decocms 4.434.0 → 4.435.0

package/dist/server/cli.js

@@ -2182,7 +2182,7 @@ Usage: deco services <up|down|status>`),process.exit(1)}}var _Z$=L(()=>{pu()});f
       `.execute($);if(Number(W.rows[0]?.cnt)===0){console.warn(`Failed to migrate ${G}/${K}, keeping in old table`);continue}}await Pc`
       DELETE FROM kysely_migration WHERE name = ${Q}
     `.execute($)}}async function CG$($){await tO4($),await oO4($);let Z=new VG$({db:$,provider:{getMigrations:()=>Promise.resolve(X41)}}),{error:Q,results:X}=await Z.migrateToLatest(),Y=0;if(X?.forEach((J)=>{if(J.status==="Success")Y++;else if(J.status==="Error")console.error(`Failed to execute migration "${J.migrationName}"`)}),Q)throw console.error("Failed to migrate"),console.error(Q),Q;return Y}async function rO4($){let{keepOpen:Z=!1,database:Q,skipBetterAuth:X=!1}=$??{},Y="skipped";if(!X&&!Q)Y=await Je0();let J=Q??Z8(),G=async()=>{if(!Z&&!Q)await gj(J).catch((K)=>{console.warn("Warning: Error closing database:",K)})};try{let K=await CG$(J.db);return await G(),{betterAuth:Y,kysely:K}}catch(K){throw await G(),K}}async function aO4(){let $=Z8(),Z=new VG$({db:$.db,provider:{getMigrations:()=>Promise.resolve(X41)}}),{error:Q,results:X}=await Z.migrateDown();if(X?.forEach((Y)=>{if(Y.status==="Success")console.log(`\u2705 Migration "${Y.migrationName}" rolled back successfully`);else if(Y.status==="Error")console.error(`\u274C Failed to rollback migration "${Y.migrationName}"`)}),Q)throw console.error("Failed to rollback migration"),console.error(Q),Q}var _G$=L(()=>{IG$();Ge0();bQ()});async function AW0($){let Z={...process.env},Q=FX0($,Z);console.log(x_1(Q.settings.encryptionKey));let X=Q.settings.betterAuthSecret||(Q.settings.localMode?PQ$(Q.settings.dataDir):""),{ensureServices:Y}=await Promise.resolve().then(() => (TK0(),PK0)),{outputs:J,services:G}=await Y({home:Q.settings.dataDir,externalDatabaseUrl:Q.externalDatabaseUrl,externalNatsUrl:Q.externalNatsUrl});if(!Q.skipMigrations){let{migrateBetterAuth:W}=await Promise.resolve().then(() => (Ge0(),AQ$));await W(J.databaseUrl);let{createDatabase:H}=await Promise.resolve().then(() => (bQ(),k7$)),{migrateToLatest:F}=await Promise.resolve().then(() => (_G$(),SG$)),U=H(J.databaseUrl);await F({keepOpen:!0,database:U,skipBetterAuth:!0})}let K={...Q.settings,betterAuthSecret:X,databaseUrl:J.databaseUrl,natsUrls:J.natsUrls,...J.s3?{s3Endpoint:J.s3.endpoint,s3Bucket:J.s3.bucket,s3AccessKeyId:J.s3.accessKeyId,s3SecretAccessKey:J.s3.secretAccessKey,s3ForcePathStyle:J.s3.forcePathStyle}:{}};return vZ$(K),{settings:K,services:G.map((W)=>({name:W.name==="PostgreSQL"?"Postgres":W.name,port:W.port})),managedServiceNames:G.filter((W)=>W.owner==="managed").map((W)=>W.name)}}var Y41=L(()=>{pu();TQ$();X$()});var bG$={};J0(bG$,{updateService:()=>FT,subscribeCliState:()=>K41,setTuiConsoleIntercepted:()=>RW0,setServerUrl:()=>ys,setMigrationsDone:()=>bs,setDevMode:()=>eO4,resetCliStateForTests:()=>sO4,isTuiConsoleIntercepted:()=>qW0,getCliState:()=>G41,addLogEntry:()=>dj});function vG$(){return[{name:"Postgres",status:"pending",port:0},{name:"NATS",status:"pending",port:0}]}function xG$(){return{services:vG$(),migrationsStatus:"pending",serverUrl:null,logs:[]}}function sO4(){CJ=xG$()}function fs(){for(let $ of J41)$()}function G41(){return CJ}function K41($){return J41.add($),()=>J41.delete($)}function FT($){CJ={...CJ,services:CJ.services.map((Z)=>Z.name===$.name?$:Z)},fs()}function bs(){CJ={...CJ,migrationsStatus:"done"},fs()}function ys($){CJ={...CJ,serverUrl:$},fs()}function dj($){let Z=[...CJ.logs,$];CJ={...CJ,logs:Z.length>500?Z.slice(-500):Z},fs()}function eO4(){CJ={...CJ,services:[...vG$(),{name:"API",status:"pending",port:0},{name:"Vite",status:"pending",port:0}]},fs()}function RW0($){fG$=$}function qW0(){return fG$}var CJ,J41,fG$=!1;var UT=L(()=>{CJ=xG$();J41=new Set});import{createServer as yG$}from"net";function $j4($){return new Promise((Z)=>{let Q=yG$();Q.once("error",()=>Z(!1)),Q.listen($,"0.0.0.0",()=>{Q.close(()=>Z(!0))})})}async function gs($){if(await $j4($))return $;let Z=await new Promise((Q,X)=>{let Y=yG$();Y.once("error",X),Y.listen(0,"0.0.0.0",()=>{let J=Y.address(),G=typeof J==="object"&&J?J.port:0;Y.close(()=>Q(G))})});return console.warn(`Port ${$} is in use, using port ${Z} instead.`),Z}var W41=()=>{};var F41={};J0(F41,{startDevServer:()=>Qj4,pipeToLogStore:()=>H41});import{join as Zj4}from"path";function H41($){let Z=$.getReader(),Q=new TextDecoder,X="";function Y(){let J=X.split(`
-`);X=J.pop()??"";for(let G of J){let K=Bun.stripANSI(G).replace(/^\[\d+\]\s*/,"").trim();if(!K)continue;dj({method:"",path:"",status:0,duration:0,timestamp:new Date,rawLine:K})}}(async()=>{try{for(;;){let{done:J,value:G}=await Z.read();if(J)break;X+=Q.decode(G,{stream:!0}),Y()}}catch{}if(X.trim()){let J=Bun.stripANSI(X).replace(/^\[\d+\]\s*/,"").trim();if(J)dj({method:"",path:"",status:0,duration:0,timestamp:new Date,rawLine:J})}})()}async function Qj4($){let{baseUrl:Z,noTui:Q}=$,X=process.env.HOST==="0.0.0.0"&&Boolean(process.env.PORT),Y=X?process.env.PORT:$.vitePort,J=Z||`http://localhost:${Y}`,G=X?await gs(Number(Y)+1):await gs(Number($.port)),{settings:K,services:W,managedServiceNames:H}=await AW0({port:String(G),home:$.home,baseUrl:$.baseUrl,localMode:$.localMode,skipMigrations:$.skipMigrations,noTui:$.noTui,vitePort:$.vitePort});for(let O of W)FT({name:O.name,status:"ready",port:O.port});bs();let F=Zj4(import.meta.dir,"..","..","..","..",".."),U=Q===!0,N=Bun.spawn(["bun","run","dev:servers"],{cwd:F,env:{...process.env,PORT:String(K.port),VITE_PORT:String(Y),DATABASE_URL:K.databaseUrl,NATS_URL:K.natsUrls.join(","),NODE_ENV:K.nodeEnv,BASE_URL:J,DECOCMS_LOCAL_MODE:String(K.localMode),DECOCMS_HOME:K.dataDir,DATA_DIR:K.dataDir,DECO_CLI:"1",...K.betterAuthSecret?{BETTER_AUTH_SECRET:K.betterAuthSecret}:{},...K.s3Endpoint?{S3_ENDPOINT:K.s3Endpoint,S3_BUCKET:K.s3Bucket??"",S3_ACCESS_KEY_ID:K.s3AccessKeyId??"",S3_SECRET_ACCESS_KEY:K.s3SecretAccessKey??"",S3_FORCE_PATH_STYLE:String(K.s3ForcePathStyle)}:{},...K.natsCredsPath?{NATS_CREDS:K.natsCredsPath}:{}},stdio:["inherit",U?"inherit":"pipe",U?"inherit":"pipe"]});if(!U)H41(N.stdout),H41(N.stderr);ys(J),FT({name:"Vite",status:"ready",port:Number(Y)}),FT({name:"API",status:"ready",port:Number(K.port)});let D=async(O)=>{if(N.kill(O),await N.exited,H.length>0){let{stopServices:j}=await Promise.resolve().then(() => (TK0(),PK0));await j(K.dataDir)}};return process.on("SIGINT",()=>D("SIGINT")),process.on("SIGTERM",()=>D("SIGTERM")),{port:Number(Y),process:N}}var U41=L(()=>{Y41();UT();W41()});var MW0;var N41=L(()=>{MW0={name:"decocms",version:"4.434.0",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js","db:migrate:dbos":"bun run ./dist/server/migrate-dbos.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts","migrate:dbos":"bun run src/database/migrate-dbos.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^4.0.58","@ai-sdk/google":"^4.0.76","@ai-sdk/openai":"^4.0.71","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^3.1.0","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^4.0.17","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^7.0.107","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});import{Box as Yj4,Text as gG$}from"ink";import{jsx as Jj4,jsxs as hG$}from"react/jsx-runtime";function uG$({version:$}){return hG$(Yj4,{flexDirection:"column",marginTop:1,children:[pK0.map((Z,Q)=>Jj4(gG$,{color:nK0[Q],children:Z},Q)),hG$(gG$,{dimColor:!0,children:[" v",$]})]})}var lG$=L(()=>{Es()});import{Box as NT,Text as ij}from"ink";import{Spinner as Gj4}from"@inkjs/ui";import{jsx as aG,jsxs as Tc}from"react/jsx-runtime";function cG$({status:$}){if($==="pending")return aG(Gj4,{label:""});return aG(ij,{color:"green",children:"\u2713"})}function Kj4($){return`${$.name}: ${$.port||"...."}`}function mG$({services:$,migrationsStatus:Z,home:Q,serverUrl:X}){return Tc(NT,{flexDirection:"column",paddingBottom:1,children:[aG(uG$,{version:MW0.version}),aG(NT,{marginBottom:1,children:aG(ij,{dimColor:!0,children:"\u2500".repeat(80)})}),aG(NT,{children:Tc(ij,{dimColor:!0,children:["Home: ",Q]})}),Tc(NT,{gap:2,children:[$.map((Y)=>Tc(NT,{gap:1,children:[aG(ij,{children:Kj4(Y)}),aG(cG$,{status:Y.status})]},Y.name)),Tc(NT,{gap:1,children:[aG(ij,{children:"Migrations"}),aG(cG$,{status:Z})]})]}),aG(NT,{children:X?Tc(ij,{children:["Open in browser: ",aG(ij,{color:"cyan",children:X})]}):aG(ij,{dimColor:!0,children:"Starting..."})})]})}var dG$=L(()=>{N41();lG$()});import{Box as Wj4,Text as hs}from"ink";import{jsx as B41,jsxs as L41}from"react/jsx-runtime";function Hj4($){if($>=500)return"red";if($>=400)return"yellow";if($>=300)return"cyan";return"green"}function iG$({logs:$}){return B41(Wj4,{flexDirection:"column",children:$.map((Z,Q)=>{if(Z.rawLine)return B41(hs,{dimColor:!0,children:Z.rawLine},Q);let X=Z.duration<1000?`${Z.duration}ms`:`${(Z.duration/1000).toFixed(1)}s`;return L41(hs,{children:[L41(hs,{dimColor:!0,children:[Z.method.padEnd(6)," ",Z.path.padEnd(30)," "]}),B41(hs,{color:Hj4(Z.status),children:Z.status}),L41(hs,{dimColor:!0,children:[" ",X.padStart(8)]})]},Q)})})}var pG$=()=>{};var D41={};J0(D41,{App:()=>Nj4});import{Box as Fj4}from"ink";import{useSyncExternalStore as Uj4}from"react";import{jsx as nG$,jsxs as Bj4}from"react/jsx-runtime";function Nj4({home:$}){let Z=Uj4(K41,G41);return Bj4(Fj4,{flexDirection:"column",children:[nG$(mG$,{services:Z.services,migrationsStatus:Z.migrationsStatus,home:$,serverUrl:Z.serverUrl}),nG$(iG$,{logs:Z.logs})]})}var O41=L(()=>{dG$();pG$();UT()});var SK="thread-gate",EL="decopilot-hosted-harness",zL="decopilot-hosted-harness-sandboxed",_K="automations",pj="background-tools",BT="task-board-github-reads";var tG$="13";function oG$($){return{name:"decocms",systemDatabaseUrl:$.systemDatabaseUrl,systemDatabaseSchemaName:"dbos",systemDatabasePoolSize:$.poolSize,runAdminServer:!1,executorID:$.executorID,applicationVersion:tG$,...$.listenQueues!==void 0?{listenQueues:$.listenQueues}:{}}}var rG$=()=>{};import Lj4 from"pg";async function sG$($,Z){let{databaseUrl:Q,lockTimeoutMs:X=Dj4}=$,Y=$.log??((W)=>console.log(W)),J=new Lj4.Client({connectionString:Q});await J.connect();let G=Date.now(),K=!1;try{while(!K){if(K=(await J.query("SELECT pg_try_advisory_lock($1) AS locked",[aG$.toString()])).rows[0]?.locked===!0,K)break;if(Date.now()-G>=X)throw Error(`Timed out after ${X}ms waiting for the DBOS migration lock. Another process is still migrating the dbos schema; this pod will restart and retry.`);await $$(Oj4)}let W=Date.now()-G;if(W>1000)Y(`[dbos] waited ${W}ms for the migration lock; another process migrated first`);return await Z()}finally{if(K)try{await J.query("SELECT pg_advisory_unlock($1)",[aG$.toString()])}catch{}await J.end().catch(()=>{})}}var aG$=8314027461559302n,Dj4=600000,Oj4=500;var eG$=L(()=>{$8()});function jj4(){let $=(process.env.BUN_OPTIONS??"").split(/\s+/).filter(Boolean);return[...process.argv.slice(1),...$]}function j41($,Z){for(let Q=0;Q<$.length;Q++){let X=$[Q];if(X===void 0)continue;if(X===Z)return $[Q+1];if(X.startsWith(`${Z}=`))return X.slice(Z.length+1)}return}function $3$(){let $=jj4();if($.includes("--cpu-prof")){console.log(JSON.stringify({msg:"cpu-profiling-active",dir:j41($,"--cpu-prof-dir")??process.cwd(),name:j41($,"--cpu-prof-name"),markdown:$.includes("--cpu-prof-md"),intervalUs:Number(j41($,"--cpu-prof-interval")??1000),note:"profile is written on process exit"}));return}if(process.env.CPU_PROFILE)console.warn(JSON.stringify({msg:"cpu-profiling-requested-but-inactive",hint:'CPU profiling is a Bun launch flag. Set BUN_OPTIONS="--cpu-prof --cpu-prof-md --cpu-prof-dir=/tmp" before starting the process.'}))}function Z3$(){if(process.env.HEAP_WATCH!=="1")return()=>{};let $=Number(process.env.HEAP_WATCH_INTERVAL_MS??60000),Z=async()=>{let Q=YT();if(!Q)return;let X={};try{let{heapStats:Y}=await import("bun:jsc"),J=Y(),G=Object.entries(J.objectTypeCounts).sort((K,W)=>W[1]-K[1]).slice(0,20);X={objectCount:J.objectCount,heapSize:J.heapSize,top:Object.fromEntries(G)}}catch{}console.log(JSON.stringify({msg:"heap-watch",ts:new Date().toISOString(),uptimeS:Math.round(process.uptime()),rss:Q.rss,heapUsed:Q.heapUsed,heapTotal:Q.heapTotal,external:Q.external,arrayBuffers:Q.arrayBuffers,...X}))};return Z().catch(()=>{}),IW0=setInterval(()=>void Z().catch(()=>{}),$),IW0.unref?.(),process.on("SIGUSR2",()=>{try{let Q=Bun.generateHeapSnapshot("v8"),X=typeof Q==="string"?Q:JSON.stringify(Q),Y=`/tmp/heap-${process.pid}-${Date.now()}.heapsnapshot`;Bun.write(Y,X),console.log(JSON.stringify({msg:"heap-snapshot-written",path:Y}))}catch(Q){console.error("[heap-watch] snapshot failed:",Q)}}),()=>{if(IW0)clearInterval(IW0)}}var IW0;var Q3$=()=>{};import*as wj4 from"bun:jsc";function X3$(){if(process.env.STALL_WATCHDOG!=="1")return()=>{};let $=Number(process.env.STALL_WATCHDOG_MS??100),Z=Number(process.env.STALL_WATCHDOG_TICK_MS??50);try{Ej4()}catch(J){return console.error("[stall-watchdog] failed to start sampling profiler:",J),()=>{}}let Q,X=performance.now()+Z,Y=()=>{let J=performance.now(),G=J-X;X=J+Z;let K=[];try{K=zj4()?.traces??[]}catch{}if(G>$&&K.length>0){let W=new Map;for(let F of K){let U=F.frames.find((D)=>D.sourceURL&&!/Unknown Executable/.test(D.category??""))??F.frames[0];if(!U)continue;let N=(U.sourceURL??"?").replace(/^.*\/node_modules\//,"node_modules/"),B=`${U.name??"?"} @ ${N}:${U.line??"?"}`;W.set(B,(W.get(B)??0)+1)}let H=[...W.entries()].sort((F,U)=>U[1]-F[1]).slice(0,8).map(([F,U])=>({frame:F,count:U}));console.warn(JSON.stringify({msg:"stall-stack",ts:new Date().toISOString(),lagMs:Math.round(G),samplesInWindow:K.length,top:H}))}Q=setTimeout(Y,Z),Q.unref?.()};return Q=setTimeout(Y,Z),Q.unref?.(),()=>{if(Q)clearTimeout(Q)}}var Ej4,zj4;var Y3$=L(()=>{({startSamplingProfiler:Ej4,samplingProfilerStackTraces:zj4}=wj4)});function J3$(){$3$();let $=[Z3$(),z7$(),X3$()];return()=>{for(let Z of $)Z()}}var G3$=L(()=>{as0();Q3$();Y3$()});var LT=b((K3$)=>{Object.defineProperty(K3$,"__esModule",{value:!0});K3$.RepublishHeaders=K3$.DirectMsgHeaders=K3$.JsHeaders=K3$.AdvisoryKind=void 0;K3$.isOrderedPushConsumerOptions=Pj4;K3$.isPullConsumer=Tj4;K3$.isPushConsumer=Aj4;K3$.isBoundPushConsumerOptions=Rj4;function Pj4($){if($&&typeof $==="object")return"name_prefix"in $||"deliver_subject_prefix"in $||"filter_subjects"in $||"filter_subject"in $||"deliver_policy"in $||"opt_start_seq"in $||"opt_start_time"in $||"replay_policy"in $||"inactive_threshold"in $||"headers_only"in $||"deliver_prefix"in $;return!1}function Tj4($){return $.isPullConsumer()}function Aj4($){return $.isPushConsumer()}function Rj4($){if($&&typeof $==="object")return"deliver_subject"in $||"deliver_group"in $||"idle_heartbeat"in $;return!1}K3$.AdvisoryKind={API:"api_audit",StreamAction:"stream_action",ConsumerAction:"consumer_action",SnapshotCreate:"snapshot_create",SnapshotComplete:"snapshot_complete",RestoreCreate:"restore_create",RestoreComplete:"restore_complete",MaxDeliver:"max_deliver",Terminated:"terminated",Ack:"consumer_ack",StreamLeaderElected:"stream_leader_elected",StreamQuorumLost:"stream_quorum_lost",ConsumerLeaderElected:"consumer_leader_elected",ConsumerQuorumLost:"consumer_quorum_lost"};K3$.JsHeaders={StreamSourceHdr:"Nats-Stream-Source",LastConsumerSeqHdr:"Nats-Last-Consumer",LastStreamSeqHdr:"Nats-Last-Stream",ConsumerStalledHdr:"Nats-Consumer-Stalled",MessageSizeHdr:"Nats-Msg-Size",RollupHdr:"Nats-Rollup",RollupValueSubject:"sub",RollupValueAll:"all",PendingMessagesHdr:"Nats-Pending-Messages",PendingBytesHdr:"Nats-Pending-Bytes",RequiredApiLevel:"Nats-Required-Api-Level"};K3$.DirectMsgHeaders={Stream:"Nats-Stream",Sequence:"Nats-Sequence",TimeStamp:"Nats-Time-Stamp",Subject:"Nats-Subject",LastSequence:"Nats-Last-Sequence",NumPending:"Nats-Num-Pending"};K3$.RepublishHeaders={Stream:"Nats-Stream",Subject:"Nats-Subject",Sequence:"Nats-Sequence",LastSequence:"Nats-Last-Sequence",Size:"Nats-Msg-Size"}});var sG=b((H3$)=>{Object.defineProperty(H3$,"__esModule",{value:!0});H3$.TD=H3$.TE=H3$.Empty=void 0;H3$.encode=vj4;H3$.decode=xj4;H3$.Empty=new Uint8Array(0);H3$.TE=new TextEncoder;H3$.TD=new TextDecoder;function _j4(...$){let Z=0;for(let Y=0;Y<$.length;Y++)Z+=$[Y].length;let Q=new Uint8Array(Z),X=0;for(let Y=0;Y<$.length;Y++)Q.set($[Y],X),X+=$[Y].length;return Q}function vj4(...$){let Z=[];for(let Q=0;Q<$.length;Q++)Z.push(H3$.TE.encode($[Q]));if(Z.length===0)return H3$.Empty;if(Z.length===1)return Z[0];return _j4(...Z)}function xj4($){if(!$||$.length===0)return"";return H3$.TD.decode($)}});var eG=b((N3$)=>{Object.defineProperty(N3$,"__esModule",{value:!0});N3$.errors=N3$.PermissionViolationError=N3$.NoRespondersError=N3$.TimeoutError=N3$.RequestError=N3$.ProtocolError=N3$.ConnectionError=N3$.DrainingConnectionError=N3$.ClosedConnectionError=N3$.AuthorizationError=N3$.UserAuthenticationExpiredError=N3$.InvalidOperationError=N3$.InvalidArgumentError=N3$.InvalidSubjectError=void 0;class E41 extends Error{constructor($,Z){super(`illegal subject: '${$}'`,Z);this.name="InvalidSubjectError"}}N3$.InvalidSubjectError=E41;class VW0 extends Error{constructor($,Z){super($,Z);this.name="InvalidArgumentError"}static format($,Z,Q){if(Array.isArray(Z)&&Z.length>1)Z=Z[0];if(Array.isArray($))$=$.map((X)=>`'${X}'`),$=$.join(",");else $=`'${$}'`;return new VW0(`${$} ${Z}`,Q)}}N3$.InvalidArgumentError=VW0;class z41 extends Error{constructor($,Z){super($,Z);this.name="InvalidOperationError"}}N3$.InvalidOperationError=z41;class kW0 extends Error{constructor($,Z){super($,Z);this.name="UserAuthenticationExpiredError"}static parse($){if($.toLowerCase().indexOf("user authentication expired")!==-1)return new kW0($);return null}}N3$.UserAuthenticationExpiredError=kW0;class CW0 extends Error{constructor($,Z){super($,Z);this.name="AuthorizationError"}static parse($){let Z=["authorization violation","account authentication expired","authentication timeout"],Q=$.toLowerCase();for(let X=0;X<Z.length;X++)if(Q.indexOf(Z[X])!==-1)return new CW0($);return null}}N3$.AuthorizationError=CW0;class P41 extends Error{constructor(){super("closed connection");this.name="ClosedConnectionError"}}N3$.ClosedConnectionError=P41;class T41 extends Error{constructor(){super("connection draining");this.name="DrainingConnectionError"}}N3$.DrainingConnectionError=T41;class A41 extends Error{constructor($,Z){super($,Z);this.name="ConnectionError"}}N3$.ConnectionError=A41;class R41 extends Error{constructor($,Z){super($,Z);this.name="ProtocolError"}}N3$.ProtocolError=R41;class q41 extends Error{constructor($="",Z){super($,Z);this.name="RequestError"}isNoResponders(){return this.cause instanceof SW0}}N3$.RequestError=q41;class M41 extends Error{constructor($){super("timeout",$);this.name="TimeoutError"}}N3$.TimeoutError=M41;class SW0 extends Error{subject;constructor($,Z){super(`no responders: '${$}'`,Z);this.subject=$,this.name="NoResponders"}}N3$.NoRespondersError=SW0;class _W0 extends Error{operation;subject;queue;constructor($,Z,Q,X,Y){super($,Y);this.name="PermissionViolationError",this.operation=Z,this.subject=Q,this.queue=X}static parse($){if(($?$.toLowerCase():"").indexOf("permissions violation")===-1)return null;let Q="publish",X="",Y=void 0,J=$.match(/(Publish|Subscription) to "(\S+)"/);if(J){if(Q=J[1].toLowerCase(),X=J[2],Q==="subscription"){let G=$.match(/using queue "(\S+)"/);if(G)Y=G[1]}}return new _W0($,Q,X,Y)}}N3$.PermissionViolationError=_W0;N3$.errors={AuthorizationError:CW0,ClosedConnectionError:P41,ConnectionError:A41,DrainingConnectionError:T41,InvalidArgumentError:VW0,InvalidOperationError:z41,InvalidSubjectError:E41,NoRespondersError:SW0,PermissionViolationError:_W0,ProtocolError:R41,RequestError:q41,TimeoutError:M41,UserAuthenticationExpiredError:kW0}});var EH=b((j3$)=>{Object.defineProperty(j3$,"__esModule",{value:!0});j3$.SimpleMutex=j3$.Perf=void 0;j3$.extend=aj4;j3$.render=sj4;j3$.timeout=ej4;j3$.delay=$w4;j3$.deadline=Zw4;j3$.deferred=V41;j3$.debugDeferred=Qw4;j3$.shuffle=Xw4;j3$.collect=Yw4;j3$.jitter=O3$;j3$.backoff=Jw4;j3$.nanos=Gw4;j3$.millis=Kw4;j3$.randomToken=Fw4;var rj4=sG(),I41=eG();function aj4($,...Z){for(let Q=0;Q<Z.length;Q++){let X=Z[Q];Object.keys(X).forEach(function(Y){$[Y]=X[Y]})}return $}function sj4($){return rj4.TD.decode($).replace(/\n/g,"\u240A").replace(/\r/g,"\u240D")}function ej4($,Z=!0){let Q=Z?new I41.TimeoutError:null,X,Y,J=new Promise((G,K)=>{X={cancel:()=>{if(Y)clearTimeout(Y)}},Y=setTimeout(()=>{if(Q===null)K(new I41.TimeoutError);else K(Q)},$)});return Object.assign(J,X)}function $w4($=0){let Z,Q=new Promise((X)=>{let Y=setTimeout(()=>{X()},$);Z={cancel:()=>{if(Y)clearTimeout(Y),X()}}});return Object.assign(Q,Z)}async function Zw4($,Z=1000){let Q=V41(),X=setTimeout(()=>{Q.reject(new I41.TimeoutError)},Z);try{return await Promise.race([$,Q])}finally{clearTimeout(X)}}function V41(){let $={},Z=new Promise((Q,X)=>{$={resolve:Q,reject:X}});return Object.assign(Z,$)}function Qw4(){let $={},Z=new Promise((Q,X)=>{$={resolve:(Y)=>{console.trace("resolve",Y),Q(Y)},reject:(Y)=>{console.trace("reject"),X(Y)}}});return Object.assign(Z,$)}function Xw4($){for(let Z=$.length-1;Z>0;Z--){let Q=Math.floor(Math.random()*(Z+1));[$[Z],$[Q]]=[$[Q],$[Z]]}return $}async function Yw4($){let Z=[];for await(let Q of $)Z.push(Q);return Z}class L3${timers;measures;constructor(){this.timers=new Map,this.measures=new Map}mark($){this.timers.set($,performance.now())}measure($,Z,Q){let X=this.timers.get(Z);if(X===void 0)throw Error(`${Z} is not defined`);let Y=this.timers.get(Q);if(Y===void 0)throw Error(`${Q} is not defined`);this.measures.set($,Y-X)}getEntries(){let $=[];return this.measures.forEach((Z,Q)=>{$.push({name:Q,duration:Z})}),$}}j3$.Perf=L3$;class D3${max;current;waiting;constructor($=1){this.max=$,this.current=0,this.waiting=[]}lock(){if(this.current++,this.current<=this.max)return Promise.resolve();let $=V41();return this.waiting.push($),$}unlock(){this.current--,this.waiting.pop()?.resolve()}}j3$.SimpleMutex=D3$;function O3$($){if($===0)return 0;return Math.floor($/2+Math.random()*$)}function Jw4($=[0,250,250,500,500,3000,5000]){if(!Array.isArray($))$=[0,250,250,500,500,3000,5000];let Z=$.length-1;return{backoff(Q){return O3$(Q>Z?$[Z]:$[Q])}}}function Gw4($){return $*1e6}function Kw4($){return Math.floor($/1e6)}var Ww4="0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz",PL=new Uint8Array(62);for(let $=0;$<62;$++)PL[$]=Ww4.charCodeAt($);var Hw4=218340105584896;function Fw4(){let $=Math.floor(Math.random()*Hw4),Z=$%62,Q=PL[Z];$=($-Z)/62,Z=$%62;let X=PL[Z];$=($-Z)/62,Z=$%62;let Y=PL[Z];$=($-Z)/62,Z=$%62;let J=PL[Z];$=($-Z)/62,Z=$%62;let G=PL[Z];$=($-Z)/62,Z=$%62;let K=PL[Z];$=($-Z)/62,Z=$%62;let W=PL[Z];$=($-Z)/62;let H=PL[$];return String.fromCharCode(Q,X,Y,J,G,K,W,H)}});var q3$=b((A3$)=>{Object.defineProperty(A3$,"__esModule",{value:!0});A3$.nuid=A3$.NuidImpl=void 0;var Mw4="0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz",nj=62,xW0=12,P3$=10,E3$=33,Iw4=333,z3$=xW0+P3$,C41=new Uint8Array(nj);for(let $=0;$<nj;$++)C41[$]=Mw4.charCodeAt($);var vW0=4294967296,T3$=BigInt(nj)**BigInt(P3$),us=Number(T3$/(1n<<32n)),k41=Number(T3$%(1n<<32n));function Vw4($){for(let Z=0;Z<$.length;Z++)$[Z]=Math.floor(Math.random()*256)}function kw4($){if(globalThis?.crypto?.getRandomValues)globalThis.crypto.getRandomValues($);else Vw4($)}class S41{buf;cbuf;seqHi;seqLo;inc;inited;constructor(){this.buf=new Uint8Array(z3$),this.cbuf=new Uint8Array(xW0),this.inited=!1}init(){this.inited=!0,this.setPre(),this.initSeqAndInc(),this.fillSeq()}initSeqAndInc(){let $=0;do this.seqHi=Math.floor(Math.random()*(us+1)),this.seqLo=Math.floor(Math.random()*vW0);while($++<8&&this.seqHi===us&&this.seqLo>=k41);if(this.seqHi===us&&this.seqLo>=k41)this.seqLo=0;this.inc=Math.random()*(Iw4-E3$)+E3$|0}setPre(){kw4(this.cbuf);for(let $=0;$<xW0;$++)this.buf[$]=C41[this.cbuf[$]%nj]}fillSeq(){let $=this.seqHi,Z=this.seqLo;for(let Q=z3$-1;Q>=xW0;Q--){let X=Math.floor($/nj),J=($-X*nj)*vW0+Z,G=Math.floor(J/nj),K=J-G*nj;this.buf[Q]=C41[K],$=X,Z=G}}next(){if(!this.inited)this.init();if(this.seqLo+=this.inc,this.seqLo>=vW0)this.seqLo-=vW0,this.seqHi+=1;if(this.seqHi>us||this.seqHi===us&&this.seqLo>=k41)this.setPre(),this.initSeqAndInc();this.fillSeq();let $=this.buf;return String.fromCharCode($[0],$[1],$[2],$[3],$[4],$[5],$[6],$[7],$[8],$[9],$[10],$[11],$[12],$[13],$[14],$[15],$[16],$[17],$[18],$[19],$[20],$[21])}reset(){this.init()}}A3$.NuidImpl=S41;A3$.nuid=new S41});var k3$=b((I3$)=>{Object.defineProperty(I3$,"__esModule",{value:!0});I3$.nuid=I3$.Nuid=void 0;var M3$=q3$();I3$.Nuid=M3$.NuidImpl;I3$.nuid=M3$.nuid});var bW0=b((fW0)=>{Object.defineProperty(fW0,"__esModule",{value:!0});fW0.nuid=fW0.Nuid=void 0;var C3$=k3$();Object.defineProperty(fW0,"Nuid",{enumerable:!0,get:function(){return C3$.Nuid}});Object.defineProperty(fW0,"nuid",{enumerable:!0,get:function(){return C3$.nuid}})});var tj=b((S3$)=>{Object.defineProperty(S3$,"__esModule",{value:!0});S3$.DEFAULT_HOST=S3$.DEFAULT_PORT=S3$.Match=void 0;S3$.syncIterator=fw4;S3$.createInbox=bw4;var vw4=bW0(),xw4=eG();S3$.Match={Exact:"exact",CanonicalMIME:"canonical",IgnoreCase:"insensitive"};function fw4($){let Z=$[Symbol.asyncIterator]();return{async next(){let Q=await Z.next();if(Q.done)return Promise.resolve(null);return Promise.resolve(Q.value)}}}function bw4($=""){if($=$||"_INBOX",typeof $!=="string")throw TypeError("prefix must be a string");return $.split(".").forEach((Z)=>{if(Z==="*"||Z===">")throw xw4.InvalidArgumentError.format("prefix",`cannot have wildcards ('${$}')`)}),`${$}.${vw4.nuid.next()}`}S3$.DEFAULT_PORT=4222;S3$.DEFAULT_HOST="127.0.0.1"});var ls=b((f3$)=>{Object.defineProperty(f3$,"__esModule",{value:!0});f3$.DataBuffer=void 0;var v3$=sG();class x3${buffers;byteLength;constructor(){this.buffers=[],this.byteLength=0}static concat(...$){let Z=0;for(let Y=0;Y<$.length;Y++)Z+=$[Y].length;let Q=new Uint8Array(Z),X=0;for(let Y=0;Y<$.length;Y++)Q.set($[Y],X),X+=$[Y].length;return Q}static fromAscii($){if(!$)$="";return v3$.TE.encode($)}static toAscii($){return v3$.TD.decode($)}reset(){this.buffers.length=0,this.byteLength=0}pack(){if(this.buffers.length>1){let $=new Uint8Array(this.byteLength),Z=0;for(let Q=0;Q<this.buffers.length;Q++)$.set(this.buffers[Q],Z),Z+=this.buffers[Q].length;this.buffers.length=0,this.buffers.push($)}}shift(){if(this.buffers.length){let $=this.buffers.shift();if($)return this.byteLength-=$.length,$}return new Uint8Array(0)}drain($){if(this.buffers.length){this.pack();let Z=this.buffers.pop();if(Z){let Q=this.byteLength;if($===void 0||$>Q)$=Q;let X=Z.subarray(0,$);if(Q>$)this.buffers.push(Z.subarray($));return this.byteLength=Q-$,X}}return new Uint8Array(0)}fill($,...Z){if($)this.buffers.push($),this.byteLength+=$.length;for(let Q=0;Q<Z.length;Q++)if(Z[Q]&&Z[Q].length)this.buffers.push(Z[Q]),this.byteLength+=Z[Q].length}peek(){if(this.buffers.length)return this.pack(),this.buffers[0];return new Uint8Array(0)}size(){return this.byteLength}length(){return this.buffers.length}}f3$.DataBuffer=x3$});var DT=b((g3$)=>{Object.defineProperty(g3$,"__esModule",{value:!0});g3$.LF=g3$.CR=g3$.CRLF=g3$.CR_LF_LEN=g3$.CR_LF=void 0;g3$.setTransportFactory=dw4;g3$.defaultPort=iw4;g3$.getUrlParseFn=pw4;g3$.newTransport=nw4;g3$.getResolveFn=tw4;g3$.protoLen=y3$;g3$.extractProtocolMessage=ow4;var lw4=sG(),cw4=tj(),mw4=ls(),$3;function dw4($){$3=$}function iw4(){return $3!==void 0&&$3.defaultPort!==void 0?$3.defaultPort:cw4.DEFAULT_PORT}function pw4(){return $3!==void 0&&$3.urlParseFn?$3.urlParseFn:void 0}function nw4(){if(!$3||typeof $3.factory!=="function")throw Error("transport fn is not set");return $3.factory()}function tw4(){return $3!==void 0&&$3.dnsResolveFn?$3.dnsResolveFn:void 0}g3$.CR_LF=`\r
+`);X=J.pop()??"";for(let G of J){let K=Bun.stripANSI(G).replace(/^\[\d+\]\s*/,"").trim();if(!K)continue;dj({method:"",path:"",status:0,duration:0,timestamp:new Date,rawLine:K})}}(async()=>{try{for(;;){let{done:J,value:G}=await Z.read();if(J)break;X+=Q.decode(G,{stream:!0}),Y()}}catch{}if(X.trim()){let J=Bun.stripANSI(X).replace(/^\[\d+\]\s*/,"").trim();if(J)dj({method:"",path:"",status:0,duration:0,timestamp:new Date,rawLine:J})}})()}async function Qj4($){let{baseUrl:Z,noTui:Q}=$,X=process.env.HOST==="0.0.0.0"&&Boolean(process.env.PORT),Y=X?process.env.PORT:$.vitePort,J=Z||`http://localhost:${Y}`,G=X?await gs(Number(Y)+1):await gs(Number($.port)),{settings:K,services:W,managedServiceNames:H}=await AW0({port:String(G),home:$.home,baseUrl:$.baseUrl,localMode:$.localMode,skipMigrations:$.skipMigrations,noTui:$.noTui,vitePort:$.vitePort});for(let O of W)FT({name:O.name,status:"ready",port:O.port});bs();let F=Zj4(import.meta.dir,"..","..","..","..",".."),U=Q===!0,N=Bun.spawn(["bun","run","dev:servers"],{cwd:F,env:{...process.env,PORT:String(K.port),VITE_PORT:String(Y),DATABASE_URL:K.databaseUrl,NATS_URL:K.natsUrls.join(","),NODE_ENV:K.nodeEnv,BASE_URL:J,DECOCMS_LOCAL_MODE:String(K.localMode),DECOCMS_HOME:K.dataDir,DATA_DIR:K.dataDir,DECO_CLI:"1",...K.betterAuthSecret?{BETTER_AUTH_SECRET:K.betterAuthSecret}:{},...K.s3Endpoint?{S3_ENDPOINT:K.s3Endpoint,S3_BUCKET:K.s3Bucket??"",S3_ACCESS_KEY_ID:K.s3AccessKeyId??"",S3_SECRET_ACCESS_KEY:K.s3SecretAccessKey??"",S3_FORCE_PATH_STYLE:String(K.s3ForcePathStyle)}:{},...K.natsCredsPath?{NATS_CREDS:K.natsCredsPath}:{}},stdio:["inherit",U?"inherit":"pipe",U?"inherit":"pipe"]});if(!U)H41(N.stdout),H41(N.stderr);ys(J),FT({name:"Vite",status:"ready",port:Number(Y)}),FT({name:"API",status:"ready",port:Number(K.port)});let D=async(O)=>{if(N.kill(O),await N.exited,H.length>0){let{stopServices:j}=await Promise.resolve().then(() => (TK0(),PK0));await j(K.dataDir)}};return process.on("SIGINT",()=>D("SIGINT")),process.on("SIGTERM",()=>D("SIGTERM")),{port:Number(Y),process:N}}var U41=L(()=>{Y41();UT();W41()});var MW0;var N41=L(()=>{MW0={name:"decocms",version:"4.435.0",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js","db:migrate:dbos":"bun run ./dist/server/migrate-dbos.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts","migrate:dbos":"bun run src/database/migrate-dbos.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^4.0.58","@ai-sdk/google":"^4.0.76","@ai-sdk/openai":"^4.0.71","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^3.1.0","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^4.0.17","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^7.0.107","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});import{Box as Yj4,Text as gG$}from"ink";import{jsx as Jj4,jsxs as hG$}from"react/jsx-runtime";function uG$({version:$}){return hG$(Yj4,{flexDirection:"column",marginTop:1,children:[pK0.map((Z,Q)=>Jj4(gG$,{color:nK0[Q],children:Z},Q)),hG$(gG$,{dimColor:!0,children:[" v",$]})]})}var lG$=L(()=>{Es()});import{Box as NT,Text as ij}from"ink";import{Spinner as Gj4}from"@inkjs/ui";import{jsx as aG,jsxs as Tc}from"react/jsx-runtime";function cG$({status:$}){if($==="pending")return aG(Gj4,{label:""});return aG(ij,{color:"green",children:"\u2713"})}function Kj4($){return`${$.name}: ${$.port||"...."}`}function mG$({services:$,migrationsStatus:Z,home:Q,serverUrl:X}){return Tc(NT,{flexDirection:"column",paddingBottom:1,children:[aG(uG$,{version:MW0.version}),aG(NT,{marginBottom:1,children:aG(ij,{dimColor:!0,children:"\u2500".repeat(80)})}),aG(NT,{children:Tc(ij,{dimColor:!0,children:["Home: ",Q]})}),Tc(NT,{gap:2,children:[$.map((Y)=>Tc(NT,{gap:1,children:[aG(ij,{children:Kj4(Y)}),aG(cG$,{status:Y.status})]},Y.name)),Tc(NT,{gap:1,children:[aG(ij,{children:"Migrations"}),aG(cG$,{status:Z})]})]}),aG(NT,{children:X?Tc(ij,{children:["Open in browser: ",aG(ij,{color:"cyan",children:X})]}):aG(ij,{dimColor:!0,children:"Starting..."})})]})}var dG$=L(()=>{N41();lG$()});import{Box as Wj4,Text as hs}from"ink";import{jsx as B41,jsxs as L41}from"react/jsx-runtime";function Hj4($){if($>=500)return"red";if($>=400)return"yellow";if($>=300)return"cyan";return"green"}function iG$({logs:$}){return B41(Wj4,{flexDirection:"column",children:$.map((Z,Q)=>{if(Z.rawLine)return B41(hs,{dimColor:!0,children:Z.rawLine},Q);let X=Z.duration<1000?`${Z.duration}ms`:`${(Z.duration/1000).toFixed(1)}s`;return L41(hs,{children:[L41(hs,{dimColor:!0,children:[Z.method.padEnd(6)," ",Z.path.padEnd(30)," "]}),B41(hs,{color:Hj4(Z.status),children:Z.status}),L41(hs,{dimColor:!0,children:[" ",X.padStart(8)]})]},Q)})})}var pG$=()=>{};var D41={};J0(D41,{App:()=>Nj4});import{Box as Fj4}from"ink";import{useSyncExternalStore as Uj4}from"react";import{jsx as nG$,jsxs as Bj4}from"react/jsx-runtime";function Nj4({home:$}){let Z=Uj4(K41,G41);return Bj4(Fj4,{flexDirection:"column",children:[nG$(mG$,{services:Z.services,migrationsStatus:Z.migrationsStatus,home:$,serverUrl:Z.serverUrl}),nG$(iG$,{logs:Z.logs})]})}var O41=L(()=>{dG$();pG$();UT()});var SK="thread-gate",EL="decopilot-hosted-harness",zL="decopilot-hosted-harness-sandboxed",_K="automations",pj="background-tools",BT="task-board-github-reads";var tG$="13";function oG$($){return{name:"decocms",systemDatabaseUrl:$.systemDatabaseUrl,systemDatabaseSchemaName:"dbos",systemDatabasePoolSize:$.poolSize,runAdminServer:!1,executorID:$.executorID,applicationVersion:tG$,...$.listenQueues!==void 0?{listenQueues:$.listenQueues}:{}}}var rG$=()=>{};import Lj4 from"pg";async function sG$($,Z){let{databaseUrl:Q,lockTimeoutMs:X=Dj4}=$,Y=$.log??((W)=>console.log(W)),J=new Lj4.Client({connectionString:Q});await J.connect();let G=Date.now(),K=!1;try{while(!K){if(K=(await J.query("SELECT pg_try_advisory_lock($1) AS locked",[aG$.toString()])).rows[0]?.locked===!0,K)break;if(Date.now()-G>=X)throw Error(`Timed out after ${X}ms waiting for the DBOS migration lock. Another process is still migrating the dbos schema; this pod will restart and retry.`);await $$(Oj4)}let W=Date.now()-G;if(W>1000)Y(`[dbos] waited ${W}ms for the migration lock; another process migrated first`);return await Z()}finally{if(K)try{await J.query("SELECT pg_advisory_unlock($1)",[aG$.toString()])}catch{}await J.end().catch(()=>{})}}var aG$=8314027461559302n,Dj4=600000,Oj4=500;var eG$=L(()=>{$8()});function jj4(){let $=(process.env.BUN_OPTIONS??"").split(/\s+/).filter(Boolean);return[...process.argv.slice(1),...$]}function j41($,Z){for(let Q=0;Q<$.length;Q++){let X=$[Q];if(X===void 0)continue;if(X===Z)return $[Q+1];if(X.startsWith(`${Z}=`))return X.slice(Z.length+1)}return}function $3$(){let $=jj4();if($.includes("--cpu-prof")){console.log(JSON.stringify({msg:"cpu-profiling-active",dir:j41($,"--cpu-prof-dir")??process.cwd(),name:j41($,"--cpu-prof-name"),markdown:$.includes("--cpu-prof-md"),intervalUs:Number(j41($,"--cpu-prof-interval")??1000),note:"profile is written on process exit"}));return}if(process.env.CPU_PROFILE)console.warn(JSON.stringify({msg:"cpu-profiling-requested-but-inactive",hint:'CPU profiling is a Bun launch flag. Set BUN_OPTIONS="--cpu-prof --cpu-prof-md --cpu-prof-dir=/tmp" before starting the process.'}))}function Z3$(){if(process.env.HEAP_WATCH!=="1")return()=>{};let $=Number(process.env.HEAP_WATCH_INTERVAL_MS??60000),Z=async()=>{let Q=YT();if(!Q)return;let X={};try{let{heapStats:Y}=await import("bun:jsc"),J=Y(),G=Object.entries(J.objectTypeCounts).sort((K,W)=>W[1]-K[1]).slice(0,20);X={objectCount:J.objectCount,heapSize:J.heapSize,top:Object.fromEntries(G)}}catch{}console.log(JSON.stringify({msg:"heap-watch",ts:new Date().toISOString(),uptimeS:Math.round(process.uptime()),rss:Q.rss,heapUsed:Q.heapUsed,heapTotal:Q.heapTotal,external:Q.external,arrayBuffers:Q.arrayBuffers,...X}))};return Z().catch(()=>{}),IW0=setInterval(()=>void Z().catch(()=>{}),$),IW0.unref?.(),process.on("SIGUSR2",()=>{try{let Q=Bun.generateHeapSnapshot("v8"),X=typeof Q==="string"?Q:JSON.stringify(Q),Y=`/tmp/heap-${process.pid}-${Date.now()}.heapsnapshot`;Bun.write(Y,X),console.log(JSON.stringify({msg:"heap-snapshot-written",path:Y}))}catch(Q){console.error("[heap-watch] snapshot failed:",Q)}}),()=>{if(IW0)clearInterval(IW0)}}var IW0;var Q3$=()=>{};import*as wj4 from"bun:jsc";function X3$(){if(process.env.STALL_WATCHDOG!=="1")return()=>{};let $=Number(process.env.STALL_WATCHDOG_MS??100),Z=Number(process.env.STALL_WATCHDOG_TICK_MS??50);try{Ej4()}catch(J){return console.error("[stall-watchdog] failed to start sampling profiler:",J),()=>{}}let Q,X=performance.now()+Z,Y=()=>{let J=performance.now(),G=J-X;X=J+Z;let K=[];try{K=zj4()?.traces??[]}catch{}if(G>$&&K.length>0){let W=new Map;for(let F of K){let U=F.frames.find((D)=>D.sourceURL&&!/Unknown Executable/.test(D.category??""))??F.frames[0];if(!U)continue;let N=(U.sourceURL??"?").replace(/^.*\/node_modules\//,"node_modules/"),B=`${U.name??"?"} @ ${N}:${U.line??"?"}`;W.set(B,(W.get(B)??0)+1)}let H=[...W.entries()].sort((F,U)=>U[1]-F[1]).slice(0,8).map(([F,U])=>({frame:F,count:U}));console.warn(JSON.stringify({msg:"stall-stack",ts:new Date().toISOString(),lagMs:Math.round(G),samplesInWindow:K.length,top:H}))}Q=setTimeout(Y,Z),Q.unref?.()};return Q=setTimeout(Y,Z),Q.unref?.(),()=>{if(Q)clearTimeout(Q)}}var Ej4,zj4;var Y3$=L(()=>{({startSamplingProfiler:Ej4,samplingProfilerStackTraces:zj4}=wj4)});function J3$(){$3$();let $=[Z3$(),z7$(),X3$()];return()=>{for(let Z of $)Z()}}var G3$=L(()=>{as0();Q3$();Y3$()});var LT=b((K3$)=>{Object.defineProperty(K3$,"__esModule",{value:!0});K3$.RepublishHeaders=K3$.DirectMsgHeaders=K3$.JsHeaders=K3$.AdvisoryKind=void 0;K3$.isOrderedPushConsumerOptions=Pj4;K3$.isPullConsumer=Tj4;K3$.isPushConsumer=Aj4;K3$.isBoundPushConsumerOptions=Rj4;function Pj4($){if($&&typeof $==="object")return"name_prefix"in $||"deliver_subject_prefix"in $||"filter_subjects"in $||"filter_subject"in $||"deliver_policy"in $||"opt_start_seq"in $||"opt_start_time"in $||"replay_policy"in $||"inactive_threshold"in $||"headers_only"in $||"deliver_prefix"in $;return!1}function Tj4($){return $.isPullConsumer()}function Aj4($){return $.isPushConsumer()}function Rj4($){if($&&typeof $==="object")return"deliver_subject"in $||"deliver_group"in $||"idle_heartbeat"in $;return!1}K3$.AdvisoryKind={API:"api_audit",StreamAction:"stream_action",ConsumerAction:"consumer_action",SnapshotCreate:"snapshot_create",SnapshotComplete:"snapshot_complete",RestoreCreate:"restore_create",RestoreComplete:"restore_complete",MaxDeliver:"max_deliver",Terminated:"terminated",Ack:"consumer_ack",StreamLeaderElected:"stream_leader_elected",StreamQuorumLost:"stream_quorum_lost",ConsumerLeaderElected:"consumer_leader_elected",ConsumerQuorumLost:"consumer_quorum_lost"};K3$.JsHeaders={StreamSourceHdr:"Nats-Stream-Source",LastConsumerSeqHdr:"Nats-Last-Consumer",LastStreamSeqHdr:"Nats-Last-Stream",ConsumerStalledHdr:"Nats-Consumer-Stalled",MessageSizeHdr:"Nats-Msg-Size",RollupHdr:"Nats-Rollup",RollupValueSubject:"sub",RollupValueAll:"all",PendingMessagesHdr:"Nats-Pending-Messages",PendingBytesHdr:"Nats-Pending-Bytes",RequiredApiLevel:"Nats-Required-Api-Level"};K3$.DirectMsgHeaders={Stream:"Nats-Stream",Sequence:"Nats-Sequence",TimeStamp:"Nats-Time-Stamp",Subject:"Nats-Subject",LastSequence:"Nats-Last-Sequence",NumPending:"Nats-Num-Pending"};K3$.RepublishHeaders={Stream:"Nats-Stream",Subject:"Nats-Subject",Sequence:"Nats-Sequence",LastSequence:"Nats-Last-Sequence",Size:"Nats-Msg-Size"}});var sG=b((H3$)=>{Object.defineProperty(H3$,"__esModule",{value:!0});H3$.TD=H3$.TE=H3$.Empty=void 0;H3$.encode=vj4;H3$.decode=xj4;H3$.Empty=new Uint8Array(0);H3$.TE=new TextEncoder;H3$.TD=new TextDecoder;function _j4(...$){let Z=0;for(let Y=0;Y<$.length;Y++)Z+=$[Y].length;let Q=new Uint8Array(Z),X=0;for(let Y=0;Y<$.length;Y++)Q.set($[Y],X),X+=$[Y].length;return Q}function vj4(...$){let Z=[];for(let Q=0;Q<$.length;Q++)Z.push(H3$.TE.encode($[Q]));if(Z.length===0)return H3$.Empty;if(Z.length===1)return Z[0];return _j4(...Z)}function xj4($){if(!$||$.length===0)return"";return H3$.TD.decode($)}});var eG=b((N3$)=>{Object.defineProperty(N3$,"__esModule",{value:!0});N3$.errors=N3$.PermissionViolationError=N3$.NoRespondersError=N3$.TimeoutError=N3$.RequestError=N3$.ProtocolError=N3$.ConnectionError=N3$.DrainingConnectionError=N3$.ClosedConnectionError=N3$.AuthorizationError=N3$.UserAuthenticationExpiredError=N3$.InvalidOperationError=N3$.InvalidArgumentError=N3$.InvalidSubjectError=void 0;class E41 extends Error{constructor($,Z){super(`illegal subject: '${$}'`,Z);this.name="InvalidSubjectError"}}N3$.InvalidSubjectError=E41;class VW0 extends Error{constructor($,Z){super($,Z);this.name="InvalidArgumentError"}static format($,Z,Q){if(Array.isArray(Z)&&Z.length>1)Z=Z[0];if(Array.isArray($))$=$.map((X)=>`'${X}'`),$=$.join(",");else $=`'${$}'`;return new VW0(`${$} ${Z}`,Q)}}N3$.InvalidArgumentError=VW0;class z41 extends Error{constructor($,Z){super($,Z);this.name="InvalidOperationError"}}N3$.InvalidOperationError=z41;class kW0 extends Error{constructor($,Z){super($,Z);this.name="UserAuthenticationExpiredError"}static parse($){if($.toLowerCase().indexOf("user authentication expired")!==-1)return new kW0($);return null}}N3$.UserAuthenticationExpiredError=kW0;class CW0 extends Error{constructor($,Z){super($,Z);this.name="AuthorizationError"}static parse($){let Z=["authorization violation","account authentication expired","authentication timeout"],Q=$.toLowerCase();for(let X=0;X<Z.length;X++)if(Q.indexOf(Z[X])!==-1)return new CW0($);return null}}N3$.AuthorizationError=CW0;class P41 extends Error{constructor(){super("closed connection");this.name="ClosedConnectionError"}}N3$.ClosedConnectionError=P41;class T41 extends Error{constructor(){super("connection draining");this.name="DrainingConnectionError"}}N3$.DrainingConnectionError=T41;class A41 extends Error{constructor($,Z){super($,Z);this.name="ConnectionError"}}N3$.ConnectionError=A41;class R41 extends Error{constructor($,Z){super($,Z);this.name="ProtocolError"}}N3$.ProtocolError=R41;class q41 extends Error{constructor($="",Z){super($,Z);this.name="RequestError"}isNoResponders(){return this.cause instanceof SW0}}N3$.RequestError=q41;class M41 extends Error{constructor($){super("timeout",$);this.name="TimeoutError"}}N3$.TimeoutError=M41;class SW0 extends Error{subject;constructor($,Z){super(`no responders: '${$}'`,Z);this.subject=$,this.name="NoResponders"}}N3$.NoRespondersError=SW0;class _W0 extends Error{operation;subject;queue;constructor($,Z,Q,X,Y){super($,Y);this.name="PermissionViolationError",this.operation=Z,this.subject=Q,this.queue=X}static parse($){if(($?$.toLowerCase():"").indexOf("permissions violation")===-1)return null;let Q="publish",X="",Y=void 0,J=$.match(/(Publish|Subscription) to "(\S+)"/);if(J){if(Q=J[1].toLowerCase(),X=J[2],Q==="subscription"){let G=$.match(/using queue "(\S+)"/);if(G)Y=G[1]}}return new _W0($,Q,X,Y)}}N3$.PermissionViolationError=_W0;N3$.errors={AuthorizationError:CW0,ClosedConnectionError:P41,ConnectionError:A41,DrainingConnectionError:T41,InvalidArgumentError:VW0,InvalidOperationError:z41,InvalidSubjectError:E41,NoRespondersError:SW0,PermissionViolationError:_W0,ProtocolError:R41,RequestError:q41,TimeoutError:M41,UserAuthenticationExpiredError:kW0}});var EH=b((j3$)=>{Object.defineProperty(j3$,"__esModule",{value:!0});j3$.SimpleMutex=j3$.Perf=void 0;j3$.extend=aj4;j3$.render=sj4;j3$.timeout=ej4;j3$.delay=$w4;j3$.deadline=Zw4;j3$.deferred=V41;j3$.debugDeferred=Qw4;j3$.shuffle=Xw4;j3$.collect=Yw4;j3$.jitter=O3$;j3$.backoff=Jw4;j3$.nanos=Gw4;j3$.millis=Kw4;j3$.randomToken=Fw4;var rj4=sG(),I41=eG();function aj4($,...Z){for(let Q=0;Q<Z.length;Q++){let X=Z[Q];Object.keys(X).forEach(function(Y){$[Y]=X[Y]})}return $}function sj4($){return rj4.TD.decode($).replace(/\n/g,"\u240A").replace(/\r/g,"\u240D")}function ej4($,Z=!0){let Q=Z?new I41.TimeoutError:null,X,Y,J=new Promise((G,K)=>{X={cancel:()=>{if(Y)clearTimeout(Y)}},Y=setTimeout(()=>{if(Q===null)K(new I41.TimeoutError);else K(Q)},$)});return Object.assign(J,X)}function $w4($=0){let Z,Q=new Promise((X)=>{let Y=setTimeout(()=>{X()},$);Z={cancel:()=>{if(Y)clearTimeout(Y),X()}}});return Object.assign(Q,Z)}async function Zw4($,Z=1000){let Q=V41(),X=setTimeout(()=>{Q.reject(new I41.TimeoutError)},Z);try{return await Promise.race([$,Q])}finally{clearTimeout(X)}}function V41(){let $={},Z=new Promise((Q,X)=>{$={resolve:Q,reject:X}});return Object.assign(Z,$)}function Qw4(){let $={},Z=new Promise((Q,X)=>{$={resolve:(Y)=>{console.trace("resolve",Y),Q(Y)},reject:(Y)=>{console.trace("reject"),X(Y)}}});return Object.assign(Z,$)}function Xw4($){for(let Z=$.length-1;Z>0;Z--){let Q=Math.floor(Math.random()*(Z+1));[$[Z],$[Q]]=[$[Q],$[Z]]}return $}async function Yw4($){let Z=[];for await(let Q of $)Z.push(Q);return Z}class L3${timers;measures;constructor(){this.timers=new Map,this.measures=new Map}mark($){this.timers.set($,performance.now())}measure($,Z,Q){let X=this.timers.get(Z);if(X===void 0)throw Error(`${Z} is not defined`);let Y=this.timers.get(Q);if(Y===void 0)throw Error(`${Q} is not defined`);this.measures.set($,Y-X)}getEntries(){let $=[];return this.measures.forEach((Z,Q)=>{$.push({name:Q,duration:Z})}),$}}j3$.Perf=L3$;class D3${max;current;waiting;constructor($=1){this.max=$,this.current=0,this.waiting=[]}lock(){if(this.current++,this.current<=this.max)return Promise.resolve();let $=V41();return this.waiting.push($),$}unlock(){this.current--,this.waiting.pop()?.resolve()}}j3$.SimpleMutex=D3$;function O3$($){if($===0)return 0;return Math.floor($/2+Math.random()*$)}function Jw4($=[0,250,250,500,500,3000,5000]){if(!Array.isArray($))$=[0,250,250,500,500,3000,5000];let Z=$.length-1;return{backoff(Q){return O3$(Q>Z?$[Z]:$[Q])}}}function Gw4($){return $*1e6}function Kw4($){return Math.floor($/1e6)}var Ww4="0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz",PL=new Uint8Array(62);for(let $=0;$<62;$++)PL[$]=Ww4.charCodeAt($);var Hw4=218340105584896;function Fw4(){let $=Math.floor(Math.random()*Hw4),Z=$%62,Q=PL[Z];$=($-Z)/62,Z=$%62;let X=PL[Z];$=($-Z)/62,Z=$%62;let Y=PL[Z];$=($-Z)/62,Z=$%62;let J=PL[Z];$=($-Z)/62,Z=$%62;let G=PL[Z];$=($-Z)/62,Z=$%62;let K=PL[Z];$=($-Z)/62,Z=$%62;let W=PL[Z];$=($-Z)/62;let H=PL[$];return String.fromCharCode(Q,X,Y,J,G,K,W,H)}});var q3$=b((A3$)=>{Object.defineProperty(A3$,"__esModule",{value:!0});A3$.nuid=A3$.NuidImpl=void 0;var Mw4="0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz",nj=62,xW0=12,P3$=10,E3$=33,Iw4=333,z3$=xW0+P3$,C41=new Uint8Array(nj);for(let $=0;$<nj;$++)C41[$]=Mw4.charCodeAt($);var vW0=4294967296,T3$=BigInt(nj)**BigInt(P3$),us=Number(T3$/(1n<<32n)),k41=Number(T3$%(1n<<32n));function Vw4($){for(let Z=0;Z<$.length;Z++)$[Z]=Math.floor(Math.random()*256)}function kw4($){if(globalThis?.crypto?.getRandomValues)globalThis.crypto.getRandomValues($);else Vw4($)}class S41{buf;cbuf;seqHi;seqLo;inc;inited;constructor(){this.buf=new Uint8Array(z3$),this.cbuf=new Uint8Array(xW0),this.inited=!1}init(){this.inited=!0,this.setPre(),this.initSeqAndInc(),this.fillSeq()}initSeqAndInc(){let $=0;do this.seqHi=Math.floor(Math.random()*(us+1)),this.seqLo=Math.floor(Math.random()*vW0);while($++<8&&this.seqHi===us&&this.seqLo>=k41);if(this.seqHi===us&&this.seqLo>=k41)this.seqLo=0;this.inc=Math.random()*(Iw4-E3$)+E3$|0}setPre(){kw4(this.cbuf);for(let $=0;$<xW0;$++)this.buf[$]=C41[this.cbuf[$]%nj]}fillSeq(){let $=this.seqHi,Z=this.seqLo;for(let Q=z3$-1;Q>=xW0;Q--){let X=Math.floor($/nj),J=($-X*nj)*vW0+Z,G=Math.floor(J/nj),K=J-G*nj;this.buf[Q]=C41[K],$=X,Z=G}}next(){if(!this.inited)this.init();if(this.seqLo+=this.inc,this.seqLo>=vW0)this.seqLo-=vW0,this.seqHi+=1;if(this.seqHi>us||this.seqHi===us&&this.seqLo>=k41)this.setPre(),this.initSeqAndInc();this.fillSeq();let $=this.buf;return String.fromCharCode($[0],$[1],$[2],$[3],$[4],$[5],$[6],$[7],$[8],$[9],$[10],$[11],$[12],$[13],$[14],$[15],$[16],$[17],$[18],$[19],$[20],$[21])}reset(){this.init()}}A3$.NuidImpl=S41;A3$.nuid=new S41});var k3$=b((I3$)=>{Object.defineProperty(I3$,"__esModule",{value:!0});I3$.nuid=I3$.Nuid=void 0;var M3$=q3$();I3$.Nuid=M3$.NuidImpl;I3$.nuid=M3$.nuid});var bW0=b((fW0)=>{Object.defineProperty(fW0,"__esModule",{value:!0});fW0.nuid=fW0.Nuid=void 0;var C3$=k3$();Object.defineProperty(fW0,"Nuid",{enumerable:!0,get:function(){return C3$.Nuid}});Object.defineProperty(fW0,"nuid",{enumerable:!0,get:function(){return C3$.nuid}})});var tj=b((S3$)=>{Object.defineProperty(S3$,"__esModule",{value:!0});S3$.DEFAULT_HOST=S3$.DEFAULT_PORT=S3$.Match=void 0;S3$.syncIterator=fw4;S3$.createInbox=bw4;var vw4=bW0(),xw4=eG();S3$.Match={Exact:"exact",CanonicalMIME:"canonical",IgnoreCase:"insensitive"};function fw4($){let Z=$[Symbol.asyncIterator]();return{async next(){let Q=await Z.next();if(Q.done)return Promise.resolve(null);return Promise.resolve(Q.value)}}}function bw4($=""){if($=$||"_INBOX",typeof $!=="string")throw TypeError("prefix must be a string");return $.split(".").forEach((Z)=>{if(Z==="*"||Z===">")throw xw4.InvalidArgumentError.format("prefix",`cannot have wildcards ('${$}')`)}),`${$}.${vw4.nuid.next()}`}S3$.DEFAULT_PORT=4222;S3$.DEFAULT_HOST="127.0.0.1"});var ls=b((f3$)=>{Object.defineProperty(f3$,"__esModule",{value:!0});f3$.DataBuffer=void 0;var v3$=sG();class x3${buffers;byteLength;constructor(){this.buffers=[],this.byteLength=0}static concat(...$){let Z=0;for(let Y=0;Y<$.length;Y++)Z+=$[Y].length;let Q=new Uint8Array(Z),X=0;for(let Y=0;Y<$.length;Y++)Q.set($[Y],X),X+=$[Y].length;return Q}static fromAscii($){if(!$)$="";return v3$.TE.encode($)}static toAscii($){return v3$.TD.decode($)}reset(){this.buffers.length=0,this.byteLength=0}pack(){if(this.buffers.length>1){let $=new Uint8Array(this.byteLength),Z=0;for(let Q=0;Q<this.buffers.length;Q++)$.set(this.buffers[Q],Z),Z+=this.buffers[Q].length;this.buffers.length=0,this.buffers.push($)}}shift(){if(this.buffers.length){let $=this.buffers.shift();if($)return this.byteLength-=$.length,$}return new Uint8Array(0)}drain($){if(this.buffers.length){this.pack();let Z=this.buffers.pop();if(Z){let Q=this.byteLength;if($===void 0||$>Q)$=Q;let X=Z.subarray(0,$);if(Q>$)this.buffers.push(Z.subarray($));return this.byteLength=Q-$,X}}return new Uint8Array(0)}fill($,...Z){if($)this.buffers.push($),this.byteLength+=$.length;for(let Q=0;Q<Z.length;Q++)if(Z[Q]&&Z[Q].length)this.buffers.push(Z[Q]),this.byteLength+=Z[Q].length}peek(){if(this.buffers.length)return this.pack(),this.buffers[0];return new Uint8Array(0)}size(){return this.byteLength}length(){return this.buffers.length}}f3$.DataBuffer=x3$});var DT=b((g3$)=>{Object.defineProperty(g3$,"__esModule",{value:!0});g3$.LF=g3$.CR=g3$.CRLF=g3$.CR_LF_LEN=g3$.CR_LF=void 0;g3$.setTransportFactory=dw4;g3$.defaultPort=iw4;g3$.getUrlParseFn=pw4;g3$.newTransport=nw4;g3$.getResolveFn=tw4;g3$.protoLen=y3$;g3$.extractProtocolMessage=ow4;var lw4=sG(),cw4=tj(),mw4=ls(),$3;function dw4($){$3=$}function iw4(){return $3!==void 0&&$3.defaultPort!==void 0?$3.defaultPort:cw4.DEFAULT_PORT}function pw4(){return $3!==void 0&&$3.urlParseFn?$3.urlParseFn:void 0}function nw4(){if(!$3||typeof $3.factory!=="function")throw Error("transport fn is not set");return $3.factory()}function tw4(){return $3!==void 0&&$3.dnsResolveFn?$3.dnsResolveFn:void 0}g3$.CR_LF=`\r
 `;g3$.CR_LF_LEN=g3$.CR_LF.length;g3$.CRLF=mw4.DataBuffer.fromAscii(g3$.CR_LF);g3$.CR=new Uint8Array(g3$.CRLF)[0];g3$.LF=new Uint8Array(g3$.CRLF)[1];function y3$($){for(let Z=0;Z<$.length;Z++){let Q=Z+1;if($.byteLength>Q&&$[Z]===g3$.CR&&$[Q]===g3$.LF)return Q+1}return 0}function ow4($){let Z=y3$($);if(Z>0){let X=new Uint8Array($).slice(0,Z);return lw4.TD.decode(X)}return""}});var b41=b((p3$)=>{Object.defineProperty(p3$,"__esModule",{value:!0});p3$.ipV4=m3$;p3$.isIP=GE4;p3$.parseIP=d3$;var cs=4,OT=16,yW0=48,c3$=57,u3$=65,YE4=70,l3$=97,JE4=102,f41=16777215;function m3$($,Z,Q,X){let Y=new Uint8Array(OT);return[0,0,0,0,0,0,0,0,0,0,255,255].forEach((G,K)=>{Y[K]=G}),Y[12]=$,Y[13]=Z,Y[14]=Q,Y[15]=X,Y}function GE4($){return d3$($)!==void 0}function d3$($){for(let Z=0;Z<$.length;Z++)switch($[Z]){case".":return i3$($);case":":return KE4($)}return}function i3$($){let Z=new Uint8Array(cs);for(let Q=0;Q<cs;Q++){if($.length===0)return;if(Q>0){if($[0]!==".")return;$=$.substring(1)}let{n:X,c:Y,ok:J}=WE4($);if(!J||X>255)return;$=$.substring(Y),Z[Q]=X}return m3$(Z[0],Z[1],Z[2],Z[3])}function KE4($){let Z=new Uint8Array(OT),Q=-1;if($.length>=2&&$[0]===":"&&$[1]===":"){if(Q=0,$=$.substring(2),$.length===0)return Z}let X=0;while(X<OT){let{n:Y,c:J,ok:G}=HE4($);if(!G||Y>65535)return;if(J<$.length&&$[J]==="."){if(Q<0&&X!=OT-cs)return;if(X+cs>OT)return;let K=i3$($);if(K===void 0)return;Z[X]=K[12],Z[X+1]=K[13],Z[X+2]=K[14],Z[X+3]=K[15],$="",X+=cs;break}if(Z[X]=Y>>8,Z[X+1]=Y,X+=2,$=$.substring(J),$.length===0)break;if($[0]!==":"||$.length==1)return;if($=$.substring(1),$[0]===":"){if(Q>=0)return;if(Q=X,$=$.substring(1),$.length===0)break}}if($.length!==0)return;if(X<OT){if(Q<0)return;let Y=OT-X;for(let J=X-1;J>=Q;J--)Z[J+Y]=Z[J];for(let J=Q+Y-1;J>=Q;J--)Z[J]=0}else if(Q>=0)return;return Z}function WE4($){let Z=0,Q=0;for(Z=0;Z<$.length&&yW0<=$.charCodeAt(Z)&&$.charCodeAt(Z)<=c3$;Z++)if(Q=Q*10+($.charCodeAt(Z)-yW0),Q>=f41)return{n:f41,c:Z,ok:!1};if(Z===0)return{n:0,c:0,ok:!1};return{n:Q,c:Z,ok:!0}}function HE4($){let Z=0,Q=0;for(Q=0;Q<$.length;Q++){if(yW0<=$.charCodeAt(Q)&&$.charCodeAt(Q)<=c3$)Z*=16,Z+=$.charCodeAt(Q)-yW0;else if(l3$<=$.charCodeAt(Q)&&$.charCodeAt(Q)<=JE4)Z*=16,Z+=$.charCodeAt(Q)-l3$+10;else if(u3$<=$.charCodeAt(Q)&&$.charCodeAt(Q)<=YE4)Z*=16,Z+=$.charCodeAt(Q)-u3$+10;else break;if(Z>=f41)return{n:0,c:Q,ok:!1}}if(Q===0)return{n:0,c:Q,ok:!1};return{n:Z,c:Q,ok:!0}}});var c41=b((t3$)=>{Object.defineProperty(t3$,"__esModule",{value:!0});t3$.Servers=t3$.ServerImpl=void 0;t3$.isIPV4OrHostname=n3$;t3$.hostPort=l41;var y41=DT(),g41=EH(),h41=b41(),BE4=tj(),LE4=eG();function n3$($){if($.indexOf("[")!==-1||$.indexOf("::")!==-1)return!1;if($.indexOf(".")!==-1)return!0;if($.split(":").length<=2)return!0;return!1}function u41($){return!n3$($)}function DE4($){let Q=$.toUpperCase().indexOf("::FFFF:");if(Q!==-1&&$.indexOf(".")!==-1){let X=$.substring(Q+7);return X=X.replace("[",""),X.replace("]","")}return $}function l41($){if($=$.trim(),$.match(/^(.*:\/\/)(.*)/m))$=$.replace(/^(.*:\/\/)(.*)/gm,"$2");if($=DE4($),u41($)&&$.indexOf("[")===-1)$=`[${$}]`;let Z=u41($)?$.match(/(]:)(\d+)/):$.match(/(:)(\d+)/),Q=Z&&Z.length===3&&Z[1]&&Z[2]?parseInt(Z[2]):BE4.DEFAULT_PORT,Y=new URL(`${Q===80?"https":"http"}://${$}`);Y.port=`${Q}`;let J=Y.hostname;if(J.charAt(0)==="[")J=J.substring(1,J.length-1);return{listen:Y.host,hostname:J,port:Q}}class Ac{src;listen;hostname;port;didConnect;reconnects;lastConnect;gossiped;tlsName;resolves;constructor($,Z=!1){this.src=$,this.tlsName="";let Q=l41($);this.listen=Q.listen,this.hostname=Q.hostname,this.port=Q.port,this.didConnect=!1,this.reconnects=0,this.lastConnect=0,this.gossiped=Z}toString(){return this.listen}async resolve($){if(!$.fn||$.resolve===!1)return[this];let Z=[];if((0,h41.isIP)(this.hostname))return[this];else{let Q=await $.fn(this.hostname);if($.debug)console.log(`resolve ${this.hostname} = ${Q.join(",")}`);for(let X of Q){let Y=this.port===80?"https":"http",J=new URL(`${Y}://${u41(X)?"["+X+"]":X}`);J.port=`${this.port}`;let G=new Ac(J.host,!1);G.tlsName=this.hostname,Z.push(G)}}if($.randomize)(0,g41.shuffle)(Z);return this.resolves=Z,Z}}t3$.ServerImpl=Ac;class gW0{firstSelect;servers;currentServer;tlsName;randomize;constructor($={}){this.firstSelect=!0,this.servers=[],this.tlsName="",this.randomize=$.randomize||!1}setServers($){if(!Array.isArray($)||$.length===0)throw LE4.InvalidArgumentError.format("servers","cannot be empty");let Z=(0,y41.getUrlParseFn)(),Q=new Map;for(let Y of this.servers)Q.set(Y.listen,Y);let X=[];for(let Y of $){Y=Z?Z(Y):Y;let{listen:J}=l41(Y),G=Q.get(J);if(G)G.gossiped=!1,X.push(G);else X.push(new Ac(Y))}if(this.randomize)(0,g41.shuffle)(X);if(this.servers=X,this.currentServer===void 0||!X.includes(this.currentServer))this.currentServer=X[0],this.firstSelect=!0}clear(){this.servers.length=0}updateTLSName(){let $=this.getCurrentServer();if(!(0,h41.isIP)($.hostname))this.tlsName=$.hostname,this.servers.forEach((Z)=>{if(Z.gossiped)Z.tlsName=this.tlsName})}getCurrentServer(){return this.currentServer}addServer($,Z=!1){let Q=(0,y41.getUrlParseFn)();$=Q?Q($):$;let X=new Ac($,Z);if((0,h41.isIP)(X.hostname))X.tlsName=this.tlsName;this.servers.push(X)}selectServer(){if(this.firstSelect)return this.firstSelect=!1,this.currentServer;let $=this.servers.shift();if($)this.servers.push($),this.currentServer=$;return $}removeCurrentServer(){this.removeServer(this.currentServer)}removeServer($){if($){let Z=this.servers.indexOf($);this.servers.splice(Z,1)}}snapshot(){return gW0.freezeAll(this.servers)}snapshotForHandler(){let $=this.currentServer;if(!$)return this.snapshot();let Z=this.servers.indexOf($);if(Z<=0)return this.snapshot();return gW0.freezeAll([$,...this.servers.slice(0,Z),...this.servers.slice(Z+1)])}static freezeAll($){return $.map((Z)=>Object.freeze({hostname:Z.hostname,port:Z.port,listen:Z.listen,src:Z.src,tlsName:Z.tlsName,reconnects:Z.reconnects,lastConnect:Z.lastConnect,gossiped:Z.gossiped,didConnect:Z.didConnect}))}find($){return this.servers.find((Z)=>Z.listen===$.listen)}setCurrent($){this.currentServer=$}length(){return this.servers.length}next(){return this.servers.length?this.servers[0]:void 0}getServers(){return this.servers}update($,Z){let Q=[],X=[],Y=(0,y41.getUrlParseFn)(),J=new Map;if($.connect_urls&&$.connect_urls.length>0)$.connect_urls.forEach((K)=>{K=Y?Y(K,Z):K;let W=new Ac(K,!0);J.set(K,W)});let G=[];if(this.servers.forEach((K,W)=>{let H=K.listen;if(K.gossiped&&this.currentServer.listen!==H&&J.get(H)===void 0)G.push(W);J.delete(H)}),G.reverse(),G.forEach((K)=>{let W=this.servers.splice(K,1);X=X.concat(W[0].listen)}),J.forEach((K,W)=>{this.servers.push(K),Q.push(W)}),this.randomize&&Q.length>0){let K=this.currentServer,W=this.servers.filter((H)=>H!==K);(0,g41.shuffle)(W),this.servers=K?[K,...W]:W}return{added:Q,deleted:X}}}t3$.Servers=gW0});var hW0=b((s3$)=>{Object.defineProperty(s3$,"__esModule",{value:!0});s3$.QueuedIteratorImpl=void 0;var m41=EH(),r3$=eG();class a3${inflight;processed;received;noIterator;iterClosed;done;signal;yields;filtered;pendingFiltered;ctx;_data;err;time;profile;yielding;didBreak;constructor(){this.inflight=0,this.filtered=0,this.pendingFiltered=0,this.processed=0,this.received=0,this.noIterator=!1,this.done=!1,this.signal=(0,m41.deferred)(),this.yields=[],this.iterClosed=(0,m41.deferred)(),this.time=0,this.yielding=!1,this.didBreak=!1,this.profile=!1}[Symbol.asyncIterator](){return this.iterate()}push($){if(this.done)return;if(this.didBreak){if(typeof $==="function"){let Z=$;try{Z()}catch(Q){}}return}if(typeof $==="function")this.pendingFiltered++;this.yields.push($),this.signal.resolve()}async*iterate(){if(this.noIterator)throw new r3$.InvalidOperationError("iterator cannot be used when a callback is registered");if(this.yielding)throw new r3$.InvalidOperationError("iterator is already yielding");this.yielding=!0;try{while(!0){if(this.yields.length===0)await this.signal;if(this.err)throw this.err;let $=this.yields;this.inflight=$.length,this.yields=[];for(let Z=0;Z<$.length;Z++){if(typeof $[Z]==="function"){this.pendingFiltered--;let X=$[Z];try{X()}catch(Y){throw Y}if(this.err)throw this.err;continue}this.processed++,this.inflight--;let Q=this.profile?Date.now():0;yield $[Z],this.time=this.profile?Date.now()-Q:0}if(this.done)break;else if(this.yields.length===0)$.length=0,this.yields=$,this.signal=(0,m41.deferred)()}}finally{this.didBreak=!0,this.stop()}}stop($){if(this.done)return;this.err=$,this.done=!0,this.signal.resolve(),this.iterClosed.resolve($)}getProcessed(){return this.noIterator?this.received:this.processed}getPending(){return this.yields.length+this.inflight-this.pendingFiltered}getReceived(){return this.received-this.filtered}}s3$.QueuedIteratorImpl=a3$});var d41=b((QK$)=>{Object.defineProperty(QK$,"__esModule",{value:!0});QK$.MuxSubscription=void 0;var EE4=tj(),$K$=eG();class ZK${baseInbox;reqs;constructor(){this.reqs=new Map}size(){return this.reqs.size}init($){return this.baseInbox=`${(0,EE4.createInbox)($)}.`,this.baseInbox}add($){if(!isNaN($.received))$.received=0;this.reqs.set($.token,$)}get($){return this.reqs.get($)}cancel($){this.reqs.delete($.token)}getToken($){let Z=$.subject||"";if(Z.indexOf(this.baseInbox)===0)return Z.substring(this.baseInbox.length);return null}all(){return Array.from(this.reqs.values())}handleError($,Z){if($)return this.all().forEach((Q)=>{Q.resolver(Z,{})}),!0;if(Z.operation==="publish"){let Q=this.all().find((X)=>{return X.requestSubject===Z.subject});if(Q)return Q.resolver(Z,{}),!0}return!1}dispatcher(){return($,Z)=>{let Q=this.getToken(Z);if(Q){let X=this.get(Q);if(X){if($===null)$=Z?.data?.length===0&&Z.headers?.code===503?new $K$.NoRespondersError(X.requestSubject):null;X.resolver($,Z)}}}}close(){let $=new $K$.RequestError("connection closed");this.reqs.forEach((Z)=>{Z.resolver($,{})})}}QK$.MuxSubscription=ZK$});var i41=b((JK$)=>{Object.defineProperty(JK$,"__esModule",{value:!0});JK$.Heartbeat=void 0;var zE4=EH();class YK${ph;interval;maxOut;timer;pendings;constructor($,Z,Q){this.ph=$,this.interval=Z,this.maxOut=Q,this.pendings=[]}start(){this.cancel(),this._schedule()}cancel($){if(this.timer)clearTimeout(this.timer),this.timer=void 0;if(this._reset(),$)this.ph.disconnect()}_schedule(){this.timer=setTimeout(()=>{if(this.ph.dispatchStatus({type:"ping",pendingPings:this.pendings.length+1}),this.pendings.length===this.maxOut){this.cancel(!0);return}let $=(0,zE4.deferred)();this.ph.flush($).then(()=>{this._reset()}).catch(()=>{this.cancel()}),this.pendings.push($),this._schedule()},this.interval)}_reset(){this.pendings=this.pendings.filter(($)=>{return $.resolve(),!1})}}JK$.Heartbeat=YK$});var t41=b((FK$)=>{Object.defineProperty(FK$,"__esModule",{value:!0});FK$.DenoBuffer=FK$.MAX_SIZE=FK$.AssertionError=void 0;FK$.assert=WK$;FK$.concat=HK$;FK$.append=TE4;FK$.readAll=AE4;FK$.writeAll=RE4;var PE4=sG();class p41 extends Error{constructor($){super($);this.name="AssertionError"}}FK$.AssertionError=p41;function WK$($,Z="Assertion failed."){if(!$)throw new p41(Z)}var KK$=32768;FK$.MAX_SIZE=4294967294;function uW0($,Z,Q=0){let X=Z.byteLength-Q;if($.byteLength>X)$=$.subarray(0,X);return Z.set($,Q),$.byteLength}function HK$($,Z){if($===void 0&&Z===void 0)return new Uint8Array(0);if($===void 0)return Z;if(Z===void 0)return $;let Q=new Uint8Array($.length+Z.length);return Q.set($,0),Q.set(Z,$.length),Q}function TE4($,Z){return HK$($,Uint8Array.of(Z))}class n41{_buf;_off;constructor($){if(this._off=0,$==null){this._buf=new Uint8Array(0);return}this._buf=new Uint8Array($)}bytes($={copy:!0}){if($.copy===!1)return this._buf.subarray(this._off);return this._buf.slice(this._off)}empty(){return this._buf.byteLength<=this._off}get length(){return this._buf.byteLength-this._off}get capacity(){return this._buf.buffer.byteLength}truncate($){if($===0){this.reset();return}if($<0||$>this.length)throw Error("bytes.Buffer: truncation out of range");this._reslice(this._off+$)}reset(){this._reslice(0),this._off=0}_tryGrowByReslice($){let Z=this._buf.byteLength;if($<=this.capacity-Z)return this._reslice(Z+$),Z;return-1}_reslice($){WK$($<=this._buf.buffer.byteLength),this._buf=new Uint8Array(this._buf.buffer,0,$)}readByte(){let $=new Uint8Array(1);if(this.read($))return $[0];return null}read($){if(this.empty()){if(this.reset(),$.byteLength===0)return 0;return null}let Z=uW0(this._buf.subarray(this._off),$);return this._off+=Z,Z}writeByte($){return this.write(Uint8Array.of($))}writeString($){return this.write(PE4.TE.encode($))}write($){let Z=this._grow($.byteLength);return uW0($,this._buf,Z)}_grow($){let Z=this.length;if(Z===0&&this._off!==0)this.reset();let Q=this._tryGrowByReslice($);if(Q>=0)return Q;let X=this.capacity;if($<=Math.floor(X/2)-Z)uW0(this._buf.subarray(this._off),this._buf);else if(X+$>FK$.MAX_SIZE)throw Error("The buffer cannot be grown beyond the maximum size.");else{let Y=new Uint8Array(Math.min(2*X+$,FK$.MAX_SIZE));uW0(this._buf.subarray(this._off),Y),this._buf=Y}return this._off=0,this._reslice(Math.min(Z+$,FK$.MAX_SIZE)),Z}grow($){if($<0)throw Error("Buffer._grow: negative count");let Z=this._grow($);this._reslice(Z)}readFrom($){let Z=0,Q=new Uint8Array(KK$);while(!0){let X=this.capacity-this.length<KK$,Y=X?Q:new Uint8Array(this._buf.buffer,this.length),J=$.read(Y);if(J===null)return Z;if(X)this.write(Y.subarray(0,J));else this._reslice(this.length+J);Z+=J}}}FK$.DenoBuffer=n41;function AE4($){let Z=new n41;return Z.readFrom($),Z.bytes()}function RE4($,Z){let Q=0;while(Q<Z.length)Q+=$.write(Z.subarray(Q))}});var a41=b((DK$)=>{Object.defineProperty(DK$,"__esModule",{value:!0});DK$.cc=DK$.State=DK$.Parser=DK$.Kind=void 0;DK$.describe=SE4;var o41=t41(),r41=sG();DK$.Kind={OK:0,ERR:1,MSG:2,INFO:3,PING:4,PONG:5};function SE4($){let Z,Q="";switch($.kind){case DK$.Kind.MSG:Z="MSG";break;case DK$.Kind.OK:Z="OK";break;case DK$.Kind.ERR:Z="ERR",Q=r41.TD.decode($.data);break;case DK$.Kind.PING:Z="PING";break;case DK$.Kind.PONG:Z="PONG";break;case DK$.Kind.INFO:Z="INFO",Q=r41.TD.decode($.data)}return`${Z}: ${Q}`}function NK$(){let $={};return $.sid=-1,$.hdr=-1,$.size=-1,$}var BK$=48,_E4=57,Rc=67108864;class LK${dispatcher;state;as;drop;hdr;ma;argBuf;msgBuf;constructor($){this.dispatcher=$,this.state=DK$.State.OP_START,this.as=0,this.drop=0,this.hdr=0}parse($){let Z;for(Z=0;Z<$.length;Z++){let Q=$[Z];switch(this.state){case DK$.State.OP_START:switch(Q){case DK$.cc.M:case DK$.cc.m:this.state=DK$.State.OP_M,this.hdr=-1,this.ma=NK$();break;case DK$.cc.H:case DK$.cc.h:this.state=DK$.State.OP_H,this.hdr=0,this.ma=NK$();break;case DK$.cc.P:case DK$.cc.p:this.state=DK$.State.OP_P;break;case DK$.cc.PLUS:this.state=DK$.State.OP_PLUS;break;case DK$.cc.MINUS:this.state=DK$.State.OP_MINUS;break;case DK$.cc.I:case DK$.cc.i:this.state=DK$.State.OP_I;break;default:throw this.fail($.subarray(Z))}break;case DK$.State.OP_H:switch(Q){case DK$.cc.M:case DK$.cc.m:this.state=DK$.State.OP_M;break;default:throw this.fail($.subarray(Z))}break;case DK$.State.OP_M:switch(Q){case DK$.cc.S:case DK$.cc.s:this.state=DK$.State.OP_MS;break;default:throw this.fail($.subarray(Z))}break;case DK$.State.OP_MS:switch(Q){case DK$.cc.G:case DK$.cc.g:this.state=DK$.State.OP_MSG;break;default:throw this.fail($.subarray(Z))}break;case DK$.State.OP_MSG:switch(Q){case DK$.cc.SPACE:case DK$.cc.TAB:this.state=DK$.State.OP_MSG_SPC;break;default:throw this.fail($.subarray(Z))}break;case DK$.State.OP_MSG_SPC:switch(Q){case DK$.cc.SPACE:case DK$.cc.TAB:continue;default:this.state=DK$.State.MSG_ARG,this.as=Z}break;case DK$.State.MSG_ARG:switch(Q){case DK$.cc.CR:this.drop=1;break;case DK$.cc.NL:{let X=this.argBuf?this.argBuf.bytes():$.subarray(this.as,Z-this.drop);this.processMsgArgs(X),this.drop=0,this.as=Z+1,this.state=DK$.State.MSG_PAYLOAD,Z=this.as+this.ma.size-1;break}default:if(this.argBuf)this.argBuf.writeByte(Q)}break;case DK$.State.MSG_PAYLOAD:if(this.msgBuf)if(this.msgBuf.length>=this.ma.size){let X=this.msgBuf.bytes({copy:!1});this.dispatcher.push({kind:DK$.Kind.MSG,msg:this.ma,data:X}),this.argBuf=void 0,this.msgBuf=void 0,this.state=DK$.State.MSG_END}else{let X=this.ma.size-this.msgBuf.length,Y=$.length-Z;if(Y<X)X=Y;if(X>0)this.msgBuf.write($.subarray(Z,Z+X)),Z=Z+X-1;else this.msgBuf.writeByte(Q)}else if(Z-this.as>=this.ma.size)this.dispatcher.push({kind:DK$.Kind.MSG,msg:this.ma,data:$.subarray(this.as,Z)}),this.argBuf=void 0,this.msgBuf=void 0,this.state=DK$.State.MSG_END;break;case DK$.State.MSG_END:switch(Q){case DK$.cc.NL:this.drop=0,this.as=Z+1,this.state=DK$.State.OP_START;break;default:continue}break;case DK$.State.OP_PLUS:switch(Q){case DK$.cc.O:case DK$.cc.o:this.state=DK$.State.OP_PLUS_O;break;default:throw this.fail($.subarray(Z))}break;case DK$.State.OP_PLUS_O:switch(Q){case DK$.cc.K:case DK$.cc.k:this.state=DK$.State.OP_PLUS_OK;break;default:throw this.fail($.subarray(Z))}break;case DK$.State.OP_PLUS_OK:switch(Q){case DK$.cc.NL:this.dispatcher.push({kind:DK$.Kind.OK}),this.drop=0,this.state=DK$.State.OP_START;break}break;case DK$.State.OP_MINUS:switch(Q){case DK$.cc.E:case DK$.cc.e:this.state=DK$.State.OP_MINUS_E;break;default:throw this.fail($.subarray(Z))}break;case DK$.State.OP_MINUS_E:switch(Q){case DK$.cc.R:case DK$.cc.r:this.state=DK$.State.OP_MINUS_ER;break;default:throw this.fail($.subarray(Z))}break;case DK$.State.OP_MINUS_ER:switch(Q){case DK$.cc.R:case DK$.cc.r:this.state=DK$.State.OP_MINUS_ERR;break;default:throw this.fail($.subarray(Z))}break;case DK$.State.OP_MINUS_ERR:switch(Q){case DK$.cc.SPACE:case DK$.cc.TAB:this.state=DK$.State.OP_MINUS_ERR_SPC;break;default:throw this.fail($.subarray(Z))}break;case DK$.State.OP_MINUS_ERR_SPC:switch(Q){case DK$.cc.SPACE:case DK$.cc.TAB:continue;default:this.state=DK$.State.MINUS_ERR_ARG,this.as=Z}break;case DK$.State.MINUS_ERR_ARG:switch(Q){case DK$.cc.CR:this.drop=1;break;case DK$.cc.NL:{let X;if(this.argBuf)X=this.argBuf.bytes(),this.argBuf=void 0;else X=$.subarray(this.as,Z-this.drop);this.dispatcher.push({kind:DK$.Kind.ERR,data:X}),this.drop=0,this.as=Z+1,this.state=DK$.State.OP_START;break}default:if(this.argBuf)this.argBuf.write(Uint8Array.of(Q))}break;case DK$.State.OP_P:switch(Q){case DK$.cc.I:case DK$.cc.i:this.state=DK$.State.OP_PI;break;case DK$.cc.O:case DK$.cc.o:this.state=DK$.State.OP_PO;break;default:throw this.fail($.subarray(Z))}break;case DK$.State.OP_PO:switch(Q){case DK$.cc.N:case DK$.cc.n:this.state=DK$.State.OP_PON;break;default:throw this.fail($.subarray(Z))}break;case DK$.State.OP_PON:switch(Q){case DK$.cc.G:case DK$.cc.g:this.state=DK$.State.OP_PONG;break;default:throw this.fail($.subarray(Z))}break;case DK$.State.OP_PONG:switch(Q){case DK$.cc.NL:this.dispatcher.push({kind:DK$.Kind.PONG}),this.drop=0,this.state=DK$.State.OP_START;break}break;case DK$.State.OP_PI:switch(Q){case DK$.cc.N:case DK$.cc.n:this.state=DK$.State.OP_PIN;break;default:throw this.fail($.subarray(Z))}break;case DK$.State.OP_PIN:switch(Q){case DK$.cc.G:case DK$.cc.g:this.state=DK$.State.OP_PING;break;default:throw this.fail($.subarray(Z))}break;case DK$.State.OP_PING:switch(Q){case DK$.cc.NL:this.dispatcher.push({kind:DK$.Kind.PING}),this.drop=0,this.state=DK$.State.OP_START;break}break;case DK$.State.OP_I:switch(Q){case DK$.cc.N:case DK$.cc.n:this.state=DK$.State.OP_IN;break;default:throw this.fail($.subarray(Z))}break;case DK$.State.OP_IN:switch(Q){case DK$.cc.F:case DK$.cc.f:this.state=DK$.State.OP_INF;break;default:throw this.fail($.subarray(Z))}break;case DK$.State.OP_INF:switch(Q){case DK$.cc.O:case DK$.cc.o:this.state=DK$.State.OP_INFO;break;default:throw this.fail($.subarray(Z))}break;case DK$.State.OP_INFO:switch(Q){case DK$.cc.SPACE:case DK$.cc.TAB:this.state=DK$.State.OP_INFO_SPC;break;default:throw this.fail($.subarray(Z))}break;case DK$.State.OP_INFO_SPC:switch(Q){case DK$.cc.SPACE:case DK$.cc.TAB:continue;default:this.state=DK$.State.INFO_ARG,this.as=Z}break;case DK$.State.INFO_ARG:switch(Q){case DK$.cc.CR:this.drop=1;break;case DK$.cc.NL:{let X;if(this.argBuf)X=this.argBuf.bytes(),this.argBuf=void 0;else X=$.subarray(this.as,Z-this.drop);this.dispatcher.push({kind:DK$.Kind.INFO,data:X}),this.drop=0,this.as=Z+1,this.state=DK$.State.OP_START;break}default:if(this.argBuf)this.argBuf.writeByte(Q)}break;default:throw this.fail($.subarray(Z))}}if((this.state===DK$.State.MSG_ARG||this.state===DK$.State.MINUS_ERR_ARG||this.state===DK$.State.INFO_ARG)&&!this.argBuf)this.argBuf=new o41.DenoBuffer($.subarray(this.as,Z-this.drop));if(this.state===DK$.State.MSG_PAYLOAD&&!this.msgBuf){if(!this.argBuf)this.cloneMsgArg();this.msgBuf=new o41.DenoBuffer($.subarray(this.as))}}cloneMsgArg(){let $=this.ma.subject.length,Z=this.ma.reply?this.ma.reply.length:0,Q=new Uint8Array($+Z);if(Q.set(this.ma.subject),this.ma.reply)Q.set(this.ma.reply,$);if(this.argBuf=new o41.DenoBuffer(Q),this.ma.subject=Q.subarray(0,$),this.ma.reply)this.ma.reply=Q.subarray($)}processMsgArgs($){if(this.hdr>=0)return this.processHeaderMsgArgs($);let Z=[],Q=-1;for(let X=0;X<$.length;X++)switch($[X]){case DK$.cc.SPACE:case DK$.cc.TAB:case DK$.cc.CR:case DK$.cc.NL:if(Q>=0)Z.push($.subarray(Q,X)),Q=-1;break;default:if(Q<0)Q=X}if(Q>=0)Z.push($.subarray(Q));switch(Z.length){case 3:this.ma.subject=Z[0],this.ma.sid=this.protoParseInt(Z[1]),this.ma.reply=void 0,this.ma.size=this.protoParseInt(Z[2],Rc);break;case 4:this.ma.subject=Z[0],this.ma.sid=this.protoParseInt(Z[1]),this.ma.reply=Z[2],this.ma.size=this.protoParseInt(Z[3],Rc);break;default:throw this.fail($,"processMsgArgs Parse Error")}if(this.ma.sid<0)throw this.fail($,"processMsgArgs Bad or Missing Sid Error");if(this.ma.size<0)throw this.fail($,"processMsgArgs Bad or Missing Size Error")}fail($,Z=""){if(!Z)Z=`parse error [${this.state}]`;else Z=`${Z} [${this.state}]`;return Error(`${Z}: ${r41.TD.decode($)}`)}processHeaderMsgArgs($){let Z=[],Q=-1;for(let X=0;X<$.length;X++)switch($[X]){case DK$.cc.SPACE:case DK$.cc.TAB:case DK$.cc.CR:case DK$.cc.NL:if(Q>=0)Z.push($.subarray(Q,X)),Q=-1;break;default:if(Q<0)Q=X}if(Q>=0)Z.push($.subarray(Q));switch(Z.length){case 4:this.ma.subject=Z[0],this.ma.sid=this.protoParseInt(Z[1]),this.ma.reply=void 0,this.ma.hdr=this.protoParseInt(Z[2],Rc),this.ma.size=this.protoParseInt(Z[3],Rc);break;case 5:this.ma.subject=Z[0],this.ma.sid=this.protoParseInt(Z[1]),this.ma.reply=Z[2],this.ma.hdr=this.protoParseInt(Z[3],Rc),this.ma.size=this.protoParseInt(Z[4],Rc);break;default:throw this.fail($,"processHeaderMsgArgs Parse Error")}if(this.ma.sid<0)throw this.fail($,"processHeaderMsgArgs Bad or Missing Sid Error");if(this.ma.hdr<0||this.ma.hdr>this.ma.size)throw this.fail($,"processHeaderMsgArgs Bad or Missing Header Size Error");if(this.ma.size<0)throw this.fail($,"processHeaderMsgArgs Bad or Missing Size Error")}protoParseInt($,Z){if($.length===0||$.length>15)return-1;let Q=0;for(let X=0;X<$.length;X++){if($[X]<BK$||$[X]>_E4)return-1;Q=Q*10+($[X]-BK$)}return Z!==void 0&&Q>Z?-1:Q}}DK$.Parser=LK$;DK$.State={OP_START:0,OP_PLUS:1,OP_PLUS_O:2,OP_PLUS_OK:3,OP_MINUS:4,OP_MINUS_E:5,OP_MINUS_ER:6,OP_MINUS_ERR:7,OP_MINUS_ERR_SPC:8,MINUS_ERR_ARG:9,OP_M:10,OP_MS:11,OP_MSG:12,OP_MSG_SPC:13,MSG_ARG:14,MSG_PAYLOAD:15,MSG_END:16,OP_H:17,OP_P:18,OP_PI:19,OP_PIN:20,OP_PING:21,OP_PO:22,OP_PON:23,OP_PONG:24,OP_I:25,OP_IN:26,OP_INF:27,OP_INFO:28,OP_INFO_SPC:29,INFO_ARG:30};DK$.cc={CR:13,E:69,e:101,F:70,f:102,G:71,g:103,H:72,h:104,I:73,i:105,K:75,k:107,M:77,m:109,MINUS:45,N:78,n:110,NL:10,O:79,o:111,P:80,p:112,PLUS:43,R:82,r:114,S:83,s:115,SPACE:32,TAB:9}});var mW0=b((jK$)=>{Object.defineProperty(jK$,"__esModule",{value:!0});jK$.MsgHdrsImpl=void 0;jK$.canonicalMIMEHeaderKey=e41;jK$.headers=fE4;var OK$=sG(),zH=tj(),cW0=eG();function e41($){let F=!0,U=Array($.length);for(let N=0;N<$.length;N++){let B=$.charCodeAt(N);if(B===58||B<33||B>126)throw cW0.InvalidArgumentError.format("header",`'${$[N]}' is not a valid character in a header name`);if(F&&97<=B&&B<=122)B-=32;else if(!F&&65<=B&&B<=90)B+=32;U[N]=B,F=B==45}return String.fromCharCode(...U)}function fE4($=0,Z=""){if($===0&&Z!=="")throw cW0.InvalidArgumentError.format("code","is required");else if($>0&&Z==="")throw cW0.InvalidArgumentError.format("description","is required");return new qc($,Z)}var s41="NATS/1.0";class qc{_code;headers;_description;constructor($=0,Z=""){this._code=$,this._description=Z,this.headers=new Map}[Symbol.iterator](){return this.headers.entries()}size(){return this.headers.size}equals($){if($&&this.headers.size===$.headers.size&&this._code===$._code){for(let[Z,Q]of this.headers){let X=$.values(Z);if(Q.length!==X.length)return!1;let Y=[...Q].sort(),J=[...X].sort();for(let G=0;G<Y.length;G++)if(Y[G]!==J[G])return!1}return!0}return!1}static decode($){let Z=new qc,X=OK$.TD.decode($).split(`\r
 `),Y=X[0];if(Y!==s41){let J=Y.replace(s41,"").trim();if(J.length>0){if(Z._code=parseInt(J,10),isNaN(Z._code))Z._code=0;let G=Z._code.toString();J=J.replace(G,""),Z._description=J.trim()}}if(X.length>=1)X.slice(1).map((J)=>{if(J){let G=J.indexOf(":");if(G>-1){let K=J.slice(0,G),W=J.slice(G+1).trim();Z.append(K,W)}}});return Z}toString(){if(this.headers.size===0&&this._code===0)return"";let $=s41;if(this._code>0&&this._description!=="")$+=` ${this._code} ${this._description}`;for(let[Z,Q]of this.headers)for(let X=0;X<Q.length;X++)$=`${$}\r
 ${Z}: ${Q[X]}`;return`${$}\r
@@ -3331,7 +3331,7 @@ Caused by: ${Z.stack}`}};Rp=class Rp extends $Y{constructor($,Z){super($,Z);this
 `).filter((Z)=>!/^Co-authored-by:\s/i.test(Z)).join(`
 `).trimEnd()}function jw6($){let Z=$.userName.trim(),Q=$.userEmail?.trim();if(Q)return`Co-authored-by: ${Z} <${Q}>`;return`Co-authored-by: ${Z}`}function uN1($,Z){let Q=hp(Z);if(!Q)return $;let X=Jo$($),Y=jw6(Q);if(X.includes(Y))return X;let J=X.trimEnd();return J.length>0?`${J}
 
-${Y}`:Y}var Yo$,Ow6;var lN1=L(()=>{Yo$=/[\r\n<>]/,Ow6=/^[^\s@<>]+@[^\s@<>]+\.[^\s@<>]+$/});var VC0=L(()=>{$8();lN1()});function ww6($){if($ instanceof TypeError)return!0;if($ instanceof Error&&!($ instanceof DOMException)&&typeof $.code==="string")return!0;if($ instanceof DOMException&&$.name==="AbortError")return!0;return!1}async function cN1($,Z,Q,X){try{return await O8(async()=>{let J=await fetch($,{...Z,signal:AbortSignal.timeout(X)});return{status:J.status,ok:J.ok,body:await J.text()}},{maxAttempts:3,minTimeout:50,maxTimeout:500,multiplier:2,jitter:0.5,isRetriable:ww6})}catch(Y){let J=Y instanceof Error?Y.message:String(Y);throw Error(`[SANDBOX_UNREACHABLE] sandbox daemon ${Q} request failed: ${J}`,{cause:Y})}}async function kC0($){try{let Z=await fetch(`${$}/health`,{signal:AbortSignal.timeout(Ew6)});if(!Z.ok){try{await Z.text()}catch{}return null}let Q=await Z.json();if(typeof Q==="object"&&Q!==null&&typeof Q.bootId==="string"&&typeof Q.ready==="boolean"&&Q.setup&&typeof Q.setup.running==="boolean"&&typeof Q.setup.done==="boolean")return Q;return null}catch{return null}}async function dN1($){for(let Z=0;Z<Go$;Z++){if(await kC0($)!==null)return;let Q=(Math.random()*2-1)*zw6;await $$(Ko$+Q)}throw Error(`sandbox daemon at ${$} did not respond on /health within ${Go$*Ko$/1000}s`)}async function cN($,Z,Q,X,Y){return Pw6($,Z,"POST",Q,X,Y)}async function Pw6($,Z,Q,X,Y,J){let G={...X};if(Y&&Y.rotateToken!==void 0)G.auth=Y;let K=await cN1(`${$}/_sandbox/config`,{method:Q,headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:JSON.stringify(G)},"/_sandbox/config",J?.timeoutMs??mN1);if(!K.ok)throw new PF(K.status,K.body);return Ho$(K.body,"/_sandbox/config")}async function Wo$($,Z,Q){let X=await cN1(`${$}/_sandbox/setup/${Q}`,{method:"POST",headers:{Authorization:`Bearer ${Z}`}},`/_sandbox/setup/${Q}`,mN1);if(!X.ok)throw Error(`sandbox daemon /_sandbox/setup/${Q} returned ${X.status}: ${X.body}`)}async function _60($,Z,Q){let X=await cN1(`${$}/_sandbox/orgfs-config`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:Q},"/_sandbox/orgfs-config",mN1);if(!X.ok)throw Error(`sandbox daemon /_sandbox/orgfs-config returned ${X.status}: ${X.body}`);return Ho$(X.body,"/_sandbox/orgfs-config")}function Ho$($,Z){try{return JSON.parse($)}catch(Q){throw Error(`sandbox daemon ${Z} returned a malformed JSON body: ${$.slice(0,200)}`,{cause:Q})}}async function CC0($,Z,Q,X){let Y=new Headers(X.headers);for(let K of Tw6)Y.delete(K);Y.set("authorization",`Bearer ${Z}`);let J=X.method!=="GET"&&X.method!=="HEAD",G=`${$}${Q.startsWith("/")?Q:`/${Q}`}`;return fetch(G,{method:X.method,headers:Y,body:J?X.body:void 0,redirect:"manual",signal:X.signal,duplex:J?"half":void 0})}var PF,Ew6=500,mN1=30000,Go$=25,Ko$=200,zw6=50,Tw6;var Eg=L(()=>{VC0();$8();PF=class PF extends Error{status;constructor($,Z){super(`sandbox daemon /_sandbox/config returned ${$}: ${Z}`);this.status=$;this.name="ConfigRequestError"}};Tw6=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length"]});class SC0{counted=new Set;markCounted($){this.counted.add($)}consume($){return this.counted.delete($)}}class zg{map=new Map;async run($,Z){let Q=this.map.get($);if(Q)return Q;let X=Z();this.map.set($,X);try{return await X}finally{this.map.delete($)}}}function _C0($,Z,Q){if(!$)return Q(null);if(!$.withLock)return Q($);return $.withLock(Z,Q)}function v60($){if(!$.orgId||!$.virtualMcpId||!$.branch)throw Error("composeSandboxRef: orgId, virtualMcpId and branch are all required for agent refs");return`agent:${$.orgId}:${$.virtualMcpId}:${$.branch}`}function Fo$($){if(!$.startsWith("agent:"))return"";let Z=$.split(":");return Z.length>=4?Z.slice(3).join(":"):""}import{hash as Aw6}from"crypto";function Rw6($,Z=16){return Aw6("sha256",al$($),"hex").slice(0,Z)}function c3($){let Z=Rw6($),Q=qw6(Fo$($.projectRef));return Q?`${Q}-${Z}`:`s-${Z}`}function qw6($){if(!$)return"";let Z=$.split("/").pop()??"",Q="",X=!1;for(let Y of Z.toLowerCase()){let J=Y.charCodeAt(0),G=J>=97&&J<=122,K=J>=48&&J<=57;if(!G&&!K){X||=Q.length>0;continue}if(X){if(Q.length+1>=Uo$)break;Q+="-",X=!1}if(Q+=Y,Q.length===Uo$)break}return Q}var Uo$=24;var No$=L(()=>{uF1()});function vC0($,Z){let Q=$.replace(/\/+$/,"");if(Q.includes("{handle}"))return`${Q.replace("{handle}",Z)}/`;try{let X=new URL(Q);return X.hostname=`${Z}.${X.hostname}`,`${X.toString()}/`}catch{return`${Q}/${Z}/`}}function up($){let Z=$.repo,Q=Z?{repository:{cloneUrl:Z.cloneUrl,repoName:Z.displayName??Mw6(Z.cloneUrl),...Z.branch?{branch:Z.branch}:{},submoduleCredentials:Z.submoduleCredentials??[]},repositories:($.extraRepos??[]).filter((W)=>!!W.directoryName).map((W)=>({cloneUrl:W.cloneUrl,repoName:W.directoryName,...W.branch?{branch:W.branch}:{},submoduleCredentials:W.submoduleCredentials??[]})),...Z.userName.trim()||Z.userEmail.trim()?{identity:{userName:Z.userName,userEmail:Z.userEmail}}:{}}:void 0,X=$.tenant,Y=hp({userName:X?.userName,userEmail:X?.userEmail})??void 0,J=$.packageManager?{name:$.packageManager.name,...$.packageManager.path?{path:$.packageManager.path}:{}}:void 0,G=J?{packageManager:J,runtime:$.runtime,...$.port!==void 0?{port:$.port}:{}}:void 0,K=X?.orgId;if(!Q&&!G&&!Y&&$.cloneOnly===void 0&&!K)return null;return{...Q?{git:Q}:{},...Y?{operator:Y}:{},...K?{orgId:K}:{},...$.cloneOnly!==void 0?{cloneOnly:$.cloneOnly}:{},...G?{application:G}:{}}}function Mw6($){try{let Z=new URL($);return Z.pathname.replace(/^\/+/,"").replace(/\.git$/,"")||Z.hostname}catch{return $}}var Bo$=L(()=>{lN1()});function Iw6($){try{return new URL($).username.length>0}catch{return!1}}function x60($){let Z=$.repo?.cloneUrl;if(!Z||!Iw6(Z))return null;return{git:{repository:{cloneUrl:Z}}}}var lp=L(()=>{No$();Bo$()});async function*Oo$($){let Z=$.now??(()=>Date.now()),Q=Z(),X=$.schedulingTimeoutMs??kw6,Y={pod:{},sandbox:{},events:{hasPulling:!1,hasPulled:!1},startedAt:Q},J=[],G=null,K=!1,W=(E)=>{if(K)return;if(G){let z=G;G=null,z(E)}else J.push(E)},H=()=>{if(J.length>0)return Promise.resolve(J.shift());if(K)return Promise.resolve(null);return new Promise((E)=>{G=E})},F=()=>{if(K)return;if(K=!0,G){let E=G;G=null,E(null)}},U=new AbortController,N=()=>{U.abort(),F()};if($.signal)if($.signal.aborted)U.abort(),F();else $.signal.addEventListener("abort",N,{once:!0});let B=Math.max(0,X-(Z()-Q)),D=setTimeout(()=>W("tick"),B+100),O,j=new Promise((E)=>{O=E}),w=Promise.allSettled([Sw6($.kc,$.namespace,$.claimName,U.signal,Y,W,Z,O),vw6($.kc,$.namespace,$.claimName,U.signal,Y,W),xw6($.kc,$.namespace,$.claimName,j,U.signal,Y,W,Z)]);try{let E=null,z=-1,A=Lo$(Y,X,Z);if(E=pN1(A),!iN1(A))z=Do$(A);if(yield A,iN1(A))return;while(!K){if(await H()===null)break;let T=Lo$(Y,X,Z);if(iN1(T)){let S=pN1(T);if(S!==E)E=S,yield T;return}let q=Do$(T);if(q<z)continue;let f=pN1(T);if(f!==E)E=f,z=q,yield T}}finally{if(clearTimeout(D),U.abort(),$.signal)$.signal.removeEventListener("abort",N);F(),await w.catch(()=>{})}}async function jo$($,Z=Cw6){let Q=new AbortController,X="claiming",Y,J=()=>{clearTimeout(Y),Y=setTimeout(()=>Q.abort(),Z)};try{J();for await(let G of $(Q.signal)){if(G.kind==="ready")return;if(G.kind==="failed")throw new $Y(G.message);X=G.kind,J()}}finally{clearTimeout(Y),Q.abort()}throw new Rp(`Sandbox did not become ready: no progress for ${Math.round(Z/1000)}s while ${X}`)}function Lo$($,Z,Q){let{pod:X,sandbox:Y,events:J,startedAt:G}=$;if(Y.ready)return{kind:"ready"};let K=X.containerWaitingReason;if(K==="ImagePullBackOff"||K==="ErrImagePull")return{kind:"failed",reason:"image-pull-backoff",message:"Sandbox image failed to download. The cluster may be missing pull credentials or the image tag may not exist."};if(K==="CrashLoopBackOff")return{kind:"failed",reason:"crash-loop-backoff",message:"Sandbox crashed during startup and is now in CrashLoopBackOff. Check pod logs."};if(!X.scheduled&&J.lastFailedSchedulingAt!==void 0&&Q()-G>Z)return{kind:"failed",reason:"scheduling-timeout",message:J.failedSchedulingMessage??`Pod could not be scheduled within ${Math.round(Z/1000)}s.`};if(X.containerRunning&&!X.containerReady)return{kind:"warming-daemon",since:G};if(J.hasPulling&&!J.hasPulled)return{kind:"pulling-image",since:G};if(K==="ContainerCreating"||K==="PodInitializing"||X.scheduled&&!X.containerRunning)return{kind:"starting-container",since:G};if(X.scheduledFalseReason==="Unschedulable"||J.lastFailedSchedulingAt!==void 0&&!X.scheduled)return{kind:"waiting-for-capacity",since:G,message:J.failedSchedulingMessage??X.scheduledFalseMessage,nodeClaim:J.nominatedNodeClaim};return{kind:"claiming",since:G}}function iN1($){return $.kind==="ready"||$.kind==="failed"}function Do$($){switch($.kind){case"claiming":return 0;case"waiting-for-capacity":return 1;case"pulling-image":return 2;case"starting-container":return 3;case"warming-daemon":return 4;case"ready":case"failed":return 99}}function pN1($){switch($.kind){case"claiming":case"pulling-image":case"starting-container":case"warming-daemon":return $.kind;case"waiting-for-capacity":return`waiting-for-capacity:${$.message??""}:${$.nodeClaim??""}`;case"ready":return"ready";case"failed":return`failed:${$.reason}:${$.message}`}}async function Sw6($,Z,Q,X,Y,J,G,K){let W=`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?watch=true&labelSelector=${encodeURIComponent(`${Vw6}=${Q}`)}`;return xC0({kc:$,path:W,signal:X,label:`pod/${Q}`,onEvent:(H)=>{if(H.type!=="ADDED"&&H.type!=="MODIFIED")return;let F=H.object;if(F.metadata?.name)K(F.metadata.name);_w6(F,Y,G),J("pod")}})}function _w6($,Z,Q){let Y=($.status?.conditions??[]).find((G)=>G.type==="PodScheduled");if(Y?.status==="True")Z.pod.scheduled=!0,Z.pod.scheduledFalseReason=void 0,Z.pod.scheduledFalseMessage=void 0;else if(Y?.status==="False")Z.pod.scheduled=!1,Z.pod.scheduledFalseReason=Y.reason,Z.pod.scheduledFalseMessage=Y.message;let J=($.status?.containerStatuses??[]).find((G)=>G.name===Q7.MAIN_CONTAINER_NAME);if(J)Z.pod.containerWaitingReason=J.state?.waiting?.reason,Z.pod.containerRunning=!!J.state?.running,Z.pod.containerReady=J.ready===!0}async function vw6($,Z,Q,X,Y,J){let G=`/apis/${Q7.CLAIM_API_GROUP}/${Q7.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(Z)}/${Q7.CLAIM_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${Q}`)}`;return xC0({kc:$,path:G,signal:X,label:`sandboxclaim/${Q}`,onEvent:(K)=>{if(K.type!=="ADDED"&&K.type!=="MODIFIED")return;let H=K.object.status?.conditions?.find((F)=>F.type==="Ready");if(!H)return;if(H.status==="True")Y.sandbox.ready=!0,Y.sandbox.notReadyReason=void 0,Y.sandbox.notReadyMessage=void 0;else Y.sandbox.ready=!1,Y.sandbox.notReadyReason=H.reason,Y.sandbox.notReadyMessage=H.message;J("sandbox")}})}async function xw6($,Z,Q,X,Y,J,G,K){let W=await Promise.race([X,new Promise((F)=>{if(Y.aborted){F(Q);return}Y.addEventListener("abort",()=>F(Q),{once:!0})})]);if(Y.aborted)return;let H=`/api/v1/namespaces/${encodeURIComponent(Z)}/events?watch=true&fieldSelector=${encodeURIComponent(`involvedObject.name=${W},involvedObject.kind=Pod`)}`;return xC0({kc:$,path:H,signal:Y,label:`events/${Q}`,onEvent:(F)=>{if(F.type!=="ADDED"&&F.type!=="MODIFIED")return;let U=F.object,N=U.reason;if(!N)return;switch(N){case"Pulling":J.events.hasPulling=!0;break;case"Pulled":J.events.hasPulling=!0,J.events.hasPulled=!0;break;case"FailedScheduling":J.events.lastFailedSchedulingAt=K(),J.events.failedSchedulingMessage=U.message;break;case"Nominated":{let B=U.message?.match(/nodeclaim\/([\w-]+)/);if(B)J.events.nominatedNodeClaim=B[1];break}default:return}G("event")}})}async function wo$($){let{kc:Z,namespace:Q,labelSelector:X,signal:Y,onDelete:J}=$,G=`/apis/${Q7.CLAIM_API_GROUP}/${Q7.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(Q)}/${Q7.CLAIM_PLURAL}?watch=true&labelSelector=${encodeURIComponent(X)}`;return xC0({kc:Z,path:G,signal:Y,label:"sandboxclaim-reaper",onEvent:(K)=>{if(K.type!=="DELETED")return;let W=K.object.metadata?.name;if(W)J(W)}})}async function xC0($){let{kc:Z,path:Q,signal:X,label:Y,onEvent:J}=$,G=0;while(!X.aborted){try{let W=await AW(Z,{method:"GET",path:Q,signal:X,headers:{accept:"application/json"},stream:!0});if(!W.ok||!W.body){try{await W.body?.cancel()}catch{}if(W.status===401||W.status===403){console.warn(`[lifecycle-watcher] ${Y} stopped: watch denied (${W.status} ${W.statusText}). `+"The kubeconfig in use cannot watch SandboxClaims \u2014 if you are running locally, "+"this provider should not be active (check STUDIO_AGENT_SANDBOX_ENABLED).");return}throw Error(`watch handshake failed: ${W.status} ${W.statusText}`)}G=0;for await(let H of kc$(W.body)){if(X.aborted)return;try{J(H)}catch(F){console.warn(`[lifecycle-watcher] ${Y} onEvent threw: ${F instanceof Error?F.message:String(F)}`)}}}catch(W){if(X.aborted)return;let H=W instanceof Error?W.message:String(W);console.warn(`[lifecycle-watcher] ${Y} watch ended: ${H}`)}if(X.aborted)return;let K=q7(5000,250,G,2,0);G+=1,await $$(K,{signal:X}).catch(()=>{})}}var Vw6="studio.decocms.com/sandbox-handle",kw6=300000,Cw6=600000;var Eo$=L(()=>{$8();F60();Uj0()});import{createHash as fw6}from"crypto";import{z as JJ}from"zod";function mN($){let Z;try{Z=new URL($.trim())}catch{return null}if(Z.protocol!=="https:"||Z.search||Z.hash)return null;let Q=Z.pathname.replace(/\/+$/,"").replace(/\.git$/,"").replace(/\/+$/,"");return Q?`https://${Z.host.toLowerCase()}${Q}`:null}function f60($){return mN($)?.toLowerCase()??null}function uw6($){let Z=new Set;for(let Q of $){let X=`${f60(Q.repoUrl)??Q.repoUrl}#${Q.branch}`;if(Z.has(X))return Q;Z.add(X)}return null}function zo$($){return $.reduce((Z,Q)=>Z+Q.replicas,0)}function To$($,Z){if(Z.warmPoolName)return Z.warmPoolName;let Q=fw6("sha256").update(`${Z.repoUrl}#${Z.branch}`).digest("hex").slice(0,8);return`${$}-${Q}`}function Ao$($){return Math.max(0,$.size-zo$($.repos))}function cp($){return $.flatMap((Z)=>Z.repos.map((Q)=>({pool:Z,repo:Q,warmPoolName:To$(Z.name,Q)})))}function lw6($,Z){return Mo$(void 0,$,!0,Z)}function Ro$($,{templateName:Z}){let Q=lw6(Z,$.image),X=(Y,J)=>({apiVersion:`${Q7.CLAIM_API_GROUP}/${Q7.CLAIM_API_VERSION}`,kind:"SandboxWarmPool",metadata:{name:Y,labels:{[cw6]:$.name}},spec:{replicas:J,updateStrategy:{type:"OnReplenish"},sandboxTemplateRef:{name:Q}}});return[...$.repos.map((Y)=>X(To$($.name,Y),Y.replicas)),X($.name,Ao$($))]}function bC0($){return $.tenant?.orgId}function tN1($,Z){if(!Z.tenant)return null;let Q=$.filter((J)=>J.tenant===Z.tenant&&J.image===Z.image),X=Z.cloneUrl?f60(Z.cloneUrl):null;if(X){let J=cp(Q).filter((K)=>f60(K.repo.repoUrl)===X),G=J.find((K)=>K.repo.branch===Z.branch)??J[0];if(G)return G}let Y=Q.find((J)=>Ao$(J)>0);return Y?{pool:Y,repo:null,warmPoolName:Y.name}:null}function qo$($,Z,Q){return $?.warmPoolName??(Z?Q:"none")}function Mo$($,Z,Q=!1,X){let Y=X&&X!=="default"?`-${X}`:"";return`${Z}${Y}${$==="harness-run"||Q?"-medium":""}`}async function oN1($){let Z=Mo$($.purpose,$.templateName,$.tenantPool,$.sandboxImage);if(Z===$.templateName)return{name:Z,probes:$.probes};let Q=$.probes[Z]??null,X=Q!==null&&$.now-Q.checkedAt<$.ttlMs?Q:{checkedAt:$.now,present:await $.exists(Z)},Y={...$.probes,[Z]:X};if(X.present)return{name:Z,probes:Y};if(Q?.present!==!1)$.onAbsent?.(Z);if($.sandboxImage&&$.sandboxImage!=="default")return oN1({...$,sandboxImage:void 0,probes:Y});return{name:$.templateName,probes:Y}}function rN1($,Z,Q){let X=f60(Z);if(!X)return[];let Y=Q.replace(/^refs\/heads\//,"");return cp($).filter(({repo:J})=>f60(J.repoUrl)===X&&J.branch===Y)}class aN1{source;dirty=new Set;pods=new Map;known=new Map;constructor($){this.source=$}pools(){return this.source()}resolve($){return tN1(this.pools(),$)}markDirty($,Z){let Q=rN1(this.pools(),$,Z).map((X)=>X.warmPoolName);for(let X of Q)this.dirty.add(X);return Q}takeDirty($){return this.dirty.delete($)}pod($){return this.pods.get($)}setPod($,Z){this.pods.set($,Z)}retainPods($,Z){for(let[Q,X]of this.pods)if(X.pool===$&&!Z.has(Q))this.pods.delete(Q)}retain($){let Z=new Map($.map((X)=>[X.warmPoolName,X])),Q=[...this.known.values()].filter((X)=>!Z.has(X.warmPoolName));for(let X of this.dirty)if(!Z.has(X))this.dirty.delete(X);for(let[X,Y]of this.pods)if(!Z.has(Y.pool))this.pods.delete(X);return this.known=Z,Q}}var bw6=54,yw6,gw6=2048,hw6,b60,fC0,nN1,Po$,cw6="studio.decocms.com/tenant-pool";var y60=L(()=>{r4();F60();yw6=/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/;hw6=JJ.object({runtime:JJ.enum(["node","bun","deno"]).default("node"),packageManager:JJ.enum(["npm","pnpm","yarn","bun","deno"]).optional(),packageManagerPath:JJ.string().optional(),devPort:JJ.number().int().positive().optional()}).default({runtime:"node"}),b60=JJ.object({repoUrl:JJ.string().max(gw6).transform(($,Z)=>{let Q=mN($);if(Q)return Q;return Z.addIssue({code:"custom",message:"repoUrl must be an https clone URL"}),JJ.NEVER}),branch:JJ.string().min(1).default("main"),workload:hw6,replicas:JJ.number().int().min(1)});fC0=class fC0 extends Error{poolName;size;allocated;constructor($,Z,Q){super(`pool ${$}: repos take ${Q} replicas, more than its size ${Z}`);this.poolName=$;this.size=Z;this.allocated=Q;this.name="TenantPoolCapacityError"}};nN1=JJ.object({name:JJ.string().max(bw6).regex(yw6,"pool name must be a DNS label (lowercase alphanumeric and '-')"),tenant:JJ.string().min(1).max(512),size:JJ.number().int().min(1),image:PN.default("default")}),Po$=nN1.extend({repos:JJ.array(b60).default([])}).superRefine(($,Z)=>{let Q=uw6($.repos);if(Q)Z.addIssue({code:"custom",path:["repos"],message:`duplicate repo allocation ${Q.repoUrl}#${Q.branch}`});let X=zo$($.repos);if(X>$.size)Z.addIssue({code:"custom",path:["repos"],message:new fC0($.name,$.size,X).message})})});async function Io$($,Z,Q){let X=new Map;for(let Y of $){let J=Z(Y);if(!J)continue;let G=X.get(J);if(G)G.push(Y);else X.set(J,[Y])}await Promise.allSettled([...X.values()].map(async(Y)=>{for(let J of Y)await Q(J).catch(()=>{})}))}function mw6($){try{let Z=new URL($);if(Z.hostname.toLowerCase()!=="github.com")return null;let[Q,X]=Z.pathname.replace(/^\/+/,"").split("/"),Y=X?.replace(/\.git$/,"");return Q&&Y?`${Q}/${Y}`.toLowerCase():null}catch{return null}}function Vo$($){if($.repositoryId)return{repositoryId:$.repositoryId};let Z=$.connectionId?mw6($.cloneUrl):null;return $.connectionId&&Z?{connectionId:$.connectionId,repo:Z}:null}var ko$=L(()=>{y60()});async function mp($,Z,Q,X){let Y=(G)=>CC0(G.url,G.token,Z,Q),J=!(Q.body instanceof ReadableStream);try{let G=await Y($);if(G.status!==401||!J)return G;let K=await X.unauthorized();if(!K)return G;return await G.body?.cancel().catch(()=>{}),await Y(K)}catch(G){if(!J)throw G;let K=await X.unreachable();if(!K)throw G;return Y(K)}}var yC0=L(()=>{Eg()});function _o$($,Z){return new Response(JSON.stringify(Z),{status:$,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function Co$($){let Z=new Headers;for(let[Q,X]of $.headers.entries())if(!iw6.includes(Q.toLowerCase()))Z.set(Q,X);return new Response($.body,{status:$.status,statusText:$.statusText,headers:Z})}function So$($,Z){let Q=_o$($,{error:Z});return Q.headers.set("x-sandbox-preview-not-ready","1"),Q}async function ip($,Z,Q){let X=await Z.base();if(!X)return So$(404,"sandbox not found");let Y=new URL($.url);if((Y.pathname==="/_sandbox"||Y.pathname.startsWith("/_sandbox/"))&&$.method!=="GET")return _o$(404,{error:"not found"});let G=(F)=>`${F}${Y.pathname}${Y.search}`,K=new Headers($.headers);for(let F of dw6)K.delete(F);let W=$.method!=="GET"&&$.method!=="HEAD",H={method:$.method,headers:K,body:W?$.body:void 0,redirect:"manual",signal:$.signal,duplex:W?"half":void 0};try{return Co$(await fetch(G(X),H))}catch(F){let U=`${X}${Y.pathname}`;if(console.warn(`[${Q}] preview fetch to ${U} failed: ${F instanceof Error?F.message:String(F)}`),Z.invalidate(),$.method==="GET"||$.method==="HEAD"){let N=await Z.retryBase();if(N)try{return Co$(await fetch(G(N),H))}catch(B){console.warn(`[${Q}] preview fetch retry to ${U} failed: ${B instanceof Error?B.message:String(B)}`)}}return So$(502,"sandbox daemon unreachable")}}var dp="x-sandbox-preview-not-ready",dw6,iw6;var gC0=L(()=>{dw6=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length","upgrade"],iw6=["connection","keep-alive","transfer-encoding","content-encoding","content-length"]});import{createHash as pw6,randomBytes as nw6,randomUUID as vo$}from"crypto";import*as uo$ from"net";import{PassThrough as tw6}from"stream";function xo$($){if($ instanceof Error)return $.message;if($&&typeof $==="object"){let Z=$;if(Z.error instanceof Error)return Z.error.message;if(typeof Z.message==="string"&&Z.message)return Z.message}return String($)}function yo$($){return{pool:$.warmPoolName,org:$.pool.tenant}}class YB1{records=new Map;inflight=new zg;activeGauge=new SC0;stateStore;previewUrlPattern;kubeConfig;capacityProbe;portForward;namespace;sandboxTemplateName;envName;tokenGenerator;idleTtlMs;metrics;previewGateway;sentinelToken;mintCloneUrl;mintPoolCloneUrl;mintOrgFsConfig;forwardPort;daemonAddress;persistCredentials;tenantPools;tenantPoolRefreshMs;templateProbes={};closed=!1;claimWatchAbort=new AbortController;constructor($={}){this.stateStore=$.stateStore??null,this.previewUrlPattern=$.previewUrlPattern??null,this.kubeConfig=$.kubeConfig??KE6(),this.portForward=new RN1(this.kubeConfig),this.namespace=$.namespace??ow6,this.sandboxTemplateName=$.sandboxTemplateName??rw6,this.envName=NE6($.envName),this.tokenGenerator=$.tokenGenerator??(()=>nw6(sw6).toString("hex")),this.idleTtlMs=$.idleTtlMs??$E6,this.metrics=$.meter?GE6($.meter):null,this.previewGateway=$.previewGateway&&$.previewUrlPattern?{...$.previewGateway}:null;let Z=$.sentinelToken?.trim()??"";this.sentinelToken=Z.length>0?Z:null,this.mintCloneUrl=$.mintCloneUrl,this.mintPoolCloneUrl=$.mintPoolCloneUrl,this.mintOrgFsConfig=$.mintOrgFsConfig,this.forwardPort=$.forwardPort,this.daemonAddress=$.daemonAddress??"forward",this.persistCredentials=$.persistCredentials??!0;let Q=$.tenantPools;if(this.tenantPools=this.sentinelToken===null?null:new aN1(typeof Q==="function"?Q:()=>Q??[]),this.sentinelToken===null&&(typeof Q==="function"||(Q?.length??0)>0))console.warn(`[${V6}] tenant pools configured without a sentinel token \u2014 ignoring them (warm-pool mode is off)`);this.tenantPoolRefreshMs=$.tenantPoolRefreshMs??QE6,this.startClaimReaper(),this.startCredentialRefresher(),this.startTenantPoolReconciler()}startClaimReaper(){let $=["app.kubernetes.io/managed-by=studio","app.kubernetes.io/name=studio-sandbox",...this.envName?[`${GJ.env}=${this.envName}`]:[]].join(",");wo$({kc:this.kubeConfig,namespace:this.namespace,labelSelector:$,signal:this.claimWatchAbort.signal,onDelete:(Z)=>this.invalidateRecord(Z)})}async ensure($,Z={}){let Q=c3($);if(Q.startsWith("s-"))throw Error(`ensure: projectRef has no slug source: ${$.projectRef}`);return this.inflight.run(Q,()=>_C0(this.stateStore,$,(X)=>this.ensureLocked($,Q,Z,X)))}async delete($){let Z=await this.getRecord($);if(this.records.delete($),Z)this.dropRecord(Z);if(await this.deleteHttpRouteIfManaged($).catch((Q)=>{console.warn(`[${V6}] HTTPRoute delete failed for ${$}: ${Q instanceof Error?Q.message:String(Q)}`)}),await iR(this.kubeConfig,this.namespace,$),this.stateStore)if(Z)await this.stateStore.delete(Z.id);else await this.stateStore.deleteByHandle($)}lastTermination($){return zc$(this.kubeConfig,this.namespace,GJ.sandboxHandle,$,Q7.MAIN_CONTAINER_NAME)}async alive($){return await gD(this.kubeConfig,this.namespace,$)!==void 0}watchClaimLifecycle($,Z){return Oo$({kc:this.kubeConfig,namespace:this.namespace,claimName:$,signal:Z})}hasSchedulableCapacity(){return this.capacityProbe??=Sc$(this.kubeConfig,this.namespace),this.capacityProbe()}async getPreviewUrl($){let Z=await this.getRecord($);if(!Z)return null;return this.composePreviewUrl(Z)}async proxyDaemonRequest($,Z,Q){let X=await this.getRecord($);if(!X&&this.previewUrlPattern&&this.stateStore){let W=await this.stateStore.getByHandle($),H=W?.state,F=H?.token;if(W&&F){let N=`http://${H?.adoptedSandboxName??$}.${this.namespace}.svc.cluster.local:${dN}`;try{let B=await CC0(N,F,Z,Q);if(B.status!==404)return B;try{await B.body?.cancel()}catch{}}catch{}}}if(!X)X=await this.resurrectByHandle($);if(!X)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let Y=X,J=performance.now(),G=0,K=(W)=>{return Y=W,{url:W.daemonUrl,token:W.token}};try{let W=await mp(K(X),Z,Q,{unauthorized:async()=>{this.invalidateRecord($);let H=await this.getRecord($).catch(()=>null)??await this.resurrectByHandle($).catch(()=>null);return H?K(H):null},unreachable:async()=>{this.invalidateRecord($);let H=await this.resurrectByHandle($)??await this.getRecord($).catch(()=>null);return H?K(H):null}});return G=W.status,W}finally{this.recordProxyDuration("daemon",G,Y,performance.now()-J)}}async adoptLiveClaim($,Z){if(this.records.has(Z))return!0;let Q=await gD(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!Q||Q.metadata?.deletionTimestamp)return!1;return await this.inflight.run(Z,async()=>{let Y=this.records.get(Z);if(Y)return this.toSandbox(Y);let J=await this.adopt($,Z,Q);if(!J)throw Error(`cannot adopt live claim ${Z}`);return _C0(this.stateStore,$,(G)=>this.finish(J,G,!0,!0,"adopt"))}).catch(()=>null)!=null}async resolvePreviewUpstreamUrl($){if(this.previewUrlPattern)return`http://${await this.resolveServiceNameForHandle($)}.${this.namespace}.svc.cluster.local:${dN}`;let Z=await this.getRecord($);if(Z)return Z.daemonUrl;let Q=await this.resurrectByHandle($);return Q?Q.daemonUrl:null}async daemonEndpoint($){let Z=await this.getRecord($)??await this.resurrectByHandle($);if(!Z)return null;return{url:this.daemonAddress==="service"?`http://${Z.adoptedSandboxName}.${this.namespace}.svc.cluster.local:${dN}`:Z.daemonUrl,token:Z.token}}listSandboxes(){return[...this.records.values()].map(($)=>{let Z=$.ensureOpts,Q=Z?.tenant;return{handle:$.handle,tenant:Q?{orgId:Q.orgId,userId:Q.userId}:null,repos:[Z?.repo,...Z?.extraRepos??[]].filter((X)=>X!==void 0).map(Vo$).filter((X)=>X!==null),orgFs:Boolean(Z?.orgFsConfigJson)||$.orgFsRedacted===!0}})}async resolveServiceNameForHandle($){let Z=this.records.get($);if(Z)return Z.adoptedSandboxName;if(this.stateStore){let X=(await this.stateStore.getByHandle($).catch(()=>null))?.state?.adoptedSandboxName;if(X)return X}return $}async proxyPreviewRequest($,Z){let Q=performance.now(),X=this.records.get($)??null,Y=0;try{let J=await ip(Z,{base:()=>this.resolvePreviewUpstreamUrl($),invalidate:()=>this.invalidateRecord($),retryBase:async()=>{return await this.resurrectByHandle($).catch(()=>null)?this.resolvePreviewUpstreamUrl($):null}},V6);return Y=J.status,J}finally{this.recordProxyDuration("preview",Y,X,performance.now()-Q,$)}}async ensureLocked($,Z,Q,X){if(Q.image)console.warn(`[${V6}] opts.image ignored (template ${this.sandboxTemplateName} pins image): got ${Q.image}`);if(X){let G=await X.get($);if(G){let K=await this.rehydrate($,Z,G);if(K)return await this.refreshDaemonGitCredential(K,Q),await this.relayOrgFsConfig(K.daemonUrl,K.token,Q.orgFsConfigJson),this.finish(K,X,!1,!0,"resume");await X.delete($)}}let Y=await gD(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(Y)if(Y.metadata?.deletionTimestamp)await B60(this.kubeConfig,this.namespace,Z).catch((G)=>{console.warn(`[${V6}] wait for terminating claim ${Z} failed: ${G instanceof Error?G.message:String(G)}`)});else if(!sN1(Y)){let G=await this.join($,Z,Q,Y).catch((K)=>{return console.warn(`[${V6}] join of starting claim ${Z} failed, recreating: ${K instanceof Error?K.message:String(K)}`),null});if(G)return this.finish(G,X,!0,!0,"adopt");await iR(this.kubeConfig,this.namespace,Z).catch(()=>{}),await B60(this.kubeConfig,this.namespace,Z).catch((K)=>{console.warn(`[${V6}] wait for deleted claim ${Z} failed: ${K instanceof Error?K.message:String(K)}`)})}else{let G=await this.adopt($,Z,Y).catch((K)=>{return console.warn(`[${V6}] adopt ${Z} failed, recreating: ${K instanceof Error?K.message:String(K)}`),null});if(G)return await this.refreshDaemonGitCredential(G,Q),await this.relayOrgFsConfig(G.daemonUrl,G.token,Q.orgFsConfigJson),this.finish(G,X,!0,!0,"adopt");await iR(this.kubeConfig,this.namespace,Z).catch(()=>{}),await B60(this.kubeConfig,this.namespace,Z).catch((K)=>{console.warn(`[${V6}] wait for deleted claim ${Z} failed: ${K instanceof Error?K.message:String(K)}`)})}let J=await this.provision($,Z,Q);return this.finish(J,X,!0,!1,"fresh")}async finish($,Z,Q,X,Y){let J=this.records.get($.handle),G=J!==void 0;if(J&&J.daemonForward!==$.daemonForward)this.closeForwarder(J.daemonForward);if(this.records.set($.handle,$),Q)await this.persist(Z,$);if(X)await Fj0(this.kubeConfig,this.namespace,$.handle,this.computeShutdownTime()).catch((K)=>console.warn(`[${V6}] TTL refresh failed for ${$.handle}: ${K instanceof Error?K.message:String(K)}`));if(this.metrics){let K=ZB1($.tenant);if(this.metrics.ensureOutcome.add(1,{...K,outcome:Y}),!G)this.metrics.active.add(1,K),this.activeGauge.markCounted($.handle)}return this.toSandbox($)}buildEnvMap($,Z){let Q={},X=[];for(let[Y,J]of Object.entries($.env??{}))if(ew6.has(Y))X.push(Y);else Q[Y]=J;if(X.length>0)console.warn(`[${V6}] opts.env keys overlap reserved bootstrap names and were dropped: ${X.join(",")}`);return{...Q,DAEMON_TOKEN:Z.token,DAEMON_BOOT_ID:Z.daemonBootId,APP_ROOT:Z.workdir,PROXY_PORT:String(dN)}}async resolveTemplateName($,Z,Q){let{name:X,probes:Y}=await oN1({purpose:$,tenantPool:Z,...Q?{sandboxImage:Q}:{},templateName:this.sandboxTemplateName,probes:this.templateProbes,now:Date.now(),ttlMs:aw6,exists:(J)=>Oc$(this.kubeConfig,this.namespace,J),onAbsent:(J)=>console.warn(`[${V6}] SandboxTemplate ${J} not found (or not readable) \u2014 this claim falls back to a template without that suffix. Upgrade the sandbox-env chart to the version that renders it.`)});return this.templateProbes=Y,X}buildClaim($,Z,Q,X,Y){let J=this.sentinelToken!==null,G=J?[]:Object.entries(this.buildEnvMap(Z,Q)).sort(([H],[F])=>H<F?-1:H>F?1:0).map(([H,F])=>({name:H,value:F})),K=DE6(Z),W=Object.keys(K).length>0;return{apiVersion:`${Q7.CLAIM_API_GROUP}/${Q7.CLAIM_API_VERSION}`,kind:"SandboxClaim",metadata:{name:$,namespace:this.namespace,labels:{"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[GJ.env]:this.envName}:{},...$B1(Z.tenant)},...W?{annotations:K}:{}},spec:{sandboxTemplateRef:{name:Y},additionalPodMetadata:{labels:$B1(Z.tenant,{[GJ.role]:"claimed",[GJ.sandboxHandle]:$,...this.envName?{[GJ.env]:this.envName}:{}}),...W?{annotations:K}:{}},env:G,warmpool:qo$(X,J,Y),lifecycle:{shutdownPolicy:"Delete",shutdownTime:this.computeShutdownTime()}}}}async provision($,Z,Q){let X=this.tokenGenerator(),Y=vo$(),J=hC0,G=this.claimTenantPoolBinding(Q),K=this.buildClaim(Z,Q,{token:X,daemonBootId:Y,workdir:J},G,await this.resolveTemplateName(Q.purpose,G!==null,Q.sandboxImage));try{await iF1(this.kubeConfig,this.namespace,K)}catch(W){if(W instanceof H60)await B60(this.kubeConfig,this.namespace,Z),await iF1(this.kubeConfig,this.namespace,K);else throw W}return this.bind($,Z,Q,G,{token:X,daemonBootId:Y,workdir:J})}claimTenantPoolBinding($){return this.tenantPools?.resolve({tenant:bC0($),image:$.sandboxImage??"default",cloneUrl:$.repo?.cloneUrl,branch:$.repo?.branch})??null}async bind($,Z,Q,X,{token:Y,daemonBootId:J,workdir:G}){let K;try{K=await jc$(this.kubeConfig,this.namespace,Z),await jo$((B)=>this.watchClaimLifecycle(Z,B))}catch(B){throw await iR(this.kubeConfig,this.namespace,Z).catch(()=>{}),B}try{await this.ensureServicePortForAdoptedSandbox(K),await this.ensureHttpRouteForHandle(Z,K,Q.tenant??null)}catch(B){throw await iR(this.kubeConfig,this.namespace,Z).catch(()=>{}),B}let W=await this.openForwarder(K,dN,Z),H=`http://127.0.0.1:${W.localPort}`,F=X?.repo!=null&&K!==Z,U=this.workloadConfigPayload(Q,F),N=J;try{if(await dN1(H),this.sentinelToken!==null){let B=await kC0(H);if(B)N=B.bootId;try{await cN(H,this.sentinelToken,U??{},{rotateToken:Y})}catch(D){if(D instanceof PF&&D.status===401)console.warn(`[${V6}] sentinel rejected by adopted pod (handle=${Z}, sandbox=${K}): pod belongs to another claim; tearing down and reprovisioning`);throw D}}else if(U)await cN(H,Y,U);await this.relayOrgFsConfig(H,Y,Q.orgFsConfigJson)}catch(B){throw this.closeForwarder(W),await this.deleteHttpRouteIfManaged(Z).catch(()=>{}),await iR(this.kubeConfig,this.namespace,Z).catch(()=>{}),B}return{id:$,handle:Z,adoptedSandboxName:K,token:Y,workdir:G,daemonUrl:H,daemonForward:W,workload:Q.workload??null,daemonBootId:N,tenant:Q.tenant??null,tenantPoolPodBound:F,ensureOpts:PE6(Q)}}workloadConfigPayload($,Z){return up({runtime:$?.workload?.runtime??"node",packageManager:$?.workload?.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:$?.repo??null,extraRepos:$?.extraRepos??[],port:$?.workload?.devPort??fo$,tenant:$?.tenant??void 0,...$?{cloneOnly:$.cloneOnly===!0&&!Z}:{}})}async relayOrgFsConfig($,Z,Q){if(!Q)return;await _60($,Z,Q).catch((X)=>console.warn("[org-fs] sidecar config relay failed",X))}async refreshDaemonGitCredential($,Z){let Q=x60(Z);if(!Q)return;try{await cN($.daemonUrl,$.token,Q)}catch(X){console.warn(`[${V6}] git credential refresh failed for ${$.handle}: ${X instanceof Error?X.message:String(X)}`)}}async withFreshCloneUrl($,Z={}){if(!this.mintCloneUrl)return $;try{let Q=await this.mintCloneUrl($,Z);if(!Q)return $;let{credentialExpiresAt:X,...Y}=$;return{...Y,cloneUrl:Q}}catch(Q){return console.warn(`[${V6}] clone credential re-mint failed: ${Q instanceof Error?Q.message:String(Q)}`),$}}async withFreshCredentials($,Z=!1){return{...$,...$.repo?{repo:await this.withFreshCloneUrl($.repo,{tenant:$.tenant})}:{},...$.orgFsConfigJson||Z?{orgFsConfigJson:await EE6($,this.mintOrgFsConfig)}:{}}}startCredentialRefresher(){if(!this.mintCloneUrl)return;let{signal:$}=this.claimWatchAbort;(async()=>{while(!$.aborted){if(await $$(XE6,{signal:$}).catch(()=>{}),$.aborted)break;try{await this.refreshAllGitCredentials()}catch(Z){console.warn(`[${V6}] periodic credential refresh failed: ${Z instanceof Error?Z.message:String(Z)}`)}}})()}startTenantPoolReconciler(){let $=this.tenantPools;if(!$)return;let{signal:Z}=this.claimWatchAbort;(async()=>{while(!Z.aborted){try{await this.reconcileTenantPools($)}catch(Q){console.warn(`[${V6}] tenant pool reconcile failed: ${Q instanceof Error?Q.message:String(Q)}`)}await $$(ZE6,{signal:Z}).catch(()=>{})}})()}listTenantPools(){return this.tenantPools?.pools()??[]}markTenantPoolsDirty($,Z){return Promise.resolve(this.tenantPools?.markDirty($,Z)??[])}async reconcileTenantPools($){let Z=cp($.pools());for(let Q of $.retain(Z))this.recordPoolGone(Q);for(let Q of Z){let X=Q.warmPoolName,Y=await wc$(this.kubeConfig,this.namespace,X);if(Y===null){console.warn(`[${V6}] tenant pool ${X}: no SandboxWarmPool (or no selector yet) in ${this.namespace}`);continue}let J=$.takeDirty(X),G=Y.filter((K)=>!K.labels[GJ.sandboxHandle]);$.retainPods(X,new Set(Y.map((K)=>K.uid)));for(let K of G){if(this.claimWatchAbort.signal.aborted)return;await this.warmPoolPod($,Q,K,J)}this.recordPoolDepth($,Q,Y,G)}}recordPoolGone($){let Z=yo$($);for(let Q of["ready","bound","pending","failed"])this.metrics?.poolPods.record(0,{...Z,state:Q})}recordPoolDepth($,Z,Q,X){let Y=this.metrics?.poolPods;if(!Y)return;let J=0,G=0;for(let W of X){let H=$.pod(W.uid);if(!H)continue;if(H.failures>=uC0)G++;else if(H.lastConfigAt>0)J++}let K=yo$(Z);Y.record(J,{...K,state:"ready"}),Y.record(Q.length-X.length,{...K,state:"bound"}),Y.record(X.length-J-G,{...K,state:"pending"}),Y.record(G,{...K,state:"failed"})}async warmPoolPod($,Z,Q,X){let Y=Z.warmPoolName,{workload:J}=Z.repo,G=$.pod(Q.uid);if(G&&G.failures>=uC0){if(Date.now()-G.lastFailureAt<bo$)return;$.setPod(Q.uid,{...G,failures:0})}let K=X||G!==void 0&&Date.now()-G.lastConfigAt>=this.tenantPoolRefreshMs;if(G&&!K)return;let W=await this.allocationCloneUrl(Z);if(!W){this.recordPoolFailure($,Q,Y,"clone credential mint failed");return}let H={cloneUrl:W,branch:Z.repo.branch,userName:"",userEmail:""},F=await this.openForwarder(Q.name,dN,Q.name).catch(()=>null);if(!F){this.recordPoolFailure($,Q,Y,"port-forward failed");return}let U=`http://127.0.0.1:${F.localPort}`;try{await dN1(U);let N=this.sentinelToken;if(!N)return;if(!await this.isPoolPodUnbound(Q))return;let B=up({runtime:J.runtime,packageManager:J.packageManager?{name:J.packageManager,...J.packageManagerPath?{path:J.packageManagerPath}:{}}:null,repo:H,port:J.devPort??fo$})??{},{transition:D}=await cN(U,N,B);if(K&&D!=="bootstrap"&&await this.isPoolPodUnbound(Q))await Wo$(U,N,"clone");$.setPod(Q.uid,{pool:Y,lastConfigAt:Date.now(),lastFailureAt:0,failures:0}),console.log(`[${V6}] tenant pool ${Y}: warmed ${Q.name} (${D})`)}catch(N){this.recordPoolFailure($,Q,Y,N instanceof Error?N.message:String(N))}finally{this.closeForwarder(F)}}async allocationCloneUrl({pool:$,repo:Z}){if(!this.mintPoolCloneUrl)return`${Z.repoUrl}.git`;try{return await this.mintPoolCloneUrl({tenant:$.tenant,repoUrl:Z.repoUrl,branch:Z.branch})}catch(Q){return console.warn(`[${V6}] tenant pool clone credential mint failed: ${Q instanceof Error?Q.message:String(Q)}`),null}}isPoolPodUnbound($){return Ec$(this.kubeConfig,this.namespace,$.name,GJ.sandboxHandle)}recordPoolFailure($,Z,Q,X){let Y=$.pod(Z.uid),J=(Y?.failures??0)+1;$.setPod(Z.uid,{pool:Q,lastConfigAt:Y?.lastConfigAt??0,lastFailureAt:Date.now(),failures:J});let G=J>=uC0?` \u2014 backing off ${bo$/60000}min`:"";console.warn(`[${V6}] tenant pool ${Q}: warming ${Z.name} failed (${J}/${uC0})${G}: ${X}`)}async refreshAllGitCredentials(){await Io$(this.records.values(),($)=>$.ensureOpts?.repo?.connectionId,async($)=>{if(this.claimWatchAbort.signal.aborted)return;let Z=$.ensureOpts?.repo;if(!Z)return;try{let Q=await this.withFreshCloneUrl(Z,{bufferMs:YE6,tenant:$.ensureOpts?.tenant});await this.refreshDaemonGitCredential($,{...$.ensureOpts,repo:Q}),$.ensureOpts={...$.ensureOpts,repo:Q}}catch(Q){throw console.warn(`[${V6}] git credential refresh failed for ${$.handle}: ${Q instanceof Error?Q.message:String(Q)}`),Q}})}async rebootstrapDaemon($,Z,Q){if(this.sentinelToken===null)return!1;let X=this.workloadConfigPayload(Q,!1)??{};try{return await cN($,this.sentinelToken,X,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,Q?.orgFsConfigJson),!0}catch(Y){if(Y instanceof PF&&Y.status===401)try{return await cN($,Z,X,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,Q?.orgFsConfigJson),!0}catch(J){return console.warn(`[${V6}] re-bootstrap retry with claim token failed: ${J instanceof Error?J.message:String(J)}`),!1}return console.warn(`[${V6}] re-bootstrap failed: ${Y instanceof Error?Y.message:String(Y)}`),!1}}async ensureServicePortForAdoptedSandbox($){if(!this.previewGateway||!this.previewUrlPattern)return;await Vc$(this.kubeConfig,this.namespace,$,{name:"daemon",port:dN,targetPort:dN})}async ensureHttpRouteForHandle($,Z,Q){if(!this.previewGateway||!this.previewUrlPattern)return;let X=TE6(this.previewUrlPattern,$);if(!X)throw new $Y(`Unable to derive preview hostname for ${$} from pattern: ${this.previewUrlPattern}`);let Y={apiVersion:`${nF1.API_GROUP}/${nF1.API_VERSION}`,kind:"HTTPRoute",metadata:{name:$,namespace:this.namespace,labels:$B1(Q??void 0,{[GJ.role]:"claimed",[GJ.sandboxHandle]:$,"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[GJ.env]:this.envName}:{}})},spec:{parentRefs:[{kind:"Gateway",group:"gateway.networking.k8s.io",name:this.previewGateway.name,namespace:this.previewGateway.namespace}],hostnames:[X],rules:[{backendRefs:[{group:"",kind:"Service",name:Z,port:dN}]}]}};await qc$(this.kubeConfig,this.namespace,Y)}async deleteHttpRouteIfManaged($){if(!this.previewGateway)return;await Mc$(this.kubeConfig,this.namespace,$)}async rehydrate($,Z,Q){let X=Q.state;if(!X.adoptedSandboxName&&!X.podName||!X.token)return null;let Y=await gD(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!Y||!sN1(Y))return null;let J=Y.status?.sandbox?.name??X.adoptedSandboxName??X.podName??Z,G=await this.openAndProbeDaemon(J,Z);if(!G)return null;if(X.daemonBootId&&X.daemonBootId!==G.bootId){if(this.sentinelToken!==null){let K=X.ensureOpts?await this.withFreshCredentials(X.ensureOpts,X.orgFsRedacted===!0):null;if(!await this.rebootstrapDaemon(G.daemonUrl,X.token,K))return this.closeForwarder(G.daemonForward),null}else console.warn(`[${V6}] daemon restart detected (handle=${Z}): stored bootId=${X.daemonBootId} live bootId=${G.bootId}`);await this.stateStore?.put($,{handle:Z,state:{...X,daemonBootId:G.bootId}}).catch((K)=>console.warn(`[${V6}] bootId persist failed for ${Z}: ${K instanceof Error?K.message:String(K)}`))}return{id:$,handle:Z,adoptedSandboxName:J,tenantPoolPodBound:!1,token:X.token,workdir:X.workdir??hC0,daemonUrl:G.daemonUrl,daemonForward:G.daemonForward,workload:X.workload??null,daemonBootId:G.bootId,tenant:X.tenant??null,ensureOpts:X.ensureOpts??null,orgFsRedacted:X.orgFsRedacted===!0}}join($,Z,Q,X){let Y=this.sentinelToken!==null,J=Y?this.tokenGenerator():eN1(X,"DAEMON_TOKEN"),G=Y?vo$():eN1(X,"DAEMON_BOOT_ID");if(!J||!G)throw new $Y(`claim ${Z} carries no daemon token`);return this.bind($,Z,Q,this.claimTenantPoolBinding(Q),{token:J,daemonBootId:G,workdir:hC0})}async adopt($,Z,Q){if(!sN1(Q))return null;let X=Q.status?.sandbox?.name??Z;if(this.sentinelToken!==null)return null;let Y=eN1(Q,"DAEMON_TOKEN");if(!Y)return null;let J=await this.openAndProbeDaemon(X,Z);if(!J)return null;let G=OE6(Q);if(this.previewGateway)await this.ensureServicePortForAdoptedSandbox(X).catch((K)=>{console.warn(`[${V6}] Service port backfill failed for ${Z}: ${K instanceof Error?K.message:String(K)}`)}),await this.ensureHttpRouteForHandle(Z,X,G).catch((K)=>{console.warn(`[${V6}] HTTPRoute backfill failed for ${Z}: ${K instanceof Error?K.message:String(K)}`)});return{id:$,handle:Z,adoptedSandboxName:X,tenantPoolPodBound:!1,token:Y,workdir:hC0,daemonUrl:J.daemonUrl,daemonForward:J.daemonForward,workload:null,daemonBootId:J.bootId,tenant:G,ensureOpts:null}}async openAndProbeDaemon($,Z){let Q=await this.openForwarder($,dN,Z).catch(()=>null);if(!Q)return null;let X=`http://127.0.0.1:${Q.localPort}`,Y=await kC0(X);if(!Y)return this.closeForwarder(Q),null;return{daemonForward:Q,daemonUrl:X,bootId:Y.bootId}}async getRecord($){let Z=this.records.get($);if(Z)return Z;if(!this.stateStore)return null;let Q=await this.stateStore.getByHandle($);if(!Q)return null;let X=await this.rehydrate(Q.id,$,Q);if(X)this.records.set($,X);return X}async resurrectByHandle($){if(!this.stateStore)return null;let Z=await this.stateStore.getByHandle($);if(!Z)return null;let Q=Z.state,X=Q.ensureOpts;if(!X)return null;let Y=await this.withFreshCredentials(X,Q.orgFsRedacted===!0);if(c3(Z.id)!==$)return null;return await this.ensure(Z.id,Y),this.records.get($)??null}invalidateRecord($){let Z=this.records.get($);if(!Z)return;this.records.delete($),this.dropRecord(Z)}dropRecord($){if(this.closeForwarder($.daemonForward),this.metrics&&this.activeGauge.consume($.handle))this.metrics.active.add(-1,ZB1($.tenant))}recordProxyDuration($,Z,Q,X,Y){if(!this.metrics)return;this.metrics.proxyDurationMs.record(X,{...ZB1(Q?.tenant??null),source:$,sandbox_handle:Q?.handle??Y??"",status_code:Z||0})}composePreviewUrl($){if(this.previewUrlPattern)return vC0(this.previewUrlPattern,$.handle);return`http://127.0.0.1:${$.daemonForward.localPort}/`}toSandbox($){return{handle:$.handle,workdir:$.workdir,previewUrl:this.composePreviewUrl($),warmPoolAdopted:$.tenantPoolPodBound===!0,provider:"kubernetes"}}async persist($,Z){if(!$)return;let Q={adoptedSandboxName:Z.adoptedSandboxName,token:Z.token,workdir:Z.workdir,workload:Z.workload,daemonBootId:Z.daemonBootId,tenant:Z.tenant,...Z.ensureOpts?this.persistCredentials?{ensureOpts:Z.ensureOpts}:zE6(Z.ensureOpts,Z.orgFsRedacted===!0):{}};await $.put(Z.id,{handle:Z.handle,state:Q})}computeShutdownTime(){return new Date(Date.now()+this.idleTtlMs).toISOString()}async releaseAfter($,Z){let Q=await gD(this.kubeConfig,this.namespace,$);if(!Q)return;let X=jE6(Q.spec?.lifecycle?.shutdownTime,new Date(Date.now()+Z));if(!X)return;await Fj0(this.kubeConfig,this.namespace,$,X).catch((Y)=>console.warn(`[${V6}] release failed for ${$}: ${Y instanceof Error?Y.message:String(Y)}`))}async renewTtl($){let Z=await gD(this.kubeConfig,this.namespace,$);if(!Z)return;let Q=wE6(Z.spec?.lifecycle?.shutdownTime,new Date(Date.now()+this.idleTtlMs));if(!Q)return;await Fj0(this.kubeConfig,this.namespace,$,Q).catch((X)=>console.warn(`[${V6}] TTL renew failed for ${$}: ${X instanceof Error?X.message:String(X)}`))}openForwarder($,Z,Q=$){if(this.forwardPort)return this.forwardPort($,Z,Q);let X=WE6(Q,Z);return new Promise((Y,J)=>{let G=(K,W)=>{let H=uo$.createServer((F)=>this.handleForwardedConnection(F,$,Z,Q));H.once("error",(F)=>{if(F.code==="EADDRINUSE"&&W<JE6){try{H.close()}catch{}let U=QB1+(K-QB1+1)%lo$;G(U,W+1);return}J(F)}),H.listen(K,"127.0.0.1",()=>{let F=H.address();if(!F||typeof F==="string"){H.close(),J(Error("port-forward listener failed to bind"));return}let U=F.port;Y({localPort:U,close:()=>H.close((N)=>{if(N)console.warn(`[${V6}] port-forward close on :${U} errored: ${N.message}`)})})})};G(X,0)})}handleForwardedConnection($,Z,Q,X){let Y=new tw6,J=null,G=!1,K=()=>{if(G)return;if(G=!0,Y.destroy(),J)try{J.close()}catch{}if(!$.destroyed)$.destroy()};$.pipe(Y),$.on("error",K),$.on("close",K),this.portForward.portForward(this.namespace,Z,[Q],$,null,Y).then((W)=>{let H=typeof W==="function"?W():W;if(!H){K();return}if(J=H,J.on("close",K),J.on("error",(F)=>{console.warn(`[${V6}] port-forward to ${Z}:${Q} dropped mid-connection: ${xo$(F)}`,JSON.stringify(XB1(F))),this.invalidateRecord(X),K()}),G)try{J.close()}catch{}}).catch((W)=>{console.warn(`[${V6}] port-forward to ${Z}:${Q} failed: ${xo$(W)}`,JSON.stringify(XB1(W))),this.invalidateRecord(X),K()})}closeForwarder($){$.close()}close(){if(this.closed)return;this.closed=!0,this.claimWatchAbort.abort();for(let $ of this.records.values())this.dropRecord($);this.records.clear()}}function GE6($){return{active:$.createUpDownCounter("studio.sandbox.active",{description:"Active sandbox count, by runner kind, owning org, and daemon impl. Cross-checks the cAdvisor-derived count from the cluster \u2014 divergence between the two indicates orphaned claims (studio deleted but K8s didn't reap) or unattributed pods.",unit:"{sandbox}"}),ensureOutcome:$.createCounter("studio.sandbox.ensure.outcome",{description:"Outcome of each ensure() call: fresh provision, resume from state-store after restart, or adopt of a cluster-side claim studio didn't know about. Cold-start ratio is the primary input for warm-pool sizing.",unit:"{call}"}),proxyDurationMs:$.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of studio-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"}),poolPods:$.createGauge("studio.sandbox.pool.pods",{description:"Tenant warm pool depth by pool and state: ready (warmed and unbound \u2014 what a claim can actually bind instantly), bound (serving a user), pending (unbound, not yet warmed), failed (gave up after repeated bootstrap failures). Alert on sustained ready=0: a pool that is always empty is doing nothing while costing N pods.",unit:"{pod}"})}}function XB1($){let Z=[],Q=$;for(let X=0;X<5&&Q instanceof Error;X++){let Y=Q;if(Z.push({name:Y.name,message:Y.message,...Y.code!==void 0?{code:Y.code}:{},...Y.errno!==void 0?{errno:Y.errno}:{}}),Y.cause===Q)break;Q=Y.cause}if(Q!==void 0&&!(Q instanceof Error)&&Q!==null){let X=Q,Y=X.error instanceof Error?XB1(X.error).chain:void 0;Z.push({nonError:String(Q),...typeof X.type==="string"?{type:X.type}:{},...typeof X.message==="string"?{message:X.message}:{},...X.code!==void 0?{code:X.code}:{},...typeof X.reason==="string"?{reason:X.reason}:{},...Y?{error:Y}:{},...Y===void 0&&X.error!==void 0?{rawError:String(X.error)}:{},keys:Object.keys(X)})}return{chain:Z}}function KE6(){let $=new UC0;return $.loadFromDefault(),$}function sN1($){return Boolean($.status?.conditions?.some((Z)=>Z.type==="Ready"&&Z.status==="True"))}function eN1($,Z){let Q=$.spec?.env;if(!Q)return null;for(let X of Q)if(X.name===Z&&X.value)return X.value;return null}function WE6($,Z){let Q=pw6("sha256").update(`${$}:${Z}`).digest();return QB1+Q.readUInt32BE(0)%lo$}function go$($){let Z=$.slice(0,FE6);return HE6.test(Z)?Z:""}function NE6($){if($===void 0)return null;let Z=$.trim();if(Z==="")return null;if(!UE6.test(Z))throw Error(`AgentSandboxProvider: envName=${JSON.stringify(Z)} is not a valid DNS-label-safe environment name (lowercase alphanumeric or '-', starts with a letter, ends alphanumeric, \u226432 chars). Studio sets this from STUDIO_ENV; check the studio chart's configMap.`);return Z}function $B1($,Z={}){let Q={...Z};if($){let X=go$($.orgId),Y=go$($.userId);if(X)Q[GJ.orgId]=X;if(Y)Q[GJ.userId]=Y}return Q}function Pg($){let Z="";for(let Q of $){let X=Q.codePointAt(0)??0;Z+=X<32||X===127?" ":Q}return Z.slice(0,BE6)}function LE6($){try{let Z=new URL($);return Z.username="",Z.password="",Z.toString()}catch{return""}}function DE6($){let Z={},Q=$.tenant;if(Q?.orgSlug)Z[TF.orgSlug]=Pg(Q.orgSlug);if(Q?.orgName)Z[TF.orgName]=Pg(Q.orgName);if(Q?.userEmail)Z[TF.userEmail]=Pg(Q.userEmail);if(Q?.userName)Z[TF.userName]=Pg(Q.userName);let X=$.repo;if(X){if(X.displayName)Z[TF.gitRepo]=Pg(X.displayName);let Y=LE6(X.cloneUrl);if(Y)Z[TF.gitRepoUrl]=Pg(Y);let J=$.branch??X.branch;if(J)Z[TF.gitBranch]=Pg(J)}return Z}function OE6($){let Z=$.metadata?.labels;if(!Z)return null;let Q=Z[GJ.orgId],X=Z[GJ.userId];if(!Q||!X)return null;let Y=$.metadata?.annotations??{};return{orgId:Q,userId:X,orgSlug:Y[TF.orgSlug],orgName:Y[TF.orgName],userEmail:Y[TF.userEmail],userName:Y[TF.userName]}}function jE6($,Z){if($){let Q=new Date($).getTime();if(Number.isFinite(Q)&&Q<=Z.getTime())return null}return Z.toISOString()}function wE6($,Z){if($){let Q=new Date($).getTime();if(Number.isFinite(Q)&&Q>=Z.getTime())return null}return Z.toISOString()}function ZB1($){return{org_id:$?.orgId??"",user_id:$?.userId??"",runner_kind:"agent-sandbox"}}async function EE6($,Z){if(!Z||!$.tenant)return $.orgFsConfigJson;try{return await Z($.tenant)??$.orgFsConfigJson}catch(Q){return console.warn(`[${V6}] org-fs credential re-mint failed: ${Q instanceof Error?Q.message:String(Q)}`),$.orgFsConfigJson}}function ho$($){try{let Z=new URL($.cloneUrl);Z.username="",Z.password="";let{submoduleCredentials:Q,credentialExpiresAt:X,...Y}=$;return{...Y,cloneUrl:Z.toString()}}catch{return null}}function zE6($,Z){let{orgFsConfigJson:Q,repo:X,extraRepos:Y,...J}=$,G=J,K=X&&ho$(X);if(K)G.repo=K;if(Y)G.extraRepos=Y.map(ho$).filter((W)=>W!==null);return Q||Z?{ensureOpts:G,orgFsRedacted:!0}:{ensureOpts:G}}function PE6($){let Z={};if($.branch)Z.branch=$.branch;if($.repo)Z.repo=$.repo;if($.workload)Z.workload=$.workload;if($.env&&Object.keys($.env).length>0)Z.env=$.env;if($.tenant)Z.tenant=$.tenant;if($.cloneOnly)Z.cloneOnly=!0;if($.purpose)Z.purpose=$.purpose;if($.sandboxImage)Z.sandboxImage=$.sandboxImage;if($.orgFsConfigJson)Z.orgFsConfigJson=$.orgFsConfigJson;return Object.keys(Z).length>0?Z:null}function TE6($,Z){try{return new URL(vC0($,Z)).hostname||null}catch{return null}}var V6="AgentSandboxProvider",ow6="agent-sandbox-system",rw6="studio-sandbox",aw6=300000,dN=9000,fo$=3000,hC0="/app",sw6=32,ew6,$E6=900000,ZE6=60000,QE6=1800000,uC0=3,bo$=1800000,XE6=900000,YE6=1800000,QB1=40000,lo$=1e4,JE6=256,GJ,TF,HE6,FE6=63,UE6,BE6=253;var co$=L(()=>{$8();_c$();Xo$();Eg();lp();Uj0();F60();Eo$();y60();ko$();yC0();gC0();ew6=new Set(["DAEMON_TOKEN","DAEMON_BOOT_ID","APP_ROOT","PROXY_PORT"]);GJ={role:"studio.decocms.com/role",sandboxHandle:"studio.decocms.com/sandbox-handle",orgId:"studio.decocms.com/org-id",userId:"studio.decocms.com/user-id",env:"studio.decocms.com/env"},TF={orgSlug:"studio.decocms.com/org-slug",orgName:"studio.decocms.com/org-name",userEmail:"studio.decocms.com/user-email",userName:"studio.decocms.com/user-name",gitRepo:"studio.decocms.com/git-repo",gitRepoUrl:"studio.decocms.com/git-repo-url",gitBranch:"studio.decocms.com/git-branch"},HE6=/^([A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?)?$/;UE6=/^[a-z]([a-z0-9-]{0,30}[a-z0-9])?$/});var mo$={};J0(mo$,{tenantPoolSchema:()=>Po$,tenantPoolRepoSchema:()=>b60,tenantPoolFieldsSchema:()=>nN1,tenantPoolAllocations:()=>cp,resolveTenantPoolBinding:()=>tN1,renderTenantPoolWarmPools:()=>Ro$,normalizeRepoUrl:()=>mN,allocationsMatchingPush:()=>rN1,TenantPoolCapacityError:()=>fC0,PREVIEW_NOT_READY_HEADER:()=>dp,AgentSandboxProvider:()=>YB1});var g60=L(()=>{co$();y60()});import{z as Tg}from"zod";function lC0($){if(!$||$.trim()==="")return[];let Z=Tg.array(AE6).parse(JSON.parse($)),Q=new Set;for(let X of Z){if(Q.has(X.name))throw Error(`tenant pools: duplicate pool name ${X.name}`);Q.add(X.name)}return Z}function do$($){let Z=mN(`https://github.com/${$.repo}`);if(!Z)throw Error(`tenant pools: bad repo ${$.repo}`);return Z}function io$($){return $.map((Z)=>({name:Z.name,tenant:Z.orgId,size:1,image:"default",repos:[{repoUrl:do$(Z),branch:Z.branch,workload:Z.workload,replicas:1,warmPoolName:Z.name}]}))}function JB1($,Z){let Q=mN(Z.repoUrl)?.toLowerCase(),X=$.find((J)=>J.orgId===Z.tenant&&J.branch===Z.branch&&do$(J).toLowerCase()===Q);if(!X)return null;let Y=`https://github.com/${X.repo}.git`;return X.connectionId?{cloneUrl:Y,connectionId:X.connectionId}:{cloneUrl:Y}}function po$($,Z){return async(Q)=>{let X=JB1($,Q);if(!X)return null;return X.connectionId?Z(X):X.cloneUrl}}var AE6;var cC0=L(()=>{g60();AE6=Tg.object({name:Tg.string().max(63).regex(/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/,"pool name must be a DNS label (lowercase alphanumeric and '-')"),orgId:Tg.string().min(1),repo:Tg.string().regex(/^[^/\s]+\/[^/\s]+$/,"repo must be `owner/name`"),connectionId:Tg.string().min(1).optional(),branch:Tg.string().min(1).default("main"),workload:b60.shape.workload})});function FB1($,Z=Date.now()){if($===void 0)return;return $===null?Z+RE6:$.getTime()}function HB1($){return JSON.stringify([$.orgId,$.userId])}function no$($,Z){let Q=mN(Z);return Q?JSON.stringify([$,Q.toLowerCase()]):null}function ME6($,Z){return"repositoryId"in Z?$.repositoryOrgs.get(Z.repositoryId):$.connectionOrgs.get(Z.connectionId)}function to$($){let{records:Z,now:Q}=$,X=new Map,Y=new Map,J=new Map,G=0;for(let K of $.pools)for(let{repoUrl:W,branch:H}of K.repos){let F=no$(K.tenant,W),U=JB1($.legacyPools??[],{tenant:K.tenant,repoUrl:W,branch:H});if(F&&U){if(U.connectionId)Y.set(F,{tenant:K.tenant,repoUrl:W,connectionId:U.connectionId,cloneUrl:U.cloneUrl});continue}let N=F?Z.orgRepositories.get(F):void 0;if(!F||!N){G++;continue}Y.set(F,{tenant:K.tenant,repoUrl:W,repositoryId:N})}for(let K of $.sandboxes){let W=K.tenant;if(!W)continue;let H=Z.members.get(HB1(W));if(H===void 0){G++;continue}for(let U of K.repos){if(ME6(Z,U)!==W.orgId){G++;continue}let N="repositoryId"in U?{repositoryId:U.repositoryId}:{connectionId:U.connectionId,repo:U.repo.toLowerCase()},B={orgId:W.orgId,userId:W.userId};X.set(JSON.stringify([B,N]),{tenant:B,repo:N})}let F=K.orgFsConfigExpiresAt;if(K.orgFs&&(F===null||F-Q<qE6))J.set(HB1(W),{orgId:W.orgId,userId:W.userId,orgSlug:H})}return{clones:[...X.values()],poolClones:[...Y.values()],orgFs:[...J.values()],refused:G}}async function oo$($,Z,Q){let X=new Set,Y=new Set,J=new Set,G=new Set,K=new Set(Q.map((D)=>D.tenant)),W=new Set;for(let D of Q)for(let{repoUrl:O}of D.repos){let j=tX(O);if(j)W.add(j.path.toLowerCase())}for(let D of Z){if(D.tenant)X.add(D.tenant.orgId),Y.add(D.tenant.userId);for(let O of D.repos)if("repositoryId"in O)G.add(O.repositoryId);else J.add(O.connectionId)}let[H,F,U,N]=await Promise.all([X.size===0?[]:$.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.organizationId as orgId","member.userId as userId","organization.slug as slug"]).where("member.organizationId","in",[...X]).where("member.userId","in",[...Y]).execute(),J.size===0?[]:$.selectFrom("connections").select(["id","organization_id"]).where("id","in",[...J]).execute(),G.size===0?[]:$.selectFrom("repositories").select(["id","organization_id"]).where("id","in",[...G]).execute(),W.size===0?[]:$.selectFrom("repositories").select(["id","organization_id","provider","host","path"]).where("organization_id","in",[...K]).where((D)=>D(D.fn("lower",["path"]),"in",[...W])).execute()]),B=new Map;for(let D of N){let O=no$(D.organization_id,p80({provider:D.provider,host:D.host,path:D.path}));if(O&&!B.has(O))B.set(O,D.id)}return{members:new Map(H.map((D)=>[HB1(D),D.slug])),connectionOrgs:new Map(F.map((D)=>[D.id,D.organization_id])),repositoryOrgs:new Map(U.map((D)=>[D.id,D.organization_id])),orgRepositories:B}}function WB1($){return $ instanceof Error?$.message:String($)}async function ro$($,Z,Q){let X=0;if($.clones.length>pp||$.poolClones.length>pp||$.orgFs.length>KB1)console.warn(`[sandbox-credential-push] ${$.clones.length} clone, ${$.poolClones.length} pool clone and ${$.orgFs.length} org-fs mints planned; minting the first ${pp}, ${pp} and ${KB1}`);let Y=await z9($.clones.slice(0,pp),GB1,async(U)=>{let N="repositoryId"in U.repo?{cloneUrl:"",repositoryId:U.repo.repositoryId}:{cloneUrl:`https://github.com/${U.repo.repo}.git`,connectionId:U.repo.connectionId};try{let B=await Z.mintCloneUrl(N,{bufferMs:mC0});return B?{tenant:U.tenant,repo:U.repo,cloneUrl:B,expiresAt:Q.now+mC0}:null}catch(B){return X++,console.warn(`[sandbox-credential-push] clone mint failed: ${WB1(B)}`),null}}),J=await z9($.poolClones.slice(0,pp),GB1,async(U)=>{try{let N=await Z.mintCloneUrl("repositoryId"in U?{cloneUrl:"",repositoryId:U.repositoryId}:{cloneUrl:U.cloneUrl,connectionId:U.connectionId},{bufferMs:mC0});return N?{tenant:U.tenant,repoUrl:U.repoUrl,cloneUrl:N,expiresAt:Q.now+mC0}:null}catch(N){return X++,console.warn(`[sandbox-credential-push] pool clone mint failed: ${WB1(N)}`),null}}),G=await z9($.orgFs.slice(0,KB1),GB1,async(U)=>{try{let N=await Z.mintOrgFsConfig(U);return N?{tenant:{orgId:U.orgId,userId:U.userId},orgFsConfigJson:N,expiresAt:Q.now+Q.orgFsLifetimeMs}:null}catch(N){return X++,console.warn(`[sandbox-credential-push] org-fs mint failed: ${WB1(N)}`),null}}),K=Y.filter((U)=>U!==null),W=J.filter((U)=>U!==null),H=G.filter((U)=>U!==null),F=[];for(let U=0;U<Math.max(K.length,W.length,H.length);U+=Rz)F.push({cloneUrls:K.slice(U,U+Rz),poolCloneUrls:W.slice(U,U+Rz),orgFsConfigs:H.slice(U,U+Rz)});return{batches:F,failed:X}}var mC0=2700000,dC0,RE6=86400000,qE6=86400000,GB1=8,pp=2000,KB1=200;var iC0=L(()=>{mF1();g60();r4();$8();bD();cC0();dC0=pl$-3600000});var KJ;var h60=L(()=>{KJ=class KJ extends Error{code;status;path;constructor($,Z,Q){super(Z.message||`Freestyle API error: ${Z.code}`);this.name="FreestyleApiError",this.code=Z.code,this.status=$,this.path=Q,Object.setPrototypeOf(this,KJ.prototype)}}});function ao$(){return typeof process<"u"&&Boolean(process.versions?.node)}var pC0=($,Z)=>globalThis.fetch($,Z);async function IE6(){if(!ao$())return null;try{return await import("undici")}catch{return null}}async function kE6(){let $=await IE6();if(!$)return null;let Z=new $.Agent({allowH2:!0,connections:VE6});return(Q,X)=>$.fetch(Q,{...X,dispatcher:Z})}function CE6($){return(typeof $==="string"?$:$ instanceof URL?$.href:$.url).startsWith("https:")}function so$(){let $,Z=()=>{return $??=kE6().then((Q)=>Q??pC0).catch(()=>pC0),$};return(Q,X)=>CE6(Q)?Z().then((Y)=>Y(Q,X)):pC0(Q,X)}var VE6=4;var eo$=()=>{};function bE6($){return new Promise((Z)=>setTimeout(Z,$))}function yE6($){if(!$)return"";let Z=new URLSearchParams;for(let[X,Y]of Object.entries($)){if(Y===void 0||Y===null)continue;Z.set(X,String(Y))}let Q=Z.toString();return Q?`?${Q}`:""}function n6($){return encodeURIComponent($)}class UB1{baseUrl;authenticationHeaders;fetchImpl;backgroundEligible;constructor($={}){if(this.baseUrl=($.baseUrl??fE6).replace(/\/+$/,""),!$.fetch&&!globalThis.fetch)throw Error("No fetch implementation available. Pass `fetch` in FreestyleOptions when running on a runtime without a global fetch.");if(this.fetchImpl=$.fetch??so$(),"identityAccessToken"in $&&$.identityAccessToken){this.authenticationHeaders={[SE6]:$.identityAccessToken},this.backgroundEligible=!1;return}if(this.backgroundEligible=!0,"stackAccessToken"in $&&$.stackAccessToken){this.authenticationHeaders={Authorization:`Bearer ${$.stackAccessToken}`,"X-Freestyle-Team-Id":$.teamId};return}let Z=$.apiKey??globalThis.process?.env?.FREESTYLE_API_KEY;if(!Z)throw Error("No Freestyle API key provided. Pass `apiKey` in FreestyleOptions or set FREESTYLE_API_KEY.");this.authenticationHeaders={Authorization:`Bearer ${Z}`}}authHeaders(){return{...this.authenticationHeaders}}url($,Z){return`${this.baseUrl}${$}${yE6(Z)}`}async fetch($,Z={}){let Q=new Headers(Z.headers);for(let[X,Y]of Object.entries(this.authHeaders()))if(!Q.has(X))Q.set(X,Y);return this.fetchImpl(this.absoluteUrl($),{...Z,headers:Q})}absoluteUrl($){return/^https?:\/\//i.test($)?$:`${this.baseUrl}${$}`}async request($,Z,{query:Q,body:X,rawBody:Y,signal:J}={}){let G={...this.authHeaders()};if(this.backgroundEligible)G[$r$]=String(vE6);let K;if(Y!==void 0)G["Content-Type"]="application/octet-stream",K=Y;else if(X!==void 0)G["Content-Type"]="application/json",K=JSON.stringify(X);let W=this.url(Z,Q),H=await this.fetchImpl(W,{method:$,headers:G,body:K,signal:J});if(this.backgroundEligible&&H.status===202)try{return await this.pollBackgroundRequest(H,Z)}catch(F){if($==="GET"&&F instanceof KJ&&F.code==="BACKGROUND_RESULT_UNSTORABLE"){delete G[$r$];let U=await this.fetchImpl(W,{method:$,headers:G,body:K});return this.finalize(U,Z)}throw F}return this.finalize(H,Z)}async pollBackgroundRequest($,Z){let Q=await $.json().catch(()=>({})),X=$.headers.get(_E6)??Q.requestId,Y=Q.resultUrl??(X?`/v5/background-requests/${n6(X)}`:void 0);if(!Y)throw new KJ($.status,{code:"BACKGROUND_PROTOCOL_ERROR",message:"202 Accepted carried no background request id"},Z);let J=0;for(;;){await bE6(xE6);let G;try{G=await this.fetch(Y,{method:"GET"}),J=0}catch(K){if(++J>=5)throw K;continue}if(G.status===202)continue;return this.finalize(G,Z)}}async finalize($,Z){if(!$.ok){let X;try{X=await $.json()}catch{X={code:"UNKNOWN_ERROR",message:await $.text().catch(()=>$.statusText)}}throw new KJ($.status,X,Z)}if($.status===204)return;let Q=await $.text();if(!Q)return;return JSON.parse(Q)}get($,Z){return this.request("GET",$,{query:Z})}post($,Z){return this.request("POST",$,{body:Z??{}})}patch($,Z){return this.request("PATCH",$,{body:Z??{}})}put($,Z){return this.request("PUT",$,{body:Z??{}})}putEmpty($){return this.request("PUT",$,{})}putBytes($,Z,Q,X){return this.request("PUT",$,{query:Q,rawBody:Z,signal:X})}async getBytes($,Z,Q={}){let X={...this.authHeaders()};if(Q.range)X.Range=Q.range;let Y=await this.fetchImpl(this.url($,Z),{method:"GET",headers:X,signal:Q.signal});if(!Y.ok){let J;try{J=await Y.json()}catch{J={code:"UNKNOWN_ERROR",message:await Y.text().catch(()=>Y.statusText)}}throw new KJ(Y.status,J,$)}return Y}delete($,Z){return this.request("DELETE",$,{query:Z})}}var SE6="x-freestyle-identity-access-token",$r$="x-freestyle-background-after-secs",_E6="x-freestyle-background-request-id",vE6=5,xE6=2000,fE6="https://api.freestyle.sh";var qW=L(()=>{h60();eo$()});class NB1{client;verifications;certificates;placeholder;constructor($){this.client=$,this.verifications=new Zr$($),this.certificates=new Qr$($),this.placeholder=new Xr$($)}async list(){let{domains:$}=await this.client.get("/v5/domains");return $}}class Zr${client;constructor($){this.client=$}create($){return this.client.post("/v5/verifications",{domain:$})}async list($={}){let{verifications:Z}=await this.client.get("/v5/verifications",$);return Z}get($){return this.client.get(`/v5/verifications/${n6($)}`)}complete($){return this.client.putEmpty(`/v5/verifications/${n6($)}`)}delete($){return this.client.delete(`/v5/verifications/${n6($)}`)}}class Qr${client;constructor($){this.client=$}async list(){let{certificates:$}=await this.client.get("/v5/certificates");return $}createWildcard($){return this.client.post("/v5/certificates/wildcard",{domain:$})}}class Xr${client;constructor($){this.client=$}async get(){try{return await this.client.get("/v5/domains/placeholder")}catch($){if($ instanceof KJ&&$.status===404)return null;throw $}}set($){return this.client.put("/v5/domains/placeholder",$)}delete(){return this.client.delete("/v5/domains/placeholder")}}var BB1=L(()=>{qW();h60()});function G5($,Z){throw new DB1($,Z)}function LB1($){return gE6.some((Z)=>$[Z]!==void 0)}function OB1($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function uE6($,Z){let Q=Z.lastIndexOf("/");if(Q<0)G5($,`${$} \`${Z}\` is not a CIDR: expected address/prefix, e.g. 203.0.113.0/24 or 2001:db8::/32`);let X=Z.slice(0,Q),Y=Z.slice(Q+1);if(!/^\d+$/.test(Y))G5($,`${$} \`${Z}\`: prefix length must be a number`);let J=Number(Y),G=X.includes(":"),K=G?128:32;if(J>K)G5($,`${$} \`${Z}\`: prefix length must be 0\u2013${K}`);if(!G&&!/^\d{1,3}(\.\d{1,3}){3}$/.test(X))G5($,`${$} \`${Z}\`: \`${X}\` is not an IP address`)}function Kr$($,Z){if(!OB1($))G5(Z,`${Z} must be an object`);for(let X of Object.keys($))if(!Yr$.includes(X))G5(`${Z}.${X}`,`${Z} has unknown field \`${X}\`. Expected one of: ${Yr$.join(", ")}`);let Q=$;for(let X of["vmId","vpcId","tunnelId","cidr"]){let Y=Q[X];if(Y!==void 0&&(typeof Y!=="string"||Y.length===0))G5(`${Z}.${X}`,`${Z}.${X} must be a non-empty string`)}if(Q.public!==void 0&&Q.public!==!0)G5(`${Z}.public`,`${Z}.public must be true when present: it declares the public Internet. Omit the field to match something else`);if(Q.public===!0){if(Q.vmId!==void 0)G5(`${Z}.public`,`${Z} cannot combine \`public: true\` with \`vmId\`: that would mean the VM only when reached over its public address, a distinction this API does not make yet. Use \`vmId\` alone to match the VM on any path, or \`public: true\` alone to match public addresses`);if(Q.vpcId!==void 0)G5(`${Z}.public`,`${Z} cannot combine \`public: true\` with \`vpcId\`: that would mean the network's members only when reached over their public addresses, a distinction this API does not make yet. Use \`vpcId\` alone or \`public: true\` alone`);if(Q.tunnelId!==void 0)G5(`${Z}.public`,`${Z} cannot combine \`public: true\` with \`tunnelId\`: traffic through a tunnel arrives over the tunnel, not over the public Internet. Use \`tunnelId\` alone`)}if(Q.cidr!==void 0)uE6(`${Z}.cidr`,Q.cidr);if(Q.protocol!==void 0&&!Jr$.includes(Q.protocol))G5(`${Z}.protocol`,`${Z}.protocol must be one of: ${Jr$.join(", ")} (got \`${String(Q.protocol)}\`)`);if(Q.port!==void 0){if(!Number.isInteger(Q.port)||Q.port<1||Q.port>65535)G5(`${Z}.port`,`${Z}.port must be an integer between 1 and 65535`);if(Q.protocol===void 0)G5(`${Z}.protocol`,`${Z}.port ${Q.port} requires ${Z}.protocol: set it to "tcp" or "udp" so the rule opens one transport rather than both`);if(!hE6.includes(Q.protocol))G5(`${Z}.port`,`${Z}.protocol "${Q.protocol}" has no ports; remove ${Z}.port ${Q.port}`)}}function Fr$($,Z){if(!OB1($))G5(Z||"rule",`${Z||"rule"} must be an object`);for(let X of Object.keys($))if(!Wr$.includes(X))G5(`${Z}${X}`,`Unknown field \`${X}\`. Expected one of: ${Wr$.join(", ")}`);let Q=$;if(Q.action===void 0)G5(`${Z}action`,`${Z}action is required. Write \`action: "allow"\` \u2014 every rule states what it does rather than defaulting to it`);if(Q.action!=="allow")G5(`${Z}action`,`${Z}action must be "allow" (got \`${String(Q.action)}\`). Only allow rules exist today`);if(Q.description!==void 0){if(typeof Q.description!=="string")G5(`${Z}description`,"description must be a string");if(Q.description.length>Gr$)G5(`${Z}description`,`description is too long (${Q.description.length} characters, maximum ${Gr$})`)}if(Q.source===void 0)G5(`${Z}source`,`${Z}source is required`);if(Q.destination===void 0)G5(`${Z}destination`,`${Z}destination is required`);return Kr$(Q.source,`${Z}source`),Kr$(Q.destination,`${Z}destination`),Q}function lE6($){let Z=Fr$($,"");for(let Q of["source","destination"]){let X=Z[Q];if(LB1(X))continue;let Y=[X.port!==void 0?`port ${X.port}`:void 0,X.protocol!==void 0?`protocol ${X.protocol}`:void 0].filter(Boolean).join(", ");G5(Q,Y?`${Q} only narrows traffic (${Y}) without saying what it is. Add \`vmId\`, \`vpcId\`, \`tunnelId\`, \`cidr\`, or \`public: true\`. Leaving it out to mean "this VM" only works inside vms.create`:`${Q} is empty. A matcher must say what the traffic is: \`vmId\`, \`vpcId\`, \`tunnelId\`, \`cidr\`, or \`public: true\` for the public Internet`)}return Z}function nC0($,Z="VM"){if($===void 0||$===null)G5("firewall",`firewall is required on a ${Z} create. A ${Z} gets nothing implicitly, so state what it may reach \u2014 \`{ rules: [] }\` if the answer is nothing`);if(!OB1($))G5("firewall","firewall must be an object with a `rules` array");for(let X of Object.keys($))if(X!=="rules")G5(`firewall.${X}`,`firewall has unknown field \`${X}\`. Expected: rules`);let Q=$.rules;if(!Array.isArray(Q))G5("firewall.rules","firewall.rules must be an array");return Q.forEach((X,Y)=>{let J=`firewall.rules[${Y}].`,G=Fr$(X,J),K=LB1(G.source),W=LB1(G.destination);if(!K&&!W&&Z!=="network")G5(`firewall.rules[${Y}]`,`firewall.rules[${Y}]: both source and destination refer to the ${Z} being created, which allows nothing. Give one of them a \`vmId\`, \`vpcId\`, \`tunnelId\`, \`cidr\`, or \`public: true\``);if(K&&W)G5(`firewall.rules[${Y}]`,`firewall.rules[${Y}]: neither end refers to the ${Z} being created. Leave one endpoint's identity unset so it means this ${Z}, or create the rule with firewall.rules.create instead`)}),$}function Hr$($){return`/v5/firewall/rules/${n6($)}`}class Ur${client;constructor($){this.client=$}async create($){let Z=lE6($);return this.client.post("/v5/firewall/rules",Z)}list($={}){return this.client.get("/v5/firewall/rules",$)}get($){return this.client.get(Hr$($))}delete($){return this.client.delete(Hr$($))}}class jB1{client;rules;constructor($){this.client=$,this.rules=new Ur$($)}evaluate($){return this.client.post("/v5/firewall/evaluate",$)}}var DB1,Yr$,gE6,Jr$,hE6,Gr$=1024,Wr$;var u60=L(()=>{qW();DB1=class DB1 extends Error{path;constructor($,Z){super(Z);this.name="FirewallRuleValidationError",this.path=$,Object.setPrototypeOf(this,DB1.prototype)}};Yr$=["vmId","vpcId","tunnelId","cidr","public","port","protocol"],gE6=["vmId","vpcId","tunnelId","cidr","public"],Jr$=["tcp","udp","icmp"],hE6=["tcp","udp"];Wr$=["action","source","destination","description"]});function wB1($){return`/v5/identities/${n6($)}`}class Nr${client;basePath;constructor($,Z){this.client=$,this.basePath=Z}create(){return this.client.post(`${this.basePath}/tokens`)}list(){return this.client.get(`${this.basePath}/tokens`)}revoke($){return this.client.delete(`${this.basePath}/tokens/${n6($)}`)}}class Br${client;basePath;constructor($,Z){this.client=$,this.basePath=Z}list(){return this.client.get(`${this.basePath}/permissions/vm`)}grant($){return this.client.post(`${this.basePath}/permissions/vm`,$)}get($){return this.client.get(`${this.basePath}/permissions/vm/${n6($)}`)}update($,Z){return this.client.patch(`${this.basePath}/permissions/vm/${n6($)}`,{allowedLinuxUsers:Z})}revoke($){return this.client.delete(`${this.basePath}/permissions/vm/${n6($)}`)}}class EB1{id;tokens;permissions;client;basePath;constructor($,Z){this.client=$,this.id=Z,this.basePath=wB1(Z),this.tokens=new Nr$($,this.basePath),this.permissions={vm:new Br$($,this.basePath)}}data(){return this.client.get(this.basePath)}delete(){return this.client.delete(this.basePath)}}class zB1{client;constructor($){this.client=$}async create($={}){let Z=await this.client.post("/v5/identities",$);return{identity:new EB1(this.client,Z.id),identityId:Z.id,data:Z}}list($={}){return this.client.get("/v5/identities",$)}get($){return this.client.get(wB1($))}ref($){return new EB1(this.client,$)}delete($){return this.client.delete(wB1($))}}var PB1=L(()=>{qW()});function b1($,Z){throw new qB1($,Z)}function D7($,Z){throw new MB1($,Z)}function l60($){return cE6.some((Z)=>$[Z]!==void 0)}function rE6($){return!l60($)&&$.port===void 0}function XY($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function Ir$($,Z,Q){if(typeof $!=="string"||!pE6.test($))D7(Z,`${Z} must be a valid HTTP header name`);let X=$.toLowerCase();if(oE6.has(X)||X.startsWith("x-forwarded-")||X.startsWith("x-freestyle-")||Q&&(X==="cookie"||X==="set-cookie"))D7(Z,`${Z} may not use reserved header \`${$}\``)}function aE6($,Z){if(!Array.isArray($))D7(Z,`${Z} must be an array of header names`);if($.length>zr$)D7(Z,`${Z} may contain at most ${zr$} names`);let Q=new Set;$.forEach((X,Y)=>{Ir$(X,`${Z}[${Y}]`,!0);let J=X.toLowerCase();if(Q.has(J))D7(`${Z}[${Y}]`,`${Z} contains duplicate header \`${X}\``);Q.add(J)})}function Tr$($){if(!XY($))D7("forwardAuth","forwardAuth must be an object");for(let X of Object.keys($))if(!Or$.includes(X))D7(X,`Unknown field \`${X}\`. Expected one of: ${Or$.join(", ")}`);let Z=$;if(typeof Z.url!=="string"||Z.url.length===0||Z.url.length>nE6)D7("url","url is required and must be an absolute HTTPS URL");let Q;try{Q=new URL(Z.url)}catch{D7("url","url must be an absolute HTTPS URL")}if(Q.protocol!=="https:"||Q.hostname.length===0||Q.username.length>0||Q.password.length>0||Q.hash.length>0||Q.port==="0")D7("url","url must be an absolute HTTPS URL");if(Z.headers!==void 0){if(!XY(Z.headers))D7("headers","headers must be an object of header name to value");let X=Object.entries(Z.headers);if(X.length>wr$)D7("headers",`headers may contain at most ${wr$} entries`);let Y=0,J=new Set;for(let[G,K]of X){Ir$(G,`headers.${G}`,!1);let W=G.toLowerCase();if(J.has(W))D7(`headers.${G}`,`headers contains duplicate header \`${G}\``);if(J.add(W),typeof K!=="string"||/[\0\r\n]/.test(K))D7(`headers.${G}`,`headers.${G} must be a string`);Y+=G.length+K.length}if(Y>Er$)D7("headers",`headers may contain at most ${Er$} bytes`)}if(Z.timeoutMs!==void 0&&(!Number.isInteger(Z.timeoutMs)||Z.timeoutMs<100||Z.timeoutMs>5000))D7("timeoutMs","timeoutMs must be an integer between 100 and 5000");if(Z.protectedCookies!==void 0){if(!Array.isArray(Z.protectedCookies))D7("protectedCookies","protectedCookies must be an array of cookie names");if(Z.protectedCookies.length>Pr$)D7("protectedCookies",`protectedCookies may contain at most ${Pr$} names`);let X=new Set;Z.protectedCookies.forEach((Y,J)=>{if(typeof Y!=="string"||Y.length>tE6||!iE6.test(Y))D7(`protectedCookies[${J}]`,`protectedCookies[${J}] must be a valid HTTP cookie name`);if(X.has(Y))D7(`protectedCookies[${J}]`,`protectedCookies contains duplicate cookie \`${Y}\``);X.add(Y)})}if(Z.authResponseHeaders!==void 0)aE6(Z.authResponseHeaders,"authResponseHeaders");return Z}function sE6($,Z){if(!XY($))b1(Z,`${Z} must be an object with an \`id\``);for(let X of Object.keys($))if(!jr$.includes(X))b1(`${Z}.${X}`,`${Z} has unknown field \`${X}\`. Expected: ${jr$.join(", ")}`);let Q=$.id;if(typeof Q!=="string"||Q.length===0)b1(`${Z}.id`,`${Z}.id is required and must be a non-empty string`)}function RB1($){if(typeof $!=="string")b1("domain","domain is required and must be a string");if($==="*")return;let Z=$.startsWith("*.")?$.slice(2):$;if(Z.length===0||Z.length>mE6)b1("domain",`domain \`${$}\` is not a hostname`);let Q=Z.split(".");if(Q.length<2)b1("domain",`domain \`${$}\` must have at least two labels, e.g. acme.com`);for(let X of Q){if(X.length===0||X.length>dE6)b1("domain",`domain \`${$}\` has an empty or over-long label`);if(!/^[a-z0-9-]+$/.test(X))b1("domain",`domain \`${$}\`: labels are lowercase letters, digits, and hyphens (a \`*.\` prefix is the only wildcard)`);if(X.startsWith("-")||X.endsWith("-"))b1("domain",`domain \`${$}\`: a label cannot start or end with a hyphen`)}}function eE6($){if(typeof $!=="string")b1("domain","domain is required and must be a string");let Z=$.lastIndexOf("@");if(Z===-1){RB1($);return}let Q=$.slice(0,Z),X=$.slice(Z+1);if(Q.length===0||Q.length>64)b1("domain",`mail route \`${$}\`: the part before \`@\` must be 1-64 characters`);if(Q.startsWith(".")||Q.endsWith(".")||Q.includes(".."))b1("domain",`mail route \`${$}\`: the part before \`@\` cannot start or end with a dot, or contain \`..\``);for(let Y of Q)if(!/[a-zA-Z0-9]/.test(Y)&&!Ar$.includes(Y))b1("domain",`mail route \`${$}\`: the part before \`@\` may use letters, digits, dots, and \`${Ar$.slice(0,-1)}\` (quoted mailboxes are not supported)`);if(X==="*")b1("domain",`mail route \`${$}\`: \`*\` is not a mail domain \u2014 name the domain the mailbox lives at`);RB1(X)}function Rr$($,Z){if(!XY($))b1(Z,`${Z} must be an object`);for(let X of Object.keys($))if(!Lr$.includes(X))b1(`${Z}.${X}`,`${Z} has unknown field \`${X}\`. Expected one of: ${Lr$.join(", ")}`);let Q=$;for(let X of["vmId","vpcId","host"]){let Y=Q[X];if(Y!==void 0&&(typeof Y!=="string"||Y.length===0))b1(`${Z}.${X}`,`${Z}.${X} must be a non-empty string`)}if(Q.public!==void 0&&Q.public!==!0)b1(`${Z}.public`,`${Z}.public must be true when present. Omit the field to match something else`);if(Z==="source"){if(Q.host!==void 0)b1("source.host","source.host is not allowed: a source is who opens the session, not where it lands. Put `host` on the destination");if(Q.port!==void 0)b1("source.port","source.port is not allowed: a source is who opens the session, not where it lands. Put `port` on the destination");if(Q.public===!0&&(Q.vmId!==void 0||Q.vpcId!==void 0))b1("source.public","source cannot combine `public: true` with `vmId` or `vpcId`: use one alone. `public` is every client on the Internet; `vmId`/`vpcId` is a specific dialer")}else{if(Q.vpcId!==void 0)b1("destination.vpcId","destination.vpcId is not allowed: a session lands in one place, not on a whole network. Name a `vmId`, a `host`, or `public: true` for the domain's own origin. A whole network may be a source");if([Q.vmId!==void 0,Q.host!==void 0,Q.public===!0].filter(Boolean).length>1)b1("destination","destination names more than one landing: give exactly one of `vmId`, `host`, or `public: true`");if((Q.vmId!==void 0||Q.host!==void 0)&&Q.port===void 0)b1("destination.port",`destination.port is required with ${Q.vmId!==void 0?"`vmId`":"`host`"}: say which port the session lands on`)}if(Q.port!==void 0){if(!Number.isInteger(Q.port)||Q.port<1||Q.port>65535)b1(`${Z}.port`,`${Z}.port must be an integer between 1 and 65535`)}}function $z6($){if("postgres"in $)return"postgres";if("smtp"in $)return"smtp";if("socks5"in $)return"socks5";return"http"}function Zz6($,Z){function Q(K,W,H){if(!XY(K)||Object.keys(K).some((F)=>!W.includes(F)))b1(H,`${H} must contain only ${W.join(", ")}`)}if(Q($,["region","credentials","scope"],Z),typeof $.region!=="string"||!/^[a-z0-9-]{1,63}$/.test($.region))b1(`${Z}.region`,"invalid s3.region");Q($.credentials,["accessKeyId","secretAccessKey","sessionToken"],`${Z}.credentials`);for(let K of["accessKeyId","secretAccessKey","sessionToken"]){let W=$.credentials[K];if(K==="sessionToken"&&W===void 0)continue;if(typeof W!=="string"||!/^[\x21-\x7e]{1,16384}$/.test(W))b1(`${Z}.credentials.${K}`,"invalid s3 credentials")}if(!/^[a-zA-Z0-9]+$/.test($.credentials.accessKeyId))b1(`${Z}.credentials.accessKeyId`,"invalid s3 access key id");Q($.scope,["bucket","prefix","operations"],`${Z}.scope`);let{bucket:X,prefix:Y,operations:J}=$.scope;if(typeof X!=="string"||!/^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/.test(X)||X.includes(".."))b1(`${Z}.scope.bucket`,"invalid s3.scope.bucket");if(typeof Y!=="string"||Buffer.byteLength(Y,"utf8")>1024||/[\x00-\x1f\x7f-\x9f]/u.test(Y))b1(`${Z}.scope.prefix`,"invalid s3.scope.prefix");let G=["GetObject","HeadObject","PutObject","DeleteObject","ListObjectsV2","CreateMultipartUpload","UploadPart","ListParts","CompleteMultipartUpload","AbortMultipartUpload","ListMultipartUploads"];if(!Array.isArray(J)||J.length===0||J.length>G.length||J.some((K)=>!G.includes(K))||new Set(J).size!==J.length)b1(`${Z}.scope.operations`,"s3.scope.operations must be a nonempty list of distinct supported operations")}function Qz6($,Z){if(!XY($))b1(Z,`${Z} must be an object: \`{ headers: { \u2026 } }\`, \`{ postgres: { \u2026 } }\`, \`{ smtp: { \u2026 } }\` or \`{ socks5: { \u2026 } }\``);let Q=Object.keys($);if(Q.length!==1||!["headers","jsonPatch","postgres","smtp","socks5","s3"].includes(Q[0]??""))b1(Z,`${Z} must have exactly one of \`headers\`, \`jsonPatch\`, \`postgres\`, \`smtp\`, \`socks5\` or \`s3\` (got: ${Q.length===0?"nothing":Q.join(", ")})`);if(Q[0]==="s3"){Zz6($.s3,`${Z}.s3`);return}if(Q[0]==="jsonPatch"){let X=$.jsonPatch;if(!Array.isArray(X)||X.length>128)b1(Z,`${Z}.jsonPatch must be an array of at most 128 operations`);let Y=(K)=>typeof K==="string"&&(K===""||K.startsWith("/"))&&!/~(?:[^01]|$)/u.test(K),J=(K,W=new Set,H=0)=>{if(H>64)return!1;if(K===null||typeof K==="string"||typeof K==="boolean")return!0;if(typeof K==="number")return Number.isFinite(K);if(typeof K!=="object"||W.has(K))return!1;W.add(K);let F=(Array.isArray(K)?Array.from(K):XY(K)?Object.values(K):[void 0]).every((U)=>J(U,W,H+1));return W.delete(K),F};for(let[K,W]of X.entries()){if(!XY(W)||!["add","remove","replace","move","copy","test"].includes(String(W.op))||!Y(W.path))b1(Z,`${Z}.jsonPatch[${K}] requires a standard op and valid JSON Pointer path`);if(["move","copy"].includes(W.op)&&!Y(W.from))b1(Z,`${Z}.jsonPatch[${K}].from must be a JSON Pointer`);if(["add","replace","test"].includes(W.op)&&(!Object.hasOwn(W,"value")||!J(W.value)))b1(Z,`${Z}.jsonPatch[${K}].value must be a JSON value (null is allowed)`)}let G;try{G=JSON.stringify(X)}catch{b1(Z,"jsonPatch must be JSON serializable")}if(Buffer.byteLength(G,"utf8")>65536)b1(Z,"jsonPatch exceeds 64 KiB");return}if(Q[0]==="socks5"){let X=$.socks5;if(!XY(X))b1(`${Z}.socks5`,`${Z}.socks5 must be an object with \`username\` and \`password\``);for(let Y of Object.keys(X))if(!["username","password"].includes(Y))b1(`${Z}.socks5.${Y}`,`${Z}.socks5 has unknown field \`${Y}\`. Expected: username, password`);for(let Y of["username","password"])if(typeof X[Y]!=="string"||X[Y].length===0)b1(`${Z}.socks5.${Y}`,`${Z}.socks5.${Y} is required and must be a non-empty string`);return}if(Q[0]==="smtp"){let X=$.smtp;if(!XY(X))b1(`${Z}.smtp`,`${Z}.smtp must be an object with \`username\` and \`password\``);for(let Y of Object.keys(X))if(!["username","password"].includes(Y))b1(`${Z}.smtp.${Y}`,`${Z}.smtp has unknown field \`${Y}\`. Expected: username, password`);for(let Y of["username","password"])if(typeof X[Y]!=="string"||X[Y].length===0)b1(`${Z}.smtp.${Y}`,`${Z}.smtp.${Y} is required and must be a non-empty string`);return}if(Q[0]==="headers"){let X=$.headers;if(!XY(X))b1(`${Z}.headers`,`${Z}.headers must be an object of header name to value`);for(let[Y,J]of Object.entries(X))if(typeof J!=="string")b1(`${Z}.headers.${Y}`,`${Z}.headers.${Y} must be a string`)}else{let X=$.postgres;if(!XY(X))b1(`${Z}.postgres`,`${Z}.postgres must be an object with \`username\` and \`password\``);for(let J of Object.keys(X))if(!["username","password","database"].includes(J))b1(`${Z}.postgres.${J}`,`${Z}.postgres has unknown field \`${J}\`. Expected: username, password, database`);let Y=X;for(let J of["username","password"])if(typeof Y[J]!=="string"||Y[J].length===0)b1(`${Z}.postgres.${J}`,`${Z}.postgres.${J} is required and must be a non-empty string`);if(Y.database!==void 0&&typeof Y.database!=="string")b1(`${Z}.postgres.database`,`${Z}.postgres.database must be a string`)}}function Xz6($,Z){let Q=$;return Z.forEach((X,Y)=>{let J=$z6(X);if(Q===void 0)Q=J;else if(Q!==J)b1(`transform[${Y}]`,`transform requires protocol \`${J}\` but the rule is \`${Q}\`; a rule terminates one protocol`)}),Q??"http"}function Yz6($,Z){if(!XY($)||Object.keys($).some((Q)=>Q!=="method"&&Q!=="path"))b1(Z,`${Z} must be an object containing only method and path`);if($.method!==void 0&&(!Array.isArray($.method)||$.method.some((Q)=>typeof Q!=="string"||Q.length===0||/[^!#$%&'*+.^_`|~0-9A-Za-z-]/.test(Q))))b1(`${Z}.method`,`${Z}.method must be an array of HTTP method tokens`);if($.path!==void 0){let Q=$.path;if(!XY(Q)||Object.keys(Q).length!==1||typeof Q.exact!=="string"||!Q.exact.startsWith("/")||/[\s?#]/.test(Q.exact))b1(`${Z}.path`,`${Z}.path must contain exact: an absolute path without a query or fragment`)}}function Vr$($,Z){if(!XY($))b1(Z||"rule",`${Z||"rule"} must be an object`);for(let H of Object.keys($))if(!qr$.includes(H))b1(`${Z}${H}`,`Unknown field \`${H}\`. Expected one of: ${qr$.join(", ")}`);let Q=$;if(Q.action===void 0)b1(`${Z}action`,`${Z}action is required. Write \`action: "allow"\` \u2014 every rule states what it does rather than defaulting to it`);if(Q.action!=="allow")b1(`${Z}action`,`${Z}action must be "allow" (got \`${String(Q.action)}\`). Only allow rules exist today`);if(Q.protocol!==void 0&&!Dr$.includes(Q.protocol))b1(`${Z}protocol`,`${Z}protocol must be one of: ${Dr$.join(", ")} (got \`${String(Q.protocol)}\`)`);let X=Q.source??{},Y=Q.destination??{};Rr$(X,"source"),Rr$(Y,"destination");let J=Q.transform??[];if(!Array.isArray(J))b1(`${Z}transform`,`${Z}transform must be an array`);J.forEach((H,F)=>Qz6(H,`${Z}transform[${F}]`));let G=Xz6(Q.protocol,J);if(Q.match!==void 0){if(Yz6(Q.match,`${Z}match`),G!=="http"||X.public===!0||!(Y.public===!0||Y.host!==void 0))b1(`${Z}match`,"match requires HTTP egress from a VM or VPC to a public origin or host")}if(J.some((H)=>("s3"in H))){if(J.length!==1||Q.match!==void 0||X.public===!0||!(Y.public===!0||Y.host!==void 0)||Q.domain.includes("*"))b1(`${Z}transform`,"s3 requires a sole transform on HTTP egress to a concrete origin, without match")}let K=J.filter((H)=>("jsonPatch"in H));if(K.length>1)b1(`${Z}transform`,"a rule may carry only one jsonPatch transform");if(K.length&&(X.public===!0||!(Y.public===!0||Y.host!==void 0)))b1(`${Z}transform`,"jsonPatch requires HTTP egress from a VM or VPC to a public origin or host");if(Q.forwardAuth!==void 0){sE6(Q.forwardAuth,`${Z}forwardAuth`);let H=Y.vmId!==void 0||!l60(Y)&&Y.port!==void 0;if(G!=="http"||X.public!==!0||!H||Q.domain==="*")b1(`${Z}forwardAuth`,`${Z}forwardAuth is only supported on HTTP public ingress: \`{ public: true } -> { vmId, port }\``)}if(G==="smtp")eE6(Q.domain);else RB1(Q.domain);if((X.vmId!==void 0||X.vpcId!==void 0)&&Y.vmId!==void 0&&J.length>0)b1(`${Z}transform`,"a VM-to-VM rule cannot carry a transform yet \u2014 remove it (only public ingress/egress rules run transforms)");if(G==="tcp"){let H=Y.public===!0||Y.host!==void 0,F=X.vmId!==void 0||X.vpcId!==void 0;if(H||F)b1(`${Z}protocol`,"a `tcp` rule is public ingress only \u2014 `{ public: true } -> { vmId, port }`. The edge splices the session without terminating it, so outbound there is nothing to broker (an outbound allow is a firewall rule, and injecting into one needs `http` or `postgres`) and inward there is no certificate to answer the source with. Give the source `public: true`, or drop `protocol` to be served as HTTPS")}else if(G==="imap"||G==="imaps"){let H=Y.public===!0||Y.host!==void 0,F=X.vmId!==void 0||X.vpcId!==void 0;if(H||F)b1(`${Z}protocol`,`an \`${G}\` rule is public ingress only \u2014 \`{ public: true } -> { vmId, port }\`. The 993 front serves mail clients reaching a VM's IMAP server; outbound there is nothing to broker (an outbound allow is a firewall rule) and inward there is no certificate to answer the source with`)}else if(G==="socks5"){let H=Y.public===!0||Y.host!==void 0;if(X.public===!0||!H)b1(`${Z}protocol`,'a `socks5` rule is egress only \u2014 `{ vmId } -> { host: "gate.provider.com", port: 1080 }`. The front exists so a guest can open sessions through a proxy whose credentials it never holds; inbound there is nothing to serve, and publishing one would be an open proxy on a platform address');if(Y.host===void 0)b1(`${Z}destination`,"a `socks5` rule has to name the proxy it goes through: give the destination a `host` and the `port` the provider listens on. `{ public: true }` on its own asks the edge to be the proxy, which would let the guest out on our address rather than through yours")}else if(G==="postgres"){let H=J.some((U)=>U!==null&&typeof U==="object"&&("postgres"in U)),F=Y.public===!0||Y.host!==void 0;if(H&&!F)b1(`${Z}transform`,"a `postgres` transform belongs on an egress rule: the edge spends a credential the guest never holds, so pointing it at your own VM would hand every client a logged-in session. Give the destination `public: true` or a `host`, or drop the transform")}else if(G==="smtp"){let H=J.some((U)=>U!==null&&typeof U==="object"&&("smtp"in U)),F=Y.public===!0||Y.host!==void 0;if(H&&!F)b1(`${Z}transform`,"an `smtp` transform belongs on an egress rule: the edge spends a credential the guest never holds, so pointing it at your own VM would turn it into an open relay. Give the destination `public: true` or a `host`, or drop the transform");if(typeof Q.domain==="string"&&Q.domain.includes("@")&&X.public!==!0)b1(`${Z}domain`,`\`${Q.domain}\` names a mailbox, which only makes sense on a rule that receives mail. An egress or VM-to-VM rule names the host the guest submits through \u2014 drop the part before \`@\``)}return{...Q,source:X,destination:Y}}function Jz6($,Z){if($==="source")return rE6(Z)?"source is empty. Say who opens the session: `vmId`, `vpcId`, or `public: true`":"source only narrows the session without saying who opens it. Add `vmId`, `vpcId`, or `public: true`";return"destination is empty. Say where the session lands: `vmId` + `port`, `host` + `port`, or `public: true` for the domain's own origin"}function Mr$($){let Z=Vr$($,"");for(let Q of["source","destination"]){let X=Z[Q];if(!l60(X))b1(Q,Jz6(Q,X))}if(Z.source.public===!0&&Z.destination.public===!0)b1("destination","a rule from the public Internet to the domain's own origin allows nothing the world cannot already do. Did you mean a `vmId` destination (ingress) or a `vmId` source (egress)?");return Z}function kr$($){if(!XY($))b1("tls","tls must be an object with a `rules` array");for(let Q of Object.keys($))if(Q!=="rules")b1(`tls.${Q}`,`tls has unknown field \`${Q}\`. Expected: rules`);let Z=$.rules;if(!Array.isArray(Z))b1("tls.rules","tls.rules must be an array");return Z.forEach((Q,X)=>{let Y=`tls.rules[${X}].`,J=Vr$(Q,Y),G=l60(J.source),K=l60(J.destination);if(!G&&!K)b1(`tls.rules[${X}]`,`tls.rules[${X}]: both source and destination refer to the VM being created, which allows nothing. Give one of them a \`vmId\`, \`vpcId\`, or \`public: true\``);if(G&&K)b1(`tls.rules[${X}]`,`tls.rules[${X}]: neither end refers to the VM being created. Leave one endpoint's identity unset so it means this VM, or create the rule with tls.rules.create instead`);if(!K&&J.destination.port===void 0)b1(`tls.rules[${X}].destination.port`,`tls.rules[${X}]: destination.port is required: say which port on this VM the session lands on`)}),$}function TB1($){return`/v5/tls/${n6($)}`}function AB1($){return`/v5/tls/forward-auth/${n6($)}`}class Cr${client;constructor($){this.client=$}list(){return this.client.get("/v5/tls/forward-auth")}async create($){let Z=Tr$($);return this.client.post("/v5/tls/forward-auth",Z)}get($){return this.client.get(AB1($))}async update($,Z){let Q=Tr$(Z);return this.client.put(AB1($),Q)}delete($){return this.client.delete(AB1($))}}class Sr${client;constructor($){this.client=$}async create($){let Z=Mr$($);return this.client.post("/v5/tls",Z)}list($={}){return this.client.get("/v5/tls",$)}get($){return this.client.get(TB1($))}async update($,Z){let Q=Mr$(Z);return this.client.put(TB1($),Q)}delete($){return this.client.delete(TB1($))}}class IB1{client;rules;forwardAuth;constructor($){this.client=$,this.rules=new Sr$($),this.forwardAuth=new Cr$($)}}var qB1,MB1,Lr$,cE6,Dr$,mE6=253,dE6=63,Or$,jr$,iE6,pE6,nE6=2048,wr$=32,Er$=16384,zr$=32,Pr$=32,tE6=128,oE6,Ar$="!#$%&'*+-/=?^_`{|}~.",qr$;var tC0=L(()=>{qW();qB1=class qB1 extends Error{path;constructor($,Z){super(Z);this.name="TlsRuleValidationError",this.path=$,Object.setPrototypeOf(this,qB1.prototype)}};MB1=class MB1 extends Error{path;constructor($,Z){super(Z);this.name="TlsForwardAuthValidationError",this.path=$,Object.setPrototypeOf(this,MB1.prototype)}};Lr$=["vmId","vpcId","public","host","port"],cE6=["vmId","vpcId","public","host"],Dr$=["tcp","http","postgres","minecraft","smtp","imap","imaps","socks5"],Or$=["url","headers","timeoutMs","protectedCookies","authResponseHeaders"],jr$=["id"],iE6=/^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/,pE6=/^[0-9A-Za-z-]+$/,oE6=new Set(["host","content-length","connection","keep-alive","proxy-authenticate","proxy-authorization","proxy-connection","te","trailer","transfer-encoding","upgrade"]);qr$=["action","domain","protocol","source","destination","transform","match","forwardAuth"]});function np($){return`/v5/tunnels/${n6($)}`}function Ag($){return $.tunnelId??=$.id,$}class VB1{client;constructor($){this.client=$}list(){return this.client.get("/v5/tunnels").then(($)=>{return $.tunnels.forEach(Ag),$})}create($={}){return this.client.post("/v5/tunnels",$).then(Ag)}get($){return this.client.get(np($)).then(Ag)}update($,Z){return this.client.patch(np($),Z).then(Ag)}rotateKey($,Z={}){return this.client.post(`${np($)}/rotate-key`,Z).then(Ag)}delete($){return this.client.delete(np($))}attachVpc($,Z,Q={}){return this.client.post(`${np($)}/vpcs/${n6(Z)}`,Q).then(Ag)}detachVpc($,Z){return this.client.delete(`${np($)}/vpcs/${n6(Z)}`).then(Ag)}}var kB1=L(()=>{qW()});class CB1{client;basePath;constructor($,Z){this.client=$,this.basePath=Z}async readFile($,Z={}){let Q=await this.openRead($,Z);return new Uint8Array(await Q.arrayBuffer())}async readTextFile($,Z={}){return await(await this.openRead($,Z)).text()}async readFileStream($,Z={}){let Q=await this.openRead($,Z);if(!Q.body)throw Error(`no response body reading ${$}`);return Q.body}async writeFile($,Z,Q={}){let X=typeof Z==="string"?new TextEncoder().encode(Z):Z,Y=X instanceof Uint8Array?X.byteLength:X.size;if(Y>Gz6)return this.uploadInChunks($,X,Y,Q);let J=X instanceof Uint8Array?X:new Uint8Array(await X.arrayBuffer());await this.client.putBytes(`${this.basePath}/fs/write`,J,{path:$,mode:Q.mode,sha256:await _r$(J)},Q.signal),Q.onProgress?.({completedBytes:Y,totalBytes:Y})}writeTextFile($,Z,Q={}){return this.writeFile($,Z,Q)}async readDir($){let{entries:Z}=await this.client.get(`${this.basePath}/fs/dir`,{path:$});return Z}async mkdir($){await this.client.post(`${this.basePath}/fs/mkdir`,{path:$})}async remove($){await this.client.delete(`${this.basePath}/fs/remove`,{path:$})}async exists($){let{exists:Z}=await this.client.get(`${this.basePath}/fs/exists`,{path:$});return Z}stat($){return this.client.get(`${this.basePath}/fs/stat`,{path:$})}openRead($,Z){let{offset:Q,length:X}=Z,Y;if(Q!==void 0||X!==void 0){let J=Q??0;Y=X===void 0?`bytes=${J}-`:`bytes=${J}-${J+X-1}`}return this.client.getBytes(`${this.basePath}/fs/read`,{path:$},{range:Y,signal:Z.signal})}async uploadInChunks($,Z,Q,X){let Y=X.chunkSize??Kz6,J=X.maxAttempts??Wz6,G=Z instanceof Uint8Array?await _r$(Z):void 0,K=await this.client.post(`${this.basePath}/fs/uploads`,{path:$,size:Q,sha256:G,mode:X.mode}),W=`${this.basePath}/fs/uploads/${K.uploadId}`;try{let H=K.receivedBytes;while(H<Q){let F=Math.min(H+Y,Q),U=Z instanceof Uint8Array?Z.subarray(H,F):Z.slice(H,F);H=(await this.putChunkWithRetry(W,U,H,J,X.signal)).receivedBytes,X.onProgress?.({completedBytes:Math.min(H,Q),totalBytes:Q})}await this.client.post(`${W}/commit`)}catch(H){throw await this.client.delete(W).catch(()=>{}),H}}async putChunkWithRetry($,Z,Q,X,Y){let J;for(let G=1;G<=X;G++){Y?.throwIfAborted?.();try{return await this.client.putBytes($,Z,{offset:Q},Y)}catch(K){if(J=K,!(!(K instanceof KJ)||K.status>=500||K.status===408||K.status===409||K.status===429)||Y?.aborted||G===X)throw K;await Hz6(Math.min(500*2**(G-1),8000));let H=await this.client.get($).catch(()=>{return});if(H&&H.receivedBytes>Q)return H}}throw J}}async function _r$($){let Z=globalThis.crypto?.subtle;if(!Z)return;let Q=await Z.digest("SHA-256",$);return Array.from(new Uint8Array(Q),(X)=>X.toString(16).padStart(2,"0")).join("")}function Hz6($){return new Promise((Z)=>setTimeout(Z,$))}var Gz6=8388608,Kz6=16777216,Wz6=5;var SB1=L(()=>{h60()});function Fz6(){return typeof process<"u"&&Boolean(process.versions?.node)}async function vr$($,Z){if(Fz6()){let X;try{X=await import("ws")}catch{throw Error("PTY sessions need the `ws` package in Node. Install it with `npm install ws`.")}return new X.default($,{headers:Z})}let Q=globalThis.WebSocket;if(!Q)throw Error("PTY sessions need a WebSocket client; no global WebSocket is available in this environment.");return new Q($)}function c60($,Z,Q){if($.on){$.on(Z,Q);return}$.addEventListener?.(Z,Q)}function Nz6($,Z){if($&&typeof $==="object"&&"data"in $){let Q=$.data;if(typeof Q==="string")return{text:Q};if(Q instanceof ArrayBuffer)return{binary:new Uint8Array(Q)};return{}}if($ instanceof Uint8Array)return Z?{binary:$}:{text:Uz6.decode($)};if(typeof $==="string")return{text:$};return{}}class _B1{_sessionId;_slug;_created=!1;socket;constructor($,Z,Q={}){this.socket=$,this._sessionId=Z,c60($,"message",(X,Y)=>{let{text:J,binary:G}=Nz6(X,Y);if(G){Q.onData?.(G);return}if(!J)return;let K;try{K=JSON.parse(J)}catch{return}if(K.type==="exited")Q.onExit?.(K.exitCode);else if(K.type==="error")Q.onError?.(Error(K.message));else if(K.type==="sessionInfo")this._sessionId=K.sessionId,this._slug=K.slug,this._created=K.created??!0,Q.onSessionInfo?.(K.sessionId)}),c60($,"close",(X)=>{let Y=X;Q.onClose?.({wasClean:Y?.wasClean??!0,code:Y?.code??1000,reason:Y?.reason??""})}),c60($,"error",(X)=>Q.onError?.(X))}write($){this.socket.send(typeof $==="string"?new TextEncoder().encode($):$)}resize($){this.sendControl({type:"resize",cols:$.cols,rows:$.rows})}signal($){this.sendControl({type:"signal",signal:$})}sendControl($){this.socket.send(JSON.stringify($))}detach(){this.socket.close()}get sessionId(){return this._sessionId}get slug(){return this._slug}get created(){return this._created}get readyState(){return this.socket.readyState}}function Bz6($){return new Promise((Z,Q)=>{if($.readyState===1){Z();return}c60($,"open",()=>Z()),c60($,"error",(X)=>Q(X))})}class vB1{client;basePath;constructor($,Z){this.client=$,this.basePath=Z}async open($={}){let{exec:Z,cols:Q,rows:X,linuxUser:Y,slug:J,replaceOnExit:G,onData:K,onExit:W,onClose:H,onError:F}=$,U={};if(Z!==void 0)U.exec=Z;if(Q!==void 0)U.cols=Q;if(X!==void 0)U.rows=X;if(Y!==void 0)U.linuxUser=Y;if(J!==void 0)U.slug=J;if(G!==void 0)U.replaceOnExit=String(G);let N=xr$(this.client,`${this.basePath}/pty`,U),B=this.client.authHeaders(),D=await vr$(N,B);return new Promise((O,j)=>{let w=!1,E=new _B1(D,-1,{onData:K,onExit:W,onClose:(z)=>{if(!w)w=!0,j(Error("connection closed before sessionInfo"));H?.(z)},onError:(z)=>{if(!w)w=!0,j(z);F?.(z)},onSessionInfo:()=>{w=!0,O(E)}})})}async attach($){let{session:Z,linuxUser:Q,onData:X,onExit:Y,onClose:J,onError:G}=$,K=xr$(this.client,`${this.basePath}/pty/sessions/${n6(String(Z))}`,{...Q!==void 0?{linuxUser:Q}:{}}),W=this.client.authHeaders(),H=await vr$(K,W),F=new _B1(H,typeof Z==="number"?Z:-1,{onData:X,onExit:Y,onClose:J,onError:G});return await Bz6(H),F}list($={}){return this.client.get(`${this.basePath}/pty/sessions`,$)}close($,Z={}){return this.client.delete(`${this.basePath}/pty/sessions/${n6(String($))}`,Z)}}class xB1{pty;linuxUser;constructor($,Z){this.pty=$,this.linuxUser=Z}open($={}){return this.pty.open({...$,linuxUser:this.linuxUser})}attach($){return this.pty.attach({...$,linuxUser:this.linuxUser})}list(){return this.pty.list({linuxUser:this.linuxUser})}close($){return this.pty.close($,{linuxUser:this.linuxUser})}}function xr$($,Z,Q){return $.url(Z,Q).replace(/^http/,"ws")}var Uz6;var fB1=L(()=>{qW();Uz6=new TextDecoder});class bB1{client;constructor($){this.client=$}list($={}){return this.client.get("/v5/snapshots",$)}get($){return this.client.get(`/v5/snapshots/${n6($)}`)}update($,Z){return this.client.patch(`/v5/snapshots/${n6($)}`,Z)}delete($){return this.client.delete(`/v5/snapshots/${n6($)}`)}}var yB1=L(()=>{qW()});var fr$=()=>{};function gB1($){return`/v5/vms/${n6($)}`}class hB1{id;fs;pty;client;basePath;constructor($,Z){this.client=$,this.id=Z,this.basePath=gB1(Z),this.fs=new CB1($,this.basePath),this.pty=new vB1($,this.basePath)}data(){return this.client.get(this.basePath)}firewallRules(){return this.client.get("/v5/firewall/rules",{vmId:this.id})}update($){return this.client.patch(this.basePath,$)}start(){return this.client.post(`${this.basePath}/start`)}pause(){return this.client.post(`${this.basePath}/pause`)}resize($){return this.client.post(`${this.basePath}/resize`,$)}delete(){return this.client.delete(this.basePath)}exec($){let Z=typeof $==="string"?{command:$}:$;return this.client.post(`${this.basePath}/exec-await`,Z)}linuxUser($){return new br$(this,$)}snapshot($={}){return this.client.post(`${this.basePath}/snapshot`,$)}}class br${vm;linuxUser;pty;constructor($,Z){this.vm=$,this.linuxUser=Z,this.pty=new xB1($.pty,Z)}exec($){let Z=typeof $==="string"?{command:$}:$;return this.vm.exec({...Z,linuxUser:this.linuxUser})}}class uB1{client;snapshots;constructor($){this.client=$,this.snapshots=new bB1($)}async create($){if(nC0($.firewall,"VM"),$.tls!==void 0)kr$($.tls);let Z=await this.client.post("/v5/vms",$);return{vm:new hB1(this.client,Z.id),vmId:Z.id,data:Z,firewallRules:Z.firewallRules??[],tlsRules:Z.tlsRules??[]}}list($={}){return this.client.get("/v5/vms",$)}get($){return this.client.get(gB1($))}ref($){return new hB1(this.client,$)}delete($){return this.client.delete(gB1($))}}var lB1=L(()=>{u60();tC0();qW();SB1();fB1();yB1();fr$();SB1();fB1();yB1()});function cB1($){return`/v5/vpcs/${n6($)}`}class yr${client;basePath;constructor($,Z){this.client=$,this.basePath=Z}list(){return this.client.get(`${this.basePath}/tunnels`)}}class mB1{id;tunnels;client;basePath;constructor($,Z){this.client=$,this.id=Z,this.basePath=cB1(Z),this.tunnels=new yr$($,this.basePath)}data(){return this.client.get(this.basePath)}update($){return this.client.patch(this.basePath,$)}delete(){return this.client.delete(this.basePath)}}class dB1{client;constructor($){this.client=$}list(){return this.client.get("/v5/vpcs")}async create($={}){if($.firewall!==void 0)nC0($.firewall,"network");let Z=await this.client.post("/v5/vpcs",$);return{vpc:new mB1(this.client,Z.id),vpcId:Z.id,data:Z,firewallRules:Z.firewallRules??[]}}get($){return this.client.get(cB1($))}ref($){return new mB1(this.client,$)}delete($){return this.client.delete(cB1($))}}var iB1=L(()=>{u60();qW()});class oC0{client;vms;vpc;tunnels;firewall;tls;domains;identities;constructor($={}){this.client=new UB1($),this.vms=new uB1(this.client),this.vpc=new dB1(this.client),this.tunnels=new VB1(this.client),this.firewall=new jB1(this.client),this.tls=new IB1(this.client),this.domains=new NB1(this.client),this.identities=new zB1(this.client)}fetch($,Z){return this.client.fetch($,Z)}}var gr$=L(()=>{qW();BB1();u60();PB1();tC0();kB1();lB1();iB1();qW();h60();lB1();iB1();kB1();BB1();u60();tC0();PB1()});var ur$;var hr$=L(()=>{ur$={name:"@decocms/sandbox",version:"1.80.4",private:!0,type:"module",description:"Sandbox runtime for isolated Studio tool execution",scripts:{check:"tsc --noEmit",test:"bun test",build:"bun run build:typegen && bun run build:harness-runner","build:typegen":"mkdir -p dist && bun run --cwd=../typegen build && bun --cwd=../typegen pm pack --filename $PWD/dist/typegen.tgz --quiet","build:harness-runner":"mkdir -p dist && bun --cwd=../harness-runner pm pack --filename $PWD/dist/harness-runner.tgz --quiet"},exports:{"./shared":"./shared.ts","./provider":"./server/provider/index.ts","./provider/agent-sandbox":"./server/provider/agent-sandbox/index.ts","./provider/postgres-state-store":"./server/provider/postgres-state-store.ts","./provider/freestyle":"./server/provider/freestyle.ts","./provider/remote":"./server/provider/remote.ts","./provider/router":"./server/provider/router.ts","./provider/sandbox-api":"./server/provider/sandbox-api.ts","./provider/sandbox-server":"./server/provider/sandbox-server.ts","./daemon-client":"./server/daemon-client.ts","./org-fs":"./org-fs.ts","./dispatch":"./dispatch/index.ts","./dispatch/*":"./dispatch/*.ts","./proxy/http":"./proxy/http.ts","./proxy/websocket":"./proxy/websocket.ts"},dependencies:{"@decocms/shared":"workspace:*","@kubernetes/client-node":"^1.4.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0",freestyle:"0.2.16",zod:"4.3.6"},devDependencies:{"@types/bun":"latest",postgres:"^3.4.5",typescript:"^7.0.2"}}});function rC0($){let Z=$?.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of studio-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"});return async(Q,X)=>{if(!Z)return X();let Y=performance.now(),J=(G)=>Z.record(performance.now()-Y,{runner_kind:Q,source:"daemon",status_code:G});try{let G=await X();return J(G.status),G}catch(G){throw J(0),G}}}var iD;var aC0=L(()=>{iD={kubernetes:"agent-sandbox",freestyle:"freestyle"}});var or$={};J0(or$,{FreestyleSandboxProvider:()=>tr$});import{createHash as Dz6,randomBytes as Oz6}from"crypto";class tr${freestyle;lookupClient;image;sidecarImage;idleTimeoutSeconds;autoDeleteSeconds;domainSuffix;timeDaemonRequest;inflight=new zg;snapshotInflight=new zg;lookups=new Map;releaseTimers=new Map;constructor($){this.freestyle=$.client??new oC0({apiKey:$.apiKey}),this.lookupClient=$.client??new oC0({apiKey:$.apiKey,fetch:Object.assign((Z,Q)=>fetch(Z,{...Q,signal:Q?.signal?AbortSignal.any([Q.signal,AbortSignal.timeout(ir$)]):AbortSignal.timeout(ir$)}),{preconnect:fetch.preconnect})}),this.image=$.image??`ghcr.io/decocms/studio/studio-sandbox-go:${ur$.version}`,this.sidecarImage=$.orgFsSidecarImage??wz6,this.idleTimeoutSeconds=$.idleTimeoutSeconds??300,this.autoDeleteSeconds=$.autoDeleteSeconds??86400,this.domainSuffix=$.domainSuffix??"style.dev",this.timeDaemonRequest=rC0($.meter)}async owns($){return await this.find($)!==null}daemonUrl($){return`https://${$}.${this.domainSuffix}`}async find($,Z={}){let Q=this.lookups.get($);if(!Z.refresh&&Q&&Date.now()-Q.at<(Q.found?Rz6:qz6))return Q.found;let X=null;try{let Y=await this.lookupClient.vms.get($),J=Y.metadata[mr$];if(J)X={vm:this.freestyle.vms.ref(Y.id),daemon:{url:this.daemonUrl($),token:J}}}catch(Y){if(!(Y instanceof KJ&&Y.status===404))throw Y}return this.remember($,X),X}remember($,Z){if(this.lookups.delete($),this.lookups.size>=Mz6){let Q=this.lookups.keys().next();if(!Q.done)this.lookups.delete(Q.value)}this.lookups.set($,{found:Z,at:Date.now()})}baseSnapshot(){let{image:$,sidecarImage:Z}=this,Q=`studio-sandbox-${Dz6("sha256").update(`${$}
+${Y}`:Y}var Yo$,Ow6;var lN1=L(()=>{Yo$=/[\r\n<>]/,Ow6=/^[^\s@<>]+@[^\s@<>]+\.[^\s@<>]+$/});var VC0=L(()=>{$8();lN1()});function ww6($){if($ instanceof TypeError)return!0;if($ instanceof Error&&!($ instanceof DOMException)&&typeof $.code==="string")return!0;if($ instanceof DOMException&&$.name==="AbortError")return!0;return!1}async function cN1($,Z,Q,X){try{return await O8(async()=>{let J=await fetch($,{...Z,signal:AbortSignal.timeout(X)});return{status:J.status,ok:J.ok,body:await J.text()}},{maxAttempts:3,minTimeout:50,maxTimeout:500,multiplier:2,jitter:0.5,isRetriable:ww6})}catch(Y){let J=Y instanceof Error?Y.message:String(Y);throw Error(`[SANDBOX_UNREACHABLE] sandbox daemon ${Q} request failed: ${J}`,{cause:Y})}}async function kC0($){try{let Z=await fetch(`${$}/health`,{signal:AbortSignal.timeout(Ew6)});if(!Z.ok){try{await Z.text()}catch{}return null}let Q=await Z.json();if(typeof Q==="object"&&Q!==null&&typeof Q.bootId==="string"&&typeof Q.ready==="boolean"&&Q.setup&&typeof Q.setup.running==="boolean"&&typeof Q.setup.done==="boolean")return Q;return null}catch{return null}}async function dN1($){for(let Z=0;Z<Go$;Z++){if(await kC0($)!==null)return;let Q=(Math.random()*2-1)*zw6;await $$(Ko$+Q)}throw Error(`sandbox daemon at ${$} did not respond on /health within ${Go$*Ko$/1000}s`)}async function cN($,Z,Q,X,Y){return Pw6($,Z,"POST",Q,X,Y)}async function Pw6($,Z,Q,X,Y,J){let G={...X};if(Y&&Y.rotateToken!==void 0)G.auth=Y;let K=await cN1(`${$}/_sandbox/config`,{method:Q,headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:JSON.stringify(G)},"/_sandbox/config",J?.timeoutMs??mN1);if(!K.ok)throw new PF(K.status,K.body);return Ho$(K.body,"/_sandbox/config")}async function Wo$($,Z,Q){let X=await cN1(`${$}/_sandbox/setup/${Q}`,{method:"POST",headers:{Authorization:`Bearer ${Z}`}},`/_sandbox/setup/${Q}`,mN1);if(!X.ok)throw Error(`sandbox daemon /_sandbox/setup/${Q} returned ${X.status}: ${X.body}`)}async function _60($,Z,Q){let X=await cN1(`${$}/_sandbox/orgfs-config`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:Q},"/_sandbox/orgfs-config",mN1);if(!X.ok)throw Error(`sandbox daemon /_sandbox/orgfs-config returned ${X.status}: ${X.body}`);return Ho$(X.body,"/_sandbox/orgfs-config")}function Ho$($,Z){try{return JSON.parse($)}catch(Q){throw Error(`sandbox daemon ${Z} returned a malformed JSON body: ${$.slice(0,200)}`,{cause:Q})}}async function CC0($,Z,Q,X){let Y=new Headers(X.headers);for(let K of Tw6)Y.delete(K);Y.set("authorization",`Bearer ${Z}`);let J=X.method!=="GET"&&X.method!=="HEAD",G=`${$}${Q.startsWith("/")?Q:`/${Q}`}`;return fetch(G,{method:X.method,headers:Y,body:J?X.body:void 0,redirect:"manual",signal:X.signal,duplex:J?"half":void 0})}var PF,Ew6=500,mN1=30000,Go$=25,Ko$=200,zw6=50,Tw6;var Eg=L(()=>{VC0();$8();PF=class PF extends Error{status;constructor($,Z){super(`sandbox daemon /_sandbox/config returned ${$}: ${Z}`);this.status=$;this.name="ConfigRequestError"}};Tw6=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length"]});class SC0{counted=new Set;markCounted($){this.counted.add($)}consume($){return this.counted.delete($)}}class zg{map=new Map;async run($,Z){let Q=this.map.get($);if(Q)return Q;let X=Z();this.map.set($,X);try{return await X}finally{this.map.delete($)}}}function _C0($,Z,Q){if(!$)return Q(null);if(!$.withLock)return Q($);return $.withLock(Z,Q)}function v60($){if(!$.orgId||!$.virtualMcpId||!$.branch)throw Error("composeSandboxRef: orgId, virtualMcpId and branch are all required for agent refs");return`agent:${$.orgId}:${$.virtualMcpId}:${$.branch}`}function Fo$($){if(!$.startsWith("agent:"))return"";let Z=$.split(":");return Z.length>=4?Z.slice(3).join(":"):""}import{hash as Aw6}from"crypto";function Rw6($,Z=16){return Aw6("sha256",al$($),"hex").slice(0,Z)}function c3($){let Z=Rw6($),Q=qw6(Fo$($.projectRef));return Q?`${Q}-${Z}`:`s-${Z}`}function qw6($){if(!$)return"";let Z=$.split("/").pop()??"",Q="",X=!1;for(let Y of Z.toLowerCase()){let J=Y.charCodeAt(0),G=J>=97&&J<=122,K=J>=48&&J<=57;if(!G&&!K){X||=Q.length>0;continue}if(X){if(Q.length+1>=Uo$)break;Q+="-",X=!1}if(Q+=Y,Q.length===Uo$)break}return Q}var Uo$=24;var No$=L(()=>{uF1()});function vC0($,Z){let Q=$.replace(/\/+$/,"");if(Q.includes("{handle}"))return`${Q.replace("{handle}",Z)}/`;try{let X=new URL(Q);return X.hostname=`${Z}.${X.hostname}`,`${X.toString()}/`}catch{return`${Q}/${Z}/`}}function up($){let Z=$.repo,Q=Z?{repository:{cloneUrl:Z.cloneUrl,repoName:Z.displayName??Mw6(Z.cloneUrl),...Z.branch?{branch:Z.branch}:{},submoduleCredentials:Z.submoduleCredentials??[]},repositories:($.extraRepos??[]).filter((W)=>!!W.directoryName).map((W)=>({cloneUrl:W.cloneUrl,repoName:W.directoryName,...W.branch?{branch:W.branch}:{},submoduleCredentials:W.submoduleCredentials??[]})),...Z.userName.trim()||Z.userEmail.trim()?{identity:{userName:Z.userName,userEmail:Z.userEmail}}:{}}:void 0,X=$.tenant,Y=hp({userName:X?.userName,userEmail:X?.userEmail})??void 0,J=$.packageManager?{name:$.packageManager.name,...$.packageManager.path?{path:$.packageManager.path}:{}}:void 0,G=J?{packageManager:J,runtime:$.runtime,...$.port!==void 0?{port:$.port}:{}}:void 0,K=X?.orgId;if(!Q&&!G&&!Y&&$.cloneOnly===void 0&&!K)return null;return{...Q?{git:Q}:{},...Y?{operator:Y}:{},...K?{orgId:K}:{},...$.cloneOnly!==void 0?{cloneOnly:$.cloneOnly}:{},...G?{application:G}:{}}}function Mw6($){try{let Z=new URL($);return Z.pathname.replace(/^\/+/,"").replace(/\.git$/,"")||Z.hostname}catch{return $}}var Bo$=L(()=>{lN1()});function Iw6($){try{return new URL($).username.length>0}catch{return!1}}function x60($){let Z=$.repo?.cloneUrl;if(!Z||!Iw6(Z))return null;return{git:{repository:{cloneUrl:Z}}}}var lp=L(()=>{No$();Bo$()});async function*Oo$($){let Z=$.now??(()=>Date.now()),Q=Z(),X=$.schedulingTimeoutMs??kw6,Y={pod:{},sandbox:{},events:{hasPulling:!1,hasPulled:!1},startedAt:Q},J=[],G=null,K=!1,W=(E)=>{if(K)return;if(G){let z=G;G=null,z(E)}else J.push(E)},H=()=>{if(J.length>0)return Promise.resolve(J.shift());if(K)return Promise.resolve(null);return new Promise((E)=>{G=E})},F=()=>{if(K)return;if(K=!0,G){let E=G;G=null,E(null)}},U=new AbortController,N=()=>{U.abort(),F()};if($.signal)if($.signal.aborted)U.abort(),F();else $.signal.addEventListener("abort",N,{once:!0});let B=Math.max(0,X-(Z()-Q)),D=setTimeout(()=>W("tick"),B+100),O,j=new Promise((E)=>{O=E}),w=Promise.allSettled([Sw6($.kc,$.namespace,$.claimName,U.signal,Y,W,Z,O),vw6($.kc,$.namespace,$.claimName,U.signal,Y,W),xw6($.kc,$.namespace,$.claimName,j,U.signal,Y,W,Z)]);try{let E=null,z=-1,A=Lo$(Y,X,Z);if(E=pN1(A),!iN1(A))z=Do$(A);if(yield A,iN1(A))return;while(!K){if(await H()===null)break;let T=Lo$(Y,X,Z);if(iN1(T)){let S=pN1(T);if(S!==E)E=S,yield T;return}let q=Do$(T);if(q<z)continue;let f=pN1(T);if(f!==E)E=f,z=q,yield T}}finally{if(clearTimeout(D),U.abort(),$.signal)$.signal.removeEventListener("abort",N);F(),await w.catch(()=>{})}}async function jo$($,Z=Cw6){let Q=new AbortController,X="claiming",Y,J=()=>{clearTimeout(Y),Y=setTimeout(()=>Q.abort(),Z)};try{J();for await(let G of $(Q.signal)){if(G.kind==="ready")return;if(G.kind==="failed")throw new $Y(G.message);X=G.kind,J()}}finally{clearTimeout(Y),Q.abort()}throw new Rp(`Sandbox did not become ready: no progress for ${Math.round(Z/1000)}s while ${X}`)}function Lo$($,Z,Q){let{pod:X,sandbox:Y,events:J,startedAt:G}=$;if(Y.ready)return{kind:"ready"};let K=X.containerWaitingReason;if(K==="ImagePullBackOff"||K==="ErrImagePull")return{kind:"failed",reason:"image-pull-backoff",message:"Sandbox image failed to download. The cluster may be missing pull credentials or the image tag may not exist."};if(K==="CrashLoopBackOff")return{kind:"failed",reason:"crash-loop-backoff",message:"Sandbox crashed during startup and is now in CrashLoopBackOff. Check pod logs."};if(!X.scheduled&&J.lastFailedSchedulingAt!==void 0&&Q()-G>Z)return{kind:"failed",reason:"scheduling-timeout",message:J.failedSchedulingMessage??`Pod could not be scheduled within ${Math.round(Z/1000)}s.`};if(X.containerRunning&&!X.containerReady)return{kind:"warming-daemon",since:G};if(J.hasPulling&&!J.hasPulled)return{kind:"pulling-image",since:G};if(K==="ContainerCreating"||K==="PodInitializing"||X.scheduled&&!X.containerRunning)return{kind:"starting-container",since:G};if(X.scheduledFalseReason==="Unschedulable"||J.lastFailedSchedulingAt!==void 0&&!X.scheduled)return{kind:"waiting-for-capacity",since:G,message:J.failedSchedulingMessage??X.scheduledFalseMessage,nodeClaim:J.nominatedNodeClaim};return{kind:"claiming",since:G}}function iN1($){return $.kind==="ready"||$.kind==="failed"}function Do$($){switch($.kind){case"claiming":return 0;case"waiting-for-capacity":return 1;case"pulling-image":return 2;case"starting-container":return 3;case"warming-daemon":return 4;case"ready":case"failed":return 99}}function pN1($){switch($.kind){case"claiming":case"pulling-image":case"starting-container":case"warming-daemon":return $.kind;case"waiting-for-capacity":return`waiting-for-capacity:${$.message??""}:${$.nodeClaim??""}`;case"ready":return"ready";case"failed":return`failed:${$.reason}:${$.message}`}}async function Sw6($,Z,Q,X,Y,J,G,K){let W=`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?watch=true&labelSelector=${encodeURIComponent(`${Vw6}=${Q}`)}`;return xC0({kc:$,path:W,signal:X,label:`pod/${Q}`,onEvent:(H)=>{if(H.type!=="ADDED"&&H.type!=="MODIFIED")return;let F=H.object;if(F.metadata?.name)K(F.metadata.name);_w6(F,Y,G),J("pod")}})}function _w6($,Z,Q){let Y=($.status?.conditions??[]).find((G)=>G.type==="PodScheduled");if(Y?.status==="True")Z.pod.scheduled=!0,Z.pod.scheduledFalseReason=void 0,Z.pod.scheduledFalseMessage=void 0;else if(Y?.status==="False")Z.pod.scheduled=!1,Z.pod.scheduledFalseReason=Y.reason,Z.pod.scheduledFalseMessage=Y.message;let J=($.status?.containerStatuses??[]).find((G)=>G.name===Q7.MAIN_CONTAINER_NAME);if(J)Z.pod.containerWaitingReason=J.state?.waiting?.reason,Z.pod.containerRunning=!!J.state?.running,Z.pod.containerReady=J.ready===!0}async function vw6($,Z,Q,X,Y,J){let G=`/apis/${Q7.CLAIM_API_GROUP}/${Q7.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(Z)}/${Q7.CLAIM_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${Q}`)}`;return xC0({kc:$,path:G,signal:X,label:`sandboxclaim/${Q}`,onEvent:(K)=>{if(K.type!=="ADDED"&&K.type!=="MODIFIED")return;let H=K.object.status?.conditions?.find((F)=>F.type==="Ready");if(!H)return;if(H.status==="True")Y.sandbox.ready=!0,Y.sandbox.notReadyReason=void 0,Y.sandbox.notReadyMessage=void 0;else Y.sandbox.ready=!1,Y.sandbox.notReadyReason=H.reason,Y.sandbox.notReadyMessage=H.message;J("sandbox")}})}async function xw6($,Z,Q,X,Y,J,G,K){let W=await Promise.race([X,new Promise((F)=>{if(Y.aborted){F(Q);return}Y.addEventListener("abort",()=>F(Q),{once:!0})})]);if(Y.aborted)return;let H=`/api/v1/namespaces/${encodeURIComponent(Z)}/events?watch=true&fieldSelector=${encodeURIComponent(`involvedObject.name=${W},involvedObject.kind=Pod`)}`;return xC0({kc:$,path:H,signal:Y,label:`events/${Q}`,onEvent:(F)=>{if(F.type!=="ADDED"&&F.type!=="MODIFIED")return;let U=F.object,N=U.reason;if(!N)return;switch(N){case"Pulling":J.events.hasPulling=!0;break;case"Pulled":J.events.hasPulling=!0,J.events.hasPulled=!0;break;case"FailedScheduling":J.events.lastFailedSchedulingAt=K(),J.events.failedSchedulingMessage=U.message;break;case"Nominated":{let B=U.message?.match(/nodeclaim\/([\w-]+)/);if(B)J.events.nominatedNodeClaim=B[1];break}default:return}G("event")}})}async function wo$($){let{kc:Z,namespace:Q,labelSelector:X,signal:Y,onDelete:J}=$,G=`/apis/${Q7.CLAIM_API_GROUP}/${Q7.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(Q)}/${Q7.CLAIM_PLURAL}?watch=true&labelSelector=${encodeURIComponent(X)}`;return xC0({kc:Z,path:G,signal:Y,label:"sandboxclaim-reaper",onEvent:(K)=>{if(K.type!=="DELETED")return;let W=K.object.metadata?.name;if(W)J(W)}})}async function xC0($){let{kc:Z,path:Q,signal:X,label:Y,onEvent:J}=$,G=0;while(!X.aborted){try{let W=await AW(Z,{method:"GET",path:Q,signal:X,headers:{accept:"application/json"},stream:!0});if(!W.ok||!W.body){try{await W.body?.cancel()}catch{}if(W.status===401||W.status===403){console.warn(`[lifecycle-watcher] ${Y} stopped: watch denied (${W.status} ${W.statusText}). `+"The kubeconfig in use cannot watch SandboxClaims \u2014 if you are running locally, "+"this provider should not be active (check STUDIO_AGENT_SANDBOX_ENABLED).");return}throw Error(`watch handshake failed: ${W.status} ${W.statusText}`)}G=0;for await(let H of kc$(W.body)){if(X.aborted)return;try{J(H)}catch(F){console.warn(`[lifecycle-watcher] ${Y} onEvent threw: ${F instanceof Error?F.message:String(F)}`)}}}catch(W){if(X.aborted)return;let H=W instanceof Error?W.message:String(W);console.warn(`[lifecycle-watcher] ${Y} watch ended: ${H}`)}if(X.aborted)return;let K=q7(5000,250,G,2,0);G+=1,await $$(K,{signal:X}).catch(()=>{})}}var Vw6="studio.decocms.com/sandbox-handle",kw6=300000,Cw6=600000;var Eo$=L(()=>{$8();F60();Uj0()});import{createHash as fw6}from"crypto";import{z as JJ}from"zod";function mN($){let Z;try{Z=new URL($.trim())}catch{return null}if(Z.protocol!=="https:"||Z.search||Z.hash)return null;let Q=Z.pathname.replace(/\/+$/,"").replace(/\.git$/,"").replace(/\/+$/,"");return Q?`https://${Z.host.toLowerCase()}${Q}`:null}function f60($){return mN($)?.toLowerCase()??null}function uw6($){let Z=new Set;for(let Q of $){let X=`${f60(Q.repoUrl)??Q.repoUrl}#${Q.branch}`;if(Z.has(X))return Q;Z.add(X)}return null}function zo$($){return $.reduce((Z,Q)=>Z+Q.replicas,0)}function To$($,Z){if(Z.warmPoolName)return Z.warmPoolName;let Q=fw6("sha256").update(`${Z.repoUrl}#${Z.branch}`).digest("hex").slice(0,8);return`${$}-${Q}`}function Ao$($){return Math.max(0,$.size-zo$($.repos))}function cp($){return $.flatMap((Z)=>Z.repos.map((Q)=>({pool:Z,repo:Q,warmPoolName:To$(Z.name,Q)})))}function lw6($,Z){return Mo$(void 0,$,!0,Z)}function Ro$($,{templateName:Z}){let Q=lw6(Z,$.image),X=(Y,J)=>({apiVersion:`${Q7.CLAIM_API_GROUP}/${Q7.CLAIM_API_VERSION}`,kind:"SandboxWarmPool",metadata:{name:Y,labels:{[cw6]:$.name}},spec:{replicas:J,updateStrategy:{type:"OnReplenish"},sandboxTemplateRef:{name:Q}}});return[...$.repos.map((Y)=>X(To$($.name,Y),Y.replicas)),X($.name,Ao$($))]}function bC0($){return $.tenant?.orgId}function tN1($,Z){if(!Z.tenant)return null;let Q=$.filter((J)=>J.tenant===Z.tenant&&J.image===Z.image),X=Z.cloneUrl?f60(Z.cloneUrl):null;if(X){let J=cp(Q).filter((K)=>f60(K.repo.repoUrl)===X),G=J.find((K)=>K.repo.branch===Z.branch)??J[0];if(G)return G}let Y=Q.find((J)=>Ao$(J)>0);return Y?{pool:Y,repo:null,warmPoolName:Y.name}:null}function qo$($,Z,Q){return $?.warmPoolName??(Z?Q:"none")}function Mo$($,Z,Q=!1,X){let Y=X&&X!=="default"?`-${X}`:"";return`${Z}${Y}${$==="harness-run"||Q?"-medium":""}`}async function oN1($){let Z=Mo$($.purpose,$.templateName,$.tenantPool,$.sandboxImage);if(Z===$.templateName)return{name:Z,probes:$.probes};let Q=$.probes[Z]??null,X=Q!==null&&$.now-Q.checkedAt<$.ttlMs?Q:{checkedAt:$.now,present:await $.exists(Z)},Y={...$.probes,[Z]:X};if(X.present)return{name:Z,probes:Y};if(Q?.present!==!1)$.onAbsent?.(Z);if($.sandboxImage&&$.sandboxImage!=="default")return oN1({...$,sandboxImage:void 0,probes:Y});return{name:$.templateName,probes:Y}}function rN1($,Z,Q){let X=f60(Z);if(!X)return[];let Y=Q.replace(/^refs\/heads\//,"");return cp($).filter(({repo:J})=>f60(J.repoUrl)===X&&J.branch===Y)}class aN1{source;dirty=new Set;pods=new Map;known=new Map;constructor($){this.source=$}pools(){return this.source()}resolve($){return tN1(this.pools(),$)}markDirty($,Z){let Q=rN1(this.pools(),$,Z).map((X)=>X.warmPoolName);for(let X of Q)this.dirty.add(X);return Q}takeDirty($){return this.dirty.delete($)}pod($){return this.pods.get($)}setPod($,Z){this.pods.set($,Z)}retainPods($,Z){for(let[Q,X]of this.pods)if(X.pool===$&&!Z.has(Q))this.pods.delete(Q)}retain($){let Z=new Map($.map((X)=>[X.warmPoolName,X])),Q=[...this.known.values()].filter((X)=>!Z.has(X.warmPoolName));for(let X of this.dirty)if(!Z.has(X))this.dirty.delete(X);for(let[X,Y]of this.pods)if(!Z.has(Y.pool))this.pods.delete(X);return this.known=Z,Q}}var bw6=54,yw6,gw6=2048,hw6,b60,fC0,nN1,Po$,cw6="studio.decocms.com/tenant-pool";var y60=L(()=>{r4();F60();yw6=/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/;hw6=JJ.object({runtime:JJ.enum(["node","bun","deno"]).default("node"),packageManager:JJ.enum(["npm","pnpm","yarn","bun","deno"]).optional(),packageManagerPath:JJ.string().optional(),devPort:JJ.number().int().positive().optional()}).default({runtime:"node"}),b60=JJ.object({repoUrl:JJ.string().max(gw6).transform(($,Z)=>{let Q=mN($);if(Q)return Q;return Z.addIssue({code:"custom",message:"repoUrl must be an https clone URL"}),JJ.NEVER}),branch:JJ.string().min(1).default("main"),workload:hw6,replicas:JJ.number().int().min(1)});fC0=class fC0 extends Error{poolName;size;allocated;constructor($,Z,Q){super(`pool ${$}: repos take ${Q} replicas, more than its size ${Z}`);this.poolName=$;this.size=Z;this.allocated=Q;this.name="TenantPoolCapacityError"}};nN1=JJ.object({name:JJ.string().max(bw6).regex(yw6,"pool name must be a DNS label (lowercase alphanumeric and '-')"),tenant:JJ.string().min(1).max(512),size:JJ.number().int().min(1),image:PN.default("default")}),Po$=nN1.extend({repos:JJ.array(b60).default([])}).superRefine(($,Z)=>{let Q=uw6($.repos);if(Q)Z.addIssue({code:"custom",path:["repos"],message:`duplicate repo allocation ${Q.repoUrl}#${Q.branch}`});let X=zo$($.repos);if(X>$.size)Z.addIssue({code:"custom",path:["repos"],message:new fC0($.name,$.size,X).message})})});async function Io$($,Z,Q){let X=new Map;for(let Y of $){let J=Z(Y);if(!J)continue;let G=X.get(J);if(G)G.push(Y);else X.set(J,[Y])}await Promise.allSettled([...X.values()].map(async(Y)=>{for(let J of Y)await Q(J).catch(()=>{})}))}function mw6($){try{let Z=new URL($);if(Z.hostname.toLowerCase()!=="github.com")return null;let[Q,X]=Z.pathname.replace(/^\/+/,"").split("/"),Y=X?.replace(/\.git$/,"");return Q&&Y?`${Q}/${Y}`.toLowerCase():null}catch{return null}}function Vo$($){if($.repositoryId)return{repositoryId:$.repositoryId};let Z=$.connectionId?mw6($.cloneUrl):null;return $.connectionId&&Z?{connectionId:$.connectionId,repo:Z}:null}var ko$=L(()=>{y60()});async function mp($,Z,Q,X){let Y=(G)=>CC0(G.url,G.token,Z,Q),J=!(Q.body instanceof ReadableStream);try{let G=await Y($);if(G.status!==401||!J)return G;let K=await X.unauthorized();if(!K)return G;return await G.body?.cancel().catch(()=>{}),await Y(K)}catch(G){if(!J)throw G;let K=await X.unreachable();if(!K)throw G;return Y(K)}}var yC0=L(()=>{Eg()});function _o$($,Z){return new Response(JSON.stringify(Z),{status:$,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function Co$($){let Z=new Headers;for(let[Q,X]of $.headers.entries())if(!iw6.includes(Q.toLowerCase()))Z.set(Q,X);return new Response($.body,{status:$.status,statusText:$.statusText,headers:Z})}function So$($,Z){let Q=_o$($,{error:Z});return Q.headers.set("x-sandbox-preview-not-ready","1"),Q}async function ip($,Z,Q){let X=await Z.base();if(!X)return So$(404,"sandbox not found");let Y=new URL($.url);if((Y.pathname==="/_sandbox"||Y.pathname.startsWith("/_sandbox/"))&&$.method!=="GET")return _o$(404,{error:"not found"});let G=(F)=>`${F}${Y.pathname}${Y.search}`,K=new Headers($.headers);for(let F of dw6)K.delete(F);let W=$.method!=="GET"&&$.method!=="HEAD",H={method:$.method,headers:K,body:W?$.body:void 0,redirect:"manual",signal:$.signal,duplex:W?"half":void 0};try{return Co$(await fetch(G(X),H))}catch(F){let U=`${X}${Y.pathname}`;if(console.warn(`[${Q}] preview fetch to ${U} failed: ${F instanceof Error?F.message:String(F)}`),Z.invalidate(),$.method==="GET"||$.method==="HEAD"){let N=await Z.retryBase();if(N)try{return Co$(await fetch(G(N),H))}catch(B){console.warn(`[${Q}] preview fetch retry to ${U} failed: ${B instanceof Error?B.message:String(B)}`)}}return So$(502,"sandbox daemon unreachable")}}var dp="x-sandbox-preview-not-ready",dw6,iw6;var gC0=L(()=>{dw6=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length","upgrade"],iw6=["connection","keep-alive","transfer-encoding","content-encoding","content-length"]});import{createHash as pw6,randomBytes as nw6,randomUUID as vo$}from"crypto";import*as uo$ from"net";import{PassThrough as tw6}from"stream";function xo$($){if($ instanceof Error)return $.message;if($&&typeof $==="object"){let Z=$;if(Z.error instanceof Error)return Z.error.message;if(typeof Z.message==="string"&&Z.message)return Z.message}return String($)}function yo$($){return{pool:$.warmPoolName,org:$.pool.tenant}}class YB1{records=new Map;inflight=new zg;activeGauge=new SC0;stateStore;previewUrlPattern;kubeConfig;capacityProbe;portForward;namespace;sandboxTemplateName;envName;tokenGenerator;idleTtlMs;metrics;previewGateway;sentinelToken;mintCloneUrl;mintPoolCloneUrl;mintOrgFsConfig;forwardPort;daemonAddress;persistCredentials;tenantPools;tenantPoolRefreshMs;templateProbes={};closed=!1;claimWatchAbort=new AbortController;constructor($={}){this.stateStore=$.stateStore??null,this.previewUrlPattern=$.previewUrlPattern??null,this.kubeConfig=$.kubeConfig??KE6(),this.portForward=new RN1(this.kubeConfig),this.namespace=$.namespace??ow6,this.sandboxTemplateName=$.sandboxTemplateName??rw6,this.envName=NE6($.envName),this.tokenGenerator=$.tokenGenerator??(()=>nw6(sw6).toString("hex")),this.idleTtlMs=$.idleTtlMs??$E6,this.metrics=$.meter?GE6($.meter):null,this.previewGateway=$.previewGateway&&$.previewUrlPattern?{...$.previewGateway}:null;let Z=$.sentinelToken?.trim()??"";this.sentinelToken=Z.length>0?Z:null,this.mintCloneUrl=$.mintCloneUrl,this.mintPoolCloneUrl=$.mintPoolCloneUrl,this.mintOrgFsConfig=$.mintOrgFsConfig,this.forwardPort=$.forwardPort,this.daemonAddress=$.daemonAddress??"forward",this.persistCredentials=$.persistCredentials??!0;let Q=$.tenantPools;if(this.tenantPools=this.sentinelToken===null?null:new aN1(typeof Q==="function"?Q:()=>Q??[]),this.sentinelToken===null&&(typeof Q==="function"||(Q?.length??0)>0))console.warn(`[${V6}] tenant pools configured without a sentinel token \u2014 ignoring them (warm-pool mode is off)`);this.tenantPoolRefreshMs=$.tenantPoolRefreshMs??QE6,this.startClaimReaper(),this.startCredentialRefresher(),this.startTenantPoolReconciler()}startClaimReaper(){let $=["app.kubernetes.io/managed-by=studio","app.kubernetes.io/name=studio-sandbox",...this.envName?[`${GJ.env}=${this.envName}`]:[]].join(",");wo$({kc:this.kubeConfig,namespace:this.namespace,labelSelector:$,signal:this.claimWatchAbort.signal,onDelete:(Z)=>this.invalidateRecord(Z)})}async ensure($,Z={}){let Q=c3($);if(Q.startsWith("s-"))throw Error(`ensure: projectRef has no slug source: ${$.projectRef}`);return this.inflight.run(Q,()=>_C0(this.stateStore,$,(X)=>this.ensureLocked($,Q,Z,X)))}async delete($){let Z=await this.getRecord($);if(this.records.delete($),Z)this.dropRecord(Z);if(await this.deleteHttpRouteIfManaged($).catch((Q)=>{console.warn(`[${V6}] HTTPRoute delete failed for ${$}: ${Q instanceof Error?Q.message:String(Q)}`)}),await iR(this.kubeConfig,this.namespace,$),this.stateStore)if(Z)await this.stateStore.delete(Z.id);else await this.stateStore.deleteByHandle($)}lastTermination($){return zc$(this.kubeConfig,this.namespace,GJ.sandboxHandle,$,Q7.MAIN_CONTAINER_NAME)}async alive($){return await gD(this.kubeConfig,this.namespace,$)!==void 0}watchClaimLifecycle($,Z){return Oo$({kc:this.kubeConfig,namespace:this.namespace,claimName:$,signal:Z})}hasSchedulableCapacity(){return this.capacityProbe??=Sc$(this.kubeConfig,this.namespace),this.capacityProbe()}async getPreviewUrl($){let Z=await this.getRecord($);if(!Z)return null;return this.composePreviewUrl(Z)}async proxyDaemonRequest($,Z,Q){let X=await this.getRecord($);if(!X&&this.previewUrlPattern&&this.stateStore){let W=await this.stateStore.getByHandle($),H=W?.state,F=H?.token;if(W&&F){let N=`http://${H?.adoptedSandboxName??$}.${this.namespace}.svc.cluster.local:${dN}`;try{let B=await CC0(N,F,Z,Q);if(B.status!==404)return B;try{await B.body?.cancel()}catch{}}catch{}}}if(!X)X=await this.resurrectByHandle($);if(!X)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let Y=X,J=performance.now(),G=0,K=(W)=>{return Y=W,{url:W.daemonUrl,token:W.token}};try{let W=await mp(K(X),Z,Q,{unauthorized:async()=>{this.invalidateRecord($);let H=await this.getRecord($).catch(()=>null)??await this.resurrectByHandle($).catch(()=>null);return H?K(H):null},unreachable:async()=>{this.invalidateRecord($);let H=await this.resurrectByHandle($)??await this.getRecord($).catch(()=>null);return H?K(H):null}});return G=W.status,W}finally{this.recordProxyDuration("daemon",G,Y,performance.now()-J)}}async adoptLiveClaim($,Z){if(this.records.has(Z))return!0;let Q=await gD(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!Q||Q.metadata?.deletionTimestamp)return!1;return await this.inflight.run(Z,async()=>{let Y=this.records.get(Z);if(Y)return this.toSandbox(Y);let J=await this.adopt($,Z,Q);if(!J)throw Error(`cannot adopt live claim ${Z}`);return _C0(this.stateStore,$,(G)=>this.finish(J,G,!0,!0,"adopt"))}).catch(()=>null)!=null}async resolvePreviewUpstreamUrl($){if(this.previewUrlPattern)return`http://${await this.resolveServiceNameForHandle($)}.${this.namespace}.svc.cluster.local:${dN}`;let Z=await this.getRecord($);if(Z)return Z.daemonUrl;let Q=await this.resurrectByHandle($);return Q?Q.daemonUrl:null}async daemonEndpoint($){let Z=await this.getRecord($)??await this.resurrectByHandle($);if(!Z)return null;return{url:this.daemonAddress==="service"?`http://${Z.adoptedSandboxName}.${this.namespace}.svc.cluster.local:${dN}`:Z.daemonUrl,token:Z.token}}listSandboxes(){return[...this.records.values()].map(($)=>{let Z=$.ensureOpts,Q=Z?.tenant;return{handle:$.handle,tenant:Q?{orgId:Q.orgId,userId:Q.userId}:null,repos:[Z?.repo,...Z?.extraRepos??[]].filter((X)=>X!==void 0).map(Vo$).filter((X)=>X!==null),orgFs:Boolean(Z?.orgFsConfigJson)||$.orgFsRedacted===!0}})}async resolveServiceNameForHandle($){let Z=this.records.get($);if(Z)return Z.adoptedSandboxName;if(this.stateStore){let X=(await this.stateStore.getByHandle($).catch(()=>null))?.state?.adoptedSandboxName;if(X)return X}return $}async proxyPreviewRequest($,Z){let Q=performance.now(),X=this.records.get($)??null,Y=0;try{let J=await ip(Z,{base:()=>this.resolvePreviewUpstreamUrl($),invalidate:()=>this.invalidateRecord($),retryBase:async()=>{return await this.resurrectByHandle($).catch(()=>null)?this.resolvePreviewUpstreamUrl($):null}},V6);return Y=J.status,J}finally{this.recordProxyDuration("preview",Y,X,performance.now()-Q,$)}}async ensureLocked($,Z,Q,X){if(Q.image)console.warn(`[${V6}] opts.image ignored (template ${this.sandboxTemplateName} pins image): got ${Q.image}`);if(X){let G=await X.get($);if(G){let K=await this.rehydrate($,Z,G);if(K)return await this.refreshDaemonGitCredential(K,Q),await this.relayOrgFsConfig(K.daemonUrl,K.token,Q.orgFsConfigJson),this.finish(K,X,!1,!0,"resume");await X.delete($)}}let Y=await gD(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(Y)if(Y.metadata?.deletionTimestamp)await B60(this.kubeConfig,this.namespace,Z).catch((G)=>{console.warn(`[${V6}] wait for terminating claim ${Z} failed: ${G instanceof Error?G.message:String(G)}`)});else if(!sN1(Y)){let G=await this.join($,Z,Q,Y).catch((K)=>{return console.warn(`[${V6}] join of starting claim ${Z} failed, recreating: ${K instanceof Error?K.message:String(K)}`),null});if(G)return this.finish(G,X,!0,!0,"adopt");await iR(this.kubeConfig,this.namespace,Z).catch(()=>{}),await B60(this.kubeConfig,this.namespace,Z).catch((K)=>{console.warn(`[${V6}] wait for deleted claim ${Z} failed: ${K instanceof Error?K.message:String(K)}`)})}else{let G=await this.adopt($,Z,Y).catch((K)=>{return console.warn(`[${V6}] adopt ${Z} failed, recreating: ${K instanceof Error?K.message:String(K)}`),null});if(G)return await this.refreshDaemonGitCredential(G,Q),await this.relayOrgFsConfig(G.daemonUrl,G.token,Q.orgFsConfigJson),this.finish(G,X,!0,!0,"adopt");await iR(this.kubeConfig,this.namespace,Z).catch(()=>{}),await B60(this.kubeConfig,this.namespace,Z).catch((K)=>{console.warn(`[${V6}] wait for deleted claim ${Z} failed: ${K instanceof Error?K.message:String(K)}`)})}let J=await this.provision($,Z,Q);return this.finish(J,X,!0,!1,"fresh")}async finish($,Z,Q,X,Y){let J=this.records.get($.handle),G=J!==void 0;if(J&&J.daemonForward!==$.daemonForward)this.closeForwarder(J.daemonForward);if(this.records.set($.handle,$),Q)await this.persist(Z,$);if(X)await Fj0(this.kubeConfig,this.namespace,$.handle,this.computeShutdownTime()).catch((K)=>console.warn(`[${V6}] TTL refresh failed for ${$.handle}: ${K instanceof Error?K.message:String(K)}`));if(this.metrics){let K=ZB1($.tenant);if(this.metrics.ensureOutcome.add(1,{...K,outcome:Y}),!G)this.metrics.active.add(1,K),this.activeGauge.markCounted($.handle)}return this.toSandbox($)}buildEnvMap($,Z){let Q={},X=[];for(let[Y,J]of Object.entries($.env??{}))if(ew6.has(Y))X.push(Y);else Q[Y]=J;if(X.length>0)console.warn(`[${V6}] opts.env keys overlap reserved bootstrap names and were dropped: ${X.join(",")}`);return{...Q,DAEMON_TOKEN:Z.token,DAEMON_BOOT_ID:Z.daemonBootId,APP_ROOT:Z.workdir,PROXY_PORT:String(dN)}}async resolveTemplateName($,Z,Q){let{name:X,probes:Y}=await oN1({purpose:$,tenantPool:Z,...Q?{sandboxImage:Q}:{},templateName:this.sandboxTemplateName,probes:this.templateProbes,now:Date.now(),ttlMs:aw6,exists:(J)=>Oc$(this.kubeConfig,this.namespace,J),onAbsent:(J)=>console.warn(`[${V6}] SandboxTemplate ${J} not found (or not readable) \u2014 this claim falls back to a template without that suffix. Upgrade the sandbox-env chart to the version that renders it.`)});return this.templateProbes=Y,X}buildClaim($,Z,Q,X,Y){let J=this.sentinelToken!==null,G=J?[]:Object.entries(this.buildEnvMap(Z,Q)).sort(([H],[F])=>H<F?-1:H>F?1:0).map(([H,F])=>({name:H,value:F})),K=DE6(Z),W=Object.keys(K).length>0;return{apiVersion:`${Q7.CLAIM_API_GROUP}/${Q7.CLAIM_API_VERSION}`,kind:"SandboxClaim",metadata:{name:$,namespace:this.namespace,labels:{"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[GJ.env]:this.envName}:{},...$B1(Z.tenant)},...W?{annotations:K}:{}},spec:{sandboxTemplateRef:{name:Y},additionalPodMetadata:{labels:$B1(Z.tenant,{[GJ.role]:"claimed",[GJ.sandboxHandle]:$,...this.envName?{[GJ.env]:this.envName}:{}}),...W?{annotations:K}:{}},env:G,warmpool:qo$(X,J,Y),lifecycle:{shutdownPolicy:"Delete",shutdownTime:this.computeShutdownTime()}}}}async provision($,Z,Q){let X=this.tokenGenerator(),Y=vo$(),J=hC0,G=this.claimTenantPoolBinding(Q),K=this.buildClaim(Z,Q,{token:X,daemonBootId:Y,workdir:J},G,await this.resolveTemplateName(Q.purpose,G!==null,Q.sandboxImage));try{await iF1(this.kubeConfig,this.namespace,K)}catch(W){if(W instanceof H60)await B60(this.kubeConfig,this.namespace,Z),await iF1(this.kubeConfig,this.namespace,K);else throw W}return this.bind($,Z,Q,G,{token:X,daemonBootId:Y,workdir:J})}claimTenantPoolBinding($){return this.tenantPools?.resolve({tenant:bC0($),image:$.sandboxImage??"default",cloneUrl:$.repo?.cloneUrl,branch:$.repo?.branch})??null}async bind($,Z,Q,X,{token:Y,daemonBootId:J,workdir:G}){let K;try{K=await jc$(this.kubeConfig,this.namespace,Z),await jo$((B)=>this.watchClaimLifecycle(Z,B))}catch(B){throw await iR(this.kubeConfig,this.namespace,Z).catch(()=>{}),B}try{await this.ensureServicePortForAdoptedSandbox(K),await this.ensureHttpRouteForHandle(Z,K,Q.tenant??null)}catch(B){throw await iR(this.kubeConfig,this.namespace,Z).catch(()=>{}),B}let W=await this.openForwarder(K,dN,Z),H=`http://127.0.0.1:${W.localPort}`,F=X?.repo!=null&&K!==Z,U=this.workloadConfigPayload(Q,F),N=J;try{if(await dN1(H),this.sentinelToken!==null){let B=await kC0(H);if(B)N=B.bootId;try{await cN(H,this.sentinelToken,U??{},{rotateToken:Y})}catch(D){if(D instanceof PF&&D.status===401)console.warn(`[${V6}] sentinel rejected by adopted pod (handle=${Z}, sandbox=${K}): pod belongs to another claim; tearing down and reprovisioning`);throw D}}else if(U)await cN(H,Y,U);await this.relayOrgFsConfig(H,Y,Q.orgFsConfigJson)}catch(B){throw this.closeForwarder(W),await this.deleteHttpRouteIfManaged(Z).catch(()=>{}),await iR(this.kubeConfig,this.namespace,Z).catch(()=>{}),B}return{id:$,handle:Z,adoptedSandboxName:K,token:Y,workdir:G,daemonUrl:H,daemonForward:W,workload:Q.workload??null,daemonBootId:N,tenant:Q.tenant??null,tenantPoolPodBound:F,ensureOpts:PE6(Q)}}workloadConfigPayload($,Z){return up({runtime:$?.workload?.runtime??"node",packageManager:$?.workload?.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:$?.repo??null,extraRepos:$?.extraRepos??[],port:$?.workload?.devPort??fo$,tenant:$?.tenant??void 0,...$?{cloneOnly:$.cloneOnly===!0&&!Z}:{}})}async relayOrgFsConfig($,Z,Q){if(!Q)return;await _60($,Z,Q).catch((X)=>console.warn("[org-fs] sidecar config relay failed",X))}async refreshDaemonGitCredential($,Z){let Q=x60(Z);if(!Q)return;try{await cN($.daemonUrl,$.token,Q)}catch(X){console.warn(`[${V6}] git credential refresh failed for ${$.handle}: ${X instanceof Error?X.message:String(X)}`)}}async withFreshCloneUrl($,Z={}){if(!this.mintCloneUrl)return $;try{let Q=await this.mintCloneUrl($,Z);if(!Q)return $;let{credentialExpiresAt:X,...Y}=$;return{...Y,cloneUrl:Q}}catch(Q){return console.warn(`[${V6}] clone credential re-mint failed: ${Q instanceof Error?Q.message:String(Q)}`),$}}async withFreshCredentials($,Z=!1){return{...$,...$.repo?{repo:await this.withFreshCloneUrl($.repo,{tenant:$.tenant})}:{},...$.orgFsConfigJson||Z?{orgFsConfigJson:await EE6($,this.mintOrgFsConfig)}:{}}}startCredentialRefresher(){if(!this.mintCloneUrl)return;let{signal:$}=this.claimWatchAbort;(async()=>{while(!$.aborted){if(await $$(XE6,{signal:$}).catch(()=>{}),$.aborted)break;try{await this.refreshAllGitCredentials()}catch(Z){console.warn(`[${V6}] periodic credential refresh failed: ${Z instanceof Error?Z.message:String(Z)}`)}}})()}startTenantPoolReconciler(){let $=this.tenantPools;if(!$)return;let{signal:Z}=this.claimWatchAbort;(async()=>{while(!Z.aborted){try{await this.reconcileTenantPools($)}catch(Q){console.warn(`[${V6}] tenant pool reconcile failed: ${Q instanceof Error?Q.message:String(Q)}`)}await $$(ZE6,{signal:Z}).catch(()=>{})}})()}listTenantPools(){return this.tenantPools?.pools()??[]}markTenantPoolsDirty($,Z){return Promise.resolve(this.tenantPools?.markDirty($,Z)??[])}async reconcileTenantPools($){let Z=cp($.pools());for(let Q of $.retain(Z))this.recordPoolGone(Q);for(let Q of Z){let X=Q.warmPoolName,Y=await wc$(this.kubeConfig,this.namespace,X);if(Y===null){console.warn(`[${V6}] tenant pool ${X}: no SandboxWarmPool (or no selector yet) in ${this.namespace}`);continue}let J=$.takeDirty(X),G=Y.filter((K)=>!K.labels[GJ.sandboxHandle]);$.retainPods(X,new Set(Y.map((K)=>K.uid)));for(let K of G){if(this.claimWatchAbort.signal.aborted)return;await this.warmPoolPod($,Q,K,J)}this.recordPoolDepth($,Q,Y,G)}}recordPoolGone($){let Z=yo$($);for(let Q of["ready","bound","pending","failed"])this.metrics?.poolPods.record(0,{...Z,state:Q})}recordPoolDepth($,Z,Q,X){let Y=this.metrics?.poolPods;if(!Y)return;let J=0,G=0;for(let W of X){let H=$.pod(W.uid);if(!H)continue;if(H.failures>=uC0)G++;else if(H.lastConfigAt>0)J++}let K=yo$(Z);Y.record(J,{...K,state:"ready"}),Y.record(Q.length-X.length,{...K,state:"bound"}),Y.record(X.length-J-G,{...K,state:"pending"}),Y.record(G,{...K,state:"failed"})}async warmPoolPod($,Z,Q,X){let Y=Z.warmPoolName,{workload:J}=Z.repo,G=$.pod(Q.uid);if(G&&G.failures>=uC0){if(Date.now()-G.lastFailureAt<bo$)return;$.setPod(Q.uid,{...G,failures:0})}let K=X||G!==void 0&&Date.now()-G.lastConfigAt>=this.tenantPoolRefreshMs;if(G&&!K)return;let W=await this.allocationCloneUrl(Z);if(!W){this.recordPoolFailure($,Q,Y,"clone credential mint failed");return}let H={cloneUrl:W,branch:Z.repo.branch,userName:"",userEmail:""},F=await this.openForwarder(Q.name,dN,Q.name).catch(()=>null);if(!F){this.recordPoolFailure($,Q,Y,"port-forward failed");return}let U=`http://127.0.0.1:${F.localPort}`;try{await dN1(U);let N=this.sentinelToken;if(!N)return;if(!await this.isPoolPodUnbound(Q))return;let B=up({runtime:J.runtime,packageManager:J.packageManager?{name:J.packageManager,...J.packageManagerPath?{path:J.packageManagerPath}:{}}:null,repo:H,port:J.devPort??fo$})??{},{transition:D}=await cN(U,N,B);if(K&&D!=="bootstrap"&&await this.isPoolPodUnbound(Q))await Wo$(U,N,"clone");$.setPod(Q.uid,{pool:Y,lastConfigAt:Date.now(),lastFailureAt:0,failures:0}),console.log(`[${V6}] tenant pool ${Y}: warmed ${Q.name} (${D})`)}catch(N){this.recordPoolFailure($,Q,Y,N instanceof Error?N.message:String(N))}finally{this.closeForwarder(F)}}async allocationCloneUrl({pool:$,repo:Z}){if(!this.mintPoolCloneUrl)return`${Z.repoUrl}.git`;try{return await this.mintPoolCloneUrl({tenant:$.tenant,repoUrl:Z.repoUrl,branch:Z.branch})}catch(Q){return console.warn(`[${V6}] tenant pool clone credential mint failed: ${Q instanceof Error?Q.message:String(Q)}`),null}}isPoolPodUnbound($){return Ec$(this.kubeConfig,this.namespace,$.name,GJ.sandboxHandle)}recordPoolFailure($,Z,Q,X){let Y=$.pod(Z.uid),J=(Y?.failures??0)+1;$.setPod(Z.uid,{pool:Q,lastConfigAt:Y?.lastConfigAt??0,lastFailureAt:Date.now(),failures:J});let G=J>=uC0?` \u2014 backing off ${bo$/60000}min`:"";console.warn(`[${V6}] tenant pool ${Q}: warming ${Z.name} failed (${J}/${uC0})${G}: ${X}`)}async refreshAllGitCredentials(){await Io$(this.records.values(),($)=>$.ensureOpts?.repo?.connectionId,async($)=>{if(this.claimWatchAbort.signal.aborted)return;let Z=$.ensureOpts?.repo;if(!Z)return;try{let Q=await this.withFreshCloneUrl(Z,{bufferMs:YE6,tenant:$.ensureOpts?.tenant});await this.refreshDaemonGitCredential($,{...$.ensureOpts,repo:Q}),$.ensureOpts={...$.ensureOpts,repo:Q}}catch(Q){throw console.warn(`[${V6}] git credential refresh failed for ${$.handle}: ${Q instanceof Error?Q.message:String(Q)}`),Q}})}async rebootstrapDaemon($,Z,Q){if(this.sentinelToken===null)return!1;let X=this.workloadConfigPayload(Q,!1)??{};try{return await cN($,this.sentinelToken,X,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,Q?.orgFsConfigJson),!0}catch(Y){if(Y instanceof PF&&Y.status===401)try{return await cN($,Z,X,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,Q?.orgFsConfigJson),!0}catch(J){return console.warn(`[${V6}] re-bootstrap retry with claim token failed: ${J instanceof Error?J.message:String(J)}`),!1}return console.warn(`[${V6}] re-bootstrap failed: ${Y instanceof Error?Y.message:String(Y)}`),!1}}async ensureServicePortForAdoptedSandbox($){if(!this.previewGateway||!this.previewUrlPattern)return;await Vc$(this.kubeConfig,this.namespace,$,{name:"daemon",port:dN,targetPort:dN})}async ensureHttpRouteForHandle($,Z,Q){if(!this.previewGateway||!this.previewUrlPattern)return;let X=TE6(this.previewUrlPattern,$);if(!X)throw new $Y(`Unable to derive preview hostname for ${$} from pattern: ${this.previewUrlPattern}`);let Y={apiVersion:`${nF1.API_GROUP}/${nF1.API_VERSION}`,kind:"HTTPRoute",metadata:{name:$,namespace:this.namespace,labels:$B1(Q??void 0,{[GJ.role]:"claimed",[GJ.sandboxHandle]:$,"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[GJ.env]:this.envName}:{}})},spec:{parentRefs:[{kind:"Gateway",group:"gateway.networking.k8s.io",name:this.previewGateway.name,namespace:this.previewGateway.namespace}],hostnames:[X],rules:[{backendRefs:[{group:"",kind:"Service",name:Z,port:dN}]}]}};await qc$(this.kubeConfig,this.namespace,Y)}async deleteHttpRouteIfManaged($){if(!this.previewGateway)return;await Mc$(this.kubeConfig,this.namespace,$)}async rehydrate($,Z,Q){let X=Q.state;if(!X.adoptedSandboxName&&!X.podName||!X.token)return null;let Y=await gD(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!Y||!sN1(Y))return null;let J=Y.status?.sandbox?.name??X.adoptedSandboxName??X.podName??Z,G=await this.openAndProbeDaemon(J,Z);if(!G)return null;if(X.daemonBootId&&X.daemonBootId!==G.bootId){if(this.sentinelToken!==null){let K=X.ensureOpts?await this.withFreshCredentials(X.ensureOpts,X.orgFsRedacted===!0):null;if(!await this.rebootstrapDaemon(G.daemonUrl,X.token,K))return this.closeForwarder(G.daemonForward),null}else console.warn(`[${V6}] daemon restart detected (handle=${Z}): stored bootId=${X.daemonBootId} live bootId=${G.bootId}`);await this.stateStore?.put($,{handle:Z,state:{...X,daemonBootId:G.bootId}}).catch((K)=>console.warn(`[${V6}] bootId persist failed for ${Z}: ${K instanceof Error?K.message:String(K)}`))}return{id:$,handle:Z,adoptedSandboxName:J,tenantPoolPodBound:!1,token:X.token,workdir:X.workdir??hC0,daemonUrl:G.daemonUrl,daemonForward:G.daemonForward,workload:X.workload??null,daemonBootId:G.bootId,tenant:X.tenant??null,ensureOpts:X.ensureOpts??null,orgFsRedacted:X.orgFsRedacted===!0}}join($,Z,Q,X){let Y=this.sentinelToken!==null,J=Y?this.tokenGenerator():eN1(X,"DAEMON_TOKEN"),G=Y?vo$():eN1(X,"DAEMON_BOOT_ID");if(!J||!G)throw new $Y(`claim ${Z} carries no daemon token`);return this.bind($,Z,Q,this.claimTenantPoolBinding(Q),{token:J,daemonBootId:G,workdir:hC0})}async adopt($,Z,Q){if(!sN1(Q))return null;let X=Q.status?.sandbox?.name??Z;if(this.sentinelToken!==null)return null;let Y=eN1(Q,"DAEMON_TOKEN");if(!Y)return null;let J=await this.openAndProbeDaemon(X,Z);if(!J)return null;let G=OE6(Q);if(this.previewGateway)await this.ensureServicePortForAdoptedSandbox(X).catch((K)=>{console.warn(`[${V6}] Service port backfill failed for ${Z}: ${K instanceof Error?K.message:String(K)}`)}),await this.ensureHttpRouteForHandle(Z,X,G).catch((K)=>{console.warn(`[${V6}] HTTPRoute backfill failed for ${Z}: ${K instanceof Error?K.message:String(K)}`)});return{id:$,handle:Z,adoptedSandboxName:X,tenantPoolPodBound:!1,token:Y,workdir:hC0,daemonUrl:J.daemonUrl,daemonForward:J.daemonForward,workload:null,daemonBootId:J.bootId,tenant:G,ensureOpts:null}}async openAndProbeDaemon($,Z){let Q=await this.openForwarder($,dN,Z).catch(()=>null);if(!Q)return null;let X=`http://127.0.0.1:${Q.localPort}`,Y=await kC0(X);if(!Y)return this.closeForwarder(Q),null;return{daemonForward:Q,daemonUrl:X,bootId:Y.bootId}}async getRecord($){let Z=this.records.get($);if(Z)return Z;if(!this.stateStore)return null;let Q=await this.stateStore.getByHandle($);if(!Q)return null;let X=await this.rehydrate(Q.id,$,Q);if(X)this.records.set($,X);return X}async resurrectByHandle($){if(!this.stateStore)return null;let Z=await this.stateStore.getByHandle($);if(!Z)return null;let Q=Z.state,X=Q.ensureOpts;if(!X)return null;let Y=await this.withFreshCredentials(X,Q.orgFsRedacted===!0);if(c3(Z.id)!==$)return null;return await this.ensure(Z.id,Y),this.records.get($)??null}invalidateRecord($){let Z=this.records.get($);if(!Z)return;this.records.delete($),this.dropRecord(Z)}dropRecord($){if(this.closeForwarder($.daemonForward),this.metrics&&this.activeGauge.consume($.handle))this.metrics.active.add(-1,ZB1($.tenant))}recordProxyDuration($,Z,Q,X,Y){if(!this.metrics)return;this.metrics.proxyDurationMs.record(X,{...ZB1(Q?.tenant??null),source:$,sandbox_handle:Q?.handle??Y??"",status_code:Z||0})}composePreviewUrl($){if(this.previewUrlPattern)return vC0(this.previewUrlPattern,$.handle);return`http://127.0.0.1:${$.daemonForward.localPort}/`}toSandbox($){return{handle:$.handle,workdir:$.workdir,previewUrl:this.composePreviewUrl($),warmPoolAdopted:$.tenantPoolPodBound===!0,provider:"kubernetes"}}async persist($,Z){if(!$)return;let Q={adoptedSandboxName:Z.adoptedSandboxName,token:Z.token,workdir:Z.workdir,workload:Z.workload,daemonBootId:Z.daemonBootId,tenant:Z.tenant,...Z.ensureOpts?this.persistCredentials?{ensureOpts:Z.ensureOpts}:zE6(Z.ensureOpts,Z.orgFsRedacted===!0):{}};await $.put(Z.id,{handle:Z.handle,state:Q})}computeShutdownTime(){return new Date(Date.now()+this.idleTtlMs).toISOString()}async releaseAfter($,Z){let Q=await gD(this.kubeConfig,this.namespace,$);if(!Q)return;let X=jE6(Q.spec?.lifecycle?.shutdownTime,new Date(Date.now()+Z));if(!X)return;await Fj0(this.kubeConfig,this.namespace,$,X).catch((Y)=>console.warn(`[${V6}] release failed for ${$}: ${Y instanceof Error?Y.message:String(Y)}`))}async renewTtl($){let Z=await gD(this.kubeConfig,this.namespace,$);if(!Z)return;let Q=wE6(Z.spec?.lifecycle?.shutdownTime,new Date(Date.now()+this.idleTtlMs));if(!Q)return;await Fj0(this.kubeConfig,this.namespace,$,Q).catch((X)=>console.warn(`[${V6}] TTL renew failed for ${$}: ${X instanceof Error?X.message:String(X)}`))}openForwarder($,Z,Q=$){if(this.forwardPort)return this.forwardPort($,Z,Q);let X=WE6(Q,Z);return new Promise((Y,J)=>{let G=(K,W)=>{let H=uo$.createServer((F)=>this.handleForwardedConnection(F,$,Z,Q));H.once("error",(F)=>{if(F.code==="EADDRINUSE"&&W<JE6){try{H.close()}catch{}let U=QB1+(K-QB1+1)%lo$;G(U,W+1);return}J(F)}),H.listen(K,"127.0.0.1",()=>{let F=H.address();if(!F||typeof F==="string"){H.close(),J(Error("port-forward listener failed to bind"));return}let U=F.port;Y({localPort:U,close:()=>H.close((N)=>{if(N)console.warn(`[${V6}] port-forward close on :${U} errored: ${N.message}`)})})})};G(X,0)})}handleForwardedConnection($,Z,Q,X){let Y=new tw6,J=null,G=!1,K=()=>{if(G)return;if(G=!0,Y.destroy(),J)try{J.close()}catch{}if(!$.destroyed)$.destroy()};$.pipe(Y),$.on("error",K),$.on("close",K),this.portForward.portForward(this.namespace,Z,[Q],$,null,Y).then((W)=>{let H=typeof W==="function"?W():W;if(!H){K();return}if(J=H,J.on("close",K),J.on("error",(F)=>{console.warn(`[${V6}] port-forward to ${Z}:${Q} dropped mid-connection: ${xo$(F)}`,JSON.stringify(XB1(F))),this.invalidateRecord(X),K()}),G)try{J.close()}catch{}}).catch((W)=>{console.warn(`[${V6}] port-forward to ${Z}:${Q} failed: ${xo$(W)}`,JSON.stringify(XB1(W))),this.invalidateRecord(X),K()})}closeForwarder($){$.close()}close(){if(this.closed)return;this.closed=!0,this.claimWatchAbort.abort();for(let $ of this.records.values())this.dropRecord($);this.records.clear()}}function GE6($){return{active:$.createUpDownCounter("studio.sandbox.active",{description:"Active sandbox count, by runner kind, owning org, and daemon impl. Cross-checks the cAdvisor-derived count from the cluster \u2014 divergence between the two indicates orphaned claims (studio deleted but K8s didn't reap) or unattributed pods.",unit:"{sandbox}"}),ensureOutcome:$.createCounter("studio.sandbox.ensure.outcome",{description:"Outcome of each ensure() call: fresh provision, resume from state-store after restart, or adopt of a cluster-side claim studio didn't know about. Cold-start ratio is the primary input for warm-pool sizing.",unit:"{call}"}),proxyDurationMs:$.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of studio-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"}),poolPods:$.createGauge("studio.sandbox.pool.pods",{description:"Tenant warm pool depth by pool and state: ready (warmed and unbound \u2014 what a claim can actually bind instantly), bound (serving a user), pending (unbound, not yet warmed), failed (gave up after repeated bootstrap failures). Alert on sustained ready=0: a pool that is always empty is doing nothing while costing N pods.",unit:"{pod}"})}}function XB1($){let Z=[],Q=$;for(let X=0;X<5&&Q instanceof Error;X++){let Y=Q;if(Z.push({name:Y.name,message:Y.message,...Y.code!==void 0?{code:Y.code}:{},...Y.errno!==void 0?{errno:Y.errno}:{}}),Y.cause===Q)break;Q=Y.cause}if(Q!==void 0&&!(Q instanceof Error)&&Q!==null){let X=Q,Y=X.error instanceof Error?XB1(X.error).chain:void 0;Z.push({nonError:String(Q),...typeof X.type==="string"?{type:X.type}:{},...typeof X.message==="string"?{message:X.message}:{},...X.code!==void 0?{code:X.code}:{},...typeof X.reason==="string"?{reason:X.reason}:{},...Y?{error:Y}:{},...Y===void 0&&X.error!==void 0?{rawError:String(X.error)}:{},keys:Object.keys(X)})}return{chain:Z}}function KE6(){let $=new UC0;return $.loadFromDefault(),$}function sN1($){return Boolean($.status?.conditions?.some((Z)=>Z.type==="Ready"&&Z.status==="True"))}function eN1($,Z){let Q=$.spec?.env;if(!Q)return null;for(let X of Q)if(X.name===Z&&X.value)return X.value;return null}function WE6($,Z){let Q=pw6("sha256").update(`${$}:${Z}`).digest();return QB1+Q.readUInt32BE(0)%lo$}function go$($){let Z=$.slice(0,FE6);return HE6.test(Z)?Z:""}function NE6($){if($===void 0)return null;let Z=$.trim();if(Z==="")return null;if(!UE6.test(Z))throw Error(`AgentSandboxProvider: envName=${JSON.stringify(Z)} is not a valid DNS-label-safe environment name (lowercase alphanumeric or '-', starts with a letter, ends alphanumeric, \u226432 chars). Studio sets this from STUDIO_ENV; check the studio chart's configMap.`);return Z}function $B1($,Z={}){let Q={...Z};if($){let X=go$($.orgId),Y=go$($.userId);if(X)Q[GJ.orgId]=X;if(Y)Q[GJ.userId]=Y}return Q}function Pg($){let Z="";for(let Q of $){let X=Q.codePointAt(0)??0;Z+=X<32||X===127?" ":Q}return Z.slice(0,BE6)}function LE6($){try{let Z=new URL($);return Z.username="",Z.password="",Z.toString()}catch{return""}}function DE6($){let Z={},Q=$.tenant;if(Q?.orgSlug)Z[TF.orgSlug]=Pg(Q.orgSlug);if(Q?.orgName)Z[TF.orgName]=Pg(Q.orgName);if(Q?.userEmail)Z[TF.userEmail]=Pg(Q.userEmail);if(Q?.userName)Z[TF.userName]=Pg(Q.userName);let X=$.repo;if(X){if(X.displayName)Z[TF.gitRepo]=Pg(X.displayName);let Y=LE6(X.cloneUrl);if(Y)Z[TF.gitRepoUrl]=Pg(Y);let J=$.branch??X.branch;if(J)Z[TF.gitBranch]=Pg(J)}return Z}function OE6($){let Z=$.metadata?.labels;if(!Z)return null;let Q=Z[GJ.orgId],X=Z[GJ.userId];if(!Q||!X)return null;let Y=$.metadata?.annotations??{};return{orgId:Q,userId:X,orgSlug:Y[TF.orgSlug],orgName:Y[TF.orgName],userEmail:Y[TF.userEmail],userName:Y[TF.userName]}}function jE6($,Z){if($){let Q=new Date($).getTime();if(Number.isFinite(Q)&&Q<=Z.getTime())return null}return Z.toISOString()}function wE6($,Z){if($){let Q=new Date($).getTime();if(Number.isFinite(Q)&&Q>=Z.getTime())return null}return Z.toISOString()}function ZB1($){return{org_id:$?.orgId??"",user_id:$?.userId??"",runner_kind:"agent-sandbox"}}async function EE6($,Z){if(!Z||!$.tenant)return $.orgFsConfigJson;try{return await Z($.tenant)??$.orgFsConfigJson}catch(Q){return console.warn(`[${V6}] org-fs credential re-mint failed: ${Q instanceof Error?Q.message:String(Q)}`),$.orgFsConfigJson}}function ho$($){try{let Z=new URL($.cloneUrl);Z.username="",Z.password="";let{submoduleCredentials:Q,credentialExpiresAt:X,...Y}=$;return{...Y,cloneUrl:Z.toString()}}catch{return null}}function zE6($,Z){let{orgFsConfigJson:Q,repo:X,extraRepos:Y,...J}=$,G=J,K=X&&ho$(X);if(K)G.repo=K;if(Y)G.extraRepos=Y.map(ho$).filter((W)=>W!==null);return Q||Z?{ensureOpts:G,orgFsRedacted:!0}:{ensureOpts:G}}function PE6($){let Z={};if($.branch)Z.branch=$.branch;if($.repo)Z.repo=$.repo;if($.workload)Z.workload=$.workload;if($.env&&Object.keys($.env).length>0)Z.env=$.env;if($.tenant)Z.tenant=$.tenant;if($.cloneOnly)Z.cloneOnly=!0;if($.purpose)Z.purpose=$.purpose;if($.sandboxImage)Z.sandboxImage=$.sandboxImage;if($.orgFsConfigJson)Z.orgFsConfigJson=$.orgFsConfigJson;return Object.keys(Z).length>0?Z:null}function TE6($,Z){try{return new URL(vC0($,Z)).hostname||null}catch{return null}}var V6="AgentSandboxProvider",ow6="agent-sandbox-system",rw6="studio-sandbox",aw6=300000,dN=9000,fo$=3000,hC0="/app",sw6=32,ew6,$E6=900000,ZE6=60000,QE6=1800000,uC0=3,bo$=1800000,XE6=900000,YE6=1800000,QB1=40000,lo$=1e4,JE6=256,GJ,TF,HE6,FE6=63,UE6,BE6=253;var co$=L(()=>{$8();_c$();Xo$();Eg();lp();Uj0();F60();Eo$();y60();ko$();yC0();gC0();ew6=new Set(["DAEMON_TOKEN","DAEMON_BOOT_ID","APP_ROOT","PROXY_PORT"]);GJ={role:"studio.decocms.com/role",sandboxHandle:"studio.decocms.com/sandbox-handle",orgId:"studio.decocms.com/org-id",userId:"studio.decocms.com/user-id",env:"studio.decocms.com/env"},TF={orgSlug:"studio.decocms.com/org-slug",orgName:"studio.decocms.com/org-name",userEmail:"studio.decocms.com/user-email",userName:"studio.decocms.com/user-name",gitRepo:"studio.decocms.com/git-repo",gitRepoUrl:"studio.decocms.com/git-repo-url",gitBranch:"studio.decocms.com/git-branch"},HE6=/^([A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?)?$/;UE6=/^[a-z]([a-z0-9-]{0,30}[a-z0-9])?$/});var mo$={};J0(mo$,{tenantPoolSchema:()=>Po$,tenantPoolRepoSchema:()=>b60,tenantPoolFieldsSchema:()=>nN1,tenantPoolAllocations:()=>cp,resolveTenantPoolBinding:()=>tN1,renderTenantPoolWarmPools:()=>Ro$,normalizeRepoUrl:()=>mN,allocationsMatchingPush:()=>rN1,TenantPoolCapacityError:()=>fC0,PREVIEW_NOT_READY_HEADER:()=>dp,AgentSandboxProvider:()=>YB1});var g60=L(()=>{co$();y60()});import{z as Tg}from"zod";function lC0($){if(!$||$.trim()==="")return[];let Z=Tg.array(AE6).parse(JSON.parse($)),Q=new Set;for(let X of Z){if(Q.has(X.name))throw Error(`tenant pools: duplicate pool name ${X.name}`);Q.add(X.name)}return Z}function do$($){let Z=mN(`https://github.com/${$.repo}`);if(!Z)throw Error(`tenant pools: bad repo ${$.repo}`);return Z}function io$($){return $.map((Z)=>({name:Z.name,tenant:Z.orgId,size:1,image:"default",repos:[{repoUrl:do$(Z),branch:Z.branch,workload:Z.workload,replicas:1,warmPoolName:Z.name}]}))}function JB1($,Z){let Q=mN(Z.repoUrl)?.toLowerCase(),X=$.find((J)=>J.orgId===Z.tenant&&J.branch===Z.branch&&do$(J).toLowerCase()===Q);if(!X)return null;let Y=`https://github.com/${X.repo}.git`;return X.connectionId?{cloneUrl:Y,connectionId:X.connectionId}:{cloneUrl:Y}}function po$($,Z){return async(Q)=>{let X=JB1($,Q);if(!X)return null;return X.connectionId?Z(X):X.cloneUrl}}var AE6;var cC0=L(()=>{g60();AE6=Tg.object({name:Tg.string().max(63).regex(/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/,"pool name must be a DNS label (lowercase alphanumeric and '-')"),orgId:Tg.string().min(1),repo:Tg.string().regex(/^[^/\s]+\/[^/\s]+$/,"repo must be `owner/name`"),connectionId:Tg.string().min(1).optional(),branch:Tg.string().min(1).default("main"),workload:b60.shape.workload})});function FB1($,Z=Date.now()){if($===void 0)return;return $===null?Z+RE6:$.getTime()}function HB1($){return JSON.stringify([$.orgId,$.userId])}function no$($,Z){let Q=mN(Z);return Q?JSON.stringify([$,Q.toLowerCase()]):null}function ME6($,Z){return"repositoryId"in Z?$.repositoryOrgs.get(Z.repositoryId):$.connectionOrgs.get(Z.connectionId)}function to$($){let{records:Z,now:Q}=$,X=new Map,Y=new Map,J=new Map,G=0;for(let K of $.pools)for(let{repoUrl:W,branch:H}of K.repos){let F=no$(K.tenant,W),U=JB1($.legacyPools??[],{tenant:K.tenant,repoUrl:W,branch:H});if(F&&U){if(U.connectionId)Y.set(F,{tenant:K.tenant,repoUrl:W,connectionId:U.connectionId,cloneUrl:U.cloneUrl});continue}let N=F?Z.orgRepositories.get(F):void 0;if(!F||!N){G++;continue}Y.set(F,{tenant:K.tenant,repoUrl:W,repositoryId:N})}for(let K of $.sandboxes){let W=K.tenant;if(!W)continue;let H=Z.members.get(HB1(W));if(H===void 0){G++;continue}for(let U of K.repos){if(ME6(Z,U)!==W.orgId){G++;continue}let N="repositoryId"in U?{repositoryId:U.repositoryId}:{connectionId:U.connectionId,repo:U.repo.toLowerCase()},B={orgId:W.orgId,userId:W.userId};X.set(JSON.stringify([B,N]),{tenant:B,repo:N})}let F=K.orgFsConfigExpiresAt;if(K.orgFs&&(F===null||F-Q<qE6))J.set(HB1(W),{orgId:W.orgId,userId:W.userId,orgSlug:H})}return{clones:[...X.values()],poolClones:[...Y.values()],orgFs:[...J.values()],refused:G}}async function oo$($,Z,Q){let X=new Set,Y=new Set,J=new Set,G=new Set,K=new Set(Q.map((D)=>D.tenant)),W=new Set;for(let D of Q)for(let{repoUrl:O}of D.repos){let j=tX(O);if(j)W.add(j.path.toLowerCase())}for(let D of Z){if(D.tenant)X.add(D.tenant.orgId),Y.add(D.tenant.userId);for(let O of D.repos)if("repositoryId"in O)G.add(O.repositoryId);else J.add(O.connectionId)}let[H,F,U,N]=await Promise.all([X.size===0?[]:$.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.organizationId as orgId","member.userId as userId","organization.slug as slug"]).where("member.organizationId","in",[...X]).where("member.userId","in",[...Y]).execute(),J.size===0?[]:$.selectFrom("connections").select(["id","organization_id"]).where("id","in",[...J]).execute(),G.size===0?[]:$.selectFrom("repositories").select(["id","organization_id"]).where("id","in",[...G]).execute(),W.size===0?[]:$.selectFrom("repositories").select(["id","organization_id","provider","host","path"]).where("organization_id","in",[...K]).where((D)=>D(D.fn("lower",["path"]),"in",[...W])).execute()]),B=new Map;for(let D of N){let O=no$(D.organization_id,p80({provider:D.provider,host:D.host,path:D.path}));if(O&&!B.has(O))B.set(O,D.id)}return{members:new Map(H.map((D)=>[HB1(D),D.slug])),connectionOrgs:new Map(F.map((D)=>[D.id,D.organization_id])),repositoryOrgs:new Map(U.map((D)=>[D.id,D.organization_id])),orgRepositories:B}}function WB1($){return $ instanceof Error?$.message:String($)}async function ro$($,Z,Q){let X=0;if($.clones.length>pp||$.poolClones.length>pp||$.orgFs.length>KB1)console.warn(`[sandbox-credential-push] ${$.clones.length} clone, ${$.poolClones.length} pool clone and ${$.orgFs.length} org-fs mints planned; minting the first ${pp}, ${pp} and ${KB1}`);let Y=await z9($.clones.slice(0,pp),GB1,async(U)=>{let N="repositoryId"in U.repo?{cloneUrl:"",repositoryId:U.repo.repositoryId}:{cloneUrl:`https://github.com/${U.repo.repo}.git`,connectionId:U.repo.connectionId};try{let B=await Z.mintCloneUrl(N,{bufferMs:mC0});return B?{tenant:U.tenant,repo:U.repo,cloneUrl:B,expiresAt:Q.now+mC0}:null}catch(B){return X++,console.warn(`[sandbox-credential-push] clone mint failed: ${WB1(B)}`),null}}),J=await z9($.poolClones.slice(0,pp),GB1,async(U)=>{try{let N=await Z.mintCloneUrl("repositoryId"in U?{cloneUrl:"",repositoryId:U.repositoryId}:{cloneUrl:U.cloneUrl,connectionId:U.connectionId},{bufferMs:mC0});return N?{tenant:U.tenant,repoUrl:U.repoUrl,cloneUrl:N,expiresAt:Q.now+mC0}:null}catch(N){return X++,console.warn(`[sandbox-credential-push] pool clone mint failed: ${WB1(N)}`),null}}),G=await z9($.orgFs.slice(0,KB1),GB1,async(U)=>{try{let N=await Z.mintOrgFsConfig(U);return N?{tenant:{orgId:U.orgId,userId:U.userId},orgFsConfigJson:N,expiresAt:Q.now+Q.orgFsLifetimeMs}:null}catch(N){return X++,console.warn(`[sandbox-credential-push] org-fs mint failed: ${WB1(N)}`),null}}),K=Y.filter((U)=>U!==null),W=J.filter((U)=>U!==null),H=G.filter((U)=>U!==null),F=[];for(let U=0;U<Math.max(K.length,W.length,H.length);U+=Rz)F.push({cloneUrls:K.slice(U,U+Rz),poolCloneUrls:W.slice(U,U+Rz),orgFsConfigs:H.slice(U,U+Rz)});return{batches:F,failed:X}}var mC0=2700000,dC0,RE6=86400000,qE6=86400000,GB1=8,pp=2000,KB1=200;var iC0=L(()=>{mF1();g60();r4();$8();bD();cC0();dC0=pl$-3600000});var KJ;var h60=L(()=>{KJ=class KJ extends Error{code;status;path;constructor($,Z,Q){super(Z.message||`Freestyle API error: ${Z.code}`);this.name="FreestyleApiError",this.code=Z.code,this.status=$,this.path=Q,Object.setPrototypeOf(this,KJ.prototype)}}});function ao$(){return typeof process<"u"&&Boolean(process.versions?.node)}var pC0=($,Z)=>globalThis.fetch($,Z);async function IE6(){if(!ao$())return null;try{return await import("undici")}catch{return null}}async function kE6(){let $=await IE6();if(!$)return null;let Z=new $.Agent({allowH2:!0,connections:VE6});return(Q,X)=>$.fetch(Q,{...X,dispatcher:Z})}function CE6($){return(typeof $==="string"?$:$ instanceof URL?$.href:$.url).startsWith("https:")}function so$(){let $,Z=()=>{return $??=kE6().then((Q)=>Q??pC0).catch(()=>pC0),$};return(Q,X)=>CE6(Q)?Z().then((Y)=>Y(Q,X)):pC0(Q,X)}var VE6=4;var eo$=()=>{};function bE6($){return new Promise((Z)=>setTimeout(Z,$))}function yE6($){if(!$)return"";let Z=new URLSearchParams;for(let[X,Y]of Object.entries($)){if(Y===void 0||Y===null)continue;Z.set(X,String(Y))}let Q=Z.toString();return Q?`?${Q}`:""}function n6($){return encodeURIComponent($)}class UB1{baseUrl;authenticationHeaders;fetchImpl;backgroundEligible;constructor($={}){if(this.baseUrl=($.baseUrl??fE6).replace(/\/+$/,""),!$.fetch&&!globalThis.fetch)throw Error("No fetch implementation available. Pass `fetch` in FreestyleOptions when running on a runtime without a global fetch.");if(this.fetchImpl=$.fetch??so$(),"identityAccessToken"in $&&$.identityAccessToken){this.authenticationHeaders={[SE6]:$.identityAccessToken},this.backgroundEligible=!1;return}if(this.backgroundEligible=!0,"stackAccessToken"in $&&$.stackAccessToken){this.authenticationHeaders={Authorization:`Bearer ${$.stackAccessToken}`,"X-Freestyle-Team-Id":$.teamId};return}let Z=$.apiKey??globalThis.process?.env?.FREESTYLE_API_KEY;if(!Z)throw Error("No Freestyle API key provided. Pass `apiKey` in FreestyleOptions or set FREESTYLE_API_KEY.");this.authenticationHeaders={Authorization:`Bearer ${Z}`}}authHeaders(){return{...this.authenticationHeaders}}url($,Z){return`${this.baseUrl}${$}${yE6(Z)}`}async fetch($,Z={}){let Q=new Headers(Z.headers);for(let[X,Y]of Object.entries(this.authHeaders()))if(!Q.has(X))Q.set(X,Y);return this.fetchImpl(this.absoluteUrl($),{...Z,headers:Q})}absoluteUrl($){return/^https?:\/\//i.test($)?$:`${this.baseUrl}${$}`}async request($,Z,{query:Q,body:X,rawBody:Y,signal:J}={}){let G={...this.authHeaders()};if(this.backgroundEligible)G[$r$]=String(vE6);let K;if(Y!==void 0)G["Content-Type"]="application/octet-stream",K=Y;else if(X!==void 0)G["Content-Type"]="application/json",K=JSON.stringify(X);let W=this.url(Z,Q),H=await this.fetchImpl(W,{method:$,headers:G,body:K,signal:J});if(this.backgroundEligible&&H.status===202)try{return await this.pollBackgroundRequest(H,Z)}catch(F){if($==="GET"&&F instanceof KJ&&F.code==="BACKGROUND_RESULT_UNSTORABLE"){delete G[$r$];let U=await this.fetchImpl(W,{method:$,headers:G,body:K});return this.finalize(U,Z)}throw F}return this.finalize(H,Z)}async pollBackgroundRequest($,Z){let Q=await $.json().catch(()=>({})),X=$.headers.get(_E6)??Q.requestId,Y=Q.resultUrl??(X?`/v5/background-requests/${n6(X)}`:void 0);if(!Y)throw new KJ($.status,{code:"BACKGROUND_PROTOCOL_ERROR",message:"202 Accepted carried no background request id"},Z);let J=0;for(;;){await bE6(xE6);let G;try{G=await this.fetch(Y,{method:"GET"}),J=0}catch(K){if(++J>=5)throw K;continue}if(G.status===202)continue;return this.finalize(G,Z)}}async finalize($,Z){if(!$.ok){let X;try{X=await $.json()}catch{X={code:"UNKNOWN_ERROR",message:await $.text().catch(()=>$.statusText)}}throw new KJ($.status,X,Z)}if($.status===204)return;let Q=await $.text();if(!Q)return;return JSON.parse(Q)}get($,Z){return this.request("GET",$,{query:Z})}post($,Z){return this.request("POST",$,{body:Z??{}})}patch($,Z){return this.request("PATCH",$,{body:Z??{}})}put($,Z){return this.request("PUT",$,{body:Z??{}})}putEmpty($){return this.request("PUT",$,{})}putBytes($,Z,Q,X){return this.request("PUT",$,{query:Q,rawBody:Z,signal:X})}async getBytes($,Z,Q={}){let X={...this.authHeaders()};if(Q.range)X.Range=Q.range;let Y=await this.fetchImpl(this.url($,Z),{method:"GET",headers:X,signal:Q.signal});if(!Y.ok){let J;try{J=await Y.json()}catch{J={code:"UNKNOWN_ERROR",message:await Y.text().catch(()=>Y.statusText)}}throw new KJ(Y.status,J,$)}return Y}delete($,Z){return this.request("DELETE",$,{query:Z})}}var SE6="x-freestyle-identity-access-token",$r$="x-freestyle-background-after-secs",_E6="x-freestyle-background-request-id",vE6=5,xE6=2000,fE6="https://api.freestyle.sh";var qW=L(()=>{h60();eo$()});class NB1{client;verifications;certificates;placeholder;constructor($){this.client=$,this.verifications=new Zr$($),this.certificates=new Qr$($),this.placeholder=new Xr$($)}async list(){let{domains:$}=await this.client.get("/v5/domains");return $}}class Zr${client;constructor($){this.client=$}create($){return this.client.post("/v5/verifications",{domain:$})}async list($={}){let{verifications:Z}=await this.client.get("/v5/verifications",$);return Z}get($){return this.client.get(`/v5/verifications/${n6($)}`)}complete($){return this.client.putEmpty(`/v5/verifications/${n6($)}`)}delete($){return this.client.delete(`/v5/verifications/${n6($)}`)}}class Qr${client;constructor($){this.client=$}async list(){let{certificates:$}=await this.client.get("/v5/certificates");return $}createWildcard($){return this.client.post("/v5/certificates/wildcard",{domain:$})}}class Xr${client;constructor($){this.client=$}async get(){try{return await this.client.get("/v5/domains/placeholder")}catch($){if($ instanceof KJ&&$.status===404)return null;throw $}}set($){return this.client.put("/v5/domains/placeholder",$)}delete(){return this.client.delete("/v5/domains/placeholder")}}var BB1=L(()=>{qW();h60()});function G5($,Z){throw new DB1($,Z)}function LB1($){return gE6.some((Z)=>$[Z]!==void 0)}function OB1($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function uE6($,Z){let Q=Z.lastIndexOf("/");if(Q<0)G5($,`${$} \`${Z}\` is not a CIDR: expected address/prefix, e.g. 203.0.113.0/24 or 2001:db8::/32`);let X=Z.slice(0,Q),Y=Z.slice(Q+1);if(!/^\d+$/.test(Y))G5($,`${$} \`${Z}\`: prefix length must be a number`);let J=Number(Y),G=X.includes(":"),K=G?128:32;if(J>K)G5($,`${$} \`${Z}\`: prefix length must be 0\u2013${K}`);if(!G&&!/^\d{1,3}(\.\d{1,3}){3}$/.test(X))G5($,`${$} \`${Z}\`: \`${X}\` is not an IP address`)}function Kr$($,Z){if(!OB1($))G5(Z,`${Z} must be an object`);for(let X of Object.keys($))if(!Yr$.includes(X))G5(`${Z}.${X}`,`${Z} has unknown field \`${X}\`. Expected one of: ${Yr$.join(", ")}`);let Q=$;for(let X of["vmId","vpcId","tunnelId","cidr"]){let Y=Q[X];if(Y!==void 0&&(typeof Y!=="string"||Y.length===0))G5(`${Z}.${X}`,`${Z}.${X} must be a non-empty string`)}if(Q.public!==void 0&&Q.public!==!0)G5(`${Z}.public`,`${Z}.public must be true when present: it declares the public Internet. Omit the field to match something else`);if(Q.public===!0){if(Q.vmId!==void 0)G5(`${Z}.public`,`${Z} cannot combine \`public: true\` with \`vmId\`: that would mean the VM only when reached over its public address, a distinction this API does not make yet. Use \`vmId\` alone to match the VM on any path, or \`public: true\` alone to match public addresses`);if(Q.vpcId!==void 0)G5(`${Z}.public`,`${Z} cannot combine \`public: true\` with \`vpcId\`: that would mean the network's members only when reached over their public addresses, a distinction this API does not make yet. Use \`vpcId\` alone or \`public: true\` alone`);if(Q.tunnelId!==void 0)G5(`${Z}.public`,`${Z} cannot combine \`public: true\` with \`tunnelId\`: traffic through a tunnel arrives over the tunnel, not over the public Internet. Use \`tunnelId\` alone`)}if(Q.cidr!==void 0)uE6(`${Z}.cidr`,Q.cidr);if(Q.protocol!==void 0&&!Jr$.includes(Q.protocol))G5(`${Z}.protocol`,`${Z}.protocol must be one of: ${Jr$.join(", ")} (got \`${String(Q.protocol)}\`)`);if(Q.port!==void 0){if(!Number.isInteger(Q.port)||Q.port<1||Q.port>65535)G5(`${Z}.port`,`${Z}.port must be an integer between 1 and 65535`);if(Q.protocol===void 0)G5(`${Z}.protocol`,`${Z}.port ${Q.port} requires ${Z}.protocol: set it to "tcp" or "udp" so the rule opens one transport rather than both`);if(!hE6.includes(Q.protocol))G5(`${Z}.port`,`${Z}.protocol "${Q.protocol}" has no ports; remove ${Z}.port ${Q.port}`)}}function Fr$($,Z){if(!OB1($))G5(Z||"rule",`${Z||"rule"} must be an object`);for(let X of Object.keys($))if(!Wr$.includes(X))G5(`${Z}${X}`,`Unknown field \`${X}\`. Expected one of: ${Wr$.join(", ")}`);let Q=$;if(Q.action===void 0)G5(`${Z}action`,`${Z}action is required. Write \`action: "allow"\` \u2014 every rule states what it does rather than defaulting to it`);if(Q.action!=="allow")G5(`${Z}action`,`${Z}action must be "allow" (got \`${String(Q.action)}\`). Only allow rules exist today`);if(Q.description!==void 0){if(typeof Q.description!=="string")G5(`${Z}description`,"description must be a string");if(Q.description.length>Gr$)G5(`${Z}description`,`description is too long (${Q.description.length} characters, maximum ${Gr$})`)}if(Q.source===void 0)G5(`${Z}source`,`${Z}source is required`);if(Q.destination===void 0)G5(`${Z}destination`,`${Z}destination is required`);return Kr$(Q.source,`${Z}source`),Kr$(Q.destination,`${Z}destination`),Q}function lE6($){let Z=Fr$($,"");for(let Q of["source","destination"]){let X=Z[Q];if(LB1(X))continue;let Y=[X.port!==void 0?`port ${X.port}`:void 0,X.protocol!==void 0?`protocol ${X.protocol}`:void 0].filter(Boolean).join(", ");G5(Q,Y?`${Q} only narrows traffic (${Y}) without saying what it is. Add \`vmId\`, \`vpcId\`, \`tunnelId\`, \`cidr\`, or \`public: true\`. Leaving it out to mean "this VM" only works inside vms.create`:`${Q} is empty. A matcher must say what the traffic is: \`vmId\`, \`vpcId\`, \`tunnelId\`, \`cidr\`, or \`public: true\` for the public Internet`)}return Z}function nC0($,Z="VM"){if($===void 0||$===null)G5("firewall",`firewall is required on a ${Z} create. A ${Z} gets nothing implicitly, so state what it may reach \u2014 \`{ rules: [] }\` if the answer is nothing`);if(!OB1($))G5("firewall","firewall must be an object with a `rules` array");for(let X of Object.keys($))if(X!=="rules")G5(`firewall.${X}`,`firewall has unknown field \`${X}\`. Expected: rules`);let Q=$.rules;if(!Array.isArray(Q))G5("firewall.rules","firewall.rules must be an array");return Q.forEach((X,Y)=>{let J=`firewall.rules[${Y}].`,G=Fr$(X,J),K=LB1(G.source),W=LB1(G.destination);if(!K&&!W&&Z!=="network")G5(`firewall.rules[${Y}]`,`firewall.rules[${Y}]: both source and destination refer to the ${Z} being created, which allows nothing. Give one of them a \`vmId\`, \`vpcId\`, \`tunnelId\`, \`cidr\`, or \`public: true\``);if(K&&W)G5(`firewall.rules[${Y}]`,`firewall.rules[${Y}]: neither end refers to the ${Z} being created. Leave one endpoint's identity unset so it means this ${Z}, or create the rule with firewall.rules.create instead`)}),$}function Hr$($){return`/v5/firewall/rules/${n6($)}`}class Ur${client;constructor($){this.client=$}async create($){let Z=lE6($);return this.client.post("/v5/firewall/rules",Z)}list($={}){return this.client.get("/v5/firewall/rules",$)}get($){return this.client.get(Hr$($))}delete($){return this.client.delete(Hr$($))}}class jB1{client;rules;constructor($){this.client=$,this.rules=new Ur$($)}evaluate($){return this.client.post("/v5/firewall/evaluate",$)}}var DB1,Yr$,gE6,Jr$,hE6,Gr$=1024,Wr$;var u60=L(()=>{qW();DB1=class DB1 extends Error{path;constructor($,Z){super(Z);this.name="FirewallRuleValidationError",this.path=$,Object.setPrototypeOf(this,DB1.prototype)}};Yr$=["vmId","vpcId","tunnelId","cidr","public","port","protocol"],gE6=["vmId","vpcId","tunnelId","cidr","public"],Jr$=["tcp","udp","icmp"],hE6=["tcp","udp"];Wr$=["action","source","destination","description"]});function wB1($){return`/v5/identities/${n6($)}`}class Nr${client;basePath;constructor($,Z){this.client=$,this.basePath=Z}create(){return this.client.post(`${this.basePath}/tokens`)}list(){return this.client.get(`${this.basePath}/tokens`)}revoke($){return this.client.delete(`${this.basePath}/tokens/${n6($)}`)}}class Br${client;basePath;constructor($,Z){this.client=$,this.basePath=Z}list(){return this.client.get(`${this.basePath}/permissions/vm`)}grant($){return this.client.post(`${this.basePath}/permissions/vm`,$)}get($){return this.client.get(`${this.basePath}/permissions/vm/${n6($)}`)}update($,Z){return this.client.patch(`${this.basePath}/permissions/vm/${n6($)}`,{allowedLinuxUsers:Z})}revoke($){return this.client.delete(`${this.basePath}/permissions/vm/${n6($)}`)}}class EB1{id;tokens;permissions;client;basePath;constructor($,Z){this.client=$,this.id=Z,this.basePath=wB1(Z),this.tokens=new Nr$($,this.basePath),this.permissions={vm:new Br$($,this.basePath)}}data(){return this.client.get(this.basePath)}delete(){return this.client.delete(this.basePath)}}class zB1{client;constructor($){this.client=$}async create($={}){let Z=await this.client.post("/v5/identities",$);return{identity:new EB1(this.client,Z.id),identityId:Z.id,data:Z}}list($={}){return this.client.get("/v5/identities",$)}get($){return this.client.get(wB1($))}ref($){return new EB1(this.client,$)}delete($){return this.client.delete(wB1($))}}var PB1=L(()=>{qW()});function b1($,Z){throw new qB1($,Z)}function D7($,Z){throw new MB1($,Z)}function l60($){return cE6.some((Z)=>$[Z]!==void 0)}function rE6($){return!l60($)&&$.port===void 0}function XY($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function Ir$($,Z,Q){if(typeof $!=="string"||!pE6.test($))D7(Z,`${Z} must be a valid HTTP header name`);let X=$.toLowerCase();if(oE6.has(X)||X.startsWith("x-forwarded-")||X.startsWith("x-freestyle-")||Q&&(X==="cookie"||X==="set-cookie"))D7(Z,`${Z} may not use reserved header \`${$}\``)}function aE6($,Z){if(!Array.isArray($))D7(Z,`${Z} must be an array of header names`);if($.length>zr$)D7(Z,`${Z} may contain at most ${zr$} names`);let Q=new Set;$.forEach((X,Y)=>{Ir$(X,`${Z}[${Y}]`,!0);let J=X.toLowerCase();if(Q.has(J))D7(`${Z}[${Y}]`,`${Z} contains duplicate header \`${X}\``);Q.add(J)})}function Tr$($){if(!XY($))D7("forwardAuth","forwardAuth must be an object");for(let X of Object.keys($))if(!Or$.includes(X))D7(X,`Unknown field \`${X}\`. Expected one of: ${Or$.join(", ")}`);let Z=$;if(typeof Z.url!=="string"||Z.url.length===0||Z.url.length>nE6)D7("url","url is required and must be an absolute HTTPS URL");let Q;try{Q=new URL(Z.url)}catch{D7("url","url must be an absolute HTTPS URL")}if(Q.protocol!=="https:"||Q.hostname.length===0||Q.username.length>0||Q.password.length>0||Q.hash.length>0||Q.port==="0")D7("url","url must be an absolute HTTPS URL");if(Z.headers!==void 0){if(!XY(Z.headers))D7("headers","headers must be an object of header name to value");let X=Object.entries(Z.headers);if(X.length>wr$)D7("headers",`headers may contain at most ${wr$} entries`);let Y=0,J=new Set;for(let[G,K]of X){Ir$(G,`headers.${G}`,!1);let W=G.toLowerCase();if(J.has(W))D7(`headers.${G}`,`headers contains duplicate header \`${G}\``);if(J.add(W),typeof K!=="string"||/[\0\r\n]/.test(K))D7(`headers.${G}`,`headers.${G} must be a string`);Y+=G.length+K.length}if(Y>Er$)D7("headers",`headers may contain at most ${Er$} bytes`)}if(Z.timeoutMs!==void 0&&(!Number.isInteger(Z.timeoutMs)||Z.timeoutMs<100||Z.timeoutMs>5000))D7("timeoutMs","timeoutMs must be an integer between 100 and 5000");if(Z.protectedCookies!==void 0){if(!Array.isArray(Z.protectedCookies))D7("protectedCookies","protectedCookies must be an array of cookie names");if(Z.protectedCookies.length>Pr$)D7("protectedCookies",`protectedCookies may contain at most ${Pr$} names`);let X=new Set;Z.protectedCookies.forEach((Y,J)=>{if(typeof Y!=="string"||Y.length>tE6||!iE6.test(Y))D7(`protectedCookies[${J}]`,`protectedCookies[${J}] must be a valid HTTP cookie name`);if(X.has(Y))D7(`protectedCookies[${J}]`,`protectedCookies contains duplicate cookie \`${Y}\``);X.add(Y)})}if(Z.authResponseHeaders!==void 0)aE6(Z.authResponseHeaders,"authResponseHeaders");return Z}function sE6($,Z){if(!XY($))b1(Z,`${Z} must be an object with an \`id\``);for(let X of Object.keys($))if(!jr$.includes(X))b1(`${Z}.${X}`,`${Z} has unknown field \`${X}\`. Expected: ${jr$.join(", ")}`);let Q=$.id;if(typeof Q!=="string"||Q.length===0)b1(`${Z}.id`,`${Z}.id is required and must be a non-empty string`)}function RB1($){if(typeof $!=="string")b1("domain","domain is required and must be a string");if($==="*")return;let Z=$.startsWith("*.")?$.slice(2):$;if(Z.length===0||Z.length>mE6)b1("domain",`domain \`${$}\` is not a hostname`);let Q=Z.split(".");if(Q.length<2)b1("domain",`domain \`${$}\` must have at least two labels, e.g. acme.com`);for(let X of Q){if(X.length===0||X.length>dE6)b1("domain",`domain \`${$}\` has an empty or over-long label`);if(!/^[a-z0-9-]+$/.test(X))b1("domain",`domain \`${$}\`: labels are lowercase letters, digits, and hyphens (a \`*.\` prefix is the only wildcard)`);if(X.startsWith("-")||X.endsWith("-"))b1("domain",`domain \`${$}\`: a label cannot start or end with a hyphen`)}}function eE6($){if(typeof $!=="string")b1("domain","domain is required and must be a string");let Z=$.lastIndexOf("@");if(Z===-1){RB1($);return}let Q=$.slice(0,Z),X=$.slice(Z+1);if(Q.length===0||Q.length>64)b1("domain",`mail route \`${$}\`: the part before \`@\` must be 1-64 characters`);if(Q.startsWith(".")||Q.endsWith(".")||Q.includes(".."))b1("domain",`mail route \`${$}\`: the part before \`@\` cannot start or end with a dot, or contain \`..\``);for(let Y of Q)if(!/[a-zA-Z0-9]/.test(Y)&&!Ar$.includes(Y))b1("domain",`mail route \`${$}\`: the part before \`@\` may use letters, digits, dots, and \`${Ar$.slice(0,-1)}\` (quoted mailboxes are not supported)`);if(X==="*")b1("domain",`mail route \`${$}\`: \`*\` is not a mail domain \u2014 name the domain the mailbox lives at`);RB1(X)}function Rr$($,Z){if(!XY($))b1(Z,`${Z} must be an object`);for(let X of Object.keys($))if(!Lr$.includes(X))b1(`${Z}.${X}`,`${Z} has unknown field \`${X}\`. Expected one of: ${Lr$.join(", ")}`);let Q=$;for(let X of["vmId","vpcId","host"]){let Y=Q[X];if(Y!==void 0&&(typeof Y!=="string"||Y.length===0))b1(`${Z}.${X}`,`${Z}.${X} must be a non-empty string`)}if(Q.public!==void 0&&Q.public!==!0)b1(`${Z}.public`,`${Z}.public must be true when present. Omit the field to match something else`);if(Z==="source"){if(Q.host!==void 0)b1("source.host","source.host is not allowed: a source is who opens the session, not where it lands. Put `host` on the destination");if(Q.port!==void 0)b1("source.port","source.port is not allowed: a source is who opens the session, not where it lands. Put `port` on the destination");if(Q.public===!0&&(Q.vmId!==void 0||Q.vpcId!==void 0))b1("source.public","source cannot combine `public: true` with `vmId` or `vpcId`: use one alone. `public` is every client on the Internet; `vmId`/`vpcId` is a specific dialer")}else{if(Q.vpcId!==void 0)b1("destination.vpcId","destination.vpcId is not allowed: a session lands in one place, not on a whole network. Name a `vmId`, a `host`, or `public: true` for the domain's own origin. A whole network may be a source");if([Q.vmId!==void 0,Q.host!==void 0,Q.public===!0].filter(Boolean).length>1)b1("destination","destination names more than one landing: give exactly one of `vmId`, `host`, or `public: true`");if((Q.vmId!==void 0||Q.host!==void 0)&&Q.port===void 0)b1("destination.port",`destination.port is required with ${Q.vmId!==void 0?"`vmId`":"`host`"}: say which port the session lands on`)}if(Q.port!==void 0){if(!Number.isInteger(Q.port)||Q.port<1||Q.port>65535)b1(`${Z}.port`,`${Z}.port must be an integer between 1 and 65535`)}}function $z6($){if("postgres"in $)return"postgres";if("smtp"in $)return"smtp";if("socks5"in $)return"socks5";return"http"}function Zz6($,Z){function Q(K,W,H){if(!XY(K)||Object.keys(K).some((F)=>!W.includes(F)))b1(H,`${H} must contain only ${W.join(", ")}`)}if(Q($,["region","credentials","scope"],Z),typeof $.region!=="string"||!/^[a-z0-9-]{1,63}$/.test($.region))b1(`${Z}.region`,"invalid s3.region");Q($.credentials,["accessKeyId","secretAccessKey","sessionToken"],`${Z}.credentials`);for(let K of["accessKeyId","secretAccessKey","sessionToken"]){let W=$.credentials[K];if(K==="sessionToken"&&W===void 0)continue;if(typeof W!=="string"||!/^[\x21-\x7e]{1,16384}$/.test(W))b1(`${Z}.credentials.${K}`,"invalid s3 credentials")}if(!/^[a-zA-Z0-9]+$/.test($.credentials.accessKeyId))b1(`${Z}.credentials.accessKeyId`,"invalid s3 access key id");Q($.scope,["bucket","prefix","operations"],`${Z}.scope`);let{bucket:X,prefix:Y,operations:J}=$.scope;if(typeof X!=="string"||!/^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/.test(X)||X.includes(".."))b1(`${Z}.scope.bucket`,"invalid s3.scope.bucket");if(typeof Y!=="string"||Buffer.byteLength(Y,"utf8")>1024||/[\x00-\x1f\x7f-\x9f]/u.test(Y))b1(`${Z}.scope.prefix`,"invalid s3.scope.prefix");let G=["GetObject","HeadObject","PutObject","DeleteObject","ListObjectsV2","CreateMultipartUpload","UploadPart","ListParts","CompleteMultipartUpload","AbortMultipartUpload","ListMultipartUploads"];if(!Array.isArray(J)||J.length===0||J.length>G.length||J.some((K)=>!G.includes(K))||new Set(J).size!==J.length)b1(`${Z}.scope.operations`,"s3.scope.operations must be a nonempty list of distinct supported operations")}function Qz6($,Z){if(!XY($))b1(Z,`${Z} must be an object: \`{ headers: { \u2026 } }\`, \`{ postgres: { \u2026 } }\`, \`{ smtp: { \u2026 } }\` or \`{ socks5: { \u2026 } }\``);let Q=Object.keys($);if(Q.length!==1||!["headers","jsonPatch","postgres","smtp","socks5","s3"].includes(Q[0]??""))b1(Z,`${Z} must have exactly one of \`headers\`, \`jsonPatch\`, \`postgres\`, \`smtp\`, \`socks5\` or \`s3\` (got: ${Q.length===0?"nothing":Q.join(", ")})`);if(Q[0]==="s3"){Zz6($.s3,`${Z}.s3`);return}if(Q[0]==="jsonPatch"){let X=$.jsonPatch;if(!Array.isArray(X)||X.length>128)b1(Z,`${Z}.jsonPatch must be an array of at most 128 operations`);let Y=(K)=>typeof K==="string"&&(K===""||K.startsWith("/"))&&!/~(?:[^01]|$)/u.test(K),J=(K,W=new Set,H=0)=>{if(H>64)return!1;if(K===null||typeof K==="string"||typeof K==="boolean")return!0;if(typeof K==="number")return Number.isFinite(K);if(typeof K!=="object"||W.has(K))return!1;W.add(K);let F=(Array.isArray(K)?Array.from(K):XY(K)?Object.values(K):[void 0]).every((U)=>J(U,W,H+1));return W.delete(K),F};for(let[K,W]of X.entries()){if(!XY(W)||!["add","remove","replace","move","copy","test"].includes(String(W.op))||!Y(W.path))b1(Z,`${Z}.jsonPatch[${K}] requires a standard op and valid JSON Pointer path`);if(["move","copy"].includes(W.op)&&!Y(W.from))b1(Z,`${Z}.jsonPatch[${K}].from must be a JSON Pointer`);if(["add","replace","test"].includes(W.op)&&(!Object.hasOwn(W,"value")||!J(W.value)))b1(Z,`${Z}.jsonPatch[${K}].value must be a JSON value (null is allowed)`)}let G;try{G=JSON.stringify(X)}catch{b1(Z,"jsonPatch must be JSON serializable")}if(Buffer.byteLength(G,"utf8")>65536)b1(Z,"jsonPatch exceeds 64 KiB");return}if(Q[0]==="socks5"){let X=$.socks5;if(!XY(X))b1(`${Z}.socks5`,`${Z}.socks5 must be an object with \`username\` and \`password\``);for(let Y of Object.keys(X))if(!["username","password"].includes(Y))b1(`${Z}.socks5.${Y}`,`${Z}.socks5 has unknown field \`${Y}\`. Expected: username, password`);for(let Y of["username","password"])if(typeof X[Y]!=="string"||X[Y].length===0)b1(`${Z}.socks5.${Y}`,`${Z}.socks5.${Y} is required and must be a non-empty string`);return}if(Q[0]==="smtp"){let X=$.smtp;if(!XY(X))b1(`${Z}.smtp`,`${Z}.smtp must be an object with \`username\` and \`password\``);for(let Y of Object.keys(X))if(!["username","password"].includes(Y))b1(`${Z}.smtp.${Y}`,`${Z}.smtp has unknown field \`${Y}\`. Expected: username, password`);for(let Y of["username","password"])if(typeof X[Y]!=="string"||X[Y].length===0)b1(`${Z}.smtp.${Y}`,`${Z}.smtp.${Y} is required and must be a non-empty string`);return}if(Q[0]==="headers"){let X=$.headers;if(!XY(X))b1(`${Z}.headers`,`${Z}.headers must be an object of header name to value`);for(let[Y,J]of Object.entries(X))if(typeof J!=="string")b1(`${Z}.headers.${Y}`,`${Z}.headers.${Y} must be a string`)}else{let X=$.postgres;if(!XY(X))b1(`${Z}.postgres`,`${Z}.postgres must be an object with \`username\` and \`password\``);for(let J of Object.keys(X))if(!["username","password","database"].includes(J))b1(`${Z}.postgres.${J}`,`${Z}.postgres has unknown field \`${J}\`. Expected: username, password, database`);let Y=X;for(let J of["username","password"])if(typeof Y[J]!=="string"||Y[J].length===0)b1(`${Z}.postgres.${J}`,`${Z}.postgres.${J} is required and must be a non-empty string`);if(Y.database!==void 0&&typeof Y.database!=="string")b1(`${Z}.postgres.database`,`${Z}.postgres.database must be a string`)}}function Xz6($,Z){let Q=$;return Z.forEach((X,Y)=>{let J=$z6(X);if(Q===void 0)Q=J;else if(Q!==J)b1(`transform[${Y}]`,`transform requires protocol \`${J}\` but the rule is \`${Q}\`; a rule terminates one protocol`)}),Q??"http"}function Yz6($,Z){if(!XY($)||Object.keys($).some((Q)=>Q!=="method"&&Q!=="path"))b1(Z,`${Z} must be an object containing only method and path`);if($.method!==void 0&&(!Array.isArray($.method)||$.method.some((Q)=>typeof Q!=="string"||Q.length===0||/[^!#$%&'*+.^_`|~0-9A-Za-z-]/.test(Q))))b1(`${Z}.method`,`${Z}.method must be an array of HTTP method tokens`);if($.path!==void 0){let Q=$.path;if(!XY(Q)||Object.keys(Q).length!==1||typeof Q.exact!=="string"||!Q.exact.startsWith("/")||/[\s?#]/.test(Q.exact))b1(`${Z}.path`,`${Z}.path must contain exact: an absolute path without a query or fragment`)}}function Vr$($,Z){if(!XY($))b1(Z||"rule",`${Z||"rule"} must be an object`);for(let H of Object.keys($))if(!qr$.includes(H))b1(`${Z}${H}`,`Unknown field \`${H}\`. Expected one of: ${qr$.join(", ")}`);let Q=$;if(Q.action===void 0)b1(`${Z}action`,`${Z}action is required. Write \`action: "allow"\` \u2014 every rule states what it does rather than defaulting to it`);if(Q.action!=="allow")b1(`${Z}action`,`${Z}action must be "allow" (got \`${String(Q.action)}\`). Only allow rules exist today`);if(Q.protocol!==void 0&&!Dr$.includes(Q.protocol))b1(`${Z}protocol`,`${Z}protocol must be one of: ${Dr$.join(", ")} (got \`${String(Q.protocol)}\`)`);let X=Q.source??{},Y=Q.destination??{};Rr$(X,"source"),Rr$(Y,"destination");let J=Q.transform??[];if(!Array.isArray(J))b1(`${Z}transform`,`${Z}transform must be an array`);J.forEach((H,F)=>Qz6(H,`${Z}transform[${F}]`));let G=Xz6(Q.protocol,J);if(Q.match!==void 0){if(Yz6(Q.match,`${Z}match`),G!=="http"||X.public===!0||!(Y.public===!0||Y.host!==void 0))b1(`${Z}match`,"match requires HTTP egress from a VM or VPC to a public origin or host")}if(J.some((H)=>("s3"in H))){if(J.length!==1||Q.match!==void 0||X.public===!0||!(Y.public===!0||Y.host!==void 0)||Q.domain.includes("*"))b1(`${Z}transform`,"s3 requires a sole transform on HTTP egress to a concrete origin, without match")}let K=J.filter((H)=>("jsonPatch"in H));if(K.length>1)b1(`${Z}transform`,"a rule may carry only one jsonPatch transform");if(K.length&&(X.public===!0||!(Y.public===!0||Y.host!==void 0)))b1(`${Z}transform`,"jsonPatch requires HTTP egress from a VM or VPC to a public origin or host");if(Q.forwardAuth!==void 0){sE6(Q.forwardAuth,`${Z}forwardAuth`);let H=Y.vmId!==void 0||!l60(Y)&&Y.port!==void 0;if(G!=="http"||X.public!==!0||!H||Q.domain==="*")b1(`${Z}forwardAuth`,`${Z}forwardAuth is only supported on HTTP public ingress: \`{ public: true } -> { vmId, port }\``)}if(G==="smtp")eE6(Q.domain);else RB1(Q.domain);if((X.vmId!==void 0||X.vpcId!==void 0)&&Y.vmId!==void 0&&J.length>0)b1(`${Z}transform`,"a VM-to-VM rule cannot carry a transform yet \u2014 remove it (only public ingress/egress rules run transforms)");if(G==="tcp"){let H=Y.public===!0||Y.host!==void 0,F=X.vmId!==void 0||X.vpcId!==void 0;if(H||F)b1(`${Z}protocol`,"a `tcp` rule is public ingress only \u2014 `{ public: true } -> { vmId, port }`. The edge splices the session without terminating it, so outbound there is nothing to broker (an outbound allow is a firewall rule, and injecting into one needs `http` or `postgres`) and inward there is no certificate to answer the source with. Give the source `public: true`, or drop `protocol` to be served as HTTPS")}else if(G==="imap"||G==="imaps"){let H=Y.public===!0||Y.host!==void 0,F=X.vmId!==void 0||X.vpcId!==void 0;if(H||F)b1(`${Z}protocol`,`an \`${G}\` rule is public ingress only \u2014 \`{ public: true } -> { vmId, port }\`. The 993 front serves mail clients reaching a VM's IMAP server; outbound there is nothing to broker (an outbound allow is a firewall rule) and inward there is no certificate to answer the source with`)}else if(G==="socks5"){let H=Y.public===!0||Y.host!==void 0;if(X.public===!0||!H)b1(`${Z}protocol`,'a `socks5` rule is egress only \u2014 `{ vmId } -> { host: "gate.provider.com", port: 1080 }`. The front exists so a guest can open sessions through a proxy whose credentials it never holds; inbound there is nothing to serve, and publishing one would be an open proxy on a platform address');if(Y.host===void 0)b1(`${Z}destination`,"a `socks5` rule has to name the proxy it goes through: give the destination a `host` and the `port` the provider listens on. `{ public: true }` on its own asks the edge to be the proxy, which would let the guest out on our address rather than through yours")}else if(G==="postgres"){let H=J.some((U)=>U!==null&&typeof U==="object"&&("postgres"in U)),F=Y.public===!0||Y.host!==void 0;if(H&&!F)b1(`${Z}transform`,"a `postgres` transform belongs on an egress rule: the edge spends a credential the guest never holds, so pointing it at your own VM would hand every client a logged-in session. Give the destination `public: true` or a `host`, or drop the transform")}else if(G==="smtp"){let H=J.some((U)=>U!==null&&typeof U==="object"&&("smtp"in U)),F=Y.public===!0||Y.host!==void 0;if(H&&!F)b1(`${Z}transform`,"an `smtp` transform belongs on an egress rule: the edge spends a credential the guest never holds, so pointing it at your own VM would turn it into an open relay. Give the destination `public: true` or a `host`, or drop the transform");if(typeof Q.domain==="string"&&Q.domain.includes("@")&&X.public!==!0)b1(`${Z}domain`,`\`${Q.domain}\` names a mailbox, which only makes sense on a rule that receives mail. An egress or VM-to-VM rule names the host the guest submits through \u2014 drop the part before \`@\``)}return{...Q,source:X,destination:Y}}function Jz6($,Z){if($==="source")return rE6(Z)?"source is empty. Say who opens the session: `vmId`, `vpcId`, or `public: true`":"source only narrows the session without saying who opens it. Add `vmId`, `vpcId`, or `public: true`";return"destination is empty. Say where the session lands: `vmId` + `port`, `host` + `port`, or `public: true` for the domain's own origin"}function Mr$($){let Z=Vr$($,"");for(let Q of["source","destination"]){let X=Z[Q];if(!l60(X))b1(Q,Jz6(Q,X))}if(Z.source.public===!0&&Z.destination.public===!0)b1("destination","a rule from the public Internet to the domain's own origin allows nothing the world cannot already do. Did you mean a `vmId` destination (ingress) or a `vmId` source (egress)?");return Z}function kr$($){if(!XY($))b1("tls","tls must be an object with a `rules` array");for(let Q of Object.keys($))if(Q!=="rules")b1(`tls.${Q}`,`tls has unknown field \`${Q}\`. Expected: rules`);let Z=$.rules;if(!Array.isArray(Z))b1("tls.rules","tls.rules must be an array");return Z.forEach((Q,X)=>{let Y=`tls.rules[${X}].`,J=Vr$(Q,Y),G=l60(J.source),K=l60(J.destination);if(!G&&!K)b1(`tls.rules[${X}]`,`tls.rules[${X}]: both source and destination refer to the VM being created, which allows nothing. Give one of them a \`vmId\`, \`vpcId\`, or \`public: true\``);if(G&&K)b1(`tls.rules[${X}]`,`tls.rules[${X}]: neither end refers to the VM being created. Leave one endpoint's identity unset so it means this VM, or create the rule with tls.rules.create instead`);if(!K&&J.destination.port===void 0)b1(`tls.rules[${X}].destination.port`,`tls.rules[${X}]: destination.port is required: say which port on this VM the session lands on`)}),$}function TB1($){return`/v5/tls/${n6($)}`}function AB1($){return`/v5/tls/forward-auth/${n6($)}`}class Cr${client;constructor($){this.client=$}list(){return this.client.get("/v5/tls/forward-auth")}async create($){let Z=Tr$($);return this.client.post("/v5/tls/forward-auth",Z)}get($){return this.client.get(AB1($))}async update($,Z){let Q=Tr$(Z);return this.client.put(AB1($),Q)}delete($){return this.client.delete(AB1($))}}class Sr${client;constructor($){this.client=$}async create($){let Z=Mr$($);return this.client.post("/v5/tls",Z)}list($={}){return this.client.get("/v5/tls",$)}get($){return this.client.get(TB1($))}async update($,Z){let Q=Mr$(Z);return this.client.put(TB1($),Q)}delete($){return this.client.delete(TB1($))}}class IB1{client;rules;forwardAuth;constructor($){this.client=$,this.rules=new Sr$($),this.forwardAuth=new Cr$($)}}var qB1,MB1,Lr$,cE6,Dr$,mE6=253,dE6=63,Or$,jr$,iE6,pE6,nE6=2048,wr$=32,Er$=16384,zr$=32,Pr$=32,tE6=128,oE6,Ar$="!#$%&'*+-/=?^_`{|}~.",qr$;var tC0=L(()=>{qW();qB1=class qB1 extends Error{path;constructor($,Z){super(Z);this.name="TlsRuleValidationError",this.path=$,Object.setPrototypeOf(this,qB1.prototype)}};MB1=class MB1 extends Error{path;constructor($,Z){super(Z);this.name="TlsForwardAuthValidationError",this.path=$,Object.setPrototypeOf(this,MB1.prototype)}};Lr$=["vmId","vpcId","public","host","port"],cE6=["vmId","vpcId","public","host"],Dr$=["tcp","http","postgres","minecraft","smtp","imap","imaps","socks5"],Or$=["url","headers","timeoutMs","protectedCookies","authResponseHeaders"],jr$=["id"],iE6=/^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/,pE6=/^[0-9A-Za-z-]+$/,oE6=new Set(["host","content-length","connection","keep-alive","proxy-authenticate","proxy-authorization","proxy-connection","te","trailer","transfer-encoding","upgrade"]);qr$=["action","domain","protocol","source","destination","transform","match","forwardAuth"]});function np($){return`/v5/tunnels/${n6($)}`}function Ag($){return $.tunnelId??=$.id,$}class VB1{client;constructor($){this.client=$}list(){return this.client.get("/v5/tunnels").then(($)=>{return $.tunnels.forEach(Ag),$})}create($={}){return this.client.post("/v5/tunnels",$).then(Ag)}get($){return this.client.get(np($)).then(Ag)}update($,Z){return this.client.patch(np($),Z).then(Ag)}rotateKey($,Z={}){return this.client.post(`${np($)}/rotate-key`,Z).then(Ag)}delete($){return this.client.delete(np($))}attachVpc($,Z,Q={}){return this.client.post(`${np($)}/vpcs/${n6(Z)}`,Q).then(Ag)}detachVpc($,Z){return this.client.delete(`${np($)}/vpcs/${n6(Z)}`).then(Ag)}}var kB1=L(()=>{qW()});class CB1{client;basePath;constructor($,Z){this.client=$,this.basePath=Z}async readFile($,Z={}){let Q=await this.openRead($,Z);return new Uint8Array(await Q.arrayBuffer())}async readTextFile($,Z={}){return await(await this.openRead($,Z)).text()}async readFileStream($,Z={}){let Q=await this.openRead($,Z);if(!Q.body)throw Error(`no response body reading ${$}`);return Q.body}async writeFile($,Z,Q={}){let X=typeof Z==="string"?new TextEncoder().encode(Z):Z,Y=X instanceof Uint8Array?X.byteLength:X.size;if(Y>Gz6)return this.uploadInChunks($,X,Y,Q);let J=X instanceof Uint8Array?X:new Uint8Array(await X.arrayBuffer());await this.client.putBytes(`${this.basePath}/fs/write`,J,{path:$,mode:Q.mode,sha256:await _r$(J)},Q.signal),Q.onProgress?.({completedBytes:Y,totalBytes:Y})}writeTextFile($,Z,Q={}){return this.writeFile($,Z,Q)}async readDir($){let{entries:Z}=await this.client.get(`${this.basePath}/fs/dir`,{path:$});return Z}async mkdir($){await this.client.post(`${this.basePath}/fs/mkdir`,{path:$})}async remove($){await this.client.delete(`${this.basePath}/fs/remove`,{path:$})}async exists($){let{exists:Z}=await this.client.get(`${this.basePath}/fs/exists`,{path:$});return Z}stat($){return this.client.get(`${this.basePath}/fs/stat`,{path:$})}openRead($,Z){let{offset:Q,length:X}=Z,Y;if(Q!==void 0||X!==void 0){let J=Q??0;Y=X===void 0?`bytes=${J}-`:`bytes=${J}-${J+X-1}`}return this.client.getBytes(`${this.basePath}/fs/read`,{path:$},{range:Y,signal:Z.signal})}async uploadInChunks($,Z,Q,X){let Y=X.chunkSize??Kz6,J=X.maxAttempts??Wz6,G=Z instanceof Uint8Array?await _r$(Z):void 0,K=await this.client.post(`${this.basePath}/fs/uploads`,{path:$,size:Q,sha256:G,mode:X.mode}),W=`${this.basePath}/fs/uploads/${K.uploadId}`;try{let H=K.receivedBytes;while(H<Q){let F=Math.min(H+Y,Q),U=Z instanceof Uint8Array?Z.subarray(H,F):Z.slice(H,F);H=(await this.putChunkWithRetry(W,U,H,J,X.signal)).receivedBytes,X.onProgress?.({completedBytes:Math.min(H,Q),totalBytes:Q})}await this.client.post(`${W}/commit`)}catch(H){throw await this.client.delete(W).catch(()=>{}),H}}async putChunkWithRetry($,Z,Q,X,Y){let J;for(let G=1;G<=X;G++){Y?.throwIfAborted?.();try{return await this.client.putBytes($,Z,{offset:Q},Y)}catch(K){if(J=K,!(!(K instanceof KJ)||K.status>=500||K.status===408||K.status===409||K.status===429)||Y?.aborted||G===X)throw K;await Hz6(Math.min(500*2**(G-1),8000));let H=await this.client.get($).catch(()=>{return});if(H&&H.receivedBytes>Q)return H}}throw J}}async function _r$($){let Z=globalThis.crypto?.subtle;if(!Z)return;let Q=await Z.digest("SHA-256",$);return Array.from(new Uint8Array(Q),(X)=>X.toString(16).padStart(2,"0")).join("")}function Hz6($){return new Promise((Z)=>setTimeout(Z,$))}var Gz6=8388608,Kz6=16777216,Wz6=5;var SB1=L(()=>{h60()});function Fz6(){return typeof process<"u"&&Boolean(process.versions?.node)}async function vr$($,Z){if(Fz6()){let X;try{X=await import("ws")}catch{throw Error("PTY sessions need the `ws` package in Node. Install it with `npm install ws`.")}return new X.default($,{headers:Z})}let Q=globalThis.WebSocket;if(!Q)throw Error("PTY sessions need a WebSocket client; no global WebSocket is available in this environment.");return new Q($)}function c60($,Z,Q){if($.on){$.on(Z,Q);return}$.addEventListener?.(Z,Q)}function Nz6($,Z){if($&&typeof $==="object"&&"data"in $){let Q=$.data;if(typeof Q==="string")return{text:Q};if(Q instanceof ArrayBuffer)return{binary:new Uint8Array(Q)};return{}}if($ instanceof Uint8Array)return Z?{binary:$}:{text:Uz6.decode($)};if(typeof $==="string")return{text:$};return{}}class _B1{_sessionId;_slug;_created=!1;socket;constructor($,Z,Q={}){this.socket=$,this._sessionId=Z,c60($,"message",(X,Y)=>{let{text:J,binary:G}=Nz6(X,Y);if(G){Q.onData?.(G);return}if(!J)return;let K;try{K=JSON.parse(J)}catch{return}if(K.type==="exited")Q.onExit?.(K.exitCode);else if(K.type==="error")Q.onError?.(Error(K.message));else if(K.type==="sessionInfo")this._sessionId=K.sessionId,this._slug=K.slug,this._created=K.created??!0,Q.onSessionInfo?.(K.sessionId)}),c60($,"close",(X)=>{let Y=X;Q.onClose?.({wasClean:Y?.wasClean??!0,code:Y?.code??1000,reason:Y?.reason??""})}),c60($,"error",(X)=>Q.onError?.(X))}write($){this.socket.send(typeof $==="string"?new TextEncoder().encode($):$)}resize($){this.sendControl({type:"resize",cols:$.cols,rows:$.rows})}signal($){this.sendControl({type:"signal",signal:$})}sendControl($){this.socket.send(JSON.stringify($))}detach(){this.socket.close()}get sessionId(){return this._sessionId}get slug(){return this._slug}get created(){return this._created}get readyState(){return this.socket.readyState}}function Bz6($){return new Promise((Z,Q)=>{if($.readyState===1){Z();return}c60($,"open",()=>Z()),c60($,"error",(X)=>Q(X))})}class vB1{client;basePath;constructor($,Z){this.client=$,this.basePath=Z}async open($={}){let{exec:Z,cols:Q,rows:X,linuxUser:Y,slug:J,replaceOnExit:G,onData:K,onExit:W,onClose:H,onError:F}=$,U={};if(Z!==void 0)U.exec=Z;if(Q!==void 0)U.cols=Q;if(X!==void 0)U.rows=X;if(Y!==void 0)U.linuxUser=Y;if(J!==void 0)U.slug=J;if(G!==void 0)U.replaceOnExit=String(G);let N=xr$(this.client,`${this.basePath}/pty`,U),B=this.client.authHeaders(),D=await vr$(N,B);return new Promise((O,j)=>{let w=!1,E=new _B1(D,-1,{onData:K,onExit:W,onClose:(z)=>{if(!w)w=!0,j(Error("connection closed before sessionInfo"));H?.(z)},onError:(z)=>{if(!w)w=!0,j(z);F?.(z)},onSessionInfo:()=>{w=!0,O(E)}})})}async attach($){let{session:Z,linuxUser:Q,onData:X,onExit:Y,onClose:J,onError:G}=$,K=xr$(this.client,`${this.basePath}/pty/sessions/${n6(String(Z))}`,{...Q!==void 0?{linuxUser:Q}:{}}),W=this.client.authHeaders(),H=await vr$(K,W),F=new _B1(H,typeof Z==="number"?Z:-1,{onData:X,onExit:Y,onClose:J,onError:G});return await Bz6(H),F}list($={}){return this.client.get(`${this.basePath}/pty/sessions`,$)}close($,Z={}){return this.client.delete(`${this.basePath}/pty/sessions/${n6(String($))}`,Z)}}class xB1{pty;linuxUser;constructor($,Z){this.pty=$,this.linuxUser=Z}open($={}){return this.pty.open({...$,linuxUser:this.linuxUser})}attach($){return this.pty.attach({...$,linuxUser:this.linuxUser})}list(){return this.pty.list({linuxUser:this.linuxUser})}close($){return this.pty.close($,{linuxUser:this.linuxUser})}}function xr$($,Z,Q){return $.url(Z,Q).replace(/^http/,"ws")}var Uz6;var fB1=L(()=>{qW();Uz6=new TextDecoder});class bB1{client;constructor($){this.client=$}list($={}){return this.client.get("/v5/snapshots",$)}get($){return this.client.get(`/v5/snapshots/${n6($)}`)}update($,Z){return this.client.patch(`/v5/snapshots/${n6($)}`,Z)}delete($){return this.client.delete(`/v5/snapshots/${n6($)}`)}}var yB1=L(()=>{qW()});var fr$=()=>{};function gB1($){return`/v5/vms/${n6($)}`}class hB1{id;fs;pty;client;basePath;constructor($,Z){this.client=$,this.id=Z,this.basePath=gB1(Z),this.fs=new CB1($,this.basePath),this.pty=new vB1($,this.basePath)}data(){return this.client.get(this.basePath)}firewallRules(){return this.client.get("/v5/firewall/rules",{vmId:this.id})}update($){return this.client.patch(this.basePath,$)}start(){return this.client.post(`${this.basePath}/start`)}pause(){return this.client.post(`${this.basePath}/pause`)}resize($){return this.client.post(`${this.basePath}/resize`,$)}delete(){return this.client.delete(this.basePath)}exec($){let Z=typeof $==="string"?{command:$}:$;return this.client.post(`${this.basePath}/exec-await`,Z)}linuxUser($){return new br$(this,$)}snapshot($={}){return this.client.post(`${this.basePath}/snapshot`,$)}}class br${vm;linuxUser;pty;constructor($,Z){this.vm=$,this.linuxUser=Z,this.pty=new xB1($.pty,Z)}exec($){let Z=typeof $==="string"?{command:$}:$;return this.vm.exec({...Z,linuxUser:this.linuxUser})}}class uB1{client;snapshots;constructor($){this.client=$,this.snapshots=new bB1($)}async create($){if(nC0($.firewall,"VM"),$.tls!==void 0)kr$($.tls);let Z=await this.client.post("/v5/vms",$);return{vm:new hB1(this.client,Z.id),vmId:Z.id,data:Z,firewallRules:Z.firewallRules??[],tlsRules:Z.tlsRules??[]}}list($={}){return this.client.get("/v5/vms",$)}get($){return this.client.get(gB1($))}ref($){return new hB1(this.client,$)}delete($){return this.client.delete(gB1($))}}var lB1=L(()=>{u60();tC0();qW();SB1();fB1();yB1();fr$();SB1();fB1();yB1()});function cB1($){return`/v5/vpcs/${n6($)}`}class yr${client;basePath;constructor($,Z){this.client=$,this.basePath=Z}list(){return this.client.get(`${this.basePath}/tunnels`)}}class mB1{id;tunnels;client;basePath;constructor($,Z){this.client=$,this.id=Z,this.basePath=cB1(Z),this.tunnels=new yr$($,this.basePath)}data(){return this.client.get(this.basePath)}update($){return this.client.patch(this.basePath,$)}delete(){return this.client.delete(this.basePath)}}class dB1{client;constructor($){this.client=$}list(){return this.client.get("/v5/vpcs")}async create($={}){if($.firewall!==void 0)nC0($.firewall,"network");let Z=await this.client.post("/v5/vpcs",$);return{vpc:new mB1(this.client,Z.id),vpcId:Z.id,data:Z,firewallRules:Z.firewallRules??[]}}get($){return this.client.get(cB1($))}ref($){return new mB1(this.client,$)}delete($){return this.client.delete(cB1($))}}var iB1=L(()=>{u60();qW()});class oC0{client;vms;vpc;tunnels;firewall;tls;domains;identities;constructor($={}){this.client=new UB1($),this.vms=new uB1(this.client),this.vpc=new dB1(this.client),this.tunnels=new VB1(this.client),this.firewall=new jB1(this.client),this.tls=new IB1(this.client),this.domains=new NB1(this.client),this.identities=new zB1(this.client)}fetch($,Z){return this.client.fetch($,Z)}}var gr$=L(()=>{qW();BB1();u60();PB1();tC0();kB1();lB1();iB1();qW();h60();lB1();iB1();kB1();BB1();u60();tC0();PB1()});var ur$;var hr$=L(()=>{ur$={name:"@decocms/sandbox",version:"1.81.0",private:!0,type:"module",description:"Sandbox runtime for isolated Studio tool execution",scripts:{check:"tsc --noEmit",test:"bun test",build:"bun run build:typegen && bun run build:harness-runner","build:typegen":"mkdir -p dist && bun run --cwd=../typegen build && bun --cwd=../typegen pm pack --filename $PWD/dist/typegen.tgz --quiet","build:harness-runner":"mkdir -p dist && bun --cwd=../harness-runner pm pack --filename $PWD/dist/harness-runner.tgz --quiet"},exports:{"./shared":"./shared.ts","./provider":"./server/provider/index.ts","./provider/agent-sandbox":"./server/provider/agent-sandbox/index.ts","./provider/postgres-state-store":"./server/provider/postgres-state-store.ts","./provider/freestyle":"./server/provider/freestyle.ts","./provider/remote":"./server/provider/remote.ts","./provider/router":"./server/provider/router.ts","./provider/sandbox-api":"./server/provider/sandbox-api.ts","./provider/sandbox-server":"./server/provider/sandbox-server.ts","./daemon-client":"./server/daemon-client.ts","./org-fs":"./org-fs.ts","./dispatch":"./dispatch/index.ts","./dispatch/*":"./dispatch/*.ts","./proxy/http":"./proxy/http.ts","./proxy/websocket":"./proxy/websocket.ts"},dependencies:{"@decocms/shared":"workspace:*","@kubernetes/client-node":"^1.4.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0",freestyle:"0.2.16",zod:"4.3.6"},devDependencies:{"@types/bun":"latest",postgres:"^3.4.5",typescript:"^7.0.2"}}});function rC0($){let Z=$?.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of studio-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"});return async(Q,X)=>{if(!Z)return X();let Y=performance.now(),J=(G)=>Z.record(performance.now()-Y,{runner_kind:Q,source:"daemon",status_code:G});try{let G=await X();return J(G.status),G}catch(G){throw J(0),G}}}var iD;var aC0=L(()=>{iD={kubernetes:"agent-sandbox",freestyle:"freestyle"}});var or$={};J0(or$,{FreestyleSandboxProvider:()=>tr$});import{createHash as Dz6,randomBytes as Oz6}from"crypto";class tr${freestyle;lookupClient;image;sidecarImage;idleTimeoutSeconds;autoDeleteSeconds;domainSuffix;timeDaemonRequest;inflight=new zg;snapshotInflight=new zg;lookups=new Map;releaseTimers=new Map;constructor($){this.freestyle=$.client??new oC0({apiKey:$.apiKey}),this.lookupClient=$.client??new oC0({apiKey:$.apiKey,fetch:Object.assign((Z,Q)=>fetch(Z,{...Q,signal:Q?.signal?AbortSignal.any([Q.signal,AbortSignal.timeout(ir$)]):AbortSignal.timeout(ir$)}),{preconnect:fetch.preconnect})}),this.image=$.image??`ghcr.io/decocms/studio/studio-sandbox-go:${ur$.version}`,this.sidecarImage=$.orgFsSidecarImage??wz6,this.idleTimeoutSeconds=$.idleTimeoutSeconds??300,this.autoDeleteSeconds=$.autoDeleteSeconds??86400,this.domainSuffix=$.domainSuffix??"style.dev",this.timeDaemonRequest=rC0($.meter)}async owns($){return await this.find($)!==null}daemonUrl($){return`https://${$}.${this.domainSuffix}`}async find($,Z={}){let Q=this.lookups.get($);if(!Z.refresh&&Q&&Date.now()-Q.at<(Q.found?Rz6:qz6))return Q.found;let X=null;try{let Y=await this.lookupClient.vms.get($),J=Y.metadata[mr$];if(J)X={vm:this.freestyle.vms.ref(Y.id),daemon:{url:this.daemonUrl($),token:J}}}catch(Y){if(!(Y instanceof KJ&&Y.status===404))throw Y}return this.remember($,X),X}remember($,Z){if(this.lookups.delete($),this.lookups.size>=Mz6){let Q=this.lookups.keys().next();if(!Q.done)this.lookups.delete(Q.value)}this.lookups.set($,{found:Z,at:Date.now()})}baseSnapshot(){let{image:$,sidecarImage:Z}=this,Q=`studio-sandbox-${Dz6("sha256").update(`${$}
 ${Z}`).digest("hex").slice(0,16)}`;return this.snapshotInflight.run(Q,async()=>{if(await this.snapshotExists(Q))return Q;console.log(`[${Rg}] building base snapshot ${Q} for ${$}`);let{vm:X}=await this.freestyle.vms.create({ttlSeconds:1800,firewall:{rules:[{action:"allow",source:{},destination:{public:!0}}]}});try{await this.run(X,`docker pull -q ${tp($)} && docker pull -q ${tp(Z)}`,{timeoutMs:pB1}),await X.snapshot({slug:Q})}catch(Y){if(!await this.snapshotExists(Q))throw Y}finally{await X.delete().catch(()=>{})}return Q})}async snapshotExists($){try{return await this.freestyle.vms.snapshots.get($),!0}catch(Z){if(Z instanceof KJ&&Z.status===404)return!1;throw Z}}async run($,Z,Q={}){let X=await $.exec({command:Z,...Q});if(X.statusCode!==0)throw Error(`${Z.split(" ",2).join(" ")} failed (${X.statusCode??"timeout"}): ${(X.stderr||X.stdout||"").slice(-500)}`);return X.stdout??""}async ensure($,Z={}){let Q=c3($);if(Q.startsWith("s-"))throw Error(`ensure: projectRef has no slug source: ${$.projectRef}`);return this.inflight.run(Q,async()=>{this.cancelRelease(Q);let X=await this.find(Q,{refresh:!0});if(X)await this.resume(X,Z);else await this.create(Q,Z);return{handle:Q,workdir:m60,previewUrl:this.daemonUrl(Q),warmPoolAdopted:!1,provider:"freestyle"}})}async resume($,Z){let{state:Q}=await $.vm.data();if(Q!=="running")await $.vm.start();if(await this.waitForDaemon($.daemon.url),Z.orgFsConfigJson)await _60($.daemon.url,$.daemon.token,Z.orgFsConfigJson).catch((Y)=>console.warn(`[${Rg}] org-fs relay failed`,Y));let X=x60(Z);if(X)await cN($.daemon.url,$.daemon.token,X).catch((Y)=>console.warn(`[${Rg}] git credential refresh failed: ${nr$(Y)}`))}async create($,Z){let Q=await this.baseSnapshot(),X=Oz6(24).toString("hex"),{vm:Y}=await this.createVm({snapshotId:Q,slug:$,idleTimeoutSeconds:this.idleTimeoutSeconds,metadata:{[mr$]:X,...Z.tenant?{[zz6]:Z.tenant.orgId,[Pz6]:Z.tenant.userId}:{}},firewall:{rules:[{action:"allow",source:{},destination:{public:!0}}]},tls:{rules:[{action:"allow",domain:`${$}.${this.domainSuffix}`,source:{public:!0},destination:{port:sC0}}]}}),J={url:this.daemonUrl($),token:X};try{let G={...Z.env,DAEMON_TOKEN:X,DAEMON_BOOT_ID:crypto.randomUUID(),APP_ROOT:m60,PROXY_PORT:String(sC0),ORGFS_SIDECAR_CONFIG_PATH:`${eC0}/config.json`,ORGFS_SIDECAR_STATUS_PATH:`${eC0}/status.json`},K=Object.keys(G).map((W)=>`-e ${tp(W)}`).join(" ");if(await this.run(Y,`sudo sh -c ${tp(Ez6)} && docker run -d --name ${cr$} --restart=always --privileged --device /dev/fuse -e APP_ROOT=${m60} -e ORGFS_FEED_IDLE_MS=60000 -v ${fz}:${m60}/org:rshared -v ${op}:${eC0} ${tp(this.sidecarImage)}`,{timeoutMs:pB1}),await this.run(Y,`docker run -d --name ${lr$} --restart=always -p ${sC0}:${sC0} -v ${fz}:${m60}/org:rslave -v ${op}:${eC0} ${K} ${tp(this.image)}`,{env:G,timeoutMs:pB1}),await this.waitForDaemon(J.url),await cN(J.url,X,this.configPayload(Z)??{}),Z.orgFsConfigJson)await _60(J.url,X,Z.orgFsConfigJson).catch((W)=>console.warn(`[${Rg}] org-fs relay failed`,W))}catch(G){throw await Y.delete().catch(()=>{}),this.lookups.delete($),G}this.remember($,{vm:Y,daemon:J})}async createVm($){try{return await this.freestyle.vms.create({...$,autoDeleteSeconds:this.autoDeleteSeconds})}catch(Z){if(!(Z instanceof KJ&&Z.status===400))throw Z;return console.warn(`[${Rg}] autoDeleteSeconds=${this.autoDeleteSeconds} refused (${Z.message}); creating with the plan's cap`),this.freestyle.vms.create($)}}configPayload($){return up({runtime:$.workload?.runtime??"node",packageManager:$.workload?.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:$.repo??null,extraRepos:$.extraRepos??[],port:$.workload?.devPort??jz6,tenant:$.tenant,cloneOnly:$.cloneOnly===!0})}async waitForDaemon($){let Z=Date.now()+dr$;while(Date.now()<Z){if(await pr$($))return;await $$(Tz6)}throw Error(`sandbox daemon at ${$} did not answer /health within ${dr$/1000}s`)}async delete($){this.cancelRelease($);let Z=await this.find($,{refresh:!0});if(this.lookups.delete($),!Z)return;await Z.vm.exec({command:`docker stop -t 30 ${lr$}; docker stop -t 10 ${cr$}`,timeoutMs:60000}).catch(()=>{}),await Z.vm.delete()}async lastTermination($){return null}async alive($){return await this.find($,{refresh:!0})!==null}async*watchClaimLifecycle($,Z){let Q=Date.now();yield{kind:"claiming",since:Q};let X=!1;while(!Z?.aborted){let Y=await this.find($,{refresh:!0}).catch(()=>null);if(Y){if(!X)X=!0,yield{kind:"warming-daemon",since:Date.now()};if(await pr$(Y.daemon.url)){yield{kind:"ready"};return}}if(Date.now()-Q>Iz6){yield{kind:"failed",reason:Y?"crash-loop-backoff":"claim-never-created",message:Y?"the sandbox VM exists but its daemon never answered":"no sandbox VM was created"};return}await $$(1000)}}async hasSchedulableCapacity(){return!0}async getPreviewUrl($){return await this.find($)?this.daemonUrl($):null}async proxyDaemonRequest($,Z,Q){let X=await this.find($);if(!X)return Response.json({error:"sandbox not found"},{status:404});let Y=async()=>(await this.find($,{refresh:!0}))?.daemon??null;return this.timeDaemonRequest(iD.freestyle,()=>mp(X.daemon,Z,Q,{unauthorized:async()=>{let J=await Y();return J&&J.token!==X.daemon.token?J:null},unreachable:Y}))}async daemonEndpoint($){return(await this.find($))?.daemon??null}async adoptLiveClaim($,Z){return await this.find(Z,{refresh:!0})!==null}async resolvePreviewUpstreamUrl($){return(await this.find($))?.daemon.url??null}proxyPreviewRequest($,Z){return ip(Z,{base:()=>this.resolvePreviewUpstreamUrl($).catch(()=>null),invalidate:()=>this.lookups.delete($),retryBase:()=>this.find($,{refresh:!0}).then((Q)=>Q?.daemon.url??null).catch(()=>null)},Rg)}async markTenantPoolsDirty($,Z){return[]}async releaseAfter($,Z){this.cancelRelease($);let Q=setTimeout(()=>{this.releaseTimers.delete($),this.find($).then((X)=>X?.vm.pause()).catch((X)=>console.warn(`[${Rg}] pause ${$} failed: ${nr$(X)}`))},Z);Q.unref?.(),this.releaseTimers.set($,Q)}async renewTtl($){this.cancelRelease($)}cancelRelease($){let Z=this.releaseTimers.get($);if(Z)clearTimeout(Z);this.releaseTimers.delete($)}close(){for(let $ of this.releaseTimers.values())clearTimeout($);this.releaseTimers.clear(),this.lookups.clear()}}async function pr$($){try{let Z=await fetch(`${$}/health`,{signal:AbortSignal.timeout(Az6)});return await Z.body?.cancel(),Z.ok}catch{return!1}}function tp($){return`'${$.replaceAll("'","'\\''")}'`}function nr$($){return $ instanceof Error?$.message:String($)}var Rg="FreestyleSandboxProvider",sC0=9000,m60="/app",jz6=3000,lr$="sandbox",cr$="orgfs",wz6="ghcr.io/decocms/studio/orgfs-sidecar:0.2.0",fz="/srv/sandbox/org",op="/srv/sandbox/orgfs-ctl",eC0="/run/orgfs",Ez6,mr$="studio-daemon-token",zz6="studio-org-id",Pz6="studio-user-id",dr$=120000,Tz6=500,Az6=5000,pB1=300000,Rz6=300000,qz6=1e4,Mz6=5000,Iz6=300000,ir$=3000;var rr$=L(()=>{gr$();$8();hr$();Eg();lp();yC0();gC0();aC0();Ez6=[`mkdir -p ${fz} ${op}`,`grep -q ' ${fz} ' /etc/fstab || printf '%s\\n' '${fz} ${fz} none bind,rshared 0 0' 'tmpfs ${op} tmpfs uid=1000,gid=1000,mode=0755,size=1m 0 0' >> /etc/fstab`,`mountpoint -q ${fz} || mount ${fz}`,`mountpoint -q ${op} || mount ${op}`].join(" && ")});function d60($,Z){if($ instanceof Error)Object.assign($,{["sandboxProvider"]:Z});return $}function nB1($){for(let Z=$,Q=0;Z instanceof Error&&Q<5;Q++){let X=Z.sandboxProvider;if(X==="kubernetes"||X==="freestyle")return X;Z=Z.cause}return}var tB1={};J0(tB1,{handleShare:()=>ar$,SandboxProviderRouter:()=>sr$});import{createHash as Vz6}from"crypto";function ar$($){let Z=Vz6("sha256").update($).digest("hex").slice(0,8);return Number.parseInt(Z,16)/4294967296}function Sz6($){return $ instanceof PF}class sr${providers;picked=new Map;strays=new Map;freestyleShare;constructor($,Z={}){this.providers=$;if(!$.kubernetes&&!$.freestyle)throw Error("SandboxProviderRouter needs at least one provider");this.freestyleShare=Math.min(1,Math.max(0,Z.freestyleShare??0))}get($){let Z=this.providers[$];if(!Z)throw Error(`sandbox provider ${$} is not configured`);return Z}remember($,Z){if(this.picked.delete($),this.picked.size>=kz6){let Q=this.picked.keys().next();if(!Q.done)this.picked.delete(Q.value)}this.picked.set($,Z)}async providerOf($){let{kubernetes:Z,freestyle:Q}=this.providers;if(!Q)return"kubernetes";if(!Z)return"freestyle";let X=this.picked.get($);if(X)return X;return await Q.owns($).catch(()=>!1)?"freestyle":"kubernetes"}async owner($){return this.get(await this.providerOf($))}async place($,Z){let{kubernetes:Q,freestyle:X}=this.providers,Y=Z.sandboxImage??"default";if(Y!=="default"){if(!Q)throw Error(`sandbox image ${Y} needs the kubernetes provider`);return{kind:"kubernetes",reason:X?"image":void 0}}if(!Q)return{kind:"freestyle"};if(!X)return{kind:"kubernetes"};let J=this.strays.get($);if(J)this.retire(J,$);if(J!=="kubernetes"&&await Q.alive($).catch(()=>!1))return{kind:"kubernetes",reason:"existing"};let G=J==="freestyle"?!1:await X.owns($).catch(()=>null);if(G)return{kind:"freestyle",reason:"existing"};if(G===null)return{kind:"kubernetes",reason:"freestyle-unavailable"};if(Z.provider)return{kind:Z.provider,reason:"requested"};if(this.hasWarmPool(Z,Y))return{kind:"kubernetes",reason:"warm-pool"};if(ar$($)<this.freestyleShare)return{kind:"freestyle",reason:"split"};return await Q.hasSchedulableCapacity().catch(()=>!1)?{kind:"kubernetes",reason:"split"}:{kind:"freestyle",reason:"capacity"}}hasWarmPool($,Z){let Q=bC0($);if(!Q)return!1;return(this.providers.kubernetes?.listTenantPools?.()??[]).some((Y)=>Y.tenant===Q&&Y.image===Z)}async ensure($,Z={}){let{provider:Q,...X}=Z,Y=c3($),J=await this.place(Y,Z);if(this.remember(Y,J.kind),this.strays.get(Y)===J.kind)this.strays.delete(Y);let G;try{let H=await this.get(J.kind).ensure($,X);return J.reason?{...H,placement:{reason:J.reason}}:H}catch(H){G=d60(H,J.kind)}let K=Cz6(J.kind);if(!J.reason||J.reason==="image"||Sz6(G))throw G;console.warn(`[SandboxProviderRouter] ensure ${Y} failed on ${J.kind}, trying ${K}:`,G instanceof Error?G.message:String(G)),this.remember(Y,K);let W;try{W=await this.get(K).ensure($,X)}catch(H){throw this.picked.delete(Y),d60(H,K)}if(J.reason==="existing")this.retire(J.kind,Y);return{...W,placement:{reason:"fallback",fallbackFrom:J.kind}}}retire($,Z){this.strays.set(Z,$),O8(async()=>{if(this.strays.get(Z)===$)await this.get($).delete(Z)},{maxAttempts:3}).then(()=>{if(this.strays.get(Z)===$)this.strays.delete(Z)}).catch((Q)=>console.warn(`[SandboxProviderRouter] delete of ${$} sandbox ${Z} after fallback failed:`,Q instanceof Error?Q.message:String(Q)))}async delete($){let Z=this.strays.get($);this.strays.delete($),await Promise.all([(await this.owner($)).delete($),Z&&this.get(Z).delete($).catch(()=>{})]),this.picked.delete($)}async lastTermination($){return(await this.owner($)).lastTermination($)}async alive($){return(await this.owner($)).alive($)}async*watchClaimLifecycle($,Z){yield*(await this.owner($)).watchClaimLifecycle($,Z)}async hasSchedulableCapacity(){let{kubernetes:$,freestyle:Z}=this.providers;if(!$||Z)return!0;return $.hasSchedulableCapacity()}async getPreviewUrl($){return(await this.owner($)).getPreviewUrl($)}async proxyDaemonRequest($,Z,Q){return(await this.owner($)).proxyDaemonRequest($,Z,Q)}async adoptLiveClaim($,Z){return(await this.owner(Z)).adoptLiveClaim($,Z)}async resolvePreviewUpstreamUrl($){return(await this.owner($)).resolvePreviewUpstreamUrl($)}async proxyPreviewRequest($,Z){return(await this.owner($)).proxyPreviewRequest($,Z)}async markTenantPoolsDirty($,Z){return await this.providers.kubernetes?.markTenantPoolsDirty($,Z)??[]}async releaseAfter($,Z){await(await this.owner($)).releaseAfter($,Z)}async renewTtl($){await(await this.owner($)).renewTtl($)}async daemonEndpoint($){let Z=this.providers[await this.providerOf($)];if(!Z?.daemonEndpoint)throw Error("sandbox provider has no daemon endpoint to serve");return Z.daemonEndpoint($)}listSandboxes(){return this.providers.kubernetes?.listSandboxes?.()??[]}listTenantPools(){return this.providers.kubernetes?.listTenantPools?.()??[]}close(){this.providers.kubernetes?.close(),this.providers.freestyle?.close(),this.picked.clear(),this.strays.clear()}}var kz6=5000,Cz6=($)=>$==="kubernetes"?"freestyle":"kubernetes";var oB1=L(()=>{$8();Eg();y60();lp()});var rB1={};J0(rB1,{toClaimPhase:()=>Ja$,SandboxHostError:()=>qg,RemoteSandboxProvider:()=>Ya$});function ap($){return $ instanceof Error?$.message:String($)}function gz6($){if(!Array.isArray($))return"";let Z=$[0];return typeof Z==="object"&&Z!==null&&"text"in Z&&typeof Z.text==="string"?Z.text:""}function hz6($){return $ instanceof nL&&$.code===503}function uz6($,Z){let Q=null;try{Q=JSON.parse(Z)}catch{}let X=Wc$.safeParse(Q);if(!X.success)return new qg(`${$} failed: ${Z.slice(0,300)}`);let Y=X.data.code==="bootstrap-rejected"?new PF(X.data.status??502,X.data.error):new qg(`${$}: ${X.data.error}`);return X.data.provider?d60(Y,X.data.provider):Y}function QS0($){return{kind:"failed",reason:"unknown",message:$}}function $a$($){return $.kind==="ready"||$.kind==="failed"}function Za$($){return q7(Xa$,Qa$,$,2,0.5)}function $S0(...$){let Z=$.filter((Q)=>Q!==void 0);return Z.length>1?AbortSignal.any(Z):Z[0]}class Ya${baseUrl;token;credentialLifetimeMs;stallMs;timeDaemonRequest;closed=new AbortController;connecting=null;sandboxes=new Map;capacity=null;capacityInFlight=null;constructor($){this.baseUrl=$.baseUrl.replace(/\/$/,""),this.token=$.token,this.credentialLifetimeMs=$.credentialLifetimeMs,this.stallMs=$.stallMs??4*Zc$,this.timeDaemonRequest=rC0($.meter)}headers(){return{authorization:`Bearer ${this.token}`}}client(){return this.connecting??=(async()=>{let $=new H7({name:"studio",version:"1.0.0"}),Z=new cU(new URL(`${this.baseUrl}/mcp`),{requestInit:{headers:this.headers()},fetch:(Q,X)=>fetch(Q,{...X,timeout:!1})});return await $.connect(Z,{timeout:er$}),$})().catch(($)=>{throw this.connecting=null,$}),this.connecting}async call($,Z,Q,X={}){let{timeoutMs:Y=er$,signal:J}=X,G;try{G=await O8(async()=>(await this.client()).callTool({name:$,arguments:{...Z}},void 0,{timeout:Y??_z6,signal:J}),{maxAttempts:vz6,minTimeout:Qa$,maxTimeout:Xa$,jitter:xz6,isRetriable:hz6,signal:J})}catch(W){if(J?.aborted)throw J.reason;throw W instanceof C5?W.cause:W}if(G.isError)throw uz6($,gz6(G.content));let K=Q.safeParse(G.structuredContent);if(!K.success)throw new qg(`${$} returned a malformed result: ${K.error.message}`);return K.data}async whileHostAlive($,Z,Q){let X=new AbortController,Y=new AbortController;this.hostStall($,$S0(X.signal,Q,this.closed.signal)??X.signal).then((J)=>{if(J)Y.abort(J)});try{return await Z($S0(Y.signal,Q,this.closed.signal)??Y.signal)}finally{X.abort()}}cached($){let Z=this.sandboxes.get($);if(!Z)return null;if(Date.now()-Z.at>bz6)return this.sandboxes.delete($),null;return Z}remember($,Z,Q,X){if(this.sandboxes.delete($),!Z)return;if(this.sandboxes.size>=yz6){let Y=this.sandboxes.keys().next();if(!Y.done)this.sandboxes.delete(Y.value)}this.sandboxes.set($,{daemon:Z,previewUrl:Q,provider:X,at:Date.now()})}async status($,Z={}){let Q=(Y,J)=>this.call(yD.status,{handle:$,resurrect:Z.resurrect??!1},Jc$,{signal:Y,timeoutMs:J}),X=Z.resurrect?await this.whileHostAlive($,(Y)=>Q(Y,null),Z.signal):await Q(Z.signal);return this.remember($,X.daemon,X.previewUrl,X.provider),X}async daemonFor($,Z={}){if(!Z.refresh){let Q=this.cached($);if(Q)return Q.daemon}return(await this.status($,{resurrect:!0,signal:Z.signal})).daemon}async ensure($,Z={}){let{image:Q,...X}=Z,Y=c3($),J=this.credentialLifetimeMs,G=Date.now(),K=await this.whileHostAlive(Y,(W)=>this.call(yD.ensure,{id:$,opts:X,...J&&{credentialsValidUntil:{orgFsConfig:G+J.orgFsConfig}}},Yc$,{timeoutMs:null,signal:W}));if(K.handle!==Y)throw new qg(`host answered ensure with ${K.handle}, expected ${Y}`);return this.remember(K.handle,K.daemon,K.previewUrl,K.provider),{handle:K.handle,workdir:K.workdir,previewUrl:K.previewUrl,warmPoolAdopted:K.warmPoolAdopted,provider:K.provider,...K.placement&&{placement:K.placement}}}async delete($){this.sandboxes.delete($),await this.call(yD.delete,{handle:$},cF1)}async alive($){return(await this.status($)).alive}async getPreviewUrl($){let Z=this.cached($);if(Z)return Z.previewUrl;return(await this.status($)).previewUrl}async lastTermination($){return(await this.status($)).lastTermination}async lifetime($,Z){try{await this.call(yD.lifetime,$,cF1)}catch(Q){console.warn(`[${rp}] ${Z} failed: ${ap(Q)}`)}}renewTtl($){return this.lifetime({handle:$},`TTL renew for ${$}`)}releaseAfter($,Z){return this.lifetime({handle:$,graceMs:Math.max(0,Math.round(Z))},`release of ${$}`)}hasSchedulableCapacity(){let $=this.capacity;if($&&Date.now()-$.at<fz6)return Promise.resolve($.value);return this.capacityInFlight??=this.readCapacity().finally(()=>{this.capacityInFlight=null}),this.capacityInFlight}async readCapacity(){let $=!0;try{$=(await this.call(yD.capacity,{},Gc$)).schedulable}catch(Z){console.warn(`[${rp}] capacity probe failed: ${ap(Z)}`)}return this.capacity={value:$,at:Date.now()},$}async adoptLiveClaim($,Z){let Q=await this.status(Z).catch(()=>null);return Boolean(Q?.daemon)}async markTenantPoolsDirty($,Z){try{return(await this.call(yD.tenantPoolsPush,{repoUrl:$,ref:Z},Kc$)).pools}catch(Q){return console.warn(`[${rp}] tenant pool push for ${$}@${Z} failed: ${ap(Q)}`),[]}}list(){return this.call(yD.list,{},Nc$)}pushCredentials($){return this.call(yD.credentialsPush,$,Uc$)}close(){this.closed.abort(),this.sandboxes.clear();let $=this.connecting;this.connecting=null,$?.then((Z)=>Z.close()).catch(()=>{})}async proxyDaemonRequest($,Z,Q){let X=Q.signal,Y=await this.daemonFor($,{signal:X});if(!Y)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let J=this.sandboxes.get($)?.provider??"kubernetes";return this.timeDaemonRequest(iD[J],()=>mp(Y,Z,Q,{unauthorized:async()=>{let G=await this.daemonFor($,{refresh:!0,signal:X}).catch(()=>null);return G&&(G.token!==Y.token||G.url!==Y.url)?G:null},unreachable:()=>this.daemonFor($,{refresh:!0,signal:X})}))}async resolvePreviewUpstreamUrl($,Z){return(await this.daemonFor($,{signal:Z}))?.url??null}proxyPreviewRequest($,Z){let Q=Z.signal;return ip(Z,{base:()=>this.resolvePreviewUpstreamUrl($,Q).catch((X)=>{return console.warn(`[${rp}] preview upstream for ${$} failed: ${ap(X)}`),null}),invalidate:()=>this.sandboxes.delete($),retryBase:()=>this.daemonFor($,{refresh:!0,signal:Q}).then((X)=>X?.url??null).catch(()=>null)},rp)}async*watchOnce($,Z){let Q=new URL(`${this.baseUrl}${$c$}`);Q.searchParams.set("handle",$);let X=new AbortController,Y,J=this.stallMs/2,G=()=>{clearTimeout(Y),Y=setTimeout(()=>X.abort(Error(`host sent nothing for ${J/1000}s`)),J)};G();try{let K=await fetch(Q,{headers:{...this.headers(),accept:"text/event-stream"},signal:$S0(X.signal,Z),timeout:!1});if(!K.ok||!K.body){await K.body?.cancel().catch(()=>{});let F=`watch answered ${K.status}`;throw K.status>=400&&K.status<500?new ZS0(F):Error(F)}G();let W=new TextDecoder,H="";for await(let F of K.body){G(),H+=W.decode(F,{stream:!0});let U=H.indexOf(`
 
 `);while(U!==-1){let N=H.slice(0,U);H=H.slice(U+2),U=H.indexOf(`
@@ -3732,13 +3732,13 @@ ${Y}`:Y}case"media":return"";case"mediaSingle":case"mediaGroup":return Rn(eN(Q),
                   then max(up.metadata->'models'->'thinking'->>'provider')
                 end`.as("provider")]).whereRef("up.thread_id","=","link.thread_id").where("up.kind","=","finish").as("cost"),(G)=>G.onTrue()).select((G)=>["cost.usd as costUsd","cost.provider as costProvider","link.task_board_item_id as taskId","link.thread_id as threadId","link.created_at as createdAt","t.status as status","t.failure_kind as failureKind","t.title as title","t.virtual_mcp_id as virtualMcpId","t.metadata as metadata","t.updated_at as updatedAt","t.last_progress_at as lastProgressAt","lastmsg.payload as lastMessagePayload",G.or([G.exists(G.selectFrom("thread_message_parts as mp").select("mp.id").whereRef("mp.thread_id","=","link.thread_id")),G.exists(G.selectFrom("thread_messages as tm").select("tm.id").whereRef("tm.thread_id","=","link.thread_id"))]).as("hasMessages")]).where("link.organization_id","=",Q).where("link.task_board_item_id","in",X).orderBy("link.created_at","desc").execute(),J=new Map;for(let G of Y){let K={threadId:G.threadId,virtualMcpId:G.virtualMcpId??null,status:G.status??null,failureKind:G.failureKind??null,title:G.title??null,lastMessage:a58(G.lastMessagePayload),hasPreview:yS6(G.metadata),hasMessages:!!G.hasMessages,lastActiveAt:hS6(G.updatedAt,G.lastProgressAt),costUsd:gS6(G.costUsd),costProvider:G.costProvider??null,createdAt:G.createdAt instanceof Date?G.createdAt.toISOString():G.createdAt},W=J.get(G.taskId);if(W)W.push(K);else J.set(G.taskId,[K])}for(let G of Z)G.threads=J.get(G.id)??[]}async attachTags($,Z){let Q=Z.map((J)=>J.id),X=await $.selectFrom("task_board_item_tags as link").innerJoin("organization_tags as tag","tag.id","link.id").select(["link.task_board_item_id as taskId","link.created_by as createdBy","link.created_at as createdAt","tag.id as id","tag.name as name","tag.color as color"]).where("link.task_board_item_id","in",Q).orderBy("tag.name","asc").execute(),Y=new Map;for(let J of X){let G={id:J.id,name:J.name,color:J.color??null,createdBy:J.createdBy,createdAt:J.createdAt instanceof Date?J.createdAt.toISOString():J.createdAt},K=Y.get(J.taskId);if(K)K.push(G);else Y.set(J.taskId,[G])}for(let J of Z)J.tags=Y.get(J.id)??[]}async attachActivityFields($,Z){let Q=Z.map((J)=>J.id),X=await $.selectFrom("task_board_activity").select(["task_board_item_id as taskId","action","data","occurred_at"]).where("task_board_item_id","in",Q).where("action","in",["status_changed","review_approved","review_changes_requested"]).orderBy("occurred_at","asc").execute(),Y=new Map;for(let J of X){let G={action:J.action,data:J.data??null,occurredAt:J.occurred_at instanceof Date?J.occurred_at.toISOString():J.occurred_at},K=Y.get(J.taskId);if(K)K.push(G);else Y.set(J.taskId,[G])}for(let J of Z){let G=Y.get(J.id)??[];J.statusSince=oh$(G,J.status,J.createdAt);let K=J.reviewCycleStartedAt,W=Jz(G,{cycleStartedAt:K}),H=Jz(G,{cycleStartedAt:K,verifiedOnly:!0});J.reviewVerdicts=jW.flatMap((F)=>{let U=W.get(F);if(!U)return[];return[{reviewer:F,verdict:U,verified:H.get(F)==="approved"}]})}}async recordActivity($){await this.db.insertInto("task_board_activity").values({id:r8("act"),task_board_item_id:$.taskBoardItemId,action:$.action,actor_id:$.actorId,data:$.data?JSON.stringify($.data):null,occurred_at:new Date().toISOString()}).execute(),await this.fanOut([$])}async fanOut($){for(let Z of $){let Q=xS6(Z.action);if(!Q)continue;await Sn({db:this.db,taskBoardItemId:Z.taskBoardItemId,type:Q,actorId:Z.actorId,alsoSubscribe:Z.alsoSubscribe})}}async resolveReviewClaimByToken($,Z){let Q=await this.db.selectFrom("task_board_review_claims").select(["reviewer","cycle_at"]).where("task_board_item_id","=",$).where("token","=",Z).executeTakeFirst();return Q?{reviewer:Q.reviewer,cycleAt:Q.cycle_at}:null}async recordActivities($){if($.length===0)return;let Z=new Date().toISOString(),Q=[];for(let X of $)if(!(fS6.has(X.action)&&await this.touchRecentActivity(X,Z)))Q.push(X);if(Q.length===0)return;await this.db.insertInto("task_board_activity").values(Q.map((X)=>({id:r8("act"),task_board_item_id:X.taskBoardItemId,action:X.action,actor_id:X.actorId,data:X.data?JSON.stringify(X.data):null,occurred_at:Z}))).execute(),await this.fanOut(Q)}async touchRecentActivity($,Z){let Q=new Date(Date.parse(Z)-bS6).toISOString();return((await this.db.updateTable("task_board_activity").set({occurred_at:new Date(Z)}).where("id","=",this.db.selectFrom("task_board_activity").select("id").where("task_board_item_id","=",$.taskBoardItemId).where("action","=",$.action).where((Y)=>$.actorId===null?Y("actor_id","is",null):Y("actor_id","=",$.actorId)).where("occurred_at",">=",new Date(Q)).orderBy("occurred_at","desc").limit(1)).executeTakeFirst()).numUpdatedRows??0n)>0n}async listActivity($,Z){return(await this.db.selectFrom("task_board_activity as a").innerJoin("task_board_items as item","item.id","a.task_board_item_id").selectAll("a").where("item.organization_id","=",Z).where("a.task_board_item_id","=",$).orderBy("a.occurred_at","asc").execute()).map((X)=>({id:X.id,taskBoardItemId:X.task_board_item_id,action:X.action,actorId:X.actor_id,data:typeof X.data==="string"?JSON.parse(X.data):X.data??{},occurredAt:X.occurred_at instanceof Date?X.occurred_at.toISOString():X.occurred_at}))}async hasHumanRejectedDone($,Z){let Q=HJ`a.data->>'from'`,X=HJ`a.data->>'reason'`,Y="a.actor_id";return await this.db.selectFrom("task_board_activity as a").innerJoin("task_board_items as item","item.id","a.task_board_item_id").select("a.id").where("item.organization_id","=",Z).where("a.task_board_item_id","=",$).where("a.action","=","status_changed").where("a.actor_id","is not",null).where(Q,"in",["done","merged"]).where(X,"is",null).limit(1).executeTakeFirst()!==void 0}async listComments($,Z){return(await this.db.selectFrom("task_board_comments as c").innerJoin("task_board_items as item","item.id","c.task_board_item_id").selectAll("c").where("item.organization_id","=",Z).where("c.task_board_item_id","=",$).orderBy("c.created_at","asc").execute()).map((X)=>h_0(X))}async createComment($){if(!await this.db.selectFrom("task_board_items").select("id").where("id","=",$.taskBoardItemId).where("organization_id","=",$.organizationId).executeTakeFirst())return null;let Q=null;if($.parentId){let Y=await this.db.selectFrom("task_board_comments").select(["id","parent_id"]).where("id","=",$.parentId).where("task_board_item_id","=",$.taskBoardItemId).executeTakeFirst();if(!Y)return null;Q=Y.parent_id??Y.id}let X=await this.db.insertInto("task_board_comments").values({id:r8("cmt"),task_board_item_id:$.taskBoardItemId,parent_id:Q,author_id:$.authorId,thread_id:$.threadId??null,body:$.body}).returningAll().executeTakeFirstOrThrow();return h_0(X)}async updateComment($){let Z=await this.commentInOrg($.id,$.organizationId);if(!Z)return null;if($.body!==void 0&&Z.authorId!==$.callerId)return null;if($.resolved!==void 0&&Z.parentId!==null)return null;let Q=await this.db.updateTable("task_board_comments").set({...$.body===void 0?{}:{body:$.body},...$.resolved===void 0?{}:{resolved:$.resolved},updated_at:new Date().toISOString()}).where("id","=",$.id).returningAll().executeTakeFirst();return Q?h_0(Q):null}async deleteComment($,Z,Q){let X=await this.commentInOrg($,Z);if(!X)return!1;if(X.authorId!==Q&&X.authorId!==V8)return!1;return await this.db.deleteFrom("task_board_comments").where("id","=",$).execute(),!0}async getComment($,Z){let Q=await this.db.selectFrom("task_board_comments as c").innerJoin("task_board_items as item","item.id","c.task_board_item_id").selectAll("c").where("c.id","=",$).where("item.organization_id","=",Z).executeTakeFirst();return Q?h_0(Q):null}async commentInOrg($,Z){let Q=await this.db.selectFrom("task_board_comments as c").innerJoin("task_board_items as item","item.id","c.task_board_item_id").select(["c.id","c.author_id","c.parent_id"]).where("c.id","=",$).where("item.organization_id","=",Z).executeTakeFirst();return Q?{authorId:Q.author_id,parentId:Q.parent_id}:null}itemFromDbRow($){return{id:$.id,organizationId:$.organization_id,title:$.title,description:$.description,status:$.status,priority:$.priority,type:$.type??iH1,assigneeId:$.assignee_id,assignedBy:$.assigned_by,repo:$.repo,repositoryId:$.repository_id??null,dueDate:$.due_date instanceof Date?$.due_date.toISOString():$.due_date,externalUrl:$.external_url??null,previewRoutes:$.preview_routes??[],source:$.source??null,sortOrder:$.sort_order,keySeq:$.key_seq,retryAttempts:$.retry_attempts??0,reviewCycleStartedAt:$.review_cycle_started_at instanceof Date?$.review_cycle_started_at.toISOString():$.review_cycle_started_at??null,threads:[],tags:[],reviewVerdicts:[],statusSince:null,createdBy:$.created_by,createdAt:$.created_at instanceof Date?$.created_at.toISOString():$.created_at,updatedBy:$.updated_by,updatedAt:$.updated_at instanceof Date?$.updated_at.toISOString():$.updated_at}}}var vS6,fS6,bS6=600000,s58,o50,uS6;var QO=L(()=>{Be();r4();wW();SX();u4();u4();z_0();x_0();g_0();ke();vS6=new Set(v_0);fS6=new Set(["description_changed","title_changed"]);s58=new Set(["in_progress","in_review"]),o50=new Set(["completed","failed","expired"]);uS6=[...kO0,"done"]});function $P($){if($==null)return null;if(typeof $==="string")return ZW1($);let Z;try{Z=JSON.stringify($)}catch{return null}return Z?ZW1(Z):null}function r50($){return{repo:vD0($.url)?.repo??tX($.url)??ii($.repoOwner,$.repoName),repositoryId:$.repositoryId,connectionId:$.connectionId}}var ng=L(()=>{r4()});function a50($){return $.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;")}function lS6($){let Z=kn($.orgSlug,$.keySeq),Q=Z??$.title,X=Z?`${$.baseUrl}/${encodeURIComponent($.orgSlug)}/t/${encodeURIComponent(Z)}`:null,Y=$.prs.map((J)=>`<p style="margin:0 0 8px 0;"><a href="${a50(J.url)}" style="color:#141413;">Review ${a50(J.repo)} #${J.number}</a></p>`).join("");return{subject:`${Q} is ready for your review`,html:U3({preheader:`${Q} has a pull request waiting for you.`,heading:"Ready for your review",subheading:X?`<a href="${X}" style="color:#141413;">${a50(Q)}</a> \u2014 ${a50($.title)}`:a50($.title),body:Y})}}function cS6(){let $=pH().auth,Z=$.emailProviders??[],Q=$.inviteEmailProviderId?F3(Z,$.inviteEmailProviderId):Z[0];return Q?H3(Q):null}async function e58($,Z){try{let Q=await $.storage.organizationSettings.get(Z.organizationId);if(!CZ(Q?.flags,"home_task_intake_enabled"))return;if(!Z.createdBy)return;let X=await $.storage.taskBoard.listPrs(Z.id,Z.organizationId);if(X.length===0)return;let Y=await $.db.selectFrom("user").innerJoin("member","member.userId","user.id").select("user.email as email").where("user.id","=",Z.createdBy).where("member.organizationId","=",Z.organizationId).executeTakeFirst();if(!Y?.email)return;let J=await $.db.selectFrom("organization").select("slug").where("id","=",Z.organizationId).executeTakeFirst();if(!J?.slug)return;let G=cS6();if(!G)return;let{subject:K,html:W}=lS6({title:Z.title,orgSlug:J.slug,keySeq:Z.keySeq,prs:X.map((H)=>({url:H.url,repo:`${H.repoOwner}/${H.repoName}`,number:H.number})),baseUrl:h9()});await G({to:Y.email,subject:K,html:W})}catch(Q){console.error(`[task-board] PR-ready email for ${Z.id} failed`,Q)}}var $98=L(()=>{b_0();GZ();kA();m10();R9()});function ZB($){return!!$&&P0().taskBoardAdminOrgIds.includes($)}async function sO1($,Z){let Q=P0().taskBoardAdminOrgIds;if(!Z||Q.length===0)return!1;return!!await $.selectFrom("member").select(["id"]).where("userId","=",Z).where("organizationId","in",Q).executeTakeFirst()}async function QB($){if(!$.db)return!1;return sO1($.db,$.auth?.user?.id)}function XO($){console.log("task_board_admin_action",$)}var _n=L(()=>{X$()});async function VF($,Z){let Q=await $.selectFrom("organization").select(["id","slug","name"]).where("id","=",Z).executeTakeFirst();if(!Q)return null;let X=await GX.create();return X.organization={id:Q.id,slug:Q.slug,name:Q.name},ZP(X,{id:Q.id,slug:Q.slug}),X}var vn=L(()=>{VN()});import{z as mS6}from"zod";async function pS6($,Z,Q){if(!ZB($.organization?.id)||!await QB($))throw Error("Not allowed to act on another organization (the `org` parameter needs an admin org)");let X=await $.storage.taskBoardAnalytics.resolveOrgRef(Z);if(!X)throw Error(`Organization not found: ${Z}`);let Y=await VF($.db,X.id);if(!Y)throw Error(`Organization not found: ${Z}`);return XO({action:"tool_org_override",actorUserId:$.auth?.user?.id,actorOrgId:$.organization?.id,targetOrgId:X.id,tool:Q}),Y.auth=$.auth,Y.boundAuth=$.boundAuth,Y.access=$.access,Y}function xn($){let Z=$;return{...$,description:`${$.description}${iS6}`,inputSchema:Z.inputSchema.extend(dS6),execute:async(Q,X)=>{let{org:Y,...J}=Q??{};if(!Y)return Z.execute(Q,X);return Z.execute(J,await pS6(X,Y,$.name))}}}var dS6,iS6;var u_0=L(()=>{_n();vn();dS6={org:mS6.string().optional().describe("Org slug or id to read instead of the current one. Requires membership of an admin org; omit for the current org.")},iS6=" Pass `org` to read ANOTHER organization's board instead of the current "+"one \u2014 call TASK_BOARD_ADMIN_ORG_LIST first for the organizations you may "+"name (an empty list means none, and `org` will be refused)."});import{z as l_0}from"zod";async function W5($,Z){try{await $.storage.taskBoard.recordActivity(Z)}catch(Q){console.error("[task-board] activity log write failed",Q)}}async function Z98($,Z){if(Z.length===0)return;try{await $.storage.taskBoard.recordActivities(Z)}catch(Q){console.error("[task-board] activity log write failed",Q)}}var nS6,eO1;var HY=L(()=>{_0();jG();u_0();nS6=m({name:"TASK_BOARD_ACTIVITY_LIST",description:"List a task board item's change history (timeline, oldest first).",annotations:{title:"List Task Activity",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:l_0.object({taskBoardItemId:l_0.string()}),outputSchema:l_0.object({activity:l_0.array(Aa$)}),handler:async($,Z)=>{o(Z),await Z.access.check();let Q=Z.organization?.id;if(!Q)throw Error("Organization ID required (no active organization in context)");return{activity:await Z.storage.taskBoard.listActivity($.taskBoardItemId,Q)}}}),eO1=xn(nS6)});function tg($){if($.length===0)return!1;let Z=new Map;for(let Q of $){let X=`${Q.repoOwner}/${Q.repoName}`.toLowerCase(),Y=Z.get(X);if(Y)Y.push(Q);else Z.set(X,[Q])}return[...Z.values()].every(tS6)}function tS6($){return $.some((Z)=>Z.merged===!0)&&$.every((Z)=>Z.merged===!0||Z.state==="closed")}async function oS6($,Z,Q,X){let Y=await $.storage.taskBoard.getById(Q,Z);if(!Y||Y.status!=="done")return!1;let J=await $.storage.taskBoard.listPrs(Q,Z),G=await Promise.all(J.map(async(H)=>({...H,...await X($,Z,H)})));if(!tg(G))return!1;let K=I$.archive,W=await $.storage.taskBoard.update(Q,Z,{status:K},Y.updatedBy);return await W5($,{taskBoardItemId:Q,action:"status_changed",actorId:null,data:{from:"done",to:K,reason:"merged_pr_auto_archive"}}),P8(Z,W),!0}async function Q98($,Z,Q,X=m_0){let Y=0;for(let J of Q)try{if(await oS6($,Z,J,X))Y+=1}catch(G){console.error(`[task-board-archive] ${J} failed`,G)}return{archived:Y}}function c_0($){let Z=new Map;for(let{id:Q,organizationId:X}of $){let Y=Z.get(X);if(Y)Y.push(Q);else Z.set(X,[Q])}return[...Z].map(([Q,X])=>({organizationId:Q,itemIds:X}))}var fn=L(()=>{u4();HY();i7();v9()});function og($){let Z=aS6[$];if(Z===void 0)throw Error(`Unknown board column "${$}"`);return Z}function $j1($){return X98.includes($)}function Y98($,Z){return og(Z)>og($)}function i_0($,Z){return og($)<=og(Z)}function G98($){return $==="done"||X98.includes($)}function FJ($){if(og($.status)>d_0.in_review)return!1;return $.status===I$.review||Boolean($.reviewCycleStartedAt)}var rS6,d_0,aS6,X98,J98;var kF=L(()=>{u4();rS6=Object.fromEntries(DF.map(($,Z)=>[$,Z])),d_0=rS6,aS6=d_0;X98=kO0;J98=new Set(["in_review","approved"])});function p_0($){return $===""?"Your Studio tools are registered under their bare names: a tool named `JIRA_COMMENT_ADD` is called exactly that.":"Your Studio tools are namespaced `mcp__studio__`: where an instruction names a tool `JIRA_COMMENT_ADD`, the tool you actually call is `mcp__studio__JIRA_COMMENT_ADD`. Don't search for the unprefixed name."}function n_0($){return $.replace(/\/api\/[^/\s)]+\/fs\/([^/\s)]+)\/read\?path=([^)\s]+)/g,(Z,Q,X)=>{let Y,J;try{Y=decodeURIComponent(Q),J=decodeURIComponent(X)}catch{return Z}let G=(K)=>K.startsWith("/")||K.split("/").includes("..");if(G(Y)||G(J))return Z;return TW(Y,J)})}function t_0($,Z){return Z===$?null:"The image and file links in that description are real paths in this sandbox, not URLs \u2014 `Read` them. A screenshot the task points at is usually the clearest statement of what it wants."}var Zj1=L(()=>{bD()});function sS6($,Z){let Q=Z?.repositoryId,X=Z?.repo;if(Q){let Y=$.filter((J)=>J.repository?.id===Q);if(Y.length>0)return Y}if(X)return $.filter((Y)=>`${Y.owner}/${Y.name}`.toLowerCase()===X.toLowerCase());return Q?[]:$}function eS6($,Z){if($=sS6($,Z),$.length!==1)return null;let Q=$[0];return{id:Q.id,owner:Q.owner,name:Q.name,url:Q.webUrl,provider:Q.provider,...Q.connectionId?{connectionId:Q.connectionId}:{},...Q.repository?{repositoryId:Q.repository.id}:{},...Q.installationId!==void 0?{installationId:Q.installationId}:{}}}async function r_0($,Z,Q){if(!xj())return console.warn(`[task-board] claude-code skipped for org ${Z}: `+"hosted sandbox unavailable \u2014 running Decopilot"),null;try{let X=await Az($,Z),Y=eS6(X,Q);if(Y)return{repo:Y};if(X.length===0)return console.warn(`[task-board] claude-code skipped for org ${Z}: `+"no importable repos \u2014 running Decopilot"),null;return console.warn(`[task-board] claude-code for org ${Z}: ${X.length} importable repos \u2014 the run picks one with TASK_ADD_REPO`),{choices:X.map((J)=>({id:J.id,repo:`${J.owner}/${J.name}`}))}}catch(X){return console.warn("[task-board] repo lookup for claude-code failed",X),null}}function o_0($){let Z=$?.others??[];if(Z.length===0)return[];return[`This issue spans ${Z.length+1} repositories, and it has an open pull request in each of the others too:`,...Z.map((Q)=>`- ${Q.repo}: pull request #${Q.number} (${Q.url}) on branch \`${Q.head}\`. After cloning that repository, run \`git fetch origin +refs/heads/${Q.head}:refs/remotes/origin/${Q.head} && git checkout -B ${Q.head} origin/${Q.head}\` BEFORE editing (the clone is single-branch, so a bare \`git fetch origin ${Q.head}\` creates no branch to check out), and push to update that SAME pull request \u2014 do NOT open a new one there.`),"A change that only lands on one side is worse than none: if you cannot update them all, update none and say why."]}function K98($,Z,Q){let X=cb$(Z?.provider??"github"),Y=Q?.source?.kind==="jira",J=[Q?.instruction?.trim()||(Y?"":`You've been assigned this task. Complete it and finish with a ${X.changeRequest} if it makes sense (like a coding task) or is explicitly requested.`),"","You are running AUTONOMOUSLY \u2014 no human is watching, so drive this to "+"completion yourself. Make reasonable decisions and move on; do not stop to ask for confirmation.","",`Title: ${$.title}`];if($.description){let G=n_0($.description);J.push("","Description:",G);let K=t_0($.description,G);if(K)J.push("",K)}if(J.push("",Z?`The repository ${Z.owner}/${Z.name} is already cloned at your working directory, on its own branch. It is hosted on ${X.name}, so ${X.cli?`\`git\` and \`${X.cli}\` are`:"`git` is"} authenticated there${X.cli?"":" (Bitbucket has no CLI; `$BITBUCKET_TOKEN` is the bearer for its REST API)"}. ${M40}`:["Your working directory is EMPTY: this organization has several repositories, so nothing has been cloned yet. FIRST call `mcp__studio__TASK_ADD_REPO` with the id of the repository this task is about. It clones that repository into your working directory and waits for the checkout, so once it returns the repository is there on its own branch, with `git` and that repository's own CLI authenticated. Do not read files or run `git` before it returns; there is nothing there yet.","","Repositories in this organization:",...(Q?.repoChoices??[]).map((G)=>`- ${G.repo} (id: ${G.id})`),Q?.repoChoices?.length?"Start with the one the task is about. If it turns out to need a change in "+"another of them too, call `mcp__studio__TASK_ADD_REPO` again \u2014 repositories "+"accumulate, so a second call adds a checkout beside the first rather than replacing it. Each lands in its own directory and keeps its own git remote, so open one change request per repository you changed.":"Call `mcp__studio__TASK_ADD_REPO` with no arguments to list them."].join(`
 `),"",$_6,""),Q?.resolveConflict&&Q.pr)J.push(`Pull request #${Q.pr.number} (${Q.pr.url}) is approved but has a MERGE CONFLICT with its base branch.`,`Check that branch out (\`${YW1(Z?.provider??"github",Q.pr.number)}\`), merge or rebase the base branch into it, resolve the conflicts, and push to update the SAME ${X.changeRequest} \u2014 do NOT open a new one. Resolve by preserving BOTH sides' intent; never blindly discard either side, and change only what the conflict requires.`,"");else if(Q?.feedback)J.push(Q.pr?`A reviewer requested changes on pull request #${Q.pr.number} (${Q.pr.url}):`:"A reviewer requested changes on your previous work:",Q.feedback,Q.pr?`Check that branch out (\`${YW1(Z?.provider??"github",Q.pr.number)}\`) before editing, address the feedback, then push to update the SAME ${X.changeRequest} \u2014 do NOT open a new one.`:"Address this feedback.",...o_0(Q.pr),"");else if(Q?.pr)J.push(`This task already has an open pull request #${Q.pr.number} (${Q.pr.url}), and you are already on its branch.`,"Continue that work: commit and push to update the SAME pull request \u2014 do NOT open a new one. If it already does everything the task asks, say so and stop rather than changing it.",...o_0(Q.pr),"");if(Y)return J.push(p_0("mcp__studio__"),""),J.join(`
-`).trimStart();return J.push("How to finish:","- Make the change, commit it, push the branch, and open a pull request"+(Q?.pr?" \u2014 or push to the existing one, per the instruction above.":"."),"- Change only what the task needs. Don't refactor around it.","- The change must be REACHABLE from the surface the task names: edit the component that route actually renders, not one that merely looks like the right place. A change nothing imports is the most common reason a task comes back rejected.","- Before handing over, VERIFY the task's outcome LOCALLY, in the sandbox: exercise the affected code path and confirm the behaviour actually happens. A green test suite is not the bar. Do NOT wait for, or verify against, the PR's deploy preview \u2014 a reviewer checks that after you hand over.",'- A browser is installed globally, NOT in the repo\'s `node_modules` \u2014 don\'t go looking for playwright there. `qa-screenshot <url> <path>.png [--mobile] [--full] [--selector=<css>]` renders any URL (localhost included) in headless Chromium, runs the page\'s JS, and writes a file you must then `Read` \u2014 a screenshot you never opened is not verification. Write screenshots under `/app/org/output/` and EMBED them in your task comment as markdown images, `![home](/app/org/output/qa/home.png)` \u2014 only that form renders on the card; a bare path or a code span shows the reader nothing. To INTERACT (click, fill, `document.elementFromPoint`), write a throwaway node script: `const { chromium } = require("/usr/local/lib/node_modules/playwright-core"); chromium.launch({ executablePath: "/usr/bin/chromium", args: ["--no-sandbox"] })`.',`- Open the ${X.changeRequest} from the branch you were given \u2014 the board finds it by that branch. Don't move the work to a differently-named one.`),J.push(`- If your change adds or edits pages a person can open, report their paths with \`mcp__studio__TASK_BOARD_ITEM_UPDATE\` (id "${$.id}", \`previewRoutes: ["/some-page"]\`) \u2014 paths only, no host. The card joins them onto the deploy preview so a reviewer opens the page directly. Skip it when the change has no visible route.`,'- If the task turns out to need no code change, do NOT open a PR: explain why in a comment on the task (`mcp__studio__TASK_BOARD_COMMENT_CREATE`) and move it to "done". There is nothing for a reviewer to review, so leaving it for one would strand it.',`- Anything a reviewer should know (a decision you made, something you found and deliberately left alone, a question) goes on the task as a comment: \`mcp__studio__TASK_BOARD_COMMENT_CREATE\` with taskBoardItemId "${$.id}". Read what's already there first with \`mcp__studio__TASK_BOARD_COMMENT_LIST\` \u2014 a comment may be addressed to you.`,"",`(task id: ${$.id})`),J.join(`
+`).trimStart();return J.push("How to finish:","- Make the change, commit it, push the branch, and open a pull request"+(Q?.pr?" \u2014 or push to the existing one, per the instruction above.":"."),"- Change only what the task needs. Don't refactor around it.","- The change must be REACHABLE from the surface the task names: edit the component that route actually renders, not one that merely looks like the right place. A change nothing imports is the most common reason a task comes back rejected.","- Before handing over, VERIFY the task's outcome LOCALLY, in the sandbox: exercise the affected code path and confirm the behaviour actually happens. A green test suite is not the bar. Do NOT wait for, or verify against, the PR's deploy preview \u2014 a reviewer checks that after you hand over.",'- A browser is installed globally, NOT in the repo\'s `node_modules` \u2014 don\'t go looking for playwright there. `qa-screenshot <url> <path>.png [--mobile] [--full] [--selector=<css>]` renders any URL (localhost included) in headless Chromium, runs the page\'s JS, and writes a file you must then `Read` \u2014 a screenshot you never opened is not verification. Write screenshots under `/app/org/output/` and EMBED them in your task comment as markdown images, `![home](/app/org/output/qa/home.png)` \u2014 only that form renders on the card; a bare path or a code span shows the reader nothing. To INTERACT (click, fill, `document.elementFromPoint`), write a throwaway node script: `const { chromium } = require("/usr/local/lib/node_modules/playwright-core"); chromium.launch({ executablePath: "/usr/bin/chromium", args: ["--no-sandbox"] })`. Add `--engine=webkit` (WebKit, Safari\'s engine) when a mobile scroll, snap or animation quirk could be engine-specific, or when asked to check Safari; to script it, `webkit` from the same playwright-core with `browser.newContext(devices["iPhone 13"])`. It is not a real iPhone or Mac: report it as "checked in WebKit", not as tested on iOS or Safari.',`- Open the ${X.changeRequest} from the branch you were given \u2014 the board finds it by that branch. Don't move the work to a differently-named one.`),J.push(`- If your change adds or edits pages a person can open, report their paths with \`mcp__studio__TASK_BOARD_ITEM_UPDATE\` (id "${$.id}", \`previewRoutes: ["/some-page"]\`) \u2014 paths only, no host. The card joins them onto the deploy preview so a reviewer opens the page directly. Skip it when the change has no visible route.`,'- If the task turns out to need no code change, do NOT open a PR: explain why in a comment on the task (`mcp__studio__TASK_BOARD_COMMENT_CREATE`) and move it to "done". There is nothing for a reviewer to review, so leaving it for one would strand it.',`- Anything a reviewer should know (a decision you made, something you found and deliberately left alone, a question) goes on the task as a comment: \`mcp__studio__TASK_BOARD_COMMENT_CREATE\` with taskBoardItemId "${$.id}". Read what's already there first with \`mcp__studio__TASK_BOARD_COMMENT_LIST\` \u2014 a comment may be addressed to you.`,"",`(task id: ${$.id})`),J.join(`
 `)}var $_6;var Qj1=L(()=>{Z60();r4();u4();X$();Zj1();$_6='Each checkout is authenticated for ITS OWN host: use `gh` inside a GitHub repository and `glab` inside a GitLab one (`glab mr create` is the counterpart of `gh pr create`). Bitbucket has no CLI: inside a Bitbucket repository open pull requests through the Studio tools or the REST API with `curl -H "Authorization: Bearer $BITBUCKET_TOKEN"` against api.bitbucket.org. A run can hold several at once, so pick the one that matches the repository '+"you are standing in \u2014 check its remote with `git remote get-url origin` if "+"you are unsure."});import{createHmac as Z_6,timingSafeEqual as Q_6}from"crypto";function Xj1($,Z,Q){return`rtok_${Z_6("sha256",T_0()).update(`${$}:${Z}:${Q.toISOString()}`).digest("base64url")}`}function W98($,Z,Q,X){let Y=Buffer.from($),J=Buffer.from(Xj1(Z,Q,X));return Y.length===J.length&&Q_6(Y,J)}var Yj1=L(()=>{FO1()});import{createHash as X_6}from"crypto";function s50($,Z){if($.status===null||H98.has($.status))return!1;return!l50({updated_at:$.lastActiveAt,last_progress_at:null},Z)}function Jj1($,Z){return $.threads.some((Q)=>!jW.some((X)=>Yz(Q.title,X))&&s50(Q,Z))}function G_6($,Z){return Z-$>=J_6}function K_6($,Z,Q,X){if($||Z!==!1)return!1;return G_6(Q,X)}async function bn($,Z,Q){let X=await $.storage.organizationSettings.get(Z.organizationId),Y=Q?.kinds??ID(X?.flags);if(Y.length===0)return[];if(Jj1(Z,Date.now()))return[];let J=CZ(X?.flags,"cheap_reviewer_model")?"reviewer":"default",G=await $.storage.taskBoard.listActivity(Z.id,Z.organizationId),K=Z.reviewCycleStartedAt,W=VD(G,K),H=new Date(W),F=Jz(G,{cycleStartedAt:K}),U=[];return await Promise.all(Y.map(async(N)=>{let B=F.has(N);if(!B){let j=L_6(G,W),w=B_6(Z,N,W,j);if(w){await w_6($,Z,N,w).catch((E)=>console.error(`[task-board] ${N} verdict nudge failed`,E));return}if(O_6(j,Date.now()))return}if(U_6(Z,N,W,Date.now(),B)){await CF($,Z,`${CN[N]} failed ${Gj1} times on `+"this review \u2014 it will not be retried");return}if(Q?.previewMatchesHead===!1){if(K_6(B,Q.previewMatchesHead,W,Date.now()))await CF($,Z,"the pull request's deploy preview is not showing its latest commit (its checks never went green), so the Reviewer cannot verify this change against what the PR actually does");return}if(N_6(Z,N,W,Date.now(),B))return;let D=W_6(Z,N,W,Date.now(),B);if(await P_6($,Z,N,H,D,J).catch((j)=>{return console.error(`[task-board] ${N} reviewer enqueue failed`,j),!1}))U.push(N)})),U}function W_6($,Z,Q,X=Date.now(),Y=!0){return $.threads.filter((J)=>Yz(J.title,Z)&&Kj1(J,X,Y)&&new Date(J.createdAt).getTime()>=Q).length}function H_6($,Z){if(!$||!Z||!("choices"in Z))return null;return Z.choices.find((Q)=>Q.repo===$)?.id??null}function F_6($,Z,Q){let X=$.threads.filter((Y)=>Yz(Y.title,Z)&&Y.status==="completed"&&new Date(Y.createdAt).getTime()<Q).map((Y)=>new Date(Y.lastActiveAt).getTime()).filter((Y)=>Number.isFinite(Y));return X.length===0?0:Math.max(...X)}function Kj1($,Z,Q=!0){if($.status==="failed")return!0;if($.status!==null&&H98.has($.status))return!Q;return $.status!==null&&!s50($,Z)}function F98($,Z,Q,X=Date.now()){return $.threads.filter((Y)=>{if(!Yz(Y.title,Z))return!1;return s50(Y,X)||new Date(Y.createdAt).getTime()>=Q})}function U_6($,Z,Q,X=Date.now(),Y=!0){let J=F98($,Z,Q,X);return J.length>0&&J.every((G)=>Kj1(G,X,Y))&&J.length>=Gj1}function N_6($,Z,Q,X=Date.now(),Y=!0){let J=F98($,Z,Q,X);if(J.length===0)return!1;if(J.some((K)=>s50(K,X)))return!0;let G=J.filter((K)=>Kj1(K,X,Y));if(G.length>=Gj1)return!0;return G.length!==J.length}function B_6($,Z,Q,X,Y=Date.now()){return $.threads.find((J)=>Yz(J.title,Z)&&J.status==="completed"&&!s50(J,Y)&&new Date(J.createdAt).getTime()>=Q&&!X.has(J.threadId))??null}function L_6($,Z){let Q=new Map;for(let X of $){if(X.action!=="review_verdict_requested")continue;let Y=new Date(X.occurredAt).getTime();if(Y<Z)continue;let J=X.data?.threadId;if(typeof J==="string")Q.set(J,Y)}return Q}function O_6($,Z){for(let Q of $.values())if(Z-Q<D_6)return!0;return!1}function j_6($){return[`Your ${CN[$]} run ended without recording a decision, so the task is stuck: nothing ships and nobody is told why. A review that reaches no verdict is not a review.`,"","Do exactly ONE thing in this run and then stop:","- Call `TASK_BOARD_REVIEW_DECISION` now, with the verdict your review already reached and notes that say what you checked.","- Approve ONLY if you actually exercised the change and it holds. If you could not finish \u2014 a check never came back, a preview never rendered, you ran out of room \u2014 `request_changes` and say exactly what is unresolved. That hands the card to a person, which is the correct outcome for an unfinished review.","- Do NOT re-run the review, do NOT change any code, and do NOT wait on any background task: whatever you know right now is the verdict."].join(`
 `)}async function w_6($,Z,Q,X){let Y=await $.storage.threads.get(X.threadId);if(!Y||Y.message_storage_version!==2)return;await $.storage.taskBoard.recordActivity({taskBoardItemId:Z.id,action:"review_verdict_requested",actorId:null,data:{reviewer:Q,threadId:X.threadId}}),console.warn(`[task-board] ${Q} reviewer on ${Z.id} completed with no verdict \u2014 `+"asking for one"),await In($,Z,Y,{messageId:`review-verdict-${X.threadId}`,prompt:j_6(Q),workflowID:`review-verdict:${X.threadId}`,runClass:"reviewer"})}function E_6($,Z,Q,X){return`review:${$}:${Z}:${Q.toISOString()}:${X}`}function z_6($){return`thrd_${X_6("sha256").update($).digest("hex").slice(0,32)}`}async function P_6($,Z,Q,X,Y,J){let G=Z.organizationId,K=Xj1(Z.id,Q,X),W=await r_0($,G,{repositoryId:Z.repositoryId,repo:Z.repo}),H=W&&"repo"in W?W.repo:null,F=W!==null,U=F_6(Z,Q,X.getTime()),N=H_6(Z.repo,W),B=F?"mcp__studio__TASK_BOARD_ITEM_PRS_GET":"TASK_BOARD_ITEM_PRS_GET",D=F?"mcp__studio__TASK_BOARD_REVIEW_DECISION":"TASK_BOARD_REVIEW_DECISION",O=F?"mcp__studio__TASK_BOARD_COMMENT_CREATE":"TASK_BOARD_COMMENT_CREATE",j=F?"mcp__studio__TASK_BOARD_COMMENT_LIST":"TASK_BOARD_COMMENT_LIST",w=[Y_6[Q],"","You are running AUTONOMOUSLY \u2014 no human is watching this run. Making the "+'approve / request-changes call IS your job; you are the decision-maker, not an assistant asking a human to decide. NEVER use `user_ask` to ask whether to approve, or to confirm an obvious call ("Approve the PR?"). Reserve `user_ask` for a genuine, unresolvable blocker only a human can clear (e.g. a missing credential, or a requirement so ambiguous you '+"truly cannot judge the outcome) \u2014 that should be rare. When in doubt "+"between asking and deciding, DECIDE.","","Do NOT merge the pull request \u2014 the board does that itself once your "+"approval is in. Pushing fixes to the PR's own branch is expected of you; opening a second pull request, force-pushing, or touching any other ref is not."].join(`
 `),E=Z.description&&F?n_0(Z.description):Z.description,z=Z.description&&E?t_0(Z.description,E):null,A=[...F?[]:[w,""],`Task title: ${Z.title}`,E?`
 Task description:
 ${E}
-`:"",...z?[z,""]:[],"How to work:",`- Call \`${B}\` with the task id below to find the pull request under review.`,H?`- The repository ${H.owner}/${H.name} is already cloned at your working directory and \`git\` and its CLI (\`gh\` for GitHub, \`glab\` for GitLab; Bitbucket has no CLI \u2014 use the REST API with \`curl\` and \`$BITBUCKET_TOKEN\`) are authenticated \u2014 check the PR's branch out there to inspect / exercise the change. ${M40}`:F?`- Your working directory is EMPTY. Call \`mcp__studio__TASK_ADD_REPO\` ${N?`with id \`${N}\` (${Z.repo}) FIRST \u2014 do NOT call it with no arguments, that only lists the org's repositories and costs you a turn.`:"with the id of the PR's repository FIRST;"} it clones the repository and waits for the checkout, and \`git\` and its CLI are authenticated once it returns. ${M40}`:"- Load the PR's repository to inspect / exercise the change.",`- ${nh$}`,...U>0?[`- This is a RE-REVIEW. You already reviewed an earlier version of this pull request and asked for changes, and there are more commits since (a human re-delegated the card, or your own fixes from that round are in the history). Read your own previous notes with \`${j}\`, then review WHAT MOVED SINCE \u2014 \`gh pr diff <number>\` still shows the whole PR, so narrow it with \`git log --since='${new Date(U).toISOString()}' --oneline\` and diff only those commits. Confirm your earlier notes were addressed and check the new commits for their own problems. Do NOT re-read the parts of the PR you already cleared.`]:[],"- Fix the issues you find on the PR's branch, run the repository's own checks, and push to that same PR. You are the last automated run on this task \u2014 nothing picks up findings you only describe.",`- THEN exercise the change. If the PR has a deploy \`previewUrl\` (from \`${B}\`), use it \u2014 re-read it after your push so you get the preview of YOUR commit, wait for it if it is still building, and deep-link to the page/route the task affects (not root). If there is NO preview, exercise it in the sandbox instead: run the repository's own checks, and for a UI change build and serve it locally and capture it (a Flutter app runs on an Android emulator, but only on the Android sandbox image \u2014 see the \`flutter-app\` skill). Either way, if you cannot exercise it at all, do NOT approve \u2014 \`request_changes\` saying which path you tried and what blocked it.`,"- For a VISUAL change, capture before/after by running `qa-screenshot <url> /app/org/output/qa/<name>.png [--mobile] [--full] [--selector=<css>] [--console]` (headless Chromium, baked into the sandbox; also works against a dev server you started on localhost \u2014 none is running by default, this pod is a checkout). Choose the framing: default is the top viewport, `--full` is the whole page, and `--selector='<css>'` frames just the component you changed (best for a focused before/after). Add `--mobile` too for a responsive change, and `--console` to catch the runtime errors a screenshot alone reports as a pass. WRITE them under `/app/org/output/` \u2014 that's what surfaces them on the task. Then `Read` the files to actually LOOK at them: a screenshot you never opened is not verification. To INTERACT with a page \u2014 click, hit-test with `document.elementFromPoint`, fill a form \u2014 `qa-screenshot` is not enough, but the browser it drives is yours: write a throwaway node script that requires the global playwright-core: `const { chromium } = require(\"/usr/local/lib/node_modules/playwright-core\"); chromium.launch({ executablePath: \"/usr/bin/chromium\", args: [\"--no-sandbox\"] })`. Do NOT report a check as impossible because Playwright is missing \u2014 it is installed.",`- Record what you validated with \`${O}\` (scenarios + pass/fail, the exact URL + viewport, and anything you couldn't verify) BEFORE your decision. EMBED the before/after shots inline as markdown images referencing their /app/org/output path, and put each before/after PAIR in a two-column table so they render side by side, e.g.:
+`:"",...z?[z,""]:[],"How to work:",`- Call \`${B}\` with the task id below to find the pull request under review.`,H?`- The repository ${H.owner}/${H.name} is already cloned at your working directory and \`git\` and its CLI (\`gh\` for GitHub, \`glab\` for GitLab; Bitbucket has no CLI \u2014 use the REST API with \`curl\` and \`$BITBUCKET_TOKEN\`) are authenticated \u2014 check the PR's branch out there to inspect / exercise the change. ${M40}`:F?`- Your working directory is EMPTY. Call \`mcp__studio__TASK_ADD_REPO\` ${N?`with id \`${N}\` (${Z.repo}) FIRST \u2014 do NOT call it with no arguments, that only lists the org's repositories and costs you a turn.`:"with the id of the PR's repository FIRST;"} it clones the repository and waits for the checkout, and \`git\` and its CLI are authenticated once it returns. ${M40}`:"- Load the PR's repository to inspect / exercise the change.",`- ${nh$}`,...U>0?[`- This is a RE-REVIEW. You already reviewed an earlier version of this pull request and asked for changes, and there are more commits since (a human re-delegated the card, or your own fixes from that round are in the history). Read your own previous notes with \`${j}\`, then review WHAT MOVED SINCE \u2014 \`gh pr diff <number>\` still shows the whole PR, so narrow it with \`git log --since='${new Date(U).toISOString()}' --oneline\` and diff only those commits. Confirm your earlier notes were addressed and check the new commits for their own problems. Do NOT re-read the parts of the PR you already cleared.`]:[],"- Fix the issues you find on the PR's branch, run the repository's own checks, and push to that same PR. You are the last automated run on this task \u2014 nothing picks up findings you only describe.",`- THEN exercise the change. If the PR has a deploy \`previewUrl\` (from \`${B}\`), use it \u2014 re-read it after your push so you get the preview of YOUR commit, wait for it if it is still building, and deep-link to the page/route the task affects (not root). If there is NO preview, exercise it in the sandbox instead: run the repository's own checks, and for a UI change build and serve it locally and capture it (a Flutter app runs on an Android emulator, but only on the Android sandbox image \u2014 see the \`flutter-app\` skill). Either way, if you cannot exercise it at all, do NOT approve \u2014 \`request_changes\` saying which path you tried and what blocked it.`,"- For a VISUAL change, capture before/after by running `qa-screenshot <url> /app/org/output/qa/<name>.png [--mobile] [--full] [--selector=<css>] [--console]` (headless Chromium, baked into the sandbox; also works against a dev server you started on localhost \u2014 none is running by default, this pod is a checkout). Choose the framing: default is the top viewport, `--full` is the whole page, and `--selector='<css>'` frames just the component you changed (best for a focused before/after). Add `--mobile` too for a responsive change, and `--console` to catch the runtime errors a screenshot alone reports as a pass. WRITE them under `/app/org/output/` \u2014 that's what surfaces them on the task. Then `Read` the files to actually LOOK at them: a screenshot you never opened is not verification. To INTERACT with a page \u2014 click, hit-test with `document.elementFromPoint`, fill a form \u2014 `qa-screenshot` is not enough, but the browser it drives is yours: write a throwaway node script that requires the global playwright-core: `const { chromium } = require(\"/usr/local/lib/node_modules/playwright-core\"); chromium.launch({ executablePath: \"/usr/bin/chromium\", args: [\"--no-sandbox\"] })`. Do NOT report a check as impossible because Playwright is missing \u2014 it is installed. Add `--engine=webkit` (WebKit, Safari's engine) when a mobile scroll, snap or animation quirk could be engine-specific, or when asked to check Safari; to script it, `webkit` from the same playwright-core with `browser.newContext(devices[\"iPhone 13\"])`. It is not a real iPhone or Mac: report it as \"checked in WebKit\", not as tested on iOS or Safari.",`- Record what you validated with \`${O}\` (scenarios + pass/fail, the exact URL + viewport, and anything you couldn't verify) BEFORE your decision. EMBED the before/after shots inline as markdown images referencing their /app/org/output path, and put each before/after PAIR in a two-column table so they render side by side, e.g.:
 
 | Before | After |
 | --- | --- |