push"){let H=G.ref,F=G.repository?.full_name;if(!H||!F)return Q.json({ok:!0,ignored:"shape"});return x10().then((U)=>U?.markTenantPoolsDirty(`https://github.com/${F}`,H)).catch((U)=>console.warn(`[github-webhook] tenant pool refresh for ${F}@${H} failed: ${U instanceof Error?U.message:String(U)}`)),Q.json({ok:!0})}let W=ao6(J??"",G);if(W.length===0)return Q.json({ok:!0,ignored:"no-pr"});let K=await eo6($,W);return Q.json({ok:!0,refreshed:K})}),Z}async function eo6($,Z){let Q=0;for(let Y of Z){let X=$.taskBoard(),J;try{J=await X.findPrLinks(Y)}catch(G){console.error("[github-webhook] pr link lookup failed:",G);continue}for(let G of J)try{let W=await X.getById(G.taskBoardItemId,G.organizationId),K=W?await $.contextFactory()(G.organizationId,W.assignedBy??W.createdBy):null;if(!K)continue;if(await mb$(K,G.organizationId,G.taskBoardItemId)!==null)Q++}catch(W){console.error(`[github-webhook] pr card refresh failed for ${G.taskBoardItemId}:`,W)}}return Q}var oo6=5242880,ro6;var xX8=D(()=>{J8();QK();yW();v7();ro6=new Set(["check_suite","issue_comment"])});import{DBOS as sD1,SchedulerMode as $r6}from"@dbos-inc/dbos-sdk";async function Qr6(){try{return await Yr6()}catch($){return console.warn(`[sandbox-credential-push] push failed: ${$ instanceof Error?$.message:String($)}`),null}}async function Yr6(){if(!b10())return null;let[{RemoteSandboxProvider:$},{SandboxProviderRouter:Z}]=await Promise.all([Promise.resolve().then(() => (k91(),V91)),Promise.resolve().then(() => (I91(),M91))]),Q=await x10(),Y=Q instanceof Z?Q.providers.kubernetes:Q;if(!(Y instanceof $))return null;let{db:X}=D8(),{sandboxes:J,pools:G}=await Y.list(),W=Date.now(),K=HT$({sandboxes:J,pools:G,records:await FT$(X,J,G),legacyPools:WT0(process.env.STUDIO_SANDBOX_TENANT_POOLS),now:W}),{batches:H,failed:F}=await UT$(K,VH0(X,new UX(E0().encryptionKey)),{now:W,orgFsLifetimeMs:FT0}),U=0,N=0,B=0;for(let O of H)try{let L=await Y.pushCredentials(O);U+=L.stored,N+=L.kept}catch(L){B++,console.warn(`[sandbox-credential-push] a push batch failed: ${L instanceof Error?L.message:String(L)}`)}return{sandboxes:J.length,pushed:U,kept:N,refused:K.refused,failed:F+B}}async function Xr6($,Z){let Q=await sD1.runStep(Qr6,{name:"pushSandboxCredentials"});if(Q&&(Q.refused>0||Q.failed>0))console.warn(`[sandbox-credential-push] ${Q.sandboxes} sandboxes: pushed ${Q.pushed}, kept ${Q.kept}, refused ${Q.refused}, failed ${Q.failed}`)}function fX8(){if(rD1)return;if(!E0().agentSandboxEnabled||!b10())return;rD1=sD1.registerWorkflow(Xr6,{name:"sandboxCredentialPushWorkflow"}),sD1.registerScheduled(rD1,{name:"sandboxCredentialPushWorkflow",crontab:Zr6,mode:$r6.ExactlyOncePerIntervalWhenActive})}var Zr6="1-59/10 * * * *",rD1=null;var yX8=D(()=>{SG();BL();w41();UT0();KT0();yW();X$()});function gX8($){let Z=new YO($.db,new UX($.encryptionKey)),Q=new Z1;return Q.get("/attachments/:token",async(Y)=>{let X=Xv$(Y.req.param("token"));if(!X)return Y.json({error:"Invalid or expired link"},404);let J=await Z.getByOrg(X.organizationId);if(!J)return Y.json({error:"Jira is not connected"},404);let W=await new lQ(J.siteUrl,J.email,J.apiToken).downloadAttachment(X.attachmentId);if(!W.ok||!W.body)return Y.json({error:"Jira refused the download"},502);let K=new Headers;for(let H of["content-type","content-length","content-disposition"]){let F=W.headers.get(H);if(F)K.set(H,F)}return K.set("cache-control","no-store"),new Response(W.body,{status:200,headers:K})}),Q}var hX8=D(()=>{J8();BL();m71();FE();t40()});import{DBOS as Yz,SchedulerMode as Jr6}from"@dbos-inc/dbos-sdk";function uX8($){eD1=$}function ZO1(){if(!eD1)throw Error("[jira-trigger] runtime not initialized \u2014 setJiraTriggerSweepRuntime() must run before the workflow fires");return eD1}function QO1(){let $=ZO1();return new YO($.db,new UX($.encryptionKey))}async function Fr6($){try{let Z=await QO1().getById($);if(!Z?.enabled||!Z.boardId)return{integrationId:$,started:0};let Q=await VH(ZO1().db,Z.organizationId);if(!Q)return{integrationId:$,started:0};if((await Q.storage.jiraIntegrations.listAutomations(Z.organizationId)).length===0)return{integrationId:$,started:0};let X=new lQ(Z.siteUrl,Z.email,Z.apiToken),G=`(${await X.getBoardScopeJql(Z.boardId)}) AND status CHANGED AFTER "-${Wr6}m"`,W=0,K;for(let H=0;H<Kr6;H++){let F=await X.searchIssues({jql:G,nextPageToken:K});for(let U of F.issues)if(await eH1(Q,Z,{issueId:U.id,now:Date.now()})==="started")W++;if(K=F.nextPageToken??void 0,!K)break}return{integrationId:$,started:W}}catch(Z){return{integrationId:$,started:0,error:Z instanceof Error?Z.message:String(Z)}}}async function Ur6($,Z){let Q=await Yz.runStep(()=>QO1().listEnabledIds(),{name:"loadJiraIntegrations"});if(Q.length===0)return;let Y=await Promise.all(Q.map((X)=>Yz.runStep(()=>Fr6(X),{name:`sweepJira:${X}`})));for(let X of Y)if(X.error)console.warn(`[jira-trigger] integration ${X.integrationId} failed: ${X.error}`);else if(X.started>0)console.log(`[jira-trigger] integration ${X.integrationId} started ${X.started} run(s) the webhook missed`)}async function Nr6($,Z){try{let Q=await QO1().getById($);if(!Q?.enabled)return"disabled";let Y=await VH(ZO1().db,Q.organizationId);if(!Y)return"disabled";let X=await eH1(Y,Q,{issueId:Z.issueId,changelogId:Z.changelogId});if(X==="started")console.log(`[jira-trigger] started a run for ${Z.issueKey} after it settled`);else if(X==="returned")console.log(`[jira-trigger] ${Z.issueKey} went back where it was before settling in "${Z.toStatus}"; no run`);return X}catch(Q){return console.error(`[jira-trigger] settling ${Z.issueKey} failed`,Q instanceof Error?Q.message:Q),"error"}}async function Br6($,Z){await Yz.sleep(yk0()+Hr6),await Yz.runStep(()=>Nr6($,Z),{name:"settleJiraMove"})}async function lX8($,Z){if(!$O1)throw Error("[jira-trigger] settle workflow is not registered");await Yz.startWorkflow($O1,{workflowID:`jira-settle:${$}:${Z.changelogId}`})($,Z)}function cX8(){if(aD1)return;$O1=Yz.registerWorkflow(Br6,{name:"jiraSettleWorkflow"}),aD1=Yz.registerWorkflow(Ur6,{name:"jiraTriggerSweepWorkflow"}),Yz.registerScheduled(aD1,{name:"jiraTriggerSweepWorkflow",crontab:Gr6,mode:Jr6.ExactlyOncePerIntervalWhenActive})}var Gr6="7-59/10 * * * *",Wr6=35,Kr6=5,Hr6=5000,eD1=null,$O1=null,aD1=null;var YO1=D(()=>{BL();t40();kd();FE();sH1();gk0()});function mX8($){let Z=new YO($.db,new UX($.encryptionKey));async function Q(X,J){let G=ue$(J);if(!G)return;let W=await Z.getByWebhookSecret(X);if(!W?.enabled)return;if((await Z.listAutomations(W.organizationId)).length===0)return;await lX8(W.id,G)}let Y=new Z1;return Y.post("/webhook/:secret",x5({maxSize:Dr6}),async(X)=>{let J=X.req.param("secret");if(!await Z.getByWebhookSecret(J))return X.json({error:"Unknown webhook"},404);let W;try{W=await X.req.json()}catch{return X.json({error:"Body must be JSON"},400)}return Q(J,W).catch((K)=>{console.error("[jira-webhook] trigger failed",K)}),X.body(null,202)}),Y}var Dr6=1048576;var dX8=D(()=>{J8();QK();BL();YO1();gk0();t40()});function iX8($,Z){if(Z.startsWith("text/html")||Z.startsWith("image/svg"))$.set("Content-Security-Policy","sandbox allow-scripts allow-modals allow-same-origin")}var pX8,Or6,Lr6,nX8;var tX8=D(()=>{J8();OJ();yd();oc();pX8=new Z1,Or6=["range","if-none-match","if-modified-since"],Lr6=["content-type","content-length","content-range","accept-ranges","etag","last-modified"];pX8.get("/:org/files/*",async($)=>{let Z=$.get("studioContext"),Q=Z.organization?.id;if(!Z.auth?.user?.id){if(Wp($))return $.redirect(`/login?next=${encodeURIComponent($.req.path)}`,302);throw new q1(401,{message:"Authentication required"})}if(!Q)throw new q1(401,{message:"Organization context required"});let Y=$.req.path.replace(/^.*\/files\//,"");if(!Y)throw new q1(400,{message:"Missing file key"});let X=await J80(Y,Z);if(!X)throw new q1(503,{message:"Object storage not configured"});if(X.startsWith("data:")&&RW()){let K=X.match(/^data:([^;]+);base64,(.+)$/s);if(!K)throw new q1(500,{message:"Invalid data URL from storage"});let[,H,F]=K,U=Buffer.from(F,"base64"),N=new Headers({"Content-Type":H,"Cache-Control":"private, max-age=86400"});return iX8(N,H),new Response(U,{status:200,headers:N})}let J=new Headers;for(let K of Or6){let H=$.req.header(K);if(H)J.set(K,H)}let G=await fetch(X,{headers:J});if(G.status===403||G.status===404)throw new q1(404,{message:"File not found"});if(!G.ok&&G.status!==304&&G.status!==416)throw console.error(`[files] upstream storage error ${G.status} for key:`,Y),new q1(502,{message:"Upstream storage error"});let W=new Headers;for(let K of Lr6){let H=G.headers.get(K);if(H)W.set(K,H)}return W.set("Cache-Control","private, max-age=86400"),iX8(W,W.get("content-type")??""),new Response(G.body,{status:G.status,headers:W})});nX8=pX8});var n60=b((ay)=>{var wr6=ay&&ay.__createBinding||(Object.create?function($,Z,Q,Y){if(Y===void 0)Y=Q;var X=Object.getOwnPropertyDescriptor(Z,Q);if(!X||("get"in X?!Z.__esModule:X.writable||X.configurable))X={enumerable:!0,get:function(){return Z[Q]}};Object.defineProperty($,Y,X)}:function($,Z,Q,Y){if(Y===void 0)Y=Q;$[Y]=Z[Q]}),jr6=ay&&ay.__exportStar||function($,Z){for(var Q in $)if(Q!=="default"&&!Object.prototype.hasOwnProperty.call(Z,Q))wr6(Z,$,Q)};Object.defineProperty(ay,"__esModule",{value:!0});jr6(OG(),ay)});var sX8=b((oX8)=>{Object.defineProperty(oX8,"__esModule",{value:!0});oX8.version=void 0;oX8.version="3.4.0"});var $J8=b((PN)=>{var Er6=PN&&PN.__importDefault||function($){return $&&$.__esModule?$:{default:$}};Object.defineProperty(PN,"__esModule",{value:!0});PN.NodeTransport=PN.VERSION=void 0;PN.nodeResolveHost=qr6;var s5=n60(),zr6=M0("net"),XO1=M0("tls"),Pr6=M0("path"),aX8=M0("fs"),Ar6=Er6(M0("dns")),Tr6=sX8();PN.VERSION=Tr6.version;var Rr6="nats.js";class eX8{socket;version;lang;yields=[];signal=(0,s5.deferred)();closedNotification=(0,s5.deferred)();options;connected=!1;tlsName="";done=!1;closeError;constructor(){this.lang=Rr6,this.version=PN.VERSION}async connect($,Z){this.tlsName=$.tlsName,this.options=Z;let{tls:Q}=this.options,{handshakeFirst:Y}=Q||{};try{if(Y===!0)this.socket=await this.tlsFirst($);else this.socket=await this.dial($);if(this.done)this.socket?.destroy();let X=await this.peekInfo();(0,s5.checkOptions)(X,Z);let{tls_required:J,tls_available:G}=X,W=G===!0&&Z.tls!==null;if(!Y&&(J||W))this.socket=await this.startTLS();if(this.done)this.socket?.destroy();if(J&&this.socket.encrypted!==!0)throw s5.errors.InvalidArgumentError.format("tls","is not available on this server");return this.connected=!0,this.setupHandlers(),this.signal.resolve(),Promise.resolve()}catch(X){let J=X;if(!J)J=new s5.errors.ConnectionError("error connecting - node provided an undefined error");let{code:G}=J,W=G==="ECONNREFUSED"?new s5.errors.ConnectionError("connection refused",{cause:J}):J;throw this.socket?.destroy(),W}}dial($){let Z=(0,s5.deferred)(),Q,Y=(0,zr6.createConnection)($.port,$.hostname,()=>{Z.resolve(Y),Y.removeAllListeners()});return Y.on("error",(X)=>{Q=X}),Y.on("close",()=>{Y.removeAllListeners(),Z.reject(Q)}),Y.setNoDelay(!0),Z}get isClosed(){return this.done}close($){return this._closed($,!1)}peekInfo(){let $=(0,s5.deferred)(),Z;return this.socket.on("data",(Q)=>{this.yields.push(Q);let Y=s5.DataBuffer.concat(...this.yields),X=(0,s5.extractProtocolMessage)(Y);if(X!=="")try{let J=s5.INFO.exec(X);if(!J)throw Error("unexpected response from server");let G=JSON.parse(J[1]);$.resolve(G)}catch(J){$.reject(J)}finally{this.socket.removeAllListeners()}}),this.socket.on("error",(Q)=>{Z=Q}),this.socket.on("close",()=>{this.socket.removeAllListeners(),$.reject(Z)}),$}loadFile($){if(!$)return Promise.resolve();let Z=(0,s5.deferred)();try{if($=(0,Pr6.resolve)($),!(0,aX8.existsSync)($))Z.reject(Error(`${$} doesn't exist`));(0,aX8.readFile)($,(Q,Y)=>{if(Q)return Z.reject(Q);Z.resolve(Y)})}catch(Q){Z.reject(Q)}return Z}async loadClientCerts(){let $={},{certFile:Z,cert:Q,caFile:Y,ca:X,keyFile:J,key:G}=this.options.tls;try{if(Z){let W=await this.loadFile(Z);if(W)$.cert=W}else if(Q)$.cert=Q;if(J){let W=await this.loadFile(J);if(W)$.key=W}else if(G)$.key=G;if(Y){let W=await this.loadFile(Y);if(W)$.ca=[W]}else if(X)$.ca=X;return Promise.resolve($)}catch(W){return Promise.reject(W)}}async tlsFirst($){let Z,Q={servername:this.tlsName,rejectUnauthorized:!0};if(this.socket)Q.socket=this.socket;if(typeof this.options.tls==="object")try{let X=await this.loadClientCerts()||{};Q=(0,s5.extend)(Q,this.options.tls,X)}catch(X){return Promise.reject(new s5.errors.ConnectionError(X.message,{cause:X}))}let Y=(0,s5.deferred)();try{let X=(0,XO1.connect)($.port,$.hostname,Q,()=>{X.removeAllListeners(),Y.resolve(X)});X.on("error",(J)=>{Z=J}),X.on("secureConnect",()=>{if(Q.rejectUnauthorized===!1)return;if(!X.authorized)throw X.authorizationError}),X.on("close",()=>{Y.reject(Z),X.removeAllListeners()}),X.setNoDelay(!0)}catch(X){Y.reject(new s5.errors.ConnectionError(X.message,{cause:X}))}return Y}async startTLS(){let $,Z={socket:this.socket,servername:this.tlsName,rejectUnauthorized:!0};if(typeof this.options.tls==="object")try{let Y=await this.loadClientCerts()||{};Z=(0,s5.extend)(Z,this.options.tls,Y)}catch(Y){return Promise.reject(new s5.errors.ConnectionError(Y.message,{cause:Y}))}let Q=(0,s5.deferred)();try{let Y=(0,XO1.connect)(Z,()=>{Y.removeAllListeners(),Q.resolve(Y)});Y.on("error",(X)=>{$=X}),Y.on("secureConnect",()=>{if(Z.rejectUnauthorized===!1)return;if(!Y.authorized)throw Y.authorizationError}),Y.on("close",()=>{Q.reject($),Y.removeAllListeners()})}catch(Y){Q.reject(new s5.errors.ConnectionError(Y.message,{cause:Y}))}return Q}setupHandlers(){let $;this.socket.on("data",(Z)=>{return this.yields.push(Z),this.signal.resolve()}),this.socket.on("error",(Z)=>{$=Z}),this.socket.on("end",()=>{if(this.socket?.destroyed)return;this.socket?.write(new Uint8Array(0),()=>{this.socket?.end()})}),this.socket.on("close",()=>{this._closed($,!1)})}[Symbol.asyncIterator](){return this.iterate()}async*iterate(){while(!0){if(this.yields.length===0)await this.signal;let $=this.yields;this.yields=[];for(let Z=0;Z<$.length;Z++){if(this.options.debug)console.info(`> ${(0,s5.render)($[Z])}`);yield $[Z]}if(this.done)break;else if(this.yields.length===0)$.length=0,this.yields=$,this.signal=(0,s5.deferred)()}}discard(){if(this.done=!0,this.socket)try{this.socket.removeAllListeners(),this.socket.destroy()}catch{}}disconnect(){this._closed(void 0,!0).then().catch()}isEncrypted(){return this.socket instanceof XO1.TLSSocket}_send($){if(this.isClosed||this.socket===void 0)return Promise.resolve();if(this.options.debug)console.info(`< ${(0,s5.render)($)}`);let Z=(0,s5.deferred)();try{this.socket.write($,(Q)=>{if(Q){if(this.options.debug)console.error(`!!! ${(0,s5.render)($)}: ${Q}`);return Z.reject(Q)}return Z.resolve()})}catch(Q){if(this.options.debug)console.error(`!!! ${(0,s5.render)($)}: ${Q}`);Z.reject(Q)}return Z}send($){this._send($).catch((Q)=>{})}async _closed($,Z=!0){if(!this.connected)return;if(this.done){this.socket?.destroy();return}if(this.closeError=$,!$&&this.socket&&Z)try{await this._send(new TextEncoder().encode(""))}catch(Q){if(this.options.debug)console.log("transport close terminated with an error",Q)}try{if(this.socket)this.socket.removeAllListeners(),this.socket?.destroy(),this.socket=void 0}catch(Q){console.log(Q)}this.done=!0,this.closedNotification.resolve(this.closeError)}closed(){return this.closedNotification}}PN.NodeTransport=eX8;function qr6($){let Z=(0,s5.deferred)();return Ar6.default.lookup($,{all:!0},(Q,Y)=>{if(Q){Z.reject(Q);return}let X=[];for(let J of Y)X.push(J.address);if(X.length===0)X.push($);Z.resolve(X)}),Z}});var JJ8=b((XJ8)=>{Object.defineProperty(XJ8,"__esModule",{value:!0});XJ8.connect=Mr6;var ZJ8=$J8(),QJ8=n60(),YJ8=n60();function Mr6($={}){if((0,YJ8.hasWsProtocol)($))return Promise.reject(YJ8.errors.InvalidArgumentError.format("servers","node client doesn't support websockets, use the 'wsconnect' function instead"));return(0,QJ8.setTransportFactory)({factory:()=>{return new ZJ8.NodeTransport},dnsResolveFn:ZJ8.nodeResolveHost}),QJ8.NatsConnectionImpl.connect($)}});var GJ8=b((wO)=>{var Vr6=wO&&wO.__createBinding||(Object.create?function($,Z,Q,Y){if(Y===void 0)Y=Q;var X=Object.getOwnPropertyDescriptor(Z,Q);if(!X||("get"in X?!Z.__esModule:X.writable||X.configurable))X={enumerable:!0,get:function(){return Z[Q]}};Object.defineProperty($,Y,X)}:function($,Z,Q,Y){if(Y===void 0)Y=Q;$[Y]=Z[Q]}),kr6=wO&&wO.__exportStar||function($,Z){for(var Q in $)if(Q!=="default"&&!Object.prototype.hasOwnProperty.call(Z,Q))Vr6(Z,$,Q)};Object.defineProperty(wO,"__esModule",{value:!0});wO.connect=void 0;var Sr6=JJ8();Object.defineProperty(wO,"connect",{enumerable:!0,get:function(){return Sr6.connect}});kr6(n60(),wO)});function FJ8($){let Z=$?.connectFn??br6,Q=null,Y=null,X=!1,J=!1,G=!1,W=[];function K(){return Q!==null&&!Q.isClosed()&&!Q.isDraining()&&!G}function H(){console.log(`[NatsProvider] fireReady: ${W.length} callbacks`);for(let N of W)try{N()}catch{}}function F(N){(async()=>{for await(let B of N.status())if(B.type==="disconnect")console.log("[NatsProvider] Disconnected"),G=!0;else if(B.type==="reconnect")console.log("[NatsProvider] Reconnected, re-firing ready callbacks"),G=!1,Y=null,H()})().catch(()=>{})}async function U(N,B){let O=0;while(!J)try{Q=await Z({servers:N,timeout:vr6,reconnect:!0,maxReconnectAttempts:-1,...B?{authenticator:B}:{}}),console.log(`[NatsProvider] Connected to ${Q.getServer()} after ${O} attempt(s)`),Y=null,G=!1,F(Q),H();return}catch{O++;let L=B7(_r6,Cr6,O-1,2,0.5);await O$(L)}}return{init(N,B){if(X)return;X=!0,J=!1;let O=B?.creds?WJ8.credsAuthenticator(new TextEncoder().encode(B.creds)):void 0;U(N,O).catch(()=>{})},isConnected(){return K()},getConnection(){return K()?Q:null},getJetStream(){if(!K())return null;if(!Y)Y=HJ8.jetstream(Q);return Y},onReady(N){if(W.push(N),K())try{N()}catch{}},async drain(){if(J=!0,X=!1,Y=null,G=!1,Q){let N=Q;Q=null,await N.drain().catch(()=>{})}}}}function br6($){return KJ8.connect($)}var WJ8,KJ8,HJ8,Cr6=100,_r6=3000,vr6=3000;var UJ8=D(()=>{a$();WJ8=C(Az(),1),KJ8=C(GJ8(),1),HJ8=C(LK(),1)});function K_0($){let Z=$?.ttlMs??60000,Q=$?.maxSize??1e4,Y=$?.updateRecencyOnGet??!1,X=new Map;function J(){if(X.size<=Q)return;let G=Date.now();for(let[W,K]of X)if(K.expiresAt<=G)X.delete(W);while(X.size>Q){let W=X.keys().next().value;if(W===void 0)break;X.delete(W)}}return{get(G){let W=X.get(G);if(!W)return;if(W.expiresAt<=Date.now()){X.delete(G);return}if(Y)X.delete(G),X.set(G,W);return W.value},set(G,W){X.delete(G),X.set(G,{value:W,expiresAt:Date.now()+Z}),J()},delete(G){X.delete(G)},clear(){X.clear()},size(){return X.size}}}function H_0($,Z){return`${$}.${Z}`}class JO1{cache;constructor($){this.cache=K_0({ttlMs:$?.ttlMs??xr6,maxSize:$?.maxSize??fr6})}async get($,Z){return this.cache.get(H_0($,Z))??null}async set($,Z,Q){this.cache.set(H_0($,Z),Q)}async invalidate($,Z){this.cache.delete(H_0($,Z)),this.cache.delete(H_0($,`${Z}:decisions`))}teardown(){this.cache.clear()}}var xr6=600000,fr6=5000;var NJ8=()=>{};function F_0($,Z){return`${$}:${Z}`}function GO1($){let Z=K_0({ttlMs:$?.ttlMs??yr6,maxSize:$?.maxSize??gr6}),Q=$?.getConnection,Y=crypto.randomUUID(),X=new TextEncoder,J=new TextDecoder,G=null;function W(K,H){let F=Q?.();if(!F)return;try{F.publish(BJ8,X.encode(JSON.stringify({organizationId:K,keyId:H,originId:Y})))}catch(U){console.warn("[ProviderKeyCache] Publish failed (non-critical):",U)}}return{get(K,H){return Z.get(F_0(K,H))},set(K,H,F){Z.set(F_0(K,H),F)},invalidate(K,H){Z.delete(F_0(K,H)),W(K,H)},start(){if(G)return;let K=Q?.();if(!K)return;G=K.subscribe(BJ8),(async()=>{for await(let H of G)try{let F=JSON.parse(J.decode(H.data));if(F.originId===Y)continue;Z.delete(F_0(F.organizationId,F.keyId))}catch{}})().catch(console.error)},teardown(){G?.unsubscribe(),G=null,Z.clear()}}}var BJ8="studio.ai-provider-keys.invalidate",yr6=30000,gr6=5000;var DJ8=()=>{};class WO1{options;subscription=null;onCancel=null;encoder=new TextEncoder;originId=crypto.randomUUID();constructor($){this.options=$}async start($){if($)this.onCancel=$;if(this.subscription)return;if(!this.onCancel)return;let Z=this.options.getConnection();if(!Z)return;let Q=new TextDecoder,Y=Z.subscribe("studio.decopilot.cancel");this.subscription=Y,(async()=>{for await(let X of Y)try{let J=JSON.parse(Q.decode(X.data));if(J.originId===this.originId)continue;this.onCancel?.(J.taskId)}catch{}})().catch(console.error)}broadcast($){if(/[.*>\s]/.test($)){console.warn("[NatsCancelBroadcast] Invalid threadId, skipping broadcast");return}this.onCancel?.($);try{let Z=this.options.getConnection();if(!Z)return;let Q=this.encoder.encode(JSON.stringify({taskId:$,originId:this.originId}));Z.publish("studio.decopilot.cancel",Q)}catch(Z){console.warn("[NatsCancelBroadcast] Publish failed (non-critical):",Z)}}async stop(){this.subscription?.unsubscribe(),this.subscription=null,this.onCancel=null}}var OJ8=($)=>{let Z;return()=>Z??=$()},KO1,HO1;var LJ8=D(()=>{k6();KO1=OJ8(()=>e1.createHistogram("decopilot.stream.encode_ms",{description:"Per-chunk JSON.stringify+encode time for decopilot stream",unit:"ms"})),HO1=OJ8(()=>e1.createCounter("decopilot.stream.published_chunks",{description:"Logical decopilot stream chunks published to JetStream",unit:"{chunks}"}))});function ir6($=EJ8){return{name:tU,subjects:[`${oY1}.>`],storage:nH.StorageType.File,max_age:lr6,max_bytes:mr6,max_msgs_per_subject:dr6,discard:nH.DiscardPolicy.Old,retention:nH.RetentionPolicy.Limits,duplicate_window:cr6,num_replicas:$}}class zJ8{chunks=0;encodeMs=0;maxMs=0;bytes=0;windowStart=performance.now();constructor(){setInterval(()=>this.flush(),1e4).unref?.()}record($,Z){if(this.chunks++,this.encodeMs+=$,$>this.maxMs)this.maxMs=$;this.bytes+=Z}flush(){let $=performance.now(),Z=$-this.windowStart;if(this.chunks>0&&Z>0)console.warn(JSON.stringify({msg:"stream-encode-trace",windowMs:Math.round(Z),chunks:this.chunks,encodeMs:Math.round(this.encodeMs),pctOfLoop:+(this.encodeMs/Z*100).toFixed(1),maxChunkMs:+this.maxMs.toFixed(2),mbEncoded:+(this.bytes/1048576).toFixed(2)}));this.chunks=0,this.encodeMs=0,this.maxMs=0,this.bytes=0,this.windowStart=$}}function wJ8($){let Z=jJ8.headers();for(let[Q,Y]of Object.entries($))Z.set(Q,Y);return Z}function or6($,Z){let Q=0;return{publish(Y,X,J,G){Y.publish(X,J,G?{headers:G}:void 0).catch((W)=>{if(Q++,ur6().add(1,{"org.id":Z??"unknown"}),Q===1||Q%100===0)console.warn(`[Decopilot] JetStream publish failed for thread ${$} (${Q} total):`,W)})},get errorCount(){return Q}}}function rr6($,Z){return $.info?.cluster?Z:1}function sr6($){if(!($ instanceof Error))return!1;if(/non-clustered/i.test($.message))return!0;return/replicas?\b/i.test($.message)&&/not supported|can ?not|exceed|insufficient|greater than/i.test($.message)}class FO1{options;js=null;jsm=null;constructor($){this.options=$}async init(){let $=this.options.getConnection();if(!$){console.log("[Decopilot] StreamBuffer.init skipped: NATS not connected yet");return}let Z=async(Y,X)=>{let J=ir6(X);try{await Y.streams.info(tU),await Y.streams.update(tU,J)}catch(G){if(G instanceof Error&&G.message.includes("stream not found"))await Y.streams.add(J),await Y.streams.update(tU,J);else if(G instanceof Error&&/can ?not change.*storage|storage type/i.test(G.message))await Y.streams.delete(tU),await Y.streams.add(J);else throw G}},Q=await E8(async()=>{let Y=this.options.getJetStreamManager?await this.options.getJetStreamManager():await nH.jetstreamManager($),X=rr6($,EJ8);try{await Z(Y,X)}catch(J){if(X<=1||!sr6(J))throw J;console.warn(`[Decopilot] StreamBuffer: NATS rejected num_replicas=${X} (${J.message}); falling back to an unreplicated stream`),await Z(Y,1)}return Y},{maxAttempts:5,minTimeout:250,maxTimeout:4000,jitter:0.5,isRetriable:pd});this.js=this.options.getJetStream(),this.jsm=Q,console.log(`[Decopilot] StreamBuffer.init ${this.js?"ready":"degraded (js=null)"}`)}pump($,Z,Q,Y){let X=this.js;if(!X)return console.warn(`[Decopilot] pump: JetStream client unavailable for thread ${Z}; chunks NOT published to NATS`),Promise.resolve();let J=or6(Z,Y),G=!1,W=()=>{if(G)return;G=!0;let H=Iy$(Z);X.publish(H.subject,H.data).catch(()=>{})};Q.addEventListener("abort",W,{once:!0});let K=(H)=>{let F=performance.now(),U=sY1(H,{runId:Z}),N=performance.now()-F;KO1().record(N),HO1().add(1,{"org.id":Y??"unknown"}),tr6?.record(N,U.reduce((B,O)=>B+O.data.length,0));for(let B of U)J.publish(X,B.subject,B.data,B.headers?wJ8(B.headers):void 0)};return(async()=>{let H=$.getReader(),F=0,U=0,N;try{while(!0){let{done:B,value:O}=await H.read();if(B)break;if(K(O),U++,++F>=64)F=0,await new Promise((L)=>setImmediate(L))}}catch(B){N=B,console.warn(`[Decopilot] stream pump error for thread ${Z}:`,B?.message??B)}finally{if(H.releaseLock(),W(),nr6)console.warn(JSON.stringify({msg:"decopilot-stream-diag",event:"pump-done",taskId:Z,publishedChunks:U,publishErrors:J.errorCount}))}if(N!==void 0)throw N})()}async publishSerialized($,Z){try{return await E8(()=>$.publish(Z.subject,Z.data,{...Z.headers?{headers:wJ8(Z.headers)}:{},...Z.msgId?{msgID:Z.msgId}:{}}),{maxAttempts:6,minTimeout:250,maxTimeout:5000,jitter:0.5,isRetriable:pd}),!0}catch(Q){return console.error(`[Decopilot] publish failed after retries subject=${Z.subject}`,Q),!1}}async publishRawChunk($,Z,Q){let Y=this.js;if(!Y)return!1;let X=performance.now(),J=sY1(Z,{runId:$,dedup:Q});KO1().record(performance.now()-X),HO1().add(1);for(let G of J)if(!await this.publishSerialized(Y,G))return!1;return!0}async publishDone($,Z,Q){let Y=this.js;if(!Y)return!1;let X=My$({runId:$,fenceToken:Z,finalSeq:Q});return await this.publishSerialized(Y,X)}async createTailStream($,Z,Q){let Y=this.js;if(!Y)return console.warn(`[Decopilot] createTailStream: JetStream client unavailable for thread ${$}; no live tail`),null;let X=Q?.deliverPolicy==="new"?nH.DeliverPolicy.New:nH.DeliverPolicy.All,J=Q?.closeOnDone??!1,G=jE($),W;try{W=await E8(async()=>{return(await Y.consumers.get(tU,{filter_subjects:G,deliver_policy:X})).consume()},{maxAttempts:6,minTimeout:250,maxTimeout:5000,jitter:0.5,isRetriable:pd})}catch(L){return console.warn("[Decopilot] JetStream tail unavailable (non-critical):",L?.message??L),null}let F=JM0({messages:async function*(){try{for await(let L of W)yield{subject:L.subject,data:L.data,headers:L.headers}}finally{W.stop()}}(),onCancel:()=>W.stop()}).pipeThrough(ZM0()).pipeThrough(QM0()).getReader(),U=!1,N=()=>{if(U)return;U=!0;try{F.releaseLock()}catch{}},B=!1,O=()=>{if(B)return;B=!0,W.stop(),F.cancel().catch(()=>{}),N()};return Z?.addEventListener("abort",O,{once:!0}),new ReadableStream({async pull(L){for(;;){let{done:w,value:j}=await F.read();if(w){O(),L.close();return}let E=j;if(E.kind==="done"){if(J){O(),L.close();return}continue}L.enqueue(E.chunk);return}},cancel(){O()}})}purge($){if(!this.jsm)return;this.jsm.streams.purge(tU,{filter:jE($)}).catch(()=>{})}teardown(){this.js=null,this.jsm=null}}var nH,jJ8,hr6=($)=>{let Z;return()=>Z??=$()},ur6,lr6=86400000000000,cr6=120000000000,mr6=4294967296,EJ8,dr6=500000,pr6,nr6,tr6;var PJ8=D(()=>{a$();aY1();GM0();YM0();k6();LJ8();nH=C(LK(),1),jJ8=C(Az(),1),ur6=hr6(()=>e1.createCounter("decopilot.stream.publish_errors",{description:"Number of JetStream publish failures for decopilot stream chunks",unit:"{errors}"})),EJ8=Math.max(1,Number(process.env.DECOPILOT_STREAM_REPLICAS??3)||3);pr6=process.env.STREAM_ENCODE_TRACE==="1",nr6=process.env.DECOPILOT_STREAM_TRACE==="1";tr6=pr6?new zJ8:null});function U_0($,Z,Q,Y){if(!Y)return!1;return $.emit(Z,DF(Q,Y.status,{title:Y.title??void 0,virtualMcpId:Y.virtual_mcp_id??void 0,createdBy:Y.created_by??void 0,triggerId:Y.trigger_id??null,branch:Y.branch??null,harnessId:Y.harness_id??void 0,createdAt:Y.created_at,updatedAt:Y.updated_at})),!0}var AJ8=D(()=>{p8()});class UO1{storage;options;timer=null;constructor($,Z={}){this.storage=$;this.options=Z}start(){if(this.timer)return;let $=this.options.intervalMs??300000;this.timer=setInterval(()=>{this.runOnce()},$)}async runOnce(){let $=this.options.staleAfterMs??3600000;try{let Z=await this.storage.sweepAbandoned($);if(Z>0)console.log(`[async-research-sweeper] marked ${Z} stale jobs as abandoned`);return Z}catch(Z){return console.error("[async-research-sweeper] sweep failed",Z),0}}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}function ar6($,Z,Q={}){let Y=$.startsWith("thread:")?RH($,Q):$;return[...new Set([Z,Y].filter((X)=>!!X))]}async function NO1($,Z){let Q=Z.organizationId;try{let Y=await $.storage.taskBoard.linkedThreadIds(Z.id,Q);for(let X of Y){let J=await xU($,X);if(!J?.owner||!J?.name)continue;let G=await $.storage.threads.get(X),W=await tm($,{threadId:X,runBranch:G?.branch}),K=await c00($,Q,B41(J)).catch(()=>null);if(!K){console.warn(`[task-board] no credential for ${J.owner}/${J.name} \u2014 `+`cannot look up ${Z.id}'s change request by branch`);continue}let H=ar6(W,await qT0($,X),{flat:Bf(K.repo.provider)});for(let F of H){let U=await K.readForBranch(F).catch(()=>null);if(!U)continue;return await $.storage.taskBoard.linkPr({taskBoardItemId:Z.id,organizationId:Q,url:U.url,prNumber:U.number,repo:K.repo}),await $.storage.taskBoard.openReviewCycleIfInProgress(Z.id,Q),await O3(Q).catch(()=>{}),console.log(`[task-board] ${Z.id}: linked ${U.url} found on branch ${F}`),!0}}}catch(Y){console.error("[task-board] PR lookup by branch failed",Y)}return!1}var TJ8=D(()=>{Q7();hW();v7()});async function RJ8($,Z,Q){let Y=Z.organizationId;if(!uX(Z))return!1;if(!xf(Q))return!1;if(await $.storage.taskBoard.hasHumanRejectedDone(Z.id,Y))return!1;let X=await $.storage.organizationSettings.get(Y),J=zU(X?.flags),G=await $.storage.taskBoard.update(Z.id,Y,{status:J},Z.updatedBy);return await $5($,{taskBoardItemId:Z.id,action:"status_changed",actorId:null,data:{from:Z.status,to:J,reason:"pr_merged"}}),L8(Y,G),console.log(`[task-board-review-sweeper] ${Z.id}: linked PR already merged \u2014 moved to ${J}`),!0}var qJ8=D(()=>{x4();cY();Cd();kH();P9()});function Js6($){return $ instanceof kX}function MJ8($,Z){return Z-$>=Ys6}class BO1{taskBoard;contextFactory;billing;options;timer=null;running=!1;cursor=null;constructor($,Z,Q,Y={}){this.taskBoard=$;this.contextFactory=Z;this.billing=Q;this.options=Y}start(){if(this.timer)return;let $=this.options.intervalMs??er6;this.timer=setInterval(()=>{this.runOnce()},$),this.timer.unref()}async runOnce(){if(this.running)return 0;this.running=!0;let $=0;try{let Z=this.options.batchSize??Zs6,Q=this.options.itemIntervalMs??$s6,Y=new Date(Date.now()-Q),X=await this.taskBoard.listItemsPendingReview(Z,this.cursor,Y),J=X.at(-1);this.cursor=X.length===Z&&J?{updatedAt:J.updatedAt,id:J.id}:null;for(let{id:G,organizationId:W}of X)try{if(await this.reconcileItem(G,W,Y))$++}catch(K){console.error(`[task-board-review-sweeper] ${G} failed`,K)}await this.reapNeverStartedThreads(Z),$+=await this.dispatchDueRetries(Z),await this.reactToUnhandledFailures(Z),$+=await this.settleFinishedRunsWithoutPr(Z,Y)}catch(Z){console.error("[task-board-review-sweeper] sweep failed",Z)}finally{this.running=!1}return $}async reapNeverStartedThreads($){try{let Z=await this.taskBoard.failNeverStartedLinkedThreads($,new Date(Date.now()-y71),XY1);for(let Q of Z)console.warn(`[task-board-review-sweeper] failed never-started thread ${Q.threadId} on ${Q.itemId}`)}catch(Z){console.error("[task-board-review-sweeper] reaping failed",Z)}}async reactToUnhandledFailures($){let Z=await this.taskBoard.listItemsStuckAfterFailure($,new Date(Date.now()-Xs6));for(let{id:Q,organizationId:Y,threadId:X}of Z)try{console.warn(`[task-board-review-sweeper] reacting to an unhandled failure on ${Q}`),await ZY1(this.taskBoard,X,Y),await QY1(this.taskBoard,this.billing,X,Y)}catch(J){console.error(`[task-board-review-sweeper] unhandled-failure reaction for ${Q} failed`,J)}}async settleFinishedRunsWithoutPr($,Z){let Q=0,Y=await this.taskBoard.listItemsFinishedWithoutPr($,Z);for(let{id:X,organizationId:J,finishedAt:G}of Y)try{if(!await this.taskBoard.claimSweep(X,J,Z))continue;let W=await this.taskBoard.getById(X,J);if(!W||W.status!==R$.progress||uX(W)||W.assigneeId!==R8)continue;let K=await this.contextFactory(J,W.assignedBy??W.createdBy);if(!K)continue;if(await NO1(K,W)){if(await this.taskBoard.clearSweepBudget(X,J),await this.reconcileItem(X,J,Z))Q++;continue}if(!MJ8(G.getTime(),Date.now()))continue;let H="the run finished without opening a pull request \u2014 there is "+"nothing for a reviewer to review",F=await this.taskBoard.advanceToReviewIfInProgress(X,J,W.updatedBy);if(!F)continue;await this.taskBoard.recordActivity({taskBoardItemId:X,action:"status_changed",actorId:null,data:{from:R$.progress,to:R$.review,reason:H}}).catch(()=>{}),L8(J,F),await SH(K,F,H)}catch(W){console.error(`[task-board-review-sweeper] settling finished run on ${X} failed`,W)}return Q}async dispatchDueRetries($){let Z=0,Q=await this.taskBoard.listItemsDueForRetry($,new Date);for(let{id:Y,organizationId:X,attempts:J}of Q)try{if(!await this.taskBoard.claimDueRetry(Y,X,new Date))continue;let G=await this.taskBoard.getById(Y,X);if(!G||G.status!==R$.progress||G.assigneeId!==R8)continue;let W=await this.contextFactory(X,G.assignedBy??G.createdBy);if(!W)continue;await CH(W,G,{runClass:"retry"}),Z++,console.warn(`[task-board-review-sweeper] re-dispatched ${Y} after a failure (attempt ${J})`)}catch(G){if(console.error(`[task-board-review-sweeper] retry dispatch for ${Y} failed`,G),Js6(G)){await this.returnToTodo(Y,X,G instanceof Error?G.message:String(G));continue}await this.taskBoard.scheduleRunRetry(Y,X,J,new Date(Date.now()+Qs6)).catch((W)=>console.error(`[task-board-review-sweeper] re-arming ${Y} failed`,W))}return Z}async returnToTodo($,Z,Q){try{let Y=await this.taskBoard.getById($,Z);if(!Y||Y.status!==R$.progress)return;let X=await this.taskBoard.returnToTodoAfterFailure($,Z,Y.updatedBy);if(!X)return;await this.taskBoard.recordActivity({taskBoardItemId:$,action:"status_changed",actorId:null,data:{from:"in_progress",to:"todo",reason:Q}}).catch(()=>{}),L8(Z,X)}catch(Y){console.error(`[task-board-review-sweeper] returning ${$} to todo failed`,Y)}}async handOffReviewWithoutPr($,Z){let Q=await this.taskBoard.listActivity(Z.id,Z.organizationId);if(!MJ8(WD(Q,Z.reviewCycleStartedAt),Date.now()))return;await SH($,Z,"no pull request is linked to this task \u2014 there is nothing for a "+"reviewer to review")}async reconcileItem($,Z,Q){if(!await this.taskBoard.claimSweep($,Z,Q))return!1;let Y=await this.taskBoard.getById($,Z);if(!Y)return!1;if(!uX(Y))return!1;let X=Y.assigneeId===R8,J=await this.taskBoard.listPrs($,Z),G=await this.contextFactory(Z,Y.assignedBy??Y.createdBy);if(!G)return!1;if(J.length===0){if(await NO1(G,Y))J=await this.taskBoard.listPrs($,Z);if(J.length===0){if(X)await this.handOffReviewWithoutPr(G,Y);return!1}}let W=await Promise.all(J.map(async(K)=>({...K,...await bd(Z,K)})));if(W.every((K)=>K.state===null))console.warn(`[task-board-review-sweeper] ${$}: no live PR state from GitHub (${W.length} PR(s)) \u2014 proceeding on unknown`);if(await RJ8(G,Y,W))return!0;if(await Sg$(G,Y))return!0;if(await this.resolveConflictFromSweep(G,Y,W))return!0;if(!X)return!1;if(!sQ1(W))return!1;return await _d(G,Y,{previewMatchesHead:aQ1(W)}),!0}async resolveConflictFromSweep($,Z,Q){let Y=Q.find((X)=>X.state!=="closed"&&X.conflict===!0);if(!Y)return!1;return await DE($,Z.organizationId,Z,{pr:{number:Y.number,url:Y.url},conflict:!0}).catch((X)=>{return console.error("[task-board-review-sweeper] conflict resolve failed",X),!1})}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}var er6=60000,$s6=300000,Zs6=50,Qs6=60000,Ys6=900000,Xs6=120000;var IJ8=D(()=>{x4();wq0();TJ8();pU();L80();kH();qJ8();P9();kW();JY1();v7();c$0();vd()});import{readdir as Gs6,rm as N_0}from"fs/promises";import{join as B_0}from"path";async function D_0($){let Z=new Date;Z.setUTCDate(Z.getUTCDate()-Ws6),Z.setUTCHours(0,0,0,0);let Q=0;try{let Y=await ey($);for(let X of Y)if(/^\d{4}$/.test(X))Q+=await VJ8($,X,Z);else if(!X.startsWith(".")){let J=B_0($,X),G=await ey(J);for(let K of G){if(!/^\d{4}$/.test(K))continue;Q+=await VJ8(J,K,Z)}if((await ey(J)).length===0)await N_0(J,{recursive:!0,force:!0})}}catch(Y){console.warn("monitoring retention cleanup failed:",Y)}return Q}async function VJ8($,Z,Q){let Y=0,X=B_0($,Z),J=await ey(X);for(let W of J){if(!/^\d{2}$/.test(W))continue;let K=B_0(X,W),H=await ey(K);for(let U of H){if(!/^\d{2}$/.test(U))continue;let N=new Date(`${Z}-${W}-${U}T00:00:00Z`);if(isNaN(N.getTime()))continue;if(N<Q){let B=B_0(K,U);await N_0(B,{recursive:!0,force:!0}),Y++}}if((await ey(K)).length===0)await N_0(K,{recursive:!0,force:!0})}if((await ey(X)).length===0)await N_0(X,{recursive:!0,force:!0});return Y}async function ey($){try{return(await Gs6($)).filter((Q)=>!Q.startsWith("."))}catch{return[]}}var Ws6=30;var DO1=()=>{};import{DBOS as OO1,SchedulerMode as Ks6}from"@dbos-inc/dbos-sdk";async function Fs6(){let $=[KK(),Kg(),VN()],Z=0;for(let Q of $)try{Z+=await D_0(Q)}catch(Y){console.error("[monitoring-retention] cleanup failed:",Y)}return console.log(`[monitoring-retention] deleted ${Z} day-dir(s) across ${$.length} signal dir(s)`),{deleted:Z,dirs:$.length}}async function Us6($,Z){await OO1.runStep(()=>Fs6(),{name:"monitoringRetention"})}function SJ8(){if(kJ8)return;kJ8=!0;let $=OO1.registerWorkflow(Us6,{name:"monitoringRetentionWorkflow"});OO1.registerScheduled($,{name:"monitoringRetentionWorkflow",crontab:Hs6,mode:Ks6.ExactlyOncePerIntervalWhenActive})}var Hs6="23 4 * * *",kJ8=!1;var CJ8=D(()=>{v3();DO1()});function _J8($){return async(Z,Q)=>{let Y=await $.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.role","organization.id as orgId","organization.slug as orgSlug","organization.name as orgName"]).where("member.userId","=",Q).where("member.organizationId","=",Z).executeTakeFirst();if(!Y)return console.warn(`[automationContextFactory] User ${Q} not found in org ${Z} \u2014 returning null`),null;let X=await cQ.create();X.auth.user={id:Q,role:Y.role},X.organization={id:Y.orgId,slug:Y.orgSlug,name:Y.orgName};let J=await NA($.db,Z,Y.role);return X.boundAuth=fU1({auth:X.authInstance,headers:new Headers,role:Y.role,permissions:J,userId:Q}),X.access=new aP(Q,void 0,X.boundAuth,Y.role,"self"),BE(X,{id:Y.orgId,slug:Y.orgSlug}),X}}var vJ8=D(()=>{YW();wU()});function Ns6(){return[{name:"Postgres",status:"pending",port:0},{name:"NATS",status:"pending",port:0}]}function Bs6(){return{services:Ns6(),migrationsStatus:"pending",serverUrl:null,logs:[]}}function Os6(){for(let $ of Ds6)$()}function bJ8($){let Z=[...LO1.logs,$];LO1={...LO1,logs:Z.length>500?Z.slice(-500):Z},Os6()}function wO1(){return Ls6}var LO1,Ds6,Ls6=!1;var jO1=D(()=>{LO1=Bs6(),Ds6=new Set});import{EventEmitter as ws6}from"events";var EO1;var xJ8=D(()=>{jO1();EO1=new ws6;EO1.on("request",($)=>{bJ8($)})});function fJ8(){return async($,Z)=>{let Q=Date.now(),Y=$.req.method,X=$.req.path;if(X==="/api/auth/get-session"||X.includes("favicon")){await Z();return}let J="",G=!1;if(X.startsWith("/mcp")&&Y==="POST"){G=!0;try{if($.req.header("Content-Type")?.includes("application/json")){let N=await $.req.raw.clone().json();if(N.method==="tools/call"&&N.params?.name){let B=cp(N.params.name),O=N.params.arguments||{},L=Object.keys(O).map((j)=>cp(j)),w=L.length>0?L.slice(0,3).join(",")+(L.length>3?"\u2026":""):"";J=`${W9.tool}${B}${W9.dim}(${w})${W9.reset}`}else if(N.method)J=`${W9.dim}${cp(N.method)}${W9.reset}`}}catch{}}let W=cp(X);if(X.startsWith("/mcp/conn_")){let F=X.split("/")[2]??"";W=`/mcp/${W9.mcp}${cp(F.slice(0,12))}\u2026${W9.reset}`}else if(X==="/mcp")W=`${W9.mcp}/mcp${W9.reset}`;else if(X==="/mcp/registry")W=`${W9.mcp}/mcp/registry${W9.reset}`;let K=Es6(Y),H=G?"\u25C0":"\u2190";if(!wO1())console.log(`${W9.dim}${H}${W9.reset} ${K}${Y}${W9.reset} ${W}${J?` ${J}`:""}`);try{await Z()}finally{let F=Date.now()-Q,U=$.res.status,N=js6(U),B=F<1000?`${F}ms`:`${(F/1000).toFixed(1)}s`,O=G?"\u25B6":"\u2192";if(!wO1())console.log(`${W9.dim}${O}${W9.reset} ${K}${Y}${W9.reset} ${W}${J?` ${J}`:""} ${N}${U}${W9.reset} ${W9.duration}${B}${W9.reset}`);EO1.emit("request",{method:Y,path:cp(X),status:U,duration:F,timestamp:new Date})}}}var W9,js6=($)=>{if($>=500)return W9.serverError;if($>=400)return W9.clientError;if($>=300)return W9.redirect;return W9.ok},Es6=($)=>{return W9[$]||W9.reset},cp=($)=>{return $.replace(/\r/g,"").replace(/\n/g,"").replace(/\x1b\[[0-9;]*m/g,"").replace(/[\x00-\x1f\x7f-\x9f]/g,"")};var yJ8=D(()=>{jO1();xJ8();W9={reset:"\x1B[0m",dim:"\x1B[2m",bold:"\x1B[1m",GET:"\x1B[36m",POST:"\x1B[33m",PUT:"\x1B[35m",DELETE:"\x1B[31m",ok:"\x1B[32m",redirect:"\x1B[36m",clientError:"\x1B[33m",serverError:"\x1B[31m",mcp:"\x1B[35m",tool:"\x1B[96m",duration:"\x1B[90m"}});import{createHmac as lJ8}from"crypto";import{mkdir as zs6,readdir as Ps6,rm as gJ8,stat as cJ8}from"fs/promises";import{join as PO1,relative as As6}from"path";import{z as Q8}from"zod";function dJ8($){let Z=$.replace(/[^a-zA-Z0-9_-]/g,"_");return PO1(Ts6,Z)}function iJ8($){return $.replace(/^\/+/,"").replace(/\.\./g,"")}function zO1($,Z){let Q=dJ8($),Y=iJ8(Z);return PO1(Q,Y)}function Rs6($,Z,Q,Y){let X=E0().encryptionKey||"dev-secret",J=`${$}:${Z}:${Q}:${Y}`;return lJ8("sha256",X).update(J).digest("hex")}function uJ8($,Z,Q,Y,X){let J=Math.floor(Date.now()/1000)+Y,G=Rs6(Z,Q,J,X),W=new URL(`/api/dev-assets/${Z}/${iJ8(Q)}`,$);return W.searchParams.set("expires",J.toString()),W.searchParams.set("signature",G),W.searchParams.set("method",X),W.toString()}function pJ8($,Z,Q){let Y=`${$}:${Z.getTime()}:${Q}`;return`"${lJ8("md5","etag").update(Y).digest("hex")}"`}async function nJ8($,Z,Q,Y,X){try{let J=await Ps6($,{withFileTypes:!0});for(let G of J){let W=PO1($,G.name),H=As6(Z,W).replace(/\\/g,"/");if(Q&&!H.startsWith(Q))continue;if(G.isDirectory())if(Y){let F=H+"/";if(!Q||F.startsWith(Q)){if(!(Q?H.slice(Q.length):H).includes("/"))X.commonPrefixes.add(F)}}else await nJ8(W,Z,Q,Y,X);else if(G.isFile()){if(Y&&Q){let F=H.slice(Q.length);if(F.includes(Y)){let U=F.indexOf(Y),N=Q+F.slice(0,U+1);X.commonPrefixes.add(N);continue}}try{let F=await cJ8(W);X.objects.push({key:H,size:F.size,lastModified:F.mtime.toISOString(),etag:pJ8(W,F.mtime,F.size)})}catch{}}}}catch{}}function tJ8($,Z){let Y=J0($).id;return[{name:"LIST_OBJECTS",description:"List objects in the local assets directory with pagination support",inputSchema:Q8.object({prefix:Q8.string().optional(),maxKeys:Q8.number().optional().default(1000),continuationToken:Q8.string().optional(),delimiter:Q8.string().optional()}),outputSchema:Q8.object({objects:Q8.array(Q8.object({key:Q8.string(),size:Q8.number(),lastModified:Q8.string(),etag:Q8.string()})),nextContinuationToken:Q8.string().optional(),isTruncated:Q8.boolean(),commonPrefixes:Q8.array(Q8.string()).optional()}),handler:async(X)=>{let J=X,G=J.prefix||"",W=J.maxKeys??1000,K=J.delimiter,H=J.continuationToken,F=dJ8(Y);await zs6(F,{recursive:!0});let U={objects:[],commonPrefixes:new Set};await nJ8(F,F,G,K,U),U.objects.sort((w,j)=>w.key.localeCompare(j.key));let N=0;if(H){if(N=U.objects.findIndex((w)=>w.key>H),N===-1)N=U.objects.length}let B=U.objects.slice(N,N+W),O=N+W<U.objects.length,L=O?B[B.length-1]?.key:void 0;return{objects:B,isTruncated:O,nextContinuationToken:L,commonPrefixes:Array.from(U.commonPrefixes).sort()}}},{name:"GET_OBJECT_METADATA",description:"Get metadata for a file in the local assets directory",inputSchema:Q8.object({key:Q8.string()}),outputSchema:Q8.object({contentType:Q8.string().optional(),contentLength:Q8.number(),lastModified:Q8.string(),etag:Q8.string(),metadata:Q8.record(Q8.string(),Q8.string()).optional()}),handler:async(X)=>{let J=X,G=zO1(Y,J.key),W=await cJ8(G);return{contentType:xN1(J.key),contentLength:W.size,lastModified:W.mtime.toISOString(),etag:pJ8(G,W.mtime,W.size)}}},{name:"GET_PRESIGNED_URL",description:"Generate a presigned URL for downloading a file from local storage",inputSchema:Q8.object({key:Q8.string(),expiresIn:Q8.number().optional()}),outputSchema:Q8.object({url:Q8.string(),expiresIn:Q8.number()}),handler:async(X)=>{let J=X,G=aD(J.expiresIn,hJ8);return{url:uJ8(Z,Y,J.key,G,"GET"),expiresIn:G}}},{name:"PUT_PRESIGNED_URL",description:"Generate a presigned URL for uploading a file to local storage",inputSchema:Q8.object({key:Q8.string(),expiresIn:Q8.number().optional(),contentType:Q8.string().optional()}),outputSchema:Q8.object({url:Q8.string(),expiresIn:Q8.number()}),handler:async(X)=>{let J=X,G=aD(J.expiresIn,hJ8);return{url:uJ8(Z,Y,J.key,G,"PUT"),expiresIn:G}}},{name:"DELETE_OBJECT",description:"Delete a single file from local storage",inputSchema:Q8.object({key:Q8.string()}),outputSchema:Q8.object({success:Q8.boolean(),key:Q8.string()}),handler:async(X)=>{let J=X,G=zO1(Y,J.key);try{return await gJ8(G),{success:!0,key:J.key}}catch{return{success:!1,key:J.key}}}},{name:"DELETE_OBJECTS",description:"Delete multiple files from local storage",inputSchema:Q8.object({keys:Q8.array(Q8.string()).max(1000)}),outputSchema:Q8.object({deleted:Q8.array(Q8.string()),errors:Q8.array(Q8.object({key:Q8.string(),message:Q8.string()}))}),handler:async(X)=>{let J=X,G=[],W=[];return await Promise.all(J.keys.map(async(K)=>{let H=zO1(Y,K);try{await gJ8(H),G.push(K)}catch(F){W.push({key:K,message:F instanceof Error?F.message:"Unknown error"})}})),{deleted:G,errors:W}}}]}async function AO1($,Z,Q){let Y=tJ8(Z,Q),X=new Ww({name:"dev-assets-mcp",version:"1.0.0"},{capabilities:{tools:{}},jsonSchemaValidator:vZ});for(let G of Y){let W="shape"in G.inputSchema?G.inputSchema.shape:Q8.object({}).shape,K=G.outputSchema&&"shape"in G.outputSchema?G.outputSchema.shape:Q8.object({}).shape;X.registerTool(G.name,{description:G.description??"",inputSchema:W,outputSchema:K,annotations:G.annotations,_meta:G._meta},async(H)=>{try{let F=await G.handler(H);return{content:[{type:"text",text:JSON.stringify(F)}],structuredContent:F}}catch(F){return{content:[{type:"text",text:`Error: ${F.message}`}],isError:!0}}})}let J=new z3({enableJsonResponse:$.headers.get("Accept")?.includes("application/json")??!1});return await X.connect(J),nW(X,J,$,"mcp:dev-assets")}async function oJ8($,Z,Q,Y){let J=tJ8(Q,Y).find((G)=>G.name===$);if(!J)return{content:[{type:"text",text:`Tool not found: ${$}`}],isError:!0};try{let G=await J.handler(Z);return{content:[{type:"text",text:JSON.stringify(G)}]}}catch(G){return{content:[{type:"text",text:G instanceof Error?G.message:String(G)}],isError:!0}}}var Ts6="./data/assets",hJ8=3600,mJ8,rJ8;var sJ8=D(()=>{X$();ed();J8();vJ0();ad();NJ();eD();eS0();mJ8=new Z1;mJ8.all("/",async($)=>{let Z=$.get("studioContext"),Q=new URL($.req.url),Y=`${Q.protocol}//${Q.host}`;return AO1($.req.raw,Z,Y)});rJ8=mJ8});var aJ8={};$6(aJ8,{mountDevRoutes:()=>qs6});function qs6($,Z){$.all("/mcp/:connectionId{.*_dev-assets$}",Z,async(Y)=>{let X=Y.get("studioContext"),J=new URL(Y.req.url),G=`${J.protocol}//${J.host}`;return AO1(Y.req.raw,X,G)}),$.all("/mcp/:connectionId{.*_dev-assets$}/call-tool/:toolName",Z,async(Y)=>{let X=Y.get("studioContext"),J=new URL(Y.req.url),G=`${J.protocol}//${J.host}`,W=Y.req.param("toolName");if(!W)return Y.json({error:"Missing tool name"},400);let K=await Y.req.json(),H=await oJ8(W,K,X,G);if(H.isError)return Y.json(H.content,500);return Y.json(H.content)}),$.use("/mcp/dev-assets",Z),$.route("/mcp/dev-assets",rJ8);let Q=new Z1;Q.use("*",iH({mountPath:"/api/dev-assets"})),Q.route("/",aS0({orgFromPath:!1})),$.route("/api/dev-assets",Q)}var eJ8=D(()=>{J8();VN1();eS0();sJ8()});var HG8={};$6(HG8,{watchHandler:()=>KG8,resolveCorsOrigin:()=>GG8,isSsoExemptPath:()=>XG8,isAllowedOAuthRedirectUri:()=>WG8,createApp:()=>xs6});import{readFileSync as Ms6}from"fs";import{PrometheusSerializer as Is6}from"@opentelemetry/exporter-prometheus";import{DBOS as jO}from"@dbos-inc/dbos-sdk";import{oAuthDiscoveryMetadata as Ss6,oAuthProtectedResourceMetadata as Cs6}from"better-auth/plugins";async function Vs6($){let Z=$.connect(),Q;try{Q=await Promise.race([Z,ZG8($G8)])}catch{return Z.then((Y)=>Y.release(!0)).catch(()=>{}),!1}try{return await Promise.race([Q.query("SELECT 1"),ZG8($G8)]),Q.release(),!0}catch{return Q.release(!0),!1}}function ZG8($){return new Promise((Z,Q)=>setTimeout(()=>Q(Error("pg health-check timeout")),$))}function XG8($){return $.startsWith("/api/org-sso/")||/^\/api\/[^/]+\/sso\//.test($)||$.startsWith("/api/auth/")||$.startsWith("/api/tools/management")||$.startsWith("/oauth-proxy/")||/^\/api\/[^/]+\/oauth-proxy\//.test($)||$.startsWith(`${gS0}/`)||$.startsWith(`${_S0}/`)}function JG8($){return $==="local.studio.decocms.com"}function GG8($,{baseUrl:Z,requestOrigin:Q}){let Y;try{Y=new URL($).hostname}catch{return null}if(Y==="localhost"||Y==="127.0.0.1")return $;if(JG8(Y))return $;let X=Z??Q;try{if(new URL(X).origin===$)return $}catch{}return null}function WG8($,Z){return $.origin===new URL(Z).origin||$.hostname==="localhost"||JG8($.hostname)}async function xs6($={}){let Z=$.database??D8(),Q=!1;_5.stop().catch((K0)=>{console.error("[SSEHub] Error stopping previous broadcast (HMR cleanup):",K0)});let Y,X,J,G,W=new JO1,K,H,F,U=null;if($.disableNats)K=GO1(),Y={get:async()=>null,set:async()=>{},invalidate:async()=>{},teardown:()=>{}},X=null,J=null,G=new q80,H={start:async()=>{},broadcast:()=>{},stop:async()=>{}},F={init:async()=>{},pump:(K0)=>{return(async()=>{let H0=K0.getReader();try{while(!0){let{done:R0}=await H0.read();if(R0)break}}catch{}finally{H0.releaseLock()}})()},publishRawChunk:async()=>!1,publishDone:async()=>!1,createTailStream:async()=>null,purge:()=>{},teardown:()=>{}};else{U=FJ8();let K0=E0().natsCredsPath,H0;if(K0)try{H0=Ms6(K0,"utf8")}catch(w8){console.error(`[app] failed to read NATS_CREDS at ${K0}; connecting anonymously`,w8)}U.init(E0().natsUrls,H0?{creds:H0}:void 0);let R0=Y$1()?new u11({getJetStream:()=>U.getJetStream()}):null;R0?.init().catch(()=>{}),Y=R0;let A0=new e91({getJetStream:()=>U.getJetStream()});A0.init().catch(()=>{}),X=A0;let D1=new yf(iQ1,{getJetStream:()=>U.getJetStream()}),x$=new yf(m$0,{getJetStream:()=>U.getJetStream()});D1.init().catch(()=>{}),x$.init().catch(()=>{}),J={reads:D1,cards:x$};let i$=new bJ1({getJetStream:()=>U.getJetStream()});i$.init().catch(()=>{}),G=i$,K=GO1({getConnection:()=>U.getConnection()}),H=new WO1({getConnection:()=>U.getConnection()}),F=new FO1({getConnection:()=>U.getConnection(),getJetStream:()=>U.getJetStream()}),g48(U),U.onReady(()=>{R0?.init().catch((w8)=>{console.error("[McpListCache] Deferred init failed:",w8)}),A0.init().catch((w8)=>{console.error("[SkillCatalogCache] Deferred init failed:",w8)}),D1.init().catch((w8)=>{console.error("[PrReadCache] Deferred init failed:",w8)}),x$.init().catch((w8)=>{console.error("[PrCardCache] Deferred init failed:",w8)}),i$.init().catch((w8)=>{console.error("[ConnectionCircuitStore] Deferred init failed:",w8)}),K.start(),hN$(()=>U.getConnection()),F.init().catch((w8)=>{console.warn("[Decopilot] StreamBuffer init failed (late-join disabled):",w8)})})}if(Xz)await Xz();l11(Y),ZZ1(X),pQ1(J),xJ1(G);let B={storage:new oh(Z.db),sseHub:_5,onThreadFinished:async(K0,H0)=>fd(new D3(Z.db),K0,H0,new kG(Z.db))},O=new XX1(B),L=new i40(Z.db),w=new UO1(L);w.start(),Vg$(H),H.start((K0)=>{dq0(K0),O.execute({type:"CANCEL",taskId:K0}).catch((H0)=>{console.error("[Decopilot] CancelBroadcast execute failed:",H0)})}).catch((K0)=>{console.error("[Decopilot] CancelBroadcast start failed:",K0)}),U?.onReady(()=>{H.start().catch((K0)=>{console.error("[CancelBroadcast] Deferred start failed:",K0)})});let j=()=>U?.getConnection()??null;TN1(j),U?.onReady(()=>TN1(j)),LG1(j),U?.onReady(()=>LG1(j)),F.init().catch((K0)=>{console.warn("[Decopilot] StreamBuffer init failed, attach/late-join disabled:",K0)}),Xz=async()=>{await O.stopAll(),O.dispose(),w.dispose(),H.stop().catch(()=>{}),Z58(),F.teardown(),Y?.teardown(),X?.teardown(),J?.reads.teardown(),J?.cards.teardown(),W.teardown(),K.teardown(),uN$(),G.teardown(),l11(null),ZZ1(null),pQ1(null),xJ1(null)};let E=new Z1;if(E.use("*",CJ1({enabled:(K0)=>Gp(K0,"debug")==="1"})),E.use("*",f_0),E.use("/*",v48({origin:(K0,H0)=>GG8(K0,{baseUrl:E0().baseUrl,requestOrigin:new URL(H0.req.url).origin}),credentials:!0,allowMethods:["GET","POST","PUT","DELETE","OPTIONS"],allowHeaders:["Content-Type","Authorization","mcp-protocol-version"],exposeHeaders:["WWW-Authenticate"]})),E.use("*",async(K0,H0)=>{if(await H0(),K0.req.path.includes("/files/"))return;if(K0.req.path.includes("/fs/")&&K0.req.path.endsWith("/read"))return;K0.header("X-Frame-Options","DENY"),K0.header("Content-Security-Policy","frame-ancestors 'none'")}),!E0().noTui)E.use("*",fJ8());E.use("*",async(K0,H0)=>{if(await H0(),ap(K0.req.path))return;if(K0.res.status>=500){let A0=await K0.res.clone().text();console.error(`[5xx Response] ${K0.req.method} ${K0.req.path} - ${K0.res.status}:`,A0)}}),E.get(aY.HEALTH,(K0)=>{if(Q)return K0.json({status:"shutting_down"},503);return K0.json({status:"ok"})}),E.get(aY.HEALTH_LIVE,(K0)=>{return K0.json({status:"ok"})}),E.get(aY.HEALTH_READY,async(K0)=>{if(Q)return K0.json({status:"shutting_down"},503);let H0={};if(H0.postgres={status:await Vs6(Z.pool)?"up":"down"},U)H0.nats=U.isConnected()?{status:"up"}:{status:"down"};else H0.nats={status:"down"};let R0=H0.postgres.status==="up",A0=R0?200:503;return K0.json({status:R0?"ready":"not_ready",services:H0},A0)}),E.get(aY.METRICS,async(K0)=>{try{let H0=await u_0.collect(),R0=ks6.serialize(H0.resourceMetrics);return K0.text(R0,200,{"Content-Type":"text/plain; version=0.0.4; charset=utf-8"})}catch(H0){return console.error("Failed to collect metrics:",H0),K0.text("# Error collecting metrics",500)}});let z=1800000;E.get(`${aY.DBOS_QUEUE_DEPTH_PREFIX}:queueName`,async(K0)=>{let H0=K0.req.param("queueName");if(!_s6.has(H0))return K0.json({error:`Unknown queue: ${H0}`},404);let[R0,A0]=await Promise.all([jO.listQueuedWorkflows({queueName:H0,status:"ENQUEUED",loadInput:!1,loadOutput:!1}),jO.listQueuedWorkflows({queueName:H0,status:"PENDING",loadInput:!1,loadOutput:!1,dequeuedAfter:new Date(Date.now()-z).toISOString()})]);return K0.json({queue_length:R0.length,in_flight:A0.length})}),E.route("/api/config",EX8),E.route("/api/_reports",CX8),E.route("/api/_stripe",oD1),E.route("/api/_github",bX8({taskBoard:()=>i,contextFactory:()=>g})),E.route("/api/_git",Dp);let T={db:Z.db,encryptionKey:E0().encryptionKey};E.route("/api/_jira",mX8(T)),E.route("/api/_jira",gX8(T)),E.route("/report",VX8($.clientDir)),E.route("/api/auth/custom",X68),E.route("/api/auth/desktop",K68),E.all("/api/auth/admin/*",c68),E.all("/api/auth/*",async(K0)=>{return await x8.handler(K0.req.raw)});let A=F88();A.use("/.well-known/oauth-protected-resource/mcp/:connectionId",J60),A.use("/mcp/:connectionId/.well-known/oauth-protected-resource",J60),E.route("/",A),E.get("/.well-known/oauth-protected-resource/api/:org/mcp/:connectionId",m40),E.route("/",O88()),E.use("/oauth-proxy/:connectionId/*",J60),E.all("/oauth-proxy/:connectionId/*",QG8);let P=async(K0)=>{let R0=await vs6()(K0.req.raw),A0=await R0.json();return Response.json(A0,R0)};E.use("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",J60),E.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",P);let q=async(K0)=>{let R0=await bs6()(K0.req.raw),A0=await R0.json();return Response.json(A0,R0)};E.get("/.well-known/oauth-authorization-server/*/:gateway?/:connectionId?",q);let x=x48({ttlMs:120000}),_=await G48({db:Z.db,auth:x8,encryption:{key:E0().encryptionKey},observability:{tracer:IO,meter:e1},modelListCache:W,providerKeyCache:K,memberRoleCache:x});cQ.set(_),Ep1({db:Z.db,baseUrl:m5()}),W48({db:Z.db}),U48({db:Z.db}),E48({db:Z.db}),uX8({db:Z.db,encryptionKey:E0().encryptionKey}),Gb$({db:Z.db}),q48({db:Z.db}),kb$({db:Z.db});let V=PX0(Z.db),y=new _r(Z.db),g=_J8({db:Z.db});IJ1({storage:V,studioContextFactory:g}),DX1({systemDatabaseUrl:Ks0(E0().databaseUrl,E0().databasePgSsl),studioContextFactory:g,deps:{runRegistry:O,cancelBroadcast:H,streamBuffer:F,sseHub:_5}}),WX1({dispatchRunFn:Ey$,studioContextFactory:g,deps:{runRegistry:O,cancelBroadcast:H,streamBuffer:F,sseHub:_5}});let l=new oh(Z.db),i=new D3(Z.db),p=new kG(Z.db),U0=new BO1(i,g,p);if(E0().taskBoardReviewSweeperEnabled){U0.start();let K0=Xz;Xz=async()=>{await K0?.(),U0.dispose()}}uy$({getJetStream:()=>U?.getJetStream()??null,getJetStreamManager:async()=>{let K0=U?.getConnection();return K0?await YG8.jetstreamManager(K0):null},messageParts:l.messageParts(),resolveRun:async(K0)=>{let H0=await Z.db.selectFrom("threads").select(["organization_id","created_by","message_storage_version","status","run_fence_token","title"]).where("id","=",K0).executeTakeFirst();return H0?{orgId:H0.organization_id,createdBy:H0.created_by,version:H0.message_storage_version??1,status:H0.status,runFenceToken:H0.run_fence_token,title:H0.title??null}:null},completeRunIfNotCompleted:async(K0,H0)=>{let R0=await l.completeRunIfNotCompleted(K0,H0);if(U_0(_5,H0,K0,R0),R0)await fd(i,K0,H0,p);return R0},markRunRequiresAction:async(K0,H0)=>{let R0=await l.requiresActionIfInProgress(K0,H0);return U_0(_5,H0,K0,R0),R0},markRunFailed:async(K0,H0,R0,A0)=>{let D1=await l.markRunFailed(K0,H0,R0,A0);if(U_0(_5,H0,K0,D1),D1)await fd(i,K0,H0,p);return D1},clearSynthesizedError:async(K0,H0)=>{await l.messageParts().replaceMessageParts(K0,wE(K0,H0),[])},persistTitle:(K0,H0,R0)=>l.update(K0,H0,{title:R0}),onTitleUpdated:async({runId:K0,orgId:H0,title:R0})=>{let A0=await l.get(K0,H0).catch(()=>null);_5.emit(H0,DF(K0,A0?.status??"in_progress",{title:R0,virtualMcpId:A0?.virtual_mcp_id??void 0,createdBy:A0?.created_by,triggerId:A0?.trigger_id,branch:A0?.branch??null,harnessId:A0?.harness_id??void 0,createdAt:A0?.created_at,updatedAt:A0?.updated_at}))},bumpProgress:async({runId:K0,orgId:H0})=>{await l.bumpProgress(K0,H0)},recordCompleted:async({runId:K0,orgId:H0,distinctId:R0,usage:A0})=>{f1.capture({distinctId:R0,event:"chat_message_completed",groups:{organization:H0},properties:{organization_id:H0,thread_id:K0,transport:"projector",input_tokens:A0.inputTokens,output_tokens:A0.outputTokens,total_tokens:A0.totalTokens}})},recordFailed:async({runId:K0,orgId:H0,distinctId:R0,reason:A0,kind:D1})=>{f1.capture({distinctId:R0,event:"chat_message_failed",groups:{organization:H0},properties:{organization_id:H0,thread_id:K0,transport:"projector",error_category:D1,error_message:A0}})},purgeRun:async(K0)=>{F.purge(K0)}}),if$({studioContextFactory:g,systemDatabaseUrl:Ks0(E0().databaseUrl,E0().databasePgSsl),streamBuffer:F}),SJ8(),zp1(),H48(),B48(),P48(),cX8(),Ub$(),I48(),Sb$(),fX8();let v0=async(K0,H0,R0)=>{let A0=await V.findById(K0,H0);if(!A0)throw Error("Automation not found");return SJ1({automationId:A0.id,organizationId:A0.organization_id,triggerId:null})},G0=new Np(V,({automation:K0,trigger:H0,contextMessages:R0,idempotencyKey:A0})=>R80({automationId:K0.id,organizationId:K0.organization_id,triggerId:H0.id,contextMessages:R0},{idempotencyKey:A0})),N0=[KK(),Kg(),VN()];for(let K0 of N0)D_0(K0).then(()=>{}).catch((H0)=>console.error("[monitoring] Retention cleanup failed:",H0));let o=()=>x8.api.deleteAllExpiredApiKeys().catch((K0)=>console.error("[auth] Expired API key cleanup failed:",K0));o(),setInterval(o,86400000).unref(),E.use("*",async(K0,H0)=>{if(b_0(K0.req.path))return H0();let R0={measure:async(D1,x$)=>{pW(K0,D1);try{return await x$()}finally{P3(K0,D1)}}},A0=await cQ.create(K0.req.raw,{timings:R0});A0.automationRunner=v0,K0.set("studioContext",A0);try{await H0()}finally{let D1=A0.pendingRevalidations;if(D1.length>0)Promise.race([Promise.allSettled(D1),O$(30000)]).catch((i$)=>console.error("[studio] revalidation cleanup error:",i$))}}),E.use("/api/:org/decopilot/*",Kp),E.use("/api/:org/v1/*",Kp),E.use("/api/:org/files/*",Kp),E.use("*",async(K0,H0)=>{if(XG8(K0.req.path))return H0();let R0=K0.get("studioContext");if(!R0?.organization?.id||!R0?.auth?.user?.id)return H0();if(!(await R0.storage.orgSsoConfig.getByOrgId(R0.organization.id))?.enforced)return H0();if(!await R0.storage.orgSsoSessions.isValid(R0.auth.user.id,R0.organization.id))return K0.json({error:"SSO authentication required for this organization"},403);return H0()});let $0=new Z1;$0.use("*",iH({mountPath:"/api/org-sso"})),$0.route("/",lS0()),E.route("/api/org-sso",$0),E.get("/api/tools/management",(K0)=>{return K0.json({tools:mn0,grouped:sP()})}),E.use("/mcp/*",async(K0,H0)=>{pW(K0,"mcp");try{return await H0()}finally{P3(K0,"mcp")}});let Z0=async(K0,H0)=>{let R0=K0.var.studioContext;if(!R0.auth.user?.id&&!R0.auth.apiKey?.id){let A0=new URL(K0.req.url),D1=K0.req.header("x-forwarded-proto")?.split(",")[0]?.trim(),x$=D1?`${D1}://${A0.host}`:A0.origin;return K0.res=new Response(null,{status:401,headers:{"WWW-Authenticate":`Bearer realm="mcp",resource_metadata="${x$}${A0.pathname}/.well-known/oauth-protected-resource"`}})}return await H0()};if(E.use("/mcp/:connectionId?",Z0),E.use("/mcp/gateway/:virtualMcpId?",Z0),E.use("/mcp/virtual-mcp/:virtualMcpId?",Z0),E.use("/mcp/self",Z0),RW()){let{mountDevRoutes:K0}=(eJ8(),A_0(aJ8));K0(E,Z0)}let r=new Z1;r.use("*",iH({mountPath:"/mcp"})),r.route("/",gM0()),E.route("/mcp",r);let Y0=new Z1;Y0.use("*",iH({mountPath:"/mcp/self"})),Y0.route("/",SC0()),E.route("/mcp/self",Y0);let d0=new Z1;d0.use("*",iH({mountPath:"/mcp"})),d0.route("/",lM0()),E.route("/mcp",d0),E.use("/api/:org/models/*",async(K0,H0)=>{pW(K0,"llm_models");try{return await H0()}finally{P3(K0,"llm_models")}});let C0=Y58({cancelBroadcast:H,streamBuffer:F,runRegistry:O});E.route("/api",C0),E.route("/api",nX8);let W1=new Z1;W1.use("*",iH({mountPath:"/api"})),W1.route("/",bC0()),E.route("/api",W1),E.route("/api",NX8);let u0=new Z1;u0.use("*",iH({mountPath:"/api"})),u0.route("/",xC0({tokenStorage:y,automationEventDispatcher:G0})),E.route("/api",u0);let L0=new br(Z.db),j0=new Z1;j0.use("*",iH({mountPath:"/api"})),j0.route("/",pS0()),E.route("/api",j0),E.route("/api/deco-sites",j58()),E.route("/api/deco-apps",GX8());let l0=new Z1;l0.use("*",iH({mountPath:"/api/deco-sites"})),l0.route("/",tS0()),E.route("/api/deco-sites",l0),E.route(gS0,m68()),E.route(r78,e78()),E.route("/api/_editor-resolve",DX8()),E.route(N68,B68()),E.route(_S0,T68());let O1=E0(),Q1=O1.elevenlabsApiKey?new Y_0({apiKey:O1.elevenlabsApiKey,model:O1.elevenlabsVoiceModel,conversationModel:O1.elevenlabsConversationModel,voiceId:O1.elevenlabsVoiceId}):null,_0={openai:O1.openaiLiveApiKey?new lD1({apiKey:O1.openaiLiveApiKey,voice:O1.openaiLiveVoice}):null,elevenlabs:Q1?new uD1(Q1,()=>U?.getConnection()??null):null},m0=new pD1({adapter:Q1,conversationAdapters:_0,defaults:O1,secret:O1.studioJwtSecret??O1.betterAuthSecret,getConnection:()=>U?.getConnection()??null}),p0=gY8({voiceSessions:m0,kvStorage:L0,runRegistry:O,streamBuffer:F,sseHub:_5,cancelBroadcast:H,tokenStorage:y,automationEventDispatcher:G0,mountDevAssets:RW(),mcpAuth:Z0,oauthProxyHandler:QG8,watchHandler:KG8,betterAuthProtectedResourceHandler:P,getNatsConnection:()=>U?.getConnection()??null});return E.route("/api/:org",p0),E.notFound((K0)=>{return K0.json({error:"Not Found",path:K0.req.path},404)}),E.onError(J58),Object.assign(E,{markShuttingDown:()=>{Q=!0},shutdown:async()=>{if(console.log("[shutdown] Stopping workers..."),await Promise.allSettled([_5.stop(),Xz?Promise.resolve(Xz()).finally(()=>{Xz=null}):Promise.resolve()]),U)await U.drain().catch((K0)=>console.error("[shutdown] NATS drain error:",K0));console.log("[shutdown] Flushing telemetry..."),await oX().catch((K0)=>console.error("[shutdown] Telemetry flush error:",K0)),console.log("[shutdown] Closing database..."),await RZ$(Z).catch((K0)=>console.error("[shutdown] Database close error:",K0)),console.log("[shutdown] Cleanup complete.")},initDbos:async()=>{await jO.registerQueue(_3,{partitionQueue:!0,concurrency:RJ1,minPollingIntervalMs:qJ1}),await jO.registerQueue(C3,{partitionQueue:!0,concurrency:NX1,priorityEnabled:!0}),await jO.registerQueue(MN,{workerConcurrency:E0().decopilotMaxConcurrentHostedRuns,priorityEnabled:!0}),await jO.registerQueue(IN,{workerConcurrency:E0().sandboxMaxConcurrentHostedRuns,priorityEnabled:!0}),await jO.registerQueue(qO,{partitionQueue:!0,concurrency:df$}),await jO.registerQueue(Hz,Vb$),await kN1(V),await Promise.allSettled(["automations-gate","automations-global","jira-push"].map((K0)=>jO.deleteQueue(K0))),await MJ1(Z.pool),iY$().catch((K0)=>{console.error("[studio-pack-backfill] failed:",K0)}),Pp1().catch((K0)=>{console.error("[org-fs] public-sets boot sync kick failed:",K0)})}})}var YG8,$G8=5000,Xz=null,QG8=async($)=>{let Z=$.req.param("connectionId");if(!Z)return $.json({error:"Missing connectionId"},400);let Q=$.req.path.split("/").filter(Boolean),Y=Q[Q.length-1],X=$.get("studioContext");if(!X)X=await cQ.create($.req.raw),$.set("studioContext",X);let J=$.req.param("org")?X.organization?.id:void 0,G=await X.storage.connections.findById(Z,J);if(!G?.connection_url)return $.json({error:"Connection not found"},404);if(Y==="register"&&G.oauth_config?.clientId){let y=await $.req.json().catch(()=>({}));return $.json({...typeof y==="object"&&y!==null?y:{},client_id:G.oauth_config.clientId,...G.oauth_config.clientSecret?{client_secret:G.oauth_config.clientSecret}:{},client_secret_expires_at:0})}let W=await Qp(G.connection_url),K,H=new URL(G.connection_url),U=(typeof G.metadata?.oauthResource==="string"&&G.metadata.oauthResource.length>0?G.metadata.oauthResource:void 0)??G.connection_url;if(W.ok)K=(await W.json()).authorization_servers?.[0];if(!K)K=H.origin;let N=await d40(K);if(!N.ok)return $.json({error:"Failed to get auth server metadata"},502);let B=await N.json(),O;if(Y==="authorize")O=B.authorization_endpoint;else if(Y==="token")O=B.token_endpoint;else if(Y==="register")O=B.registration_endpoint;if(!O)return $.json({error:`Unknown OAuth endpoint: ${Y}`},404);let L=D88(O);if(L)return L;let w=new URL(O),j=new URL($.req.url);if(w.search=j.search,Y==="authorize"){let y=w.searchParams.get("redirect_uri");if(y){let g=E0().baseUrl??j.origin;try{if(!WG8(new URL(y),g))return $.json({error:"invalid_request",error_description:"redirect_uri is not allowed"},400)}catch{return $.json({error:"invalid_request",error_description:"redirect_uri is malformed"},400)}w.searchParams.set("redirect_uri",y)}if(w.searchParams.has("resource"))w.searchParams.set("resource",U);if(k48(G.connection_url))w.searchParams.set("auto_personal","true"),w.searchParams.set("force_new","true");return $.redirect(w.toString(),302)}let E={Accept:$.req.header("Accept")||"application/json"},z=$.req.header("Content-Type");if(z)E["Content-Type"]=z;let T=$.req.header("Authorization");if(T)E.Authorization=T;let A,P=null,q=null;if($.req.method!=="GET"&&$.req.method!=="HEAD")if(Y==="token"&&z?.includes("application/x-www-form-urlencoded")){if(T?.toLowerCase().startsWith("basic "))try{let p=atob(T.slice(6).trim()),U0=p.indexOf(":");if(U0!==-1){let v0=decodeURIComponent(p.slice(0,U0)),G0=decodeURIComponent(p.slice(U0+1));P=v0||null,q=G0||null}}catch{}let y=await $.req.formData();if(y.has("resource"))y.set("resource",U);let g=y.get("client_id"),l=y.get("client_secret");if(typeof g==="string"&&g)P=g;if(typeof l==="string"&&l)q=l;let i=new URLSearchParams;for(let[p,U0]of y.entries())i.append(p,U0.toString());A=i.toString()}else if(Y==="register"&&z?.toLowerCase().includes("application/json")){let y=await X.db.selectFrom("organization").select(["id","slug","name"]).where("id","=",G.organization_id).executeTakeFirst(),g=await $.req.text(),l={};try{l=g?JSON.parse(g):{}}catch{A=g}let i=typeof l==="object"&&l!==null&&!Array.isArray(l);if(A===void 0&&!i)A=g;if(A===void 0){let p=l,U0=p.metadata&&typeof p.metadata==="object"?p.metadata:{};p.metadata={...U0,organization_id:G.organization_id,...y?.slug?{organization_slug:y.slug}:{},...y?.name?{organization_name:y.name}:{}},A=JSON.stringify(p),E["Content-Type"]="application/json"}}else A=$.req.raw.body??void 0;let x=await fetch(w.toString(),{method:$.req.method,headers:E,body:A,duplex:"half",redirect:"manual"}),_=new Headers,V=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];for(let[y,g]of x.headers.entries())if(!V.includes(y.toLowerCase()))_.set(y,g);if(Y==="token"&&x.ok){let y=await x.text();try{let g=JSON.parse(y);if(typeof g.access_token==="string"&&g.access_token){let l=typeof g.expires_in==="number"?new Date(Date.now()+g.expires_in*1000):null,i=null;try{i=await Yp(G.connection_url)??O}catch{i=O}let p={connectionId:Z,accessToken:g.access_token,refreshToken:typeof g.refresh_token==="string"?g.refresh_token:null,scope:typeof g.scope==="string"?g.scope:null,expiresAt:l,clientId:P,clientSecret:q,tokenEndpoint:i};await new w9(X.db,X.vault).upsert(p)}}catch(g){console.error("[oauth-proxy] failed to persist downstream token:",g)}return new Response(y,{status:x.status,statusText:x.statusText,headers:_})}return new Response(x.body,{status:x.status,statusText:x.statusText,headers:_})},KG8=async($)=>{let Z=$.var.studioContext,Q=Z.auth.user?.id??Z.auth.apiKey?.userId;if(!Q)return $.json({error:"Unauthorized"},401);let Y=Z.organization?.id;if(!Y)return $.json({error:"organization id missing"},400);let X=$.req.query("types"),J=X?X.split(",").map((H)=>H.trim()).filter(Boolean):null,G=$.req.query("scope")==="all";if(G&&(!dU(Y)||!await iU(Z)))return $.json({error:"forbidden"},403);let W=G?Zq0:Y;if(G)fD({action:"watch_all_orgs",actorUserId:Q,actorOrgId:Y,targetOrgId:"all"});let K=crypto.randomUUID();return DO($,async(H)=>{if(await H.writeSSE({event:"connected",data:JSON.stringify({listenerId:K,organizationId:Y,typePatterns:J,connectedAt:new Date().toISOString()})}),!_5.add({id:K,organizationId:W,typePatterns:J?.length?J:null,push:(N,B)=>{H.writeSSE({id:N.id,event:N.type,data:JSON.stringify(G?{...N,organizationId:B}:N)}).catch(()=>{_5.remove(W,K)})}})){await H.writeSSE({event:"error",data:JSON.stringify({error:"Too many connections",message:"SSE connection limit reached. Try again later."})});return}let U=setInterval(()=>{H.writeSSE({event:"keepalive",data:""}).catch(()=>{clearInterval(U),_5.remove(W,K)})},30000);await new Promise((N)=>{H.onAbort(()=>{clearInterval(U),_5.remove(W,K),N()})})})},ks6,_s6,vs6=()=>Cs6(x8),bs6=()=>Ss6(x8);var FG8=D(()=>{a$();X$();Ap1();F48();D48();A48();S80();VQ1();V48();c$0();I9();oc();p8();J8();VS0();b48();_J1();Z3();wU();aU1();SG();k6();G6();JN1();H68();D68();R68();UN1();d68();EN1();MN1();IN1();UH();FS0();VN1();G58();SS0();hY8();dY8();iY8();oY8();JX8();_N1();WX8();hM0();M80();BX8();cM0();WD1();OX8();JD1();zX8();kX8();_X8();vX8();xX8();yX8();hX8();dX8();YO1();yN1();tX8();GD1();QD1();H50();UJ8();SJ();hT0();tQ1();Z00();Y00();yJ1();NJ8();DJ8();RN1();PJ8();JX1();AJ8();Do();yr();xD();P9();EU1();IJ8();CJ8();J30();DO1();v3();SN1();bD();QX1();J30();$M0();kn0();Sn0();vJ8();au();yJ8();Sp();aU1();Vd();dd();iq0();YG8=C(LK(),1);ks6=new Is6,_s6=new Set([_3,C3,MN,IN,qO,Hz])});var DG8={};$6(DG8,{resolveClientDir:()=>cs6,resolveAssetPathWithTraversalCheck:()=>BG8,isPathWithinDirectory:()=>NG8,createAssetHandler:()=>ms6});import{resolve as t60,dirname as fs6,join as ys6,extname as gs6,basename as hs6,sep as UG8}from"path";function us6($,Z){if($===Z||hs6($)==="index.html")return{"Cache-Control":"no-cache"};if($.includes(`${UG8}assets${UG8}`))return{"Cache-Control":"public, max-age=31536000, immutable"};return{}}function NG8($,Z){let Q=t60(Z),Y=t60($);return Y===Q||Y.startsWith(Q+"/")}function BG8({requestPath:$,clientDir:Z}){let Q=$.startsWith("/")?$.slice(1):$,Y=t60(Z,Q);if(!NG8(Y,Z))return null;return Y}function cs6($,Z="../client"){let Q=new URL($),Y=fs6(Q.pathname);return t60(Y,Z)}function ms6($={}){let{env:Z="production",clientDir:Q=ls6,isServerPath:Y=()=>!1}=$;if(Z==="development")return async function(J){return null};return async function(J){if(J.method!=="GET")return null;let G=new URL(J.url),W;try{W=decodeURIComponent(G.pathname)}catch{return null}if(Y(W))return null;let K=BG8({requestPath:W,clientDir:Q});if(!K)return null;let H=ys6(K,"index.html"),F=t60(Q,"index.html"),U=J.headers.get("accept"),B=U?.includes("text/html")||U?.includes("*/*")&&["",".html"].includes(gs6(K))?[H,F]:[];for(let O of[K,...B])try{let L=Bun.file(O);if(await L.exists())return new Response(L,{headers:us6(O,F)})}catch{}if(W.includes("/assets/"))return new Response("Not Found",{status:404,headers:{"Cache-Control":"no-store"}});return null}}var ls6="./dist/client";var OG8=()=>{};var LG8={};$6(LG8,{tryUpgradePreviewWs:()=>rs6,tryHandlePreviewHttp:()=>os6,previewWebSocketHandler:()=>ss6,parsePreviewBaseDomain:()=>ts6,isPreviewWsData:()=>O_0,extractHandleFromHost:()=>TO1});function ps6($){if($.method!=="GET")return!1;return($.headers.get("accept")??"").includes("text/html")}function ns6(){return new Response(is6,{status:503,headers:{"content-type":"text/html; charset=utf-8","cache-control":"no-store","retry-after":"1","access-control-allow-origin":"*"}})}function ts6($){if(!$||$.trim()==="")return null;let Z=$.includes("{handle}")?$.replace("{handle}","__handle__"):$,Q;try{Q=new URL(Z)}catch{return null}let Y=Q.hostname;if($.includes("{handle}")){let X=Y.indexOf(".");if(X<=0||X===Y.length-1)return null;return Y.slice(X+1)}return Y}function TO1($,Z){if(!$||!Z)return null;let Q=$.indexOf(":"),Y=(Q>=0?$.slice(0,Q):$).toLowerCase(),J=`.${Z.toLowerCase().replace(/^\.+|\.+$/g,"")}`;if(!Y.endsWith(J))return null;let G=Y.slice(0,Y.length-J.length);if(!G||G.includes("."))return null;return G}async function os6($,Z){let Q=TO1($.headers.get("host"),Z.baseDomain);if(!Q)return null;let Y=await Z.getRunner();if(!Y)return r60(503,"preview proxy not configured");let X=await Y.proxyPreviewRequest(Q,$);if(X.headers.get(um)&&ps6($))return ns6();return X.headers.delete(um),X}function r60($,Z){return new Response(JSON.stringify({error:Z}),{status:$,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function O_0($){return typeof $==="object"&&$!==null&&$.kind==="preview"}async function rs6($,Z,Q){if(($.headers.get("upgrade")??"").toLowerCase()!=="websocket")return null;let Y=TO1($.headers.get("host"),Q.baseDomain);if(!Y)return null;let X=await Q.getRunner();if(!X)return r60(503,"preview proxy not configured");let J=await X.resolvePreviewUpstreamUrl(Y);if(!J)return r60(404,"sandbox not found");let G=new URL($.url);if(G.pathname.startsWith("/_sandbox"))return r60(404,"not found");let W=`${J.replace(/^http/,"ws")}${G.pathname}${G.search}`,K=$.headers.get("sec-websocket-protocol"),H=K?K.split(",").map((N)=>N.trim()).filter(Boolean):[],F={kind:"preview",upstreamUrl:W,upstreamProtocols:H,pending:[],upstream:null,closed:!1};if(!Z.upgrade($,{data:F}))return r60(426,"upgrade failed");return}function o60($,Z,Q,Y){if(Z.closed)return;Z.closed=!0;try{$.close(Q,Y)}catch{}try{Z.upstream?.close()}catch{}}var ds6=256,is6='<!DOCTYPE html><html><head><meta charset="utf-8"><title>Connecting\u2026</title><style>body{font-family:system-ui,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0;background:#fafafa;color:#555}div{text-align:center;max-width:420px;padding:24px}h3{margin:0 0 8px}p{margin:0;font-size:14px;color:#999;line-height:1.5}</style></head><body><div><h3>Connecting to sandbox\u2026</h3><p>Waiting for the sandbox to come online. This page refreshes automatically.</p></div><script>setTimeout(function(){window.location.reload()},1500)</script></body></html>',ss6;var wG8=D(()=>{M10();ss6={open($){let Z=$.data;if(!O_0(Z))return;let Q;try{Q=Z.upstreamProtocols.length>0?new WebSocket(Z.upstreamUrl,Z.upstreamProtocols):new WebSocket(Z.upstreamUrl)}catch(Y){console.warn(`[preview-ws] failed to dial upstream ${Z.upstreamUrl}: ${Y instanceof Error?Y.message:String(Y)}`),o60($,Z,1011,"upstream connect failed");return}Q.binaryType="arraybuffer",Z.upstream=Q,Q.addEventListener("open",()=>{while(Z.pending.length>0){let Y=Z.pending.shift();if(Y!==void 0)Q.send(Y)}}),Q.addEventListener("message",(Y)=>{if(Z.closed)return;$.send(Y.data)}),Q.addEventListener("close",(Y)=>{o60($,Z,Y.code||1000,Y.reason||"")}),Q.addEventListener("error",()=>{o60($,Z,1011,"upstream error")})},message($,Z){let Q=$.data;if(!O_0(Q))return;let Y=Q.upstream;if(Y&&Y.readyState===WebSocket.OPEN){Y.send(Z);return}if(Q.pending.length>=ds6){o60($,Q,1011,"preview ws backlog overflow");return}Q.pending.push(Z)},close($){let Z=$.data;if(!O_0(Z))return;o60($,Z,1000,"")}}});var PG8={};$6(PG8,{printBanner:()=>es6,bannerLines:()=>zG8,BANNER_LINES:()=>jG8,BANNER_GRADIENT:()=>EG8});function as6($){let Z=Number.parseInt($.slice(1),16);return[Z>>16&255,Z>>8&255,Z&255]}function zG8($){let Z=jG8.map((Q,Y)=>{let[X,J,G]=as6(EG8[Y]);return`\x1B[38;2;${X};${J};${G}m${Q}\x1B[39m`});if($!==void 0)Z.push(`\x1B[2m  v${$}\x1B[22m`);return Z}function es6($){console.log("");for(let Z of zG8($))console.log(Z);console.log("")}var jG8,EG8;var AG8=D(()=>{jG8=[" \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588     \u2588\u2588\u2588\u2588\u2588\u2588\u2588   ","\u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588 "," \u2591\u2588\u2588\u2588   \u2591\u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588  \u2588 \u2591  \u2588\u2588\u2588     \u2591\u2591\u2591  \u2588\u2588\u2588     \u2591\u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2588\u2588\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2591\u2591\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2588\u2588\u2588  \u2591\u2588\u2588\u2588 \u2591   \u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588 "," \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588  \u2591\u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2591  ","\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591     \u2591\u2591\u2591\u2591\u2591\u2591\u2591   "],EG8=["#00ff64","#00ee5e","#00dc56","#00c84e","#00b444","#00a03c","#008832","#006e28"]});a$();var fO1="13";function yO1($){return{name:"decocms",systemDatabaseUrl:$.systemDatabaseUrl,systemDatabaseSchemaName:"dbos",systemDatabasePoolSize:$.poolSize,runAdminServer:!1,executorID:$.executorID,applicationVersion:fO1,...$.listenQueues!==void 0?{listenQueues:$.listenQueues}:{}}}a$();import uG8 from"pg";var gO1=8314027461559302n,lG8=600000,cG8=500;async function hO1($,Z){let{databaseUrl:Q,lockTimeoutMs:Y=lG8}=$,X=$.log??((K)=>console.log(K)),J=new uG8.Client({connectionString:Q});await J.connect();let G=Date.now(),W=!1;try{while(!W){if(W=(await J.query("SELECT pg_try_advisory_lock($1) AS locked",[gO1.toString()])).rows[0]?.locked===!0,W)break;if(Date.now()-G>=Y)throw Error(`Timed out after ${Y}ms waiting for the DBOS migration lock. Another process is still migrating the dbos schema; this pod will restart and retry.`);await O$(cG8)}let K=Date.now()-G;if(K>1000)X(`[dbos] waited ${K}ms for the migration lock; another process migrated first`);return await Z()}finally{if(W)try{await J.query("SELECT pg_advisory_unlock($1)",[gO1.toString()])}catch{}await J.end().catch(()=>{})}}X$();M_0();k6();function u38(){let $=(process.env.BUN_OPTIONS??"").split(/\s+/).filter(Boolean);return[...process.argv.slice(1),...$]}function m_0($,Z){for(let Q=0;Q<$.length;Q++){let Y=$[Q];if(Y===void 0)continue;if(Y===Z)return $[Q+1];if(Y.startsWith(`${Z}=`))return Y.slice(Z.length+1)}return}function AL1(){let $=u38();if($.includes("--cpu-prof")){console.log(JSON.stringify({msg:"cpu-profiling-active",dir:m_0($,"--cpu-prof-dir")??process.cwd(),name:m_0($,"--cpu-prof-name"),markdown:$.includes("--cpu-prof-md"),intervalUs:Number(m_0($,"--cpu-prof-interval")??1000),note:"profile is written on process exit"}));return}if(process.env.CPU_PROFILE)console.warn(JSON.stringify({msg:"cpu-profiling-requested-but-inactive",hint:'CPU profiling is a Bun launch flag. Set BUN_OPTIONS="--cpu-prof --cpu-prof-md --cpu-prof-dir=/tmp" before starting the process.'}))}p_0();var N50;function CL1(){if(process.env.HEAP_WATCH!=="1")return()=>{};let $=Number(process.env.HEAP_WATCH_INTERVAL_MS??60000),Z=async()=>{let Q=Nz();if(!Q)return;let Y={};try{let{heapStats:X}=await import("bun:jsc"),J=X(),G=Object.entries(J.objectTypeCounts).sort((W,K)=>K[1]-W[1]).slice(0,20);Y={objectCount:J.objectCount,heapSize:J.heapSize,top:Object.fromEntries(G)}}catch{}console.log(JSON.stringify({msg:"heap-watch",ts:new Date().toISOString(),uptimeS:Math.round(process.uptime()),rss:Q.rss,heapUsed:Q.heapUsed,heapTotal:Q.heapTotal,external:Q.external,arrayBuffers:Q.arrayBuffers,...Y}))};return Z().catch(()=>{}),N50=setInterval(()=>void Z().catch(()=>{}),$),N50.unref?.(),process.on("SIGUSR2",()=>{try{let Q=Bun.generateHeapSnapshot("v8"),Y=typeof Q==="string"?Q:JSON.stringify(Q),X=`/tmp/heap-${process.pid}-${Date.now()}.heapsnapshot`;Bun.write(X,Y),console.log(JSON.stringify({msg:"heap-snapshot-written",path:X}))}catch(Q){console.error("[heap-watch] snapshot failed:",Q)}}),()=>{if(N50)clearInterval(N50)}}import*as m38 from"bun:jsc";var{startSamplingProfiler:d38,samplingProfilerStackTraces:i38}=m38;function _L1(){if(process.env.STALL_WATCHDOG!=="1")return()=>{};let $=Number(process.env.STALL_WATCHDOG_MS??100),Z=Number(process.env.STALL_WATCHDOG_TICK_MS??50);try{d38()}catch(J){return console.error("[stall-watchdog] failed to start sampling profiler:",J),()=>{}}let Q,Y=performance.now()+Z,X=()=>{let J=performance.now(),G=J-Y;Y=J+Z;let W=[];try{W=i38()?.traces??[]}catch{}if(G>$&&W.length>0){let K=new Map;for(let F of W){let U=F.frames.find((O)=>O.sourceURL&&!/Unknown Executable/.test(O.category??""))??F.frames[0];if(!U)continue;let N=(U.sourceURL??"?").replace(/^.*\/node_modules\//,"node_modules/"),B=`${U.name??"?"} @ ${N}:${U.line??"?"}`;K.set(B,(K.get(B)??0)+1)}let H=[...K.entries()].sort((F,U)=>U[1]-F[1]).slice(0,8).map(([F,U])=>({frame:F,count:U}));console.warn(JSON.stringify({msg:"stall-stack",ts:new Date().toISOString(),lagMs:Math.round(G),samplesInWindow:W.length,top:H}))}Q=setTimeout(X,Z),Q.unref?.()};return Q=setTimeout(X,Z),Q.unref?.(),()=>{if(Q)clearTimeout(Q)}}function vL1(){AL1();let $=[CL1(),SL1(),_L1()];return()=>{for(let Z of $)Z()}}import{existsSync as Wa6}from"fs";var WG=E0();EL1();var{DBOS:s60,DBOSClient:$a6}=await import("@dbos-inc/dbos-sdk");function kO1($,Z){if(!Z)return $;let Q=new URL($);if(!Q.searchParams.has("sslmode"))Q.searchParams.set("sslmode","verify-full");return Q.toString()}var Za6=[_3,C3,MN,IN,qO,Hz],Qa6=WG.dispatchRole==="worker"?Za6:WG.dispatchRole==="api"?[]:void 0;s60.setConfig(yO1({systemDatabaseUrl:kO1(WG.databaseUrl,WG.databasePgSsl),poolSize:WG.dbosPoolSize,executorID:WG.podName,listenQueues:Qa6}));var{createApp:Ya6}=await Promise.resolve().then(() => (FG8(),HG8)),{isServerPath:Xa6}=await Promise.resolve().then(() => (H50(),QL1)),{createAssetHandler:Ja6,resolveClientDir:IG8}=await Promise.resolve().then(() => (OG8(),DG8)),Ga6=WG.port,TG8=IG8(import.meta.url,"../client"),VG8=Wa6(TG8)?TG8:IG8(import.meta.url,"../dist/client"),Ka6=Ja6({clientDir:VG8,isServerPath:Xa6}),Ha6={"X-Frame-Options":"DENY","Content-Security-Policy":"frame-ancestors 'none'"};function Fa6($){let Z=new Headers($.headers);for(let[Q,Y]of Object.entries(Ha6))Z.set(Q,Y);return new Response($.body,{status:$.status,statusText:$.statusText,headers:Z})}var{parsePreviewBaseDomain:Ua6,tryHandlePreviewHttp:Na6,tryUpgradePreviewWs:Ba6,previewWebSocketHandler:RO1,isPreviewWsData:qO1}=await Promise.resolve().then(() => (wG8(),LG8)),{getOrInitSharedRunner:kG8}=await Promise.resolve().then(() => (yW(),RR$)),SG8=Ua6(process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN),RG8={baseDomain:SG8??"",getRunner:kG8};if(process.env.STUDIO_SANDBOX_TENANT_POOLS?.trim())kG8().catch(($)=>{console.warn("[lifecycle] eager sandbox provider init for tenant pools failed:",$ instanceof Error?$.message:String($))});var L_0=await Ya6({clientDir:VG8}),MO1=process.env.DBOS_CONDUCTOR_KEY?.trim(),qG8=process.env.DBOS_CONDUCTOR_URL?.trim();await hO1({databaseUrl:kO1(WG.databaseUrl,WG.databasePgSsl)},()=>s60.launch({...MO1?{conductorKey:MO1}:{},...MO1&&qG8?{conductorURL:qG8}:{}}));console.log(`[dbos] application version: ${s60.applicationVersion}`);var IO1=5,VO1=0;await E8(async()=>{VO1++;try{return await L_0.initDbos()}catch($){let Z=VO1>=IO1?"giving up":"retrying";throw console.warn(`[dbos] initDbos attempt ${VO1}/${IO1} failed, ${Z}`,$),$}},{maxAttempts:IO1,minTimeout:1000,maxTimeout:1e4,jitter:0.5});if(!WG.isCli){let{bannerLines:$}=await Promise.resolve().then(() => (AG8(),PG8));console.log("");for(let Z of $())console.log(Z)}var Da6=Bun.serve({idleTimeout:0,port:Ga6,hostname:"0.0.0.0",fetch:async($,Z)=>{if(SG8){let Y=await Ba6($,Z,RG8);if(Y===void 0)return;if(Y)return Y;let X=await Na6($,RG8);if(X)return X}let Q=await Ka6($);if(Q)return Fa6(Q);return L_0.fetch($,{server:Z})},websocket:{open($){if(qO1($.data))RO1.open($)},message($,Z){if(qO1($.data))RO1.message($,Z)},close($){if(qO1($.data))RO1.close($)}},development:!1}),Oa6=vL1();if(WG.localMode)Promise.resolve().then(() => (uf(),_q0)).then(async({seedLocalMode:$,markSeedComplete:Z,healLocalJwks:Q})=>{try{let Y=await Q();if(Y>0)console.log(`[local-mode] cleared ${Y} undecryptable JWKS key(s); Better Auth will generate a fresh one`);let X=await $()}catch(Y){console.error("Failed to seed local mode:",Y)}finally{Z()}}).catch(async($)=>{console.error("Failed to load local-mode module:",$);try{let{markSeedComplete:Z}=await Promise.resolve().then(() => (uf(),_q0));Z()}catch{}});var MG8=!1;async function La6($){let Z;try{Z=await $a6.create({systemDatabaseUrl:kO1(WG.databaseUrl,WG.databasePgSsl),systemDatabaseSchemaName:"dbos"});let Q=await Z.listWorkflows({status:"PENDING",queueName:C3,executorId:$,loadInput:!1,loadOutput:!1});if(Q.length===0){console.log(`[shutdown] no in-flight thread-gate gates to hand off (executor ${$})`);return}let Y=Q.map((X)=>X.workflowID);await Z.resumeWorkflows(Y,{queueName:C3}),console.log(`[shutdown] re-enqueued ${Y.length} in-flight thread-gate gate(s) for re-adoption by a live executor (from ${$}):`,Y)}catch(Q){console.error("[shutdown] thread-gate handoff failed:",Q)}finally{await Z?.destroy().catch(()=>{})}}async function w_0($){if(MG8)return;MG8=!0,console.log(`
 [shutdown] Received ${$}, shutting down gracefully...`);let Z=Number(process.env.SHUTDOWN_GRACE_SECONDS??60)*1000,Q=Math.max(Z-5000,1e4),Y=setTimeout(()=>{console.error(`[shutdown] Timed out after ${Q}ms, forcing exit.`),process.exit(1)},Q);Y.unref?.();let X=0;try{Oa6(),L_0.markShuttingDown();let J=lO1(WG.dispatchRole,Q,process.env.SHUTDOWN_DRAIN_MS);await O$(J),await Da6.stop(!0);let G=s60.executorID;await s60.shutdown(),await La6(G),await L_0.shutdown()}catch(J){console.error("[shutdown] Error during shutdown:",J),X=1}clearTimeout(Y),process.exit(X)}process.on("SIGTERM",()=>w_0("SIGTERM"));process.on("SIGINT",()=>w_0("SIGINT"));process.on("SIGHUP",()=>w_0("SIGHUP"));process.on("unhandledRejection",($)=>{console.error("[process] Unhandled rejection:",$)});process.on("uncaughtException",($)=>{console.error("[process] Uncaught exception:",$),w_0("uncaughtException")});