decocms 4.443.1 → 4.443.2

package/dist/server/server.js

@@ -1201,7 +1201,7 @@ Caused by: ${Z.stack}`}};Tm=class Tm extends xY{constructor($,Z){super($,Z);this
 `).filter((Z)=>!/^Co-authored-by:\s/i.test(Z)).join(`
 `).trimEnd()}function tc4($){let Z=$.userName.trim(),Q=$.userEmail?.trim();if(Q)return`Co-authored-by: ${Z} <${Q}>`;return`Co-authored-by: ${Z}`}function V51($,Z){let Q=gm(Z);if(!Q)return $;let Y=fA$($),X=tc4(Q);if(Y.includes(X))return Y;let J=Y.trimEnd();return J.length>0?`${J}
 
-${X}`:X}var xA$,nc4;var k51=D(()=>{xA$=/[\r\n<>]/,nc4=/^[^\s@<>]+@[^\s@<>]+\.[^\s@<>]+$/});var XT0=D(()=>{a$();k51()});function oc4($){if($ instanceof TypeError)return!0;if($ instanceof Error&&!($ instanceof DOMException)&&typeof $.code==="string")return!0;if($ instanceof DOMException&&$.name==="AbortError")return!0;return!1}async function S51($,Z,Q,Y){try{return await E8(async()=>{let J=await fetch($,{...Z,signal:AbortSignal.timeout(Y)});return{status:J.status,ok:J.ok,body:await J.text()}},{maxAttempts:3,minTimeout:50,maxTimeout:500,multiplier:2,jitter:0.5,isRetriable:oc4})}catch(X){let J=X instanceof Error?X.message:String(X);throw Error(`[SANDBOX_UNREACHABLE] sandbox daemon ${Q} request failed: ${J}`,{cause:X})}}async function JT0($){try{let Z=await fetch(`${$}/health`,{signal:AbortSignal.timeout(rc4)});if(!Z.ok){try{await Z.text()}catch{}return null}let Q=await Z.json();if(typeof Q==="object"&&Q!==null&&typeof Q.bootId==="string"&&typeof Q.ready==="boolean"&&Q.setup&&typeof Q.setup.running==="boolean"&&typeof Q.setup.done==="boolean")return Q;return null}catch{return null}}async function _51($){for(let Z=0;Z<yA$;Z++){if(await JT0($)!==null)return;let Q=(Math.random()*2-1)*sc4;await L$(gA$+Q)}throw Error(`sandbox daemon at ${$} did not respond on /health within ${yA$*gA$/1000}s`)}async function _U($,Z,Q,Y,X){return ac4($,Z,"POST",Q,Y,X)}async function ac4($,Z,Q,Y,X,J){let G={...Y};if(X&&X.rotateToken!==void 0)G.auth=X;let W=await S51(`${$}/_sandbox/config`,{method:Q,headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:JSON.stringify(G)},"/_sandbox/config",J?.timeoutMs??C51);if(!W.ok)throw new PH(W.status,W.body);return uA$(W.body,"/_sandbox/config")}async function hA$($,Z,Q){let Y=await S51(`${$}/_sandbox/setup/${Q}`,{method:"POST",headers:{Authorization:`Bearer ${Z}`}},`/_sandbox/setup/${Q}`,C51);if(!Y.ok)throw Error(`sandbox daemon /_sandbox/setup/${Q} returned ${Y.status}: ${Y.body}`)}async function A10($,Z,Q){let Y=await S51(`${$}/_sandbox/orgfs-config`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:Q},"/_sandbox/orgfs-config",C51);if(!Y.ok)throw Error(`sandbox daemon /_sandbox/orgfs-config returned ${Y.status}: ${Y.body}`);return uA$(Y.body,"/_sandbox/orgfs-config")}function uA$($,Z){try{return JSON.parse($)}catch(Q){throw Error(`sandbox daemon ${Z} returned a malformed JSON body: ${$.slice(0,200)}`,{cause:Q})}}async function GT0($,Z,Q,Y){let X=new Headers(Y.headers);for(let W of ec4)X.delete(W);X.set("authorization",`Bearer ${Z}`);let J=Y.method!=="GET"&&Y.method!=="HEAD",G=`${$}${Q.startsWith("/")?Q:`/${Q}`}`;return fetch(G,{method:Y.method,headers:X,body:J?Y.body:void 0,redirect:"manual",signal:Y.signal,duplex:J?"half":void 0})}var PH,rc4=500,C51=30000,yA$=25,gA$=200,sc4=50,ec4;var Gf=D(()=>{XT0();a$();PH=class PH extends Error{status;constructor($,Z){super(`sandbox daemon /_sandbox/config returned ${$}: ${Z}`);this.status=$;this.name="ConfigRequestError"}};ec4=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length"]});class WT0{counted=new Set;markCounted($){this.counted.add($)}consume($){return this.counted.delete($)}}class Wf{map=new Map;async run($,Z){let Q=this.map.get($);if(Q)return Q;let Y=Z();this.map.set($,Y);try{return await Y}finally{this.map.delete($)}}}function KT0($,Z,Q){if(!$)return Q(null);if(!$.withLock)return Q($);return $.withLock(Z,Q)}function T10($){if(!$.orgId||!$.virtualMcpId||!$.branch)throw Error("composeSandboxRef: orgId, virtualMcpId and branch are all required for agent refs");return`agent:${$.orgId}:${$.virtualMcpId}:${$.branch}`}function lA$($){if(!$.startsWith("agent:"))return"";let Z=$.split(":");return Z.length>=4?Z.slice(3).join(":"):""}import{hash as $m4}from"crypto";function Zm4($,Z=16){return $m4("sha256",VL$($),"hex").slice(0,Z)}function N3($){let Z=Zm4($),Q=Qm4(lA$($.projectRef));return Q?`${Q}-${Z}`:`s-${Z}`}function Qm4($){if(!$)return"";let Z=$.split("/").pop()??"",Q="",Y=!1;for(let X of Z.toLowerCase()){let J=X.charCodeAt(0),G=J>=97&&J<=122,W=J>=48&&J<=57;if(!G&&!W){Y||=Q.length>0;continue}if(Y){if(Q.length+1>=cA$)break;Q+="-",Y=!1}if(Q+=X,Q.length===cA$)break}return Q}var cA$=24;var mA$=D(()=>{V41()});function HT0($,Z){let Q=$.replace(/\/+$/,"");if(Q.includes("{handle}"))return`${Q.replace("{handle}",Z)}/`;try{let Y=new URL(Q);return Y.hostname=`${Z}.${Y.hostname}`,`${Y.toString()}/`}catch{return`${Q}/${Z}/`}}function hm($){let Z=$.repo,Q=Z?{repository:{cloneUrl:Z.cloneUrl,repoName:Z.displayName??Ym4(Z.cloneUrl),...Z.branch?{branch:Z.branch}:{},submoduleCredentials:Z.submoduleCredentials??[]},repositories:($.extraRepos??[]).filter((K)=>!!K.directoryName).map((K)=>({cloneUrl:K.cloneUrl,repoName:K.directoryName,...K.branch?{branch:K.branch}:{},submoduleCredentials:K.submoduleCredentials??[]})),...Z.userName.trim()||Z.userEmail.trim()?{identity:{userName:Z.userName,userEmail:Z.userEmail}}:{}}:void 0,Y=$.tenant,X=gm({userName:Y?.userName,userEmail:Y?.userEmail})??void 0,J=$.packageManager?{name:$.packageManager.name,...$.packageManager.path?{path:$.packageManager.path}:{}}:void 0,G=J?{packageManager:J,runtime:$.runtime,...$.port!==void 0?{port:$.port}:{}}:void 0,W=Y?.orgId;if(!Q&&!G&&!X&&$.cloneOnly===void 0&&!W)return null;return{...Q?{git:Q}:{},...X?{operator:X}:{},...W?{orgId:W}:{},...$.cloneOnly!==void 0?{cloneOnly:$.cloneOnly}:{},...G?{application:G}:{}}}function Ym4($){try{let Z=new URL($);return Z.pathname.replace(/^\/+/,"").replace(/\.git$/,"")||Z.hostname}catch{return $}}var dA$=D(()=>{k51()});function Xm4($){try{return new URL($).username.length>0}catch{return!1}}function R10($){let Z=$.repo?.cloneUrl;if(!Z||!Xm4(Z))return null;return{git:{repository:{cloneUrl:Z}}}}var um=D(()=>{mA$();dA$()});async function*nA$($){let Z=$.now??(()=>Date.now()),Q=Z(),Y=$.schedulingTimeoutMs??Gm4,X={pod:{},sandbox:{},events:{hasPulling:!1,hasPulled:!1},startedAt:Q},J=[],G=null,W=!1,K=(E)=>{if(W)return;if(G){let z=G;G=null,z(E)}else J.push(E)},H=()=>{if(J.length>0)return Promise.resolve(J.shift());if(W)return Promise.resolve(null);return new Promise((E)=>{G=E})},F=()=>{if(W)return;if(W=!0,G){let E=G;G=null,E(null)}},U=new AbortController,N=()=>{U.abort(),F()};if($.signal)if($.signal.aborted)U.abort(),F();else $.signal.addEventListener("abort",N,{once:!0});let B=Math.max(0,Y-(Z()-Q)),O=setTimeout(()=>K("tick"),B+100),L,w=new Promise((E)=>{L=E}),j=Promise.allSettled([Km4($.kc,$.namespace,$.claimName,U.signal,X,K,Z,L),Fm4($.kc,$.namespace,$.claimName,U.signal,X,K),Um4($.kc,$.namespace,$.claimName,w,U.signal,X,K,Z)]);try{let E=null,z=-1,T=iA$(X,Y,Z);if(E=b51(T),!v51(T))z=pA$(T);if(yield T,v51(T))return;while(!W){if(await H()===null)break;let A=iA$(X,Y,Z);if(v51(A)){let _=b51(A);if(_!==E)E=_,yield A;return}let q=pA$(A);if(q<z)continue;let f=b51(A);if(f!==E)E=f,z=q,yield A}}finally{if(clearTimeout(O),U.abort(),$.signal)$.signal.removeEventListener("abort",N);F(),await j.catch(()=>{})}}async function tA$($,Z=Wm4){let Q=new AbortController,Y="claiming",X,J=()=>{clearTimeout(X),X=setTimeout(()=>Q.abort(),Z)};try{J();for await(let G of $(Q.signal)){if(G.kind==="ready")return;if(G.kind==="failed")throw new xY(G.message);Y=G.kind,J()}}finally{clearTimeout(X),Q.abort()}throw new Tm(`Sandbox did not become ready: no progress for ${Math.round(Z/1000)}s while ${Y}`)}function iA$($,Z,Q){let{pod:Y,sandbox:X,events:J,startedAt:G}=$;if(X.ready)return{kind:"ready"};let W=Y.containerWaitingReason;if(W==="ImagePullBackOff"||W==="ErrImagePull")return{kind:"failed",reason:"image-pull-backoff",message:"Sandbox image failed to download. The cluster may be missing pull credentials or the image tag may not exist."};if(W==="CrashLoopBackOff")return{kind:"failed",reason:"crash-loop-backoff",message:"Sandbox crashed during startup and is now in CrashLoopBackOff. Check pod logs."};if(!Y.scheduled&&J.lastFailedSchedulingAt!==void 0&&Q()-G>Z)return{kind:"failed",reason:"scheduling-timeout",message:J.failedSchedulingMessage??`Pod could not be scheduled within ${Math.round(Z/1000)}s.`};if(Y.containerRunning&&!Y.containerReady)return{kind:"warming-daemon",since:G};if(J.hasPulling&&!J.hasPulled)return{kind:"pulling-image",since:G};if(W==="ContainerCreating"||W==="PodInitializing"||Y.scheduled&&!Y.containerRunning)return{kind:"starting-container",since:G};if(Y.scheduledFalseReason==="Unschedulable"||J.lastFailedSchedulingAt!==void 0&&!Y.scheduled)return{kind:"waiting-for-capacity",since:G,message:J.failedSchedulingMessage??Y.scheduledFalseMessage,nodeClaim:J.nominatedNodeClaim};return{kind:"claiming",since:G}}function v51($){return $.kind==="ready"||$.kind==="failed"}function pA$($){switch($.kind){case"claiming":return 0;case"waiting-for-capacity":return 1;case"pulling-image":return 2;case"starting-container":return 3;case"warming-daemon":return 4;case"ready":case"failed":return 99}}function b51($){switch($.kind){case"claiming":case"pulling-image":case"starting-container":case"warming-daemon":return $.kind;case"waiting-for-capacity":return`waiting-for-capacity:${$.message??""}:${$.nodeClaim??""}`;case"ready":return"ready";case"failed":return`failed:${$.reason}:${$.message}`}}async function Km4($,Z,Q,Y,X,J,G,W){let K=`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?watch=true&labelSelector=${encodeURIComponent(`${Jm4}=${Q}`)}`;return FT0({kc:$,path:K,signal:Y,label:`pod/${Q}`,onEvent:(H)=>{if(H.type!=="ADDED"&&H.type!=="MODIFIED")return;let F=H.object;if(F.metadata?.name)W(F.metadata.name);Hm4(F,X,G),J("pod")}})}function Hm4($,Z,Q){let X=($.status?.conditions??[]).find((G)=>G.type==="PodScheduled");if(X?.status==="True")Z.pod.scheduled=!0,Z.pod.scheduledFalseReason=void 0,Z.pod.scheduledFalseMessage=void 0;else if(X?.status==="False")Z.pod.scheduled=!1,Z.pod.scheduledFalseReason=X.reason,Z.pod.scheduledFalseMessage=X.message;let J=($.status?.containerStatuses??[]).find((G)=>G.name===pZ.MAIN_CONTAINER_NAME);if(J)Z.pod.containerWaitingReason=J.state?.waiting?.reason,Z.pod.containerRunning=!!J.state?.running,Z.pod.containerReady=J.ready===!0}async function Fm4($,Z,Q,Y,X,J){let G=`/apis/${pZ.CLAIM_API_GROUP}/${pZ.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(Z)}/${pZ.CLAIM_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${Q}`)}`;return FT0({kc:$,path:G,signal:Y,label:`sandboxclaim/${Q}`,onEvent:(W)=>{if(W.type!=="ADDED"&&W.type!=="MODIFIED")return;let H=W.object.status?.conditions?.find((F)=>F.type==="Ready");if(!H)return;if(H.status==="True")X.sandbox.ready=!0,X.sandbox.notReadyReason=void 0,X.sandbox.notReadyMessage=void 0;else X.sandbox.ready=!1,X.sandbox.notReadyReason=H.reason,X.sandbox.notReadyMessage=H.message;J("sandbox")}})}async function Um4($,Z,Q,Y,X,J,G,W){let K=await Promise.race([Y,new Promise((F)=>{if(X.aborted){F(Q);return}X.addEventListener("abort",()=>F(Q),{once:!0})})]);if(X.aborted)return;let H=`/api/v1/namespaces/${encodeURIComponent(Z)}/events?watch=true&fieldSelector=${encodeURIComponent(`involvedObject.name=${K},involvedObject.kind=Pod`)}`;return FT0({kc:$,path:H,signal:X,label:`events/${Q}`,onEvent:(F)=>{if(F.type!=="ADDED"&&F.type!=="MODIFIED")return;let U=F.object,N=U.reason;if(!N)return;switch(N){case"Pulling":J.events.hasPulling=!0;break;case"Pulled":J.events.hasPulling=!0,J.events.hasPulled=!0;break;case"FailedScheduling":J.events.lastFailedSchedulingAt=W(),J.events.failedSchedulingMessage=U.message;break;case"Nominated":{let B=U.message?.match(/nodeclaim\/([\w-]+)/);if(B)J.events.nominatedNodeClaim=B[1];break}default:return}G("event")}})}async function oA$($){let{kc:Z,namespace:Q,labelSelector:Y,signal:X,onDelete:J}=$,G=`/apis/${pZ.CLAIM_API_GROUP}/${pZ.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(Q)}/${pZ.CLAIM_PLURAL}?watch=true&labelSelector=${encodeURIComponent(Y)}`;return FT0({kc:Z,path:G,signal:X,label:"sandboxclaim-reaper",onEvent:(W)=>{if(W.type!=="DELETED")return;let K=W.object.metadata?.name;if(K)J(K)}})}async function FT0($){let{kc:Z,path:Q,signal:Y,label:X,onEvent:J}=$,G=0;while(!Y.aborted){try{let K=await bW(Z,{method:"GET",path:Q,signal:Y,headers:{accept:"application/json"},stream:!0});if(!K.ok||!K.body){try{await K.body?.cancel()}catch{}if(K.status===401||K.status===403){console.warn(`[lifecycle-watcher] ${X} stopped: watch denied (${K.status} ${K.statusText}). `+"The kubeconfig in use cannot watch SandboxClaims \u2014 if you are running locally, "+"this provider should not be active (check STUDIO_AGENT_SANDBOX_ENABLED).");return}throw Error(`watch handshake failed: ${K.status} ${K.statusText}`)}G=0;for await(let H of Gw$(K.body)){if(Y.aborted)return;try{J(H)}catch(F){console.warn(`[lifecycle-watcher] ${X} onEvent threw: ${F instanceof Error?F.message:String(F)}`)}}}catch(K){if(Y.aborted)return;let H=K instanceof Error?K.message:String(K);console.warn(`[lifecycle-watcher] ${X} watch ended: ${H}`)}if(Y.aborted)return;let W=D7(5000,250,G,2,0);G+=1,await L$(W,{signal:Y}).catch(()=>{})}}var Jm4="studio.decocms.com/sandbox-handle",Gm4=300000,Wm4=600000;var rA$=D(()=>{a$();$10();lH0()});import{createHash as Nm4}from"crypto";import{z as yX}from"zod";function vU($){let Z;try{Z=new URL($.trim())}catch{return null}if(Z.protocol!=="https:"||Z.search||Z.hash)return null;let Q=Z.pathname.replace(/\/+$/,"").replace(/\.git$/,"").replace(/\/+$/,"");return Q?`https://${Z.host.toLowerCase()}${Q}`:null}function q10($){return vU($)?.toLowerCase()??null}function wm4($){let Z=new Set;for(let Q of $){let Y=`${q10(Q.repoUrl)??Q.repoUrl}#${Q.branch}`;if(Z.has(Y))return Q;Z.add(Y)}return null}function sA$($){return $.reduce((Z,Q)=>Z+Q.replicas,0)}function eA$($,Z){if(Z.warmPoolName)return Z.warmPoolName;let Q=Nm4("sha256").update(`${Z.repoUrl}#${Z.branch}`).digest("hex").slice(0,8);return`${$}-${Q}`}function $T$($){return Math.max(0,$.size-sA$($.repos))}function lm($){return $.flatMap((Z)=>Z.repos.map((Q)=>({pool:Z,repo:Q,warmPoolName:eA$(Z.name,Q)})))}function jm4($,Z){return YT$(void 0,$,!0,Z)}function ZT$($,{templateName:Z}){let Q=jm4(Z,$.image),Y=(X,J)=>({apiVersion:`${pZ.CLAIM_API_GROUP}/${pZ.CLAIM_API_VERSION}`,kind:"SandboxWarmPool",metadata:{name:X,labels:{[Em4]:$.name}},spec:{replicas:J,updateStrategy:{type:"OnReplenish"},sandboxTemplateRef:{name:Q}}});return[...$.repos.map((X)=>Y(eA$($.name,X),X.replicas)),Y($.name,$T$($))]}function NT0($){return $.tenant?.orgId}function f51($,Z){if(!Z.tenant)return null;let Q=$.filter((J)=>J.tenant===Z.tenant&&J.image===Z.image),Y=Z.cloneUrl?q10(Z.cloneUrl):null;if(Y){let J=lm(Q).filter((W)=>q10(W.repo.repoUrl)===Y),G=J.find((W)=>W.repo.branch===Z.branch)??J[0];if(G)return G}let X=Q.find((J)=>$T$(J)>0);return X?{pool:X,repo:null,warmPoolName:X.name}:null}function QT$($,Z,Q){return $?.warmPoolName??(Z?Q:"none")}function YT$($,Z,Q=!1,Y){let X=Y&&Y!=="default"?`-${Y}`:"";return`${Z}${X}${$==="harness-run"||Q?"-medium":""}`}async function y51($){let Z=YT$($.purpose,$.templateName,$.tenantPool,$.sandboxImage);if(Z===$.templateName)return{name:Z,probes:$.probes};let Q=$.probes[Z]??null,Y=Q!==null&&$.now-Q.checkedAt<$.ttlMs?Q:{checkedAt:$.now,present:await $.exists(Z)},X={...$.probes,[Z]:Y};if(Y.present)return{name:Z,probes:X};if(Q?.present!==!1)$.onAbsent?.(Z);if($.sandboxImage&&$.sandboxImage!=="default")return y51({...$,sandboxImage:void 0,probes:X});return{name:$.templateName,probes:X}}function g51($,Z,Q){let Y=q10(Z);if(!Y)return[];let X=Q.replace(/^refs\/heads\//,"");return lm($).filter(({repo:J})=>q10(J.repoUrl)===Y&&J.branch===X)}class h51{source;dirty=new Set;pods=new Map;known=new Map;constructor($){this.source=$}pools(){return this.source()}resolve($){return f51(this.pools(),$)}markDirty($,Z){let Q=g51(this.pools(),$,Z).map((Y)=>Y.warmPoolName);for(let Y of Q)this.dirty.add(Y);return Q}takeDirty($){return this.dirty.delete($)}pod($){return this.pods.get($)}setPod($,Z){this.pods.set($,Z)}retainPods($,Z){for(let[Q,Y]of this.pods)if(Y.pool===$&&!Z.has(Q))this.pods.delete(Q)}retain($){let Z=new Map($.map((Y)=>[Y.warmPoolName,Y])),Q=[...this.known.values()].filter((Y)=>!Z.has(Y.warmPoolName));for(let Y of this.dirty)if(!Z.has(Y))this.dirty.delete(Y);for(let[Y,X]of this.pods)if(!Z.has(X.pool))this.pods.delete(Y);return this.known=Z,Q}}var Bm4=54,Dm4,Om4=2048,Lm4,M10,UT0,x51,aA$,Em4="studio.decocms.com/tenant-pool";var I10=D(()=>{i4();$10();Dm4=/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/;Lm4=yX.object({runtime:yX.enum(["node","bun","deno"]).default("node"),packageManager:yX.enum(["npm","pnpm","yarn","bun","deno"]).optional(),packageManagerPath:yX.string().optional(),devPort:yX.number().int().positive().optional()}).default({runtime:"node"}),M10=yX.object({repoUrl:yX.string().max(Om4).transform(($,Z)=>{let Q=vU($);if(Q)return Q;return Z.addIssue({code:"custom",message:"repoUrl must be an https clone URL"}),yX.NEVER}),branch:yX.string().min(1).default("main"),workload:Lm4,replicas:yX.number().int().min(1)});UT0=class UT0 extends Error{poolName;size;allocated;constructor($,Z,Q){super(`pool ${$}: repos take ${Q} replicas, more than its size ${Z}`);this.poolName=$;this.size=Z;this.allocated=Q;this.name="TenantPoolCapacityError"}};x51=yX.object({name:yX.string().max(Bm4).regex(Dm4,"pool name must be a DNS label (lowercase alphanumeric and '-')"),tenant:yX.string().min(1).max(512),size:yX.number().int().min(1),image:UU.default("default")}),aA$=x51.extend({repos:yX.array(M10).default([])}).superRefine(($,Z)=>{let Q=wm4($.repos);if(Q)Z.addIssue({code:"custom",path:["repos"],message:`duplicate repo allocation ${Q.repoUrl}#${Q.branch}`});let Y=sA$($.repos);if(Y>$.size)Z.addIssue({code:"custom",path:["repos"],message:new UT0($.name,$.size,Y).message})})});async function XT$($,Z,Q){let Y=new Map;for(let X of $){let J=Z(X);if(!J)continue;let G=Y.get(J);if(G)G.push(X);else Y.set(J,[X])}await Promise.allSettled([...Y.values()].map(async(X)=>{for(let J of X)await Q(J).catch(()=>{})}))}function zm4($){try{let Z=new URL($);if(Z.hostname.toLowerCase()!=="github.com")return null;let[Q,Y]=Z.pathname.replace(/^\/+/,"").split("/"),X=Y?.replace(/\.git$/,"");return Q&&X?`${Q}/${X}`.toLowerCase():null}catch{return null}}function JT$($){if($.repositoryId)return{repositoryId:$.repositoryId};let Z=$.connectionId?zm4($.cloneUrl):null;return $.connectionId&&Z?{connectionId:$.connectionId,repo:Z}:null}var GT$=D(()=>{I10()});async function cm($,Z,Q,Y){let X=(G)=>GT0(G.url,G.token,Z,Q),J=!(Q.body instanceof ReadableStream);try{let G=await X($);if(G.status!==401||!J)return G;let W=await Y.unauthorized();if(!W)return G;return await G.body?.cancel().catch(()=>{}),await X(W)}catch(G){if(!J)throw G;let W=await Y.unreachable();if(!W)throw G;return X(W)}}var BT0=D(()=>{Gf()});function HT$($,Z){return new Response(JSON.stringify(Z),{status:$,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function WT$($){let Z=new Headers;for(let[Q,Y]of $.headers.entries())if(!Am4.includes(Q.toLowerCase()))Z.set(Q,Y);return new Response($.body,{status:$.status,statusText:$.statusText,headers:Z})}function KT$($,Z){let Q=HT$($,{error:Z});return Q.headers.set("x-sandbox-preview-not-ready","1"),Q}async function dm($,Z,Q){let Y=await Z.base();if(!Y)return KT$(404,"sandbox not found");let X=new URL($.url);if((X.pathname==="/_sandbox"||X.pathname.startsWith("/_sandbox/"))&&$.method!=="GET")return HT$(404,{error:"not found"});let G=(F)=>`${F}${X.pathname}${X.search}`,W=new Headers($.headers);for(let F of Pm4)W.delete(F);let K=$.method!=="GET"&&$.method!=="HEAD",H={method:$.method,headers:W,body:K?$.body:void 0,redirect:"manual",signal:$.signal,duplex:K?"half":void 0};try{return WT$(await fetch(G(Y),H))}catch(F){let U=`${Y}${X.pathname}`;if(console.warn(`[${Q}] preview fetch to ${U} failed: ${F instanceof Error?F.message:String(F)}`),Z.invalidate(),$.method==="GET"||$.method==="HEAD"){let N=await Z.retryBase();if(N)try{return WT$(await fetch(G(N),H))}catch(B){console.warn(`[${Q}] preview fetch retry to ${U} failed: ${B instanceof Error?B.message:String(B)}`)}}return KT$(502,"sandbox daemon unreachable")}}var mm="x-sandbox-preview-not-ready",Pm4,Am4;var DT0=D(()=>{Pm4=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length","upgrade"],Am4=["connection","keep-alive","transfer-encoding","content-encoding","content-length"]});import{createHash as Tm4,randomBytes as Rm4,randomUUID as FT$}from"crypto";import*as wT$ from"net";import{PassThrough as qm4}from"stream";function UT$($){if($ instanceof Error)return $.message;if($&&typeof $==="object"){let Z=$;if(Z.error instanceof Error)return Z.error.message;if(typeof Z.message==="string"&&Z.message)return Z.message}return String($)}function DT$($){return{pool:$.warmPoolName,org:$.pool.tenant}}class p51{records=new Map;inflight=new Wf;activeGauge=new WT0;stateStore;previewUrlPattern;kubeConfig;capacityProbe;portForward;namespace;sandboxTemplateName;envName;tokenGenerator;idleTtlMs;metrics;previewGateway;sentinelToken;mintCloneUrl;mintPoolCloneUrl;mintOrgFsConfig;forwardPort;daemonAddress;persistCredentials;tenantPools;tenantPoolRefreshMs;templateProbes={};closed=!1;claimWatchAbort=new AbortController;constructor($={}){this.stateStore=$.stateStore??null,this.previewUrlPattern=$.previewUrlPattern??null,this.kubeConfig=$.kubeConfig??gm4(),this.portForward=new N51(this.kubeConfig),this.namespace=$.namespace??Mm4,this.sandboxTemplateName=$.sandboxTemplateName??Im4,this.envName=mm4($.envName),this.tokenGenerator=$.tokenGenerator??(()=>Rm4(km4).toString("hex")),this.idleTtlMs=$.idleTtlMs??Cm4,this.metrics=$.meter?ym4($.meter):null,this.previewGateway=$.previewGateway&&$.previewUrlPattern?{...$.previewGateway}:null;let Z=$.sentinelToken?.trim()??"";this.sentinelToken=Z.length>0?Z:null,this.mintCloneUrl=$.mintCloneUrl,this.mintPoolCloneUrl=$.mintPoolCloneUrl,this.mintOrgFsConfig=$.mintOrgFsConfig,this.forwardPort=$.forwardPort,this.daemonAddress=$.daemonAddress??"forward",this.persistCredentials=$.persistCredentials??!0;let Q=$.tenantPools;if(this.tenantPools=this.sentinelToken===null?null:new h51(typeof Q==="function"?Q:()=>Q??[]),this.sentinelToken===null&&(typeof Q==="function"||(Q?.length??0)>0))console.warn(`[${T6}] tenant pools configured without a sentinel token \u2014 ignoring them (warm-pool mode is off)`);this.tenantPoolRefreshMs=$.tenantPoolRefreshMs??vm4,this.startClaimReaper(),this.startCredentialRefresher(),this.startTenantPoolReconciler()}startClaimReaper(){let $=["app.kubernetes.io/managed-by=studio","app.kubernetes.io/name=studio-sandbox",...this.envName?[`${gX.env}=${this.envName}`]:[]].join(",");oA$({kc:this.kubeConfig,namespace:this.namespace,labelSelector:$,signal:this.claimWatchAbort.signal,onDelete:(Z)=>this.invalidateRecord(Z)})}async ensure($,Z={}){let Q=N3($);if(Q.startsWith("s-"))throw Error(`ensure: projectRef has no slug source: ${$.projectRef}`);return this.inflight.run(Q,()=>KT0(this.stateStore,$,(Y)=>this.ensureLocked($,Q,Z,Y)))}async delete($){let Z=await this.getRecord($);if(this.records.delete($),Z)this.dropRecord(Z);if(await this.deleteHttpRouteIfManaged($).catch((Q)=>{console.warn(`[${T6}] HTTPRoute delete failed for ${$}: ${Q instanceof Error?Q.message:String(Q)}`)}),await vA(this.kubeConfig,this.namespace,$),this.stateStore)if(Z)await this.stateStore.delete(Z.id);else await this.stateStore.deleteByHandle($)}lastTermination($){return sL$(this.kubeConfig,this.namespace,gX.sandboxHandle,$,pZ.MAIN_CONTAINER_NAME)}async alive($){return await jD(this.kubeConfig,this.namespace,$)!==void 0}watchClaimLifecycle($,Z){return nA$({kc:this.kubeConfig,namespace:this.namespace,claimName:$,signal:Z})}hasSchedulableCapacity(){return this.capacityProbe??=Kw$(this.kubeConfig,this.namespace),this.capacityProbe()}async getPreviewUrl($){let Z=await this.getRecord($);if(!Z)return null;return this.composePreviewUrl(Z)}async proxyDaemonRequest($,Z,Q){let Y=await this.getRecord($);if(!Y&&this.previewUrlPattern&&this.stateStore){let K=await this.stateStore.getByHandle($),H=K?.state,F=H?.token;if(K&&F){let N=`http://${H?.adoptedSandboxName??$}.${this.namespace}.svc.cluster.local:${bU}`;try{let B=await GT0(N,F,Z,Q);if(B.status!==404)return B;try{await B.body?.cancel()}catch{}}catch{}}}if(!Y)Y=await this.resurrectByHandle($);if(!Y)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let X=Y,J=performance.now(),G=0,W=(K)=>{return X=K,{url:K.daemonUrl,token:K.token}};try{let K=await cm(W(Y),Z,Q,{unauthorized:async()=>{this.invalidateRecord($);let H=await this.getRecord($).catch(()=>null)??await this.resurrectByHandle($).catch(()=>null);return H?W(H):null},unreachable:async()=>{this.invalidateRecord($);let H=await this.resurrectByHandle($)??await this.getRecord($).catch(()=>null);return H?W(H):null}});return G=K.status,K}finally{this.recordProxyDuration("daemon",G,X,performance.now()-J)}}async adoptLiveClaim($,Z){if(this.records.has(Z))return!0;let Q=await jD(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!Q||Q.metadata?.deletionTimestamp)return!1;return await this.inflight.run(Z,async()=>{let X=this.records.get(Z);if(X)return this.toSandbox(X);let J=await this.adopt($,Z,Q);if(!J)throw Error(`cannot adopt live claim ${Z}`);return KT0(this.stateStore,$,(G)=>this.finish(J,G,!0,!0,"adopt"))}).catch(()=>null)!=null}async resolvePreviewUpstreamUrl($){if(this.previewUrlPattern)return`http://${await this.resolveServiceNameForHandle($)}.${this.namespace}.svc.cluster.local:${bU}`;let Z=await this.getRecord($);if(Z)return Z.daemonUrl;let Q=await this.resurrectByHandle($);return Q?Q.daemonUrl:null}async daemonEndpoint($){let Z=await this.getRecord($)??await this.resurrectByHandle($);if(!Z)return null;return{url:this.daemonAddress==="service"?`http://${Z.adoptedSandboxName}.${this.namespace}.svc.cluster.local:${bU}`:Z.daemonUrl,token:Z.token}}listSandboxes(){return[...this.records.values()].map(($)=>{let Z=$.ensureOpts,Q=Z?.tenant;return{handle:$.handle,tenant:Q?{orgId:Q.orgId,userId:Q.userId}:null,repos:[Z?.repo,...Z?.extraRepos??[]].filter((Y)=>Y!==void 0).map(JT$).filter((Y)=>Y!==null),orgFs:Boolean(Z?.orgFsConfigJson)||$.orgFsRedacted===!0}})}async resolveServiceNameForHandle($){let Z=this.records.get($);if(Z)return Z.adoptedSandboxName;if(this.stateStore){let Y=(await this.stateStore.getByHandle($).catch(()=>null))?.state?.adoptedSandboxName;if(Y)return Y}return $}async proxyPreviewRequest($,Z){let Q=performance.now(),Y=this.records.get($)??null,X=0;try{let J=await dm(Z,{base:()=>this.resolvePreviewUpstreamUrl($),invalidate:()=>this.invalidateRecord($),retryBase:async()=>{return await this.resurrectByHandle($).catch(()=>null)?this.resolvePreviewUpstreamUrl($):null}},T6);return X=J.status,J}finally{this.recordProxyDuration("preview",X,Y,performance.now()-Q,$)}}async ensureLocked($,Z,Q,Y){if(Q.image)console.warn(`[${T6}] opts.image ignored (template ${this.sandboxTemplateName} pins image): got ${Q.image}`);if(Y){let G=await Y.get($);if(G){let W=await this.rehydrate($,Z,G);if(W)return await this.refreshDaemonGitCredential(W,Q),await this.relayOrgFsConfig(W.daemonUrl,W.token,Q.orgFsConfigJson),this.finish(W,Y,!1,!0,"resume");await Y.delete($)}}let X=await jD(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(X)if(X.metadata?.deletionTimestamp)await Y10(this.kubeConfig,this.namespace,Z).catch((G)=>{console.warn(`[${T6}] wait for terminating claim ${Z} failed: ${G instanceof Error?G.message:String(G)}`)});else if(!u51(X)){let G=await this.join($,Z,Q,X).catch((W)=>{return console.warn(`[${T6}] join of starting claim ${Z} failed, recreating: ${W instanceof Error?W.message:String(W)}`),null});if(G)return this.finish(G,Y,!0,!0,"adopt");await vA(this.kubeConfig,this.namespace,Z).catch(()=>{}),await Y10(this.kubeConfig,this.namespace,Z).catch((W)=>{console.warn(`[${T6}] wait for deleted claim ${Z} failed: ${W instanceof Error?W.message:String(W)}`)})}else{let G=await this.adopt($,Z,X).catch((W)=>{return console.warn(`[${T6}] adopt ${Z} failed, recreating: ${W instanceof Error?W.message:String(W)}`),null});if(G)return await this.refreshDaemonGitCredential(G,Q),await this.relayOrgFsConfig(G.daemonUrl,G.token,Q.orgFsConfigJson),this.finish(G,Y,!0,!0,"adopt");await vA(this.kubeConfig,this.namespace,Z).catch(()=>{}),await Y10(this.kubeConfig,this.namespace,Z).catch((W)=>{console.warn(`[${T6}] wait for deleted claim ${Z} failed: ${W instanceof Error?W.message:String(W)}`)})}let J=await this.provision($,Z,Q);return this.finish(J,Y,!0,!1,"fresh")}async finish($,Z,Q,Y,X){let J=this.records.get($.handle),G=J!==void 0;if(J&&J.daemonForward!==$.daemonForward)this.closeForwarder(J.daemonForward);if(this.records.set($.handle,$),Q)await this.persist(Z,$);if(Y)await uH0(this.kubeConfig,this.namespace,$.handle,this.computeShutdownTime()).catch((W)=>console.warn(`[${T6}] TTL refresh failed for ${$.handle}: ${W instanceof Error?W.message:String(W)}`));if(this.metrics){let W=m51($.tenant);if(this.metrics.ensureOutcome.add(1,{...W,outcome:X}),!G)this.metrics.active.add(1,W),this.activeGauge.markCounted($.handle)}return this.toSandbox($)}buildEnvMap($,Z){let Q={},Y=[];for(let[X,J]of Object.entries($.env??{}))if(Sm4.has(X))Y.push(X);else Q[X]=J;if(Y.length>0)console.warn(`[${T6}] opts.env keys overlap reserved bootstrap names and were dropped: ${Y.join(",")}`);return{...Q,DAEMON_TOKEN:Z.token,DAEMON_BOOT_ID:Z.daemonBootId,APP_ROOT:Z.workdir,PROXY_PORT:String(bU)}}async resolveTemplateName($,Z,Q){let{name:Y,probes:X}=await y51({purpose:$,tenantPool:Z,...Q?{sandboxImage:Q}:{},templateName:this.sandboxTemplateName,probes:this.templateProbes,now:Date.now(),ttlMs:Vm4,exists:(J)=>nL$(this.kubeConfig,this.namespace,J),onAbsent:(J)=>console.warn(`[${T6}] SandboxTemplate ${J} not found (or not readable) \u2014 this claim falls back to a template without that suffix. Upgrade the sandbox-env chart to the version that renders it.`)});return this.templateProbes=X,Y}buildClaim($,Z,Q,Y,X){let J=this.sentinelToken!==null,G=J?[]:Object.entries(this.buildEnvMap(Z,Q)).sort(([H],[F])=>H<F?-1:H>F?1:0).map(([H,F])=>({name:H,value:F})),W=pm4(Z),K=Object.keys(W).length>0;return{apiVersion:`${pZ.CLAIM_API_GROUP}/${pZ.CLAIM_API_VERSION}`,kind:"SandboxClaim",metadata:{name:$,namespace:this.namespace,labels:{"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[gX.env]:this.envName}:{},...c51(Z.tenant)},...K?{annotations:W}:{}},spec:{sandboxTemplateRef:{name:X},additionalPodMetadata:{labels:c51(Z.tenant,{[gX.role]:"claimed",[gX.sandboxHandle]:$,...this.envName?{[gX.env]:this.envName}:{}}),...K?{annotations:W}:{}},env:G,warmpool:QT$(Y,J,X),lifecycle:{shutdownPolicy:"Delete",shutdownTime:this.computeShutdownTime()}}}}async provision($,Z,Q){let Y=this.tokenGenerator(),X=FT$(),J=OT0,G=this.claimTenantPoolBinding(Q),W=this.buildClaim(Z,Q,{token:Y,daemonBootId:X,workdir:J},G,await this.resolveTemplateName(Q.purpose,G!==null,Q.sandboxImage));try{await v41(this.kubeConfig,this.namespace,W)}catch(K){if(K instanceof e00)await Y10(this.kubeConfig,this.namespace,Z),await v41(this.kubeConfig,this.namespace,W);else throw K}return this.bind($,Z,Q,G,{token:Y,daemonBootId:X,workdir:J})}claimTenantPoolBinding($){return this.tenantPools?.resolve({tenant:NT0($),image:$.sandboxImage??"default",cloneUrl:$.repo?.cloneUrl,branch:$.repo?.branch})??null}async bind($,Z,Q,Y,{token:X,daemonBootId:J,workdir:G}){let W;try{W=await tL$(this.kubeConfig,this.namespace,Z),await tA$((B)=>this.watchClaimLifecycle(Z,B))}catch(B){throw await vA(this.kubeConfig,this.namespace,Z).catch(()=>{}),B}try{await this.ensureServicePortForAdoptedSandbox(W),await this.ensureHttpRouteForHandle(Z,W,Q.tenant??null)}catch(B){throw await vA(this.kubeConfig,this.namespace,Z).catch(()=>{}),B}let K=await this.openForwarder(W,bU,Z),H=`http://127.0.0.1:${K.localPort}`,F=Y?.repo!=null&&W!==Z,U=this.workloadConfigPayload(Q,F),N=J;try{if(await _51(H),this.sentinelToken!==null){let B=await JT0(H);if(B)N=B.bootId;try{await _U(H,this.sentinelToken,U??{},{rotateToken:X})}catch(O){if(O instanceof PH&&O.status===401)console.warn(`[${T6}] sentinel rejected by adopted pod (handle=${Z}, sandbox=${W}): pod belongs to another claim; tearing down and reprovisioning`);throw O}}else if(U)await _U(H,X,U);await this.relayOrgFsConfig(H,X,Q.orgFsConfigJson)}catch(B){throw this.closeForwarder(K),await this.deleteHttpRouteIfManaged(Z).catch(()=>{}),await vA(this.kubeConfig,this.namespace,Z).catch(()=>{}),B}return{id:$,handle:Z,adoptedSandboxName:W,token:X,workdir:G,daemonUrl:H,daemonForward:K,workload:Q.workload??null,daemonBootId:N,tenant:Q.tenant??null,tenantPoolPodBound:F,ensureOpts:am4(Q)}}workloadConfigPayload($,Z){return hm({runtime:$?.workload?.runtime??"node",packageManager:$?.workload?.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:$?.repo??null,extraRepos:$?.extraRepos??[],port:$?.workload?.devPort??NT$,tenant:$?.tenant??void 0,...$?{cloneOnly:$.cloneOnly===!0&&!Z}:{}})}async relayOrgFsConfig($,Z,Q){if(!Q)return;await A10($,Z,Q).catch((Y)=>console.warn("[org-fs] sidecar config relay failed",Y))}async refreshDaemonGitCredential($,Z){let Q=R10(Z);if(!Q)return;try{await _U($.daemonUrl,$.token,Q)}catch(Y){console.warn(`[${T6}] git credential refresh failed for ${$.handle}: ${Y instanceof Error?Y.message:String(Y)}`)}}async withFreshCloneUrl($,Z={}){if(!this.mintCloneUrl)return $;try{let Q=await this.mintCloneUrl($,Z);if(!Q)return $;let{credentialExpiresAt:Y,...X}=$;return{...X,cloneUrl:Q}}catch(Q){return console.warn(`[${T6}] clone credential re-mint failed: ${Q instanceof Error?Q.message:String(Q)}`),$}}async withFreshCredentials($,Z=!1){return{...$,...$.repo?{repo:await this.withFreshCloneUrl($.repo,{tenant:$.tenant})}:{},...$.orgFsConfigJson||Z?{orgFsConfigJson:await rm4($,this.mintOrgFsConfig)}:{}}}startCredentialRefresher(){if(!this.mintCloneUrl)return;let{signal:$}=this.claimWatchAbort;(async()=>{while(!$.aborted){if(await L$(bm4,{signal:$}).catch(()=>{}),$.aborted)break;try{await this.refreshAllGitCredentials()}catch(Z){console.warn(`[${T6}] periodic credential refresh failed: ${Z instanceof Error?Z.message:String(Z)}`)}}})()}startTenantPoolReconciler(){let $=this.tenantPools;if(!$)return;let{signal:Z}=this.claimWatchAbort;(async()=>{while(!Z.aborted){try{await this.reconcileTenantPools($)}catch(Q){console.warn(`[${T6}] tenant pool reconcile failed: ${Q instanceof Error?Q.message:String(Q)}`)}await L$(_m4,{signal:Z}).catch(()=>{})}})()}listTenantPools(){return this.tenantPools?.pools()??[]}markTenantPoolsDirty($,Z){return Promise.resolve(this.tenantPools?.markDirty($,Z)??[])}async reconcileTenantPools($){let Z=lm($.pools());for(let Q of $.retain(Z))this.recordPoolGone(Q);for(let Q of Z){let Y=Q.warmPoolName,X=await oL$(this.kubeConfig,this.namespace,Y);if(X===null){console.warn(`[${T6}] tenant pool ${Y}: no SandboxWarmPool (or no selector yet) in ${this.namespace}`);continue}let J=$.takeDirty(Y),G=X.filter((W)=>!W.labels[gX.sandboxHandle]);$.retainPods(Y,new Set(X.map((W)=>W.uid)));for(let W of G){if(this.claimWatchAbort.signal.aborted)return;await this.warmPoolPod($,Q,W,J)}this.recordPoolDepth($,Q,X,G)}}recordPoolGone($){let Z=DT$($);for(let Q of["ready","bound","pending","failed"])this.metrics?.poolPods.record(0,{...Z,state:Q})}recordPoolDepth($,Z,Q,Y){let X=this.metrics?.poolPods;if(!X)return;let J=0,G=0;for(let K of Y){let H=$.pod(K.uid);if(!H)continue;if(H.failures>=LT0)G++;else if(H.lastConfigAt>0)J++}let W=DT$(Z);X.record(J,{...W,state:"ready"}),X.record(Q.length-Y.length,{...W,state:"bound"}),X.record(Y.length-J-G,{...W,state:"pending"}),X.record(G,{...W,state:"failed"})}async warmPoolPod($,Z,Q,Y){let X=Z.warmPoolName,{workload:J}=Z.repo,G=$.pod(Q.uid);if(G&&G.failures>=LT0){if(Date.now()-G.lastFailureAt<BT$)return;$.setPod(Q.uid,{...G,failures:0})}let W=Y||G!==void 0&&Date.now()-G.lastConfigAt>=this.tenantPoolRefreshMs;if(G&&!W)return;let K=await this.allocationCloneUrl(Z);if(!K){this.recordPoolFailure($,Q,X,"clone credential mint failed");return}let H={cloneUrl:K,branch:Z.repo.branch,userName:"",userEmail:""},F=await this.openForwarder(Q.name,bU,Q.name).catch(()=>null);if(!F){this.recordPoolFailure($,Q,X,"port-forward failed");return}let U=`http://127.0.0.1:${F.localPort}`;try{await _51(U);let N=this.sentinelToken;if(!N)return;if(!await this.isPoolPodUnbound(Q))return;let B=hm({runtime:J.runtime,packageManager:J.packageManager?{name:J.packageManager,...J.packageManagerPath?{path:J.packageManagerPath}:{}}:null,repo:H,port:J.devPort??NT$})??{},{transition:O}=await _U(U,N,B);if(W&&O!=="bootstrap"&&await this.isPoolPodUnbound(Q))await hA$(U,N,"clone");$.setPod(Q.uid,{pool:X,lastConfigAt:Date.now(),lastFailureAt:0,failures:0}),console.log(`[${T6}] tenant pool ${X}: warmed ${Q.name} (${O})`)}catch(N){this.recordPoolFailure($,Q,X,N instanceof Error?N.message:String(N))}finally{this.closeForwarder(F)}}async allocationCloneUrl({pool:$,repo:Z}){if(!this.mintPoolCloneUrl)return`${Z.repoUrl}.git`;try{return await this.mintPoolCloneUrl({tenant:$.tenant,repoUrl:Z.repoUrl,branch:Z.branch})}catch(Q){return console.warn(`[${T6}] tenant pool clone credential mint failed: ${Q instanceof Error?Q.message:String(Q)}`),null}}isPoolPodUnbound($){return rL$(this.kubeConfig,this.namespace,$.name,gX.sandboxHandle)}recordPoolFailure($,Z,Q,Y){let X=$.pod(Z.uid),J=(X?.failures??0)+1;$.setPod(Z.uid,{pool:Q,lastConfigAt:X?.lastConfigAt??0,lastFailureAt:Date.now(),failures:J});let G=J>=LT0?` \u2014 backing off ${BT$/60000}min`:"";console.warn(`[${T6}] tenant pool ${Q}: warming ${Z.name} failed (${J}/${LT0})${G}: ${Y}`)}async refreshAllGitCredentials(){await XT$(this.records.values(),($)=>$.ensureOpts?.repo?.connectionId,async($)=>{if(this.claimWatchAbort.signal.aborted)return;let Z=$.ensureOpts?.repo;if(!Z)return;try{let Q=await this.withFreshCloneUrl(Z,{bufferMs:xm4,tenant:$.ensureOpts?.tenant});await this.refreshDaemonGitCredential($,{...$.ensureOpts,repo:Q}),$.ensureOpts={...$.ensureOpts,repo:Q}}catch(Q){throw console.warn(`[${T6}] git credential refresh failed for ${$.handle}: ${Q instanceof Error?Q.message:String(Q)}`),Q}})}async rebootstrapDaemon($,Z,Q){if(this.sentinelToken===null)return!1;let Y=this.workloadConfigPayload(Q,!1)??{};try{return await _U($,this.sentinelToken,Y,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,Q?.orgFsConfigJson),!0}catch(X){if(X instanceof PH&&X.status===401)try{return await _U($,Z,Y,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,Q?.orgFsConfigJson),!0}catch(J){return console.warn(`[${T6}] re-bootstrap retry with claim token failed: ${J instanceof Error?J.message:String(J)}`),!1}return console.warn(`[${T6}] re-bootstrap failed: ${X instanceof Error?X.message:String(X)}`),!1}}async ensureServicePortForAdoptedSandbox($){if(!this.previewGateway||!this.previewUrlPattern)return;await Jw$(this.kubeConfig,this.namespace,$,{name:"daemon",port:bU,targetPort:bU})}async ensureHttpRouteForHandle($,Z,Q){if(!this.previewGateway||!this.previewUrlPattern)return;let Y=em4(this.previewUrlPattern,$);if(!Y)throw new xY(`Unable to derive preview hostname for ${$} from pattern: ${this.previewUrlPattern}`);let X={apiVersion:`${x41.API_GROUP}/${x41.API_VERSION}`,kind:"HTTPRoute",metadata:{name:$,namespace:this.namespace,labels:c51(Q??void 0,{[gX.role]:"claimed",[gX.sandboxHandle]:$,"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[gX.env]:this.envName}:{}})},spec:{parentRefs:[{kind:"Gateway",group:"gateway.networking.k8s.io",name:this.previewGateway.name,namespace:this.previewGateway.namespace}],hostnames:[Y],rules:[{backendRefs:[{group:"",kind:"Service",name:Z,port:bU}]}]}};await Qw$(this.kubeConfig,this.namespace,X)}async deleteHttpRouteIfManaged($){if(!this.previewGateway)return;await Yw$(this.kubeConfig,this.namespace,$)}async rehydrate($,Z,Q){let Y=Q.state;if(!Y.adoptedSandboxName&&!Y.podName||!Y.token)return null;let X=await jD(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!X||!u51(X))return null;let J=X.status?.sandbox?.name??Y.adoptedSandboxName??Y.podName??Z,G=await this.openAndProbeDaemon(J,Z);if(!G)return null;if(Y.daemonBootId&&Y.daemonBootId!==G.bootId){if(this.sentinelToken!==null){let W=Y.ensureOpts?await this.withFreshCredentials(Y.ensureOpts,Y.orgFsRedacted===!0):null;if(!await this.rebootstrapDaemon(G.daemonUrl,Y.token,W))return this.closeForwarder(G.daemonForward),null}else console.warn(`[${T6}] daemon restart detected (handle=${Z}): stored bootId=${Y.daemonBootId} live bootId=${G.bootId}`);await this.stateStore?.put($,{handle:Z,state:{...Y,daemonBootId:G.bootId}}).catch((W)=>console.warn(`[${T6}] bootId persist failed for ${Z}: ${W instanceof Error?W.message:String(W)}`))}return{id:$,handle:Z,adoptedSandboxName:J,tenantPoolPodBound:!1,token:Y.token,workdir:Y.workdir??OT0,daemonUrl:G.daemonUrl,daemonForward:G.daemonForward,workload:Y.workload??null,daemonBootId:G.bootId,tenant:Y.tenant??null,ensureOpts:Y.ensureOpts??null,orgFsRedacted:Y.orgFsRedacted===!0}}join($,Z,Q,Y){let X=this.sentinelToken!==null,J=X?this.tokenGenerator():l51(Y,"DAEMON_TOKEN"),G=X?FT$():l51(Y,"DAEMON_BOOT_ID");if(!J||!G)throw new xY(`claim ${Z} carries no daemon token`);return this.bind($,Z,Q,this.claimTenantPoolBinding(Q),{token:J,daemonBootId:G,workdir:OT0})}async adopt($,Z,Q){if(!u51(Q))return null;let Y=Q.status?.sandbox?.name??Z;if(this.sentinelToken!==null)return null;let X=l51(Q,"DAEMON_TOKEN");if(!X)return null;let J=await this.openAndProbeDaemon(Y,Z);if(!J)return null;let G=nm4(Q);if(this.previewGateway)await this.ensureServicePortForAdoptedSandbox(Y).catch((W)=>{console.warn(`[${T6}] Service port backfill failed for ${Z}: ${W instanceof Error?W.message:String(W)}`)}),await this.ensureHttpRouteForHandle(Z,Y,G).catch((W)=>{console.warn(`[${T6}] HTTPRoute backfill failed for ${Z}: ${W instanceof Error?W.message:String(W)}`)});return{id:$,handle:Z,adoptedSandboxName:Y,tenantPoolPodBound:!1,token:X,workdir:OT0,daemonUrl:J.daemonUrl,daemonForward:J.daemonForward,workload:null,daemonBootId:J.bootId,tenant:G,ensureOpts:null}}async openAndProbeDaemon($,Z){let Q=await this.openForwarder($,bU,Z).catch(()=>null);if(!Q)return null;let Y=`http://127.0.0.1:${Q.localPort}`,X=await JT0(Y);if(!X)return this.closeForwarder(Q),null;return{daemonForward:Q,daemonUrl:Y,bootId:X.bootId}}async getRecord($){let Z=this.records.get($);if(Z)return Z;if(!this.stateStore)return null;let Q=await this.stateStore.getByHandle($);if(!Q)return null;let Y=await this.rehydrate(Q.id,$,Q);if(Y)this.records.set($,Y);return Y}async resurrectByHandle($){if(!this.stateStore)return null;let Z=await this.stateStore.getByHandle($);if(!Z)return null;let Q=Z.state,Y=Q.ensureOpts;if(!Y)return null;let X=await this.withFreshCredentials(Y,Q.orgFsRedacted===!0);if(N3(Z.id)!==$)return null;return await this.ensure(Z.id,X),this.records.get($)??null}invalidateRecord($){let Z=this.records.get($);if(!Z)return;this.records.delete($),this.dropRecord(Z)}dropRecord($){if(this.closeForwarder($.daemonForward),this.metrics&&this.activeGauge.consume($.handle))this.metrics.active.add(-1,m51($.tenant))}recordProxyDuration($,Z,Q,Y,X){if(!this.metrics)return;this.metrics.proxyDurationMs.record(Y,{...m51(Q?.tenant??null),source:$,sandbox_handle:Q?.handle??X??"",status_code:Z||0})}composePreviewUrl($){if(this.previewUrlPattern)return HT0(this.previewUrlPattern,$.handle);return`http://127.0.0.1:${$.daemonForward.localPort}/`}toSandbox($){return{handle:$.handle,workdir:$.workdir,previewUrl:this.composePreviewUrl($),warmPoolAdopted:$.tenantPoolPodBound===!0,provider:"kubernetes"}}async persist($,Z){if(!$)return;let Q={adoptedSandboxName:Z.adoptedSandboxName,token:Z.token,workdir:Z.workdir,workload:Z.workload,daemonBootId:Z.daemonBootId,tenant:Z.tenant,...Z.ensureOpts?this.persistCredentials?{ensureOpts:Z.ensureOpts}:sm4(Z.ensureOpts,Z.orgFsRedacted===!0):{}};await $.put(Z.id,{handle:Z.handle,state:Q})}computeShutdownTime(){return new Date(Date.now()+this.idleTtlMs).toISOString()}async releaseAfter($,Z){let Q=await jD(this.kubeConfig,this.namespace,$);if(!Q)return;let Y=tm4(Q.spec?.lifecycle?.shutdownTime,new Date(Date.now()+Z));if(!Y)return;await uH0(this.kubeConfig,this.namespace,$,Y).catch((X)=>console.warn(`[${T6}] release failed for ${$}: ${X instanceof Error?X.message:String(X)}`))}async renewTtl($){let Z=await jD(this.kubeConfig,this.namespace,$);if(!Z)return;let Q=om4(Z.spec?.lifecycle?.shutdownTime,new Date(Date.now()+this.idleTtlMs));if(!Q)return;await uH0(this.kubeConfig,this.namespace,$,Q).catch((Y)=>console.warn(`[${T6}] TTL renew failed for ${$}: ${Y instanceof Error?Y.message:String(Y)}`))}openForwarder($,Z,Q=$){if(this.forwardPort)return this.forwardPort($,Z,Q);let Y=hm4(Q,Z);return new Promise((X,J)=>{let G=(W,K)=>{let H=wT$.createServer((F)=>this.handleForwardedConnection(F,$,Z,Q));H.once("error",(F)=>{if(F.code==="EADDRINUSE"&&K<fm4){try{H.close()}catch{}let U=d51+(W-d51+1)%jT$;G(U,K+1);return}J(F)}),H.listen(W,"127.0.0.1",()=>{let F=H.address();if(!F||typeof F==="string"){H.close(),J(Error("port-forward listener failed to bind"));return}let U=F.port;X({localPort:U,close:()=>H.close((N)=>{if(N)console.warn(`[${T6}] port-forward close on :${U} errored: ${N.message}`)})})})};G(Y,0)})}handleForwardedConnection($,Z,Q,Y){let X=new qm4,J=null,G=!1,W=()=>{if(G)return;if(G=!0,X.destroy(),J)try{J.close()}catch{}if(!$.destroyed)$.destroy()};$.pipe(X),$.on("error",W),$.on("close",W),this.portForward.portForward(this.namespace,Z,[Q],$,null,X).then((K)=>{let H=typeof K==="function"?K():K;if(!H){W();return}if(J=H,J.on("close",W),J.on("error",(F)=>{console.warn(`[${T6}] port-forward to ${Z}:${Q} dropped mid-connection: ${UT$(F)}`,JSON.stringify(i51(F))),this.invalidateRecord(Y),W()}),G)try{J.close()}catch{}}).catch((K)=>{console.warn(`[${T6}] port-forward to ${Z}:${Q} failed: ${UT$(K)}`,JSON.stringify(i51(K))),this.invalidateRecord(Y),W()})}closeForwarder($){$.close()}close(){if(this.closed)return;this.closed=!0,this.claimWatchAbort.abort();for(let $ of this.records.values())this.dropRecord($);this.records.clear()}}function ym4($){return{active:$.createUpDownCounter("studio.sandbox.active",{description:"Active sandbox count, by runner kind, owning org, and daemon impl. Cross-checks the cAdvisor-derived count from the cluster \u2014 divergence between the two indicates orphaned claims (studio deleted but K8s didn't reap) or unattributed pods.",unit:"{sandbox}"}),ensureOutcome:$.createCounter("studio.sandbox.ensure.outcome",{description:"Outcome of each ensure() call: fresh provision, resume from state-store after restart, or adopt of a cluster-side claim studio didn't know about. Cold-start ratio is the primary input for warm-pool sizing.",unit:"{call}"}),proxyDurationMs:$.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of studio-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"}),poolPods:$.createGauge("studio.sandbox.pool.pods",{description:"Tenant warm pool depth by pool and state: ready (warmed and unbound \u2014 what a claim can actually bind instantly), bound (serving a user), pending (unbound, not yet warmed), failed (gave up after repeated bootstrap failures). Alert on sustained ready=0: a pool that is always empty is doing nothing while costing N pods.",unit:"{pod}"})}}function i51($){let Z=[],Q=$;for(let Y=0;Y<5&&Q instanceof Error;Y++){let X=Q;if(Z.push({name:X.name,message:X.message,...X.code!==void 0?{code:X.code}:{},...X.errno!==void 0?{errno:X.errno}:{}}),X.cause===Q)break;Q=X.cause}if(Q!==void 0&&!(Q instanceof Error)&&Q!==null){let Y=Q,X=Y.error instanceof Error?i51(Y.error).chain:void 0;Z.push({nonError:String(Q),...typeof Y.type==="string"?{type:Y.type}:{},...typeof Y.message==="string"?{message:Y.message}:{},...Y.code!==void 0?{code:Y.code}:{},...typeof Y.reason==="string"?{reason:Y.reason}:{},...X?{error:X}:{},...X===void 0&&Y.error!==void 0?{rawError:String(Y.error)}:{},keys:Object.keys(Y)})}return{chain:Z}}function gm4(){let $=new lA0;return $.loadFromDefault(),$}function u51($){return Boolean($.status?.conditions?.some((Z)=>Z.type==="Ready"&&Z.status==="True"))}function l51($,Z){let Q=$.spec?.env;if(!Q)return null;for(let Y of Q)if(Y.name===Z&&Y.value)return Y.value;return null}function hm4($,Z){let Q=Tm4("sha256").update(`${$}:${Z}`).digest();return d51+Q.readUInt32BE(0)%jT$}function OT$($){let Z=$.slice(0,lm4);return um4.test(Z)?Z:""}function mm4($){if($===void 0)return null;let Z=$.trim();if(Z==="")return null;if(!cm4.test(Z))throw Error(`AgentSandboxProvider: envName=${JSON.stringify(Z)} is not a valid DNS-label-safe environment name (lowercase alphanumeric or '-', starts with a letter, ends alphanumeric, \u226432 chars). Studio sets this from STUDIO_ENV; check the studio chart's configMap.`);return Z}function c51($,Z={}){let Q={...Z};if($){let Y=OT$($.orgId),X=OT$($.userId);if(Y)Q[gX.orgId]=Y;if(X)Q[gX.userId]=X}return Q}function Kf($){let Z="";for(let Q of $){let Y=Q.codePointAt(0)??0;Z+=Y<32||Y===127?" ":Q}return Z.slice(0,dm4)}function im4($){try{let Z=new URL($);return Z.username="",Z.password="",Z.toString()}catch{return""}}function pm4($){let Z={},Q=$.tenant;if(Q?.orgSlug)Z[AH.orgSlug]=Kf(Q.orgSlug);if(Q?.orgName)Z[AH.orgName]=Kf(Q.orgName);if(Q?.userEmail)Z[AH.userEmail]=Kf(Q.userEmail);if(Q?.userName)Z[AH.userName]=Kf(Q.userName);let Y=$.repo;if(Y){if(Y.displayName)Z[AH.gitRepo]=Kf(Y.displayName);let X=im4(Y.cloneUrl);if(X)Z[AH.gitRepoUrl]=Kf(X);let J=$.branch??Y.branch;if(J)Z[AH.gitBranch]=Kf(J)}return Z}function nm4($){let Z=$.metadata?.labels;if(!Z)return null;let Q=Z[gX.orgId],Y=Z[gX.userId];if(!Q||!Y)return null;let X=$.metadata?.annotations??{};return{orgId:Q,userId:Y,orgSlug:X[AH.orgSlug],orgName:X[AH.orgName],userEmail:X[AH.userEmail],userName:X[AH.userName]}}function tm4($,Z){if($){let Q=new Date($).getTime();if(Number.isFinite(Q)&&Q<=Z.getTime())return null}return Z.toISOString()}function om4($,Z){if($){let Q=new Date($).getTime();if(Number.isFinite(Q)&&Q>=Z.getTime())return null}return Z.toISOString()}function m51($){return{org_id:$?.orgId??"",user_id:$?.userId??"",runner_kind:"agent-sandbox"}}async function rm4($,Z){if(!Z||!$.tenant)return $.orgFsConfigJson;try{return await Z($.tenant)??$.orgFsConfigJson}catch(Q){return console.warn(`[${T6}] org-fs credential re-mint failed: ${Q instanceof Error?Q.message:String(Q)}`),$.orgFsConfigJson}}function LT$($){try{let Z=new URL($.cloneUrl);Z.username="",Z.password="";let{submoduleCredentials:Q,credentialExpiresAt:Y,...X}=$;return{...X,cloneUrl:Z.toString()}}catch{return null}}function sm4($,Z){let{orgFsConfigJson:Q,repo:Y,extraRepos:X,...J}=$,G=J,W=Y&&LT$(Y);if(W)G.repo=W;if(X)G.extraRepos=X.map(LT$).filter((K)=>K!==null);return Q||Z?{ensureOpts:G,orgFsRedacted:!0}:{ensureOpts:G}}function am4($){let Z={};if($.branch)Z.branch=$.branch;if($.repo)Z.repo=$.repo;if($.workload)Z.workload=$.workload;if($.env&&Object.keys($.env).length>0)Z.env=$.env;if($.tenant)Z.tenant=$.tenant;if($.cloneOnly)Z.cloneOnly=!0;if($.purpose)Z.purpose=$.purpose;if($.sandboxImage)Z.sandboxImage=$.sandboxImage;if($.orgFsConfigJson)Z.orgFsConfigJson=$.orgFsConfigJson;return Object.keys(Z).length>0?Z:null}function em4($,Z){try{return new URL(HT0($,Z)).hostname||null}catch{return null}}var T6="AgentSandboxProvider",Mm4="agent-sandbox-system",Im4="studio-sandbox",Vm4=300000,bU=9000,NT$=3000,OT0="/app",km4=32,Sm4,Cm4=900000,_m4=60000,vm4=1800000,LT0=3,BT$=1800000,bm4=900000,xm4=1800000,d51=40000,jT$=1e4,fm4=256,gX,AH,um4,lm4=63,cm4,dm4=253;var ET$=D(()=>{a$();Hw$();bA$();Gf();um();lH0();$10();rA$();I10();GT$();BT0();DT0();Sm4=new Set(["DAEMON_TOKEN","DAEMON_BOOT_ID","APP_ROOT","PROXY_PORT"]);gX={role:"studio.decocms.com/role",sandboxHandle:"studio.decocms.com/sandbox-handle",orgId:"studio.decocms.com/org-id",userId:"studio.decocms.com/user-id",env:"studio.decocms.com/env"},AH={orgSlug:"studio.decocms.com/org-slug",orgName:"studio.decocms.com/org-name",userEmail:"studio.decocms.com/user-email",userName:"studio.decocms.com/user-name",gitRepo:"studio.decocms.com/git-repo",gitRepoUrl:"studio.decocms.com/git-repo-url",gitBranch:"studio.decocms.com/git-branch"},um4=/^([A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?)?$/;cm4=/^[a-z]([a-z0-9-]{0,30}[a-z0-9])?$/});var zT$={};Z6(zT$,{tenantPoolSchema:()=>aA$,tenantPoolRepoSchema:()=>M10,tenantPoolFieldsSchema:()=>x51,tenantPoolAllocations:()=>lm,resolveTenantPoolBinding:()=>f51,renderTenantPoolWarmPools:()=>ZT$,normalizeRepoUrl:()=>vU,allocationsMatchingPush:()=>g51,TenantPoolCapacityError:()=>UT0,PREVIEW_NOT_READY_HEADER:()=>mm,AgentSandboxProvider:()=>p51});var V10=D(()=>{ET$();I10()});import{z as Hf}from"zod";function wT0($){if(!$||$.trim()==="")return[];let Z=Hf.array($d4).parse(JSON.parse($)),Q=new Set;for(let Y of Z){if(Q.has(Y.name))throw Error(`tenant pools: duplicate pool name ${Y.name}`);Q.add(Y.name)}return Z}function PT$($){let Z=vU(`https://github.com/${$.repo}`);if(!Z)throw Error(`tenant pools: bad repo ${$.repo}`);return Z}function AT$($){return $.map((Z)=>({name:Z.name,tenant:Z.orgId,size:1,image:"default",repos:[{repoUrl:PT$(Z),branch:Z.branch,workload:Z.workload,replicas:1,warmPoolName:Z.name}]}))}function n51($,Z){let Q=vU(Z.repoUrl)?.toLowerCase(),Y=$.find((J)=>J.orgId===Z.tenant&&J.branch===Z.branch&&PT$(J).toLowerCase()===Q);if(!Y)return null;let X=`https://github.com/${Y.repo}.git`;return Y.connectionId?{cloneUrl:X,connectionId:Y.connectionId}:{cloneUrl:X}}function TT$($,Z){return async(Q)=>{let Y=n51($,Q);if(!Y)return null;return Y.connectionId?Z(Y):Y.cloneUrl}}var $d4;var jT0=D(()=>{V10();$d4=Hf.object({name:Hf.string().max(63).regex(/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/,"pool name must be a DNS label (lowercase alphanumeric and '-')"),orgId:Hf.string().min(1),repo:Hf.string().regex(/^[^/\s]+\/[^/\s]+$/,"repo must be `owner/name`"),connectionId:Hf.string().min(1).optional(),branch:Hf.string().min(1).default("main"),workload:M10.shape.workload})});function a51($,Z=Date.now()){if($===void 0)return;return $===null?Z+Zd4:$.getTime()}function s51($){return JSON.stringify([$.orgId,$.userId])}function RT$($,Z){let Q=vU(Z);return Q?JSON.stringify([$,Q.toLowerCase()]):null}function Yd4($,Z){return"repositoryId"in Z?$.repositoryOrgs.get(Z.repositoryId):$.connectionOrgs.get(Z.connectionId)}function qT$($){let{records:Z,now:Q}=$,Y=new Map,X=new Map,J=new Map,G=0;for(let W of $.pools)for(let{repoUrl:K,branch:H}of W.repos){let F=RT$(W.tenant,K),U=n51($.legacyPools??[],{tenant:W.tenant,repoUrl:K,branch:H});if(F&&U){if(U.connectionId)X.set(F,{tenant:W.tenant,repoUrl:K,connectionId:U.connectionId,cloneUrl:U.cloneUrl});continue}let N=F?Z.orgRepositories.get(F):void 0;if(!F||!N){G++;continue}X.set(F,{tenant:W.tenant,repoUrl:K,repositoryId:N})}for(let W of $.sandboxes){let K=W.tenant;if(!K)continue;let H=Z.members.get(s51(K));if(H===void 0){G++;continue}for(let U of W.repos){if(Yd4(Z,U)!==K.orgId){G++;continue}let N="repositoryId"in U?{repositoryId:U.repositoryId}:{connectionId:U.connectionId,repo:U.repo.toLowerCase()},B={orgId:K.orgId,userId:K.userId};Y.set(JSON.stringify([B,N]),{tenant:B,repo:N})}let F=W.orgFsConfigExpiresAt;if(W.orgFs&&(F===null||F-Q<Qd4))J.set(s51(K),{orgId:K.orgId,userId:K.userId,orgSlug:H})}return{clones:[...Y.values()],poolClones:[...X.values()],orgFs:[...J.values()],refused:G}}async function MT$($,Z,Q){let Y=new Set,X=new Set,J=new Set,G=new Set,W=new Set(Q.map((O)=>O.tenant)),K=new Set;for(let O of Q)for(let{repoUrl:L}of O.repos){let w=kY(L);if(w)K.add(w.path.toLowerCase())}for(let O of Z){if(O.tenant)Y.add(O.tenant.orgId),X.add(O.tenant.userId);for(let L of O.repos)if("repositoryId"in L)G.add(L.repositoryId);else J.add(L.connectionId)}let[H,F,U,N]=await Promise.all([Y.size===0?[]:$.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.organizationId as orgId","member.userId as userId","organization.slug as slug"]).where("member.organizationId","in",[...Y]).where("member.userId","in",[...X]).execute(),J.size===0?[]:$.selectFrom("connections").select(["id","organization_id"]).where("id","in",[...J]).execute(),G.size===0?[]:$.selectFrom("repositories").select(["id","organization_id"]).where("id","in",[...G]).execute(),K.size===0?[]:$.selectFrom("repositories").select(["id","organization_id","provider","host","path"]).where("organization_id","in",[...W]).where((O)=>O(O.fn("lower",["path"]),"in",[...K])).execute()]),B=new Map;for(let O of N){let L=RT$(O.organization_id,fe({provider:O.provider,host:O.host,path:O.path}));if(L&&!B.has(L))B.set(L,O.id)}return{members:new Map(H.map((O)=>[s51(O),O.slug])),connectionOrgs:new Map(F.map((O)=>[O.id,O.organization_id])),repositoryOrgs:new Map(U.map((O)=>[O.id,O.organization_id])),orgRepositories:B}}function r51($){return $ instanceof Error?$.message:String($)}async function IT$($,Z,Q){let Y=0;if($.clones.length>im||$.poolClones.length>im||$.orgFs.length>o51)console.warn(`[sandbox-credential-push] ${$.clones.length} clone, ${$.poolClones.length} pool clone and ${$.orgFs.length} org-fs mints planned; minting the first ${im}, ${im} and ${o51}`);let X=await F9($.clones.slice(0,im),t51,async(U)=>{let N="repositoryId"in U.repo?{cloneUrl:"",repositoryId:U.repo.repositoryId}:{cloneUrl:`https://github.com/${U.repo.repo}.git`,connectionId:U.repo.connectionId};try{let B=await Z.mintCloneUrl(N,{bufferMs:ET0});return B?{tenant:U.tenant,repo:U.repo,cloneUrl:B,expiresAt:Q.now+ET0}:null}catch(B){return Y++,console.warn(`[sandbox-credential-push] clone mint failed: ${r51(B)}`),null}}),J=await F9($.poolClones.slice(0,im),t51,async(U)=>{try{let N=await Z.mintCloneUrl("repositoryId"in U?{cloneUrl:"",repositoryId:U.repositoryId}:{cloneUrl:U.cloneUrl,connectionId:U.connectionId},{bufferMs:ET0});return N?{tenant:U.tenant,repoUrl:U.repoUrl,cloneUrl:N,expiresAt:Q.now+ET0}:null}catch(N){return Y++,console.warn(`[sandbox-credential-push] pool clone mint failed: ${r51(N)}`),null}}),G=await F9($.orgFs.slice(0,o51),t51,async(U)=>{try{let N=await Z.mintOrgFsConfig(U);return N?{tenant:{orgId:U.orgId,userId:U.userId},orgFsConfigJson:N,expiresAt:Q.now+Q.orgFsLifetimeMs}:null}catch(N){return Y++,console.warn(`[sandbox-credential-push] org-fs mint failed: ${r51(N)}`),null}}),W=X.filter((U)=>U!==null),K=J.filter((U)=>U!==null),H=G.filter((U)=>U!==null),F=[];for(let U=0;U<Math.max(W.length,K.length,H.length);U+=yj)F.push({cloneUrls:W.slice(U,U+yj),poolCloneUrls:K.slice(U,U+yj),orgFsConfigs:H.slice(U,U+yj)});return{batches:F,failed:Y}}var ET0=2700000,zT0,Zd4=86400000,Qd4=86400000,t51=8,im=2000,o51=200;var PT0=D(()=>{C41();V10();i4();a$();LD();jT0();zT0=TL$-3600000});var hX;var k10=D(()=>{hX=class hX extends Error{code;status;path;constructor($,Z,Q){super(Z.message||`Freestyle API error: ${Z.code}`);this.name="FreestyleApiError",this.code=Z.code,this.status=$,this.path=Q,Object.setPrototypeOf(this,hX.prototype)}}});function VT$(){return typeof process<"u"&&Boolean(process.versions?.node)}var AT0=($,Z)=>globalThis.fetch($,Z);async function Xd4(){if(!VT$())return null;try{return await import("undici")}catch{return null}}async function Gd4(){let $=await Xd4();if(!$)return null;let Z=new $.Agent({allowH2:!0,connections:Jd4});return(Q,Y)=>$.fetch(Q,{...Y,dispatcher:Z})}function Wd4($){return(typeof $==="string"?$:$ instanceof URL?$.href:$.url).startsWith("https:")}function kT$(){let $,Z=()=>{return $??=Gd4().then((Q)=>Q??AT0).catch(()=>AT0),$};return(Q,Y)=>Wd4(Q)?Z().then((X)=>X(Q,Y)):AT0(Q,Y)}var Jd4=4;var ST$=()=>{};function Bd4($){return new Promise((Z)=>setTimeout(Z,$))}function Dd4($){if(!$)return"";let Z=new URLSearchParams;for(let[Y,X]of Object.entries($)){if(X===void 0||X===null)continue;Z.set(Y,String(X))}let Q=Z.toString();return Q?`?${Q}`:""}function u6($){return encodeURIComponent($)}class e51{baseUrl;authenticationHeaders;fetchImpl;backgroundEligible;constructor($={}){if(this.baseUrl=($.baseUrl??Nd4).replace(/\/+$/,""),!$.fetch&&!globalThis.fetch)throw Error("No fetch implementation available. Pass `fetch` in FreestyleOptions when running on a runtime without a global fetch.");if(this.fetchImpl=$.fetch??kT$(),"identityAccessToken"in $&&$.identityAccessToken){this.authenticationHeaders={[Kd4]:$.identityAccessToken},this.backgroundEligible=!1;return}if(this.backgroundEligible=!0,"stackAccessToken"in $&&$.stackAccessToken){this.authenticationHeaders={Authorization:`Bearer ${$.stackAccessToken}`,"X-Freestyle-Team-Id":$.teamId};return}let Z=$.apiKey??globalThis.process?.env?.FREESTYLE_API_KEY;if(!Z)throw Error("No Freestyle API key provided. Pass `apiKey` in FreestyleOptions or set FREESTYLE_API_KEY.");this.authenticationHeaders={Authorization:`Bearer ${Z}`}}authHeaders(){return{...this.authenticationHeaders}}url($,Z){return`${this.baseUrl}${$}${Dd4(Z)}`}async fetch($,Z={}){let Q=new Headers(Z.headers);for(let[Y,X]of Object.entries(this.authHeaders()))if(!Q.has(Y))Q.set(Y,X);return this.fetchImpl(this.absoluteUrl($),{...Z,headers:Q})}absoluteUrl($){return/^https?:\/\//i.test($)?$:`${this.baseUrl}${$}`}async request($,Z,{query:Q,body:Y,rawBody:X,signal:J}={}){let G={...this.authHeaders()};if(this.backgroundEligible)G[CT$]=String(Fd4);let W;if(X!==void 0)G["Content-Type"]="application/octet-stream",W=X;else if(Y!==void 0)G["Content-Type"]="application/json",W=JSON.stringify(Y);let K=this.url(Z,Q),H=await this.fetchImpl(K,{method:$,headers:G,body:W,signal:J});if(this.backgroundEligible&&H.status===202)try{return await this.pollBackgroundRequest(H,Z)}catch(F){if($==="GET"&&F instanceof hX&&F.code==="BACKGROUND_RESULT_UNSTORABLE"){delete G[CT$];let U=await this.fetchImpl(K,{method:$,headers:G,body:W});return this.finalize(U,Z)}throw F}return this.finalize(H,Z)}async pollBackgroundRequest($,Z){let Q=await $.json().catch(()=>({})),Y=$.headers.get(Hd4)??Q.requestId,X=Q.resultUrl??(Y?`/v5/background-requests/${u6(Y)}`:void 0);if(!X)throw new hX($.status,{code:"BACKGROUND_PROTOCOL_ERROR",message:"202 Accepted carried no background request id"},Z);let J=0;for(;;){await Bd4(Ud4);let G;try{G=await this.fetch(X,{method:"GET"}),J=0}catch(W){if(++J>=5)throw W;continue}if(G.status===202)continue;return this.finalize(G,Z)}}async finalize($,Z){if(!$.ok){let Y;try{Y=await $.json()}catch{Y={code:"UNKNOWN_ERROR",message:await $.text().catch(()=>$.statusText)}}throw new hX($.status,Y,Z)}if($.status===204)return;let Q=await $.text();if(!Q)return;return JSON.parse(Q)}get($,Z){return this.request("GET",$,{query:Z})}post($,Z){return this.request("POST",$,{body:Z??{}})}patch($,Z){return this.request("PATCH",$,{body:Z??{}})}put($,Z){return this.request("PUT",$,{body:Z??{}})}putEmpty($){return this.request("PUT",$,{})}putBytes($,Z,Q,Y){return this.request("PUT",$,{query:Q,rawBody:Z,signal:Y})}async getBytes($,Z,Q={}){let Y={...this.authHeaders()};if(Q.range)Y.Range=Q.range;let X=await this.fetchImpl(this.url($,Z),{method:"GET",headers:Y,signal:Q.signal});if(!X.ok){let J;try{J=await X.json()}catch{J={code:"UNKNOWN_ERROR",message:await X.text().catch(()=>X.statusText)}}throw new hX(X.status,J,$)}return X}delete($,Z){return this.request("DELETE",$,{query:Z})}}var Kd4="x-freestyle-identity-access-token",CT$="x-freestyle-background-after-secs",Hd4="x-freestyle-background-request-id",Fd4=5,Ud4=2000,Nd4="https://api.freestyle.sh";var fW=D(()=>{k10();ST$()});class $91{client;verifications;certificates;placeholder;constructor($){this.client=$,this.verifications=new _T$($),this.certificates=new vT$($),this.placeholder=new bT$($)}async list(){let{domains:$}=await this.client.get("/v5/domains");return $}}class _T${client;constructor($){this.client=$}create($){return this.client.post("/v5/verifications",{domain:$})}async list($={}){let{verifications:Z}=await this.client.get("/v5/verifications",$);return Z}get($){return this.client.get(`/v5/verifications/${u6($)}`)}complete($){return this.client.putEmpty(`/v5/verifications/${u6($)}`)}delete($){return this.client.delete(`/v5/verifications/${u6($)}`)}}class vT${client;constructor($){this.client=$}async list(){let{certificates:$}=await this.client.get("/v5/certificates");return $}createWildcard($){return this.client.post("/v5/certificates/wildcard",{domain:$})}}class bT${client;constructor($){this.client=$}async get(){try{return await this.client.get("/v5/domains/placeholder")}catch($){if($ instanceof hX&&$.status===404)return null;throw $}}set($){return this.client.put("/v5/domains/placeholder",$)}delete(){return this.client.delete("/v5/domains/placeholder")}}var Z91=D(()=>{fW();k10()});function a6($,Z){throw new Y91($,Z)}function Q91($){return Od4.some((Z)=>$[Z]!==void 0)}function X91($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function wd4($,Z){let Q=Z.lastIndexOf("/");if(Q<0)a6($,`${$} \`${Z}\` is not a CIDR: expected address/prefix, e.g. 203.0.113.0/24 or 2001:db8::/32`);let Y=Z.slice(0,Q),X=Z.slice(Q+1);if(!/^\d+$/.test(X))a6($,`${$} \`${Z}\`: prefix length must be a number`);let J=Number(X),G=Y.includes(":"),W=G?128:32;if(J>W)a6($,`${$} \`${Z}\`: prefix length must be 0\u2013${W}`);if(!G&&!/^\d{1,3}(\.\d{1,3}){3}$/.test(Y))a6($,`${$} \`${Z}\`: \`${Y}\` is not an IP address`)}function gT$($,Z){if(!X91($))a6(Z,`${Z} must be an object`);for(let Y of Object.keys($))if(!xT$.includes(Y))a6(`${Z}.${Y}`,`${Z} has unknown field \`${Y}\`. Expected one of: ${xT$.join(", ")}`);let Q=$;for(let Y of["vmId","vpcId","tunnelId","cidr"]){let X=Q[Y];if(X!==void 0&&(typeof X!=="string"||X.length===0))a6(`${Z}.${Y}`,`${Z}.${Y} must be a non-empty string`)}if(Q.public!==void 0&&Q.public!==!0)a6(`${Z}.public`,`${Z}.public must be true when present: it declares the public Internet. Omit the field to match something else`);if(Q.public===!0){if(Q.vmId!==void 0)a6(`${Z}.public`,`${Z} cannot combine \`public: true\` with \`vmId\`: that would mean the VM only when reached over its public address, a distinction this API does not make yet. Use \`vmId\` alone to match the VM on any path, or \`public: true\` alone to match public addresses`);if(Q.vpcId!==void 0)a6(`${Z}.public`,`${Z} cannot combine \`public: true\` with \`vpcId\`: that would mean the network's members only when reached over their public addresses, a distinction this API does not make yet. Use \`vpcId\` alone or \`public: true\` alone`);if(Q.tunnelId!==void 0)a6(`${Z}.public`,`${Z} cannot combine \`public: true\` with \`tunnelId\`: traffic through a tunnel arrives over the tunnel, not over the public Internet. Use \`tunnelId\` alone`)}if(Q.cidr!==void 0)wd4(`${Z}.cidr`,Q.cidr);if(Q.protocol!==void 0&&!fT$.includes(Q.protocol))a6(`${Z}.protocol`,`${Z}.protocol must be one of: ${fT$.join(", ")} (got \`${String(Q.protocol)}\`)`);if(Q.port!==void 0){if(!Number.isInteger(Q.port)||Q.port<1||Q.port>65535)a6(`${Z}.port`,`${Z}.port must be an integer between 1 and 65535`);if(Q.protocol===void 0)a6(`${Z}.protocol`,`${Z}.port ${Q.port} requires ${Z}.protocol: set it to "tcp" or "udp" so the rule opens one transport rather than both`);if(!Ld4.includes(Q.protocol))a6(`${Z}.port`,`${Z}.protocol "${Q.protocol}" has no ports; remove ${Z}.port ${Q.port}`)}}function lT$($,Z){if(!X91($))a6(Z||"rule",`${Z||"rule"} must be an object`);for(let Y of Object.keys($))if(!hT$.includes(Y))a6(`${Z}${Y}`,`Unknown field \`${Y}\`. Expected one of: ${hT$.join(", ")}`);let Q=$;if(Q.action===void 0)a6(`${Z}action`,`${Z}action is required. Write \`action: "allow"\` \u2014 every rule states what it does rather than defaulting to it`);if(Q.action!=="allow")a6(`${Z}action`,`${Z}action must be "allow" (got \`${String(Q.action)}\`). Only allow rules exist today`);if(Q.description!==void 0){if(typeof Q.description!=="string")a6(`${Z}description`,"description must be a string");if(Q.description.length>yT$)a6(`${Z}description`,`description is too long (${Q.description.length} characters, maximum ${yT$})`)}if(Q.source===void 0)a6(`${Z}source`,`${Z}source is required`);if(Q.destination===void 0)a6(`${Z}destination`,`${Z}destination is required`);return gT$(Q.source,`${Z}source`),gT$(Q.destination,`${Z}destination`),Q}function jd4($){let Z=lT$($,"");for(let Q of["source","destination"]){let Y=Z[Q];if(Q91(Y))continue;let X=[Y.port!==void 0?`port ${Y.port}`:void 0,Y.protocol!==void 0?`protocol ${Y.protocol}`:void 0].filter(Boolean).join(", ");a6(Q,X?`${Q} only narrows traffic (${X}) without saying what it is. Add \`vmId\`, \`vpcId\`, \`tunnelId\`, \`cidr\`, or \`public: true\`. Leaving it out to mean "this VM" only works inside vms.create`:`${Q} is empty. A matcher must say what the traffic is: \`vmId\`, \`vpcId\`, \`tunnelId\`, \`cidr\`, or \`public: true\` for the public Internet`)}return Z}function TT0($,Z="VM"){if($===void 0||$===null)a6("firewall",`firewall is required on a ${Z} create. A ${Z} gets nothing implicitly, so state what it may reach \u2014 \`{ rules: [] }\` if the answer is nothing`);if(!X91($))a6("firewall","firewall must be an object with a `rules` array");for(let Y of Object.keys($))if(Y!=="rules")a6(`firewall.${Y}`,`firewall has unknown field \`${Y}\`. Expected: rules`);let Q=$.rules;if(!Array.isArray(Q))a6("firewall.rules","firewall.rules must be an array");return Q.forEach((Y,X)=>{let J=`firewall.rules[${X}].`,G=lT$(Y,J),W=Q91(G.source),K=Q91(G.destination);if(!W&&!K&&Z!=="network")a6(`firewall.rules[${X}]`,`firewall.rules[${X}]: both source and destination refer to the ${Z} being created, which allows nothing. Give one of them a \`vmId\`, \`vpcId\`, \`tunnelId\`, \`cidr\`, or \`public: true\``);if(W&&K)a6(`firewall.rules[${X}]`,`firewall.rules[${X}]: neither end refers to the ${Z} being created. Leave one endpoint's identity unset so it means this ${Z}, or create the rule with firewall.rules.create instead`)}),$}function uT$($){return`/v5/firewall/rules/${u6($)}`}class cT${client;constructor($){this.client=$}async create($){let Z=jd4($);return this.client.post("/v5/firewall/rules",Z)}list($={}){return this.client.get("/v5/firewall/rules",$)}get($){return this.client.get(uT$($))}delete($){return this.client.delete(uT$($))}}class J91{client;rules;constructor($){this.client=$,this.rules=new cT$($)}evaluate($){return this.client.post("/v5/firewall/evaluate",$)}}var Y91,xT$,Od4,fT$,Ld4,yT$=1024,hT$;var S10=D(()=>{fW();Y91=class Y91 extends Error{path;constructor($,Z){super(Z);this.name="FirewallRuleValidationError",this.path=$,Object.setPrototypeOf(this,Y91.prototype)}};xT$=["vmId","vpcId","tunnelId","cidr","public","port","protocol"],Od4=["vmId","vpcId","tunnelId","cidr","public"],fT$=["tcp","udp","icmp"],Ld4=["tcp","udp"];hT$=["action","source","destination","description"]});function G91($){return`/v5/identities/${u6($)}`}class mT${client;basePath;constructor($,Z){this.client=$,this.basePath=Z}create(){return this.client.post(`${this.basePath}/tokens`)}list(){return this.client.get(`${this.basePath}/tokens`)}revoke($){return this.client.delete(`${this.basePath}/tokens/${u6($)}`)}}class dT${client;basePath;constructor($,Z){this.client=$,this.basePath=Z}list(){return this.client.get(`${this.basePath}/permissions/vm`)}grant($){return this.client.post(`${this.basePath}/permissions/vm`,$)}get($){return this.client.get(`${this.basePath}/permissions/vm/${u6($)}`)}update($,Z){return this.client.patch(`${this.basePath}/permissions/vm/${u6($)}`,{allowedLinuxUsers:Z})}revoke($){return this.client.delete(`${this.basePath}/permissions/vm/${u6($)}`)}}class W91{id;tokens;permissions;client;basePath;constructor($,Z){this.client=$,this.id=Z,this.basePath=G91(Z),this.tokens=new mT$($,this.basePath),this.permissions={vm:new dT$($,this.basePath)}}data(){return this.client.get(this.basePath)}delete(){return this.client.delete(this.basePath)}}class K91{client;constructor($){this.client=$}async create($={}){let Z=await this.client.post("/v5/identities",$);return{identity:new W91(this.client,Z.id),identityId:Z.id,data:Z}}list($={}){return this.client.get("/v5/identities",$)}get($){return this.client.get(G91($))}ref($){return new W91(this.client,$)}delete($){return this.client.delete(G91($))}}var H91=D(()=>{fW()});function v1($,Z){throw new B91($,Z)}function G7($,Z){throw new D91($,Z)}function C10($){return Ed4.some((Z)=>$[Z]!==void 0)}function Id4($){return!C10($)&&$.port===void 0}function gY($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function XR$($,Z,Q){if(typeof $!=="string"||!Td4.test($))G7(Z,`${Z} must be a valid HTTP header name`);let Y=$.toLowerCase();if(Md4.has(Y)||Y.startsWith("x-forwarded-")||Y.startsWith("x-freestyle-")||Q&&(Y==="cookie"||Y==="set-cookie"))G7(Z,`${Z} may not use reserved header \`${$}\``)}function Vd4($,Z){if(!Array.isArray($))G7(Z,`${Z} must be an array of header names`);if($.length>sT$)G7(Z,`${Z} may contain at most ${sT$} names`);let Q=new Set;$.forEach((Y,X)=>{XR$(Y,`${Z}[${X}]`,!0);let J=Y.toLowerCase();if(Q.has(J))G7(`${Z}[${X}]`,`${Z} contains duplicate header \`${Y}\``);Q.add(J)})}function eT$($){if(!gY($))G7("forwardAuth","forwardAuth must be an object");for(let Y of Object.keys($))if(!nT$.includes(Y))G7(Y,`Unknown field \`${Y}\`. Expected one of: ${nT$.join(", ")}`);let Z=$;if(typeof Z.url!=="string"||Z.url.length===0||Z.url.length>Rd4)G7("url","url is required and must be an absolute HTTPS URL");let Q;try{Q=new URL(Z.url)}catch{G7("url","url must be an absolute HTTPS URL")}if(Q.protocol!=="https:"||Q.hostname.length===0||Q.username.length>0||Q.password.length>0||Q.hash.length>0||Q.port==="0")G7("url","url must be an absolute HTTPS URL");if(Z.headers!==void 0){if(!gY(Z.headers))G7("headers","headers must be an object of header name to value");let Y=Object.entries(Z.headers);if(Y.length>oT$)G7("headers",`headers may contain at most ${oT$} entries`);let X=0,J=new Set;for(let[G,W]of Y){XR$(G,`headers.${G}`,!1);let K=G.toLowerCase();if(J.has(K))G7(`headers.${G}`,`headers contains duplicate header \`${G}\``);if(J.add(K),typeof W!=="string"||/[\0\r\n]/.test(W))G7(`headers.${G}`,`headers.${G} must be a string`);X+=G.length+W.length}if(X>rT$)G7("headers",`headers may contain at most ${rT$} bytes`)}if(Z.timeoutMs!==void 0&&(!Number.isInteger(Z.timeoutMs)||Z.timeoutMs<100||Z.timeoutMs>5000))G7("timeoutMs","timeoutMs must be an integer between 100 and 5000");if(Z.protectedCookies!==void 0){if(!Array.isArray(Z.protectedCookies))G7("protectedCookies","protectedCookies must be an array of cookie names");if(Z.protectedCookies.length>aT$)G7("protectedCookies",`protectedCookies may contain at most ${aT$} names`);let Y=new Set;Z.protectedCookies.forEach((X,J)=>{if(typeof X!=="string"||X.length>qd4||!Ad4.test(X))G7(`protectedCookies[${J}]`,`protectedCookies[${J}] must be a valid HTTP cookie name`);if(Y.has(X))G7(`protectedCookies[${J}]`,`protectedCookies contains duplicate cookie \`${X}\``);Y.add(X)})}if(Z.authResponseHeaders!==void 0)Vd4(Z.authResponseHeaders,"authResponseHeaders");return Z}function kd4($,Z){if(!gY($))v1(Z,`${Z} must be an object with an \`id\``);for(let Y of Object.keys($))if(!tT$.includes(Y))v1(`${Z}.${Y}`,`${Z} has unknown field \`${Y}\`. Expected: ${tT$.join(", ")}`);let Q=$.id;if(typeof Q!=="string"||Q.length===0)v1(`${Z}.id`,`${Z}.id is required and must be a non-empty string`)}function N91($){if(typeof $!=="string")v1("domain","domain is required and must be a string");if($==="*")return;let Z=$.startsWith("*.")?$.slice(2):$;if(Z.length===0||Z.length>zd4)v1("domain",`domain \`${$}\` is not a hostname`);let Q=Z.split(".");if(Q.length<2)v1("domain",`domain \`${$}\` must have at least two labels, e.g. acme.com`);for(let Y of Q){if(Y.length===0||Y.length>Pd4)v1("domain",`domain \`${$}\` has an empty or over-long label`);if(!/^[a-z0-9-]+$/.test(Y))v1("domain",`domain \`${$}\`: labels are lowercase letters, digits, and hyphens (a \`*.\` prefix is the only wildcard)`);if(Y.startsWith("-")||Y.endsWith("-"))v1("domain",`domain \`${$}\`: a label cannot start or end with a hyphen`)}}function Sd4($){if(typeof $!=="string")v1("domain","domain is required and must be a string");let Z=$.lastIndexOf("@");if(Z===-1){N91($);return}let Q=$.slice(0,Z),Y=$.slice(Z+1);if(Q.length===0||Q.length>64)v1("domain",`mail route \`${$}\`: the part before \`@\` must be 1-64 characters`);if(Q.startsWith(".")||Q.endsWith(".")||Q.includes(".."))v1("domain",`mail route \`${$}\`: the part before \`@\` cannot start or end with a dot, or contain \`..\``);for(let X of Q)if(!/[a-zA-Z0-9]/.test(X)&&!$R$.includes(X))v1("domain",`mail route \`${$}\`: the part before \`@\` may use letters, digits, dots, and \`${$R$.slice(0,-1)}\` (quoted mailboxes are not supported)`);if(Y==="*")v1("domain",`mail route \`${$}\`: \`*\` is not a mail domain \u2014 name the domain the mailbox lives at`);N91(Y)}function ZR$($,Z){if(!gY($))v1(Z,`${Z} must be an object`);for(let Y of Object.keys($))if(!iT$.includes(Y))v1(`${Z}.${Y}`,`${Z} has unknown field \`${Y}\`. Expected one of: ${iT$.join(", ")}`);let Q=$;for(let Y of["vmId","vpcId","host"]){let X=Q[Y];if(X!==void 0&&(typeof X!=="string"||X.length===0))v1(`${Z}.${Y}`,`${Z}.${Y} must be a non-empty string`)}if(Q.public!==void 0&&Q.public!==!0)v1(`${Z}.public`,`${Z}.public must be true when present. Omit the field to match something else`);if(Z==="source"){if(Q.host!==void 0)v1("source.host","source.host is not allowed: a source is who opens the session, not where it lands. Put `host` on the destination");if(Q.port!==void 0)v1("source.port","source.port is not allowed: a source is who opens the session, not where it lands. Put `port` on the destination");if(Q.public===!0&&(Q.vmId!==void 0||Q.vpcId!==void 0))v1("source.public","source cannot combine `public: true` with `vmId` or `vpcId`: use one alone. `public` is every client on the Internet; `vmId`/`vpcId` is a specific dialer")}else{if(Q.vpcId!==void 0)v1("destination.vpcId","destination.vpcId is not allowed: a session lands in one place, not on a whole network. Name a `vmId`, a `host`, or `public: true` for the domain's own origin. A whole network may be a source");if([Q.vmId!==void 0,Q.host!==void 0,Q.public===!0].filter(Boolean).length>1)v1("destination","destination names more than one landing: give exactly one of `vmId`, `host`, or `public: true`");if((Q.vmId!==void 0||Q.host!==void 0)&&Q.port===void 0)v1("destination.port",`destination.port is required with ${Q.vmId!==void 0?"`vmId`":"`host`"}: say which port the session lands on`)}if(Q.port!==void 0){if(!Number.isInteger(Q.port)||Q.port<1||Q.port>65535)v1(`${Z}.port`,`${Z}.port must be an integer between 1 and 65535`)}}function Cd4($){if("postgres"in $)return"postgres";if("smtp"in $)return"smtp";if("socks5"in $)return"socks5";return"http"}function _d4($,Z){function Q(W,K,H){if(!gY(W)||Object.keys(W).some((F)=>!K.includes(F)))v1(H,`${H} must contain only ${K.join(", ")}`)}if(Q($,["region","credentials","scope"],Z),typeof $.region!=="string"||!/^[a-z0-9-]{1,63}$/.test($.region))v1(`${Z}.region`,"invalid s3.region");Q($.credentials,["accessKeyId","secretAccessKey","sessionToken"],`${Z}.credentials`);for(let W of["accessKeyId","secretAccessKey","sessionToken"]){let K=$.credentials[W];if(W==="sessionToken"&&K===void 0)continue;if(typeof K!=="string"||!/^[\x21-\x7e]{1,16384}$/.test(K))v1(`${Z}.credentials.${W}`,"invalid s3 credentials")}if(!/^[a-zA-Z0-9]+$/.test($.credentials.accessKeyId))v1(`${Z}.credentials.accessKeyId`,"invalid s3 access key id");Q($.scope,["bucket","prefix","operations"],`${Z}.scope`);let{bucket:Y,prefix:X,operations:J}=$.scope;if(typeof Y!=="string"||!/^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/.test(Y)||Y.includes(".."))v1(`${Z}.scope.bucket`,"invalid s3.scope.bucket");if(typeof X!=="string"||Buffer.byteLength(X,"utf8")>1024||/[\x00-\x1f\x7f-\x9f]/u.test(X))v1(`${Z}.scope.prefix`,"invalid s3.scope.prefix");let G=["GetObject","HeadObject","PutObject","DeleteObject","ListObjectsV2","CreateMultipartUpload","UploadPart","ListParts","CompleteMultipartUpload","AbortMultipartUpload","ListMultipartUploads"];if(!Array.isArray(J)||J.length===0||J.length>G.length||J.some((W)=>!G.includes(W))||new Set(J).size!==J.length)v1(`${Z}.scope.operations`,"s3.scope.operations must be a nonempty list of distinct supported operations")}function vd4($,Z){if(!gY($))v1(Z,`${Z} must be an object: \`{ headers: { \u2026 } }\`, \`{ postgres: { \u2026 } }\`, \`{ smtp: { \u2026 } }\` or \`{ socks5: { \u2026 } }\``);let Q=Object.keys($);if(Q.length!==1||!["headers","jsonPatch","postgres","smtp","socks5","s3"].includes(Q[0]??""))v1(Z,`${Z} must have exactly one of \`headers\`, \`jsonPatch\`, \`postgres\`, \`smtp\`, \`socks5\` or \`s3\` (got: ${Q.length===0?"nothing":Q.join(", ")})`);if(Q[0]==="s3"){_d4($.s3,`${Z}.s3`);return}if(Q[0]==="jsonPatch"){let Y=$.jsonPatch;if(!Array.isArray(Y)||Y.length>128)v1(Z,`${Z}.jsonPatch must be an array of at most 128 operations`);let X=(W)=>typeof W==="string"&&(W===""||W.startsWith("/"))&&!/~(?:[^01]|$)/u.test(W),J=(W,K=new Set,H=0)=>{if(H>64)return!1;if(W===null||typeof W==="string"||typeof W==="boolean")return!0;if(typeof W==="number")return Number.isFinite(W);if(typeof W!=="object"||K.has(W))return!1;K.add(W);let F=(Array.isArray(W)?Array.from(W):gY(W)?Object.values(W):[void 0]).every((U)=>J(U,K,H+1));return K.delete(W),F};for(let[W,K]of Y.entries()){if(!gY(K)||!["add","remove","replace","move","copy","test"].includes(String(K.op))||!X(K.path))v1(Z,`${Z}.jsonPatch[${W}] requires a standard op and valid JSON Pointer path`);if(["move","copy"].includes(K.op)&&!X(K.from))v1(Z,`${Z}.jsonPatch[${W}].from must be a JSON Pointer`);if(["add","replace","test"].includes(K.op)&&(!Object.hasOwn(K,"value")||!J(K.value)))v1(Z,`${Z}.jsonPatch[${W}].value must be a JSON value (null is allowed)`)}let G;try{G=JSON.stringify(Y)}catch{v1(Z,"jsonPatch must be JSON serializable")}if(Buffer.byteLength(G,"utf8")>65536)v1(Z,"jsonPatch exceeds 64 KiB");return}if(Q[0]==="socks5"){let Y=$.socks5;if(!gY(Y))v1(`${Z}.socks5`,`${Z}.socks5 must be an object with \`username\` and \`password\``);for(let X of Object.keys(Y))if(!["username","password"].includes(X))v1(`${Z}.socks5.${X}`,`${Z}.socks5 has unknown field \`${X}\`. Expected: username, password`);for(let X of["username","password"])if(typeof Y[X]!=="string"||Y[X].length===0)v1(`${Z}.socks5.${X}`,`${Z}.socks5.${X} is required and must be a non-empty string`);return}if(Q[0]==="smtp"){let Y=$.smtp;if(!gY(Y))v1(`${Z}.smtp`,`${Z}.smtp must be an object with \`username\` and \`password\``);for(let X of Object.keys(Y))if(!["username","password"].includes(X))v1(`${Z}.smtp.${X}`,`${Z}.smtp has unknown field \`${X}\`. Expected: username, password`);for(let X of["username","password"])if(typeof Y[X]!=="string"||Y[X].length===0)v1(`${Z}.smtp.${X}`,`${Z}.smtp.${X} is required and must be a non-empty string`);return}if(Q[0]==="headers"){let Y=$.headers;if(!gY(Y))v1(`${Z}.headers`,`${Z}.headers must be an object of header name to value`);for(let[X,J]of Object.entries(Y))if(typeof J!=="string")v1(`${Z}.headers.${X}`,`${Z}.headers.${X} must be a string`)}else{let Y=$.postgres;if(!gY(Y))v1(`${Z}.postgres`,`${Z}.postgres must be an object with \`username\` and \`password\``);for(let J of Object.keys(Y))if(!["username","password","database"].includes(J))v1(`${Z}.postgres.${J}`,`${Z}.postgres has unknown field \`${J}\`. Expected: username, password, database`);let X=Y;for(let J of["username","password"])if(typeof X[J]!=="string"||X[J].length===0)v1(`${Z}.postgres.${J}`,`${Z}.postgres.${J} is required and must be a non-empty string`);if(X.database!==void 0&&typeof X.database!=="string")v1(`${Z}.postgres.database`,`${Z}.postgres.database must be a string`)}}function bd4($,Z){let Q=$;return Z.forEach((Y,X)=>{let J=Cd4(Y);if(Q===void 0)Q=J;else if(Q!==J)v1(`transform[${X}]`,`transform requires protocol \`${J}\` but the rule is \`${Q}\`; a rule terminates one protocol`)}),Q??"http"}function xd4($,Z){if(!gY($)||Object.keys($).some((Q)=>Q!=="method"&&Q!=="path"))v1(Z,`${Z} must be an object containing only method and path`);if($.method!==void 0&&(!Array.isArray($.method)||$.method.some((Q)=>typeof Q!=="string"||Q.length===0||/[^!#$%&'*+.^_`|~0-9A-Za-z-]/.test(Q))))v1(`${Z}.method`,`${Z}.method must be an array of HTTP method tokens`);if($.path!==void 0){let Q=$.path;if(!gY(Q)||Object.keys(Q).length!==1||typeof Q.exact!=="string"||!Q.exact.startsWith("/")||/[\s?#]/.test(Q.exact))v1(`${Z}.path`,`${Z}.path must contain exact: an absolute path without a query or fragment`)}}function JR$($,Z){if(!gY($))v1(Z||"rule",`${Z||"rule"} must be an object`);for(let H of Object.keys($))if(!QR$.includes(H))v1(`${Z}${H}`,`Unknown field \`${H}\`. Expected one of: ${QR$.join(", ")}`);let Q=$;if(Q.action===void 0)v1(`${Z}action`,`${Z}action is required. Write \`action: "allow"\` \u2014 every rule states what it does rather than defaulting to it`);if(Q.action!=="allow")v1(`${Z}action`,`${Z}action must be "allow" (got \`${String(Q.action)}\`). Only allow rules exist today`);if(Q.protocol!==void 0&&!pT$.includes(Q.protocol))v1(`${Z}protocol`,`${Z}protocol must be one of: ${pT$.join(", ")} (got \`${String(Q.protocol)}\`)`);let Y=Q.source??{},X=Q.destination??{};ZR$(Y,"source"),ZR$(X,"destination");let J=Q.transform??[];if(!Array.isArray(J))v1(`${Z}transform`,`${Z}transform must be an array`);J.forEach((H,F)=>vd4(H,`${Z}transform[${F}]`));let G=bd4(Q.protocol,J);if(Q.match!==void 0){if(xd4(Q.match,`${Z}match`),G!=="http"||Y.public===!0||!(X.public===!0||X.host!==void 0))v1(`${Z}match`,"match requires HTTP egress from a VM or VPC to a public origin or host")}if(J.some((H)=>("s3"in H))){if(J.length!==1||Q.match!==void 0||Y.public===!0||!(X.public===!0||X.host!==void 0)||Q.domain.includes("*"))v1(`${Z}transform`,"s3 requires a sole transform on HTTP egress to a concrete origin, without match")}let W=J.filter((H)=>("jsonPatch"in H));if(W.length>1)v1(`${Z}transform`,"a rule may carry only one jsonPatch transform");if(W.length&&(Y.public===!0||!(X.public===!0||X.host!==void 0)))v1(`${Z}transform`,"jsonPatch requires HTTP egress from a VM or VPC to a public origin or host");if(Q.forwardAuth!==void 0){kd4(Q.forwardAuth,`${Z}forwardAuth`);let H=X.vmId!==void 0||!C10(X)&&X.port!==void 0;if(G!=="http"||Y.public!==!0||!H||Q.domain==="*")v1(`${Z}forwardAuth`,`${Z}forwardAuth is only supported on HTTP public ingress: \`{ public: true } -> { vmId, port }\``)}if(G==="smtp")Sd4(Q.domain);else N91(Q.domain);if((Y.vmId!==void 0||Y.vpcId!==void 0)&&X.vmId!==void 0&&J.length>0)v1(`${Z}transform`,"a VM-to-VM rule cannot carry a transform yet \u2014 remove it (only public ingress/egress rules run transforms)");if(G==="tcp"){let H=X.public===!0||X.host!==void 0,F=Y.vmId!==void 0||Y.vpcId!==void 0;if(H||F)v1(`${Z}protocol`,"a `tcp` rule is public ingress only \u2014 `{ public: true } -> { vmId, port }`. The edge splices the session without terminating it, so outbound there is nothing to broker (an outbound allow is a firewall rule, and injecting into one needs `http` or `postgres`) and inward there is no certificate to answer the source with. Give the source `public: true`, or drop `protocol` to be served as HTTPS")}else if(G==="imap"||G==="imaps"){let H=X.public===!0||X.host!==void 0,F=Y.vmId!==void 0||Y.vpcId!==void 0;if(H||F)v1(`${Z}protocol`,`an \`${G}\` rule is public ingress only \u2014 \`{ public: true } -> { vmId, port }\`. The 993 front serves mail clients reaching a VM's IMAP server; outbound there is nothing to broker (an outbound allow is a firewall rule) and inward there is no certificate to answer the source with`)}else if(G==="socks5"){let H=X.public===!0||X.host!==void 0;if(Y.public===!0||!H)v1(`${Z}protocol`,'a `socks5` rule is egress only \u2014 `{ vmId } -> { host: "gate.provider.com", port: 1080 }`. The front exists so a guest can open sessions through a proxy whose credentials it never holds; inbound there is nothing to serve, and publishing one would be an open proxy on a platform address');if(X.host===void 0)v1(`${Z}destination`,"a `socks5` rule has to name the proxy it goes through: give the destination a `host` and the `port` the provider listens on. `{ public: true }` on its own asks the edge to be the proxy, which would let the guest out on our address rather than through yours")}else if(G==="postgres"){let H=J.some((U)=>U!==null&&typeof U==="object"&&("postgres"in U)),F=X.public===!0||X.host!==void 0;if(H&&!F)v1(`${Z}transform`,"a `postgres` transform belongs on an egress rule: the edge spends a credential the guest never holds, so pointing it at your own VM would hand every client a logged-in session. Give the destination `public: true` or a `host`, or drop the transform")}else if(G==="smtp"){let H=J.some((U)=>U!==null&&typeof U==="object"&&("smtp"in U)),F=X.public===!0||X.host!==void 0;if(H&&!F)v1(`${Z}transform`,"an `smtp` transform belongs on an egress rule: the edge spends a credential the guest never holds, so pointing it at your own VM would turn it into an open relay. Give the destination `public: true` or a `host`, or drop the transform");if(typeof Q.domain==="string"&&Q.domain.includes("@")&&Y.public!==!0)v1(`${Z}domain`,`\`${Q.domain}\` names a mailbox, which only makes sense on a rule that receives mail. An egress or VM-to-VM rule names the host the guest submits through \u2014 drop the part before \`@\``)}return{...Q,source:Y,destination:X}}function fd4($,Z){if($==="source")return Id4(Z)?"source is empty. Say who opens the session: `vmId`, `vpcId`, or `public: true`":"source only narrows the session without saying who opens it. Add `vmId`, `vpcId`, or `public: true`";return"destination is empty. Say where the session lands: `vmId` + `port`, `host` + `port`, or `public: true` for the domain's own origin"}function YR$($){let Z=JR$($,"");for(let Q of["source","destination"]){let Y=Z[Q];if(!C10(Y))v1(Q,fd4(Q,Y))}if(Z.source.public===!0&&Z.destination.public===!0)v1("destination","a rule from the public Internet to the domain's own origin allows nothing the world cannot already do. Did you mean a `vmId` destination (ingress) or a `vmId` source (egress)?");return Z}function GR$($){if(!gY($))v1("tls","tls must be an object with a `rules` array");for(let Q of Object.keys($))if(Q!=="rules")v1(`tls.${Q}`,`tls has unknown field \`${Q}\`. Expected: rules`);let Z=$.rules;if(!Array.isArray(Z))v1("tls.rules","tls.rules must be an array");return Z.forEach((Q,Y)=>{let X=`tls.rules[${Y}].`,J=JR$(Q,X),G=C10(J.source),W=C10(J.destination);if(!G&&!W)v1(`tls.rules[${Y}]`,`tls.rules[${Y}]: both source and destination refer to the VM being created, which allows nothing. Give one of them a \`vmId\`, \`vpcId\`, or \`public: true\``);if(G&&W)v1(`tls.rules[${Y}]`,`tls.rules[${Y}]: neither end refers to the VM being created. Leave one endpoint's identity unset so it means this VM, or create the rule with tls.rules.create instead`);if(!W&&J.destination.port===void 0)v1(`tls.rules[${Y}].destination.port`,`tls.rules[${Y}]: destination.port is required: say which port on this VM the session lands on`)}),$}function F91($){return`/v5/tls/${u6($)}`}function U91($){return`/v5/tls/forward-auth/${u6($)}`}class WR${client;constructor($){this.client=$}list(){return this.client.get("/v5/tls/forward-auth")}async create($){let Z=eT$($);return this.client.post("/v5/tls/forward-auth",Z)}get($){return this.client.get(U91($))}async update($,Z){let Q=eT$(Z);return this.client.put(U91($),Q)}delete($){return this.client.delete(U91($))}}class KR${client;constructor($){this.client=$}async create($){let Z=YR$($);return this.client.post("/v5/tls",Z)}list($={}){return this.client.get("/v5/tls",$)}get($){return this.client.get(F91($))}async update($,Z){let Q=YR$(Z);return this.client.put(F91($),Q)}delete($){return this.client.delete(F91($))}}class O91{client;rules;forwardAuth;constructor($){this.client=$,this.rules=new KR$($),this.forwardAuth=new WR$($)}}var B91,D91,iT$,Ed4,pT$,zd4=253,Pd4=63,nT$,tT$,Ad4,Td4,Rd4=2048,oT$=32,rT$=16384,sT$=32,aT$=32,qd4=128,Md4,$R$="!#$%&'*+-/=?^_`{|}~.",QR$;var RT0=D(()=>{fW();B91=class B91 extends Error{path;constructor($,Z){super(Z);this.name="TlsRuleValidationError",this.path=$,Object.setPrototypeOf(this,B91.prototype)}};D91=class D91 extends Error{path;constructor($,Z){super(Z);this.name="TlsForwardAuthValidationError",this.path=$,Object.setPrototypeOf(this,D91.prototype)}};iT$=["vmId","vpcId","public","host","port"],Ed4=["vmId","vpcId","public","host"],pT$=["tcp","http","postgres","minecraft","smtp","imap","imaps","socks5"],nT$=["url","headers","timeoutMs","protectedCookies","authResponseHeaders"],tT$=["id"],Ad4=/^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/,Td4=/^[0-9A-Za-z-]+$/,Md4=new Set(["host","content-length","connection","keep-alive","proxy-authenticate","proxy-authorization","proxy-connection","te","trailer","transfer-encoding","upgrade"]);QR$=["action","domain","protocol","source","destination","transform","match","forwardAuth"]});function pm($){return`/v5/tunnels/${u6($)}`}function Ff($){return $.tunnelId??=$.id,$}class L91{client;constructor($){this.client=$}list(){return this.client.get("/v5/tunnels").then(($)=>{return $.tunnels.forEach(Ff),$})}create($={}){return this.client.post("/v5/tunnels",$).then(Ff)}get($){return this.client.get(pm($)).then(Ff)}update($,Z){return this.client.patch(pm($),Z).then(Ff)}rotateKey($,Z={}){return this.client.post(`${pm($)}/rotate-key`,Z).then(Ff)}delete($){return this.client.delete(pm($))}attachVpc($,Z,Q={}){return this.client.post(`${pm($)}/vpcs/${u6(Z)}`,Q).then(Ff)}detachVpc($,Z){return this.client.delete(`${pm($)}/vpcs/${u6(Z)}`).then(Ff)}}var w91=D(()=>{fW()});class j91{client;basePath;constructor($,Z){this.client=$,this.basePath=Z}async readFile($,Z={}){let Q=await this.openRead($,Z);return new Uint8Array(await Q.arrayBuffer())}async readTextFile($,Z={}){return await(await this.openRead($,Z)).text()}async readFileStream($,Z={}){let Q=await this.openRead($,Z);if(!Q.body)throw Error(`no response body reading ${$}`);return Q.body}async writeFile($,Z,Q={}){let Y=typeof Z==="string"?new TextEncoder().encode(Z):Z,X=Y instanceof Uint8Array?Y.byteLength:Y.size;if(X>yd4)return this.uploadInChunks($,Y,X,Q);let J=Y instanceof Uint8Array?Y:new Uint8Array(await Y.arrayBuffer());await this.client.putBytes(`${this.basePath}/fs/write`,J,{path:$,mode:Q.mode,sha256:await HR$(J)},Q.signal),Q.onProgress?.({completedBytes:X,totalBytes:X})}writeTextFile($,Z,Q={}){return this.writeFile($,Z,Q)}async readDir($){let{entries:Z}=await this.client.get(`${this.basePath}/fs/dir`,{path:$});return Z}async mkdir($){await this.client.post(`${this.basePath}/fs/mkdir`,{path:$})}async remove($){await this.client.delete(`${this.basePath}/fs/remove`,{path:$})}async exists($){let{exists:Z}=await this.client.get(`${this.basePath}/fs/exists`,{path:$});return Z}stat($){return this.client.get(`${this.basePath}/fs/stat`,{path:$})}openRead($,Z){let{offset:Q,length:Y}=Z,X;if(Q!==void 0||Y!==void 0){let J=Q??0;X=Y===void 0?`bytes=${J}-`:`bytes=${J}-${J+Y-1}`}return this.client.getBytes(`${this.basePath}/fs/read`,{path:$},{range:X,signal:Z.signal})}async uploadInChunks($,Z,Q,Y){let X=Y.chunkSize??gd4,J=Y.maxAttempts??hd4,G=Z instanceof Uint8Array?await HR$(Z):void 0,W=await this.client.post(`${this.basePath}/fs/uploads`,{path:$,size:Q,sha256:G,mode:Y.mode}),K=`${this.basePath}/fs/uploads/${W.uploadId}`;try{let H=W.receivedBytes;while(H<Q){let F=Math.min(H+X,Q),U=Z instanceof Uint8Array?Z.subarray(H,F):Z.slice(H,F);H=(await this.putChunkWithRetry(K,U,H,J,Y.signal)).receivedBytes,Y.onProgress?.({completedBytes:Math.min(H,Q),totalBytes:Q})}await this.client.post(`${K}/commit`)}catch(H){throw await this.client.delete(K).catch(()=>{}),H}}async putChunkWithRetry($,Z,Q,Y,X){let J;for(let G=1;G<=Y;G++){X?.throwIfAborted?.();try{return await this.client.putBytes($,Z,{offset:Q},X)}catch(W){if(J=W,!(!(W instanceof hX)||W.status>=500||W.status===408||W.status===409||W.status===429)||X?.aborted||G===Y)throw W;await ud4(Math.min(500*2**(G-1),8000));let H=await this.client.get($).catch(()=>{return});if(H&&H.receivedBytes>Q)return H}}throw J}}async function HR$($){let Z=globalThis.crypto?.subtle;if(!Z)return;let Q=await Z.digest("SHA-256",$);return Array.from(new Uint8Array(Q),(Y)=>Y.toString(16).padStart(2,"0")).join("")}function ud4($){return new Promise((Z)=>setTimeout(Z,$))}var yd4=8388608,gd4=16777216,hd4=5;var E91=D(()=>{k10()});function ld4(){return typeof process<"u"&&Boolean(process.versions?.node)}async function FR$($,Z){if(ld4()){let Y;try{Y=await import("ws")}catch{throw Error("PTY sessions need the `ws` package in Node. Install it with `npm install ws`.")}return new Y.default($,{headers:Z})}let Q=globalThis.WebSocket;if(!Q)throw Error("PTY sessions need a WebSocket client; no global WebSocket is available in this environment.");return new Q($)}function _10($,Z,Q){if($.on){$.on(Z,Q);return}$.addEventListener?.(Z,Q)}function md4($,Z){if($&&typeof $==="object"&&"data"in $){let Q=$.data;if(typeof Q==="string")return{text:Q};if(Q instanceof ArrayBuffer)return{binary:new Uint8Array(Q)};return{}}if($ instanceof Uint8Array)return Z?{binary:$}:{text:cd4.decode($)};if(typeof $==="string")return{text:$};return{}}class z91{_sessionId;_slug;_created=!1;socket;constructor($,Z,Q={}){this.socket=$,this._sessionId=Z,_10($,"message",(Y,X)=>{let{text:J,binary:G}=md4(Y,X);if(G){Q.onData?.(G);return}if(!J)return;let W;try{W=JSON.parse(J)}catch{return}if(W.type==="exited")Q.onExit?.(W.exitCode);else if(W.type==="error")Q.onError?.(Error(W.message));else if(W.type==="sessionInfo")this._sessionId=W.sessionId,this._slug=W.slug,this._created=W.created??!0,Q.onSessionInfo?.(W.sessionId)}),_10($,"close",(Y)=>{let X=Y;Q.onClose?.({wasClean:X?.wasClean??!0,code:X?.code??1000,reason:X?.reason??""})}),_10($,"error",(Y)=>Q.onError?.(Y))}write($){this.socket.send(typeof $==="string"?new TextEncoder().encode($):$)}resize($){this.sendControl({type:"resize",cols:$.cols,rows:$.rows})}signal($){this.sendControl({type:"signal",signal:$})}sendControl($){this.socket.send(JSON.stringify($))}detach(){this.socket.close()}get sessionId(){return this._sessionId}get slug(){return this._slug}get created(){return this._created}get readyState(){return this.socket.readyState}}function dd4($){return new Promise((Z,Q)=>{if($.readyState===1){Z();return}_10($,"open",()=>Z()),_10($,"error",(Y)=>Q(Y))})}class P91{client;basePath;constructor($,Z){this.client=$,this.basePath=Z}async open($={}){let{exec:Z,cols:Q,rows:Y,linuxUser:X,slug:J,replaceOnExit:G,onData:W,onExit:K,onClose:H,onError:F}=$,U={};if(Z!==void 0)U.exec=Z;if(Q!==void 0)U.cols=Q;if(Y!==void 0)U.rows=Y;if(X!==void 0)U.linuxUser=X;if(J!==void 0)U.slug=J;if(G!==void 0)U.replaceOnExit=String(G);let N=UR$(this.client,`${this.basePath}/pty`,U),B=this.client.authHeaders(),O=await FR$(N,B);return new Promise((L,w)=>{let j=!1,E=new z91(O,-1,{onData:W,onExit:K,onClose:(z)=>{if(!j)j=!0,w(Error("connection closed before sessionInfo"));H?.(z)},onError:(z)=>{if(!j)j=!0,w(z);F?.(z)},onSessionInfo:()=>{j=!0,L(E)}})})}async attach($){let{session:Z,linuxUser:Q,onData:Y,onExit:X,onClose:J,onError:G}=$,W=UR$(this.client,`${this.basePath}/pty/sessions/${u6(String(Z))}`,{...Q!==void 0?{linuxUser:Q}:{}}),K=this.client.authHeaders(),H=await FR$(W,K),F=new z91(H,typeof Z==="number"?Z:-1,{onData:Y,onExit:X,onClose:J,onError:G});return await dd4(H),F}list($={}){return this.client.get(`${this.basePath}/pty/sessions`,$)}close($,Z={}){return this.client.delete(`${this.basePath}/pty/sessions/${u6(String($))}`,Z)}}class A91{pty;linuxUser;constructor($,Z){this.pty=$,this.linuxUser=Z}open($={}){return this.pty.open({...$,linuxUser:this.linuxUser})}attach($){return this.pty.attach({...$,linuxUser:this.linuxUser})}list(){return this.pty.list({linuxUser:this.linuxUser})}close($){return this.pty.close($,{linuxUser:this.linuxUser})}}function UR$($,Z,Q){return $.url(Z,Q).replace(/^http/,"ws")}var cd4;var T91=D(()=>{fW();cd4=new TextDecoder});class R91{client;constructor($){this.client=$}list($={}){return this.client.get("/v5/snapshots",$)}get($){return this.client.get(`/v5/snapshots/${u6($)}`)}update($,Z){return this.client.patch(`/v5/snapshots/${u6($)}`,Z)}delete($){return this.client.delete(`/v5/snapshots/${u6($)}`)}}var q91=D(()=>{fW()});var NR$=()=>{};function M91($){return`/v5/vms/${u6($)}`}class I91{id;fs;pty;client;basePath;constructor($,Z){this.client=$,this.id=Z,this.basePath=M91(Z),this.fs=new j91($,this.basePath),this.pty=new P91($,this.basePath)}data(){return this.client.get(this.basePath)}firewallRules(){return this.client.get("/v5/firewall/rules",{vmId:this.id})}update($){return this.client.patch(this.basePath,$)}start(){return this.client.post(`${this.basePath}/start`)}pause(){return this.client.post(`${this.basePath}/pause`)}resize($){return this.client.post(`${this.basePath}/resize`,$)}delete(){return this.client.delete(this.basePath)}exec($){let Z=typeof $==="string"?{command:$}:$;return this.client.post(`${this.basePath}/exec-await`,Z)}linuxUser($){return new BR$(this,$)}snapshot($={}){return this.client.post(`${this.basePath}/snapshot`,$)}}class BR${vm;linuxUser;pty;constructor($,Z){this.vm=$,this.linuxUser=Z,this.pty=new A91($.pty,Z)}exec($){let Z=typeof $==="string"?{command:$}:$;return this.vm.exec({...Z,linuxUser:this.linuxUser})}}class V91{client;snapshots;constructor($){this.client=$,this.snapshots=new R91($)}async create($){if(TT0($.firewall,"VM"),$.tls!==void 0)GR$($.tls);let Z=await this.client.post("/v5/vms",$);return{vm:new I91(this.client,Z.id),vmId:Z.id,data:Z,firewallRules:Z.firewallRules??[],tlsRules:Z.tlsRules??[]}}list($={}){return this.client.get("/v5/vms",$)}get($){return this.client.get(M91($))}ref($){return new I91(this.client,$)}delete($){return this.client.delete(M91($))}}var k91=D(()=>{S10();RT0();fW();E91();T91();q91();NR$();E91();T91();q91()});function S91($){return`/v5/vpcs/${u6($)}`}class DR${client;basePath;constructor($,Z){this.client=$,this.basePath=Z}list(){return this.client.get(`${this.basePath}/tunnels`)}}class C91{id;tunnels;client;basePath;constructor($,Z){this.client=$,this.id=Z,this.basePath=S91(Z),this.tunnels=new DR$($,this.basePath)}data(){return this.client.get(this.basePath)}update($){return this.client.patch(this.basePath,$)}delete(){return this.client.delete(this.basePath)}}class _91{client;constructor($){this.client=$}list(){return this.client.get("/v5/vpcs")}async create($={}){if($.firewall!==void 0)TT0($.firewall,"network");let Z=await this.client.post("/v5/vpcs",$);return{vpc:new C91(this.client,Z.id),vpcId:Z.id,data:Z,firewallRules:Z.firewallRules??[]}}get($){return this.client.get(S91($))}ref($){return new C91(this.client,$)}delete($){return this.client.delete(S91($))}}var v91=D(()=>{S10();fW()});class qT0{client;vms;vpc;tunnels;firewall;tls;domains;identities;constructor($={}){this.client=new e51($),this.vms=new V91(this.client),this.vpc=new _91(this.client),this.tunnels=new L91(this.client),this.firewall=new J91(this.client),this.tls=new O91(this.client),this.domains=new $91(this.client),this.identities=new K91(this.client)}fetch($,Z){return this.client.fetch($,Z)}}var OR$=D(()=>{fW();Z91();S10();H91();RT0();w91();k91();v91();fW();k10();k91();v91();w91();Z91();S10();RT0();H91()});var wR$;var LR$=D(()=>{wR$={name:"@decocms/sandbox",version:"1.82.0",private:!0,type:"module",description:"Sandbox runtime for isolated Studio tool execution",scripts:{check:"tsc --noEmit",test:"bun test",build:"bun run build:typegen && bun run build:harness-runner","build:typegen":"mkdir -p dist && bun run --cwd=../typegen build && bun --cwd=../typegen pm pack --filename $PWD/dist/typegen.tgz --quiet","build:harness-runner":"mkdir -p dist && bun --cwd=../harness-runner pm pack --filename $PWD/dist/harness-runner.tgz --quiet"},exports:{"./shared":"./shared.ts","./provider":"./server/provider/index.ts","./provider/agent-sandbox":"./server/provider/agent-sandbox/index.ts","./provider/postgres-state-store":"./server/provider/postgres-state-store.ts","./provider/freestyle":"./server/provider/freestyle.ts","./provider/remote":"./server/provider/remote.ts","./provider/router":"./server/provider/router.ts","./provider/sandbox-api":"./server/provider/sandbox-api.ts","./provider/sandbox-server":"./server/provider/sandbox-server.ts","./daemon-client":"./server/daemon-client.ts","./org-fs":"./org-fs.ts","./dispatch":"./dispatch/index.ts","./dispatch/*":"./dispatch/*.ts","./proxy/http":"./proxy/http.ts","./proxy/websocket":"./proxy/websocket.ts"},dependencies:{"@decocms/shared":"workspace:*","@kubernetes/client-node":"^1.4.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0",freestyle:"0.2.16",zod:"4.3.6"},devDependencies:{"@types/bun":"latest",postgres:"^3.4.5",typescript:"^7.0.2"}}});function MT0($){let Z=$?.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of studio-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"});return async(Q,Y)=>{if(!Z)return Y();let X=performance.now(),J=(G)=>Z.record(performance.now()-X,{runner_kind:Q,source:"daemon",status_code:G});try{let G=await Y();return J(G.status),G}catch(G){throw J(0),G}}}var qD;var IT0=D(()=>{qD={kubernetes:"agent-sandbox",freestyle:"freestyle"}});var MR$={};Z6(MR$,{FreestyleSandboxProvider:()=>qR$});import{createHash as pd4,randomBytes as nd4}from"crypto";class qR${freestyle;lookupClient;image;sidecarImage;idleTimeoutSeconds;autoDeleteSeconds;domainSuffix;timeDaemonRequest;inflight=new Wf;snapshotInflight=new Wf;lookups=new Map;releaseTimers=new Map;constructor($){this.freestyle=$.client??new qT0({apiKey:$.apiKey}),this.lookupClient=$.client??new qT0({apiKey:$.apiKey,fetch:Object.assign((Z,Q)=>fetch(Z,{...Q,signal:Q?.signal?AbortSignal.any([Q.signal,AbortSignal.timeout(AR$)]):AbortSignal.timeout(AR$)}),{preconnect:fetch.preconnect})}),this.image=$.image??`ghcr.io/decocms/studio/studio-sandbox-go:${wR$.version}`,this.sidecarImage=$.orgFsSidecarImage??od4,this.idleTimeoutSeconds=$.idleTimeoutSeconds??300,this.autoDeleteSeconds=$.autoDeleteSeconds??86400,this.domainSuffix=$.domainSuffix??"style.dev",this.timeDaemonRequest=MT0($.meter)}async owns($){return await this.find($)!==null}daemonUrl($){return`https://${$}.${this.domainSuffix}`}async find($,Z={}){let Q=this.lookups.get($);if(!Z.refresh&&Q&&Date.now()-Q.at<(Q.found?Zi4:Qi4))return Q.found;let Y=null;try{let X=await this.lookupClient.vms.get($),J=X.metadata[zR$];if(J)Y={vm:this.freestyle.vms.ref(X.id),daemon:{url:this.daemonUrl($),token:J}}}catch(X){if(!(X instanceof hX&&X.status===404))throw X}return this.remember($,Y),Y}remember($,Z){if(this.lookups.delete($),this.lookups.size>=Yi4){let Q=this.lookups.keys().next();if(!Q.done)this.lookups.delete(Q.value)}this.lookups.set($,{found:Z,at:Date.now()})}baseSnapshot(){let{image:$,sidecarImage:Z}=this,Q=`studio-sandbox-${pd4("sha256").update(`${$}
+${X}`:X}var xA$,nc4;var k51=D(()=>{xA$=/[\r\n<>]/,nc4=/^[^\s@<>]+@[^\s@<>]+\.[^\s@<>]+$/});var XT0=D(()=>{a$();k51()});function oc4($){if($ instanceof TypeError)return!0;if($ instanceof Error&&!($ instanceof DOMException)&&typeof $.code==="string")return!0;if($ instanceof DOMException&&$.name==="AbortError")return!0;return!1}async function S51($,Z,Q,Y){try{return await E8(async()=>{let J=await fetch($,{...Z,signal:AbortSignal.timeout(Y)});return{status:J.status,ok:J.ok,body:await J.text()}},{maxAttempts:3,minTimeout:50,maxTimeout:500,multiplier:2,jitter:0.5,isRetriable:oc4})}catch(X){let J=X instanceof Error?X.message:String(X);throw Error(`[SANDBOX_UNREACHABLE] sandbox daemon ${Q} request failed: ${J}`,{cause:X})}}async function JT0($){try{let Z=await fetch(`${$}/health`,{signal:AbortSignal.timeout(rc4)});if(!Z.ok){try{await Z.text()}catch{}return null}let Q=await Z.json();if(typeof Q==="object"&&Q!==null&&typeof Q.bootId==="string"&&typeof Q.ready==="boolean"&&Q.setup&&typeof Q.setup.running==="boolean"&&typeof Q.setup.done==="boolean")return Q;return null}catch{return null}}async function _51($){for(let Z=0;Z<yA$;Z++){if(await JT0($)!==null)return;let Q=(Math.random()*2-1)*sc4;await L$(gA$+Q)}throw Error(`sandbox daemon at ${$} did not respond on /health within ${yA$*gA$/1000}s`)}async function _U($,Z,Q,Y,X){return ac4($,Z,"POST",Q,Y,X)}async function ac4($,Z,Q,Y,X,J){let G={...Y};if(X&&X.rotateToken!==void 0)G.auth=X;let W=await S51(`${$}/_sandbox/config`,{method:Q,headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:JSON.stringify(G)},"/_sandbox/config",J?.timeoutMs??C51);if(!W.ok)throw new PH(W.status,W.body);return uA$(W.body,"/_sandbox/config")}async function hA$($,Z,Q){let Y=await S51(`${$}/_sandbox/setup/${Q}`,{method:"POST",headers:{Authorization:`Bearer ${Z}`}},`/_sandbox/setup/${Q}`,C51);if(!Y.ok)throw Error(`sandbox daemon /_sandbox/setup/${Q} returned ${Y.status}: ${Y.body}`)}async function A10($,Z,Q){let Y=await S51(`${$}/_sandbox/orgfs-config`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:Q},"/_sandbox/orgfs-config",C51);if(!Y.ok)throw Error(`sandbox daemon /_sandbox/orgfs-config returned ${Y.status}: ${Y.body}`);return uA$(Y.body,"/_sandbox/orgfs-config")}function uA$($,Z){try{return JSON.parse($)}catch(Q){throw Error(`sandbox daemon ${Z} returned a malformed JSON body: ${$.slice(0,200)}`,{cause:Q})}}async function GT0($,Z,Q,Y){let X=new Headers(Y.headers);for(let W of ec4)X.delete(W);X.set("authorization",`Bearer ${Z}`);let J=Y.method!=="GET"&&Y.method!=="HEAD",G=`${$}${Q.startsWith("/")?Q:`/${Q}`}`;return fetch(G,{method:Y.method,headers:X,body:J?Y.body:void 0,redirect:"manual",signal:Y.signal,duplex:J?"half":void 0})}var PH,rc4=500,C51=30000,yA$=25,gA$=200,sc4=50,ec4;var Gf=D(()=>{XT0();a$();PH=class PH extends Error{status;constructor($,Z){super(`sandbox daemon /_sandbox/config returned ${$}: ${Z}`);this.status=$;this.name="ConfigRequestError"}};ec4=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length"]});class WT0{counted=new Set;markCounted($){this.counted.add($)}consume($){return this.counted.delete($)}}class Wf{map=new Map;async run($,Z){let Q=this.map.get($);if(Q)return Q;let Y=Z();this.map.set($,Y);try{return await Y}finally{this.map.delete($)}}}function KT0($,Z,Q){if(!$)return Q(null);if(!$.withLock)return Q($);return $.withLock(Z,Q)}function T10($){if(!$.orgId||!$.virtualMcpId||!$.branch)throw Error("composeSandboxRef: orgId, virtualMcpId and branch are all required for agent refs");return`agent:${$.orgId}:${$.virtualMcpId}:${$.branch}`}function lA$($){if(!$.startsWith("agent:"))return"";let Z=$.split(":");return Z.length>=4?Z.slice(3).join(":"):""}import{hash as $m4}from"crypto";function Zm4($,Z=16){return $m4("sha256",VL$($),"hex").slice(0,Z)}function N3($){let Z=Zm4($),Q=Qm4(lA$($.projectRef));return Q?`${Q}-${Z}`:`s-${Z}`}function Qm4($){if(!$)return"";let Z=$.split("/").pop()??"",Q="",Y=!1;for(let X of Z.toLowerCase()){let J=X.charCodeAt(0),G=J>=97&&J<=122,W=J>=48&&J<=57;if(!G&&!W){Y||=Q.length>0;continue}if(Y){if(Q.length+1>=cA$)break;Q+="-",Y=!1}if(Q+=X,Q.length===cA$)break}return Q}var cA$=24;var mA$=D(()=>{V41()});function HT0($,Z){let Q=$.replace(/\/+$/,"");if(Q.includes("{handle}"))return`${Q.replace("{handle}",Z)}/`;try{let Y=new URL(Q);return Y.hostname=`${Z}.${Y.hostname}`,`${Y.toString()}/`}catch{return`${Q}/${Z}/`}}function hm($){let Z=$.repo,Q=Z?{repository:{cloneUrl:Z.cloneUrl,repoName:Z.displayName??Ym4(Z.cloneUrl),...Z.branch?{branch:Z.branch}:{},submoduleCredentials:Z.submoduleCredentials??[]},repositories:($.extraRepos??[]).filter((K)=>!!K.directoryName).map((K)=>({cloneUrl:K.cloneUrl,repoName:K.directoryName,...K.branch?{branch:K.branch}:{},submoduleCredentials:K.submoduleCredentials??[]})),...Z.userName.trim()||Z.userEmail.trim()?{identity:{userName:Z.userName,userEmail:Z.userEmail}}:{}}:void 0,Y=$.tenant,X=gm({userName:Y?.userName,userEmail:Y?.userEmail})??void 0,J=$.packageManager?{name:$.packageManager.name,...$.packageManager.path?{path:$.packageManager.path}:{}}:void 0,G=J?{packageManager:J,runtime:$.runtime,...$.port!==void 0?{port:$.port}:{}}:void 0,W=Y?.orgId;if(!Q&&!G&&!X&&$.cloneOnly===void 0&&!W)return null;return{...Q?{git:Q}:{},...X?{operator:X}:{},...W?{orgId:W}:{},...$.cloneOnly!==void 0?{cloneOnly:$.cloneOnly}:{},...G?{application:G}:{}}}function Ym4($){try{let Z=new URL($);return Z.pathname.replace(/^\/+/,"").replace(/\.git$/,"")||Z.hostname}catch{return $}}var dA$=D(()=>{k51()});function Xm4($){try{return new URL($).username.length>0}catch{return!1}}function R10($){let Z=$.repo?.cloneUrl;if(!Z||!Xm4(Z))return null;return{git:{repository:{cloneUrl:Z}}}}var um=D(()=>{mA$();dA$()});async function*nA$($){let Z=$.now??(()=>Date.now()),Q=Z(),Y=$.schedulingTimeoutMs??Gm4,X={pod:{},sandbox:{},events:{hasPulling:!1,hasPulled:!1},startedAt:Q},J=[],G=null,W=!1,K=(E)=>{if(W)return;if(G){let z=G;G=null,z(E)}else J.push(E)},H=()=>{if(J.length>0)return Promise.resolve(J.shift());if(W)return Promise.resolve(null);return new Promise((E)=>{G=E})},F=()=>{if(W)return;if(W=!0,G){let E=G;G=null,E(null)}},U=new AbortController,N=()=>{U.abort(),F()};if($.signal)if($.signal.aborted)U.abort(),F();else $.signal.addEventListener("abort",N,{once:!0});let B=Math.max(0,Y-(Z()-Q)),O=setTimeout(()=>K("tick"),B+100),L,w=new Promise((E)=>{L=E}),j=Promise.allSettled([Km4($.kc,$.namespace,$.claimName,U.signal,X,K,Z,L),Fm4($.kc,$.namespace,$.claimName,U.signal,X,K),Um4($.kc,$.namespace,$.claimName,w,U.signal,X,K,Z)]);try{let E=null,z=-1,T=iA$(X,Y,Z);if(E=b51(T),!v51(T))z=pA$(T);if(yield T,v51(T))return;while(!W){if(await H()===null)break;let A=iA$(X,Y,Z);if(v51(A)){let _=b51(A);if(_!==E)E=_,yield A;return}let q=pA$(A);if(q<z)continue;let f=b51(A);if(f!==E)E=f,z=q,yield A}}finally{if(clearTimeout(O),U.abort(),$.signal)$.signal.removeEventListener("abort",N);F(),await j.catch(()=>{})}}async function tA$($,Z=Wm4){let Q=new AbortController,Y="claiming",X,J=()=>{clearTimeout(X),X=setTimeout(()=>Q.abort(),Z)};try{J();for await(let G of $(Q.signal)){if(G.kind==="ready")return;if(G.kind==="failed")throw new xY(G.message);Y=G.kind,J()}}finally{clearTimeout(X),Q.abort()}throw new Tm(`Sandbox did not become ready: no progress for ${Math.round(Z/1000)}s while ${Y}`)}function iA$($,Z,Q){let{pod:Y,sandbox:X,events:J,startedAt:G}=$;if(X.ready)return{kind:"ready"};let W=Y.containerWaitingReason;if(W==="ImagePullBackOff"||W==="ErrImagePull")return{kind:"failed",reason:"image-pull-backoff",message:"Sandbox image failed to download. The cluster may be missing pull credentials or the image tag may not exist."};if(W==="CrashLoopBackOff")return{kind:"failed",reason:"crash-loop-backoff",message:"Sandbox crashed during startup and is now in CrashLoopBackOff. Check pod logs."};if(!Y.scheduled&&J.lastFailedSchedulingAt!==void 0&&Q()-G>Z)return{kind:"failed",reason:"scheduling-timeout",message:J.failedSchedulingMessage??`Pod could not be scheduled within ${Math.round(Z/1000)}s.`};if(Y.containerRunning&&!Y.containerReady)return{kind:"warming-daemon",since:G};if(J.hasPulling&&!J.hasPulled)return{kind:"pulling-image",since:G};if(W==="ContainerCreating"||W==="PodInitializing"||Y.scheduled&&!Y.containerRunning)return{kind:"starting-container",since:G};if(Y.scheduledFalseReason==="Unschedulable"||J.lastFailedSchedulingAt!==void 0&&!Y.scheduled)return{kind:"waiting-for-capacity",since:G,message:J.failedSchedulingMessage??Y.scheduledFalseMessage,nodeClaim:J.nominatedNodeClaim};return{kind:"claiming",since:G}}function v51($){return $.kind==="ready"||$.kind==="failed"}function pA$($){switch($.kind){case"claiming":return 0;case"waiting-for-capacity":return 1;case"pulling-image":return 2;case"starting-container":return 3;case"warming-daemon":return 4;case"ready":case"failed":return 99}}function b51($){switch($.kind){case"claiming":case"pulling-image":case"starting-container":case"warming-daemon":return $.kind;case"waiting-for-capacity":return`waiting-for-capacity:${$.message??""}:${$.nodeClaim??""}`;case"ready":return"ready";case"failed":return`failed:${$.reason}:${$.message}`}}async function Km4($,Z,Q,Y,X,J,G,W){let K=`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?watch=true&labelSelector=${encodeURIComponent(`${Jm4}=${Q}`)}`;return FT0({kc:$,path:K,signal:Y,label:`pod/${Q}`,onEvent:(H)=>{if(H.type!=="ADDED"&&H.type!=="MODIFIED")return;let F=H.object;if(F.metadata?.name)W(F.metadata.name);Hm4(F,X,G),J("pod")}})}function Hm4($,Z,Q){let X=($.status?.conditions??[]).find((G)=>G.type==="PodScheduled");if(X?.status==="True")Z.pod.scheduled=!0,Z.pod.scheduledFalseReason=void 0,Z.pod.scheduledFalseMessage=void 0;else if(X?.status==="False")Z.pod.scheduled=!1,Z.pod.scheduledFalseReason=X.reason,Z.pod.scheduledFalseMessage=X.message;let J=($.status?.containerStatuses??[]).find((G)=>G.name===pZ.MAIN_CONTAINER_NAME);if(J)Z.pod.containerWaitingReason=J.state?.waiting?.reason,Z.pod.containerRunning=!!J.state?.running,Z.pod.containerReady=J.ready===!0}async function Fm4($,Z,Q,Y,X,J){let G=`/apis/${pZ.CLAIM_API_GROUP}/${pZ.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(Z)}/${pZ.CLAIM_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${Q}`)}`;return FT0({kc:$,path:G,signal:Y,label:`sandboxclaim/${Q}`,onEvent:(W)=>{if(W.type!=="ADDED"&&W.type!=="MODIFIED")return;let H=W.object.status?.conditions?.find((F)=>F.type==="Ready");if(!H)return;if(H.status==="True")X.sandbox.ready=!0,X.sandbox.notReadyReason=void 0,X.sandbox.notReadyMessage=void 0;else X.sandbox.ready=!1,X.sandbox.notReadyReason=H.reason,X.sandbox.notReadyMessage=H.message;J("sandbox")}})}async function Um4($,Z,Q,Y,X,J,G,W){let K=await Promise.race([Y,new Promise((F)=>{if(X.aborted){F(Q);return}X.addEventListener("abort",()=>F(Q),{once:!0})})]);if(X.aborted)return;let H=`/api/v1/namespaces/${encodeURIComponent(Z)}/events?watch=true&fieldSelector=${encodeURIComponent(`involvedObject.name=${K},involvedObject.kind=Pod`)}`;return FT0({kc:$,path:H,signal:X,label:`events/${Q}`,onEvent:(F)=>{if(F.type!=="ADDED"&&F.type!=="MODIFIED")return;let U=F.object,N=U.reason;if(!N)return;switch(N){case"Pulling":J.events.hasPulling=!0;break;case"Pulled":J.events.hasPulling=!0,J.events.hasPulled=!0;break;case"FailedScheduling":J.events.lastFailedSchedulingAt=W(),J.events.failedSchedulingMessage=U.message;break;case"Nominated":{let B=U.message?.match(/nodeclaim\/([\w-]+)/);if(B)J.events.nominatedNodeClaim=B[1];break}default:return}G("event")}})}async function oA$($){let{kc:Z,namespace:Q,labelSelector:Y,signal:X,onDelete:J}=$,G=`/apis/${pZ.CLAIM_API_GROUP}/${pZ.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(Q)}/${pZ.CLAIM_PLURAL}?watch=true&labelSelector=${encodeURIComponent(Y)}`;return FT0({kc:Z,path:G,signal:X,label:"sandboxclaim-reaper",onEvent:(W)=>{if(W.type!=="DELETED")return;let K=W.object.metadata?.name;if(K)J(K)}})}async function FT0($){let{kc:Z,path:Q,signal:Y,label:X,onEvent:J}=$,G=0;while(!Y.aborted){try{let K=await bW(Z,{method:"GET",path:Q,signal:Y,headers:{accept:"application/json"},stream:!0});if(!K.ok||!K.body){try{await K.body?.cancel()}catch{}if(K.status===401||K.status===403){console.warn(`[lifecycle-watcher] ${X} stopped: watch denied (${K.status} ${K.statusText}). `+"The kubeconfig in use cannot watch SandboxClaims \u2014 if you are running locally, "+"this provider should not be active (check STUDIO_AGENT_SANDBOX_ENABLED).");return}throw Error(`watch handshake failed: ${K.status} ${K.statusText}`)}G=0;for await(let H of Gw$(K.body)){if(Y.aborted)return;try{J(H)}catch(F){console.warn(`[lifecycle-watcher] ${X} onEvent threw: ${F instanceof Error?F.message:String(F)}`)}}}catch(K){if(Y.aborted)return;let H=K instanceof Error?K.message:String(K);console.warn(`[lifecycle-watcher] ${X} watch ended: ${H}`)}if(Y.aborted)return;let W=D7(5000,250,G,2,0);G+=1,await L$(W,{signal:Y}).catch(()=>{})}}var Jm4="studio.decocms.com/sandbox-handle",Gm4=300000,Wm4=600000;var rA$=D(()=>{a$();$10();lH0()});import{createHash as Nm4}from"crypto";import{z as yX}from"zod";function vU($){let Z;try{Z=new URL($.trim())}catch{return null}if(Z.protocol!=="https:"||Z.search||Z.hash)return null;let Q=Z.pathname.replace(/\/+$/,"").replace(/\.git$/,"").replace(/\/+$/,"");return Q?`https://${Z.host.toLowerCase()}${Q}`:null}function q10($){return vU($)?.toLowerCase()??null}function wm4($){let Z=new Set;for(let Q of $){let Y=`${q10(Q.repoUrl)??Q.repoUrl}#${Q.branch}`;if(Z.has(Y))return Q;Z.add(Y)}return null}function sA$($){return $.reduce((Z,Q)=>Z+Q.replicas,0)}function eA$($,Z){if(Z.warmPoolName)return Z.warmPoolName;let Q=Nm4("sha256").update(`${Z.repoUrl}#${Z.branch}`).digest("hex").slice(0,8);return`${$}-${Q}`}function $T$($){return Math.max(0,$.size-sA$($.repos))}function lm($){return $.flatMap((Z)=>Z.repos.map((Q)=>({pool:Z,repo:Q,warmPoolName:eA$(Z.name,Q)})))}function jm4($,Z){return YT$(void 0,$,!0,Z)}function ZT$($,{templateName:Z}){let Q=jm4(Z,$.image),Y=(X,J)=>({apiVersion:`${pZ.CLAIM_API_GROUP}/${pZ.CLAIM_API_VERSION}`,kind:"SandboxWarmPool",metadata:{name:X,labels:{[Em4]:$.name}},spec:{replicas:J,updateStrategy:{type:"OnReplenish"},sandboxTemplateRef:{name:Q}}});return[...$.repos.map((X)=>Y(eA$($.name,X),X.replicas)),Y($.name,$T$($))]}function NT0($){return $.tenant?.orgId}function f51($,Z){if(!Z.tenant)return null;let Q=$.filter((J)=>J.tenant===Z.tenant&&J.image===Z.image),Y=Z.cloneUrl?q10(Z.cloneUrl):null;if(Y){let J=lm(Q).filter((W)=>q10(W.repo.repoUrl)===Y),G=J.find((W)=>W.repo.branch===Z.branch)??J[0];if(G)return G}let X=Q.find((J)=>$T$(J)>0);return X?{pool:X,repo:null,warmPoolName:X.name}:null}function QT$($,Z,Q){return $?.warmPoolName??(Z?Q:"none")}function YT$($,Z,Q=!1,Y){let X=Y&&Y!=="default"?`-${Y}`:"";return`${Z}${X}${$==="harness-run"||Q?"-medium":""}`}async function y51($){let Z=YT$($.purpose,$.templateName,$.tenantPool,$.sandboxImage);if(Z===$.templateName)return{name:Z,probes:$.probes};let Q=$.probes[Z]??null,Y=Q!==null&&$.now-Q.checkedAt<$.ttlMs?Q:{checkedAt:$.now,present:await $.exists(Z)},X={...$.probes,[Z]:Y};if(Y.present)return{name:Z,probes:X};if(Q?.present!==!1)$.onAbsent?.(Z);if($.sandboxImage&&$.sandboxImage!=="default")return y51({...$,sandboxImage:void 0,probes:X});return{name:$.templateName,probes:X}}function g51($,Z,Q){let Y=q10(Z);if(!Y)return[];let X=Q.replace(/^refs\/heads\//,"");return lm($).filter(({repo:J})=>q10(J.repoUrl)===Y&&J.branch===X)}class h51{source;dirty=new Set;pods=new Map;known=new Map;constructor($){this.source=$}pools(){return this.source()}resolve($){return f51(this.pools(),$)}markDirty($,Z){let Q=g51(this.pools(),$,Z).map((Y)=>Y.warmPoolName);for(let Y of Q)this.dirty.add(Y);return Q}takeDirty($){return this.dirty.delete($)}pod($){return this.pods.get($)}setPod($,Z){this.pods.set($,Z)}retainPods($,Z){for(let[Q,Y]of this.pods)if(Y.pool===$&&!Z.has(Q))this.pods.delete(Q)}retain($){let Z=new Map($.map((Y)=>[Y.warmPoolName,Y])),Q=[...this.known.values()].filter((Y)=>!Z.has(Y.warmPoolName));for(let Y of this.dirty)if(!Z.has(Y))this.dirty.delete(Y);for(let[Y,X]of this.pods)if(!Z.has(X.pool))this.pods.delete(Y);return this.known=Z,Q}}var Bm4=54,Dm4,Om4=2048,Lm4,M10,UT0,x51,aA$,Em4="studio.decocms.com/tenant-pool";var I10=D(()=>{i4();$10();Dm4=/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/;Lm4=yX.object({runtime:yX.enum(["node","bun","deno"]).default("node"),packageManager:yX.enum(["npm","pnpm","yarn","bun","deno"]).optional(),packageManagerPath:yX.string().optional(),devPort:yX.number().int().positive().optional()}).default({runtime:"node"}),M10=yX.object({repoUrl:yX.string().max(Om4).transform(($,Z)=>{let Q=vU($);if(Q)return Q;return Z.addIssue({code:"custom",message:"repoUrl must be an https clone URL"}),yX.NEVER}),branch:yX.string().min(1).default("main"),workload:Lm4,replicas:yX.number().int().min(1)});UT0=class UT0 extends Error{poolName;size;allocated;constructor($,Z,Q){super(`pool ${$}: repos take ${Q} replicas, more than its size ${Z}`);this.poolName=$;this.size=Z;this.allocated=Q;this.name="TenantPoolCapacityError"}};x51=yX.object({name:yX.string().max(Bm4).regex(Dm4,"pool name must be a DNS label (lowercase alphanumeric and '-')"),tenant:yX.string().min(1).max(512),size:yX.number().int().min(1),image:UU.default("default")}),aA$=x51.extend({repos:yX.array(M10).default([])}).superRefine(($,Z)=>{let Q=wm4($.repos);if(Q)Z.addIssue({code:"custom",path:["repos"],message:`duplicate repo allocation ${Q.repoUrl}#${Q.branch}`});let Y=sA$($.repos);if(Y>$.size)Z.addIssue({code:"custom",path:["repos"],message:new UT0($.name,$.size,Y).message})})});async function XT$($,Z,Q){let Y=new Map;for(let X of $){let J=Z(X);if(!J)continue;let G=Y.get(J);if(G)G.push(X);else Y.set(J,[X])}await Promise.allSettled([...Y.values()].map(async(X)=>{for(let J of X)await Q(J).catch(()=>{})}))}function zm4($){try{let Z=new URL($);if(Z.hostname.toLowerCase()!=="github.com")return null;let[Q,Y]=Z.pathname.replace(/^\/+/,"").split("/"),X=Y?.replace(/\.git$/,"");return Q&&X?`${Q}/${X}`.toLowerCase():null}catch{return null}}function JT$($){if($.repositoryId)return{repositoryId:$.repositoryId};let Z=$.connectionId?zm4($.cloneUrl):null;return $.connectionId&&Z?{connectionId:$.connectionId,repo:Z}:null}var GT$=D(()=>{I10()});async function cm($,Z,Q,Y){let X=(G)=>GT0(G.url,G.token,Z,Q),J=!(Q.body instanceof ReadableStream);try{let G=await X($);if(G.status!==401||!J)return G;let W=await Y.unauthorized();if(!W)return G;return await G.body?.cancel().catch(()=>{}),await X(W)}catch(G){if(!J)throw G;let W=await Y.unreachable();if(!W)throw G;return X(W)}}var BT0=D(()=>{Gf()});function HT$($,Z){return new Response(JSON.stringify(Z),{status:$,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function WT$($){let Z=new Headers;for(let[Q,Y]of $.headers.entries())if(!Am4.includes(Q.toLowerCase()))Z.set(Q,Y);return new Response($.body,{status:$.status,statusText:$.statusText,headers:Z})}function KT$($,Z){let Q=HT$($,{error:Z});return Q.headers.set("x-sandbox-preview-not-ready","1"),Q}async function dm($,Z,Q){let Y=await Z.base();if(!Y)return KT$(404,"sandbox not found");let X=new URL($.url);if((X.pathname==="/_sandbox"||X.pathname.startsWith("/_sandbox/"))&&$.method!=="GET")return HT$(404,{error:"not found"});let G=(F)=>`${F}${X.pathname}${X.search}`,W=new Headers($.headers);for(let F of Pm4)W.delete(F);let K=$.method!=="GET"&&$.method!=="HEAD",H={method:$.method,headers:W,body:K?$.body:void 0,redirect:"manual",signal:$.signal,duplex:K?"half":void 0};try{return WT$(await fetch(G(Y),H))}catch(F){let U=`${Y}${X.pathname}`;if(console.warn(`[${Q}] preview fetch to ${U} failed: ${F instanceof Error?F.message:String(F)}`),Z.invalidate(),$.method==="GET"||$.method==="HEAD"){let N=await Z.retryBase();if(N)try{return WT$(await fetch(G(N),H))}catch(B){console.warn(`[${Q}] preview fetch retry to ${U} failed: ${B instanceof Error?B.message:String(B)}`)}}return KT$(502,"sandbox daemon unreachable")}}var mm="x-sandbox-preview-not-ready",Pm4,Am4;var DT0=D(()=>{Pm4=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length","upgrade"],Am4=["connection","keep-alive","transfer-encoding","content-encoding","content-length"]});import{createHash as Tm4,randomBytes as Rm4,randomUUID as FT$}from"crypto";import*as wT$ from"net";import{PassThrough as qm4}from"stream";function UT$($){if($ instanceof Error)return $.message;if($&&typeof $==="object"){let Z=$;if(Z.error instanceof Error)return Z.error.message;if(typeof Z.message==="string"&&Z.message)return Z.message}return String($)}function DT$($){return{pool:$.warmPoolName,org:$.pool.tenant}}class p51{records=new Map;inflight=new Wf;activeGauge=new WT0;stateStore;previewUrlPattern;kubeConfig;capacityProbe;portForward;namespace;sandboxTemplateName;envName;tokenGenerator;idleTtlMs;metrics;previewGateway;sentinelToken;mintCloneUrl;mintPoolCloneUrl;mintOrgFsConfig;forwardPort;daemonAddress;persistCredentials;tenantPools;tenantPoolRefreshMs;templateProbes={};closed=!1;claimWatchAbort=new AbortController;constructor($={}){this.stateStore=$.stateStore??null,this.previewUrlPattern=$.previewUrlPattern??null,this.kubeConfig=$.kubeConfig??gm4(),this.portForward=new N51(this.kubeConfig),this.namespace=$.namespace??Mm4,this.sandboxTemplateName=$.sandboxTemplateName??Im4,this.envName=mm4($.envName),this.tokenGenerator=$.tokenGenerator??(()=>Rm4(km4).toString("hex")),this.idleTtlMs=$.idleTtlMs??Cm4,this.metrics=$.meter?ym4($.meter):null,this.previewGateway=$.previewGateway&&$.previewUrlPattern?{...$.previewGateway}:null;let Z=$.sentinelToken?.trim()??"";this.sentinelToken=Z.length>0?Z:null,this.mintCloneUrl=$.mintCloneUrl,this.mintPoolCloneUrl=$.mintPoolCloneUrl,this.mintOrgFsConfig=$.mintOrgFsConfig,this.forwardPort=$.forwardPort,this.daemonAddress=$.daemonAddress??"forward",this.persistCredentials=$.persistCredentials??!0;let Q=$.tenantPools;if(this.tenantPools=this.sentinelToken===null?null:new h51(typeof Q==="function"?Q:()=>Q??[]),this.sentinelToken===null&&(typeof Q==="function"||(Q?.length??0)>0))console.warn(`[${T6}] tenant pools configured without a sentinel token \u2014 ignoring them (warm-pool mode is off)`);this.tenantPoolRefreshMs=$.tenantPoolRefreshMs??vm4,this.startClaimReaper(),this.startCredentialRefresher(),this.startTenantPoolReconciler()}startClaimReaper(){let $=["app.kubernetes.io/managed-by=studio","app.kubernetes.io/name=studio-sandbox",...this.envName?[`${gX.env}=${this.envName}`]:[]].join(",");oA$({kc:this.kubeConfig,namespace:this.namespace,labelSelector:$,signal:this.claimWatchAbort.signal,onDelete:(Z)=>this.invalidateRecord(Z)})}async ensure($,Z={}){let Q=N3($);if(Q.startsWith("s-"))throw Error(`ensure: projectRef has no slug source: ${$.projectRef}`);return this.inflight.run(Q,()=>KT0(this.stateStore,$,(Y)=>this.ensureLocked($,Q,Z,Y)))}async delete($){let Z=await this.getRecord($);if(this.records.delete($),Z)this.dropRecord(Z);if(await this.deleteHttpRouteIfManaged($).catch((Q)=>{console.warn(`[${T6}] HTTPRoute delete failed for ${$}: ${Q instanceof Error?Q.message:String(Q)}`)}),await vA(this.kubeConfig,this.namespace,$),this.stateStore)if(Z)await this.stateStore.delete(Z.id);else await this.stateStore.deleteByHandle($)}lastTermination($){return sL$(this.kubeConfig,this.namespace,gX.sandboxHandle,$,pZ.MAIN_CONTAINER_NAME)}async alive($){return await jD(this.kubeConfig,this.namespace,$)!==void 0}watchClaimLifecycle($,Z){return nA$({kc:this.kubeConfig,namespace:this.namespace,claimName:$,signal:Z})}hasSchedulableCapacity(){return this.capacityProbe??=Kw$(this.kubeConfig,this.namespace),this.capacityProbe()}async getPreviewUrl($){let Z=await this.getRecord($);if(!Z)return null;return this.composePreviewUrl(Z)}async proxyDaemonRequest($,Z,Q){let Y=await this.getRecord($);if(!Y&&this.previewUrlPattern&&this.stateStore){let K=await this.stateStore.getByHandle($),H=K?.state,F=H?.token;if(K&&F){let N=`http://${H?.adoptedSandboxName??$}.${this.namespace}.svc.cluster.local:${bU}`;try{let B=await GT0(N,F,Z,Q);if(B.status!==404)return B;try{await B.body?.cancel()}catch{}}catch{}}}if(!Y)Y=await this.resurrectByHandle($);if(!Y)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let X=Y,J=performance.now(),G=0,W=(K)=>{return X=K,{url:K.daemonUrl,token:K.token}};try{let K=await cm(W(Y),Z,Q,{unauthorized:async()=>{this.invalidateRecord($);let H=await this.getRecord($).catch(()=>null)??await this.resurrectByHandle($).catch(()=>null);return H?W(H):null},unreachable:async()=>{this.invalidateRecord($);let H=await this.resurrectByHandle($)??await this.getRecord($).catch(()=>null);return H?W(H):null}});return G=K.status,K}finally{this.recordProxyDuration("daemon",G,X,performance.now()-J)}}async adoptLiveClaim($,Z){if(this.records.has(Z))return!0;let Q=await jD(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!Q||Q.metadata?.deletionTimestamp)return!1;return await this.inflight.run(Z,async()=>{let X=this.records.get(Z);if(X)return this.toSandbox(X);let J=await this.adopt($,Z,Q);if(!J)throw Error(`cannot adopt live claim ${Z}`);return KT0(this.stateStore,$,(G)=>this.finish(J,G,!0,!0,"adopt"))}).catch(()=>null)!=null}async resolvePreviewUpstreamUrl($){if(this.previewUrlPattern)return`http://${await this.resolveServiceNameForHandle($)}.${this.namespace}.svc.cluster.local:${bU}`;let Z=await this.getRecord($);if(Z)return Z.daemonUrl;let Q=await this.resurrectByHandle($);return Q?Q.daemonUrl:null}async daemonEndpoint($){let Z=await this.getRecord($)??await this.resurrectByHandle($);if(!Z)return null;return{url:this.daemonAddress==="service"?`http://${Z.adoptedSandboxName}.${this.namespace}.svc.cluster.local:${bU}`:Z.daemonUrl,token:Z.token}}listSandboxes(){return[...this.records.values()].map(($)=>{let Z=$.ensureOpts,Q=Z?.tenant;return{handle:$.handle,tenant:Q?{orgId:Q.orgId,userId:Q.userId}:null,repos:[Z?.repo,...Z?.extraRepos??[]].filter((Y)=>Y!==void 0).map(JT$).filter((Y)=>Y!==null),orgFs:Boolean(Z?.orgFsConfigJson)||$.orgFsRedacted===!0}})}async resolveServiceNameForHandle($){let Z=this.records.get($);if(Z)return Z.adoptedSandboxName;if(this.stateStore){let Y=(await this.stateStore.getByHandle($).catch(()=>null))?.state?.adoptedSandboxName;if(Y)return Y}return $}async proxyPreviewRequest($,Z){let Q=performance.now(),Y=this.records.get($)??null,X=0;try{let J=await dm(Z,{base:()=>this.resolvePreviewUpstreamUrl($),invalidate:()=>this.invalidateRecord($),retryBase:async()=>{return await this.resurrectByHandle($).catch(()=>null)?this.resolvePreviewUpstreamUrl($):null}},T6);return X=J.status,J}finally{this.recordProxyDuration("preview",X,Y,performance.now()-Q,$)}}async ensureLocked($,Z,Q,Y){if(Q.image)console.warn(`[${T6}] opts.image ignored (template ${this.sandboxTemplateName} pins image): got ${Q.image}`);if(Y){let G=await Y.get($);if(G){let W=await this.rehydrate($,Z,G);if(W)return await this.refreshDaemonGitCredential(W,Q),await this.relayOrgFsConfig(W.daemonUrl,W.token,Q.orgFsConfigJson),this.finish(W,Y,!1,!0,"resume");await Y.delete($)}}let X=await jD(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(X)if(X.metadata?.deletionTimestamp)await Y10(this.kubeConfig,this.namespace,Z).catch((G)=>{console.warn(`[${T6}] wait for terminating claim ${Z} failed: ${G instanceof Error?G.message:String(G)}`)});else if(!u51(X)){let G=await this.join($,Z,Q,X).catch((W)=>{return console.warn(`[${T6}] join of starting claim ${Z} failed, recreating: ${W instanceof Error?W.message:String(W)}`),null});if(G)return this.finish(G,Y,!0,!0,"adopt");await vA(this.kubeConfig,this.namespace,Z).catch(()=>{}),await Y10(this.kubeConfig,this.namespace,Z).catch((W)=>{console.warn(`[${T6}] wait for deleted claim ${Z} failed: ${W instanceof Error?W.message:String(W)}`)})}else{let G=await this.adopt($,Z,X).catch((W)=>{return console.warn(`[${T6}] adopt ${Z} failed, recreating: ${W instanceof Error?W.message:String(W)}`),null});if(G)return await this.refreshDaemonGitCredential(G,Q),await this.relayOrgFsConfig(G.daemonUrl,G.token,Q.orgFsConfigJson),this.finish(G,Y,!0,!0,"adopt");await vA(this.kubeConfig,this.namespace,Z).catch(()=>{}),await Y10(this.kubeConfig,this.namespace,Z).catch((W)=>{console.warn(`[${T6}] wait for deleted claim ${Z} failed: ${W instanceof Error?W.message:String(W)}`)})}let J=await this.provision($,Z,Q);return this.finish(J,Y,!0,!1,"fresh")}async finish($,Z,Q,Y,X){let J=this.records.get($.handle),G=J!==void 0;if(J&&J.daemonForward!==$.daemonForward)this.closeForwarder(J.daemonForward);if(this.records.set($.handle,$),Q)await this.persist(Z,$);if(Y)await uH0(this.kubeConfig,this.namespace,$.handle,this.computeShutdownTime()).catch((W)=>console.warn(`[${T6}] TTL refresh failed for ${$.handle}: ${W instanceof Error?W.message:String(W)}`));if(this.metrics){let W=m51($.tenant);if(this.metrics.ensureOutcome.add(1,{...W,outcome:X}),!G)this.metrics.active.add(1,W),this.activeGauge.markCounted($.handle)}return this.toSandbox($)}buildEnvMap($,Z){let Q={},Y=[];for(let[X,J]of Object.entries($.env??{}))if(Sm4.has(X))Y.push(X);else Q[X]=J;if(Y.length>0)console.warn(`[${T6}] opts.env keys overlap reserved bootstrap names and were dropped: ${Y.join(",")}`);return{...Q,DAEMON_TOKEN:Z.token,DAEMON_BOOT_ID:Z.daemonBootId,APP_ROOT:Z.workdir,PROXY_PORT:String(bU)}}async resolveTemplateName($,Z,Q){let{name:Y,probes:X}=await y51({purpose:$,tenantPool:Z,...Q?{sandboxImage:Q}:{},templateName:this.sandboxTemplateName,probes:this.templateProbes,now:Date.now(),ttlMs:Vm4,exists:(J)=>nL$(this.kubeConfig,this.namespace,J),onAbsent:(J)=>console.warn(`[${T6}] SandboxTemplate ${J} not found (or not readable) \u2014 this claim falls back to a template without that suffix. Upgrade the sandbox-env chart to the version that renders it.`)});return this.templateProbes=X,Y}buildClaim($,Z,Q,Y,X){let J=this.sentinelToken!==null,G=J?[]:Object.entries(this.buildEnvMap(Z,Q)).sort(([H],[F])=>H<F?-1:H>F?1:0).map(([H,F])=>({name:H,value:F})),W=pm4(Z),K=Object.keys(W).length>0;return{apiVersion:`${pZ.CLAIM_API_GROUP}/${pZ.CLAIM_API_VERSION}`,kind:"SandboxClaim",metadata:{name:$,namespace:this.namespace,labels:{"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[gX.env]:this.envName}:{},...c51(Z.tenant)},...K?{annotations:W}:{}},spec:{sandboxTemplateRef:{name:X},additionalPodMetadata:{labels:c51(Z.tenant,{[gX.role]:"claimed",[gX.sandboxHandle]:$,...this.envName?{[gX.env]:this.envName}:{}}),...K?{annotations:W}:{}},env:G,warmpool:QT$(Y,J,X),lifecycle:{shutdownPolicy:"Delete",shutdownTime:this.computeShutdownTime()}}}}async provision($,Z,Q){let Y=this.tokenGenerator(),X=FT$(),J=OT0,G=this.claimTenantPoolBinding(Q),W=this.buildClaim(Z,Q,{token:Y,daemonBootId:X,workdir:J},G,await this.resolveTemplateName(Q.purpose,G!==null,Q.sandboxImage));try{await v41(this.kubeConfig,this.namespace,W)}catch(K){if(K instanceof e00)await Y10(this.kubeConfig,this.namespace,Z),await v41(this.kubeConfig,this.namespace,W);else throw K}return this.bind($,Z,Q,G,{token:Y,daemonBootId:X,workdir:J})}claimTenantPoolBinding($){return this.tenantPools?.resolve({tenant:NT0($),image:$.sandboxImage??"default",cloneUrl:$.repo?.cloneUrl,branch:$.repo?.branch})??null}async bind($,Z,Q,Y,{token:X,daemonBootId:J,workdir:G}){let W;try{W=await tL$(this.kubeConfig,this.namespace,Z),await tA$((B)=>this.watchClaimLifecycle(Z,B))}catch(B){throw await vA(this.kubeConfig,this.namespace,Z).catch(()=>{}),B}try{await this.ensureServicePortForAdoptedSandbox(W),await this.ensureHttpRouteForHandle(Z,W,Q.tenant??null)}catch(B){throw await vA(this.kubeConfig,this.namespace,Z).catch(()=>{}),B}let K=await this.openForwarder(W,bU,Z),H=`http://127.0.0.1:${K.localPort}`,F=Y?.repo!=null&&W!==Z,U=this.workloadConfigPayload(Q,F),N=J;try{if(await _51(H),this.sentinelToken!==null){let B=await JT0(H);if(B)N=B.bootId;try{await _U(H,this.sentinelToken,U??{},{rotateToken:X})}catch(O){if(O instanceof PH&&O.status===401)console.warn(`[${T6}] sentinel rejected by adopted pod (handle=${Z}, sandbox=${W}): pod belongs to another claim; tearing down and reprovisioning`);throw O}}else if(U)await _U(H,X,U);await this.relayOrgFsConfig(H,X,Q.orgFsConfigJson)}catch(B){throw this.closeForwarder(K),await this.deleteHttpRouteIfManaged(Z).catch(()=>{}),await vA(this.kubeConfig,this.namespace,Z).catch(()=>{}),B}return{id:$,handle:Z,adoptedSandboxName:W,token:X,workdir:G,daemonUrl:H,daemonForward:K,workload:Q.workload??null,daemonBootId:N,tenant:Q.tenant??null,tenantPoolPodBound:F,ensureOpts:am4(Q)}}workloadConfigPayload($,Z){return hm({runtime:$?.workload?.runtime??"node",packageManager:$?.workload?.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:$?.repo??null,extraRepos:$?.extraRepos??[],port:$?.workload?.devPort??NT$,tenant:$?.tenant??void 0,...$?{cloneOnly:$.cloneOnly===!0&&!Z}:{}})}async relayOrgFsConfig($,Z,Q){if(!Q)return;await A10($,Z,Q).catch((Y)=>console.warn("[org-fs] sidecar config relay failed",Y))}async refreshDaemonGitCredential($,Z){let Q=R10(Z);if(!Q)return;try{await _U($.daemonUrl,$.token,Q)}catch(Y){console.warn(`[${T6}] git credential refresh failed for ${$.handle}: ${Y instanceof Error?Y.message:String(Y)}`)}}async withFreshCloneUrl($,Z={}){if(!this.mintCloneUrl)return $;try{let Q=await this.mintCloneUrl($,Z);if(!Q)return $;let{credentialExpiresAt:Y,...X}=$;return{...X,cloneUrl:Q}}catch(Q){return console.warn(`[${T6}] clone credential re-mint failed: ${Q instanceof Error?Q.message:String(Q)}`),$}}async withFreshCredentials($,Z=!1){return{...$,...$.repo?{repo:await this.withFreshCloneUrl($.repo,{tenant:$.tenant})}:{},...$.orgFsConfigJson||Z?{orgFsConfigJson:await rm4($,this.mintOrgFsConfig)}:{}}}startCredentialRefresher(){if(!this.mintCloneUrl)return;let{signal:$}=this.claimWatchAbort;(async()=>{while(!$.aborted){if(await L$(bm4,{signal:$}).catch(()=>{}),$.aborted)break;try{await this.refreshAllGitCredentials()}catch(Z){console.warn(`[${T6}] periodic credential refresh failed: ${Z instanceof Error?Z.message:String(Z)}`)}}})()}startTenantPoolReconciler(){let $=this.tenantPools;if(!$)return;let{signal:Z}=this.claimWatchAbort;(async()=>{while(!Z.aborted){try{await this.reconcileTenantPools($)}catch(Q){console.warn(`[${T6}] tenant pool reconcile failed: ${Q instanceof Error?Q.message:String(Q)}`)}await L$(_m4,{signal:Z}).catch(()=>{})}})()}listTenantPools(){return this.tenantPools?.pools()??[]}markTenantPoolsDirty($,Z){return Promise.resolve(this.tenantPools?.markDirty($,Z)??[])}async reconcileTenantPools($){let Z=lm($.pools());for(let Q of $.retain(Z))this.recordPoolGone(Q);for(let Q of Z){let Y=Q.warmPoolName,X=await oL$(this.kubeConfig,this.namespace,Y);if(X===null){console.warn(`[${T6}] tenant pool ${Y}: no SandboxWarmPool (or no selector yet) in ${this.namespace}`);continue}let J=$.takeDirty(Y),G=X.filter((W)=>!W.labels[gX.sandboxHandle]);$.retainPods(Y,new Set(X.map((W)=>W.uid)));for(let W of G){if(this.claimWatchAbort.signal.aborted)return;await this.warmPoolPod($,Q,W,J)}this.recordPoolDepth($,Q,X,G)}}recordPoolGone($){let Z=DT$($);for(let Q of["ready","bound","pending","failed"])this.metrics?.poolPods.record(0,{...Z,state:Q})}recordPoolDepth($,Z,Q,Y){let X=this.metrics?.poolPods;if(!X)return;let J=0,G=0;for(let K of Y){let H=$.pod(K.uid);if(!H)continue;if(H.failures>=LT0)G++;else if(H.lastConfigAt>0)J++}let W=DT$(Z);X.record(J,{...W,state:"ready"}),X.record(Q.length-Y.length,{...W,state:"bound"}),X.record(Y.length-J-G,{...W,state:"pending"}),X.record(G,{...W,state:"failed"})}async warmPoolPod($,Z,Q,Y){let X=Z.warmPoolName,{workload:J}=Z.repo,G=$.pod(Q.uid);if(G&&G.failures>=LT0){if(Date.now()-G.lastFailureAt<BT$)return;$.setPod(Q.uid,{...G,failures:0})}let W=Y||G!==void 0&&Date.now()-G.lastConfigAt>=this.tenantPoolRefreshMs;if(G&&!W)return;let K=await this.allocationCloneUrl(Z);if(!K){this.recordPoolFailure($,Q,X,"clone credential mint failed");return}let H={cloneUrl:K,branch:Z.repo.branch,userName:"",userEmail:""},F=await this.openForwarder(Q.name,bU,Q.name).catch(()=>null);if(!F){this.recordPoolFailure($,Q,X,"port-forward failed");return}let U=`http://127.0.0.1:${F.localPort}`;try{await _51(U);let N=this.sentinelToken;if(!N)return;if(!await this.isPoolPodUnbound(Q))return;let B=hm({runtime:J.runtime,packageManager:J.packageManager?{name:J.packageManager,...J.packageManagerPath?{path:J.packageManagerPath}:{}}:null,repo:H,port:J.devPort??NT$})??{},{transition:O}=await _U(U,N,B);if(W&&O!=="bootstrap"&&await this.isPoolPodUnbound(Q))await hA$(U,N,"clone");$.setPod(Q.uid,{pool:X,lastConfigAt:Date.now(),lastFailureAt:0,failures:0}),console.log(`[${T6}] tenant pool ${X}: warmed ${Q.name} (${O})`)}catch(N){this.recordPoolFailure($,Q,X,N instanceof Error?N.message:String(N))}finally{this.closeForwarder(F)}}async allocationCloneUrl({pool:$,repo:Z}){if(!this.mintPoolCloneUrl)return`${Z.repoUrl}.git`;try{return await this.mintPoolCloneUrl({tenant:$.tenant,repoUrl:Z.repoUrl,branch:Z.branch})}catch(Q){return console.warn(`[${T6}] tenant pool clone credential mint failed: ${Q instanceof Error?Q.message:String(Q)}`),null}}isPoolPodUnbound($){return rL$(this.kubeConfig,this.namespace,$.name,gX.sandboxHandle)}recordPoolFailure($,Z,Q,Y){let X=$.pod(Z.uid),J=(X?.failures??0)+1;$.setPod(Z.uid,{pool:Q,lastConfigAt:X?.lastConfigAt??0,lastFailureAt:Date.now(),failures:J});let G=J>=LT0?` \u2014 backing off ${BT$/60000}min`:"";console.warn(`[${T6}] tenant pool ${Q}: warming ${Z.name} failed (${J}/${LT0})${G}: ${Y}`)}async refreshAllGitCredentials(){await XT$(this.records.values(),($)=>$.ensureOpts?.repo?.connectionId,async($)=>{if(this.claimWatchAbort.signal.aborted)return;let Z=$.ensureOpts?.repo;if(!Z)return;try{let Q=await this.withFreshCloneUrl(Z,{bufferMs:xm4,tenant:$.ensureOpts?.tenant});await this.refreshDaemonGitCredential($,{...$.ensureOpts,repo:Q}),$.ensureOpts={...$.ensureOpts,repo:Q}}catch(Q){throw console.warn(`[${T6}] git credential refresh failed for ${$.handle}: ${Q instanceof Error?Q.message:String(Q)}`),Q}})}async rebootstrapDaemon($,Z,Q){if(this.sentinelToken===null)return!1;let Y=this.workloadConfigPayload(Q,!1)??{};try{return await _U($,this.sentinelToken,Y,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,Q?.orgFsConfigJson),!0}catch(X){if(X instanceof PH&&X.status===401)try{return await _U($,Z,Y,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,Q?.orgFsConfigJson),!0}catch(J){return console.warn(`[${T6}] re-bootstrap retry with claim token failed: ${J instanceof Error?J.message:String(J)}`),!1}return console.warn(`[${T6}] re-bootstrap failed: ${X instanceof Error?X.message:String(X)}`),!1}}async ensureServicePortForAdoptedSandbox($){if(!this.previewGateway||!this.previewUrlPattern)return;await Jw$(this.kubeConfig,this.namespace,$,{name:"daemon",port:bU,targetPort:bU})}async ensureHttpRouteForHandle($,Z,Q){if(!this.previewGateway||!this.previewUrlPattern)return;let Y=em4(this.previewUrlPattern,$);if(!Y)throw new xY(`Unable to derive preview hostname for ${$} from pattern: ${this.previewUrlPattern}`);let X={apiVersion:`${x41.API_GROUP}/${x41.API_VERSION}`,kind:"HTTPRoute",metadata:{name:$,namespace:this.namespace,labels:c51(Q??void 0,{[gX.role]:"claimed",[gX.sandboxHandle]:$,"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[gX.env]:this.envName}:{}})},spec:{parentRefs:[{kind:"Gateway",group:"gateway.networking.k8s.io",name:this.previewGateway.name,namespace:this.previewGateway.namespace}],hostnames:[Y],rules:[{backendRefs:[{group:"",kind:"Service",name:Z,port:bU}]}]}};await Qw$(this.kubeConfig,this.namespace,X)}async deleteHttpRouteIfManaged($){if(!this.previewGateway)return;await Yw$(this.kubeConfig,this.namespace,$)}async rehydrate($,Z,Q){let Y=Q.state;if(!Y.adoptedSandboxName&&!Y.podName||!Y.token)return null;let X=await jD(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!X||!u51(X))return null;let J=X.status?.sandbox?.name??Y.adoptedSandboxName??Y.podName??Z,G=await this.openAndProbeDaemon(J,Z);if(!G)return null;if(Y.daemonBootId&&Y.daemonBootId!==G.bootId){if(this.sentinelToken!==null){let W=Y.ensureOpts?await this.withFreshCredentials(Y.ensureOpts,Y.orgFsRedacted===!0):null;if(!await this.rebootstrapDaemon(G.daemonUrl,Y.token,W))return this.closeForwarder(G.daemonForward),null}else console.warn(`[${T6}] daemon restart detected (handle=${Z}): stored bootId=${Y.daemonBootId} live bootId=${G.bootId}`);await this.stateStore?.put($,{handle:Z,state:{...Y,daemonBootId:G.bootId}}).catch((W)=>console.warn(`[${T6}] bootId persist failed for ${Z}: ${W instanceof Error?W.message:String(W)}`))}return{id:$,handle:Z,adoptedSandboxName:J,tenantPoolPodBound:!1,token:Y.token,workdir:Y.workdir??OT0,daemonUrl:G.daemonUrl,daemonForward:G.daemonForward,workload:Y.workload??null,daemonBootId:G.bootId,tenant:Y.tenant??null,ensureOpts:Y.ensureOpts??null,orgFsRedacted:Y.orgFsRedacted===!0}}join($,Z,Q,Y){let X=this.sentinelToken!==null,J=X?this.tokenGenerator():l51(Y,"DAEMON_TOKEN"),G=X?FT$():l51(Y,"DAEMON_BOOT_ID");if(!J||!G)throw new xY(`claim ${Z} carries no daemon token`);return this.bind($,Z,Q,this.claimTenantPoolBinding(Q),{token:J,daemonBootId:G,workdir:OT0})}async adopt($,Z,Q){if(!u51(Q))return null;let Y=Q.status?.sandbox?.name??Z;if(this.sentinelToken!==null)return null;let X=l51(Q,"DAEMON_TOKEN");if(!X)return null;let J=await this.openAndProbeDaemon(Y,Z);if(!J)return null;let G=nm4(Q);if(this.previewGateway)await this.ensureServicePortForAdoptedSandbox(Y).catch((W)=>{console.warn(`[${T6}] Service port backfill failed for ${Z}: ${W instanceof Error?W.message:String(W)}`)}),await this.ensureHttpRouteForHandle(Z,Y,G).catch((W)=>{console.warn(`[${T6}] HTTPRoute backfill failed for ${Z}: ${W instanceof Error?W.message:String(W)}`)});return{id:$,handle:Z,adoptedSandboxName:Y,tenantPoolPodBound:!1,token:X,workdir:OT0,daemonUrl:J.daemonUrl,daemonForward:J.daemonForward,workload:null,daemonBootId:J.bootId,tenant:G,ensureOpts:null}}async openAndProbeDaemon($,Z){let Q=await this.openForwarder($,bU,Z).catch(()=>null);if(!Q)return null;let Y=`http://127.0.0.1:${Q.localPort}`,X=await JT0(Y);if(!X)return this.closeForwarder(Q),null;return{daemonForward:Q,daemonUrl:Y,bootId:X.bootId}}async getRecord($){let Z=this.records.get($);if(Z)return Z;if(!this.stateStore)return null;let Q=await this.stateStore.getByHandle($);if(!Q)return null;let Y=await this.rehydrate(Q.id,$,Q);if(Y)this.records.set($,Y);return Y}async resurrectByHandle($){if(!this.stateStore)return null;let Z=await this.stateStore.getByHandle($);if(!Z)return null;let Q=Z.state,Y=Q.ensureOpts;if(!Y)return null;let X=await this.withFreshCredentials(Y,Q.orgFsRedacted===!0);if(N3(Z.id)!==$)return null;return await this.ensure(Z.id,X),this.records.get($)??null}invalidateRecord($){let Z=this.records.get($);if(!Z)return;this.records.delete($),this.dropRecord(Z)}dropRecord($){if(this.closeForwarder($.daemonForward),this.metrics&&this.activeGauge.consume($.handle))this.metrics.active.add(-1,m51($.tenant))}recordProxyDuration($,Z,Q,Y,X){if(!this.metrics)return;this.metrics.proxyDurationMs.record(Y,{...m51(Q?.tenant??null),source:$,sandbox_handle:Q?.handle??X??"",status_code:Z||0})}composePreviewUrl($){if(this.previewUrlPattern)return HT0(this.previewUrlPattern,$.handle);return`http://127.0.0.1:${$.daemonForward.localPort}/`}toSandbox($){return{handle:$.handle,workdir:$.workdir,previewUrl:this.composePreviewUrl($),warmPoolAdopted:$.tenantPoolPodBound===!0,provider:"kubernetes"}}async persist($,Z){if(!$)return;let Q={adoptedSandboxName:Z.adoptedSandboxName,token:Z.token,workdir:Z.workdir,workload:Z.workload,daemonBootId:Z.daemonBootId,tenant:Z.tenant,...Z.ensureOpts?this.persistCredentials?{ensureOpts:Z.ensureOpts}:sm4(Z.ensureOpts,Z.orgFsRedacted===!0):{}};await $.put(Z.id,{handle:Z.handle,state:Q})}computeShutdownTime(){return new Date(Date.now()+this.idleTtlMs).toISOString()}async releaseAfter($,Z){let Q=await jD(this.kubeConfig,this.namespace,$);if(!Q)return;let Y=tm4(Q.spec?.lifecycle?.shutdownTime,new Date(Date.now()+Z));if(!Y)return;await uH0(this.kubeConfig,this.namespace,$,Y).catch((X)=>console.warn(`[${T6}] release failed for ${$}: ${X instanceof Error?X.message:String(X)}`))}async renewTtl($){let Z=await jD(this.kubeConfig,this.namespace,$);if(!Z)return;let Q=om4(Z.spec?.lifecycle?.shutdownTime,new Date(Date.now()+this.idleTtlMs));if(!Q)return;await uH0(this.kubeConfig,this.namespace,$,Q).catch((Y)=>console.warn(`[${T6}] TTL renew failed for ${$}: ${Y instanceof Error?Y.message:String(Y)}`))}openForwarder($,Z,Q=$){if(this.forwardPort)return this.forwardPort($,Z,Q);let Y=hm4(Q,Z);return new Promise((X,J)=>{let G=(W,K)=>{let H=wT$.createServer((F)=>this.handleForwardedConnection(F,$,Z,Q));H.once("error",(F)=>{if(F.code==="EADDRINUSE"&&K<fm4){try{H.close()}catch{}let U=d51+(W-d51+1)%jT$;G(U,K+1);return}J(F)}),H.listen(W,"127.0.0.1",()=>{let F=H.address();if(!F||typeof F==="string"){H.close(),J(Error("port-forward listener failed to bind"));return}let U=F.port;X({localPort:U,close:()=>H.close((N)=>{if(N)console.warn(`[${T6}] port-forward close on :${U} errored: ${N.message}`)})})})};G(Y,0)})}handleForwardedConnection($,Z,Q,Y){let X=new qm4,J=null,G=!1,W=()=>{if(G)return;if(G=!0,X.destroy(),J)try{J.close()}catch{}if(!$.destroyed)$.destroy()};$.pipe(X),$.on("error",W),$.on("close",W),this.portForward.portForward(this.namespace,Z,[Q],$,null,X).then((K)=>{let H=typeof K==="function"?K():K;if(!H){W();return}if(J=H,J.on("close",W),J.on("error",(F)=>{console.warn(`[${T6}] port-forward to ${Z}:${Q} dropped mid-connection: ${UT$(F)}`,JSON.stringify(i51(F))),this.invalidateRecord(Y),W()}),G)try{J.close()}catch{}}).catch((K)=>{console.warn(`[${T6}] port-forward to ${Z}:${Q} failed: ${UT$(K)}`,JSON.stringify(i51(K))),this.invalidateRecord(Y),W()})}closeForwarder($){$.close()}close(){if(this.closed)return;this.closed=!0,this.claimWatchAbort.abort();for(let $ of this.records.values())this.dropRecord($);this.records.clear()}}function ym4($){return{active:$.createUpDownCounter("studio.sandbox.active",{description:"Active sandbox count, by runner kind, owning org, and daemon impl. Cross-checks the cAdvisor-derived count from the cluster \u2014 divergence between the two indicates orphaned claims (studio deleted but K8s didn't reap) or unattributed pods.",unit:"{sandbox}"}),ensureOutcome:$.createCounter("studio.sandbox.ensure.outcome",{description:"Outcome of each ensure() call: fresh provision, resume from state-store after restart, or adopt of a cluster-side claim studio didn't know about. Cold-start ratio is the primary input for warm-pool sizing.",unit:"{call}"}),proxyDurationMs:$.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of studio-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"}),poolPods:$.createGauge("studio.sandbox.pool.pods",{description:"Tenant warm pool depth by pool and state: ready (warmed and unbound \u2014 what a claim can actually bind instantly), bound (serving a user), pending (unbound, not yet warmed), failed (gave up after repeated bootstrap failures). Alert on sustained ready=0: a pool that is always empty is doing nothing while costing N pods.",unit:"{pod}"})}}function i51($){let Z=[],Q=$;for(let Y=0;Y<5&&Q instanceof Error;Y++){let X=Q;if(Z.push({name:X.name,message:X.message,...X.code!==void 0?{code:X.code}:{},...X.errno!==void 0?{errno:X.errno}:{}}),X.cause===Q)break;Q=X.cause}if(Q!==void 0&&!(Q instanceof Error)&&Q!==null){let Y=Q,X=Y.error instanceof Error?i51(Y.error).chain:void 0;Z.push({nonError:String(Q),...typeof Y.type==="string"?{type:Y.type}:{},...typeof Y.message==="string"?{message:Y.message}:{},...Y.code!==void 0?{code:Y.code}:{},...typeof Y.reason==="string"?{reason:Y.reason}:{},...X?{error:X}:{},...X===void 0&&Y.error!==void 0?{rawError:String(Y.error)}:{},keys:Object.keys(Y)})}return{chain:Z}}function gm4(){let $=new lA0;return $.loadFromDefault(),$}function u51($){return Boolean($.status?.conditions?.some((Z)=>Z.type==="Ready"&&Z.status==="True"))}function l51($,Z){let Q=$.spec?.env;if(!Q)return null;for(let Y of Q)if(Y.name===Z&&Y.value)return Y.value;return null}function hm4($,Z){let Q=Tm4("sha256").update(`${$}:${Z}`).digest();return d51+Q.readUInt32BE(0)%jT$}function OT$($){let Z=$.slice(0,lm4);return um4.test(Z)?Z:""}function mm4($){if($===void 0)return null;let Z=$.trim();if(Z==="")return null;if(!cm4.test(Z))throw Error(`AgentSandboxProvider: envName=${JSON.stringify(Z)} is not a valid DNS-label-safe environment name (lowercase alphanumeric or '-', starts with a letter, ends alphanumeric, \u226432 chars). Studio sets this from STUDIO_ENV; check the studio chart's configMap.`);return Z}function c51($,Z={}){let Q={...Z};if($){let Y=OT$($.orgId),X=OT$($.userId);if(Y)Q[gX.orgId]=Y;if(X)Q[gX.userId]=X}return Q}function Kf($){let Z="";for(let Q of $){let Y=Q.codePointAt(0)??0;Z+=Y<32||Y===127?" ":Q}return Z.slice(0,dm4)}function im4($){try{let Z=new URL($);return Z.username="",Z.password="",Z.toString()}catch{return""}}function pm4($){let Z={},Q=$.tenant;if(Q?.orgSlug)Z[AH.orgSlug]=Kf(Q.orgSlug);if(Q?.orgName)Z[AH.orgName]=Kf(Q.orgName);if(Q?.userEmail)Z[AH.userEmail]=Kf(Q.userEmail);if(Q?.userName)Z[AH.userName]=Kf(Q.userName);let Y=$.repo;if(Y){if(Y.displayName)Z[AH.gitRepo]=Kf(Y.displayName);let X=im4(Y.cloneUrl);if(X)Z[AH.gitRepoUrl]=Kf(X);let J=$.branch??Y.branch;if(J)Z[AH.gitBranch]=Kf(J)}return Z}function nm4($){let Z=$.metadata?.labels;if(!Z)return null;let Q=Z[gX.orgId],Y=Z[gX.userId];if(!Q||!Y)return null;let X=$.metadata?.annotations??{};return{orgId:Q,userId:Y,orgSlug:X[AH.orgSlug],orgName:X[AH.orgName],userEmail:X[AH.userEmail],userName:X[AH.userName]}}function tm4($,Z){if($){let Q=new Date($).getTime();if(Number.isFinite(Q)&&Q<=Z.getTime())return null}return Z.toISOString()}function om4($,Z){if($){let Q=new Date($).getTime();if(Number.isFinite(Q)&&Q>=Z.getTime())return null}return Z.toISOString()}function m51($){return{org_id:$?.orgId??"",user_id:$?.userId??"",runner_kind:"agent-sandbox"}}async function rm4($,Z){if(!Z||!$.tenant)return $.orgFsConfigJson;try{return await Z($.tenant)??$.orgFsConfigJson}catch(Q){return console.warn(`[${T6}] org-fs credential re-mint failed: ${Q instanceof Error?Q.message:String(Q)}`),$.orgFsConfigJson}}function LT$($){try{let Z=new URL($.cloneUrl);Z.username="",Z.password="";let{submoduleCredentials:Q,credentialExpiresAt:Y,...X}=$;return{...X,cloneUrl:Z.toString()}}catch{return null}}function sm4($,Z){let{orgFsConfigJson:Q,repo:Y,extraRepos:X,...J}=$,G=J,W=Y&&LT$(Y);if(W)G.repo=W;if(X)G.extraRepos=X.map(LT$).filter((K)=>K!==null);return Q||Z?{ensureOpts:G,orgFsRedacted:!0}:{ensureOpts:G}}function am4($){let Z={};if($.branch)Z.branch=$.branch;if($.repo)Z.repo=$.repo;if($.workload)Z.workload=$.workload;if($.env&&Object.keys($.env).length>0)Z.env=$.env;if($.tenant)Z.tenant=$.tenant;if($.cloneOnly)Z.cloneOnly=!0;if($.purpose)Z.purpose=$.purpose;if($.sandboxImage)Z.sandboxImage=$.sandboxImage;if($.orgFsConfigJson)Z.orgFsConfigJson=$.orgFsConfigJson;return Object.keys(Z).length>0?Z:null}function em4($,Z){try{return new URL(HT0($,Z)).hostname||null}catch{return null}}var T6="AgentSandboxProvider",Mm4="agent-sandbox-system",Im4="studio-sandbox",Vm4=300000,bU=9000,NT$=3000,OT0="/app",km4=32,Sm4,Cm4=900000,_m4=60000,vm4=1800000,LT0=3,BT$=1800000,bm4=900000,xm4=1800000,d51=40000,jT$=1e4,fm4=256,gX,AH,um4,lm4=63,cm4,dm4=253;var ET$=D(()=>{a$();Hw$();bA$();Gf();um();lH0();$10();rA$();I10();GT$();BT0();DT0();Sm4=new Set(["DAEMON_TOKEN","DAEMON_BOOT_ID","APP_ROOT","PROXY_PORT"]);gX={role:"studio.decocms.com/role",sandboxHandle:"studio.decocms.com/sandbox-handle",orgId:"studio.decocms.com/org-id",userId:"studio.decocms.com/user-id",env:"studio.decocms.com/env"},AH={orgSlug:"studio.decocms.com/org-slug",orgName:"studio.decocms.com/org-name",userEmail:"studio.decocms.com/user-email",userName:"studio.decocms.com/user-name",gitRepo:"studio.decocms.com/git-repo",gitRepoUrl:"studio.decocms.com/git-repo-url",gitBranch:"studio.decocms.com/git-branch"},um4=/^([A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?)?$/;cm4=/^[a-z]([a-z0-9-]{0,30}[a-z0-9])?$/});var zT$={};Z6(zT$,{tenantPoolSchema:()=>aA$,tenantPoolRepoSchema:()=>M10,tenantPoolFieldsSchema:()=>x51,tenantPoolAllocations:()=>lm,resolveTenantPoolBinding:()=>f51,renderTenantPoolWarmPools:()=>ZT$,normalizeRepoUrl:()=>vU,allocationsMatchingPush:()=>g51,TenantPoolCapacityError:()=>UT0,PREVIEW_NOT_READY_HEADER:()=>mm,AgentSandboxProvider:()=>p51});var V10=D(()=>{ET$();I10()});import{z as Hf}from"zod";function wT0($){if(!$||$.trim()==="")return[];let Z=Hf.array($d4).parse(JSON.parse($)),Q=new Set;for(let Y of Z){if(Q.has(Y.name))throw Error(`tenant pools: duplicate pool name ${Y.name}`);Q.add(Y.name)}return Z}function PT$($){let Z=vU(`https://github.com/${$.repo}`);if(!Z)throw Error(`tenant pools: bad repo ${$.repo}`);return Z}function AT$($){return $.map((Z)=>({name:Z.name,tenant:Z.orgId,size:1,image:"default",repos:[{repoUrl:PT$(Z),branch:Z.branch,workload:Z.workload,replicas:1,warmPoolName:Z.name}]}))}function n51($,Z){let Q=vU(Z.repoUrl)?.toLowerCase(),Y=$.find((J)=>J.orgId===Z.tenant&&J.branch===Z.branch&&PT$(J).toLowerCase()===Q);if(!Y)return null;let X=`https://github.com/${Y.repo}.git`;return Y.connectionId?{cloneUrl:X,connectionId:Y.connectionId}:{cloneUrl:X}}function TT$($,Z){return async(Q)=>{let Y=n51($,Q);if(!Y)return null;return Y.connectionId?Z(Y):Y.cloneUrl}}var $d4;var jT0=D(()=>{V10();$d4=Hf.object({name:Hf.string().max(63).regex(/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/,"pool name must be a DNS label (lowercase alphanumeric and '-')"),orgId:Hf.string().min(1),repo:Hf.string().regex(/^[^/\s]+\/[^/\s]+$/,"repo must be `owner/name`"),connectionId:Hf.string().min(1).optional(),branch:Hf.string().min(1).default("main"),workload:M10.shape.workload})});function a51($,Z=Date.now()){if($===void 0)return;return $===null?Z+Zd4:$.getTime()}function s51($){return JSON.stringify([$.orgId,$.userId])}function RT$($,Z){let Q=vU(Z);return Q?JSON.stringify([$,Q.toLowerCase()]):null}function Yd4($,Z){return"repositoryId"in Z?$.repositoryOrgs.get(Z.repositoryId):$.connectionOrgs.get(Z.connectionId)}function qT$($){let{records:Z,now:Q}=$,Y=new Map,X=new Map,J=new Map,G=0;for(let W of $.pools)for(let{repoUrl:K,branch:H}of W.repos){let F=RT$(W.tenant,K),U=n51($.legacyPools??[],{tenant:W.tenant,repoUrl:K,branch:H});if(F&&U){if(U.connectionId)X.set(F,{tenant:W.tenant,repoUrl:K,connectionId:U.connectionId,cloneUrl:U.cloneUrl});continue}let N=F?Z.orgRepositories.get(F):void 0;if(!F||!N){G++;continue}X.set(F,{tenant:W.tenant,repoUrl:K,repositoryId:N})}for(let W of $.sandboxes){let K=W.tenant;if(!K)continue;let H=Z.members.get(s51(K));if(H===void 0){G++;continue}for(let U of W.repos){if(Yd4(Z,U)!==K.orgId){G++;continue}let N="repositoryId"in U?{repositoryId:U.repositoryId}:{connectionId:U.connectionId,repo:U.repo.toLowerCase()},B={orgId:K.orgId,userId:K.userId};Y.set(JSON.stringify([B,N]),{tenant:B,repo:N})}let F=W.orgFsConfigExpiresAt;if(W.orgFs&&(F===null||F-Q<Qd4))J.set(s51(K),{orgId:K.orgId,userId:K.userId,orgSlug:H})}return{clones:[...Y.values()],poolClones:[...X.values()],orgFs:[...J.values()],refused:G}}async function MT$($,Z,Q){let Y=new Set,X=new Set,J=new Set,G=new Set,W=new Set(Q.map((O)=>O.tenant)),K=new Set;for(let O of Q)for(let{repoUrl:L}of O.repos){let w=kY(L);if(w)K.add(w.path.toLowerCase())}for(let O of Z){if(O.tenant)Y.add(O.tenant.orgId),X.add(O.tenant.userId);for(let L of O.repos)if("repositoryId"in L)G.add(L.repositoryId);else J.add(L.connectionId)}let[H,F,U,N]=await Promise.all([Y.size===0?[]:$.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.organizationId as orgId","member.userId as userId","organization.slug as slug"]).where("member.organizationId","in",[...Y]).where("member.userId","in",[...X]).execute(),J.size===0?[]:$.selectFrom("connections").select(["id","organization_id"]).where("id","in",[...J]).execute(),G.size===0?[]:$.selectFrom("repositories").select(["id","organization_id"]).where("id","in",[...G]).execute(),K.size===0?[]:$.selectFrom("repositories").select(["id","organization_id","provider","host","path"]).where("organization_id","in",[...W]).where((O)=>O(O.fn("lower",["path"]),"in",[...K])).execute()]),B=new Map;for(let O of N){let L=RT$(O.organization_id,fe({provider:O.provider,host:O.host,path:O.path}));if(L&&!B.has(L))B.set(L,O.id)}return{members:new Map(H.map((O)=>[s51(O),O.slug])),connectionOrgs:new Map(F.map((O)=>[O.id,O.organization_id])),repositoryOrgs:new Map(U.map((O)=>[O.id,O.organization_id])),orgRepositories:B}}function r51($){return $ instanceof Error?$.message:String($)}async function IT$($,Z,Q){let Y=0;if($.clones.length>im||$.poolClones.length>im||$.orgFs.length>o51)console.warn(`[sandbox-credential-push] ${$.clones.length} clone, ${$.poolClones.length} pool clone and ${$.orgFs.length} org-fs mints planned; minting the first ${im}, ${im} and ${o51}`);let X=await F9($.clones.slice(0,im),t51,async(U)=>{let N="repositoryId"in U.repo?{cloneUrl:"",repositoryId:U.repo.repositoryId}:{cloneUrl:`https://github.com/${U.repo.repo}.git`,connectionId:U.repo.connectionId};try{let B=await Z.mintCloneUrl(N,{bufferMs:ET0});return B?{tenant:U.tenant,repo:U.repo,cloneUrl:B,expiresAt:Q.now+ET0}:null}catch(B){return Y++,console.warn(`[sandbox-credential-push] clone mint failed: ${r51(B)}`),null}}),J=await F9($.poolClones.slice(0,im),t51,async(U)=>{try{let N=await Z.mintCloneUrl("repositoryId"in U?{cloneUrl:"",repositoryId:U.repositoryId}:{cloneUrl:U.cloneUrl,connectionId:U.connectionId},{bufferMs:ET0});return N?{tenant:U.tenant,repoUrl:U.repoUrl,cloneUrl:N,expiresAt:Q.now+ET0}:null}catch(N){return Y++,console.warn(`[sandbox-credential-push] pool clone mint failed: ${r51(N)}`),null}}),G=await F9($.orgFs.slice(0,o51),t51,async(U)=>{try{let N=await Z.mintOrgFsConfig(U);return N?{tenant:{orgId:U.orgId,userId:U.userId},orgFsConfigJson:N,expiresAt:Q.now+Q.orgFsLifetimeMs}:null}catch(N){return Y++,console.warn(`[sandbox-credential-push] org-fs mint failed: ${r51(N)}`),null}}),W=X.filter((U)=>U!==null),K=J.filter((U)=>U!==null),H=G.filter((U)=>U!==null),F=[];for(let U=0;U<Math.max(W.length,K.length,H.length);U+=yj)F.push({cloneUrls:W.slice(U,U+yj),poolCloneUrls:K.slice(U,U+yj),orgFsConfigs:H.slice(U,U+yj)});return{batches:F,failed:Y}}var ET0=2700000,zT0,Zd4=86400000,Qd4=86400000,t51=8,im=2000,o51=200;var PT0=D(()=>{C41();V10();i4();a$();LD();jT0();zT0=TL$-3600000});var hX;var k10=D(()=>{hX=class hX extends Error{code;status;path;constructor($,Z,Q){super(Z.message||`Freestyle API error: ${Z.code}`);this.name="FreestyleApiError",this.code=Z.code,this.status=$,this.path=Q,Object.setPrototypeOf(this,hX.prototype)}}});function VT$(){return typeof process<"u"&&Boolean(process.versions?.node)}var AT0=($,Z)=>globalThis.fetch($,Z);async function Xd4(){if(!VT$())return null;try{return await import("undici")}catch{return null}}async function Gd4(){let $=await Xd4();if(!$)return null;let Z=new $.Agent({allowH2:!0,connections:Jd4});return(Q,Y)=>$.fetch(Q,{...Y,dispatcher:Z})}function Wd4($){return(typeof $==="string"?$:$ instanceof URL?$.href:$.url).startsWith("https:")}function kT$(){let $,Z=()=>{return $??=Gd4().then((Q)=>Q??AT0).catch(()=>AT0),$};return(Q,Y)=>Wd4(Q)?Z().then((X)=>X(Q,Y)):AT0(Q,Y)}var Jd4=4;var ST$=()=>{};function Bd4($){return new Promise((Z)=>setTimeout(Z,$))}function Dd4($){if(!$)return"";let Z=new URLSearchParams;for(let[Y,X]of Object.entries($)){if(X===void 0||X===null)continue;Z.set(Y,String(X))}let Q=Z.toString();return Q?`?${Q}`:""}function u6($){return encodeURIComponent($)}class e51{baseUrl;authenticationHeaders;fetchImpl;backgroundEligible;constructor($={}){if(this.baseUrl=($.baseUrl??Nd4).replace(/\/+$/,""),!$.fetch&&!globalThis.fetch)throw Error("No fetch implementation available. Pass `fetch` in FreestyleOptions when running on a runtime without a global fetch.");if(this.fetchImpl=$.fetch??kT$(),"identityAccessToken"in $&&$.identityAccessToken){this.authenticationHeaders={[Kd4]:$.identityAccessToken},this.backgroundEligible=!1;return}if(this.backgroundEligible=!0,"stackAccessToken"in $&&$.stackAccessToken){this.authenticationHeaders={Authorization:`Bearer ${$.stackAccessToken}`,"X-Freestyle-Team-Id":$.teamId};return}let Z=$.apiKey??globalThis.process?.env?.FREESTYLE_API_KEY;if(!Z)throw Error("No Freestyle API key provided. Pass `apiKey` in FreestyleOptions or set FREESTYLE_API_KEY.");this.authenticationHeaders={Authorization:`Bearer ${Z}`}}authHeaders(){return{...this.authenticationHeaders}}url($,Z){return`${this.baseUrl}${$}${Dd4(Z)}`}async fetch($,Z={}){let Q=new Headers(Z.headers);for(let[Y,X]of Object.entries(this.authHeaders()))if(!Q.has(Y))Q.set(Y,X);return this.fetchImpl(this.absoluteUrl($),{...Z,headers:Q})}absoluteUrl($){return/^https?:\/\//i.test($)?$:`${this.baseUrl}${$}`}async request($,Z,{query:Q,body:Y,rawBody:X,signal:J}={}){let G={...this.authHeaders()};if(this.backgroundEligible)G[CT$]=String(Fd4);let W;if(X!==void 0)G["Content-Type"]="application/octet-stream",W=X;else if(Y!==void 0)G["Content-Type"]="application/json",W=JSON.stringify(Y);let K=this.url(Z,Q),H=await this.fetchImpl(K,{method:$,headers:G,body:W,signal:J});if(this.backgroundEligible&&H.status===202)try{return await this.pollBackgroundRequest(H,Z)}catch(F){if($==="GET"&&F instanceof hX&&F.code==="BACKGROUND_RESULT_UNSTORABLE"){delete G[CT$];let U=await this.fetchImpl(K,{method:$,headers:G,body:W});return this.finalize(U,Z)}throw F}return this.finalize(H,Z)}async pollBackgroundRequest($,Z){let Q=await $.json().catch(()=>({})),Y=$.headers.get(Hd4)??Q.requestId,X=Q.resultUrl??(Y?`/v5/background-requests/${u6(Y)}`:void 0);if(!X)throw new hX($.status,{code:"BACKGROUND_PROTOCOL_ERROR",message:"202 Accepted carried no background request id"},Z);let J=0;for(;;){await Bd4(Ud4);let G;try{G=await this.fetch(X,{method:"GET"}),J=0}catch(W){if(++J>=5)throw W;continue}if(G.status===202)continue;return this.finalize(G,Z)}}async finalize($,Z){if(!$.ok){let Y;try{Y=await $.json()}catch{Y={code:"UNKNOWN_ERROR",message:await $.text().catch(()=>$.statusText)}}throw new hX($.status,Y,Z)}if($.status===204)return;let Q=await $.text();if(!Q)return;return JSON.parse(Q)}get($,Z){return this.request("GET",$,{query:Z})}post($,Z){return this.request("POST",$,{body:Z??{}})}patch($,Z){return this.request("PATCH",$,{body:Z??{}})}put($,Z){return this.request("PUT",$,{body:Z??{}})}putEmpty($){return this.request("PUT",$,{})}putBytes($,Z,Q,Y){return this.request("PUT",$,{query:Q,rawBody:Z,signal:Y})}async getBytes($,Z,Q={}){let Y={...this.authHeaders()};if(Q.range)Y.Range=Q.range;let X=await this.fetchImpl(this.url($,Z),{method:"GET",headers:Y,signal:Q.signal});if(!X.ok){let J;try{J=await X.json()}catch{J={code:"UNKNOWN_ERROR",message:await X.text().catch(()=>X.statusText)}}throw new hX(X.status,J,$)}return X}delete($,Z){return this.request("DELETE",$,{query:Z})}}var Kd4="x-freestyle-identity-access-token",CT$="x-freestyle-background-after-secs",Hd4="x-freestyle-background-request-id",Fd4=5,Ud4=2000,Nd4="https://api.freestyle.sh";var fW=D(()=>{k10();ST$()});class $91{client;verifications;certificates;placeholder;constructor($){this.client=$,this.verifications=new _T$($),this.certificates=new vT$($),this.placeholder=new bT$($)}async list(){let{domains:$}=await this.client.get("/v5/domains");return $}}class _T${client;constructor($){this.client=$}create($){return this.client.post("/v5/verifications",{domain:$})}async list($={}){let{verifications:Z}=await this.client.get("/v5/verifications",$);return Z}get($){return this.client.get(`/v5/verifications/${u6($)}`)}complete($){return this.client.putEmpty(`/v5/verifications/${u6($)}`)}delete($){return this.client.delete(`/v5/verifications/${u6($)}`)}}class vT${client;constructor($){this.client=$}async list(){let{certificates:$}=await this.client.get("/v5/certificates");return $}createWildcard($){return this.client.post("/v5/certificates/wildcard",{domain:$})}}class bT${client;constructor($){this.client=$}async get(){try{return await this.client.get("/v5/domains/placeholder")}catch($){if($ instanceof hX&&$.status===404)return null;throw $}}set($){return this.client.put("/v5/domains/placeholder",$)}delete(){return this.client.delete("/v5/domains/placeholder")}}var Z91=D(()=>{fW();k10()});function a6($,Z){throw new Y91($,Z)}function Q91($){return Od4.some((Z)=>$[Z]!==void 0)}function X91($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function wd4($,Z){let Q=Z.lastIndexOf("/");if(Q<0)a6($,`${$} \`${Z}\` is not a CIDR: expected address/prefix, e.g. 203.0.113.0/24 or 2001:db8::/32`);let Y=Z.slice(0,Q),X=Z.slice(Q+1);if(!/^\d+$/.test(X))a6($,`${$} \`${Z}\`: prefix length must be a number`);let J=Number(X),G=Y.includes(":"),W=G?128:32;if(J>W)a6($,`${$} \`${Z}\`: prefix length must be 0\u2013${W}`);if(!G&&!/^\d{1,3}(\.\d{1,3}){3}$/.test(Y))a6($,`${$} \`${Z}\`: \`${Y}\` is not an IP address`)}function gT$($,Z){if(!X91($))a6(Z,`${Z} must be an object`);for(let Y of Object.keys($))if(!xT$.includes(Y))a6(`${Z}.${Y}`,`${Z} has unknown field \`${Y}\`. Expected one of: ${xT$.join(", ")}`);let Q=$;for(let Y of["vmId","vpcId","tunnelId","cidr"]){let X=Q[Y];if(X!==void 0&&(typeof X!=="string"||X.length===0))a6(`${Z}.${Y}`,`${Z}.${Y} must be a non-empty string`)}if(Q.public!==void 0&&Q.public!==!0)a6(`${Z}.public`,`${Z}.public must be true when present: it declares the public Internet. Omit the field to match something else`);if(Q.public===!0){if(Q.vmId!==void 0)a6(`${Z}.public`,`${Z} cannot combine \`public: true\` with \`vmId\`: that would mean the VM only when reached over its public address, a distinction this API does not make yet. Use \`vmId\` alone to match the VM on any path, or \`public: true\` alone to match public addresses`);if(Q.vpcId!==void 0)a6(`${Z}.public`,`${Z} cannot combine \`public: true\` with \`vpcId\`: that would mean the network's members only when reached over their public addresses, a distinction this API does not make yet. Use \`vpcId\` alone or \`public: true\` alone`);if(Q.tunnelId!==void 0)a6(`${Z}.public`,`${Z} cannot combine \`public: true\` with \`tunnelId\`: traffic through a tunnel arrives over the tunnel, not over the public Internet. Use \`tunnelId\` alone`)}if(Q.cidr!==void 0)wd4(`${Z}.cidr`,Q.cidr);if(Q.protocol!==void 0&&!fT$.includes(Q.protocol))a6(`${Z}.protocol`,`${Z}.protocol must be one of: ${fT$.join(", ")} (got \`${String(Q.protocol)}\`)`);if(Q.port!==void 0){if(!Number.isInteger(Q.port)||Q.port<1||Q.port>65535)a6(`${Z}.port`,`${Z}.port must be an integer between 1 and 65535`);if(Q.protocol===void 0)a6(`${Z}.protocol`,`${Z}.port ${Q.port} requires ${Z}.protocol: set it to "tcp" or "udp" so the rule opens one transport rather than both`);if(!Ld4.includes(Q.protocol))a6(`${Z}.port`,`${Z}.protocol "${Q.protocol}" has no ports; remove ${Z}.port ${Q.port}`)}}function lT$($,Z){if(!X91($))a6(Z||"rule",`${Z||"rule"} must be an object`);for(let Y of Object.keys($))if(!hT$.includes(Y))a6(`${Z}${Y}`,`Unknown field \`${Y}\`. Expected one of: ${hT$.join(", ")}`);let Q=$;if(Q.action===void 0)a6(`${Z}action`,`${Z}action is required. Write \`action: "allow"\` \u2014 every rule states what it does rather than defaulting to it`);if(Q.action!=="allow")a6(`${Z}action`,`${Z}action must be "allow" (got \`${String(Q.action)}\`). Only allow rules exist today`);if(Q.description!==void 0){if(typeof Q.description!=="string")a6(`${Z}description`,"description must be a string");if(Q.description.length>yT$)a6(`${Z}description`,`description is too long (${Q.description.length} characters, maximum ${yT$})`)}if(Q.source===void 0)a6(`${Z}source`,`${Z}source is required`);if(Q.destination===void 0)a6(`${Z}destination`,`${Z}destination is required`);return gT$(Q.source,`${Z}source`),gT$(Q.destination,`${Z}destination`),Q}function jd4($){let Z=lT$($,"");for(let Q of["source","destination"]){let Y=Z[Q];if(Q91(Y))continue;let X=[Y.port!==void 0?`port ${Y.port}`:void 0,Y.protocol!==void 0?`protocol ${Y.protocol}`:void 0].filter(Boolean).join(", ");a6(Q,X?`${Q} only narrows traffic (${X}) without saying what it is. Add \`vmId\`, \`vpcId\`, \`tunnelId\`, \`cidr\`, or \`public: true\`. Leaving it out to mean "this VM" only works inside vms.create`:`${Q} is empty. A matcher must say what the traffic is: \`vmId\`, \`vpcId\`, \`tunnelId\`, \`cidr\`, or \`public: true\` for the public Internet`)}return Z}function TT0($,Z="VM"){if($===void 0||$===null)a6("firewall",`firewall is required on a ${Z} create. A ${Z} gets nothing implicitly, so state what it may reach \u2014 \`{ rules: [] }\` if the answer is nothing`);if(!X91($))a6("firewall","firewall must be an object with a `rules` array");for(let Y of Object.keys($))if(Y!=="rules")a6(`firewall.${Y}`,`firewall has unknown field \`${Y}\`. Expected: rules`);let Q=$.rules;if(!Array.isArray(Q))a6("firewall.rules","firewall.rules must be an array");return Q.forEach((Y,X)=>{let J=`firewall.rules[${X}].`,G=lT$(Y,J),W=Q91(G.source),K=Q91(G.destination);if(!W&&!K&&Z!=="network")a6(`firewall.rules[${X}]`,`firewall.rules[${X}]: both source and destination refer to the ${Z} being created, which allows nothing. Give one of them a \`vmId\`, \`vpcId\`, \`tunnelId\`, \`cidr\`, or \`public: true\``);if(W&&K)a6(`firewall.rules[${X}]`,`firewall.rules[${X}]: neither end refers to the ${Z} being created. Leave one endpoint's identity unset so it means this ${Z}, or create the rule with firewall.rules.create instead`)}),$}function uT$($){return`/v5/firewall/rules/${u6($)}`}class cT${client;constructor($){this.client=$}async create($){let Z=jd4($);return this.client.post("/v5/firewall/rules",Z)}list($={}){return this.client.get("/v5/firewall/rules",$)}get($){return this.client.get(uT$($))}delete($){return this.client.delete(uT$($))}}class J91{client;rules;constructor($){this.client=$,this.rules=new cT$($)}evaluate($){return this.client.post("/v5/firewall/evaluate",$)}}var Y91,xT$,Od4,fT$,Ld4,yT$=1024,hT$;var S10=D(()=>{fW();Y91=class Y91 extends Error{path;constructor($,Z){super(Z);this.name="FirewallRuleValidationError",this.path=$,Object.setPrototypeOf(this,Y91.prototype)}};xT$=["vmId","vpcId","tunnelId","cidr","public","port","protocol"],Od4=["vmId","vpcId","tunnelId","cidr","public"],fT$=["tcp","udp","icmp"],Ld4=["tcp","udp"];hT$=["action","source","destination","description"]});function G91($){return`/v5/identities/${u6($)}`}class mT${client;basePath;constructor($,Z){this.client=$,this.basePath=Z}create(){return this.client.post(`${this.basePath}/tokens`)}list(){return this.client.get(`${this.basePath}/tokens`)}revoke($){return this.client.delete(`${this.basePath}/tokens/${u6($)}`)}}class dT${client;basePath;constructor($,Z){this.client=$,this.basePath=Z}list(){return this.client.get(`${this.basePath}/permissions/vm`)}grant($){return this.client.post(`${this.basePath}/permissions/vm`,$)}get($){return this.client.get(`${this.basePath}/permissions/vm/${u6($)}`)}update($,Z){return this.client.patch(`${this.basePath}/permissions/vm/${u6($)}`,{allowedLinuxUsers:Z})}revoke($){return this.client.delete(`${this.basePath}/permissions/vm/${u6($)}`)}}class W91{id;tokens;permissions;client;basePath;constructor($,Z){this.client=$,this.id=Z,this.basePath=G91(Z),this.tokens=new mT$($,this.basePath),this.permissions={vm:new dT$($,this.basePath)}}data(){return this.client.get(this.basePath)}delete(){return this.client.delete(this.basePath)}}class K91{client;constructor($){this.client=$}async create($={}){let Z=await this.client.post("/v5/identities",$);return{identity:new W91(this.client,Z.id),identityId:Z.id,data:Z}}list($={}){return this.client.get("/v5/identities",$)}get($){return this.client.get(G91($))}ref($){return new W91(this.client,$)}delete($){return this.client.delete(G91($))}}var H91=D(()=>{fW()});function v1($,Z){throw new B91($,Z)}function G7($,Z){throw new D91($,Z)}function C10($){return Ed4.some((Z)=>$[Z]!==void 0)}function Id4($){return!C10($)&&$.port===void 0}function gY($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function XR$($,Z,Q){if(typeof $!=="string"||!Td4.test($))G7(Z,`${Z} must be a valid HTTP header name`);let Y=$.toLowerCase();if(Md4.has(Y)||Y.startsWith("x-forwarded-")||Y.startsWith("x-freestyle-")||Q&&(Y==="cookie"||Y==="set-cookie"))G7(Z,`${Z} may not use reserved header \`${$}\``)}function Vd4($,Z){if(!Array.isArray($))G7(Z,`${Z} must be an array of header names`);if($.length>sT$)G7(Z,`${Z} may contain at most ${sT$} names`);let Q=new Set;$.forEach((Y,X)=>{XR$(Y,`${Z}[${X}]`,!0);let J=Y.toLowerCase();if(Q.has(J))G7(`${Z}[${X}]`,`${Z} contains duplicate header \`${Y}\``);Q.add(J)})}function eT$($){if(!gY($))G7("forwardAuth","forwardAuth must be an object");for(let Y of Object.keys($))if(!nT$.includes(Y))G7(Y,`Unknown field \`${Y}\`. Expected one of: ${nT$.join(", ")}`);let Z=$;if(typeof Z.url!=="string"||Z.url.length===0||Z.url.length>Rd4)G7("url","url is required and must be an absolute HTTPS URL");let Q;try{Q=new URL(Z.url)}catch{G7("url","url must be an absolute HTTPS URL")}if(Q.protocol!=="https:"||Q.hostname.length===0||Q.username.length>0||Q.password.length>0||Q.hash.length>0||Q.port==="0")G7("url","url must be an absolute HTTPS URL");if(Z.headers!==void 0){if(!gY(Z.headers))G7("headers","headers must be an object of header name to value");let Y=Object.entries(Z.headers);if(Y.length>oT$)G7("headers",`headers may contain at most ${oT$} entries`);let X=0,J=new Set;for(let[G,W]of Y){XR$(G,`headers.${G}`,!1);let K=G.toLowerCase();if(J.has(K))G7(`headers.${G}`,`headers contains duplicate header \`${G}\``);if(J.add(K),typeof W!=="string"||/[\0\r\n]/.test(W))G7(`headers.${G}`,`headers.${G} must be a string`);X+=G.length+W.length}if(X>rT$)G7("headers",`headers may contain at most ${rT$} bytes`)}if(Z.timeoutMs!==void 0&&(!Number.isInteger(Z.timeoutMs)||Z.timeoutMs<100||Z.timeoutMs>5000))G7("timeoutMs","timeoutMs must be an integer between 100 and 5000");if(Z.protectedCookies!==void 0){if(!Array.isArray(Z.protectedCookies))G7("protectedCookies","protectedCookies must be an array of cookie names");if(Z.protectedCookies.length>aT$)G7("protectedCookies",`protectedCookies may contain at most ${aT$} names`);let Y=new Set;Z.protectedCookies.forEach((X,J)=>{if(typeof X!=="string"||X.length>qd4||!Ad4.test(X))G7(`protectedCookies[${J}]`,`protectedCookies[${J}] must be a valid HTTP cookie name`);if(Y.has(X))G7(`protectedCookies[${J}]`,`protectedCookies contains duplicate cookie \`${X}\``);Y.add(X)})}if(Z.authResponseHeaders!==void 0)Vd4(Z.authResponseHeaders,"authResponseHeaders");return Z}function kd4($,Z){if(!gY($))v1(Z,`${Z} must be an object with an \`id\``);for(let Y of Object.keys($))if(!tT$.includes(Y))v1(`${Z}.${Y}`,`${Z} has unknown field \`${Y}\`. Expected: ${tT$.join(", ")}`);let Q=$.id;if(typeof Q!=="string"||Q.length===0)v1(`${Z}.id`,`${Z}.id is required and must be a non-empty string`)}function N91($){if(typeof $!=="string")v1("domain","domain is required and must be a string");if($==="*")return;let Z=$.startsWith("*.")?$.slice(2):$;if(Z.length===0||Z.length>zd4)v1("domain",`domain \`${$}\` is not a hostname`);let Q=Z.split(".");if(Q.length<2)v1("domain",`domain \`${$}\` must have at least two labels, e.g. acme.com`);for(let Y of Q){if(Y.length===0||Y.length>Pd4)v1("domain",`domain \`${$}\` has an empty or over-long label`);if(!/^[a-z0-9-]+$/.test(Y))v1("domain",`domain \`${$}\`: labels are lowercase letters, digits, and hyphens (a \`*.\` prefix is the only wildcard)`);if(Y.startsWith("-")||Y.endsWith("-"))v1("domain",`domain \`${$}\`: a label cannot start or end with a hyphen`)}}function Sd4($){if(typeof $!=="string")v1("domain","domain is required and must be a string");let Z=$.lastIndexOf("@");if(Z===-1){N91($);return}let Q=$.slice(0,Z),Y=$.slice(Z+1);if(Q.length===0||Q.length>64)v1("domain",`mail route \`${$}\`: the part before \`@\` must be 1-64 characters`);if(Q.startsWith(".")||Q.endsWith(".")||Q.includes(".."))v1("domain",`mail route \`${$}\`: the part before \`@\` cannot start or end with a dot, or contain \`..\``);for(let X of Q)if(!/[a-zA-Z0-9]/.test(X)&&!$R$.includes(X))v1("domain",`mail route \`${$}\`: the part before \`@\` may use letters, digits, dots, and \`${$R$.slice(0,-1)}\` (quoted mailboxes are not supported)`);if(Y==="*")v1("domain",`mail route \`${$}\`: \`*\` is not a mail domain \u2014 name the domain the mailbox lives at`);N91(Y)}function ZR$($,Z){if(!gY($))v1(Z,`${Z} must be an object`);for(let Y of Object.keys($))if(!iT$.includes(Y))v1(`${Z}.${Y}`,`${Z} has unknown field \`${Y}\`. Expected one of: ${iT$.join(", ")}`);let Q=$;for(let Y of["vmId","vpcId","host"]){let X=Q[Y];if(X!==void 0&&(typeof X!=="string"||X.length===0))v1(`${Z}.${Y}`,`${Z}.${Y} must be a non-empty string`)}if(Q.public!==void 0&&Q.public!==!0)v1(`${Z}.public`,`${Z}.public must be true when present. Omit the field to match something else`);if(Z==="source"){if(Q.host!==void 0)v1("source.host","source.host is not allowed: a source is who opens the session, not where it lands. Put `host` on the destination");if(Q.port!==void 0)v1("source.port","source.port is not allowed: a source is who opens the session, not where it lands. Put `port` on the destination");if(Q.public===!0&&(Q.vmId!==void 0||Q.vpcId!==void 0))v1("source.public","source cannot combine `public: true` with `vmId` or `vpcId`: use one alone. `public` is every client on the Internet; `vmId`/`vpcId` is a specific dialer")}else{if(Q.vpcId!==void 0)v1("destination.vpcId","destination.vpcId is not allowed: a session lands in one place, not on a whole network. Name a `vmId`, a `host`, or `public: true` for the domain's own origin. A whole network may be a source");if([Q.vmId!==void 0,Q.host!==void 0,Q.public===!0].filter(Boolean).length>1)v1("destination","destination names more than one landing: give exactly one of `vmId`, `host`, or `public: true`");if((Q.vmId!==void 0||Q.host!==void 0)&&Q.port===void 0)v1("destination.port",`destination.port is required with ${Q.vmId!==void 0?"`vmId`":"`host`"}: say which port the session lands on`)}if(Q.port!==void 0){if(!Number.isInteger(Q.port)||Q.port<1||Q.port>65535)v1(`${Z}.port`,`${Z}.port must be an integer between 1 and 65535`)}}function Cd4($){if("postgres"in $)return"postgres";if("smtp"in $)return"smtp";if("socks5"in $)return"socks5";return"http"}function _d4($,Z){function Q(W,K,H){if(!gY(W)||Object.keys(W).some((F)=>!K.includes(F)))v1(H,`${H} must contain only ${K.join(", ")}`)}if(Q($,["region","credentials","scope"],Z),typeof $.region!=="string"||!/^[a-z0-9-]{1,63}$/.test($.region))v1(`${Z}.region`,"invalid s3.region");Q($.credentials,["accessKeyId","secretAccessKey","sessionToken"],`${Z}.credentials`);for(let W of["accessKeyId","secretAccessKey","sessionToken"]){let K=$.credentials[W];if(W==="sessionToken"&&K===void 0)continue;if(typeof K!=="string"||!/^[\x21-\x7e]{1,16384}$/.test(K))v1(`${Z}.credentials.${W}`,"invalid s3 credentials")}if(!/^[a-zA-Z0-9]+$/.test($.credentials.accessKeyId))v1(`${Z}.credentials.accessKeyId`,"invalid s3 access key id");Q($.scope,["bucket","prefix","operations"],`${Z}.scope`);let{bucket:Y,prefix:X,operations:J}=$.scope;if(typeof Y!=="string"||!/^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/.test(Y)||Y.includes(".."))v1(`${Z}.scope.bucket`,"invalid s3.scope.bucket");if(typeof X!=="string"||Buffer.byteLength(X,"utf8")>1024||/[\x00-\x1f\x7f-\x9f]/u.test(X))v1(`${Z}.scope.prefix`,"invalid s3.scope.prefix");let G=["GetObject","HeadObject","PutObject","DeleteObject","ListObjectsV2","CreateMultipartUpload","UploadPart","ListParts","CompleteMultipartUpload","AbortMultipartUpload","ListMultipartUploads"];if(!Array.isArray(J)||J.length===0||J.length>G.length||J.some((W)=>!G.includes(W))||new Set(J).size!==J.length)v1(`${Z}.scope.operations`,"s3.scope.operations must be a nonempty list of distinct supported operations")}function vd4($,Z){if(!gY($))v1(Z,`${Z} must be an object: \`{ headers: { \u2026 } }\`, \`{ postgres: { \u2026 } }\`, \`{ smtp: { \u2026 } }\` or \`{ socks5: { \u2026 } }\``);let Q=Object.keys($);if(Q.length!==1||!["headers","jsonPatch","postgres","smtp","socks5","s3"].includes(Q[0]??""))v1(Z,`${Z} must have exactly one of \`headers\`, \`jsonPatch\`, \`postgres\`, \`smtp\`, \`socks5\` or \`s3\` (got: ${Q.length===0?"nothing":Q.join(", ")})`);if(Q[0]==="s3"){_d4($.s3,`${Z}.s3`);return}if(Q[0]==="jsonPatch"){let Y=$.jsonPatch;if(!Array.isArray(Y)||Y.length>128)v1(Z,`${Z}.jsonPatch must be an array of at most 128 operations`);let X=(W)=>typeof W==="string"&&(W===""||W.startsWith("/"))&&!/~(?:[^01]|$)/u.test(W),J=(W,K=new Set,H=0)=>{if(H>64)return!1;if(W===null||typeof W==="string"||typeof W==="boolean")return!0;if(typeof W==="number")return Number.isFinite(W);if(typeof W!=="object"||K.has(W))return!1;K.add(W);let F=(Array.isArray(W)?Array.from(W):gY(W)?Object.values(W):[void 0]).every((U)=>J(U,K,H+1));return K.delete(W),F};for(let[W,K]of Y.entries()){if(!gY(K)||!["add","remove","replace","move","copy","test"].includes(String(K.op))||!X(K.path))v1(Z,`${Z}.jsonPatch[${W}] requires a standard op and valid JSON Pointer path`);if(["move","copy"].includes(K.op)&&!X(K.from))v1(Z,`${Z}.jsonPatch[${W}].from must be a JSON Pointer`);if(["add","replace","test"].includes(K.op)&&(!Object.hasOwn(K,"value")||!J(K.value)))v1(Z,`${Z}.jsonPatch[${W}].value must be a JSON value (null is allowed)`)}let G;try{G=JSON.stringify(Y)}catch{v1(Z,"jsonPatch must be JSON serializable")}if(Buffer.byteLength(G,"utf8")>65536)v1(Z,"jsonPatch exceeds 64 KiB");return}if(Q[0]==="socks5"){let Y=$.socks5;if(!gY(Y))v1(`${Z}.socks5`,`${Z}.socks5 must be an object with \`username\` and \`password\``);for(let X of Object.keys(Y))if(!["username","password"].includes(X))v1(`${Z}.socks5.${X}`,`${Z}.socks5 has unknown field \`${X}\`. Expected: username, password`);for(let X of["username","password"])if(typeof Y[X]!=="string"||Y[X].length===0)v1(`${Z}.socks5.${X}`,`${Z}.socks5.${X} is required and must be a non-empty string`);return}if(Q[0]==="smtp"){let Y=$.smtp;if(!gY(Y))v1(`${Z}.smtp`,`${Z}.smtp must be an object with \`username\` and \`password\``);for(let X of Object.keys(Y))if(!["username","password"].includes(X))v1(`${Z}.smtp.${X}`,`${Z}.smtp has unknown field \`${X}\`. Expected: username, password`);for(let X of["username","password"])if(typeof Y[X]!=="string"||Y[X].length===0)v1(`${Z}.smtp.${X}`,`${Z}.smtp.${X} is required and must be a non-empty string`);return}if(Q[0]==="headers"){let Y=$.headers;if(!gY(Y))v1(`${Z}.headers`,`${Z}.headers must be an object of header name to value`);for(let[X,J]of Object.entries(Y))if(typeof J!=="string")v1(`${Z}.headers.${X}`,`${Z}.headers.${X} must be a string`)}else{let Y=$.postgres;if(!gY(Y))v1(`${Z}.postgres`,`${Z}.postgres must be an object with \`username\` and \`password\``);for(let J of Object.keys(Y))if(!["username","password","database"].includes(J))v1(`${Z}.postgres.${J}`,`${Z}.postgres has unknown field \`${J}\`. Expected: username, password, database`);let X=Y;for(let J of["username","password"])if(typeof X[J]!=="string"||X[J].length===0)v1(`${Z}.postgres.${J}`,`${Z}.postgres.${J} is required and must be a non-empty string`);if(X.database!==void 0&&typeof X.database!=="string")v1(`${Z}.postgres.database`,`${Z}.postgres.database must be a string`)}}function bd4($,Z){let Q=$;return Z.forEach((Y,X)=>{let J=Cd4(Y);if(Q===void 0)Q=J;else if(Q!==J)v1(`transform[${X}]`,`transform requires protocol \`${J}\` but the rule is \`${Q}\`; a rule terminates one protocol`)}),Q??"http"}function xd4($,Z){if(!gY($)||Object.keys($).some((Q)=>Q!=="method"&&Q!=="path"))v1(Z,`${Z} must be an object containing only method and path`);if($.method!==void 0&&(!Array.isArray($.method)||$.method.some((Q)=>typeof Q!=="string"||Q.length===0||/[^!#$%&'*+.^_`|~0-9A-Za-z-]/.test(Q))))v1(`${Z}.method`,`${Z}.method must be an array of HTTP method tokens`);if($.path!==void 0){let Q=$.path;if(!gY(Q)||Object.keys(Q).length!==1||typeof Q.exact!=="string"||!Q.exact.startsWith("/")||/[\s?#]/.test(Q.exact))v1(`${Z}.path`,`${Z}.path must contain exact: an absolute path without a query or fragment`)}}function JR$($,Z){if(!gY($))v1(Z||"rule",`${Z||"rule"} must be an object`);for(let H of Object.keys($))if(!QR$.includes(H))v1(`${Z}${H}`,`Unknown field \`${H}\`. Expected one of: ${QR$.join(", ")}`);let Q=$;if(Q.action===void 0)v1(`${Z}action`,`${Z}action is required. Write \`action: "allow"\` \u2014 every rule states what it does rather than defaulting to it`);if(Q.action!=="allow")v1(`${Z}action`,`${Z}action must be "allow" (got \`${String(Q.action)}\`). Only allow rules exist today`);if(Q.protocol!==void 0&&!pT$.includes(Q.protocol))v1(`${Z}protocol`,`${Z}protocol must be one of: ${pT$.join(", ")} (got \`${String(Q.protocol)}\`)`);let Y=Q.source??{},X=Q.destination??{};ZR$(Y,"source"),ZR$(X,"destination");let J=Q.transform??[];if(!Array.isArray(J))v1(`${Z}transform`,`${Z}transform must be an array`);J.forEach((H,F)=>vd4(H,`${Z}transform[${F}]`));let G=bd4(Q.protocol,J);if(Q.match!==void 0){if(xd4(Q.match,`${Z}match`),G!=="http"||Y.public===!0||!(X.public===!0||X.host!==void 0))v1(`${Z}match`,"match requires HTTP egress from a VM or VPC to a public origin or host")}if(J.some((H)=>("s3"in H))){if(J.length!==1||Q.match!==void 0||Y.public===!0||!(X.public===!0||X.host!==void 0)||Q.domain.includes("*"))v1(`${Z}transform`,"s3 requires a sole transform on HTTP egress to a concrete origin, without match")}let W=J.filter((H)=>("jsonPatch"in H));if(W.length>1)v1(`${Z}transform`,"a rule may carry only one jsonPatch transform");if(W.length&&(Y.public===!0||!(X.public===!0||X.host!==void 0)))v1(`${Z}transform`,"jsonPatch requires HTTP egress from a VM or VPC to a public origin or host");if(Q.forwardAuth!==void 0){kd4(Q.forwardAuth,`${Z}forwardAuth`);let H=X.vmId!==void 0||!C10(X)&&X.port!==void 0;if(G!=="http"||Y.public!==!0||!H||Q.domain==="*")v1(`${Z}forwardAuth`,`${Z}forwardAuth is only supported on HTTP public ingress: \`{ public: true } -> { vmId, port }\``)}if(G==="smtp")Sd4(Q.domain);else N91(Q.domain);if((Y.vmId!==void 0||Y.vpcId!==void 0)&&X.vmId!==void 0&&J.length>0)v1(`${Z}transform`,"a VM-to-VM rule cannot carry a transform yet \u2014 remove it (only public ingress/egress rules run transforms)");if(G==="tcp"){let H=X.public===!0||X.host!==void 0,F=Y.vmId!==void 0||Y.vpcId!==void 0;if(H||F)v1(`${Z}protocol`,"a `tcp` rule is public ingress only \u2014 `{ public: true } -> { vmId, port }`. The edge splices the session without terminating it, so outbound there is nothing to broker (an outbound allow is a firewall rule, and injecting into one needs `http` or `postgres`) and inward there is no certificate to answer the source with. Give the source `public: true`, or drop `protocol` to be served as HTTPS")}else if(G==="imap"||G==="imaps"){let H=X.public===!0||X.host!==void 0,F=Y.vmId!==void 0||Y.vpcId!==void 0;if(H||F)v1(`${Z}protocol`,`an \`${G}\` rule is public ingress only \u2014 \`{ public: true } -> { vmId, port }\`. The 993 front serves mail clients reaching a VM's IMAP server; outbound there is nothing to broker (an outbound allow is a firewall rule) and inward there is no certificate to answer the source with`)}else if(G==="socks5"){let H=X.public===!0||X.host!==void 0;if(Y.public===!0||!H)v1(`${Z}protocol`,'a `socks5` rule is egress only \u2014 `{ vmId } -> { host: "gate.provider.com", port: 1080 }`. The front exists so a guest can open sessions through a proxy whose credentials it never holds; inbound there is nothing to serve, and publishing one would be an open proxy on a platform address');if(X.host===void 0)v1(`${Z}destination`,"a `socks5` rule has to name the proxy it goes through: give the destination a `host` and the `port` the provider listens on. `{ public: true }` on its own asks the edge to be the proxy, which would let the guest out on our address rather than through yours")}else if(G==="postgres"){let H=J.some((U)=>U!==null&&typeof U==="object"&&("postgres"in U)),F=X.public===!0||X.host!==void 0;if(H&&!F)v1(`${Z}transform`,"a `postgres` transform belongs on an egress rule: the edge spends a credential the guest never holds, so pointing it at your own VM would hand every client a logged-in session. Give the destination `public: true` or a `host`, or drop the transform")}else if(G==="smtp"){let H=J.some((U)=>U!==null&&typeof U==="object"&&("smtp"in U)),F=X.public===!0||X.host!==void 0;if(H&&!F)v1(`${Z}transform`,"an `smtp` transform belongs on an egress rule: the edge spends a credential the guest never holds, so pointing it at your own VM would turn it into an open relay. Give the destination `public: true` or a `host`, or drop the transform");if(typeof Q.domain==="string"&&Q.domain.includes("@")&&Y.public!==!0)v1(`${Z}domain`,`\`${Q.domain}\` names a mailbox, which only makes sense on a rule that receives mail. An egress or VM-to-VM rule names the host the guest submits through \u2014 drop the part before \`@\``)}return{...Q,source:Y,destination:X}}function fd4($,Z){if($==="source")return Id4(Z)?"source is empty. Say who opens the session: `vmId`, `vpcId`, or `public: true`":"source only narrows the session without saying who opens it. Add `vmId`, `vpcId`, or `public: true`";return"destination is empty. Say where the session lands: `vmId` + `port`, `host` + `port`, or `public: true` for the domain's own origin"}function YR$($){let Z=JR$($,"");for(let Q of["source","destination"]){let Y=Z[Q];if(!C10(Y))v1(Q,fd4(Q,Y))}if(Z.source.public===!0&&Z.destination.public===!0)v1("destination","a rule from the public Internet to the domain's own origin allows nothing the world cannot already do. Did you mean a `vmId` destination (ingress) or a `vmId` source (egress)?");return Z}function GR$($){if(!gY($))v1("tls","tls must be an object with a `rules` array");for(let Q of Object.keys($))if(Q!=="rules")v1(`tls.${Q}`,`tls has unknown field \`${Q}\`. Expected: rules`);let Z=$.rules;if(!Array.isArray(Z))v1("tls.rules","tls.rules must be an array");return Z.forEach((Q,Y)=>{let X=`tls.rules[${Y}].`,J=JR$(Q,X),G=C10(J.source),W=C10(J.destination);if(!G&&!W)v1(`tls.rules[${Y}]`,`tls.rules[${Y}]: both source and destination refer to the VM being created, which allows nothing. Give one of them a \`vmId\`, \`vpcId\`, or \`public: true\``);if(G&&W)v1(`tls.rules[${Y}]`,`tls.rules[${Y}]: neither end refers to the VM being created. Leave one endpoint's identity unset so it means this VM, or create the rule with tls.rules.create instead`);if(!W&&J.destination.port===void 0)v1(`tls.rules[${Y}].destination.port`,`tls.rules[${Y}]: destination.port is required: say which port on this VM the session lands on`)}),$}function F91($){return`/v5/tls/${u6($)}`}function U91($){return`/v5/tls/forward-auth/${u6($)}`}class WR${client;constructor($){this.client=$}list(){return this.client.get("/v5/tls/forward-auth")}async create($){let Z=eT$($);return this.client.post("/v5/tls/forward-auth",Z)}get($){return this.client.get(U91($))}async update($,Z){let Q=eT$(Z);return this.client.put(U91($),Q)}delete($){return this.client.delete(U91($))}}class KR${client;constructor($){this.client=$}async create($){let Z=YR$($);return this.client.post("/v5/tls",Z)}list($={}){return this.client.get("/v5/tls",$)}get($){return this.client.get(F91($))}async update($,Z){let Q=YR$(Z);return this.client.put(F91($),Q)}delete($){return this.client.delete(F91($))}}class O91{client;rules;forwardAuth;constructor($){this.client=$,this.rules=new KR$($),this.forwardAuth=new WR$($)}}var B91,D91,iT$,Ed4,pT$,zd4=253,Pd4=63,nT$,tT$,Ad4,Td4,Rd4=2048,oT$=32,rT$=16384,sT$=32,aT$=32,qd4=128,Md4,$R$="!#$%&'*+-/=?^_`{|}~.",QR$;var RT0=D(()=>{fW();B91=class B91 extends Error{path;constructor($,Z){super(Z);this.name="TlsRuleValidationError",this.path=$,Object.setPrototypeOf(this,B91.prototype)}};D91=class D91 extends Error{path;constructor($,Z){super(Z);this.name="TlsForwardAuthValidationError",this.path=$,Object.setPrototypeOf(this,D91.prototype)}};iT$=["vmId","vpcId","public","host","port"],Ed4=["vmId","vpcId","public","host"],pT$=["tcp","http","postgres","minecraft","smtp","imap","imaps","socks5"],nT$=["url","headers","timeoutMs","protectedCookies","authResponseHeaders"],tT$=["id"],Ad4=/^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/,Td4=/^[0-9A-Za-z-]+$/,Md4=new Set(["host","content-length","connection","keep-alive","proxy-authenticate","proxy-authorization","proxy-connection","te","trailer","transfer-encoding","upgrade"]);QR$=["action","domain","protocol","source","destination","transform","match","forwardAuth"]});function pm($){return`/v5/tunnels/${u6($)}`}function Ff($){return $.tunnelId??=$.id,$}class L91{client;constructor($){this.client=$}list(){return this.client.get("/v5/tunnels").then(($)=>{return $.tunnels.forEach(Ff),$})}create($={}){return this.client.post("/v5/tunnels",$).then(Ff)}get($){return this.client.get(pm($)).then(Ff)}update($,Z){return this.client.patch(pm($),Z).then(Ff)}rotateKey($,Z={}){return this.client.post(`${pm($)}/rotate-key`,Z).then(Ff)}delete($){return this.client.delete(pm($))}attachVpc($,Z,Q={}){return this.client.post(`${pm($)}/vpcs/${u6(Z)}`,Q).then(Ff)}detachVpc($,Z){return this.client.delete(`${pm($)}/vpcs/${u6(Z)}`).then(Ff)}}var w91=D(()=>{fW()});class j91{client;basePath;constructor($,Z){this.client=$,this.basePath=Z}async readFile($,Z={}){let Q=await this.openRead($,Z);return new Uint8Array(await Q.arrayBuffer())}async readTextFile($,Z={}){return await(await this.openRead($,Z)).text()}async readFileStream($,Z={}){let Q=await this.openRead($,Z);if(!Q.body)throw Error(`no response body reading ${$}`);return Q.body}async writeFile($,Z,Q={}){let Y=typeof Z==="string"?new TextEncoder().encode(Z):Z,X=Y instanceof Uint8Array?Y.byteLength:Y.size;if(X>yd4)return this.uploadInChunks($,Y,X,Q);let J=Y instanceof Uint8Array?Y:new Uint8Array(await Y.arrayBuffer());await this.client.putBytes(`${this.basePath}/fs/write`,J,{path:$,mode:Q.mode,sha256:await HR$(J)},Q.signal),Q.onProgress?.({completedBytes:X,totalBytes:X})}writeTextFile($,Z,Q={}){return this.writeFile($,Z,Q)}async readDir($){let{entries:Z}=await this.client.get(`${this.basePath}/fs/dir`,{path:$});return Z}async mkdir($){await this.client.post(`${this.basePath}/fs/mkdir`,{path:$})}async remove($){await this.client.delete(`${this.basePath}/fs/remove`,{path:$})}async exists($){let{exists:Z}=await this.client.get(`${this.basePath}/fs/exists`,{path:$});return Z}stat($){return this.client.get(`${this.basePath}/fs/stat`,{path:$})}openRead($,Z){let{offset:Q,length:Y}=Z,X;if(Q!==void 0||Y!==void 0){let J=Q??0;X=Y===void 0?`bytes=${J}-`:`bytes=${J}-${J+Y-1}`}return this.client.getBytes(`${this.basePath}/fs/read`,{path:$},{range:X,signal:Z.signal})}async uploadInChunks($,Z,Q,Y){let X=Y.chunkSize??gd4,J=Y.maxAttempts??hd4,G=Z instanceof Uint8Array?await HR$(Z):void 0,W=await this.client.post(`${this.basePath}/fs/uploads`,{path:$,size:Q,sha256:G,mode:Y.mode}),K=`${this.basePath}/fs/uploads/${W.uploadId}`;try{let H=W.receivedBytes;while(H<Q){let F=Math.min(H+X,Q),U=Z instanceof Uint8Array?Z.subarray(H,F):Z.slice(H,F);H=(await this.putChunkWithRetry(K,U,H,J,Y.signal)).receivedBytes,Y.onProgress?.({completedBytes:Math.min(H,Q),totalBytes:Q})}await this.client.post(`${K}/commit`)}catch(H){throw await this.client.delete(K).catch(()=>{}),H}}async putChunkWithRetry($,Z,Q,Y,X){let J;for(let G=1;G<=Y;G++){X?.throwIfAborted?.();try{return await this.client.putBytes($,Z,{offset:Q},X)}catch(W){if(J=W,!(!(W instanceof hX)||W.status>=500||W.status===408||W.status===409||W.status===429)||X?.aborted||G===Y)throw W;await ud4(Math.min(500*2**(G-1),8000));let H=await this.client.get($).catch(()=>{return});if(H&&H.receivedBytes>Q)return H}}throw J}}async function HR$($){let Z=globalThis.crypto?.subtle;if(!Z)return;let Q=await Z.digest("SHA-256",$);return Array.from(new Uint8Array(Q),(Y)=>Y.toString(16).padStart(2,"0")).join("")}function ud4($){return new Promise((Z)=>setTimeout(Z,$))}var yd4=8388608,gd4=16777216,hd4=5;var E91=D(()=>{k10()});function ld4(){return typeof process<"u"&&Boolean(process.versions?.node)}async function FR$($,Z){if(ld4()){let Y;try{Y=await import("ws")}catch{throw Error("PTY sessions need the `ws` package in Node. Install it with `npm install ws`.")}return new Y.default($,{headers:Z})}let Q=globalThis.WebSocket;if(!Q)throw Error("PTY sessions need a WebSocket client; no global WebSocket is available in this environment.");return new Q($)}function _10($,Z,Q){if($.on){$.on(Z,Q);return}$.addEventListener?.(Z,Q)}function md4($,Z){if($&&typeof $==="object"&&"data"in $){let Q=$.data;if(typeof Q==="string")return{text:Q};if(Q instanceof ArrayBuffer)return{binary:new Uint8Array(Q)};return{}}if($ instanceof Uint8Array)return Z?{binary:$}:{text:cd4.decode($)};if(typeof $==="string")return{text:$};return{}}class z91{_sessionId;_slug;_created=!1;socket;constructor($,Z,Q={}){this.socket=$,this._sessionId=Z,_10($,"message",(Y,X)=>{let{text:J,binary:G}=md4(Y,X);if(G){Q.onData?.(G);return}if(!J)return;let W;try{W=JSON.parse(J)}catch{return}if(W.type==="exited")Q.onExit?.(W.exitCode);else if(W.type==="error")Q.onError?.(Error(W.message));else if(W.type==="sessionInfo")this._sessionId=W.sessionId,this._slug=W.slug,this._created=W.created??!0,Q.onSessionInfo?.(W.sessionId)}),_10($,"close",(Y)=>{let X=Y;Q.onClose?.({wasClean:X?.wasClean??!0,code:X?.code??1000,reason:X?.reason??""})}),_10($,"error",(Y)=>Q.onError?.(Y))}write($){this.socket.send(typeof $==="string"?new TextEncoder().encode($):$)}resize($){this.sendControl({type:"resize",cols:$.cols,rows:$.rows})}signal($){this.sendControl({type:"signal",signal:$})}sendControl($){this.socket.send(JSON.stringify($))}detach(){this.socket.close()}get sessionId(){return this._sessionId}get slug(){return this._slug}get created(){return this._created}get readyState(){return this.socket.readyState}}function dd4($){return new Promise((Z,Q)=>{if($.readyState===1){Z();return}_10($,"open",()=>Z()),_10($,"error",(Y)=>Q(Y))})}class P91{client;basePath;constructor($,Z){this.client=$,this.basePath=Z}async open($={}){let{exec:Z,cols:Q,rows:Y,linuxUser:X,slug:J,replaceOnExit:G,onData:W,onExit:K,onClose:H,onError:F}=$,U={};if(Z!==void 0)U.exec=Z;if(Q!==void 0)U.cols=Q;if(Y!==void 0)U.rows=Y;if(X!==void 0)U.linuxUser=X;if(J!==void 0)U.slug=J;if(G!==void 0)U.replaceOnExit=String(G);let N=UR$(this.client,`${this.basePath}/pty`,U),B=this.client.authHeaders(),O=await FR$(N,B);return new Promise((L,w)=>{let j=!1,E=new z91(O,-1,{onData:W,onExit:K,onClose:(z)=>{if(!j)j=!0,w(Error("connection closed before sessionInfo"));H?.(z)},onError:(z)=>{if(!j)j=!0,w(z);F?.(z)},onSessionInfo:()=>{j=!0,L(E)}})})}async attach($){let{session:Z,linuxUser:Q,onData:Y,onExit:X,onClose:J,onError:G}=$,W=UR$(this.client,`${this.basePath}/pty/sessions/${u6(String(Z))}`,{...Q!==void 0?{linuxUser:Q}:{}}),K=this.client.authHeaders(),H=await FR$(W,K),F=new z91(H,typeof Z==="number"?Z:-1,{onData:Y,onExit:X,onClose:J,onError:G});return await dd4(H),F}list($={}){return this.client.get(`${this.basePath}/pty/sessions`,$)}close($,Z={}){return this.client.delete(`${this.basePath}/pty/sessions/${u6(String($))}`,Z)}}class A91{pty;linuxUser;constructor($,Z){this.pty=$,this.linuxUser=Z}open($={}){return this.pty.open({...$,linuxUser:this.linuxUser})}attach($){return this.pty.attach({...$,linuxUser:this.linuxUser})}list(){return this.pty.list({linuxUser:this.linuxUser})}close($){return this.pty.close($,{linuxUser:this.linuxUser})}}function UR$($,Z,Q){return $.url(Z,Q).replace(/^http/,"ws")}var cd4;var T91=D(()=>{fW();cd4=new TextDecoder});class R91{client;constructor($){this.client=$}list($={}){return this.client.get("/v5/snapshots",$)}get($){return this.client.get(`/v5/snapshots/${u6($)}`)}update($,Z){return this.client.patch(`/v5/snapshots/${u6($)}`,Z)}delete($){return this.client.delete(`/v5/snapshots/${u6($)}`)}}var q91=D(()=>{fW()});var NR$=()=>{};function M91($){return`/v5/vms/${u6($)}`}class I91{id;fs;pty;client;basePath;constructor($,Z){this.client=$,this.id=Z,this.basePath=M91(Z),this.fs=new j91($,this.basePath),this.pty=new P91($,this.basePath)}data(){return this.client.get(this.basePath)}firewallRules(){return this.client.get("/v5/firewall/rules",{vmId:this.id})}update($){return this.client.patch(this.basePath,$)}start(){return this.client.post(`${this.basePath}/start`)}pause(){return this.client.post(`${this.basePath}/pause`)}resize($){return this.client.post(`${this.basePath}/resize`,$)}delete(){return this.client.delete(this.basePath)}exec($){let Z=typeof $==="string"?{command:$}:$;return this.client.post(`${this.basePath}/exec-await`,Z)}linuxUser($){return new BR$(this,$)}snapshot($={}){return this.client.post(`${this.basePath}/snapshot`,$)}}class BR${vm;linuxUser;pty;constructor($,Z){this.vm=$,this.linuxUser=Z,this.pty=new A91($.pty,Z)}exec($){let Z=typeof $==="string"?{command:$}:$;return this.vm.exec({...Z,linuxUser:this.linuxUser})}}class V91{client;snapshots;constructor($){this.client=$,this.snapshots=new R91($)}async create($){if(TT0($.firewall,"VM"),$.tls!==void 0)GR$($.tls);let Z=await this.client.post("/v5/vms",$);return{vm:new I91(this.client,Z.id),vmId:Z.id,data:Z,firewallRules:Z.firewallRules??[],tlsRules:Z.tlsRules??[]}}list($={}){return this.client.get("/v5/vms",$)}get($){return this.client.get(M91($))}ref($){return new I91(this.client,$)}delete($){return this.client.delete(M91($))}}var k91=D(()=>{S10();RT0();fW();E91();T91();q91();NR$();E91();T91();q91()});function S91($){return`/v5/vpcs/${u6($)}`}class DR${client;basePath;constructor($,Z){this.client=$,this.basePath=Z}list(){return this.client.get(`${this.basePath}/tunnels`)}}class C91{id;tunnels;client;basePath;constructor($,Z){this.client=$,this.id=Z,this.basePath=S91(Z),this.tunnels=new DR$($,this.basePath)}data(){return this.client.get(this.basePath)}update($){return this.client.patch(this.basePath,$)}delete(){return this.client.delete(this.basePath)}}class _91{client;constructor($){this.client=$}list(){return this.client.get("/v5/vpcs")}async create($={}){if($.firewall!==void 0)TT0($.firewall,"network");let Z=await this.client.post("/v5/vpcs",$);return{vpc:new C91(this.client,Z.id),vpcId:Z.id,data:Z,firewallRules:Z.firewallRules??[]}}get($){return this.client.get(S91($))}ref($){return new C91(this.client,$)}delete($){return this.client.delete(S91($))}}var v91=D(()=>{S10();fW()});class qT0{client;vms;vpc;tunnels;firewall;tls;domains;identities;constructor($={}){this.client=new e51($),this.vms=new V91(this.client),this.vpc=new _91(this.client),this.tunnels=new L91(this.client),this.firewall=new J91(this.client),this.tls=new O91(this.client),this.domains=new $91(this.client),this.identities=new K91(this.client)}fetch($,Z){return this.client.fetch($,Z)}}var OR$=D(()=>{fW();Z91();S10();H91();RT0();w91();k91();v91();fW();k10();k91();v91();w91();Z91();S10();RT0();H91()});var wR$;var LR$=D(()=>{wR$={name:"@decocms/sandbox",version:"1.82.1",private:!0,type:"module",description:"Sandbox runtime for isolated Studio tool execution",scripts:{check:"tsc --noEmit",test:"bun test",build:"bun run build:typegen && bun run build:harness-runner","build:typegen":"mkdir -p dist && bun run --cwd=../typegen build && bun --cwd=../typegen pm pack --filename $PWD/dist/typegen.tgz --quiet","build:harness-runner":"mkdir -p dist && bun --cwd=../harness-runner pm pack --filename $PWD/dist/harness-runner.tgz --quiet"},exports:{"./shared":"./shared.ts","./provider":"./server/provider/index.ts","./provider/agent-sandbox":"./server/provider/agent-sandbox/index.ts","./provider/postgres-state-store":"./server/provider/postgres-state-store.ts","./provider/freestyle":"./server/provider/freestyle.ts","./provider/remote":"./server/provider/remote.ts","./provider/router":"./server/provider/router.ts","./provider/sandbox-api":"./server/provider/sandbox-api.ts","./provider/sandbox-server":"./server/provider/sandbox-server.ts","./daemon-client":"./server/daemon-client.ts","./org-fs":"./org-fs.ts","./dispatch":"./dispatch/index.ts","./dispatch/*":"./dispatch/*.ts","./proxy/http":"./proxy/http.ts","./proxy/websocket":"./proxy/websocket.ts"},dependencies:{"@decocms/shared":"workspace:*","@kubernetes/client-node":"^1.4.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0",freestyle:"0.2.16",zod:"4.3.6"},devDependencies:{"@types/bun":"latest",postgres:"^3.4.5",typescript:"^7.0.2"}}});function MT0($){let Z=$?.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of studio-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"});return async(Q,Y)=>{if(!Z)return Y();let X=performance.now(),J=(G)=>Z.record(performance.now()-X,{runner_kind:Q,source:"daemon",status_code:G});try{let G=await Y();return J(G.status),G}catch(G){throw J(0),G}}}var qD;var IT0=D(()=>{qD={kubernetes:"agent-sandbox",freestyle:"freestyle"}});var MR$={};Z6(MR$,{FreestyleSandboxProvider:()=>qR$});import{createHash as pd4,randomBytes as nd4}from"crypto";class qR${freestyle;lookupClient;image;sidecarImage;idleTimeoutSeconds;autoDeleteSeconds;domainSuffix;timeDaemonRequest;inflight=new Wf;snapshotInflight=new Wf;lookups=new Map;releaseTimers=new Map;constructor($){this.freestyle=$.client??new qT0({apiKey:$.apiKey}),this.lookupClient=$.client??new qT0({apiKey:$.apiKey,fetch:Object.assign((Z,Q)=>fetch(Z,{...Q,signal:Q?.signal?AbortSignal.any([Q.signal,AbortSignal.timeout(AR$)]):AbortSignal.timeout(AR$)}),{preconnect:fetch.preconnect})}),this.image=$.image??`ghcr.io/decocms/studio/studio-sandbox-go:${wR$.version}`,this.sidecarImage=$.orgFsSidecarImage??od4,this.idleTimeoutSeconds=$.idleTimeoutSeconds??300,this.autoDeleteSeconds=$.autoDeleteSeconds??86400,this.domainSuffix=$.domainSuffix??"style.dev",this.timeDaemonRequest=MT0($.meter)}async owns($){return await this.find($)!==null}daemonUrl($){return`https://${$}.${this.domainSuffix}`}async find($,Z={}){let Q=this.lookups.get($);if(!Z.refresh&&Q&&Date.now()-Q.at<(Q.found?Zi4:Qi4))return Q.found;let Y=null;try{let X=await this.lookupClient.vms.get($),J=X.metadata[zR$];if(J)Y={vm:this.freestyle.vms.ref(X.id),daemon:{url:this.daemonUrl($),token:J}}}catch(X){if(!(X instanceof hX&&X.status===404))throw X}return this.remember($,Y),Y}remember($,Z){if(this.lookups.delete($),this.lookups.size>=Yi4){let Q=this.lookups.keys().next();if(!Q.done)this.lookups.delete(Q.value)}this.lookups.set($,{found:Z,at:Date.now()})}baseSnapshot(){let{image:$,sidecarImage:Z}=this,Q=`studio-sandbox-${pd4("sha256").update(`${$}
 ${Z}`).digest("hex").slice(0,16)}`;return this.snapshotInflight.run(Q,async()=>{if(await this.snapshotExists(Q))return Q;console.log(`[${Uf}] building base snapshot ${Q} for ${$}`);let{vm:Y}=await this.freestyle.vms.create({ttlSeconds:1800,firewall:{rules:[{action:"allow",source:{},destination:{public:!0}}]}});try{await this.run(Y,`docker pull -q ${nm($)} && docker pull -q ${nm(Z)}`,{timeoutMs:b91}),await Y.snapshot({slug:Q})}catch(X){if(!await this.snapshotExists(Q))throw X}finally{await Y.delete().catch(()=>{})}return Q})}async snapshotExists($){try{return await this.freestyle.vms.snapshots.get($),!0}catch(Z){if(Z instanceof hX&&Z.status===404)return!1;throw Z}}async run($,Z,Q={}){let Y=await $.exec({command:Z,...Q});if(Y.statusCode!==0)throw Error(`${Z.split(" ",2).join(" ")} failed (${Y.statusCode??"timeout"}): ${(Y.stderr||Y.stdout||"").slice(-500)}`);return Y.stdout??""}async ensure($,Z={}){let Q=N3($);if(Q.startsWith("s-"))throw Error(`ensure: projectRef has no slug source: ${$.projectRef}`);return this.inflight.run(Q,async()=>{this.cancelRelease(Q);let Y=await this.find(Q,{refresh:!0});if(Y)await this.resume(Y,Z);else await this.create(Q,Z);return{handle:Q,workdir:v10,previewUrl:this.daemonUrl(Q),warmPoolAdopted:!1,provider:"freestyle"}})}async resume($,Z){let{state:Q}=await $.vm.data();if(Q!=="running")await $.vm.start();if(await this.waitForDaemon($.daemon.url),Z.orgFsConfigJson)await A10($.daemon.url,$.daemon.token,Z.orgFsConfigJson).catch((X)=>console.warn(`[${Uf}] org-fs relay failed`,X));let Y=R10(Z);if(Y)await _U($.daemon.url,$.daemon.token,Y).catch((X)=>console.warn(`[${Uf}] git credential refresh failed: ${RR$(X)}`))}async create($,Z){let Q=await this.baseSnapshot(),Y=nd4(24).toString("hex"),{vm:X}=await this.createVm({snapshotId:Q,slug:$,idleTimeoutSeconds:this.idleTimeoutSeconds,metadata:{[zR$]:Y,...Z.tenant?{[sd4]:Z.tenant.orgId,[ad4]:Z.tenant.userId}:{}},firewall:{rules:[{action:"allow",source:{},destination:{public:!0}}]},tls:{rules:[{action:"allow",domain:`${$}.${this.domainSuffix}`,source:{public:!0},destination:{port:VT0}}]}}),J={url:this.daemonUrl($),token:Y};try{let G={...Z.env,DAEMON_TOKEN:Y,DAEMON_BOOT_ID:crypto.randomUUID(),APP_ROOT:v10,PROXY_PORT:String(VT0),ORGFS_SIDECAR_CONFIG_PATH:`${kT0}/config.json`,ORGFS_SIDECAR_STATUS_PATH:`${kT0}/status.json`},W=Object.keys(G).map((K)=>`-e ${nm(K)}`).join(" ");if(await this.run(X,`sudo sh -c ${nm(rd4)} && docker run -d --name ${ER$} --restart=always --privileged --device /dev/fuse -e APP_ROOT=${v10} -e ORGFS_FEED_IDLE_MS=60000 -v ${tj}:${v10}/org:rshared -v ${tm}:${kT0} ${nm(this.sidecarImage)}`,{timeoutMs:b91}),await this.run(X,`docker run -d --name ${jR$} --restart=always -p ${VT0}:${VT0} -v ${tj}:${v10}/org:rslave -v ${tm}:${kT0} ${W} ${nm(this.image)}`,{env:G,timeoutMs:b91}),await this.waitForDaemon(J.url),await _U(J.url,Y,this.configPayload(Z)??{}),Z.orgFsConfigJson)await A10(J.url,Y,Z.orgFsConfigJson).catch((K)=>console.warn(`[${Uf}] org-fs relay failed`,K))}catch(G){throw await X.delete().catch(()=>{}),this.lookups.delete($),G}this.remember($,{vm:X,daemon:J})}async createVm($){try{return await this.freestyle.vms.create({...$,autoDeleteSeconds:this.autoDeleteSeconds})}catch(Z){if(!(Z instanceof hX&&Z.status===400))throw Z;return console.warn(`[${Uf}] autoDeleteSeconds=${this.autoDeleteSeconds} refused (${Z.message}); creating with the plan's cap`),this.freestyle.vms.create($)}}configPayload($){return hm({runtime:$.workload?.runtime??"node",packageManager:$.workload?.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:$.repo??null,extraRepos:$.extraRepos??[],port:$.workload?.devPort??td4,tenant:$.tenant,cloneOnly:$.cloneOnly===!0})}async waitForDaemon($){let Z=Date.now()+PR$;while(Date.now()<Z){if(await TR$($))return;await L$(ed4)}throw Error(`sandbox daemon at ${$} did not answer /health within ${PR$/1000}s`)}async delete($){this.cancelRelease($);let Z=await this.find($,{refresh:!0});if(this.lookups.delete($),!Z)return;await Z.vm.exec({command:`docker stop -t 30 ${jR$}; docker stop -t 10 ${ER$}`,timeoutMs:60000}).catch(()=>{}),await Z.vm.delete()}async lastTermination($){return null}async alive($){return await this.find($,{refresh:!0})!==null}async*watchClaimLifecycle($,Z){let Q=Date.now();yield{kind:"claiming",since:Q};let Y=!1;while(!Z?.aborted){let X=await this.find($,{refresh:!0}).catch(()=>null);if(X){if(!Y)Y=!0,yield{kind:"warming-daemon",since:Date.now()};if(await TR$(X.daemon.url)){yield{kind:"ready"};return}}if(Date.now()-Q>Xi4){yield{kind:"failed",reason:X?"crash-loop-backoff":"claim-never-created",message:X?"the sandbox VM exists but its daemon never answered":"no sandbox VM was created"};return}await L$(1000)}}async hasSchedulableCapacity(){return!0}async getPreviewUrl($){return await this.find($)?this.daemonUrl($):null}async proxyDaemonRequest($,Z,Q){let Y=await this.find($);if(!Y)return Response.json({error:"sandbox not found"},{status:404});let X=async()=>(await this.find($,{refresh:!0}))?.daemon??null;return this.timeDaemonRequest(qD.freestyle,()=>cm(Y.daemon,Z,Q,{unauthorized:async()=>{let J=await X();return J&&J.token!==Y.daemon.token?J:null},unreachable:X}))}async daemonEndpoint($){return(await this.find($))?.daemon??null}async adoptLiveClaim($,Z){return await this.find(Z,{refresh:!0})!==null}async resolvePreviewUpstreamUrl($){return(await this.find($))?.daemon.url??null}proxyPreviewRequest($,Z){return dm(Z,{base:()=>this.resolvePreviewUpstreamUrl($).catch(()=>null),invalidate:()=>this.lookups.delete($),retryBase:()=>this.find($,{refresh:!0}).then((Q)=>Q?.daemon.url??null).catch(()=>null)},Uf)}async markTenantPoolsDirty($,Z){return[]}async releaseAfter($,Z){this.cancelRelease($);let Q=setTimeout(()=>{this.releaseTimers.delete($),this.find($).then((Y)=>Y?.vm.pause()).catch((Y)=>console.warn(`[${Uf}] pause ${$} failed: ${RR$(Y)}`))},Z);Q.unref?.(),this.releaseTimers.set($,Q)}async renewTtl($){this.cancelRelease($)}cancelRelease($){let Z=this.releaseTimers.get($);if(Z)clearTimeout(Z);this.releaseTimers.delete($)}close(){for(let $ of this.releaseTimers.values())clearTimeout($);this.releaseTimers.clear(),this.lookups.clear()}}async function TR$($){try{let Z=await fetch(`${$}/health`,{signal:AbortSignal.timeout($i4)});return await Z.body?.cancel(),Z.ok}catch{return!1}}function nm($){return`'${$.replaceAll("'","'\\''")}'`}function RR$($){return $ instanceof Error?$.message:String($)}var Uf="FreestyleSandboxProvider",VT0=9000,v10="/app",td4=3000,jR$="sandbox",ER$="orgfs",od4="ghcr.io/decocms/studio/orgfs-sidecar:0.2.0",tj="/srv/sandbox/org",tm="/srv/sandbox/orgfs-ctl",kT0="/run/orgfs",rd4,zR$="studio-daemon-token",sd4="studio-org-id",ad4="studio-user-id",PR$=120000,ed4=500,$i4=5000,b91=300000,Zi4=300000,Qi4=1e4,Yi4=5000,Xi4=300000,AR$=3000;var IR$=D(()=>{OR$();a$();LR$();Gf();um();BT0();DT0();IT0();rd4=[`mkdir -p ${tj} ${tm}`,`grep -q ' ${tj} ' /etc/fstab || printf '%s\\n' '${tj} ${tj} none bind,rshared 0 0' 'tmpfs ${tm} tmpfs uid=1000,gid=1000,mode=0755,size=1m 0 0' >> /etc/fstab`,`mountpoint -q ${tj} || mount ${tj}`,`mountpoint -q ${tm} || mount ${tm}`].join(" && ")});function b10($,Z){if($ instanceof Error)Object.assign($,{["sandboxProvider"]:Z});return $}function x91($){for(let Z=$,Q=0;Z instanceof Error&&Q<5;Q++){let Y=Z.sandboxProvider;if(Y==="kubernetes"||Y==="freestyle")return Y;Z=Z.cause}return}var f91={};Z6(f91,{handleShare:()=>VR$,SandboxProviderRouter:()=>kR$});import{createHash as Ji4}from"crypto";function VR$($){let Z=Ji4("sha256").update($).digest("hex").slice(0,8);return Number.parseInt(Z,16)/4294967296}function Ki4($){return $ instanceof PH}class kR${providers;picked=new Map;strays=new Map;freestyleShare;constructor($,Z={}){this.providers=$;if(!$.kubernetes&&!$.freestyle)throw Error("SandboxProviderRouter needs at least one provider");this.freestyleShare=Math.min(1,Math.max(0,Z.freestyleShare??0))}get($){let Z=this.providers[$];if(!Z)throw Error(`sandbox provider ${$} is not configured`);return Z}remember($,Z){if(this.picked.delete($),this.picked.size>=Gi4){let Q=this.picked.keys().next();if(!Q.done)this.picked.delete(Q.value)}this.picked.set($,Z)}async providerOf($){let{kubernetes:Z,freestyle:Q}=this.providers;if(!Q)return"kubernetes";if(!Z)return"freestyle";let Y=this.picked.get($);if(Y)return Y;return await Q.owns($).catch(()=>!1)?"freestyle":"kubernetes"}async owner($){return this.get(await this.providerOf($))}async place($,Z){let{kubernetes:Q,freestyle:Y}=this.providers,X=Z.sandboxImage??"default";if(X!=="default"){if(!Q)throw Error(`sandbox image ${X} needs the kubernetes provider`);return{kind:"kubernetes",reason:Y?"image":void 0}}if(!Q)return{kind:"freestyle"};if(!Y)return{kind:"kubernetes"};let J=this.strays.get($);if(J)this.retire(J,$);if(J!=="kubernetes"&&await Q.alive($).catch(()=>!1))return{kind:"kubernetes",reason:"existing"};let G=J==="freestyle"?!1:await Y.owns($).catch(()=>null);if(G)return{kind:"freestyle",reason:"existing"};if(G===null)return{kind:"kubernetes",reason:"freestyle-unavailable"};if(Z.provider)return{kind:Z.provider,reason:"requested"};if(this.hasWarmPool(Z,X))return{kind:"kubernetes",reason:"warm-pool"};if(VR$($)<this.freestyleShare)return{kind:"freestyle",reason:"split"};return await Q.hasSchedulableCapacity().catch(()=>!1)?{kind:"kubernetes",reason:"split"}:{kind:"freestyle",reason:"capacity"}}hasWarmPool($,Z){let Q=NT0($);if(!Q)return!1;return(this.providers.kubernetes?.listTenantPools?.()??[]).some((X)=>X.tenant===Q&&X.image===Z)}async ensure($,Z={}){let{provider:Q,...Y}=Z,X=N3($),J=await this.place(X,Z);if(this.remember(X,J.kind),this.strays.get(X)===J.kind)this.strays.delete(X);let G;try{let H=await this.get(J.kind).ensure($,Y);return J.reason?{...H,placement:{reason:J.reason}}:H}catch(H){G=b10(H,J.kind)}let W=Wi4(J.kind);if(!J.reason||J.reason==="image"||Ki4(G))throw G;console.warn(`[SandboxProviderRouter] ensure ${X} failed on ${J.kind}, trying ${W}:`,G instanceof Error?G.message:String(G)),this.remember(X,W);let K;try{K=await this.get(W).ensure($,Y)}catch(H){throw this.picked.delete(X),b10(H,W)}if(J.reason==="existing")this.retire(J.kind,X);return{...K,placement:{reason:"fallback",fallbackFrom:J.kind}}}retire($,Z){this.strays.set(Z,$),E8(async()=>{if(this.strays.get(Z)===$)await this.get($).delete(Z)},{maxAttempts:3}).then(()=>{if(this.strays.get(Z)===$)this.strays.delete(Z)}).catch((Q)=>console.warn(`[SandboxProviderRouter] delete of ${$} sandbox ${Z} after fallback failed:`,Q instanceof Error?Q.message:String(Q)))}async delete($){let Z=this.strays.get($);this.strays.delete($),await Promise.all([(await this.owner($)).delete($),Z&&this.get(Z).delete($).catch(()=>{})]),this.picked.delete($)}async lastTermination($){return(await this.owner($)).lastTermination($)}async alive($){return(await this.owner($)).alive($)}async*watchClaimLifecycle($,Z){yield*(await this.owner($)).watchClaimLifecycle($,Z)}async hasSchedulableCapacity(){let{kubernetes:$,freestyle:Z}=this.providers;if(!$||Z)return!0;return $.hasSchedulableCapacity()}async getPreviewUrl($){return(await this.owner($)).getPreviewUrl($)}async proxyDaemonRequest($,Z,Q){return(await this.owner($)).proxyDaemonRequest($,Z,Q)}async adoptLiveClaim($,Z){return(await this.owner(Z)).adoptLiveClaim($,Z)}async resolvePreviewUpstreamUrl($){return(await this.owner($)).resolvePreviewUpstreamUrl($)}async proxyPreviewRequest($,Z){return(await this.owner($)).proxyPreviewRequest($,Z)}async markTenantPoolsDirty($,Z){return await this.providers.kubernetes?.markTenantPoolsDirty($,Z)??[]}async releaseAfter($,Z){await(await this.owner($)).releaseAfter($,Z)}async renewTtl($){await(await this.owner($)).renewTtl($)}async daemonEndpoint($){let Z=this.providers[await this.providerOf($)];if(!Z?.daemonEndpoint)throw Error("sandbox provider has no daemon endpoint to serve");return Z.daemonEndpoint($)}listSandboxes(){return this.providers.kubernetes?.listSandboxes?.()??[]}listTenantPools(){return this.providers.kubernetes?.listTenantPools?.()??[]}close(){this.providers.kubernetes?.close(),this.providers.freestyle?.close(),this.picked.clear(),this.strays.clear()}}var Gi4=5000,Wi4=($)=>$==="kubernetes"?"freestyle":"kubernetes";var y91=D(()=>{a$();Gf();I10();um()});var g91={};Z6(g91,{toClaimPhase:()=>fR$,SandboxHostError:()=>Nf,RemoteSandboxProvider:()=>xR$});function rm($){return $ instanceof Error?$.message:String($)}function Oi4($){if(!Array.isArray($))return"";let Z=$[0];return typeof Z==="object"&&Z!==null&&"text"in Z&&typeof Z.text==="string"?Z.text:""}function Li4($){return $ instanceof IB&&$.code===503}function wi4($,Z){let Q=null;try{Q=JSON.parse(Z)}catch{}let Y=hL$.safeParse(Q);if(!Y.success)return new Nf(`${$} failed: ${Z.slice(0,300)}`);let X=Y.data.code==="bootstrap-rejected"?new PH(Y.data.status??502,Y.data.error):new Nf(`${$}: ${Y.data.error}`);return Y.data.provider?b10(X,Y.data.provider):X}function _T0($){return{kind:"failed",reason:"unknown",message:$}}function CR$($){return $.kind==="ready"||$.kind==="failed"}function _R$($){return D7(bR$,vR$,$,2,0.5)}function ST0(...$){let Z=$.filter((Q)=>Q!==void 0);return Z.length>1?AbortSignal.any(Z):Z[0]}class xR${baseUrl;token;credentialLifetimeMs;stallMs;timeDaemonRequest;closed=new AbortController;connecting=null;sandboxes=new Map;capacity=null;capacityInFlight=null;constructor($){this.baseUrl=$.baseUrl.replace(/\/$/,""),this.token=$.token,this.credentialLifetimeMs=$.credentialLifetimeMs,this.stallMs=$.stallMs??4*_L$,this.timeDaemonRequest=MT0($.meter)}headers(){return{authorization:`Bearer ${this.token}`}}client(){return this.connecting??=(async()=>{let $=new $7({name:"studio",version:"1.0.0"}),Z=new _F(new URL(`${this.baseUrl}/mcp`),{requestInit:{headers:this.headers()},fetch:(Q,Y)=>fetch(Q,{...Y,timeout:!1})});return await $.connect(Z,{timeout:SR$}),$})().catch(($)=>{throw this.connecting=null,$}),this.connecting}async call($,Z,Q,Y={}){let{timeoutMs:X=SR$,signal:J}=Y,G;try{G=await E8(async()=>(await this.client()).callTool({name:$,arguments:{...Z}},void 0,{timeout:X??Hi4,signal:J}),{maxAttempts:Fi4,minTimeout:vR$,maxTimeout:bR$,jitter:Ui4,isRetriable:Li4,signal:J})}catch(K){if(J?.aborted)throw J.reason;throw K instanceof A5?K.cause:K}if(G.isError)throw wi4($,Oi4(G.content));let W=Q.safeParse(G.structuredContent);if(!W.success)throw new Nf(`${$} returned a malformed result: ${W.error.message}`);return W.data}async whileHostAlive($,Z,Q){let Y=new AbortController,X=new AbortController;this.hostStall($,ST0(Y.signal,Q,this.closed.signal)??Y.signal).then((J)=>{if(J)X.abort(J)});try{return await Z(ST0(X.signal,Q,this.closed.signal)??X.signal)}finally{Y.abort()}}cached($){let Z=this.sandboxes.get($);if(!Z)return null;if(Date.now()-Z.at>Bi4)return this.sandboxes.delete($),null;return Z}remember($,Z,Q,Y){if(this.sandboxes.delete($),!Z)return;if(this.sandboxes.size>=Di4){let X=this.sandboxes.keys().next();if(!X.done)this.sandboxes.delete(X.value)}this.sandboxes.set($,{daemon:Z,previewUrl:Q,provider:Y,at:Date.now()})}async status($,Z={}){let Q=(X,J)=>this.call(wD.status,{handle:$,resurrect:Z.resurrect??!1},fL$,{signal:X,timeoutMs:J}),Y=Z.resurrect?await this.whileHostAlive($,(X)=>Q(X,null),Z.signal):await Q(Z.signal);return this.remember($,Y.daemon,Y.previewUrl,Y.provider),Y}async daemonFor($,Z={}){if(!Z.refresh){let Q=this.cached($);if(Q)return Q.daemon}return(await this.status($,{resurrect:!0,signal:Z.signal})).daemon}async ensure($,Z={}){let{image:Q,...Y}=Z,X=N3($),J=this.credentialLifetimeMs,G=Date.now(),W=await this.whileHostAlive(X,(K)=>this.call(wD.ensure,{id:$,opts:Y,...J&&{credentialsValidUntil:{orgFsConfig:G+J.orgFsConfig}}},xL$,{timeoutMs:null,signal:K}));if(W.handle!==X)throw new Nf(`host answered ensure with ${W.handle}, expected ${X}`);return this.remember(W.handle,W.daemon,W.previewUrl,W.provider),{handle:W.handle,workdir:W.workdir,previewUrl:W.previewUrl,warmPoolAdopted:W.warmPoolAdopted,provider:W.provider,...W.placement&&{placement:W.placement}}}async delete($){this.sandboxes.delete($),await this.call(wD.delete,{handle:$},S41)}async alive($){return(await this.status($)).alive}async getPreviewUrl($){let Z=this.cached($);if(Z)return Z.previewUrl;return(await this.status($)).previewUrl}async lastTermination($){return(await this.status($)).lastTermination}async lifetime($,Z){try{await this.call(wD.lifetime,$,S41)}catch(Q){console.warn(`[${om}] ${Z} failed: ${rm(Q)}`)}}renewTtl($){return this.lifetime({handle:$},`TTL renew for ${$}`)}releaseAfter($,Z){return this.lifetime({handle:$,graceMs:Math.max(0,Math.round(Z))},`release of ${$}`)}hasSchedulableCapacity(){let $=this.capacity;if($&&Date.now()-$.at<Ni4)return Promise.resolve($.value);return this.capacityInFlight??=this.readCapacity().finally(()=>{this.capacityInFlight=null}),this.capacityInFlight}async readCapacity(){let $=!0;try{$=(await this.call(wD.capacity,{},yL$)).schedulable}catch(Z){console.warn(`[${om}] capacity probe failed: ${rm(Z)}`)}return this.capacity={value:$,at:Date.now()},$}async adoptLiveClaim($,Z){let Q=await this.status(Z).catch(()=>null);return Boolean(Q?.daemon)}async markTenantPoolsDirty($,Z){try{return(await this.call(wD.tenantPoolsPush,{repoUrl:$,ref:Z},gL$)).pools}catch(Q){return console.warn(`[${om}] tenant pool push for ${$}@${Z} failed: ${rm(Q)}`),[]}}list(){return this.call(wD.list,{},mL$)}pushCredentials($){return this.call(wD.credentialsPush,$,cL$)}close(){this.closed.abort(),this.sandboxes.clear();let $=this.connecting;this.connecting=null,$?.then((Z)=>Z.close()).catch(()=>{})}async proxyDaemonRequest($,Z,Q){let Y=Q.signal,X=await this.daemonFor($,{signal:Y});if(!X)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let J=this.sandboxes.get($)?.provider??"kubernetes";return this.timeDaemonRequest(qD[J],()=>cm(X,Z,Q,{unauthorized:async()=>{let G=await this.daemonFor($,{refresh:!0,signal:Y}).catch(()=>null);return G&&(G.token!==X.token||G.url!==X.url)?G:null},unreachable:()=>this.daemonFor($,{refresh:!0,signal:Y})}))}async resolvePreviewUpstreamUrl($,Z){return(await this.daemonFor($,{signal:Z}))?.url??null}proxyPreviewRequest($,Z){let Q=Z.signal;return dm(Z,{base:()=>this.resolvePreviewUpstreamUrl($,Q).catch((Y)=>{return console.warn(`[${om}] preview upstream for ${$} failed: ${rm(Y)}`),null}),invalidate:()=>this.sandboxes.delete($),retryBase:()=>this.daemonFor($,{refresh:!0,signal:Q}).then((Y)=>Y?.url??null).catch(()=>null)},om)}async*watchOnce($,Z){let Q=new URL(`${this.baseUrl}${CL$}`);Q.searchParams.set("handle",$);let Y=new AbortController,X,J=this.stallMs/2,G=()=>{clearTimeout(X),X=setTimeout(()=>Y.abort(Error(`host sent nothing for ${J/1000}s`)),J)};G();try{let W=await fetch(Q,{headers:{...this.headers(),accept:"text/event-stream"},signal:ST0(Y.signal,Z),timeout:!1});if(!W.ok||!W.body){await W.body?.cancel().catch(()=>{});let F=`watch answered ${W.status}`;throw W.status>=400&&W.status<500?new CT0(F):Error(F)}G();let K=new TextDecoder,H="";for await(let F of W.body){G(),H+=K.decode(F,{stream:!0});let U=H.indexOf(`
 
 `);while(U!==-1){let N=H.slice(0,U);H=H.slice(U+2),U=H.indexOf(`
@@ -3719,7 +3719,7 @@ ${J.join(`
 `)}`:X}function Io6($){let Z=new Set;for(let Q of $)for(let Y of Q.split(`
 `)){let X=Y.trim();if(/^Co-authored-by:\s/i.test(X))Z.add(X)}return[...Z]}var iY8=200,wo6=12,Eo6,Po6=300,X_0=3;var mD1=D(()=>{X7();a$();Y_0();Eo6={aheadBy:0,behindBy:0,files:[]}});function ko6($){if(!$||$.includes(".."))return!1;return Vo6.test($)}function nY8($){return So6.includes($)}function dD1($){let Z=typeof $.__resolveType==="string"?$.__resolveType:null;if(!Z||!ko6(Z))return null;let{__resolveType:Q,...Y}=$;return{resolveType:Z,payload:Y}}function iD1($,Z){return`${$.replace(/\/+$/,"")}/deco/invoke/${Z}`}var Vo6,So6;var tY8=D(()=>{Vo6=/^[\w./@-]+$/;So6=["vtex/loaders/intelligentSearch/productList.ts","vtex/loaders/categories/tree.ts"]});function a60($,Z){let Q=$?.repository;if(!Q?.owner||!Q?.name)return null;if(!Q.connectionId)return Q;if(!Z.includes(Q.connectionId))return null;return Q}async function rY8($,Z,Q,Y){let X=$.organization?.id;if(!X)throw new Yz(v7);let J=await xj($.storage,X,Y);if(J&&await OD($.storage,J)){let F=await qU($,J,{forceRefresh:!0}).catch((U)=>{throw new Yz(U instanceof Error?U.message:v7)});await oY8($,Z,Q,F);return}let G=Y.connectionId??J?.legacyConnectionId;if(!G)throw new Yz("Push requires a connected git account. Connect the repository's provider for this project and restart the sandbox.");await Pm({ctx:$,connectionId:G,organizationId:X,forceRefresh:!0,onLegacyMintError:(F)=>{let U=F instanceof Error?F.message:v7;throw new Yz(U)}});let{cloneUrl:W,gitUserName:K,gitUserEmail:H}=await MU(G,Y.owner,Y.name,$.db,$.vault).catch((F)=>{let{code:U,message:N}=qL$(F instanceof Error?F.message:String(F));throw U?new Yz(N):F});await oY8($,Z,Q,{cloneUrl:W,gitUserName:K,gitUserEmail:H})}async function oY8($,Z,Q,Y){let{cloneUrl:X,gitUserName:J,gitUserEmail:G}=Y,W=vp($),K=await Z.proxyDaemonRequest(Q,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({git:{repository:{cloneUrl:X},identity:{userName:J,userEmail:G}},...W?{operator:W}:{}})});if(!K.ok){let H=await GE(K,Co6).catch(()=>K.statusText);throw Error(`Failed to refresh sandbox git credentials (${K.status}): ${H}`)}}var Co6=10485760,Yz;var pD1=D(()=>{IW();tC0();E$0();yH0();t00();X7();Yz=class Yz extends Error{constructor($){super($);this.name="GitPushAuthError"}}});function vo6($){let Z=$.startsWith("thread:")?$.slice(7):$;if(!Z||Z.length>255||Z.includes("..")||Z.startsWith("/")||Z.endsWith("/")||Z.endsWith(".lock")||!_o6.test(Z))throw Error(`Invalid branch name: ${$}`)}function sy($){return AbortSignal.any([$.req.raw.signal,AbortSignal.timeout(bo6)])}async function fo6($,Z){let Q=$.var.studioContext,Y=xU(Z.branch),X=$.req.query("thread")??Y,J=X&&X===Y?Z.branchThread:X?await Q.storage.threads.get(X).catch(()=>null):null,G=J?.virtual_mcp_id===Z.virtualMcpId?J:null,W=Af(G?.metadata?.runtime);if(W)return W;let K=uR0(Z.virtualMcpMetadata),H=K==="cms"?await TD1(Q,{claimName:Z.claimName}):"alive",F=K==="cms"&&H!=="alive"?"cms":"sandbox",U=!!G&&(H==="gone"||H==="alive"&&K==="cms");if(U&&G)z$0(Q,G.id,F);if(K==="cms")console.log("sandbox proxy: no runtime stamp",{route:$.req.path,method:$.req.method,reason:G?"unstamped":"threadless",liveness:H,resolved:F,stamped:U});return F}async function yo6($){let Z=$.get("vmClaim");if(Z.runner)return Z.runner;try{return await uX($.var.studioContext)}catch{return null}}function ay($){let{runner:Z}=$.get("vmClaim");if(!Z)return $.json({error:"No sandbox runner configured"},503);return Z}async function gp($){let{virtualMcpMetadata:Z,connectionIds:Q}=$.get("vmClaim"),Y=$.var.studioContext,X=a60(Z,Q);if(!X)throw new f0({provider:"github",status:404,message:"Project has no repository"});let J=J0(Y);return jm(Y,J.id,X)}function tD1($,Z){let Q=Z instanceof Error?Z.message:String(Z),Y=uD$(Z);if(Y!==void 0)return $.json({error:Q},429,{...G9,...Y===null?{}:{"Retry-After":String(Math.ceil(Y/1000))}});if(Z instanceof s6)return $.json({error:Q},409,G9);let X=CW(Z);if(X!==null){let J=X===404?404:X===409||X===422?409:502;return $.json({error:Q},J,G9)}return $.json({error:Q},502,G9)}async function nD1($,Z,Q){let Y;try{Y=await fetch(Z,Q)}catch{return $.json({error:"Preview unreachable"},502)}let X;try{X=await Y.text()}catch{return $.json({error:"Preview unreachable"},502)}return new Response(X,{status:Y.status,headers:{"content-type":Y.headers.get("content-type")??"application/json"}})}async function $X8($){try{let Z=await gp($),Q=await J_0(Z,$.get("vmClaim").branch);return $.json(Q,200,G9)}catch(Z){return tD1($,Z)}}function e60($,Z){let Y=(K_0.get($)??Promise.resolve()).catch(()=>{}).then(Z),X=Y.catch(()=>{});return K_0.set($,X),X.finally(()=>{if(K_0.get($)===X)K_0.delete($)}),Y}async function OQ($,Z,Q){if(!Q?.runner&&$.get("vmClaim").runtime==="cms")return $.json({error:"sandbox not found: this session is sandbox-less"},404,G9);let Y=Q?.runner??ay($);if(Y instanceof Response)return Y;let{claimName:X,userId:J,projectRef:G}=$.get("vmClaim"),W=Q?.method??"POST",K=null,H=new Headers;if(Q?.jsonBody!==void 0)K=Q.jsonBody,H.set("content-type","application/json");else if(Q?.forwardJsonBody)K=await $.req.text(),H.set("content-type","application/json");let F=Q?.signal,U={method:W,headers:H,body:K,...F?{signal:F}:{}},N=async()=>{let B=await Y.proxyDaemonRequest(X,Z,U);if(Q?.map404to410&&B.status===404){try{await B.body?.cancel()}catch{}if(await Y.adoptLiveClaim({userId:J,projectRef:G},X))B=await Y.proxyDaemonRequest(X,Z,U);if(B.status===404){try{await B.body?.cancel()}catch{}return new Response(JSON.stringify({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."}),{status:410,headers:{"content-type":"application/json",...G9}})}}let O=await B.text(),L=Q?.redactRepoDir?go6(O):O,w=B.headers.get("content-type")??"application/json";return new Response(L,{status:B.status,headers:{"content-type":w,...G9}})};try{if(F){let B=N();return B.catch(()=>{}),await Promise.race([B,new Promise((L,w)=>{if(F.aborted)return w(F.reason);F.addEventListener("abort",()=>w(F.reason),{once:!0})})])}return await N()}catch(B){let O=B instanceof Error?B.message:String(B);return $.json({error:`Daemon unreachable: ${O}`},502)}}function go6($){try{let Z=JSON.parse($);if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&"repoDir"in Z)return JSON.stringify({...Z,repoDir:null})}catch{}return $}async function H_0($,Z,Q,Y="GET",X){let J=await $.proxyDaemonRequest(Z,Q,{method:Y,headers:new Headers,body:null});if(J.status===404&&X){try{await J.body?.cancel()}catch{}if(await $.adoptLiveClaim(X,Z))J=await $.proxyDaemonRequest(Z,Q,{method:Y,headers:new Headers,body:null})}if(J.status===404){try{await J.body?.cancel()}catch{}throw Error("SANDBOX_GONE")}let G=await J.text();if(!J.ok){let W=`Daemon error (${J.status})`;try{W=JSON.parse(G).error??W}catch{}throw Error(W)}return JSON.parse(G)}function ho6($){return ZX8.includes($)}var _o6,sY8=524288,aY8=65536,bo6=1e4,eY8=2000,xo6,K_0,G9,ZX8,QX8=()=>{let $=new $1;$.use("/:virtualMcpId/:branch/*",xo6),$.post("/:virtualMcpId/:branch/write",(Q)=>OQ(Q,"/_sandbox/write",{forwardJsonBody:!0,signal:sy(Q)})),$.post("/:virtualMcpId/:branch/unlink",(Q)=>OQ(Q,"/_sandbox/unlink",{forwardJsonBody:!0,signal:sy(Q)})),$.post("/:virtualMcpId/:branch/mkdir",(Q)=>OQ(Q,"/_sandbox/mkdir",{forwardJsonBody:!0,signal:sy(Q)})),$.post("/:virtualMcpId/:branch/rename",(Q)=>OQ(Q,"/_sandbox/rename",{forwardJsonBody:!0,signal:sy(Q)})),$.post("/:virtualMcpId/:branch/read",(Q)=>OQ(Q,"/_sandbox/read",{forwardJsonBody:!0,signal:sy(Q)})),$.post("/:virtualMcpId/:branch/glob",(Q)=>OQ(Q,"/_sandbox/glob",{forwardJsonBody:!0,signal:sy(Q)})),$.post("/:virtualMcpId/:branch/grep",(Q)=>OQ(Q,"/_sandbox/grep",{forwardJsonBody:!0,signal:sy(Q)})),$.post("/:virtualMcpId/:branch/exec/:script",async(Q)=>{let Y=Q.req.param("script");if(!Y)return Q.json({error:"missing script name"},400);return OQ(Q,`/_sandbox/exec/${encodeURIComponent(Y)}`)}),$.post("/:virtualMcpId/:branch/exec/:script/kill",async(Q)=>{let Y=Q.req.param("script");if(!Y)return Q.json({error:"missing script name"},400);return OQ(Q,`/_sandbox/exec/${encodeURIComponent(Y)}/kill`)}),$.get("/:virtualMcpId/:branch/config",(Q)=>OQ(Q,"/_sandbox/config",{method:"GET",map404to410:!0,redactRepoDir:!0})),$.put("/:virtualMcpId/:branch/config",(Q)=>OQ(Q,"/_sandbox/config",{method:"PUT",forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/setup/:step",async(Q)=>{let Y=Q.req.param("step");if(!Y||!ho6(Y))return Q.json({error:`step must be one of: ${ZX8.join(", ")}`},400);let X=Q.get("vmClaim"),J=await TD1(Q.var.studioContext,{claimName:X.claimName})==="gone"?null:await yo6(Q);if(!J)return Q.json({error:"sandbox not found: nothing is running at this ref"},404,G9);if(Y==="start"){let G=J0(Q.var.studioContext),W=Ld(X.virtualMcpMetadata);try{await fR0({ctx:Q.var.studioContext,runner:J,handle:X.claimName,orgId:G.id,userId:X.callerUserId,entries:W})}catch(K){let H=K instanceof Error?K.message:String(K);return Q.json({error:`Failed to push env to daemon: ${H}`},502)}}return OQ(Q,`/_sandbox/setup/${Y}`,{signal:Q.req.raw.signal,map404to410:!0,runner:J})}),$.get("/:virtualMcpId/:branch/events",(Q)=>{let Y=Q.get("vmClaim");if(!Y.runner)return OO(Q,async(X)=>{await X.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:"No sandbox runner configured on this studio instance."})})});return eQ8(Q,{ctx:Q.var.studioContext,claimName:Y.claimName,runner:Y.runner,virtualMcpId:Y.virtualMcpId,branch:Y.branch,userId:Y.userId,projectRef:Y.projectRef,virtualMcpMetadata:Y.virtualMcpMetadata})}),$.get("/:virtualMcpId/:branch/git/status",(Q)=>{if(Q.get("vmClaim").runtime==="cms")return $X8(Q);return Z(Q)});let Z=(Q)=>OQ(Q,"/_sandbox/git/status",{method:"GET",map404to410:!0,signal:AbortSignal.any([Q.req.raw.signal,AbortSignal.timeout(eY8)])});return $.post("/:virtualMcpId/:branch/git/status",(Q)=>{if(Q.get("vmClaim").runtime==="cms")return $X8(Q);return OQ(Q,"/_sandbox/git/status",{map404to410:!0,signal:AbortSignal.any([Q.req.raw.signal,AbortSignal.timeout(eY8)])})}),$.post("/:virtualMcpId/:branch/git/diff",async(Q)=>{let Y=Q.get("vmClaim");if(Y.runtime==="cms")try{let X=await Q.req.json().catch(()=>({})),J=await gp(Q),G=await G_0(J,Y.branch,X.base);return Q.json(G,200,G9)}catch(X){return tD1(Q,X)}return OQ(Q,"/_sandbox/git/diff",{forwardJsonBody:!0,map404to410:!0})}),$.post("/:virtualMcpId/:branch/git/publish",async(Q)=>{if(Q.get("vmClaim").runtime==="cms")return Q.json({ok:!0},200,G9);let Y=ay(Q);if(Y instanceof Response)return Y;let{claimName:X,virtualMcpMetadata:J,connectionIds:G}=Q.get("vmClaim"),W=Q.var.studioContext;return e60(X,async()=>{try{await RD1(W,Y,X);let K=a60(J,G);if(K)await rY8(W,Y,X,K)}catch(K){if(K instanceof Yz)return Q.json({error:K.message},403,G9);let H=K instanceof Error?K.message:String(K);return Q.json({error:H},502,G9)}return OQ(Q,"/_sandbox/git/publish",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/discard",async(Q)=>{let Y=Q.get("vmClaim");if(Y.runtime==="cms")return e60(Y.claimName,async()=>{let X=await Q.req.json().catch(()=>({})),J=Array.isArray(X.filepaths)?X.filepaths.filter((G)=>typeof G==="string"):[];if(J.length===0)return Q.json({error:"filepaths is required"},400,G9);try{let G=await gp(Q);return await pY8(G,Y.branch,J),Q.json({ok:!0},200,G9)}catch(G){let W=CW(G)===409||G instanceof s6?409:502,K=G instanceof Error?G.message:String(G);return Q.json({error:K},W,G9)}});return e60(Y.claimName,()=>OQ(Q,"/_sandbox/git/discard",{forwardJsonBody:!0,map404to410:!0}))}),$.post("/:virtualMcpId/:branch/git/rebase",async(Q)=>{let Y=Q.get("vmClaim");if(Y.runtime==="cms")return e60(Y.claimName,async()=>{try{let W=await Q.req.json().catch(()=>({})),K=await gp(Q),H=W.base??await K.getDefaultBranch();return await W_0(K,Y.branch,H),Q.json({ok:!0},200,G9)}catch(W){return tD1(Q,W)}});let X=ay(Q);if(X instanceof Response)return X;let{claimName:J}=Q.get("vmClaim"),G=Q.var.studioContext;return e60(J,async()=>{try{await RD1(G,X,J)}catch(W){let K=W instanceof Error?W.message:String(W);return Q.json({error:K},502,G9)}return OQ(Q,"/_sandbox/git/rebase",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/suggest-commit",x5({maxSize:sY8,onError:(Q)=>Q.json({error:"Payload too large"},413,G9)}),async(Q)=>{let Y=Q.get("vmClaim"),X=null;if(Y.runtime!=="cms"){let H=ay(Q);if(H instanceof Response)return H;X=H}let{claimName:J,userId:G,projectRef:W}=Y,K=Q.var.studioContext;try{let H=await Q.req.json().catch(()=>({})),F=H.status,U=H.diff,N=U!=null&&typeof U.diffs==="object"&&U.diffs!==null,[B,O]=ID1(F)&&N?[F,U]:X?await Promise.all([H_0(X,J,"/_sandbox/git/status","GET",{userId:G,projectRef:W}),H_0(X,J,"/_sandbox/git/diff","GET",{userId:G,projectRef:W})]):await(async()=>{let w=await gp(Q);return Promise.all([J_0(w,Y.branch),G_0(w,Y.branch)])})();await rG(K,J0(K).id,"suggesting a commit message");let L=await XY8(K,B,O);return Q.json(L,200,G9)}catch(H){let F=H instanceof Error?H.message:String(H);if(F==="SANDBOX_GONE")return Q.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,G9);return Q.json({error:F},502,G9)}}),$.post("/:virtualMcpId/:branch/git/judge-review",x5({maxSize:sY8,onError:(Q)=>Q.json({error:"Payload too large"},413,G9)}),async(Q)=>{let Y=Q.get("vmClaim"),X=null;if(Y.runtime!=="cms"){let H=ay(Q);if(H instanceof Response)return H;X=H}let{claimName:J,userId:G,projectRef:W}=Y,K=Q.var.studioContext;try{let H=await Q.req.json().catch(()=>({})),F=H.status,U=H.diff,N=U!=null&&typeof U.diffs==="object"&&U.diffs!==null,[B,O]=ID1(F)&&N?[F,U]:X?await Promise.all([H_0(X,J,"/_sandbox/git/status","GET",{userId:G,projectRef:W}),H_0(X,J,"/_sandbox/git/diff","GET",{userId:G,projectRef:W})]):await(async()=>{let w=await gp(Q);return Promise.all([J_0(w,Y.branch),G_0(w,Y.branch)])})();await rG(K,J0(K).id,"judging whether a change needs review");let L=await GY8(K,B,O,typeof H.language==="string"?H.language:void 0);return Q.json(L,200,G9)}catch(H){let F=H instanceof Error?H.message:String(H);if(F==="SANDBOX_GONE")return Q.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,G9);return Q.json({error:F},502,G9)}}),$.get("/:virtualMcpId/:branch/preview-fetch",async(Q)=>{let Y=ay(Q);if(Y instanceof Response)return Y;let{claimName:X}=Q.get("vmClaim"),J=Q.req.query("path");if(!J||!J.startsWith("/")||J.startsWith("//")||J.includes("..")||J.includes("\\"))return Q.json({error:"Path not allowed"},403);let G;try{G=await Y.getPreviewUrl(X)}catch{return Q.json({error:"Preview not available"},502)}if(!G)return Q.json({error:"Preview not available"},502);let W=G.replace(/\/+$/,"");return nD1(Q,`${W}${J}`)}),$.post("/:virtualMcpId/:branch/preview-invoke",x5({maxSize:aY8,onError:(Q)=>Q.json({error:"Payload too large"},413)}),async(Q)=>{let Y=ay(Q);if(Y instanceof Response)return Y;let{claimName:X}=Q.get("vmClaim"),J;try{J=await Y.getPreviewUrl(X)}catch{return Q.json({error:"Preview not available"},502)}if(!J)return Q.json({error:"Preview not available"},502);let G;try{G=await Q.req.json()}catch{return Q.json({error:"Invalid JSON body"},400)}if(!G||typeof G!=="object"||Array.isArray(G))return Q.json({error:"Invalid JSON body"},400);let W=dD1(G);if(!W)return Q.json({error:"Invalid or missing __resolveType"},400);let K=iD1(J,W.resolveType);return nD1(Q,K,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(W.payload),signal:AbortSignal.timeout(30000)})}),$.post("/:virtualMcpId/:branch/catalog-invoke",x5({maxSize:aY8,onError:(Q)=>Q.json({error:"Payload too large"},413)}),async(Q)=>{let{runner:Y,claimName:X,virtualMcpMetadata:J}=Q.get("vmClaim"),G;try{G=Y?await Y.getPreviewUrl(X):wd(J)}catch{return Q.json({error:"Preview not available"},502)}if(!G)return Q.json({error:"Preview not available"},502);let W;try{W=await Q.req.json()}catch{return Q.json({error:"Invalid JSON body"},400)}if(!W||typeof W!=="object"||Array.isArray(W))return Q.json({error:"Invalid JSON body"},400);let K=dD1(W);if(!K)return Q.json({error:"Invalid or missing __resolveType"},400);if(!nY8(K.resolveType))return Q.json({error:"resolveType not allowed"},403);let H=iD1(G,K.resolveType);return nD1(Q,H,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(K.payload),signal:AbortSignal.timeout(30000)})}),$};var YX8=D(()=>{J8();QK();_p();AD1();Od();rQ8();hW();jd();sQ8();yW();WH();aQ8();$Y8();M71();j$0();SD1();WY8();X7();R5();mD1();tY8();hR0();pD1();_o6=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;xo6=nC0(async($,Z)=>{let Q=$.var.studioContext;try{n(Q)}catch{return $.json({error:"Unauthorized"},401)}let Y=d0(Q);if(!Y)return $.json({error:"Unauthorized"},401);let X;try{X=J0(Q)}catch{return $.json({error:"Organization scope required"},403)}let J=$.req.param("virtualMcpId"),G=$.req.param("branch");if(!J||!G)return $.json({error:"virtualMcpId and branch are required"},400);try{vo6(G)}catch(L){let w=L instanceof Error?L.message:String(L);return $.json({error:w},400)}let W=await Q.storage.virtualMcps.findById(J);if(!W||W.organization_id!==X.id)return $.json({error:"Virtual MCP not found"},404);let K=T10({orgId:X.id,virtualMcpId:J,branch:G}),H=await o91(Q,G),F=r91(H,Y),U=oQ8({userId:F,projectRef:K}),N=W.metadata??null,B=await fo6($,{claimName:U,branch:G,virtualMcpId:J,sandboxUserId:F,virtualMcpMetadata:N,branchThread:H});if(B==="cms")return $.set("vmClaim",{claimName:U,callerUserId:Y,runner:null,virtualMcpId:J,branch:G,userId:F,projectRef:K,virtualMcpMetadata:N,connectionIds:W.connections?.map((L)=>L.connection_id)??[],runtime:B}),Z();let O;try{O=await uX(Q)}catch{O=null}if(!O)return $.json({error:"No sandbox runner found"},404);return $.set("vmClaim",{claimName:U,callerUserId:Y,runner:O,virtualMcpId:J,branch:G,userId:F,projectRef:K,virtualMcpMetadata:N,connectionIds:W.connections?.map((L)=>L.connection_id)??[],runtime:B}),Z()});K_0=new Map;G9={"Cache-Control":"no-store, no-cache, must-revalidate",Pragma:"no-cache"};ZX8=["clone","install","start"]});function XX8($,Z,Q){let Y=oD1.get($);if(!Y)Y={pending:null,running:!1},oD1.set($,Y);if(!Y.pending)Y.pending={set:new Map,del:new Set,deps:Z,resolvers:[],rejecters:[]};let X=Y.pending;X.deps=Z;for(let[G,W]of Object.entries(Q.set??{}))X.set.set(G,W),X.del.delete(G);for(let G of Q.delete??[])X.del.add(G),X.set.delete(G);let J=new Promise((G,W)=>{X.resolvers.push(G),X.rejecters.push(W)});if(!Y.running)lo6($,Y);return J}async function lo6($,Z){Z.running=!0;try{while(Z.pending){let Q=Z.pending;Z.pending=null;try{let Y=await co6(Q);for(let X of Q.resolvers)X(Y)}catch(Y){for(let X of Q.rejecters)X(Y)}}}finally{if(Z.running=!1,!Z.pending)oD1.delete($)}}async function co6($){let{client:Z,branch:Q,packagePath:Y}=$.deps,X=new Map;for(let J=0;;J++){let G=await yp(Z,Q),W=await Z.listDecofileEntries(G,Y),K=uD1(W,Y),H=[],F=new Map(K.map((N)=>[N.path,{stem:N.stem,sha:N.sha}]));for(let[N,B]of $.set){let O=lD1(K,N),L=`${JSON.stringify(B,null,2)}
 `;await lY8(Z.repo,L);let w=O[0]??`${Q_0(Y)}/${vD1(N)}.json`;H.push({path:w,content:L});let j=w.slice(w.lastIndexOf("/")+1,-5);F.set(w,{stem:j,content:L});for(let E of O.slice(1))H.push({path:E,deleted:!0}),F.delete(E)}for(let N of $.del)for(let B of lD1(K,N))H.push({path:B,deleted:!0}),F.delete(B);if(H.length===0)return G;let U=Y?`${Y}/.deco/blocks.gen.json`:".deco/blocks.gen.json";if(W.some((N)=>N.type==="blob"&&N.path===U)){let N=await cY8(Z,F.values(),X),{decofile:B,skipped:O}=i60(N);if(O.length>0)console.warn("decofile gen: dropped blocks that were not valid JSON",{repo:KH(Z.repo),branch:Q,packagePath:Y,blocks:O.map((L)=>L.key)});H.push({path:U,content:B})}try{let{sha:N}=await Z.commitFiles({branch:Q,message:mo6($),expectedHead:G,changes:H});return N}catch(N){if(!(N instanceof s6)||J>=uo6-1)throw N;await L$(D7(2000,200,J,2,0.5))}}}function mo6($){let Z=(X)=>{let J=X.slice(0,3).join(", ");return X.length>3?`${J} (+${X.length-3} more)`:J},Q=[];if($.set.size>0)Q.push(`update ${Z([...$.set.keys()])}`);if($.del.size>0)Q.push(`delete ${Z([...$.del])}`);let Y=`chore(decofile): ${Q.join("; ")}`;return V51(Y,$.deps.coAuthor)}var uo6=3,oD1;var JX8=D(()=>{XT0();rC0();i4();a$();X7();Y_0();oD1=new Map});import{createHmac as GX8,randomBytes as do6,timingSafeEqual as io6}from"crypto";function WX8(){if(F_0)return F_0;let $;try{let Z=j0();$=Z.studioJwtSecret??Z.betterAuthSecret}catch{$=void 0}return F_0=$?Buffer.from($):do6(32),F_0}function rD1($){let Z=$.nowMs??Date.now(),Q={o:$.organizationId,m:$.virtualMcpId,b:$.branch,e:Math.floor((Z+po6)/1000)},Y=Buffer.from(JSON.stringify(Q)).toString("base64url"),X=GX8("sha256",WX8()).update(Y).digest("base64url");return`${Y}.${X}`}function KX8($,Z){let Q=$.indexOf(".");if(Q<0)return!1;let Y=$.slice(0,Q),X=Buffer.from($.slice(Q+1)),J=Buffer.from(GX8("sha256",WX8()).update(Y).digest("base64url"));if(X.length!==J.length||!io6(X,J))return!1;let G;try{G=JSON.parse(Buffer.from(Y,"base64url").toString())}catch{return!1}let W=Math.floor((Z.nowMs??Date.now())/1000);return G.o===Z.organizationId&&G.m===Z.virtualMcpId&&G.b===Z.branch&&typeof G.e==="number"&&G.e>=W}var po6=21600000,F_0=null;var HX8=D(()=>{$$()});function U_0($){return $&&typeof $==="object"&&!Array.isArray($)?$:null}function no6($){for(let[Z,Q]of Object.entries($)){if(!Z.startsWith("collections/blog/posts/"))continue;let Y=U_0(Q)?.__resolveType;if(typeof Y==="string"&&Y)return Y}return"blog/loaders/Blogpost.ts"}function FX8($){let Z;try{Z=U_0(JSON.parse($))}catch{return $}if(!Z)return $;let Q=no6(Z),Y={...Z},X=0;for(let[J,G]of Object.entries(Z)){if(!J.startsWith("blog-manager/posts/"))continue;let W=U_0(G),K=W&&U_0(W.post);if(!K)continue;if(K.status==="archived")continue;if(typeof K.slug!=="string"||!K.slug)continue;let F=`collections/blog/posts/${J.slice(19)}`;if(Object.hasOwn(Y,F))continue;Y[F]={name:F,__resolveType:Q,["post"]:{...K,status:"published"}},X++}return X>0?JSON.stringify(Y):$}import{z as hp}from"zod";function oo6($){return $.length>0&&$.length<=255&&!$.includes("..")&&!$.endsWith("/")&&!$.endsWith(".lock")&&to6.test($)}function OX8($){return $.req.header("x-forwarded-host")??new URL($.req.url).host}async function $50($){let Z=$.get("decofileScope");return jm($.var.studioContext,Z.organizationId,Z.repository)}function Z50($,Z){let Q=Z instanceof Error?Z.message:String(Z);if(Z instanceof s6)return $.json({error:Q},409);let Y=CW(Z);if(Y!==null){let X=Y===404?404:Y===409||Y===422?409:502;return $.json({error:Q},X)}return $.json({error:Q},500)}function LX8(){let $=new $1;return $.use("/:virtualMcpId/:branch",DX8),$.use("/:virtualMcpId/:branch/*",DX8),$.get("/:virtualMcpId/:branch",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await $50(Z),X=await mY8(Y,Q.branch,Q.packagePath,{createBranchIfMissing:!!Q.userId}),J={ETag:`"${X.sha}"`,"Cache-Control":"no-store","Access-Control-Allow-Origin":"*"};if(Z.req.header("if-none-match")===`"${X.sha}"`)return Z.body(null,304,J);if(!Q.userId)return Z.body(FX8(X.decofile),200,{...J,"content-type":"application/json"});let G=rD1({organizationId:Q.organizationId,virtualMcpId:Q.virtualMcpId,branch:Q.branch});return Z.body(`{"version":${JSON.stringify(X.sha)},"token":${JSON.stringify(G)},"apiHost":${JSON.stringify(OX8(Z))},"decofile":${X.decofile}}`,200,{...J,"content-type":"application/json"})}catch(Y){return Z50(Z,Y)}}),$.get("/:virtualMcpId/:branch/meta",async(Z)=>{let Q=Z.get("decofileScope"),Y=Q.packagePath?`${Q.packagePath}/.deco/meta.gen.json`:".deco/meta.gen.json";try{let X=await $50(Z),J=await X.readFileAtRef(Q.branch,Y);if(J===null){let G=await X.getDefaultBranch();if(G!==Q.branch)J=await X.readFileAtRef(G,Y)}if(J===null)return Z.json({error:"meta.gen.json not committed"},404);return Z.body(J,200,{"content-type":"application/json","Cache-Control":"no-store","Access-Control-Allow-Origin":"*"})}catch(X){return Z50(Z,X)}}),$.patch("/:virtualMcpId/:branch",so6,async(Z)=>{let Q=Z.get("decofileScope"),Y=Z.var.studioContext,X=ao6.safeParse(await Z.req.json().catch(()=>null));if(!X.success)return Z.json({error:"Invalid body",details:X.error.issues},400);let J;try{J=p60(X.data)}catch(G){if(G instanceof n60)return Z.json({error:G.message},400);throw G}for(let G of[...Object.keys(J.set??{}),...J.delete??[]])try{oC0(G)}catch(W){let K=W instanceof Error?W.message:String(W);return Z.json({error:K},400)}for(let[G,W]of Object.entries(J.set??{})){if(typeof W!=="object"||W===null||Array.isArray(W))return Z.json({error:`Block "${G}" must be a JSON object`},400);if(_D1(G))return Z.json({error:`Block key "${G}" collides with a framework resolver module and cannot be written`},400)}try{let G=await $50(Z),W=await XX8(`${Q.organizationId}/${Q.virtualMcpId}/${Q.branch}`,{client:G,branch:Q.branch,packagePath:Q.packagePath,coAuthor:vp(Y)},J),K=rD1({organizationId:Q.organizationId,virtualMcpId:Q.virtualMcpId,branch:Q.branch});return Z.json({version:W,token:K,apiHost:OX8(Z)})}catch(G){return Z50(Z,G)}}),$.post("/:virtualMcpId/:branch/publish",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await $50(Z),X=await Y.getDefaultBranch();if(X===Q.branch)return Z.json({error:"Branch is already the default branch"},400);let J=`chore(decofile): publish ${Q.branch}`;try{let G;try{G=await Y.mergeBranches(X,Q.branch,J)}catch(W){if(CW(W)!==409)throw W;await W_0(Y,Q.branch,X),G=await Y.mergeBranches(X,Q.branch,J)}return G?Z.json({result:"merged",sha:G}):Z.json({result:"up-to-date"})}catch(G){if(CW(G)===409)return Z.json({error:"merge-conflict"},409);if(CW(G)===405){let K=await Y.findOpenChangeRequest(X,Q.branch)??await Y.createChangeRequest({base:X,head:Q.branch,title:`Publish ${Q.branch}`});return Z.json({result:"pull-request",number:K.number,url:K.url})}throw G}}catch(Y){return Z50(Z,Y)}}),$.get("/:virtualMcpId/:branch/status",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await $50(Z),X=await Y.getDefaultBranch();if(X===Q.branch)return Z.json({baseBranch:X,aheadBy:0,behindBy:0});try{let{aheadBy:J,behindBy:G}=await Y.compare(X,Q.branch);return Z.json({baseBranch:X,aheadBy:J,behindBy:G})}catch(J){if(CW(J)===404)return Z.json({baseBranch:X,aheadBy:0,behindBy:0});throw J}}catch(Y){return Z50(Z,Y)}}),$}var to6,UX8=500,NX8=1048576,BX8=1024,ro6=8388608,so6,ao6,DX8;var wX8=D(()=>{hR0();rC0();J8();QK();AD1();tC0();pD1();X7();JX8();HX8();mD1();Y_0();WH();to6=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;so6=x5({maxSize:ro6,onError:($)=>$.json({error:"Payload too large"},413)}),ao6=hp.object({set:hp.record(hp.string(),hp.unknown()).optional(),delete:hp.array(hp.string()).optional()}).refine(($)=>Object.keys($.set??{}).length>0||($.delete?.length??0)>0,{message:"Patch must set or delete at least one block"}).refine(($)=>Object.keys($.set??{}).length+($.delete?.length??0)<=UX8,{message:`Patch cannot touch more than ${UX8} blocks`}).refine(($)=>Object.values($.set??{}).every((Z)=>JSON.stringify(Z).length<=NX8),{message:`Each block must be at most ${NX8} bytes`}).refine(($)=>[...Object.keys($.set??{}),...$.delete??[]].every((Z)=>Z.length<=BX8),{message:`Each block key must be at most ${BX8} characters`}),DX8=nC0(async($,Z)=>{let Q=$.var.studioContext,Y=Q.organization;if(!Y)return $.json({error:"Organization scope required"},500);let X=$.req.param("virtualMcpId"),J=$.req.param("branch");if(!X||!J)return $.json({error:"virtualMcpId and branch are required"},400);if(!oo6(J))return $.json({error:`Invalid branch name: ${J}`},400);let G=Q.auth?.user?.id??null;if(!G){let B=$.req.query("token");if(!($.req.method==="GET"&&!$.req.path.match(/\/(publish|status)$/)))return $.json({error:"Unauthorized"},401);if(!B||!KX8(B,{organizationId:Y.id,virtualMcpId:X,branch:J}))return $.json({error:"Unauthorized"},401)}if(!await kJ(Q,Y.id,"cms"))return $.json({error:"This organization's plan does not include the CMS",code:"feature_not_in_plan"},403);let W=await Q.storage.virtualMcps.findById(X);if(!W||W.organization_id!==Y.id)return $.json({error:"Virtual MCP not found"},404);let K=W.metadata??null;if(!wd(K))return $.json({error:"Project has no preview server configured"},404);let F=W.connections?.map((B)=>B.connection_id)??[],U=a60(K,F);if(!U)return $.json({error:"Project has no repository"},404);let N=K?.runtime;return $.set("decofileScope",{organizationId:Y.id,virtualMcpId:X,branch:J,packagePath:N?.path?.replace(/^\/+|\/+$/g,"")||null,repository:U,userId:G}),Z()})});var jX8=($)=>{let Z=new $1;if(Z.use("*",Fp),Z.use("*",u58),Z.route("/",g58($.voiceSessions)),Z.route("/",QC0()),Z.route("/",A98()),Z.route("/",K98()),Z.route("/",bQ8()),Z.route("/",fQ8()),Z.route("/",MQ8()),Z.route("/",_Q8()),Z.route("/",VQ8()),Z.route("/",dC0()),Z.route("/tools",mQ8()),Z.route("/",uQ8()),Z.route("/",ZQ8({kvStorage:$.kvStorage})),Z.route("/",e78()),Z.route("/fs",wQ8({getConnection:$.getNatsConnection})),Z.route("/sandbox",QX8()),Z.route("/decofile",LX8()),Z.route("/",TQ8()),Z.route("/",EQ8()),Z.route("/deco-sites",XC0()),Z.route("/hosting",s58()),Z.route("/monitor",X98()),Z.route("/sso",sS0()),Z.route("/",iC0({tokenStorage:$.tokenStorage,automationEventDispatcher:$.automationEventDispatcher})),Z.route("/webhooks",p58()),$.mountDevAssets)Z.route("/dev-assets",KC0({orgFromPath:!0}));return Z.use("/mcp/:connectionId?",$.mcpAuth),Z.use("/mcp/:connectionId/ui-resource",$.mcpAuth),Z.use("/mcp/gateway/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/virtual-mcp/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/self",$.mcpAuth),Z.use("/mcp/task-run/:threadId",$.mcpAuth),Z.route("/",b88()),Z.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",$.betterAuthProtectedResourceHandler),Z.get("/mcp/.well-known/oauth-protected-resource",$.betterAuthProtectedResourceHandler),Z.route("/mcp/task-run",PQ8()),Z.route("/mcp",rM0()),Z.route("/mcp/self",uC0()),Z.route("/mcp",eM0()),Z.all("/oauth-proxy/:connectionId/*",$.oauthProxyHandler),Z.get("/watch",$.watchHandler),Z};var EX8=D(()=>{J8();h58();l58();uS0();n58();mN1();a58();J98();HC0();sE();gN1();tN1();$Q8();QQ8();jQ8();zQ8();v80();SN1();$I0();BD1();AQ8();RQ8();IQ8();kQ8();LD1();xQ8();yQ8();lQ8();wD1();dQ8();jD1();sM0();YX8();wX8()});import{z as ey}from"zod";class sD1{adapter;getConnection;kvPromise;constructor($,Z){this.adapter=$;this.getConnection=Z}kv(){let $=this.getConnection();if(!$||$.isClosed())throw new q1(503,{message:"Voice transport is unavailable"});return this.kvPromise??=new AX8.Kvm(N_0.jetstream($)).create("STUDIO_VOICE_SESSIONS",{storage:N_0.StorageType.Memory,ttl:TX8.nanos(kD),max_bytes:10485760}).catch((Z)=>{throw this.kvPromise=void 0,Z}),this.kvPromise}async conversationAgent($){let Z=await this.kv(),Q=`agent.${$.conversationKey}`,Y=Date.now()+45000;while(Date.now()<Y){let X=await Z.get(Q),J=X?.operation==="PUT"?PX8.parse(X.json()):null;if(J?.state==="ready")return J.agentId;if(J?.state==="creating"&&J.expiresAt>Date.now()){await L$(200);continue}let G=zX8.encode(JSON.stringify({state:"creating",expiresAt:Date.now()+40000})),W;try{W=X&&J?await Z.update(Q,G,X.revision):await Z.create(Q,G)}catch{await L$(200);continue}try{let K=await $.ensureConversationAgent();return await Z.update(Q,zX8.encode(JSON.stringify({state:"ready",agentId:K})),W),K}catch(K){throw await Z.delete(Q,{previousSeq:W}).catch(()=>{}),K}}throw new q1(503,{message:"Voice conversation is starting; try again"})}async createSession($){let Z=this.adapter.forConversationModel($.model),Q=await this.conversationAgent(Z);try{return{provider:"elevenlabs",conversationToken:await Z.createConversationToken(Q)}}catch(Y){let X=await this.kv(),J=`agent.${Z.conversationKey}`,G=await X.get(J),W=G?.operation==="PUT"?PX8.parse(G.json()):null;if(G&&W?.state==="ready"&&W.agentId===Q)await X.delete(J,{previousSeq:G.revision}).catch(()=>{});throw Y}}}var N_0,AX8,TX8,zX8,PX8;var RX8=D(()=>{wJ();yU();a$();N_0=C(LK(),1),AX8=C(YA(),1),TX8=C(Tz(),1),zX8=new TextEncoder,PX8=ey.discriminatedUnion("state",[ey.object({state:ey.literal("ready"),agentId:ey.string()}),ey.object({state:ey.literal("creating"),expiresAt:ey.number()})])});import{z as up}from"zod";function eo6($){return{model:$.model,instructions:`${wq$}
-Start in ${$.language==="pt"?"Brazilian Portuguese":"English"}, and follow the user's language.`,delegation:{type:"client"},audio:{output:{voice:$.voice}},store:!1}}class aD1{config;constructor($){this.config=$}async createSession(){return{provider:"openai",transport:"webrtc"}}async negotiate($){let Z=await fetch("https://api.openai.com/v1/live/sessions",{method:"POST",headers:{Authorization:`Bearer ${this.config.apiKey}`,"Content-Type":"application/json","OpenAI-Safety-Identifier":$.safetyIdentifier},body:JSON.stringify({session:eo6({...this.config,language:$.language,model:$.model}),transport:{type:"webrtc",sdp:$.sdp}}),signal:AbortSignal.timeout(15000)});if(!Z.ok)throw await Z.body?.cancel(),Error(`OpenAI Live request failed (${Z.status})`);return{sdp:up.object({session:up.object({id:up.string().min(1)}),transport:up.object({type:up.literal("webrtc"),sdp:up.string().min(1).max(1e5)})}).parse(await Z.json()).transport.sdp}}}var qX8=D(()=>{yU()});var MX8;var IX8=D(()=>{MX8=[{name:"delegate_to_agent",description:"Submit a complete request to the selected Studio agent. Returns after acceptance while work continues in the background. Results arrive later.",parameters:{type:"object",properties:{request:{type:"string",description:"The complete user request, with relevant conversational details. Preserve intent and constraints."}},required:["request"]}},{name:"get_agent_status",description:"Read the current chat's work status and known results. This does not track independent organization tasks; delegate fresh task-status queries to the Studio agent. Use when asked, never poll.",parameters:{type:"object",properties:{}}},{name:"stop_agent_work",description:"Request cancellation in the current chat ONLY when the user explicitly asks. Speaking over the companion is not cancellation. To stop independent tasks, delegate that request to the Studio agent.",parameters:{type:"object",properties:{}}}]});function eD1($){return{conversation_config:{agent:{first_message:"",language:"en",prompt:{prompt:Oq$,llm:$.conversationModel,thinking_budget:0,max_tokens:512,tools:MX8.map((Z)=>({...Z,type:"client",expects_response:!0,response_timeout_secs:Z.name==="delegate_to_agent"?20:5,...Z.name==="delegate_to_agent"?{execution_mode:"async",interruption_mode:"allow",pre_tool_speech:"off"}:{}}))}},asr:{provider:"scribe_realtime",quality:"high"},turn:{turn_eagerness:"normal",turn_timeout:-1,silence_end_call_timeout:-1},tts:{voice_id:$.voiceId,model_id:$.model},conversation:{max_duration_seconds:kD/1000,client_events:["audio","interruption","user_transcript","agent_response","client_tool_call","vad_score"]}},platform_settings:{auth:{enable_auth:!0},privacy:{record_voice:!1,retention_days:1,delete_audio:!0,delete_transcript_and_pii:!0},overrides:{conversation_config_override:{agent:{language:!0}}}}}}var VX8=D(()=>{yU();IX8()});import{z as oX}from"zod";import{createHash as $r6,createHmac as Zr6}from"crypto";class B_0{config;conversationKey;configurationKey;constructor($){this.config=$;this.configurationKey=$r6("sha256").update(JSON.stringify(eD1($))).digest("hex"),this.conversationKey=Zr6("sha256",$.apiKey).update(this.configurationKey).digest("hex")}forConversationModel($){return $===this.config.conversationModel?this:new B_0({...this.config,conversationModel:$})}async request($,Z,Q){let Y=await fetch(`https://api.elevenlabs.io/v1${$}`,{method:Z===void 0?"GET":"POST",headers:{"xi-api-key":this.config.apiKey,"Content-Type":"application/json"},body:JSON.stringify(Z),signal:Q});if(!Y.ok)throw await Y.body?.cancel(),Error(`ElevenLabs request failed (${Y.status})`);return Y}async ensureConversationAgent(){let $=`Studio voice ${this.configurationKey.slice(0,24)}`,Z=await this.request(`/convai/agents?search=${encodeURIComponent($)}&page_size=100`,void 0,AbortSignal.timeout(15000)),{agents:Q}=oX.object({agents:oX.array(oX.object({agent_id:oX.string(),name:oX.string()}))}).parse(await Z.json()),Y=Q.find((J)=>J.name===$);if(Y){let J=await this.request(`/convai/agents/${encodeURIComponent(Y.agent_id)}`,void 0,AbortSignal.timeout(15000));return oX.object({platform_settings:oX.object({auth:oX.object({enable_auth:oX.literal(!0)})})}).parse(await J.json()),Y.agent_id}let X=await this.request("/convai/agents/create",{name:$,...eD1(this.config)},AbortSignal.timeout(15000));return oX.object({agent_id:oX.string().min(1)}).parse(await X.json()).agent_id}async createConversationToken($){let Z=await this.request(`/convai/conversation/token?agent_id=${encodeURIComponent($)}`,void 0,AbortSignal.timeout(15000));return oX.object({token:oX.string().min(1)}).parse(await Z.json()).token}async createTranscriptionToken(){let $=await this.request("/single-use-token/realtime_scribe",{},AbortSignal.timeout(15000));return oX.object({token:oX.string().min(1)}).parse(await $.json()).token}synthesize($,Z){return this.request(`/text-to-speech/${encodeURIComponent(this.config.voiceId)}/stream?output_format=mp3_44100_128`,{text:$,model_id:this.config.model},AbortSignal.any([Z,AbortSignal.timeout(60000)]))}}var kX8=D(()=>{VX8()});import{createHmac as Qr6,timingSafeEqual as Yr6}from"crypto";import{z as lp}from"zod";function CX8($,Z){if(!Z)throw Error("Voice requires a shared authentication secret");return Qr6("sha256",Z).update(`studio-voice-session:v1:${$}`).digest("base64url")}function _X8($,Z){let Q=Buffer.from(JSON.stringify(SX8.parse($))).toString("base64url");return`${Q}.${CX8(Q,Z)}`}function vX8($,Z,Q=Date.now()){if(!Z||$.length>4096)return null;let Y=$.split(".");if(Y.length!==2)return null;let[X,J]=Y;if(!X||!J)return null;let G=Buffer.from(CX8(X,Z)),W=Buffer.from(J);if(W.length!==G.length||!Yr6(W,G))return null;try{let K=SX8.safeParse(JSON.parse(Buffer.from(X,"base64url").toString()));if(!K.success||K.data.expiresAt<=Q||K.data.expiresAt>Q+kD)return null;return K.data}catch{return null}}var SX8;var bX8=D(()=>{yU();SX8=lp.object({sessionId:lp.string().uuid(),organizationId:lp.string().min(1).max(256),userId:lp.string().min(1).max(256),threadId:lp.string().min(1).max(256),expiresAt:lp.number().int().positive()})});import{z as $O1}from"zod";function xX8($,Z){if(Z?.voice_model!=null&&Z.voice_provider==null)throw Error("A voice model override requires a provider");let Q=Z?.voice_provider??$.voiceConversationProvider;return ZO1.parse({provider:Q,model:Z?.voice_model??(Q==="openai"?$.openaiLiveModel:$.elevenlabsConversationModel)})}var ZO1;var fX8=D(()=>{ZO1=$O1.object({provider:$O1.enum(["elevenlabs","openai"]),model:$O1.string().trim().min(1).max(128)})});import{createHash as Xr6}from"crypto";import{z as cp}from"zod";function mp($){return`user.${Xr6("sha256").update(JSON.stringify([$.organizationId,$.userId])).digest("hex")}`}class YO1{deps;kvPromise;constructor($){this.deps=$}kv(){let $=this.deps.getConnection();if(!$||$.isClosed())throw new q1(503,{message:"Voice transport is unavailable"});return this.kvPromise??=new yX8.Kvm(O_0.jetstream($)).create("STUDIO_VOICE_SESSIONS",{storage:O_0.StorageType.Memory,ttl:gX8.nanos(kD),max_bytes:10485760}).catch((Z)=>{throw this.kvPromise=void 0,Z}),this.kvPromise}adapter(){if(!this.deps.adapter)throw new q1(503,{message:"Voice is not configured on this deployment"});return this.deps.adapter}async create($,Z=!1,Q="en",Y){let X;if(Z)try{X=xX8(this.deps.defaults,Y)}catch{throw new q1(503,{message:"Voice configuration is invalid"})}let J=X?this.deps.conversationAdapters[X.provider]:this.adapter();if(!J)throw new q1(503,{message:"Voice is not configured on this deployment"});let G={...$,sessionId:crypto.randomUUID(),expiresAt:Date.now()+kD},W=_X8(G,this.deps.secret),K=await this.kv(),H=mp(G),F=await K.get(H),U=F?.operation==="PUT"?D_0.parse(F.json()):null,N=QO1.encode(JSON.stringify({sessionId:G.sessionId,expiresAt:G.expiresAt,conversation:X,characters:0,requests:0}));try{if(F&&U&&U.expiresAt<=Date.now())await K.update(H,N,F.revision);else await K.create(H,N)}catch{throw new q1(409,{message:"Close your other voice session before starting a new one"})}try{if(X&&"createSession"in J){let O=await J.createSession({language:Q,model:X.model,safetyIdentifier:mp($)});return{token:W,...O,expiresAt:G.expiresAt}}let B=await this.adapter().createTranscriptionToken();return{token:W,transcriptionToken:B,expiresAt:G.expiresAt}}catch(B){throw await this.release(G),B}}authorize($,Z){let Q=vX8(Z,this.deps.secret);if(!Q||Q.organizationId!==$.organizationId||Q.userId!==$.userId||Q.threadId!==$.threadId)throw new q1(403,{message:"Invalid voice session"});return Q}async connect($,Z){let Q=this.authorize($,Z.token),Y=await this.kv(),X=mp(Q),J=await Y.get(X),G=J?.operation==="PUT"?D_0.parse(J.json()):null;if(!J||!G||G.sessionId!==Q.sessionId||G.expiresAt<=Date.now())throw new q1(403,{message:"Voice session expired"});let W=G.conversation?this.deps.conversationAdapters[G.conversation.provider]:null;if(!W?.negotiate||!G.conversation)throw new q1(409,{message:"Voice session does not support SDP negotiation"});if(G.connected)throw new q1(409,{message:"Voice session already connected"});try{await Y.update(X,QO1.encode(JSON.stringify({...G,connected:!0})),J.revision)}catch{throw new q1(409,{message:"Voice session is busy"})}return W.negotiate({sdp:Z.sdp,language:Z.language,model:G.conversation.model,safetyIdentifier:X})}async speak($,Z,Q,Y){let X=this.authorize($,Z),J=await this.kv(),G=mp(X);for(let W=0;;W++){let K=await J.get(G),H=K?.operation==="PUT"?D_0.parse(K.json()):null;if(!K||!H||H.sessionId!==X.sessionId||H.expiresAt<=Date.now())throw new q1(403,{message:"Voice session expired"});if(H.characters+Q.length>24000||H.requests>=120)throw new q1(429,{message:"Voice session speech limit reached"});try{await J.update(G,QO1.encode(JSON.stringify({...H,characters:H.characters+Q.length,requests:H.requests+1})),K.revision);break}catch{if(W>=2)throw new q1(409,{message:"Voice session is busy"})}}return this.adapter().synthesize(Q,Y)}async release($){let Z=await this.kv(),Q=await Z.get(mp($));if(Q?.operation==="PUT"&&D_0.parse(Q.json()).sessionId===$.sessionId)await Z.delete(mp($),{previousSeq:Q.revision})}async revoke($,Z){await this.release(this.authorize($,Z))}}var O_0,yX8,gX8,D_0,QO1;var hX8=D(()=>{wJ();yU();bX8();fX8();O_0=C(LK(),1),yX8=C(YA(),1),gX8=C(Tz(),1),D_0=cp.object({sessionId:cp.string().uuid(),expiresAt:cp.number(),connected:cp.boolean().optional(),conversation:ZO1.optional(),characters:cp.number().int().nonnegative(),requests:cp.number().int().nonnegative()}),QO1=new TextEncoder});function Jr6($){return $.filter((Z)=>Z.vendors?.alias).map((Z)=>({name:Z.name,title:Z.title,description:Z.description,logo:Z.logo,category:Z.category,vendor:{alias:Z.vendors.alias,url:Z.vendors.url}}))}var Gr6=async($,Z)=>{if(!$.get("studioContext").auth.user?.id)return $.json({error:"Unauthorized"},401);return Z()},uX8=()=>{let $=new $1;return $.use("*",Gr6),$.get("/",async(Z)=>{let Q=j0(),Y=Q.decoSupabaseUrl,X=Q.decoSupabaseServiceKey;if(!Y||!X)return Z.json({apps:[]});try{let J=await YG(Y,X,"apps?select=name,title,description,logo,category,vendors(alias,url)");return Z.json({apps:Jr6(J)})}catch(J){return console.error("[deco-apps] GET error:",J),Z.json({error:"Failed to fetch apps"},502)}}),$};var lX8=D(()=>{J8();$$();dk0()});import{z as y1}from"zod";function PN($,Z="invalid_request_error",Q=null,Y=null){return{error:{message:$,type:Z,param:Q,code:Y}}}function Lr6($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let Q=$.substring(0,Z),Y=$.substring(Z+1);if(!Q||!Y)return null;return{credentialId:Q,modelId:Y}}function wr6($,Z,Q){try{return JSON.parse($)}catch{throw new dX8(`Invalid JSON in tool call arguments for function '${Q}' (tool_call_id: ${Z}): ${$}`)}}function jr6($){let Z={};for(let Q of $)if(Q.role==="assistant"&&Q.tool_calls)for(let Y of Q.tool_calls)Z[Y.id]=Y.function.name;return $.map((Q)=>{switch(Q.role){case"system":return{role:"system",content:Q.content};case"user":if(typeof Q.content==="string")return{role:"user",content:Q.content};return{role:"user",content:Q.content.map((X)=>{if(X.type==="text")return{type:"text",text:X.text};return{type:"image",image:X.image_url.url}})};case"assistant":if(Q.tool_calls&&Q.tool_calls.length>0)return{role:"assistant",content:Q.tool_calls.map((X)=>({type:"tool-call",toolCallId:X.id,toolName:X.function.name,input:wr6(X.function.arguments,X.id,X.function.name)}))};return{role:"assistant",content:Q.content??""};case"tool":let Y=Z[Q.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:Q.tool_call_id,toolName:Y,output:{type:"text",value:Q.content}}]}}})}function Er6($){let Z=$.map((Q)=>{let Y=Q.function.parameters?tF(Q.function.parameters):tF({type:"object",properties:{}});return[Q.function.name,n$({description:Q.function.description,inputSchema:Y})]});return Object.fromEntries(Z)}function zr6($){if(!$)return;return{openai:{response_format:$}}}function Pr6(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function cX8($,Z,Q,Y,X,J){let G={model:$,instructions:Z.filter((W)=>W.role==="system"),messages:Z.filter((W)=>W.role!=="system"),tools:Q,temperature:Y.temperature,maxOutputTokens:Y.max_tokens,topP:Y.top_p,frequencyPenalty:Y.frequency_penalty,presencePenalty:Y.presence_penalty,stopSequences:Y.stop?Array.isArray(Y.stop)?Y.stop:[Y.stop]:void 0,abortSignal:J};return X?{...G,providerOptions:X}:G}function mX8($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var Wr6=256,Kr6,Hr6,Fr6,Ur6,Nr6,Br6,Dr6,Or6,dX8,iX8,pX8;var nX8=D(()=>{y4();J8();_p();vH();Kr6=y1.object({type:y1.literal("function"),function:y1.object({name:y1.string(),description:y1.string().optional(),parameters:y1.record(y1.string(),y1.unknown()).optional()})}),Hr6=y1.object({id:y1.string(),type:y1.literal("function"),function:y1.object({name:y1.string(),arguments:y1.string()})}),Fr6=y1.discriminatedUnion("role",[y1.object({role:y1.literal("system"),content:y1.string(),name:y1.string().optional()}),y1.object({role:y1.literal("user"),content:y1.union([y1.string(),y1.array(y1.union([y1.object({type:y1.literal("text"),text:y1.string()}),y1.object({type:y1.literal("image_url"),image_url:y1.object({url:y1.string(),detail:y1.string().optional()})})]))]),name:y1.string().optional()}),y1.object({role:y1.literal("assistant"),content:y1.string().nullable().optional(),name:y1.string().optional(),tool_calls:y1.array(Hr6).optional()}),y1.object({role:y1.literal("tool"),content:y1.string(),tool_call_id:y1.string()})]),Ur6=y1.object({type:y1.literal("text")}),Nr6=y1.object({type:y1.literal("json_object")}),Br6=y1.object({type:y1.literal("json_schema"),json_schema:y1.object({name:y1.string(),description:y1.string().optional(),schema:y1.record(y1.string(),y1.unknown()),strict:y1.boolean().optional()})}),Dr6=y1.union([Ur6,Nr6,Br6]),Or6=y1.object({model:y1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:y1.array(Fr6),stream:y1.boolean().optional().default(!1),temperature:y1.number().min(0).max(2).optional(),max_tokens:y1.number().positive().optional(),top_p:y1.number().min(0).max(1).optional(),frequency_penalty:y1.number().min(-2).max(2).optional(),presence_penalty:y1.number().min(-2).max(2).optional(),stop:y1.union([y1.string(),y1.array(y1.string())]).optional(),tools:y1.array(Kr6).optional(),tool_choice:y1.union([y1.literal("auto"),y1.literal("none"),y1.literal("required"),y1.object({type:y1.literal("function"),function:y1.object({name:y1.string()})})]).optional(),response_format:Dr6.optional(),user:y1.string().optional()});dX8=class dX8 extends Error{constructor($){super($);this.name="MessageConversionError"}};iX8=new $1;iX8.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("studioContext"),Q=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(PN("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(PN("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==Q)return $.json(PN("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let Y=await $.req.json(),X=Or6.safeParse(Y);if(!X.success){let w=X.error.issues[0]??{message:"Invalid request",path:[]};return $.json(PN(`Invalid request: ${w.message}`,"invalid_request_error",w.path.length>0?w.path.join("."):null),400)}let J=X.data,G=Lr6(J.model);if(!G)return $.json(PN("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=G,{modelId:K}=G;if(!W){let j=(await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id})).find((E)=>jP(E.providerId));if(!j)return $.json(PN("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=j.id}let H;try{H=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(PN(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let F=H.aiSdk.languageModel(K),U=jr6(J.messages),N=J.tools?Er6(J.tools):void 0,B=zr6(J.response_format),O=Pr6(),L=Math.floor(Date.now()/1000);if(J.stream)return OO($,async(w)=>{let j=cX8(F,U,N,J,B,$.req.raw.signal);try{let E=Dd(j),z=!1,T=0,P="",A=async()=>{if(P.length===0)return;let q=P;P="",await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{content:q},finish_reason:null}]})})};for await(let q of E.stream){if(!z&&(q.type==="text-delta"||q.type==="tool-call"))await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),z=!0;if(q.type==="text-delta"){if(P+=q.text,P.length>=Wr6)await A()}else if(q.type==="tool-call"){await A();let f=T++;await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{tool_calls:[{index:f,id:q.toolCallId,type:"function",function:{name:q.toolName,arguments:JSON.stringify(q.input)}}]},finish_reason:null}]})})}else if(q.type==="finish")await A(),await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{},finish_reason:mX8(q.finishReason)}],usage:q.totalUsage?{prompt_tokens:q.totalUsage.inputTokens??0,completion_tokens:q.totalUsage.outputTokens??0,total_tokens:q.totalUsage.totalTokens??0}:void 0})})}await A(),await w.writeSSE({data:"[DONE]"})}catch(E){let z=E;console.error("[openai-compat:stream] Error:",z.message),await w.writeSSE({data:JSON.stringify({error:{message:z.message,type:"server_error"}})})}});else{let w=cX8(F,U,N,J,B,$.req.raw.signal),j=await hU(w),E={role:"assistant",content:j.text||null};if(j.toolCalls&&j.toolCalls.length>0)E.tool_calls=j.toolCalls.map((z)=>({id:z.toolCallId,type:"function",function:{name:z.toolName,arguments:JSON.stringify("input"in z?z.input:{})}})),E.content=null;return $.json({id:O,object:"chat.completion",created:L,model:J.model,choices:[{index:0,message:E,finish_reason:mX8(j.finishReason)}],usage:{prompt_tokens:j.usage?.inputTokens??0,completion_tokens:j.usage?.outputTokens??0,total_tokens:j.usage?.totalTokens??0}})}}catch(Y){let X=Y;if(X.name==="AbortError")return $.json(PN("Request aborted","invalid_request_error"),400);if(X.name==="MessageConversionError")return $.json(PN(X.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",X.message,X.stack),$.json(PN(X.message,"server_error"),500)}});pX8=iX8});function Ar6($){if(typeof $!=="object"||$===null)return!1;let Q=$.repository?.url;return typeof Q==="string"&&Q.length>0}function tX8(){let $=new $1;return $.use("*",async(Z,Q)=>{await Q(),Z.header("Cache-Control","private, no-store"),Z.header("Vary","Cookie")}),$.get("/",async(Z)=>{let Q=Z.get("studioContext"),Y=d0(Q);if(!Y)return Z.json({error:"Authentication required"},401);let J=(Z.req.query("site")??"").trim().toLowerCase();if(!EZ(J))return Z.json({error:"Invalid site slug"},400);let G=await Q.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.id as id","organization.slug as slug","organization.name as name","organization.metadata as metadata"]).where("member.userId","=",Y).execute(),W=[];for(let H of G){if(!H.slug||S9(H))continue;let F=await Q.storage.virtualMcps.list(H.id);for(let U of F){if(OA(U)!==J)continue;if(!Ar6(U.metadata))continue;W.push({orgSlug:H.slug,orgName:H.name??H.slug,project:{id:U.id,title:U.title,icon:U.icon??null}})}}let K={matches:W};return Z.json(K)}),$}var oX8=D(()=>{J8();eG()});var sX8;var rX8=D(()=>{sX8={name:"decocms",version:"4.443.1",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js","db:migrate:dbos":"bun run ./dist/server/migrate-dbos.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts","migrate:dbos":"bun run src/database/migrate-dbos.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^4.0.58","@ai-sdk/google":"^4.0.76","@ai-sdk/openai":"^4.0.71","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^3.1.0","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^4.0.17","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^7.0.107","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});function qr6(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??Rr6}}var aX8,Rr6="https://ph.studio.decocms.com",eX8;var $J8=D(()=>{J8();Cs();lf();V9();$$();ON1();rX8();aX8=new $1;aX8.get("/",($)=>{let Z={version:sX8.version,theme:T5$(),...pK().logo&&{logo:pK().logo},...uD()&&{internalUrl:ip1()},...j0().enableDecoImport&&{enableDecoImport:!0},brandExtractEnabled:!!j0().firecrawlApiKey,hostingEnabled:!!j0().controlplaneRestUrl&&!!j0().controlplaneServiceToken,hostingControlPlaneGa:j0().hostingControlPlaneGa,monitorEnabled:!!j0().clickhouseAnalyticsUrl&&!!j0().clickhouseAnalyticsPassword,monitorGa:j0().monitorGa,plansEnabled:j0().plansEnabled,auth:k68(),posthog:qr6(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:IO()}};return $.header("Cache-Control","no-store"),$.json({success:!0,config:Z})});eX8=aX8});function $g($){let Z=($??"").trim().toLowerCase();return Z=Z.replace(/^https?:\/\//,""),Z=Z.replace(/^www\./,""),Z=Z.split(/[/?#]/)[0]??"",Z.replace(/\/+$/,"")}function XO1($){return($g($).split(".")[0]||$).replace(/[-_]/g," ").split(" ").filter(Boolean).map((Q)=>Q.charAt(0).toUpperCase()+Q.slice(1)).join(" ")}function ZJ8($,Z=64){return`https://www.google.com/s2/favicons?domain=${encodeURIComponent($g($))}&sz=${Z}`}function Mr6($,Z){let Q=$.trim();if(Q.length<=Z)return Q;let Y=Q.slice(0,Z-1),X=Y.lastIndexOf(" ");return`${(X>Z*0.6?Y.slice(0,X):Y).trimEnd()}\u2026`}function QJ8($){let{brand:Z,domain:Q,score:Y}=$,X=typeof Y==="number"?`${Z} Deco Score \u2014 ${Math.round(Y)}/100 \xB7 decocms`:`${Z} Deco Score \xB7 decocms`,J=Mr6(`How does ${Q} really perform? See the full ${Z} Deco Score \u2014 SEO, performance, conversion & AEO signals scored by decocms.`,200);return{title:X,description:J}}import{z as P$}from"zod";var Ir6,YJ8;var XJ8=D(()=>{Ir6=P$.object({check_id:P$.string(),title:P$.string(),description:P$.string().optional(),impact:P$.string().optional(),why:P$.string().optional(),category:P$.string(),severity:P$.string(),value_band:P$.string().optional(),value_driver:P$.string().optional(),controllability:P$.string().optional(),pages:P$.array(P$.string()),tasks:P$.array(P$.string()),evidence:P$.string(),sample_scope:P$.string().optional(),sources:P$.array(P$.string())}),YJ8=P$.object({domain:P$.string(),brand:P$.string(),favicon:P$.string().optional(),scanned_at:P$.string().nullable(),lang:P$.string(),score:P$.number().nullable(),band:P$.string().nullable(),totals:P$.object({measured:P$.number(),registry_total:P$.number(),passed:P$.number(),failed:P$.number(),blocked:P$.number()}),buckets:P$.array(P$.object({id:P$.enum(["critical","important","worth"]),label:P$.string(),items:P$.array(Ir6)})),passing:P$.object({count:P$.number(),items:P$.array(P$.object({check_id:P$.string(),title:P$.string()}))}),not_measured:P$.object({count:P$.number(),groups:P$.array(P$.object({reason:P$.string(),label:P$.string(),count:P$.number(),checks:P$.array(P$.string())}))}),categories:P$.array(P$.object({key:P$.string(),label:P$.string(),score:P$.number().nullable(),band:P$.string().nullable(),pass:P$.number(),fail:P$.number()})),screenshots:P$.array(P$.object({url:P$.string(),page_type:P$.string().optional(),viewport:P$.enum(["desktop","mobile"]),image_url:P$.string()}))})});function JJ8($,Z,Q){let Y=Q?`?${new URLSearchParams({lang:Q}).toString()}`:"";return`${AW({})}/api/v2/public/diagnostics/${encodeURIComponent($)}/onepager${Z}${Y}`}async function L_0($,Z={}){let Q=await fetch(JJ8($,"",Z.lang),{headers:{Accept:"application/json"},signal:Z.signal});if(Q.status===404)return null;if(!Q.ok)throw Error(`onepager read HTTP ${Q.status}`);return YJ8.parse(await Q.json())}async function GJ8($,Z={}){let Q=await fetch(JJ8($,".md",Z.lang),{headers:{Accept:"text/markdown"},signal:Z.signal});if(Q.status===404)return null;if(!Q.ok)throw Error(`onepager markdown HTTP ${Q.status}`);return Q.text()}var JO1=D(()=>{XJ8();oB()});import{join as WJ8}from"path";async function kr6($){try{let Z=await L_0($,{signal:AbortSignal.timeout(Vr6)});if(!Z?.scanned_at)return null;return{brand:Z.brand.trim()||XO1($),...Z.score!==null?{score:Z.score}:{}}}catch{return null}}function WG($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function Sr6($,Z){let Q=$g($),Y=Z?.brand?.trim()||XO1(Q),X=ZJ8(Q,128),G=`${(j0().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(Q)}`,{title:W,description:K}=QJ8({brand:Y,domain:Q,score:Z?.score}),H=`${G}/og.png`,F=`${Y} Deco Score by decocms`;return[`<title>${WG(W)}</title>`,`<meta name="description" content="${WG(K)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${WG(W)}" />`,`<meta property="og:description" content="${WG(K)}" />`,`<meta property="og:url" content="${WG(G)}" />`,`<meta property="og:image" content="${WG(H)}" />`,'<meta property="og:image:width" content="1200" />','<meta property="og:image:height" content="630" />',`<meta property="og:image:alt" content="${WG(F)}" />`,'<meta name="twitter:card" content="summary_large_image" />',`<meta name="twitter:title" content="${WG(W)}" />`,`<meta name="twitter:description" content="${WG(K)}" />`,`<meta name="twitter:image" content="${WG(H)}" />`,`<meta name="twitter:image:alt" content="${WG(F)}" />`,`<link rel="canonical" href="${WG(G)}" />`,`<link rel="alternate" type="text/markdown" href="${WG(G)}.md" />`,`<link rel="icon" href="${WG(X)}" sizes="any" />`].join(`
+Start in ${$.language==="pt"?"Brazilian Portuguese":"English"}, and follow the user's language.`,delegation:{type:"client"},audio:{output:{voice:$.voice}},store:!1}}class aD1{config;constructor($){this.config=$}async createSession(){return{provider:"openai",transport:"webrtc"}}async negotiate($){let Z=await fetch("https://api.openai.com/v1/live/sessions",{method:"POST",headers:{Authorization:`Bearer ${this.config.apiKey}`,"Content-Type":"application/json","OpenAI-Safety-Identifier":$.safetyIdentifier},body:JSON.stringify({session:eo6({...this.config,language:$.language,model:$.model}),transport:{type:"webrtc",sdp:$.sdp}}),signal:AbortSignal.timeout(15000)});if(!Z.ok)throw await Z.body?.cancel(),Error(`OpenAI Live request failed (${Z.status})`);return{sdp:up.object({session:up.object({id:up.string().min(1)}),transport:up.object({type:up.literal("webrtc"),sdp:up.string().min(1).max(1e5)})}).parse(await Z.json()).transport.sdp}}}var qX8=D(()=>{yU()});var MX8;var IX8=D(()=>{MX8=[{name:"delegate_to_agent",description:"Submit a complete request to the selected Studio agent. Returns after acceptance while work continues in the background. Results arrive later.",parameters:{type:"object",properties:{request:{type:"string",description:"The complete user request, with relevant conversational details. Preserve intent and constraints."}},required:["request"]}},{name:"get_agent_status",description:"Read the current chat's work status and known results. This does not track independent organization tasks; delegate fresh task-status queries to the Studio agent. Use when asked, never poll.",parameters:{type:"object",properties:{}}},{name:"stop_agent_work",description:"Request cancellation in the current chat ONLY when the user explicitly asks. Speaking over the companion is not cancellation. To stop independent tasks, delegate that request to the Studio agent.",parameters:{type:"object",properties:{}}}]});function eD1($){return{conversation_config:{agent:{first_message:"",language:"en",prompt:{prompt:Oq$,llm:$.conversationModel,thinking_budget:0,max_tokens:512,tools:MX8.map((Z)=>({...Z,type:"client",expects_response:!0,response_timeout_secs:Z.name==="delegate_to_agent"?20:5,...Z.name==="delegate_to_agent"?{execution_mode:"async",interruption_mode:"allow",pre_tool_speech:"off"}:{}}))}},asr:{provider:"scribe_realtime",quality:"high"},turn:{turn_eagerness:"normal",turn_timeout:-1,silence_end_call_timeout:-1},tts:{voice_id:$.voiceId,model_id:$.model},conversation:{max_duration_seconds:kD/1000,client_events:["audio","interruption","user_transcript","agent_response","client_tool_call","vad_score"]}},platform_settings:{auth:{enable_auth:!0},privacy:{record_voice:!1,retention_days:1,delete_audio:!0,delete_transcript_and_pii:!0},overrides:{conversation_config_override:{agent:{language:!0}}}}}}var VX8=D(()=>{yU();IX8()});import{z as oX}from"zod";import{createHash as $r6,createHmac as Zr6}from"crypto";class B_0{config;conversationKey;configurationKey;constructor($){this.config=$;this.configurationKey=$r6("sha256").update(JSON.stringify(eD1($))).digest("hex"),this.conversationKey=Zr6("sha256",$.apiKey).update(this.configurationKey).digest("hex")}forConversationModel($){return $===this.config.conversationModel?this:new B_0({...this.config,conversationModel:$})}async request($,Z,Q){let Y=await fetch(`https://api.elevenlabs.io/v1${$}`,{method:Z===void 0?"GET":"POST",headers:{"xi-api-key":this.config.apiKey,"Content-Type":"application/json"},body:JSON.stringify(Z),signal:Q});if(!Y.ok)throw await Y.body?.cancel(),Error(`ElevenLabs request failed (${Y.status})`);return Y}async ensureConversationAgent(){let $=`Studio voice ${this.configurationKey.slice(0,24)}`,Z=await this.request(`/convai/agents?search=${encodeURIComponent($)}&page_size=100`,void 0,AbortSignal.timeout(15000)),{agents:Q}=oX.object({agents:oX.array(oX.object({agent_id:oX.string(),name:oX.string()}))}).parse(await Z.json()),Y=Q.find((J)=>J.name===$);if(Y){let J=await this.request(`/convai/agents/${encodeURIComponent(Y.agent_id)}`,void 0,AbortSignal.timeout(15000));return oX.object({platform_settings:oX.object({auth:oX.object({enable_auth:oX.literal(!0)})})}).parse(await J.json()),Y.agent_id}let X=await this.request("/convai/agents/create",{name:$,...eD1(this.config)},AbortSignal.timeout(15000));return oX.object({agent_id:oX.string().min(1)}).parse(await X.json()).agent_id}async createConversationToken($){let Z=await this.request(`/convai/conversation/token?agent_id=${encodeURIComponent($)}`,void 0,AbortSignal.timeout(15000));return oX.object({token:oX.string().min(1)}).parse(await Z.json()).token}async createTranscriptionToken(){let $=await this.request("/single-use-token/realtime_scribe",{},AbortSignal.timeout(15000));return oX.object({token:oX.string().min(1)}).parse(await $.json()).token}synthesize($,Z){return this.request(`/text-to-speech/${encodeURIComponent(this.config.voiceId)}/stream?output_format=mp3_44100_128`,{text:$,model_id:this.config.model},AbortSignal.any([Z,AbortSignal.timeout(60000)]))}}var kX8=D(()=>{VX8()});import{createHmac as Qr6,timingSafeEqual as Yr6}from"crypto";import{z as lp}from"zod";function CX8($,Z){if(!Z)throw Error("Voice requires a shared authentication secret");return Qr6("sha256",Z).update(`studio-voice-session:v1:${$}`).digest("base64url")}function _X8($,Z){let Q=Buffer.from(JSON.stringify(SX8.parse($))).toString("base64url");return`${Q}.${CX8(Q,Z)}`}function vX8($,Z,Q=Date.now()){if(!Z||$.length>4096)return null;let Y=$.split(".");if(Y.length!==2)return null;let[X,J]=Y;if(!X||!J)return null;let G=Buffer.from(CX8(X,Z)),W=Buffer.from(J);if(W.length!==G.length||!Yr6(W,G))return null;try{let K=SX8.safeParse(JSON.parse(Buffer.from(X,"base64url").toString()));if(!K.success||K.data.expiresAt<=Q||K.data.expiresAt>Q+kD)return null;return K.data}catch{return null}}var SX8;var bX8=D(()=>{yU();SX8=lp.object({sessionId:lp.string().uuid(),organizationId:lp.string().min(1).max(256),userId:lp.string().min(1).max(256),threadId:lp.string().min(1).max(256),expiresAt:lp.number().int().positive()})});import{z as $O1}from"zod";function xX8($,Z){if(Z?.voice_model!=null&&Z.voice_provider==null)throw Error("A voice model override requires a provider");let Q=Z?.voice_provider??$.voiceConversationProvider;return ZO1.parse({provider:Q,model:Z?.voice_model??(Q==="openai"?$.openaiLiveModel:$.elevenlabsConversationModel)})}var ZO1;var fX8=D(()=>{ZO1=$O1.object({provider:$O1.enum(["elevenlabs","openai"]),model:$O1.string().trim().min(1).max(128)})});import{createHash as Xr6}from"crypto";import{z as cp}from"zod";function mp($){return`user.${Xr6("sha256").update(JSON.stringify([$.organizationId,$.userId])).digest("hex")}`}class YO1{deps;kvPromise;constructor($){this.deps=$}kv(){let $=this.deps.getConnection();if(!$||$.isClosed())throw new q1(503,{message:"Voice transport is unavailable"});return this.kvPromise??=new yX8.Kvm(O_0.jetstream($)).create("STUDIO_VOICE_SESSIONS",{storage:O_0.StorageType.Memory,ttl:gX8.nanos(kD),max_bytes:10485760}).catch((Z)=>{throw this.kvPromise=void 0,Z}),this.kvPromise}adapter(){if(!this.deps.adapter)throw new q1(503,{message:"Voice is not configured on this deployment"});return this.deps.adapter}async create($,Z=!1,Q="en",Y){let X;if(Z)try{X=xX8(this.deps.defaults,Y)}catch{throw new q1(503,{message:"Voice configuration is invalid"})}let J=X?this.deps.conversationAdapters[X.provider]:this.adapter();if(!J)throw new q1(503,{message:"Voice is not configured on this deployment"});let G={...$,sessionId:crypto.randomUUID(),expiresAt:Date.now()+kD},W=_X8(G,this.deps.secret),K=await this.kv(),H=mp(G),F=await K.get(H),U=F?.operation==="PUT"?D_0.parse(F.json()):null,N=QO1.encode(JSON.stringify({sessionId:G.sessionId,expiresAt:G.expiresAt,conversation:X,characters:0,requests:0}));try{if(F&&U&&U.expiresAt<=Date.now())await K.update(H,N,F.revision);else await K.create(H,N)}catch{throw new q1(409,{message:"Close your other voice session before starting a new one"})}try{if(X&&"createSession"in J){let O=await J.createSession({language:Q,model:X.model,safetyIdentifier:mp($)});return{token:W,...O,expiresAt:G.expiresAt}}let B=await this.adapter().createTranscriptionToken();return{token:W,transcriptionToken:B,expiresAt:G.expiresAt}}catch(B){throw await this.release(G),B}}authorize($,Z){let Q=vX8(Z,this.deps.secret);if(!Q||Q.organizationId!==$.organizationId||Q.userId!==$.userId||Q.threadId!==$.threadId)throw new q1(403,{message:"Invalid voice session"});return Q}async connect($,Z){let Q=this.authorize($,Z.token),Y=await this.kv(),X=mp(Q),J=await Y.get(X),G=J?.operation==="PUT"?D_0.parse(J.json()):null;if(!J||!G||G.sessionId!==Q.sessionId||G.expiresAt<=Date.now())throw new q1(403,{message:"Voice session expired"});let W=G.conversation?this.deps.conversationAdapters[G.conversation.provider]:null;if(!W?.negotiate||!G.conversation)throw new q1(409,{message:"Voice session does not support SDP negotiation"});if(G.connected)throw new q1(409,{message:"Voice session already connected"});try{await Y.update(X,QO1.encode(JSON.stringify({...G,connected:!0})),J.revision)}catch{throw new q1(409,{message:"Voice session is busy"})}return W.negotiate({sdp:Z.sdp,language:Z.language,model:G.conversation.model,safetyIdentifier:X})}async speak($,Z,Q,Y){let X=this.authorize($,Z),J=await this.kv(),G=mp(X);for(let W=0;;W++){let K=await J.get(G),H=K?.operation==="PUT"?D_0.parse(K.json()):null;if(!K||!H||H.sessionId!==X.sessionId||H.expiresAt<=Date.now())throw new q1(403,{message:"Voice session expired"});if(H.characters+Q.length>24000||H.requests>=120)throw new q1(429,{message:"Voice session speech limit reached"});try{await J.update(G,QO1.encode(JSON.stringify({...H,characters:H.characters+Q.length,requests:H.requests+1})),K.revision);break}catch{if(W>=2)throw new q1(409,{message:"Voice session is busy"})}}return this.adapter().synthesize(Q,Y)}async release($){let Z=await this.kv(),Q=await Z.get(mp($));if(Q?.operation==="PUT"&&D_0.parse(Q.json()).sessionId===$.sessionId)await Z.delete(mp($),{previousSeq:Q.revision})}async revoke($,Z){await this.release(this.authorize($,Z))}}var O_0,yX8,gX8,D_0,QO1;var hX8=D(()=>{wJ();yU();bX8();fX8();O_0=C(LK(),1),yX8=C(YA(),1),gX8=C(Tz(),1),D_0=cp.object({sessionId:cp.string().uuid(),expiresAt:cp.number(),connected:cp.boolean().optional(),conversation:ZO1.optional(),characters:cp.number().int().nonnegative(),requests:cp.number().int().nonnegative()}),QO1=new TextEncoder});function Jr6($){return $.filter((Z)=>Z.vendors?.alias).map((Z)=>({name:Z.name,title:Z.title,description:Z.description,logo:Z.logo,category:Z.category,vendor:{alias:Z.vendors.alias,url:Z.vendors.url}}))}var Gr6=async($,Z)=>{if(!$.get("studioContext").auth.user?.id)return $.json({error:"Unauthorized"},401);return Z()},uX8=()=>{let $=new $1;return $.use("*",Gr6),$.get("/",async(Z)=>{let Q=j0(),Y=Q.decoSupabaseUrl,X=Q.decoSupabaseServiceKey;if(!Y||!X)return Z.json({apps:[]});try{let J=await YG(Y,X,"apps?select=name,title,description,logo,category,vendors(alias,url)");return Z.json({apps:Jr6(J)})}catch(J){return console.error("[deco-apps] GET error:",J),Z.json({error:"Failed to fetch apps"},502)}}),$};var lX8=D(()=>{J8();$$();dk0()});import{z as y1}from"zod";function PN($,Z="invalid_request_error",Q=null,Y=null){return{error:{message:$,type:Z,param:Q,code:Y}}}function Lr6($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let Q=$.substring(0,Z),Y=$.substring(Z+1);if(!Q||!Y)return null;return{credentialId:Q,modelId:Y}}function wr6($,Z,Q){try{return JSON.parse($)}catch{throw new dX8(`Invalid JSON in tool call arguments for function '${Q}' (tool_call_id: ${Z}): ${$}`)}}function jr6($){let Z={};for(let Q of $)if(Q.role==="assistant"&&Q.tool_calls)for(let Y of Q.tool_calls)Z[Y.id]=Y.function.name;return $.map((Q)=>{switch(Q.role){case"system":return{role:"system",content:Q.content};case"user":if(typeof Q.content==="string")return{role:"user",content:Q.content};return{role:"user",content:Q.content.map((X)=>{if(X.type==="text")return{type:"text",text:X.text};return{type:"image",image:X.image_url.url}})};case"assistant":if(Q.tool_calls&&Q.tool_calls.length>0)return{role:"assistant",content:Q.tool_calls.map((X)=>({type:"tool-call",toolCallId:X.id,toolName:X.function.name,input:wr6(X.function.arguments,X.id,X.function.name)}))};return{role:"assistant",content:Q.content??""};case"tool":let Y=Z[Q.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:Q.tool_call_id,toolName:Y,output:{type:"text",value:Q.content}}]}}})}function Er6($){let Z=$.map((Q)=>{let Y=Q.function.parameters?tF(Q.function.parameters):tF({type:"object",properties:{}});return[Q.function.name,n$({description:Q.function.description,inputSchema:Y})]});return Object.fromEntries(Z)}function zr6($){if(!$)return;return{openai:{response_format:$}}}function Pr6(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function cX8($,Z,Q,Y,X,J){let G={model:$,instructions:Z.filter((W)=>W.role==="system"),messages:Z.filter((W)=>W.role!=="system"),tools:Q,temperature:Y.temperature,maxOutputTokens:Y.max_tokens,topP:Y.top_p,frequencyPenalty:Y.frequency_penalty,presencePenalty:Y.presence_penalty,stopSequences:Y.stop?Array.isArray(Y.stop)?Y.stop:[Y.stop]:void 0,abortSignal:J};return X?{...G,providerOptions:X}:G}function mX8($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var Wr6=256,Kr6,Hr6,Fr6,Ur6,Nr6,Br6,Dr6,Or6,dX8,iX8,pX8;var nX8=D(()=>{y4();J8();_p();vH();Kr6=y1.object({type:y1.literal("function"),function:y1.object({name:y1.string(),description:y1.string().optional(),parameters:y1.record(y1.string(),y1.unknown()).optional()})}),Hr6=y1.object({id:y1.string(),type:y1.literal("function"),function:y1.object({name:y1.string(),arguments:y1.string()})}),Fr6=y1.discriminatedUnion("role",[y1.object({role:y1.literal("system"),content:y1.string(),name:y1.string().optional()}),y1.object({role:y1.literal("user"),content:y1.union([y1.string(),y1.array(y1.union([y1.object({type:y1.literal("text"),text:y1.string()}),y1.object({type:y1.literal("image_url"),image_url:y1.object({url:y1.string(),detail:y1.string().optional()})})]))]),name:y1.string().optional()}),y1.object({role:y1.literal("assistant"),content:y1.string().nullable().optional(),name:y1.string().optional(),tool_calls:y1.array(Hr6).optional()}),y1.object({role:y1.literal("tool"),content:y1.string(),tool_call_id:y1.string()})]),Ur6=y1.object({type:y1.literal("text")}),Nr6=y1.object({type:y1.literal("json_object")}),Br6=y1.object({type:y1.literal("json_schema"),json_schema:y1.object({name:y1.string(),description:y1.string().optional(),schema:y1.record(y1.string(),y1.unknown()),strict:y1.boolean().optional()})}),Dr6=y1.union([Ur6,Nr6,Br6]),Or6=y1.object({model:y1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:y1.array(Fr6),stream:y1.boolean().optional().default(!1),temperature:y1.number().min(0).max(2).optional(),max_tokens:y1.number().positive().optional(),top_p:y1.number().min(0).max(1).optional(),frequency_penalty:y1.number().min(-2).max(2).optional(),presence_penalty:y1.number().min(-2).max(2).optional(),stop:y1.union([y1.string(),y1.array(y1.string())]).optional(),tools:y1.array(Kr6).optional(),tool_choice:y1.union([y1.literal("auto"),y1.literal("none"),y1.literal("required"),y1.object({type:y1.literal("function"),function:y1.object({name:y1.string()})})]).optional(),response_format:Dr6.optional(),user:y1.string().optional()});dX8=class dX8 extends Error{constructor($){super($);this.name="MessageConversionError"}};iX8=new $1;iX8.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("studioContext"),Q=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(PN("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(PN("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==Q)return $.json(PN("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let Y=await $.req.json(),X=Or6.safeParse(Y);if(!X.success){let w=X.error.issues[0]??{message:"Invalid request",path:[]};return $.json(PN(`Invalid request: ${w.message}`,"invalid_request_error",w.path.length>0?w.path.join("."):null),400)}let J=X.data,G=Lr6(J.model);if(!G)return $.json(PN("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=G,{modelId:K}=G;if(!W){let j=(await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id})).find((E)=>jP(E.providerId));if(!j)return $.json(PN("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=j.id}let H;try{H=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(PN(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let F=H.aiSdk.languageModel(K),U=jr6(J.messages),N=J.tools?Er6(J.tools):void 0,B=zr6(J.response_format),O=Pr6(),L=Math.floor(Date.now()/1000);if(J.stream)return OO($,async(w)=>{let j=cX8(F,U,N,J,B,$.req.raw.signal);try{let E=Dd(j),z=!1,T=0,P="",A=async()=>{if(P.length===0)return;let q=P;P="",await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{content:q},finish_reason:null}]})})};for await(let q of E.stream){if(!z&&(q.type==="text-delta"||q.type==="tool-call"))await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),z=!0;if(q.type==="text-delta"){if(P+=q.text,P.length>=Wr6)await A()}else if(q.type==="tool-call"){await A();let f=T++;await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{tool_calls:[{index:f,id:q.toolCallId,type:"function",function:{name:q.toolName,arguments:JSON.stringify(q.input)}}]},finish_reason:null}]})})}else if(q.type==="finish")await A(),await w.writeSSE({data:JSON.stringify({id:O,object:"chat.completion.chunk",created:L,model:J.model,choices:[{index:0,delta:{},finish_reason:mX8(q.finishReason)}],usage:q.totalUsage?{prompt_tokens:q.totalUsage.inputTokens??0,completion_tokens:q.totalUsage.outputTokens??0,total_tokens:q.totalUsage.totalTokens??0}:void 0})})}await A(),await w.writeSSE({data:"[DONE]"})}catch(E){let z=E;console.error("[openai-compat:stream] Error:",z.message),await w.writeSSE({data:JSON.stringify({error:{message:z.message,type:"server_error"}})})}});else{let w=cX8(F,U,N,J,B,$.req.raw.signal),j=await hU(w),E={role:"assistant",content:j.text||null};if(j.toolCalls&&j.toolCalls.length>0)E.tool_calls=j.toolCalls.map((z)=>({id:z.toolCallId,type:"function",function:{name:z.toolName,arguments:JSON.stringify("input"in z?z.input:{})}})),E.content=null;return $.json({id:O,object:"chat.completion",created:L,model:J.model,choices:[{index:0,message:E,finish_reason:mX8(j.finishReason)}],usage:{prompt_tokens:j.usage?.inputTokens??0,completion_tokens:j.usage?.outputTokens??0,total_tokens:j.usage?.totalTokens??0}})}}catch(Y){let X=Y;if(X.name==="AbortError")return $.json(PN("Request aborted","invalid_request_error"),400);if(X.name==="MessageConversionError")return $.json(PN(X.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",X.message,X.stack),$.json(PN(X.message,"server_error"),500)}});pX8=iX8});function Ar6($){if(typeof $!=="object"||$===null)return!1;let Q=$.repository?.url;return typeof Q==="string"&&Q.length>0}function tX8(){let $=new $1;return $.use("*",async(Z,Q)=>{await Q(),Z.header("Cache-Control","private, no-store"),Z.header("Vary","Cookie")}),$.get("/",async(Z)=>{let Q=Z.get("studioContext"),Y=d0(Q);if(!Y)return Z.json({error:"Authentication required"},401);let J=(Z.req.query("site")??"").trim().toLowerCase();if(!EZ(J))return Z.json({error:"Invalid site slug"},400);let G=await Q.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.id as id","organization.slug as slug","organization.name as name","organization.metadata as metadata"]).where("member.userId","=",Y).execute(),W=[];for(let H of G){if(!H.slug||S9(H))continue;let F=await Q.storage.virtualMcps.list(H.id);for(let U of F){if(OA(U)!==J)continue;if(!Ar6(U.metadata))continue;W.push({orgSlug:H.slug,orgName:H.name??H.slug,project:{id:U.id,title:U.title,icon:U.icon??null}})}}let K={matches:W};return Z.json(K)}),$}var oX8=D(()=>{J8();eG()});var sX8;var rX8=D(()=>{sX8={name:"decocms",version:"4.443.2",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run migrate && bun run dev:server","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js","db:migrate:dbos":"bun run ./dist/server/migrate-dbos.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts","migrate:dbos":"bun run src/database/migrate-dbos.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^4.0.58","@ai-sdk/google":"^4.0.76","@ai-sdk/openai":"^4.0.71","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@inkjs/ui":"^2.0.0","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^3.1.0","@opentelemetry/core":"^2.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6"},devDependencies:{"@ai-sdk/provider":"^4.0.17","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^7.0.107","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});function qr6(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??Rr6}}var aX8,Rr6="https://ph.studio.decocms.com",eX8;var $J8=D(()=>{J8();Cs();lf();V9();$$();ON1();rX8();aX8=new $1;aX8.get("/",($)=>{let Z={version:sX8.version,theme:T5$(),...pK().logo&&{logo:pK().logo},...uD()&&{internalUrl:ip1()},...j0().enableDecoImport&&{enableDecoImport:!0},brandExtractEnabled:!!j0().firecrawlApiKey,hostingEnabled:!!j0().controlplaneRestUrl&&!!j0().controlplaneServiceToken,hostingControlPlaneGa:j0().hostingControlPlaneGa,monitorEnabled:!!j0().clickhouseAnalyticsUrl&&!!j0().clickhouseAnalyticsPassword,monitorGa:j0().monitorGa,plansEnabled:j0().plansEnabled,auth:k68(),posthog:qr6(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:IO()}};return $.header("Cache-Control","no-store"),$.json({success:!0,config:Z})});eX8=aX8});function $g($){let Z=($??"").trim().toLowerCase();return Z=Z.replace(/^https?:\/\//,""),Z=Z.replace(/^www\./,""),Z=Z.split(/[/?#]/)[0]??"",Z.replace(/\/+$/,"")}function XO1($){return($g($).split(".")[0]||$).replace(/[-_]/g," ").split(" ").filter(Boolean).map((Q)=>Q.charAt(0).toUpperCase()+Q.slice(1)).join(" ")}function ZJ8($,Z=64){return`https://www.google.com/s2/favicons?domain=${encodeURIComponent($g($))}&sz=${Z}`}function Mr6($,Z){let Q=$.trim();if(Q.length<=Z)return Q;let Y=Q.slice(0,Z-1),X=Y.lastIndexOf(" ");return`${(X>Z*0.6?Y.slice(0,X):Y).trimEnd()}\u2026`}function QJ8($){let{brand:Z,domain:Q,score:Y}=$,X=typeof Y==="number"?`${Z} Deco Score \u2014 ${Math.round(Y)}/100 \xB7 decocms`:`${Z} Deco Score \xB7 decocms`,J=Mr6(`How does ${Q} really perform? See the full ${Z} Deco Score \u2014 SEO, performance, conversion & AEO signals scored by decocms.`,200);return{title:X,description:J}}import{z as P$}from"zod";var Ir6,YJ8;var XJ8=D(()=>{Ir6=P$.object({check_id:P$.string(),title:P$.string(),description:P$.string().optional(),impact:P$.string().optional(),why:P$.string().optional(),category:P$.string(),severity:P$.string(),value_band:P$.string().optional(),value_driver:P$.string().optional(),controllability:P$.string().optional(),pages:P$.array(P$.string()),tasks:P$.array(P$.string()),evidence:P$.string(),sample_scope:P$.string().optional(),sources:P$.array(P$.string())}),YJ8=P$.object({domain:P$.string(),brand:P$.string(),favicon:P$.string().optional(),scanned_at:P$.string().nullable(),lang:P$.string(),score:P$.number().nullable(),band:P$.string().nullable(),totals:P$.object({measured:P$.number(),registry_total:P$.number(),passed:P$.number(),failed:P$.number(),blocked:P$.number()}),buckets:P$.array(P$.object({id:P$.enum(["critical","important","worth"]),label:P$.string(),items:P$.array(Ir6)})),passing:P$.object({count:P$.number(),items:P$.array(P$.object({check_id:P$.string(),title:P$.string()}))}),not_measured:P$.object({count:P$.number(),groups:P$.array(P$.object({reason:P$.string(),label:P$.string(),count:P$.number(),checks:P$.array(P$.string())}))}),categories:P$.array(P$.object({key:P$.string(),label:P$.string(),score:P$.number().nullable(),band:P$.string().nullable(),pass:P$.number(),fail:P$.number()})),screenshots:P$.array(P$.object({url:P$.string(),page_type:P$.string().optional(),viewport:P$.enum(["desktop","mobile"]),image_url:P$.string()}))})});function JJ8($,Z,Q){let Y=Q?`?${new URLSearchParams({lang:Q}).toString()}`:"";return`${AW({})}/api/v2/public/diagnostics/${encodeURIComponent($)}/onepager${Z}${Y}`}async function L_0($,Z={}){let Q=await fetch(JJ8($,"",Z.lang),{headers:{Accept:"application/json"},signal:Z.signal});if(Q.status===404)return null;if(!Q.ok)throw Error(`onepager read HTTP ${Q.status}`);return YJ8.parse(await Q.json())}async function GJ8($,Z={}){let Q=await fetch(JJ8($,".md",Z.lang),{headers:{Accept:"text/markdown"},signal:Z.signal});if(Q.status===404)return null;if(!Q.ok)throw Error(`onepager markdown HTTP ${Q.status}`);return Q.text()}var JO1=D(()=>{XJ8();oB()});import{join as WJ8}from"path";async function kr6($){try{let Z=await L_0($,{signal:AbortSignal.timeout(Vr6)});if(!Z?.scanned_at)return null;return{brand:Z.brand.trim()||XO1($),...Z.score!==null?{score:Z.score}:{}}}catch{return null}}function WG($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function Sr6($,Z){let Q=$g($),Y=Z?.brand?.trim()||XO1(Q),X=ZJ8(Q,128),G=`${(j0().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(Q)}`,{title:W,description:K}=QJ8({brand:Y,domain:Q,score:Z?.score}),H=`${G}/og.png`,F=`${Y} Deco Score by decocms`;return[`<title>${WG(W)}</title>`,`<meta name="description" content="${WG(K)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${WG(W)}" />`,`<meta property="og:description" content="${WG(K)}" />`,`<meta property="og:url" content="${WG(G)}" />`,`<meta property="og:image" content="${WG(H)}" />`,'<meta property="og:image:width" content="1200" />','<meta property="og:image:height" content="630" />',`<meta property="og:image:alt" content="${WG(F)}" />`,'<meta name="twitter:card" content="summary_large_image" />',`<meta name="twitter:title" content="${WG(W)}" />`,`<meta name="twitter:description" content="${WG(K)}" />`,`<meta name="twitter:image" content="${WG(H)}" />`,`<meta name="twitter:image:alt" content="${WG(F)}" />`,`<link rel="canonical" href="${WG(G)}" />`,`<link rel="alternate" type="text/markdown" href="${WG(G)}.md" />`,`<link rel="icon" href="${WG(X)}" sizes="any" />`].join(`
     `)}function Cr6($,Z){return $.replace(/<title>[\s\S]*?<\/title>\s*/i,"").replace(/<meta\s+name="(?:description|twitter:[^"]*)"[^>]*>\s*/gi,"").replace(/<meta\s+property="og:[^"]*"[^>]*>\s*/gi,"").replace(/<link\s+rel="icon"[^>]*>\s*/gi,"").replace("</head>",`    ${Z}
   </head>`)}function KJ8($){let Z=new $1;return Z.get("/:domain/og.png",async(Q)=>{let Y=$g(Q.req.param("domain")),X=async()=>{let J=$?Bun.file(WJ8($,"report-og-fallback.png")):null;if(!J||!await J.exists())return Q.notFound();return Q.body(new Uint8Array(await J.arrayBuffer()),200,{"Content-Type":"image/png","Cache-Control":"public, max-age=0, s-maxage=3600"})};try{let J=await fetch(`${AW({})}/api/v2/public/diagnostics/${encodeURIComponent(Y)}/og.png`,{signal:AbortSignal.timeout(_r6)}),G=J.headers.get("content-type")??"";if(!J.ok||!G.startsWith("image/")||!J.body)return X();return Q.body(J.body,200,{"Content-Type":G,"Cache-Control":"public, max-age=0, s-maxage=604800"})}catch{return X()}}),Z.get("/:file{.+\\.md}",async(Q)=>{let Y=$g(Q.req.param("file").replace(/\.md$/,""));try{let X=await GJ8(Y,{lang:Q.req.query("lang")?.trim()||void 0,signal:AbortSignal.timeout(vr6)});if(X===null)return Q.text("Deco Score not found",404);return Q.body(X,200,{"Content-Type":"text/markdown; charset=utf-8","Cache-Control":"public, max-age=600, stale-while-revalidate=3600","Access-Control-Allow-Origin":"*"})}catch{return Q.text("Deco Score unavailable",502)}}),Z.get("/:domain",async(Q)=>{let Y=Q.req.param("domain"),X=$?WJ8($,"index.html"):null,J=X?Bun.file(X):null;if(!J||!await J.exists())return Q.notFound();let G=await J.text();try{let W=await kr6($g(Y)),K=Sr6(Y,W);return Q.html(Cr6(G,K),200,{"Cache-Control":"public, max-age=0, s-maxage=300"})}catch{return Q.html(G)}}),Z}var Vr6=2500,_r6=1e4,vr6=1e4;var HJ8=D(()=>{J8();oB();JO1();$$()});function w_0($,Z){return fetch(`${AW({})}${$}`,Z)}async function br6($,Z){let Q=await L_0($,{lang:Z});if(!Q)return{status:"not_found",report:null};return Q.scanned_at?{status:"ready",report:Q}:{status:"empty",report:null}}function fr6($){let Z=typeof $==="object"&&$!==null?$:{},Q=typeof Z.domain==="string"?Z.domain.trim():"",Y=typeof Z.distinctId==="string"&&Z.distinctId.trim()&&Z.distinctId.length<=200?Z.distinctId.trim():void 0;return{domain:Q,distinctId:Y}}var xr6,wO,FJ8=async($,Z)=>{if(!$.get("reportUser"))return $.json({error:"Authentication required"},401);await Z();return},UJ8;var NJ8=D(()=>{J8();Q3();oB();JO1();xr6=new Set(["complete","errored","terminated","unknown"]);wO=new $1;wO.use("*",async($,Z)=>{let Q=await x8.api.getSession({headers:$.req.raw.headers});$.set("reportUser",Q?.user?.id?{email:Q.user.email}:void 0),await Z(),$.header("Cache-Control","private, no-store"),$.header("Vary","Cookie");return});wO.use("/link-token/*",FJ8);wO.use("/suggest",FJ8);wO.get("/site/:domain",async($)=>{let Z=$.req.param("domain").trim();if(!Z)return $.json({error:"domain is required"},400);let Q=$.req.query("lang")?.trim()||void 0;try{return $.json(await br6(Z,Q))}catch{return $.json({error:"report read failed"},502)}});wO.post("/run",async($)=>{let Z=$.get("reportUser"),Q;try{Q=await $.req.json()}catch{return $.json({error:"invalid JSON"},400)}let{domain:Y,distinctId:X}=fr6(Q);if(!Y)return $.json({error:"domain is required"},400);let J=Z?.email;try{let G=await w_0("/api/v2/diagnostics/run",{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${sw({})}`},body:JSON.stringify({url:Y,...J?{email:J}:{},distinct_id:X})});if(!G.ok)return $.json({error:`run HTTP ${G.status}`},502);let W=await G.json(),K=W.blocked?{state:"blocked"}:W.status==="fresh"?{state:"fresh"}:W.mode==="sync"?{state:"sync"}:{state:"running",id:W.id??null};return $.json(K)}catch{return $.json({error:"run failed"},502)}});wO.get("/status",async($)=>{let Z=$.req.query("id");if(!Z)return $.json({error:"id is required"},400);try{let Q=await w_0(`/api/v2/diagnostics/status?id=${encodeURIComponent(Z)}`,{headers:{Authorization:`Bearer ${sw({})}`}});if(!Q.ok)return $.json({error:`status HTTP ${Q.status}`},502);let X=(await Q.json()).status??"unknown",J={done:xr6.has(X),status:X};return $.json(J)}catch{return $.json({error:"status failed"},502)}});wO.get("/link-token/:id",async($)=>{let Z=$.req.param("id");try{let Q=await w_0(`/api/v2/public/link-tokens/${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(Q.status===404)return $.json(null);if(!Q.ok)return $.json({error:`link token HTTP ${Q.status}`},502);return $.json(await Q.json())}catch{return $.json({error:"link token resolve failed"},502)}});wO.get("/suggest",async($)=>{let Z=($.req.query("q")??"").trim().slice(0,64);if(Z.length<2)return $.json({suggestions:[]});try{let Q=await w_0(`/api/v2/public/suggest?q=${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(!Q.ok)return $.json({suggestions:[]});let Y=await Q.json();return $.json({suggestions:Array.isArray(Y.suggestions)?Y.suggestions:[]})}catch{return $.json({suggestions:[]})}});UJ8=wO});var yr6=1048576,GO1;var BJ8=D(()=>{J8();QK();$$();$N1();GO1=new $1;GO1.post("/webhook",x5({maxSize:yr6,onError:($)=>$.json({error:"payload too large"},413)}),async($)=>{let Z=j0().stripeWebhookSecret;if(!Z)return $.json({error:"stripe billing not configured"},503);let Q=await $.req.text();if(!c48(Q,$.req.header("stripe-signature"),Z))return $.json({error:"invalid signature"},400);let X=m48(Q);if(!X)return $.json({error:"invalid payload"},400);let J=await d48(X);return console.log("stripe webhook",{eventId:X.id,type:X.type,livemode:X.livemode,...J}),$.json({received:!0})})});import{timingSafeEqual as gr6}from"crypto";function lr6($,Z,Q){if(!Z?.startsWith("sha256="))return!1;let Y=new Bun.CryptoHasher("sha256",Q).update($).digest("hex"),X=Z.slice(7);if(X.length!==Y.length)return!1;return gr6(Buffer.from(X),Buffer.from(Y))}function cr6($,Z){let Q=Z,Y=Q?.repository?.name,X=Q?.repository?.owner?.login;if(typeof Y!=="string"||typeof X!=="string")return[];let J=[];if($==="check_suite"){if(Q.action!=="completed")return[];let G=Q.check_suite?.pull_requests;for(let W of Array.isArray(G)?G:[]){let K=W?.number;if(typeof K==="number")J.push(K)}}else if($==="issue_comment"&&Q.issue?.pull_request){let G=Q.issue.number;if(typeof G==="number")J.push(G)}return[...new Set(J)].map((G)=>({repoOwner:X,repoName:Y,number:G}))}function DJ8($){let Z=new $1;return Z.post("/webhook",x5({maxSize:hr6,onError:(Q)=>Q.json({error:"payload too large"},413)}),async(Q)=>{let Y=process.env.GITHUB_WEBHOOK_SECRET;if(!Y)return Q.json({error:"github webhook not configured"},503);let X=await Q.req.text();if(!lr6(X,Q.req.header("x-hub-signature-256"),Y))return Q.json({error:"invalid signature"},400);let J=Q.req.header("x-github-event");if(J!=="push"&&!ur6.has(J??""))return Q.json({ok:!0,ignored:"event"});let G;try{G=JSON.parse(X)}catch{return Q.json({error:"invalid payload"},400)}if(J==="push"){let H=G.ref,F=G.repository?.full_name;if(!H||!F)return Q.json({ok:!0,ignored:"shape"});return y10().then((U)=>U?.markTenantPoolsDirty(`https://github.com/${F}`,H)).catch((U)=>console.warn(`[github-webhook] tenant pool refresh for ${F}@${H} failed: ${U instanceof Error?U.message:String(U)}`)),Q.json({ok:!0})}let W=cr6(J??"",G);if(W.length===0)return Q.json({ok:!0,ignored:"no-pr"});let K=await mr6($,W);return Q.json({ok:!0,refreshed:K})}),Z}async function mr6($,Z){let Q=0;for(let Y of Z){let X=$.taskBoard(),J;try{J=await X.findPrLinks(Y)}catch(G){console.error("[github-webhook] pr link lookup failed:",G);continue}for(let G of J)try{let W=await X.getById(G.taskBoardItemId,G.organizationId),K=W?await $.contextFactory()(G.organizationId,W.assignedBy??W.createdBy):null;if(!K)continue;if(await Bx$(K,G.organizationId,G.taskBoardItemId)!==null)Q++}catch(W){console.error(`[github-webhook] pr card refresh failed for ${G.taskBoardItemId}:`,W)}}return Q}var hr6=5242880,ur6;var OJ8=D(()=>{J8();QK();yW();x7();ur6=new Set(["check_suite","issue_comment"])});import{DBOS as KO1,SchedulerMode as dr6}from"@dbos-inc/dbos-sdk";async function pr6(){try{return await nr6()}catch($){return console.warn(`[sandbox-credential-push] push failed: ${$ instanceof Error?$.message:String($)}`),null}}async function nr6(){if(!f10())return null;let[{RemoteSandboxProvider:$},{SandboxProviderRouter:Z}]=await Promise.all([Promise.resolve().then(() => (h91(),g91)),Promise.resolve().then(() => (y91(),f91))]),Q=await y10(),Y=Q instanceof Z?Q.providers.kubernetes:Q;if(!(Y instanceof $))return null;let{db:X}=O8(),{sandboxes:J,pools:G}=await Y.list(),W=Date.now(),K=qT$({sandboxes:J,pools:G,records:await MT$(X,J,G),legacyPools:wT0(process.env.STUDIO_SANDBOX_TENANT_POOLS),now:W}),{batches:H,failed:F}=await IT$(K,gH0(X,new BX(j0().encryptionKey)),{now:W,orgFsLifetimeMs:zT0}),U=0,N=0,B=0;for(let O of H)try{let L=await Y.pushCredentials(O);U+=L.stored,N+=L.kept}catch(L){B++,console.warn(`[sandbox-credential-push] a push batch failed: ${L instanceof Error?L.message:String(L)}`)}return{sandboxes:J.length,pushed:U,kept:N,refused:K.refused,failed:F+B}}async function tr6($,Z){let Q=await KO1.runStep(pr6,{name:"pushSandboxCredentials"});if(Q&&(Q.refused>0||Q.failed>0))console.warn(`[sandbox-credential-push] ${Q.sandboxes} sandboxes: pushed ${Q.pushed}, kept ${Q.kept}, refused ${Q.refused}, failed ${Q.failed}`)}function LJ8(){if(WO1)return;if(!j0().agentSandboxEnabled||!f10())return;WO1=KO1.registerWorkflow(tr6,{name:"sandboxCredentialPushWorkflow"}),KO1.registerScheduled(WO1,{name:"sandboxCredentialPushWorkflow",crontab:ir6,mode:dr6.ExactlyOncePerIntervalWhenActive})}var ir6="1-59/10 * * * *",WO1=null;var wJ8=D(()=>{CG();DL();I41();PT0();jT0();yW();$$()});function jJ8($){let Z=new XO($.db,new BX($.encryptionKey)),Q=new $1;return Q.get("/attachments/:token",async(Y)=>{let X=Pv$(Y.req.param("token"));if(!X)return Y.json({error:"Invalid or expired link"},404);let J=await Z.getByOrg(X.organizationId);if(!J)return Y.json({error:"Jira is not connected"},404);let W=await new dQ(J.siteUrl,J.email,J.apiToken).downloadAttachment(X.attachmentId);if(!W.ok||!W.body)return Y.json({error:"Jira refused the download"},502);let K=new Headers;for(let H of["content-type","content-length","content-disposition"]){let F=W.headers.get(H);if(F)K.set(H,F)}return K.set("cache-control","no-store"),new Response(W.body,{status:200,headers:K})}),Q}var EJ8=D(()=>{J8();DL();$Q1();UE();Y60()});import{DBOS as Xz,SchedulerMode as or6}from"@dbos-inc/dbos-sdk";function zJ8($){FO1=$}function NO1(){if(!FO1)throw Error("[jira-trigger] runtime not initialized \u2014 setJiraTriggerSweepRuntime() must run before the workflow fires");return FO1}function BO1(){let $=NO1();return new XO($.db,new BX($.encryptionKey))}async function $s6($){try{let Z=await BO1().getById($);if(!Z?.enabled||!Z.boardId)return{integrationId:$,started:0};let Q=await VH(NO1().db,Z.organizationId);if(!Q)return{integrationId:$,started:0};if((await Q.storage.jiraIntegrations.listAutomations(Z.organizationId)).length===0)return{integrationId:$,started:0};let X=new dQ(Z.siteUrl,Z.email,Z.apiToken),G=`(${await X.getBoardScopeJql(Z.boardId)}) AND status CHANGED AFTER "-${sr6}m"`,W=0,K;for(let H=0;H<ar6;H++){let F=await X.searchIssues({jql:G,nextPageToken:K});for(let U of F.issues)if(await KF1(Q,Z,{issueId:U.id,now:Date.now()})==="started")W++;if(K=F.nextPageToken??void 0,!K)break}return{integrationId:$,started:W}}catch(Z){return{integrationId:$,started:0,error:Z instanceof Error?Z.message:String(Z)}}}async function Zs6($,Z){let Q=await Xz.runStep(()=>BO1().listEnabledIds(),{name:"loadJiraIntegrations"});if(Q.length===0)return;let Y=await Promise.all(Q.map((X)=>Xz.runStep(()=>$s6(X),{name:`sweepJira:${X}`})));for(let X of Y)if(X.error)console.warn(`[jira-trigger] integration ${X.integrationId} failed: ${X.error}`);else if(X.started>0)console.log(`[jira-trigger] integration ${X.integrationId} started ${X.started} run(s) the webhook missed`)}async function Qs6($,Z){try{let Q=await BO1().getById($);if(!Q?.enabled)return"disabled";let Y=await VH(NO1().db,Q.organizationId);if(!Y)return"disabled";let X=await KF1(Y,Q,{issueId:Z.issueId,changelogId:Z.changelogId});if(X==="started")console.log(`[jira-trigger] started a run for ${Z.issueKey} after it settled`);else if(X==="returned")console.log(`[jira-trigger] ${Z.issueKey} went back where it was before settling in "${Z.toStatus}"; no run`);return X}catch(Q){return console.error(`[jira-trigger] settling ${Z.issueKey} failed`,Q instanceof Error?Q.message:Q),"error"}}async function Ys6($,Z){await Xz.sleep(nk0()+er6),await Xz.runStep(()=>Qs6($,Z),{name:"settleJiraMove"})}async function PJ8($,Z){if(!UO1)throw Error("[jira-trigger] settle workflow is not registered");await Xz.startWorkflow(UO1,{workflowID:`jira-settle:${$}:${Z.changelogId}`})($,Z)}function AJ8(){if(HO1)return;UO1=Xz.registerWorkflow(Ys6,{name:"jiraSettleWorkflow"}),HO1=Xz.registerWorkflow(Zs6,{name:"jiraTriggerSweepWorkflow"}),Xz.registerScheduled(HO1,{name:"jiraTriggerSweepWorkflow",crontab:rr6,mode:or6.ExactlyOncePerIntervalWhenActive})}var rr6="7-59/10 * * * *",sr6=35,ar6=5,er6=5000,FO1=null,UO1=null,HO1=null;var DO1=D(()=>{DL();Y60();_d();UE();GF1();tk0()});function TJ8($){let Z=new XO($.db,new BX($.encryptionKey));async function Q(X,J){let G=H08(J);if(!G)return;let W=await Z.getByWebhookSecret(X);if(!W?.enabled)return;if((await Z.listAutomations(W.organizationId)).length===0)return;await PJ8(W.id,G)}let Y=new $1;return Y.post("/webhook/:secret",x5({maxSize:Xs6}),async(X)=>{let J=X.req.param("secret");if(!await Z.getByWebhookSecret(J))return X.json({error:"Unknown webhook"},404);let W;try{W=await X.req.json()}catch{return X.json({error:"Body must be JSON"},400)}return Q(J,W).catch((K)=>{console.error("[jira-webhook] trigger failed",K)}),X.body(null,202)}),Y}var Xs6=1048576;var RJ8=D(()=>{J8();QK();DL();DO1();tk0();Y60()});function qJ8($,Z){if(Z.startsWith("text/html")||Z.startsWith("image/svg"))$.set("Content-Security-Policy","sandbox allow-scripts allow-modals allow-same-origin")}var MJ8,Js6,Gs6,IJ8;var VJ8=D(()=>{J8();wJ();ud();ac();MJ8=new $1,Js6=["range","if-none-match","if-modified-since"],Gs6=["content-type","content-length","content-range","accept-ranges","etag","last-modified"];MJ8.get("/:org/files/*",async($)=>{let Z=$.get("studioContext"),Q=Z.organization?.id;if(!Z.auth?.user?.id){if(Hp($))return $.redirect(`/login?next=${encodeURIComponent($.req.path)}`,302);throw new q1(401,{message:"Authentication required"})}if(!Q)throw new q1(401,{message:"Organization context required"});let Y=$.req.path.replace(/^.*\/files\//,"");if(!Y)throw new q1(400,{message:"Missing file key"});let X=await N80(Y,Z);if(!X)throw new q1(503,{message:"Object storage not configured"});if(X.startsWith("data:")&&qW()){let K=X.match(/^data:([^;]+);base64,(.+)$/s);if(!K)throw new q1(500,{message:"Invalid data URL from storage"});let[,H,F]=K,U=Buffer.from(F,"base64"),N=new Headers({"Content-Type":H,"Cache-Control":"private, max-age=86400"});return qJ8(N,H),new Response(U,{status:200,headers:N})}let J=new Headers;for(let K of Js6){let H=$.req.header(K);if(H)J.set(K,H)}let G=await fetch(X,{headers:J});if(G.status===403||G.status===404)throw new q1(404,{message:"File not found"});if(!G.ok&&G.status!==304&&G.status!==416)throw console.error(`[files] upstream storage error ${G.status} for key:`,Y),new q1(502,{message:"Upstream storage error"});let W=new Headers;for(let K of Gs6){let H=G.headers.get(K);if(H)W.set(K,H)}return W.set("Cache-Control","private, max-age=86400"),qJ8(W,W.get("content-type")??""),new Response(G.body,{status:G.status,headers:W})});IJ8=MJ8});var Q50=b((Zg)=>{var Ws6=Zg&&Zg.__createBinding||(Object.create?function($,Z,Q,Y){if(Y===void 0)Y=Q;var X=Object.getOwnPropertyDescriptor(Z,Q);if(!X||("get"in X?!Z.__esModule:X.writable||X.configurable))X={enumerable:!0,get:function(){return Z[Q]}};Object.defineProperty($,Y,X)}:function($,Z,Q,Y){if(Y===void 0)Y=Q;$[Y]=Z[Q]}),Ks6=Zg&&Zg.__exportStar||function($,Z){for(var Q in $)if(Q!=="default"&&!Object.prototype.hasOwnProperty.call(Z,Q))Ws6(Z,$,Q)};Object.defineProperty(Zg,"__esModule",{value:!0});Ks6(LG(),Zg)});var CJ8=b((kJ8)=>{Object.defineProperty(kJ8,"__esModule",{value:!0});kJ8.version=void 0;kJ8.version="3.4.0"});var bJ8=b((AN)=>{var Hs6=AN&&AN.__importDefault||function($){return $&&$.__esModule?$:{default:$}};Object.defineProperty(AN,"__esModule",{value:!0});AN.NodeTransport=AN.VERSION=void 0;AN.nodeResolveHost=Os6;var s5=Q50(),Fs6=M0("net"),OO1=M0("tls"),Us6=M0("path"),_J8=M0("fs"),Ns6=Hs6(M0("dns")),Bs6=CJ8();AN.VERSION=Bs6.version;var Ds6="nats.js";class vJ8{socket;version;lang;yields=[];signal=(0,s5.deferred)();closedNotification=(0,s5.deferred)();options;connected=!1;tlsName="";done=!1;closeError;constructor(){this.lang=Ds6,this.version=AN.VERSION}async connect($,Z){this.tlsName=$.tlsName,this.options=Z;let{tls:Q}=this.options,{handshakeFirst:Y}=Q||{};try{if(Y===!0)this.socket=await this.tlsFirst($);else this.socket=await this.dial($);if(this.done)this.socket?.destroy();let X=await this.peekInfo();(0,s5.checkOptions)(X,Z);let{tls_required:J,tls_available:G}=X,W=G===!0&&Z.tls!==null;if(!Y&&(J||W))this.socket=await this.startTLS();if(this.done)this.socket?.destroy();if(J&&this.socket.encrypted!==!0)throw s5.errors.InvalidArgumentError.format("tls","is not available on this server");return this.connected=!0,this.setupHandlers(),this.signal.resolve(),Promise.resolve()}catch(X){let J=X;if(!J)J=new s5.errors.ConnectionError("error connecting - node provided an undefined error");let{code:G}=J,W=G==="ECONNREFUSED"?new s5.errors.ConnectionError("connection refused",{cause:J}):J;throw this.socket?.destroy(),W}}dial($){let Z=(0,s5.deferred)(),Q,Y=(0,Fs6.createConnection)($.port,$.hostname,()=>{Z.resolve(Y),Y.removeAllListeners()});return Y.on("error",(X)=>{Q=X}),Y.on("close",()=>{Y.removeAllListeners(),Z.reject(Q)}),Y.setNoDelay(!0),Z}get isClosed(){return this.done}close($){return this._closed($,!1)}peekInfo(){let $=(0,s5.deferred)(),Z;return this.socket.on("data",(Q)=>{this.yields.push(Q);let Y=s5.DataBuffer.concat(...this.yields),X=(0,s5.extractProtocolMessage)(Y);if(X!=="")try{let J=s5.INFO.exec(X);if(!J)throw Error("unexpected response from server");let G=JSON.parse(J[1]);$.resolve(G)}catch(J){$.reject(J)}finally{this.socket.removeAllListeners()}}),this.socket.on("error",(Q)=>{Z=Q}),this.socket.on("close",()=>{this.socket.removeAllListeners(),$.reject(Z)}),$}loadFile($){if(!$)return Promise.resolve();let Z=(0,s5.deferred)();try{if($=(0,Us6.resolve)($),!(0,_J8.existsSync)($))Z.reject(Error(`${$} doesn't exist`));(0,_J8.readFile)($,(Q,Y)=>{if(Q)return Z.reject(Q);Z.resolve(Y)})}catch(Q){Z.reject(Q)}return Z}async loadClientCerts(){let $={},{certFile:Z,cert:Q,caFile:Y,ca:X,keyFile:J,key:G}=this.options.tls;try{if(Z){let W=await this.loadFile(Z);if(W)$.cert=W}else if(Q)$.cert=Q;if(J){let W=await this.loadFile(J);if(W)$.key=W}else if(G)$.key=G;if(Y){let W=await this.loadFile(Y);if(W)$.ca=[W]}else if(X)$.ca=X;return Promise.resolve($)}catch(W){return Promise.reject(W)}}async tlsFirst($){let Z,Q={servername:this.tlsName,rejectUnauthorized:!0};if(this.socket)Q.socket=this.socket;if(typeof this.options.tls==="object")try{let X=await this.loadClientCerts()||{};Q=(0,s5.extend)(Q,this.options.tls,X)}catch(X){return Promise.reject(new s5.errors.ConnectionError(X.message,{cause:X}))}let Y=(0,s5.deferred)();try{let X=(0,OO1.connect)($.port,$.hostname,Q,()=>{X.removeAllListeners(),Y.resolve(X)});X.on("error",(J)=>{Z=J}),X.on("secureConnect",()=>{if(Q.rejectUnauthorized===!1)return;if(!X.authorized)throw X.authorizationError}),X.on("close",()=>{Y.reject(Z),X.removeAllListeners()}),X.setNoDelay(!0)}catch(X){Y.reject(new s5.errors.ConnectionError(X.message,{cause:X}))}return Y}async startTLS(){let $,Z={socket:this.socket,servername:this.tlsName,rejectUnauthorized:!0};if(typeof this.options.tls==="object")try{let Y=await this.loadClientCerts()||{};Z=(0,s5.extend)(Z,this.options.tls,Y)}catch(Y){return Promise.reject(new s5.errors.ConnectionError(Y.message,{cause:Y}))}let Q=(0,s5.deferred)();try{let Y=(0,OO1.connect)(Z,()=>{Y.removeAllListeners(),Q.resolve(Y)});Y.on("error",(X)=>{$=X}),Y.on("secureConnect",()=>{if(Z.rejectUnauthorized===!1)return;if(!Y.authorized)throw Y.authorizationError}),Y.on("close",()=>{Q.reject($),Y.removeAllListeners()})}catch(Y){Q.reject(new s5.errors.ConnectionError(Y.message,{cause:Y}))}return Q}setupHandlers(){let $;this.socket.on("data",(Z)=>{return this.yields.push(Z),this.signal.resolve()}),this.socket.on("error",(Z)=>{$=Z}),this.socket.on("end",()=>{if(this.socket?.destroyed)return;this.socket?.write(new Uint8Array(0),()=>{this.socket?.end()})}),this.socket.on("close",()=>{this._closed($,!1)})}[Symbol.asyncIterator](){return this.iterate()}async*iterate(){while(!0){if(this.yields.length===0)await this.signal;let $=this.yields;this.yields=[];for(let Z=0;Z<$.length;Z++){if(this.options.debug)console.info(`> ${(0,s5.render)($[Z])}`);yield $[Z]}if(this.done)break;else if(this.yields.length===0)$.length=0,this.yields=$,this.signal=(0,s5.deferred)()}}discard(){if(this.done=!0,this.socket)try{this.socket.removeAllListeners(),this.socket.destroy()}catch{}}disconnect(){this._closed(void 0,!0).then().catch()}isEncrypted(){return this.socket instanceof OO1.TLSSocket}_send($){if(this.isClosed||this.socket===void 0)return Promise.resolve();if(this.options.debug)console.info(`< ${(0,s5.render)($)}`);let Z=(0,s5.deferred)();try{this.socket.write($,(Q)=>{if(Q){if(this.options.debug)console.error(`!!! ${(0,s5.render)($)}: ${Q}`);return Z.reject(Q)}return Z.resolve()})}catch(Q){if(this.options.debug)console.error(`!!! ${(0,s5.render)($)}: ${Q}`);Z.reject(Q)}return Z}send($){this._send($).catch((Q)=>{})}async _closed($,Z=!0){if(!this.connected)return;if(this.done){this.socket?.destroy();return}if(this.closeError=$,!$&&this.socket&&Z)try{await this._send(new TextEncoder().encode(""))}catch(Q){if(this.options.debug)console.log("transport close terminated with an error",Q)}try{if(this.socket)this.socket.removeAllListeners(),this.socket?.destroy(),this.socket=void 0}catch(Q){console.log(Q)}this.done=!0,this.closedNotification.resolve(this.closeError)}closed(){return this.closedNotification}}AN.NodeTransport=vJ8;function Os6($){let Z=(0,s5.deferred)();return Ns6.default.lookup($,{all:!0},(Q,Y)=>{if(Q){Z.reject(Q);return}let X=[];for(let J of Y)X.push(J.address);if(X.length===0)X.push($);Z.resolve(X)}),Z}});var hJ8=b((gJ8)=>{Object.defineProperty(gJ8,"__esModule",{value:!0});gJ8.connect=Ls6;var xJ8=bJ8(),fJ8=Q50(),yJ8=Q50();function Ls6($={}){if((0,yJ8.hasWsProtocol)($))return Promise.reject(yJ8.errors.InvalidArgumentError.format("servers","node client doesn't support websockets, use the 'wsconnect' function instead"));return(0,fJ8.setTransportFactory)({factory:()=>{return new xJ8.NodeTransport},dnsResolveFn:xJ8.nodeResolveHost}),fJ8.NatsConnectionImpl.connect($)}});var uJ8=b((jO)=>{var js6=jO&&jO.__createBinding||(Object.create?function($,Z,Q,Y){if(Y===void 0)Y=Q;var X=Object.getOwnPropertyDescriptor(Z,Q);if(!X||("get"in X?!Z.__esModule:X.writable||X.configurable))X={enumerable:!0,get:function(){return Z[Q]}};Object.defineProperty($,Y,X)}:function($,Z,Q,Y){if(Y===void 0)Y=Q;$[Y]=Z[Q]}),Es6=jO&&jO.__exportStar||function($,Z){for(var Q in $)if(Q!=="default"&&!Object.prototype.hasOwnProperty.call(Z,Q))js6(Z,$,Q)};Object.defineProperty(jO,"__esModule",{value:!0});jO.connect=void 0;var zs6=hJ8();Object.defineProperty(jO,"connect",{enumerable:!0,get:function(){return zs6.connect}});Es6(Q50(),jO)});function dJ8($){let Z=$?.connectFn??Rs6,Q=null,Y=null,X=!1,J=!1,G=!1,W=[];function K(){return Q!==null&&!Q.isClosed()&&!Q.isDraining()&&!G}function H(){console.log(`[NatsProvider] fireReady: ${W.length} callbacks`);for(let N of W)try{N()}catch{}}function F(N){(async()=>{for await(let B of N.status())if(B.type==="disconnect")console.log("[NatsProvider] Disconnected"),G=!0;else if(B.type==="reconnect")console.log("[NatsProvider] Reconnected, re-firing ready callbacks"),G=!1,Y=null,H()})().catch(()=>{})}async function U(N,B){let O=0;while(!J)try{Q=await Z({servers:N,timeout:Ts6,reconnect:!0,maxReconnectAttempts:-1,...B?{authenticator:B}:{}}),console.log(`[NatsProvider] Connected to ${Q.getServer()} after ${O} attempt(s)`),Y=null,G=!1,F(Q),H();return}catch{O++;let L=D7(As6,Ps6,O-1,2,0.5);await L$(L)}}return{init(N,B){if(X)return;X=!0,J=!1;let O=B?.creds?lJ8.credsAuthenticator(new TextEncoder().encode(B.creds)):void 0;U(N,O).catch(()=>{})},isConnected(){return K()},getConnection(){return K()?Q:null},getJetStream(){if(!K())return null;if(!Y)Y=mJ8.jetstream(Q);return Y},onReady(N){if(W.push(N),K())try{N()}catch{}},async drain(){if(J=!0,X=!1,Y=null,G=!1,Q){let N=Q;Q=null,await N.drain().catch(()=>{})}}}}function Rs6($){return cJ8.connect($)}var lJ8,cJ8,mJ8,Ps6=100,As6=3000,Ts6=3000;var iJ8=D(()=>{a$();lJ8=C(Tz(),1),cJ8=C(uJ8(),1),mJ8=C(LK(),1)});function j_0($){let Z=$?.ttlMs??60000,Q=$?.maxSize??1e4,Y=$?.updateRecencyOnGet??!1,X=new Map;function J(){if(X.size<=Q)return;let G=Date.now();for(let[W,K]of X)if(K.expiresAt<=G)X.delete(W);while(X.size>Q){let W=X.keys().next().value;if(W===void 0)break;X.delete(W)}}return{get(G){let W=X.get(G);if(!W)return;if(W.expiresAt<=Date.now()){X.delete(G);return}if(Y)X.delete(G),X.set(G,W);return W.value},set(G,W){X.delete(G),X.set(G,{value:W,expiresAt:Date.now()+Z}),J()},delete(G){X.delete(G)},clear(){X.clear()},size(){return X.size}}}function E_0($,Z){return`${$}.${Z}`}class LO1{cache;constructor($){this.cache=j_0({ttlMs:$?.ttlMs??qs6,maxSize:$?.maxSize??Ms6})}async get($,Z){return this.cache.get(E_0($,Z))??null}async set($,Z,Q){this.cache.set(E_0($,Z),Q)}async invalidate($,Z){this.cache.delete(E_0($,Z)),this.cache.delete(E_0($,`${Z}:decisions`))}teardown(){this.cache.clear()}}var qs6=600000,Ms6=5000;var pJ8=()=>{};function z_0($,Z){return`${$}:${Z}`}function wO1($){let Z=j_0({ttlMs:$?.ttlMs??Is6,maxSize:$?.maxSize??Vs6}),Q=$?.getConnection,Y=crypto.randomUUID(),X=new TextEncoder,J=new TextDecoder,G=null;function W(K,H){let F=Q?.();if(!F)return;try{F.publish(nJ8,X.encode(JSON.stringify({organizationId:K,keyId:H,originId:Y})))}catch(U){console.warn("[ProviderKeyCache] Publish failed (non-critical):",U)}}return{get(K,H){return Z.get(z_0(K,H))},set(K,H,F){Z.set(z_0(K,H),F)},invalidate(K,H){Z.delete(z_0(K,H)),W(K,H)},start(){if(G)return;let K=Q?.();if(!K)return;G=K.subscribe(nJ8),(async()=>{for await(let H of G)try{let F=JSON.parse(J.decode(H.data));if(F.originId===Y)continue;Z.delete(z_0(F.organizationId,F.keyId))}catch{}})().catch(console.error)},teardown(){G?.unsubscribe(),G=null,Z.clear()}}}var nJ8="studio.ai-provider-keys.invalidate",Is6=30000,Vs6=5000;var tJ8=()=>{};class jO1{options;subscription=null;onCancel=null;encoder=new TextEncoder;originId=crypto.randomUUID();constructor($){this.options=$}async start($){if($)this.onCancel=$;if(this.subscription)return;if(!this.onCancel)return;let Z=this.options.getConnection();if(!Z)return;let Q=new TextDecoder,Y=Z.subscribe("studio.decopilot.cancel");this.subscription=Y,(async()=>{for await(let X of Y)try{let J=JSON.parse(Q.decode(X.data));if(J.originId===this.originId)continue;this.onCancel?.(J.taskId)}catch{}})().catch(console.error)}broadcast($){if(/[.*>\s]/.test($)){console.warn("[NatsCancelBroadcast] Invalid threadId, skipping broadcast");return}this.onCancel?.($);try{let Z=this.options.getConnection();if(!Z)return;let Q=this.encoder.encode(JSON.stringify({taskId:$,originId:this.originId}));Z.publish("studio.decopilot.cancel",Q)}catch(Z){console.warn("[NatsCancelBroadcast] Publish failed (non-critical):",Z)}}async stop(){this.subscription?.unsubscribe(),this.subscription=null,this.onCancel=null}}var oJ8=($)=>{let Z;return()=>Z??=$()},EO1,zO1;var rJ8=D(()=>{k6();EO1=oJ8(()=>Z$.createHistogram("decopilot.stream.encode_ms",{description:"Per-chunk JSON.stringify+encode time for decopilot stream",unit:"ms"})),zO1=oJ8(()=>Z$.createCounter("decopilot.stream.published_chunks",{description:"Logical decopilot stream chunks published to JetStream",unit:"{chunks}"}))});function xs6($=eJ8){return{name:oU,subjects:[`${UX1}.>`],storage:nH.StorageType.File,max_age:Cs6,max_bytes:vs6,max_msgs_per_subject:bs6,discard:nH.DiscardPolicy.Old,retention:nH.RetentionPolicy.Limits,duplicate_window:_s6,num_replicas:$}}class $G8{chunks=0;encodeMs=0;maxMs=0;bytes=0;windowStart=performance.now();constructor(){setInterval(()=>this.flush(),1e4).unref?.()}record($,Z){if(this.chunks++,this.encodeMs+=$,$>this.maxMs)this.maxMs=$;this.bytes+=Z}flush(){let $=performance.now(),Z=$-this.windowStart;if(this.chunks>0&&Z>0)console.warn(JSON.stringify({msg:"stream-encode-trace",windowMs:Math.round(Z),chunks:this.chunks,encodeMs:Math.round(this.encodeMs),pctOfLoop:+(this.encodeMs/Z*100).toFixed(1),maxChunkMs:+this.maxMs.toFixed(2),mbEncoded:+(this.bytes/1048576).toFixed(2)}));this.chunks=0,this.encodeMs=0,this.maxMs=0,this.bytes=0,this.windowStart=$}}function sJ8($){let Z=aJ8.headers();for(let[Q,Y]of Object.entries($))Z.set(Q,Y);return Z}function hs6($,Z){let Q=0;return{publish(Y,X,J,G){Y.publish(X,J,G?{headers:G}:void 0).catch((W)=>{if(Q++,Ss6().add(1,{"org.id":Z??"unknown"}),Q===1||Q%100===0)console.warn(`[Decopilot] JetStream publish failed for thread ${$} (${Q} total):`,W)})},get errorCount(){return Q}}}function us6($,Z){return $.info?.cluster?Z:1}function ls6($){if(!($ instanceof Error))return!1;if(/non-clustered/i.test($.message))return!0;return/replicas?\b/i.test($.message)&&/not supported|can ?not|exceed|insufficient|greater than/i.test($.message)}class PO1{options;js=null;jsm=null;constructor($){this.options=$}async init(){let $=this.options.getConnection();if(!$){console.log("[Decopilot] StreamBuffer.init skipped: NATS not connected yet");return}let Z=async(Y,X)=>{let J=xs6(X);try{await Y.streams.info(oU),await Y.streams.update(oU,J)}catch(G){if(G instanceof Error&&G.message.includes("stream not found"))await Y.streams.add(J),await Y.streams.update(oU,J);else if(G instanceof Error&&/can ?not change.*storage|storage type/i.test(G.message))await Y.streams.delete(oU),await Y.streams.add(J);else throw G}},Q=await E8(async()=>{let Y=this.options.getJetStreamManager?await this.options.getJetStreamManager():await nH.jetstreamManager($),X=us6($,eJ8);try{await Z(Y,X)}catch(J){if(X<=1||!ls6(J))throw J;console.warn(`[Decopilot] StreamBuffer: NATS rejected num_replicas=${X} (${J.message}); falling back to an unreplicated stream`),await Z(Y,1)}return Y},{maxAttempts:5,minTimeout:250,maxTimeout:4000,jitter:0.5,isRetriable:td});this.js=this.options.getJetStream(),this.jsm=Q,console.log(`[Decopilot] StreamBuffer.init ${this.js?"ready":"degraded (js=null)"}`)}pump($,Z,Q,Y){let X=this.js;if(!X)return console.warn(`[Decopilot] pump: JetStream client unavailable for thread ${Z}; chunks NOT published to NATS`),Promise.resolve();let J=hs6(Z,Y),G=!1,W=()=>{if(G)return;G=!0;let H=ey$(Z);X.publish(H.subject,H.data).catch(()=>{})};Q.addEventListener("abort",W,{once:!0});let K=(H)=>{let F=performance.now(),U=BX1(H,{runId:Z}),N=performance.now()-F;EO1().record(N),zO1().add(1,{"org.id":Y??"unknown"}),gs6?.record(N,U.reduce((B,O)=>B+O.data.length,0));for(let B of U)J.publish(X,B.subject,B.data,B.headers?sJ8(B.headers):void 0)};return(async()=>{let H=$.getReader(),F=0,U=0,N;try{while(!0){let{done:B,value:O}=await H.read();if(B)break;if(K(O),U++,++F>=64)F=0,await new Promise((L)=>setImmediate(L))}}catch(B){N=B,console.warn(`[Decopilot] stream pump error for thread ${Z}:`,B?.message??B)}finally{if(H.releaseLock(),W(),ys6)console.warn(JSON.stringify({msg:"decopilot-stream-diag",event:"pump-done",taskId:Z,publishedChunks:U,publishErrors:J.errorCount}))}if(N!==void 0)throw N})()}async publishSerialized($,Z){try{return await E8(()=>$.publish(Z.subject,Z.data,{...Z.headers?{headers:sJ8(Z.headers)}:{},...Z.msgId?{msgID:Z.msgId}:{}}),{maxAttempts:6,minTimeout:250,maxTimeout:5000,jitter:0.5,isRetriable:td}),!0}catch(Q){return console.error(`[Decopilot] publish failed after retries subject=${Z.subject}`,Q),!1}}async publishRawChunk($,Z,Q){let Y=this.js;if(!Y)return!1;let X=performance.now(),J=BX1(Z,{runId:$,dedup:Q});EO1().record(performance.now()-X),zO1().add(1);for(let G of J)if(!await this.publishSerialized(Y,G))return!1;return!0}async publishDone($,Z,Q){let Y=this.js;if(!Y)return!1;let X=ay$({runId:$,fenceToken:Z,finalSeq:Q});return await this.publishSerialized(Y,X)}async createTailStream($,Z,Q){let Y=this.js;if(!Y)return console.warn(`[Decopilot] createTailStream: JetStream client unavailable for thread ${$}; no live tail`),null;let X=Q?.deliverPolicy==="new"?nH.DeliverPolicy.New:nH.DeliverPolicy.All,J=Q?.closeOnDone??!1,G=EE($),W;try{W=await E8(async()=>{return(await Y.consumers.get(oU,{filter_subjects:G,deliver_policy:X})).consume()},{maxAttempts:6,minTimeout:250,maxTimeout:5000,jitter:0.5,isRetriable:td})}catch(L){return console.warn("[Decopilot] JetStream tail unavailable (non-critical):",L?.message??L),null}let F=wM0({messages:async function*(){try{for await(let L of W)yield{subject:L.subject,data:L.data,headers:L.headers}}finally{W.stop()}}(),onCancel:()=>W.stop()}).pipeThrough(BM0()).pipeThrough(DM0()).getReader(),U=!1,N=()=>{if(U)return;U=!0;try{F.releaseLock()}catch{}},B=!1,O=()=>{if(B)return;B=!0,W.stop(),F.cancel().catch(()=>{}),N()};return Z?.addEventListener("abort",O,{once:!0}),new ReadableStream({async pull(L){for(;;){let{done:w,value:j}=await F.read();if(w){O(),L.close();return}let E=j;if(E.kind==="done"){if(J){O(),L.close();return}continue}L.enqueue(E.chunk);return}},cancel(){O()}})}purge($){if(!this.jsm)return;this.jsm.streams.purge(oU,{filter:EE($)}).catch(()=>{})}teardown(){this.js=null,this.jsm=null}}var nH,aJ8,ks6=($)=>{let Z;return()=>Z??=$()},Ss6,Cs6=86400000000000,_s6=120000000000,vs6=4294967296,eJ8,bs6=500000,fs6,ys6,gs6;var ZG8=D(()=>{a$();DX1();jM0();OM0();k6();rJ8();nH=C(LK(),1),aJ8=C(Tz(),1),Ss6=ks6(()=>Z$.createCounter("decopilot.stream.publish_errors",{description:"Number of JetStream publish failures for decopilot stream chunks",unit:"{errors}"})),eJ8=Math.max(1,Number(process.env.DECOPILOT_STREAM_REPLICAS??3)||3);fs6=process.env.STREAM_ENCODE_TRACE==="1",ys6=process.env.DECOPILOT_STREAM_TRACE==="1";gs6=fs6?new $G8:null});function P_0($,Z,Q,Y){if(!Y)return!1;return $.emit(Z,OF(Q,Y.status,{title:Y.title??void 0,virtualMcpId:Y.virtual_mcp_id??void 0,createdBy:Y.created_by??void 0,triggerId:Y.trigger_id??null,branch:Y.branch??null,harnessId:Y.harness_id??void 0,createdAt:Y.created_at,updatedAt:Y.updated_at})),!0}var QG8=D(()=>{p8()});class AO1{storage;options;timer=null;constructor($,Z={}){this.storage=$;this.options=Z}start(){if(this.timer)return;let $=this.options.intervalMs??300000;this.timer=setInterval(()=>{this.runOnce()},$)}async runOnce(){let $=this.options.staleAfterMs??3600000;try{let Z=await this.storage.sweepAbandoned($);if(Z>0)console.log(`[async-research-sweeper] marked ${Z} stale jobs as abandoned`);return Z}catch(Z){return console.error("[async-research-sweeper] sweep failed",Z),0}}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}function cs6($,Z,Q={}){let Y=$.startsWith("thread:")?RH($,Q):$;return[...new Set([Z,Y].filter((X)=>!!X))]}async function TO1($,Z){let Q=Z.organizationId;try{let Y=await $.storage.taskBoard.linkedThreadIds(Z.id,Q);for(let X of Y){let J=await fU($,X);if(!J?.owner||!J?.name)continue;let G=await $.storage.threads.get(X),W=await sm($,{threadId:X,runBranch:G?.branch}),K=await d00($,Q,T41(J)).catch(()=>null);if(!K){console.warn(`[task-board] no credential for ${J.owner}/${J.name} \u2014 `+`cannot look up ${Z.id}'s change request by branch`);continue}let H=cs6(W,await xT0($,X),{flat:Bf(K.repo.provider)});for(let F of H){let U=await K.readForBranch(F).catch(()=>null);if(!U)continue;return await $.storage.taskBoard.linkPr({taskBoardItemId:Z.id,organizationId:Q,url:U.url,prNumber:U.number,repo:K.repo}),await $.storage.taskBoard.openReviewCycleIfInProgress(Z.id,Q),await L3(Q).catch(()=>{}),console.log(`[task-board] ${Z.id}: linked ${U.url} found on branch ${F}`),!0}}}catch(Y){console.error("[task-board] PR lookup by branch failed",Y)}return!1}var YG8=D(()=>{X7();hW();x7()});async function XG8($,Z,Q){let Y=Z.organizationId;if(!cX(Z))return!1;if(!ff(Q))return!1;if(await $.storage.taskBoard.hasHumanRejectedDone(Z.id,Y))return!1;let X=await $.storage.organizationSettings.get(Y),J=PU(X?.flags),G=await $.storage.taskBoard.update(Z.id,Y,{status:J},Z.updatedBy);return await Z5($,{taskBoardItemId:Z.id,action:"status_changed",actorId:null,data:{from:Z.status,to:J,reason:"pr_merged"}}),w8(Y,G),console.log(`[task-board-review-sweeper] ${Z.id}: linked PR already merged \u2014 moved to ${J}`),!0}var JG8=D(()=>{I4();dY();bd();kH();A9()});function os6($){return $ instanceof CX}function GG8($,Z){return Z-$>=ns6}class RO1{taskBoard;contextFactory;billing;options;timer=null;running=!1;cursor=null;constructor($,Z,Q,Y={}){this.taskBoard=$;this.contextFactory=Z;this.billing=Q;this.options=Y}start(){if(this.timer)return;let $=this.options.intervalMs??ms6;this.timer=setInterval(()=>{this.runOnce()},$),this.timer.unref()}async runOnce(){if(this.running)return 0;this.running=!0;let $=0;try{let Z=this.options.batchSize??is6,Q=this.options.itemIntervalMs??ds6,Y=new Date(Date.now()-Q),X=await this.taskBoard.listItemsPendingReview(Z,this.cursor,Y),J=X.at(-1);this.cursor=X.length===Z&&J?{updatedAt:J.updatedAt,id:J.id}:null;for(let{id:G,organizationId:W}of X)try{if(await this.reconcileItem(G,W,Y))$++}catch(K){console.error(`[task-board-review-sweeper] ${G} failed`,K)}await this.reapNeverStartedThreads(Z),$+=await this.dispatchDueRetries(Z),await this.reactToUnhandledFailures(Z),$+=await this.settleFinishedRunsWithoutPr(Z,Y)}catch(Z){console.error("[task-board-review-sweeper] sweep failed",Z)}finally{this.running=!1}return $}async reapNeverStartedThreads($){try{let Z=await this.taskBoard.failNeverStartedLinkedThreads($,new Date(Date.now()-t71),wY1);for(let Q of Z)console.warn(`[task-board-review-sweeper] failed never-started thread ${Q.threadId} on ${Q.itemId}`)}catch(Z){console.error("[task-board-review-sweeper] reaping failed",Z)}}async reactToUnhandledFailures($){let Z=await this.taskBoard.listItemsStuckAfterFailure($,new Date(Date.now()-ts6));for(let{id:Q,organizationId:Y,threadId:X}of Z)try{console.warn(`[task-board-review-sweeper] reacting to an unhandled failure on ${Q}`),await DY1(this.taskBoard,X,Y),await OY1(this.taskBoard,this.billing,X,Y)}catch(J){console.error(`[task-board-review-sweeper] unhandled-failure reaction for ${Q} failed`,J)}}async settleFinishedRunsWithoutPr($,Z){let Q=0,Y=await this.taskBoard.listItemsFinishedWithoutPr($,Z);for(let{id:X,organizationId:J,finishedAt:G}of Y)try{if(!await this.taskBoard.claimSweep(X,J,Z))continue;let W=await this.taskBoard.getById(X,J);if(!W||W.status!==e1.progress||cX(W)||W.assigneeId!==R8)continue;let K=await this.contextFactory(J,W.assignedBy??W.createdBy);if(!K)continue;if(await TO1(K,W)){if(await this.taskBoard.clearSweepBudget(X,J),await this.reconcileItem(X,J,Z))Q++;continue}if(!GG8(G.getTime(),Date.now()))continue;let H="the run finished without opening a pull request \u2014 there is "+"nothing for a reviewer to review",F=await this.taskBoard.advanceToReviewIfInProgress(X,J,W.updatedBy);if(!F)continue;await this.taskBoard.recordActivity({taskBoardItemId:X,action:"status_changed",actorId:null,data:{from:e1.progress,to:e1.review,reason:H}}).catch(()=>{}),w8(J,F),await SH(K,F,H)}catch(W){console.error(`[task-board-review-sweeper] settling finished run on ${X} failed`,W)}return Q}async dispatchDueRetries($){let Z=0,Q=await this.taskBoard.listItemsDueForRetry($,new Date);for(let{id:Y,organizationId:X,attempts:J}of Q)try{if(!await this.taskBoard.claimDueRetry(Y,X,new Date))continue;let G=await this.taskBoard.getById(Y,X);if(!G||G.status!==e1.progress||G.assigneeId!==R8)continue;let W=await this.contextFactory(X,G.assignedBy??G.createdBy);if(!W)continue;await CH(W,G,{runClass:"retry"}),Z++,console.warn(`[task-board-review-sweeper] re-dispatched ${Y} after a failure (attempt ${J})`)}catch(G){if(console.error(`[task-board-review-sweeper] retry dispatch for ${Y} failed`,G),os6(G)){await this.returnToTodo(Y,X,G instanceof Error?G.message:String(G));continue}await this.taskBoard.scheduleRunRetry(Y,X,J,new Date(Date.now()+ps6)).catch((W)=>console.error(`[task-board-review-sweeper] re-arming ${Y} failed`,W))}return Z}async returnToTodo($,Z,Q){try{let Y=await this.taskBoard.getById($,Z);if(!Y||Y.status!==e1.progress)return;let X=await this.taskBoard.returnToTodoAfterFailure($,Z,Y.updatedBy);if(!X)return;await this.taskBoard.recordActivity({taskBoardItemId:$,action:"status_changed",actorId:null,data:{from:"in_progress",to:"todo",reason:Q}}).catch(()=>{}),w8(Z,X)}catch(Y){console.error(`[task-board-review-sweeper] returning ${$} to todo failed`,Y)}}async handOffReviewWithoutPr($,Z){let Q=await this.taskBoard.listActivity(Z.id,Z.organizationId);if(!GG8(KD(Q,Z.reviewCycleStartedAt),Date.now()))return;await SH($,Z,"no pull request is linked to this task \u2014 there is nothing for a "+"reviewer to review")}async reconcileItem($,Z,Q){if(!await this.taskBoard.claimSweep($,Z,Q))return!1;let Y=await this.taskBoard.getById($,Z);if(!Y)return!1;if(!cX(Y))return!1;let X=Y.assigneeId===R8,J=await this.taskBoard.listPrs($,Z),G=await this.contextFactory(Z,Y.assignedBy??Y.createdBy);if(!G)return!1;if(J.length===0){if(await TO1(G,Y))J=await this.taskBoard.listPrs($,Z);if(J.length===0){if(X)await this.handOffReviewWithoutPr(G,Y);return!1}}let W=await Promise.all(J.map(async(K)=>({...K,...await yd(Z,K)})));if(W.every((K)=>K.state===null))console.warn(`[task-board-review-sweeper] ${$}: no live PR state from GitHub (${W.length} PR(s)) \u2014 proceeding on unknown`);if(await XG8(G,Y,W))return!0;if(await ag$(G,Y))return!0;if(await this.resolveConflictFromSweep(G,Y,W))return!0;if(!X)return!1;if(!FY1(W))return!1;return await xd(G,Y,{previewMatchesHead:UY1(W)}),!0}async resolveConflictFromSweep($,Z,Q){let Y=Q.find((X)=>X.state!=="closed"&&X.conflict===!0);if(!Y)return!1;return await OE($,Z.organizationId,Z,{pr:{number:Y.number,url:Y.url},conflict:!0}).catch((X)=>{return console.error("[task-board-review-sweeper] conflict resolve failed",X),!1})}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}var ms6=60000,ds6=300000,is6=50,ps6=60000,ns6=900000,ts6=120000;var WG8=D(()=>{I4();Iq0();YG8();nU();T80();kH();JG8();A9();SW();jY1();x7();c$0();fd()});import{readdir as rs6,rm as A_0}from"fs/promises";import{join as T_0}from"path";async function R_0($){let Z=new Date;Z.setUTCDate(Z.getUTCDate()-ss6),Z.setUTCHours(0,0,0,0);let Q=0;try{let Y=await Qg($);for(let X of Y)if(/^\d{4}$/.test(X))Q+=await KG8($,X,Z);else if(!X.startsWith(".")){let J=T_0($,X),G=await Qg(J);for(let K of G){if(!/^\d{4}$/.test(K))continue;Q+=await KG8(J,K,Z)}if((await Qg(J)).length===0)await A_0(J,{recursive:!0,force:!0})}}catch(Y){console.warn("monitoring retention cleanup failed:",Y)}return Q}async function KG8($,Z,Q){let Y=0,X=T_0($,Z),J=await Qg(X);for(let W of J){if(!/^\d{2}$/.test(W))continue;let K=T_0(X,W),H=await Qg(K);for(let U of H){if(!/^\d{2}$/.test(U))continue;let N=new Date(`${Z}-${W}-${U}T00:00:00Z`);if(isNaN(N.getTime()))continue;if(N<Q){let B=T_0(K,U);await A_0(B,{recursive:!0,force:!0}),Y++}}if((await Qg(K)).length===0)await A_0(K,{recursive:!0,force:!0})}if((await Qg(X)).length===0)await A_0(X,{recursive:!0,force:!0});return Y}async function Qg($){try{return(await rs6($)).filter((Q)=>!Q.startsWith("."))}catch{return[]}}var ss6=30;var qO1=()=>{};import{DBOS as MO1,SchedulerMode as as6}from"@dbos-inc/dbos-sdk";async function $a6(){let $=[KK(),Ug(),kN()],Z=0;for(let Q of $)try{Z+=await R_0(Q)}catch(Y){console.error("[monitoring-retention] cleanup failed:",Y)}return console.log(`[monitoring-retention] deleted ${Z} day-dir(s) across ${$.length} signal dir(s)`),{deleted:Z,dirs:$.length}}async function Za6($,Z){await MO1.runStep(()=>$a6(),{name:"monitoringRetention"})}function FG8(){if(HG8)return;HG8=!0;let $=MO1.registerWorkflow(Za6,{name:"monitoringRetentionWorkflow"});MO1.registerScheduled($,{name:"monitoringRetentionWorkflow",crontab:es6,mode:as6.ExactlyOncePerIntervalWhenActive})}var es6="23 4 * * *",HG8=!1;var UG8=D(()=>{b3();qO1()});function NG8($){return async(Z,Q)=>{let Y=await $.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.role","organization.id as orgId","organization.slug as orgSlug","organization.name as orgName"]).where("member.userId","=",Q).where("member.organizationId","=",Z).executeTakeFirst();if(!Y)return console.warn(`[automationContextFactory] User ${Q} not found in org ${Z} \u2014 returning null`),null;let X=await iQ.create();X.auth.user={id:Q,role:Y.role},X.organization={id:Y.orgId,slug:Y.orgSlug,name:Y.orgName};let J=await NA($.db,Z,Y.role);return X.boundAuth=pU1({auth:X.authInstance,headers:new Headers,role:Y.role,permissions:J,userId:Q}),X.access=new aP(Q,void 0,X.boundAuth,Y.role,"self"),DE(X,{id:Y.orgId,slug:Y.orgSlug}),X}}var BG8=D(()=>{XW();jU()});function Qa6(){return[{name:"Postgres",status:"pending",port:0},{name:"NATS",status:"pending",port:0}]}function Ya6(){return{services:Qa6(),migrationsStatus:"pending",serverUrl:null,logs:[]}}function Ja6(){for(let $ of Xa6)$()}function DG8($){let Z=[...IO1.logs,$];IO1={...IO1,logs:Z.length>500?Z.slice(-500):Z},Ja6()}function VO1(){return Ga6}var IO1,Xa6,Ga6=!1;var kO1=D(()=>{IO1=Ya6(),Xa6=new Set});import{EventEmitter as Wa6}from"events";var SO1;var OG8=D(()=>{kO1();SO1=new Wa6;SO1.on("request",($)=>{DG8($)})});function LG8(){return async($,Z)=>{let Q=Date.now(),Y=$.req.method,X=$.req.path;if(X==="/api/auth/get-session"||X.includes("favicon")){await Z();return}let J="",G=!1;if(X.startsWith("/mcp")&&Y==="POST"){G=!0;try{if($.req.header("Content-Type")?.includes("application/json")){let N=await $.req.raw.clone().json();if(N.method==="tools/call"&&N.params?.name){let B=dp(N.params.name),O=N.params.arguments||{},L=Object.keys(O).map((j)=>dp(j)),w=L.length>0?L.slice(0,3).join(",")+(L.length>3?"\u2026":""):"";J=`${W9.tool}${B}${W9.dim}(${w})${W9.reset}`}else if(N.method)J=`${W9.dim}${dp(N.method)}${W9.reset}`}}catch{}}let W=dp(X);if(X.startsWith("/mcp/conn_")){let F=X.split("/")[2]??"";W=`/mcp/${W9.mcp}${dp(F.slice(0,12))}\u2026${W9.reset}`}else if(X==="/mcp")W=`${W9.mcp}/mcp${W9.reset}`;else if(X==="/mcp/registry")W=`${W9.mcp}/mcp/registry${W9.reset}`;let K=Ha6(Y),H=G?"\u25C0":"\u2190";if(!VO1())console.log(`${W9.dim}${H}${W9.reset} ${K}${Y}${W9.reset} ${W}${J?` ${J}`:""}`);try{await Z()}finally{let F=Date.now()-Q,U=$.res.status,N=Ka6(U),B=F<1000?`${F}ms`:`${(F/1000).toFixed(1)}s`,O=G?"\u25B6":"\u2192";if(!VO1())console.log(`${W9.dim}${O}${W9.reset} ${K}${Y}${W9.reset} ${W}${J?` ${J}`:""} ${N}${U}${W9.reset} ${W9.duration}${B}${W9.reset}`);SO1.emit("request",{method:Y,path:dp(X),status:U,duration:F,timestamp:new Date})}}}var W9,Ka6=($)=>{if($>=500)return W9.serverError;if($>=400)return W9.clientError;if($>=300)return W9.redirect;return W9.ok},Ha6=($)=>{return W9[$]||W9.reset},dp=($)=>{return $.replace(/\r/g,"").replace(/\n/g,"").replace(/\x1b\[[0-9;]*m/g,"").replace(/[\x00-\x1f\x7f-\x9f]/g,"")};var wG8=D(()=>{kO1();OG8();W9={reset:"\x1B[0m",dim:"\x1B[2m",bold:"\x1B[1m",GET:"\x1B[36m",POST:"\x1B[33m",PUT:"\x1B[35m",DELETE:"\x1B[31m",ok:"\x1B[32m",redirect:"\x1B[36m",clientError:"\x1B[33m",serverError:"\x1B[31m",mcp:"\x1B[35m",tool:"\x1B[96m",duration:"\x1B[90m"}});import{createHmac as PG8}from"crypto";import{mkdir as Fa6,readdir as Ua6,rm as jG8,stat as AG8}from"fs/promises";import{join as _O1,relative as Na6}from"path";import{z as Q8}from"zod";function RG8($){let Z=$.replace(/[^a-zA-Z0-9_-]/g,"_");return _O1(Ba6,Z)}function qG8($){return $.replace(/^\/+/,"").replace(/\.\./g,"")}function CO1($,Z){let Q=RG8($),Y=qG8(Z);return _O1(Q,Y)}function Da6($,Z,Q,Y){let X=j0().encryptionKey||"dev-secret",J=`${$}:${Z}:${Q}:${Y}`;return PG8("sha256",X).update(J).digest("hex")}function zG8($,Z,Q,Y,X){let J=Math.floor(Date.now()/1000)+Y,G=Da6(Z,Q,J,X),W=new URL(`/api/dev-assets/${Z}/${qG8(Q)}`,$);return W.searchParams.set("expires",J.toString()),W.searchParams.set("signature",G),W.searchParams.set("method",X),W.toString()}function MG8($,Z,Q){let Y=`${$}:${Z.getTime()}:${Q}`;return`"${PG8("md5","etag").update(Y).digest("hex")}"`}async function IG8($,Z,Q,Y,X){try{let J=await Ua6($,{withFileTypes:!0});for(let G of J){let W=_O1($,G.name),H=Na6(Z,W).replace(/\\/g,"/");if(Q&&!H.startsWith(Q))continue;if(G.isDirectory())if(Y){let F=H+"/";if(!Q||F.startsWith(Q)){if(!(Q?H.slice(Q.length):H).includes("/"))X.commonPrefixes.add(F)}}else await IG8(W,Z,Q,Y,X);else if(G.isFile()){if(Y&&Q){let F=H.slice(Q.length);if(F.includes(Y)){let U=F.indexOf(Y),N=Q+F.slice(0,U+1);X.commonPrefixes.add(N);continue}}try{let F=await AG8(W);X.objects.push({key:H,size:F.size,lastModified:F.mtime.toISOString(),etag:MG8(W,F.mtime,F.size)})}catch{}}}}catch{}}function VG8($,Z){let Y=J0($).id;return[{name:"LIST_OBJECTS",description:"List objects in the local assets directory with pagination support",inputSchema:Q8.object({prefix:Q8.string().optional(),maxKeys:Q8.number().optional().default(1000),continuationToken:Q8.string().optional(),delimiter:Q8.string().optional()}),outputSchema:Q8.object({objects:Q8.array(Q8.object({key:Q8.string(),size:Q8.number(),lastModified:Q8.string(),etag:Q8.string()})),nextContinuationToken:Q8.string().optional(),isTruncated:Q8.boolean(),commonPrefixes:Q8.array(Q8.string()).optional()}),handler:async(X)=>{let J=X,G=J.prefix||"",W=J.maxKeys??1000,K=J.delimiter,H=J.continuationToken,F=RG8(Y);await Fa6(F,{recursive:!0});let U={objects:[],commonPrefixes:new Set};await IG8(F,F,G,K,U),U.objects.sort((w,j)=>w.key.localeCompare(j.key));let N=0;if(H){if(N=U.objects.findIndex((w)=>w.key>H),N===-1)N=U.objects.length}let B=U.objects.slice(N,N+W),O=N+W<U.objects.length,L=O?B[B.length-1]?.key:void 0;return{objects:B,isTruncated:O,nextContinuationToken:L,commonPrefixes:Array.from(U.commonPrefixes).sort()}}},{name:"GET_OBJECT_METADATA",description:"Get metadata for a file in the local assets directory",inputSchema:Q8.object({key:Q8.string()}),outputSchema:Q8.object({contentType:Q8.string().optional(),contentLength:Q8.number(),lastModified:Q8.string(),etag:Q8.string(),metadata:Q8.record(Q8.string(),Q8.string()).optional()}),handler:async(X)=>{let J=X,G=CO1(Y,J.key),W=await AG8(G);return{contentType:pN1(J.key),contentLength:W.size,lastModified:W.mtime.toISOString(),etag:MG8(G,W.mtime,W.size)}}},{name:"GET_PRESIGNED_URL",description:"Generate a presigned URL for downloading a file from local storage",inputSchema:Q8.object({key:Q8.string(),expiresIn:Q8.number().optional()}),outputSchema:Q8.object({url:Q8.string(),expiresIn:Q8.number()}),handler:async(X)=>{let J=X,G=eD(J.expiresIn,EG8);return{url:zG8(Z,Y,J.key,G,"GET"),expiresIn:G}}},{name:"PUT_PRESIGNED_URL",description:"Generate a presigned URL for uploading a file to local storage",inputSchema:Q8.object({key:Q8.string(),expiresIn:Q8.number().optional(),contentType:Q8.string().optional()}),outputSchema:Q8.object({url:Q8.string(),expiresIn:Q8.number()}),handler:async(X)=>{let J=X,G=eD(J.expiresIn,EG8);return{url:zG8(Z,Y,J.key,G,"PUT"),expiresIn:G}}},{name:"DELETE_OBJECT",description:"Delete a single file from local storage",inputSchema:Q8.object({key:Q8.string()}),outputSchema:Q8.object({success:Q8.boolean(),key:Q8.string()}),handler:async(X)=>{let J=X,G=CO1(Y,J.key);try{return await jG8(G),{success:!0,key:J.key}}catch{return{success:!1,key:J.key}}}},{name:"DELETE_OBJECTS",description:"Delete multiple files from local storage",inputSchema:Q8.object({keys:Q8.array(Q8.string()).max(1000)}),outputSchema:Q8.object({deleted:Q8.array(Q8.string()),errors:Q8.array(Q8.object({key:Q8.string(),message:Q8.string()}))}),handler:async(X)=>{let J=X,G=[],W=[];return await Promise.all(J.keys.map(async(K)=>{let H=CO1(Y,K);try{await jG8(H),G.push(K)}catch(F){W.push({key:K,message:F instanceof Error?F.message:"Unknown error"})}})),{deleted:G,errors:W}}}]}async function vO1($,Z,Q){let Y=VG8(Z,Q),X=new Kw({name:"dev-assets-mcp",version:"1.0.0"},{capabilities:{tools:{}},jsonSchemaValidator:xZ});for(let G of Y){let W="shape"in G.inputSchema?G.inputSchema.shape:Q8.object({}).shape,K=G.outputSchema&&"shape"in G.outputSchema?G.outputSchema.shape:Q8.object({}).shape;X.registerTool(G.name,{description:G.description??"",inputSchema:W,outputSchema:K,annotations:G.annotations,_meta:G._meta},async(H)=>{try{let F=await G.handler(H);return{content:[{type:"text",text:JSON.stringify(F)}],structuredContent:F}}catch(F){return{content:[{type:"text",text:`Error: ${F.message}`}],isError:!0}}})}let J=new P3({enableJsonResponse:$.headers.get("Accept")?.includes("application/json")??!1});return await X.connect(J),nW(X,J,$,"mcp:dev-assets")}async function kG8($,Z,Q,Y){let J=VG8(Q,Y).find((G)=>G.name===$);if(!J)return{content:[{type:"text",text:`Tool not found: ${$}`}],isError:!0};try{let G=await J.handler(Z);return{content:[{type:"text",text:JSON.stringify(G)}]}}catch(G){return{content:[{type:"text",text:G instanceof Error?G.message:String(G)}],isError:!0}}}var Ba6="./data/assets",EG8=3600,TG8,SG8;var CG8=D(()=>{$$();Zi();J8();mJ0();$i();DJ();$O();HC0();TG8=new $1;TG8.all("/",async($)=>{let Z=$.get("studioContext"),Q=new URL($.req.url),Y=`${Q.protocol}//${Q.host}`;return vO1($.req.raw,Z,Y)});SG8=TG8});var _G8={};Z6(_G8,{mountDevRoutes:()=>Oa6});function Oa6($,Z){$.all("/mcp/:connectionId{.*_dev-assets$}",Z,async(Y)=>{let X=Y.get("studioContext"),J=new URL(Y.req.url),G=`${J.protocol}//${J.host}`;return vO1(Y.req.raw,X,G)}),$.all("/mcp/:connectionId{.*_dev-assets$}/call-tool/:toolName",Z,async(Y)=>{let X=Y.get("studioContext"),J=new URL(Y.req.url),G=`${J.protocol}//${J.host}`,W=Y.req.param("toolName");if(!W)return Y.json({error:"Missing tool name"},400);let K=await Y.req.json(),H=await kG8(W,K,X,G);if(H.isError)return Y.json(H.content,500);return Y.json(H.content)}),$.use("/mcp/dev-assets",Z),$.route("/mcp/dev-assets",SG8);let Q=new $1;Q.use("*",iH({mountPath:"/api/dev-assets"})),Q.route("/",KC0({orgFromPath:!1})),$.route("/api/dev-assets",Q)}var vG8=D(()=>{J8();hN1();HC0();CG8()});var mG8={};Z6(mG8,{watchHandler:()=>cG8,resolveCorsOrigin:()=>uG8,isSsoExemptPath:()=>gG8,isAllowedOAuthRedirectUri:()=>lG8,createApp:()=>qa6});import{readFileSync as La6}from"fs";import{PrometheusSerializer as wa6}from"@opentelemetry/exporter-prometheus";import{DBOS as EO}from"@dbos-inc/dbos-sdk";import{oAuthDiscoveryMetadata as za6,oAuthProtectedResourceMetadata as Pa6}from"better-auth/plugins";async function ja6($){let Z=$.connect(),Q;try{Q=await Promise.race([Z,xG8(bG8)])}catch{return Z.then((Y)=>Y.release(!0)).catch(()=>{}),!1}try{return await Promise.race([Q.query("SELECT 1"),xG8(bG8)]),Q.release(),!0}catch{return Q.release(!0),!1}}function xG8($){return new Promise((Z,Q)=>setTimeout(()=>Q(Error("pg health-check timeout")),$))}function gG8($){return $.startsWith("/api/org-sso/")||/^\/api\/[^/]+\/sso\//.test($)||$.startsWith("/api/auth/")||$.startsWith("/api/tools/management")||$.startsWith("/oauth-proxy/")||/^\/api\/[^/]+\/oauth-proxy\//.test($)||$.startsWith(`${tS0}/`)||$.startsWith(`${cS0}/`)}function hG8($){return $==="local.studio.decocms.com"}function uG8($,{baseUrl:Z,requestOrigin:Q}){let Y;try{Y=new URL($).hostname}catch{return null}if(Y==="localhost"||Y==="127.0.0.1")return $;if(hG8(Y))return $;let X=Z??Q;try{if(new URL(X).origin===$)return $}catch{}return null}function lG8($,Z){return $.origin===new URL(Z).origin||$.hostname==="localhost"||hG8($.hostname)}async function qa6($={}){let Z=$.database??O8(),Q=!1;$5.stop().catch((K0)=>{console.error("[SSEHub] Error stopping previous broadcast (HMR cleanup):",K0)});let Y,X,J,G,W=new LO1,K,H,F,U=null;if($.disableNats)K=wO1(),Y={get:async()=>null,set:async()=>{},invalidate:async()=>{},teardown:()=>{}},X=null,J=null,G=new _80,H={start:async()=>{},broadcast:()=>{},stop:async()=>{}},F={init:async()=>{},pump:(K0)=>{return(async()=>{let H0=K0.getReader();try{while(!0){let{done:T0}=await H0.read();if(T0)break}}catch{}finally{H0.releaseLock()}})()},publishRawChunk:async()=>!1,publishDone:async()=>!1,createTailStream:async()=>null,purge:()=>{},teardown:()=>{}};else{U=dJ8();let K0=j0().natsCredsPath,H0;if(K0)try{H0=La6(K0,"utf8")}catch(K8){console.error(`[app] failed to read NATS_CREDS at ${K0}; connecting anonymously`,K8)}U.init(j0().natsUrls,H0?{creds:H0}:void 0);let T0=B$1()?new r11({getJetStream:()=>U.getJetStream()}):null;T0?.init().catch(()=>{}),Y=T0;let A0=new HZ1({getJetStream:()=>U.getJetStream()});A0.init().catch(()=>{}),X=A0;let D1=new gf(XY1,{getJetStream:()=>U.getJetStream()}),g$=new gf(m$0,{getJetStream:()=>U.getJetStream()});D1.init().catch(()=>{}),g$.init().catch(()=>{}),J={reads:D1,cards:g$};let m$=new mJ1({getJetStream:()=>U.getJetStream()});m$.init().catch(()=>{}),G=m$,K=wO1({getConnection:()=>U.getConnection()}),H=new jO1({getConnection:()=>U.getConnection()}),F=new PO1({getConnection:()=>U.getConnection(),getJetStream:()=>U.getJetStream()}),F68(U),U.onReady(()=>{T0?.init().catch((K8)=>{console.error("[McpListCache] Deferred init failed:",K8)}),A0.init().catch((K8)=>{console.error("[SkillCatalogCache] Deferred init failed:",K8)}),D1.init().catch((K8)=>{console.error("[PrReadCache] Deferred init failed:",K8)}),g$.init().catch((K8)=>{console.error("[PrCardCache] Deferred init failed:",K8)}),m$.init().catch((K8)=>{console.error("[ConnectionCircuitStore] Deferred init failed:",K8)}),K.start(),$B$(()=>U.getConnection()),F.init().catch((K8)=>{console.warn("[Decopilot] StreamBuffer init failed (late-join disabled):",K8)})})}if(Jz)await Jz();s11(Y),UZ1(X),JY1(J),dJ1(G);let B={storage:new ah(Z.db),sseHub:$5,onThreadFinished:async(K0,H0)=>hd(new O3(Z.db),K0,H0,new SG(Z.db))},O=new zX1(B),L=new $60(Z.db),w=new AO1(L);w.start(),rg$(H),H.start((K0)=>{QM0(K0),O.execute({type:"CANCEL",taskId:K0}).catch((H0)=>{console.error("[Decopilot] CancelBroadcast execute failed:",H0)})}).catch((K0)=>{console.error("[Decopilot] CancelBroadcast start failed:",K0)}),U?.onReady(()=>{H.start().catch((K0)=>{console.error("[CancelBroadcast] Deferred start failed:",K0)})});let j=()=>U?.getConnection()??null;bN1(j),U?.onReady(()=>bN1(j)),RG1(j),U?.onReady(()=>RG1(j)),F.init().catch((K0)=>{console.warn("[Decopilot] StreamBuffer init failed, attach/late-join disabled:",K0)}),Jz=async()=>{await O.stopAll(),O.dispose(),w.dispose(),H.stop().catch(()=>{}),_58(),F.teardown(),Y?.teardown(),X?.teardown(),J?.reads.teardown(),J?.cards.teardown(),W.teardown(),K.teardown(),ZB$(),G.teardown(),s11(null),UZ1(null),JY1(null),dJ1(null)};let E=new $1;if(E.use("*",uJ1({enabled:(K0)=>Kp(K0,"debug")==="1"})),E.use("*",p_0),E.use("/*",J68({origin:(K0,H0)=>uG8(K0,{baseUrl:j0().baseUrl,requestOrigin:new URL(H0.req.url).origin}),credentials:!0,allowMethods:["GET","POST","PUT","DELETE","OPTIONS"],allowHeaders:["Content-Type","Authorization","mcp-protocol-version"],exposeHeaders:["WWW-Authenticate"]})),E.use("*",async(K0,H0)=>{if(await H0(),K0.req.path.includes("/files/"))return;if(K0.req.path.includes("/fs/")&&K0.req.path.endsWith("/read"))return;K0.header("X-Frame-Options","DENY"),K0.header("Content-Security-Policy","frame-ancestors 'none'")}),!j0().noTui)E.use("*",LG8());E.use("*",async(K0,H0)=>{if(await H0(),$n(K0.req.path))return;if(K0.res.status>=500){let A0=await K0.res.clone().text();console.error(`[5xx Response] ${K0.req.method} ${K0.req.path} - ${K0.res.status}:`,A0)}}),E.get($X.HEALTH,(K0)=>{if(Q)return K0.json({status:"shutting_down"},503);return K0.json({status:"ok"})}),E.get($X.HEALTH_LIVE,(K0)=>{return K0.json({status:"ok"})}),E.get($X.HEALTH_READY,async(K0)=>{if(Q)return K0.json({status:"shutting_down"},503);let H0={};if(H0.postgres={status:await ja6(Z.pool)?"up":"down"},U)H0.nats=U.isConnected()?{status:"up"}:{status:"down"};else H0.nats={status:"down"};let T0=H0.postgres.status==="up",A0=T0?200:503;return K0.json({status:T0?"ready":"not_ready",services:H0},A0)}),E.get($X.METRICS,async(K0)=>{try{let H0=await r_0.collect(),T0=Ea6.serialize(H0.resourceMetrics);return K0.text(T0,200,{"Content-Type":"text/plain; version=0.0.4; charset=utf-8"})}catch(H0){return console.error("Failed to collect metrics:",H0),K0.text("# Error collecting metrics",500)}});let z=1800000;E.get(`${$X.DBOS_QUEUE_DEPTH_PREFIX}:queueName`,async(K0)=>{let H0=K0.req.param("queueName");if(!Aa6.has(H0))return K0.json({error:`Unknown queue: ${H0}`},404);let[T0,A0]=await Promise.all([EO.listQueuedWorkflows({queueName:H0,status:"ENQUEUED",loadInput:!1,loadOutput:!1}),EO.listQueuedWorkflows({queueName:H0,status:"PENDING",loadInput:!1,loadOutput:!1,dequeuedAfter:new Date(Date.now()-z).toISOString()})]);return K0.json({queue_length:T0.length,in_flight:A0.length})}),E.route("/api/config",eX8),E.route("/api/_reports",UJ8),E.route("/api/_stripe",GO1),E.route("/api/_github",DJ8({taskBoard:()=>i,contextFactory:()=>g})),E.route("/api/_git",Lp);let T={db:Z.db,encryptionKey:j0().encryptionKey};E.route("/api/_jira",TJ8(T)),E.route("/api/_jira",jJ8(T)),E.route("/report",KJ8($.clientDir)),E.route("/api/auth/custom",S68),E.route("/api/auth/desktop",b68),E.all("/api/auth/admin/*",E58),E.all("/api/auth/*",async(K0)=>{return await x8.handler(K0.req.raw)});let P=v88();P.use("/.well-known/oauth-protected-resource/mcp/:connectionId",D60),P.use("/mcp/:connectionId/.well-known/oauth-protected-resource",D60),E.route("/",P),E.get("/.well-known/oauth-protected-resource/api/:org/mcp/:connectionId",a40),E.route("/",g88()),E.use("/oauth-proxy/:connectionId/*",D60),E.all("/oauth-proxy/:connectionId/*",fG8);let A=async(K0)=>{let T0=await Ta6()(K0.req.raw),A0=await T0.json();return Response.json(A0,T0)};E.use("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",D60),E.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",A);let q=async(K0)=>{let T0=await Ra6()(K0.req.raw),A0=await T0.json();return Response.json(A0,T0)};E.get("/.well-known/oauth-authorization-server/*/:gateway?/:connectionId?",q);let f=W68({ttlMs:120000}),_=await _48({db:Z.db,auth:x8,encryption:{key:j0().encryptionKey},observability:{tracer:VO,meter:Z$},modelListCache:W,providerKeyCache:K,memberRoleCache:f});iQ.set(_),bp1({db:Z.db,baseUrl:m5()}),v48({db:Z.db}),y48({db:Z.db}),i48({db:Z.db}),zJ8({db:Z.db,encryptionKey:j0().encryptionKey}),Tb$({db:Z.db}),s48({db:Z.db}),eb$({db:Z.db});let V=CX0(Z.db),y=new br(Z.db),g=NG8({db:Z.db});fJ1({storage:V,studioContextFactory:g}),SX1({systemDatabaseUrl:js0(j0().databaseUrl,j0().databasePgSsl),studioContextFactory:g,deps:{runRegistry:O,cancelBroadcast:H,streamBuffer:F,sseHub:$5}}),TX1({dispatchRunFn:iy$,studioContextFactory:g,deps:{runRegistry:O,cancelBroadcast:H,streamBuffer:F,sseHub:$5}});let l=new ah(Z.db),i=new O3(Z.db),p=new SG(Z.db),U0=new RO1(i,g,p);if(j0().taskBoardReviewSweeperEnabled){U0.start();let K0=Jz;Jz=async()=>{await K0?.(),U0.dispose()}}Ng$({getJetStream:()=>U?.getJetStream()??null,getJetStreamManager:async()=>{let K0=U?.getConnection();return K0?await yG8.jetstreamManager(K0):null},messageParts:l.messageParts(),resolveRun:async(K0)=>{let H0=await Z.db.selectFrom("threads").select(["organization_id","created_by","message_storage_version","status","run_fence_token","title"]).where("id","=",K0).executeTakeFirst();return H0?{orgId:H0.organization_id,createdBy:H0.created_by,version:H0.message_storage_version??1,status:H0.status,runFenceToken:H0.run_fence_token,title:H0.title??null}:null},completeRunIfNotCompleted:async(K0,H0)=>{let T0=await l.completeRunIfNotCompleted(K0,H0);if(P_0($5,H0,K0,T0),T0)await hd(i,K0,H0,p);return T0},markRunRequiresAction:async(K0,H0)=>{let T0=await l.requiresActionIfInProgress(K0,H0);return P_0($5,H0,K0,T0),T0},markRunFailed:async(K0,H0,T0,A0)=>{let D1=await l.markRunFailed(K0,H0,T0,A0);if(P_0($5,H0,K0,D1),D1)await hd(i,K0,H0,p);return D1},clearSynthesizedError:async(K0,H0)=>{await l.messageParts().replaceMessageParts(K0,jE(K0,H0),[])},persistTitle:(K0,H0,T0)=>l.update(K0,H0,{title:T0}),onTitleUpdated:async({runId:K0,orgId:H0,title:T0})=>{let A0=await l.get(K0,H0).catch(()=>null);$5.emit(H0,OF(K0,A0?.status??"in_progress",{title:T0,virtualMcpId:A0?.virtual_mcp_id??void 0,createdBy:A0?.created_by,triggerId:A0?.trigger_id,branch:A0?.branch??null,harnessId:A0?.harness_id??void 0,createdAt:A0?.created_at,updatedAt:A0?.updated_at}))},bumpProgress:async({runId:K0,orgId:H0})=>{await l.bumpProgress(K0,H0)},recordCompleted:async({runId:K0,orgId:H0,distinctId:T0,usage:A0})=>{f1.capture({distinctId:T0,event:"chat_message_completed",groups:{organization:H0},properties:{organization_id:H0,thread_id:K0,transport:"projector",input_tokens:A0.inputTokens,output_tokens:A0.outputTokens,total_tokens:A0.totalTokens}})},recordFailed:async({runId:K0,orgId:H0,distinctId:T0,reason:A0,kind:D1})=>{f1.capture({distinctId:T0,event:"chat_message_failed",groups:{organization:H0},properties:{organization_id:H0,thread_id:K0,transport:"projector",error_category:D1,error_message:A0}})},purgeRun:async(K0)=>{F.purge(K0)}}),wy$({studioContextFactory:g,systemDatabaseUrl:js0(j0().databaseUrl,j0().databasePgSsl),streamBuffer:F}),FG8(),xp1(),x48(),h48(),n48(),AJ8(),Vb$(),e48(),$x$(),LJ8();let _0=async(K0,H0,T0)=>{let A0=await V.findById(K0,H0);if(!A0)throw Error("Automation not found");return hJ1({automationId:A0.id,organizationId:A0.organization_id,triggerId:null})},G0=new Dp(V,({automation:K0,trigger:H0,contextMessages:T0,idempotencyKey:A0})=>C80({automationId:K0.id,organizationId:K0.organization_id,triggerId:H0.id,contextMessages:T0},{idempotencyKey:A0})),N0=[KK(),Ug(),kN()];for(let K0 of N0)R_0(K0).then(()=>{}).catch((H0)=>console.error("[monitoring] Retention cleanup failed:",H0));let o=()=>x8.api.deleteAllExpiredApiKeys().catch((K0)=>console.error("[auth] Expired API key cleanup failed:",K0));o(),setInterval(o,86400000).unref(),E.use("*",async(K0,H0)=>{if(d_0(K0.req.path))return H0();let T0={measure:async(D1,g$)=>{pW(K0,D1);try{return await g$()}finally{A3(K0,D1)}}},A0=await iQ.create(K0.req.raw,{timings:T0});A0.automationRunner=_0,K0.set("studioContext",A0);try{await H0()}finally{let D1=A0.pendingRevalidations;if(D1.length>0)Promise.race([Promise.allSettled(D1),L$(30000)]).catch((m$)=>console.error("[studio] revalidation cleanup error:",m$))}}),E.use("/api/:org/decopilot/*",Fp),E.use("/api/:org/v1/*",Fp),E.use("/api/:org/files/*",Fp),E.use("*",async(K0,H0)=>{if(gG8(K0.req.path))return H0();let T0=K0.get("studioContext");if(!T0?.organization?.id||!T0?.auth?.user?.id)return H0();if(!(await T0.storage.orgSsoConfig.getByOrgId(T0.organization.id))?.enforced)return H0();if(!await T0.storage.orgSsoSessions.isValid(T0.auth.user.id,T0.organization.id))return K0.json({error:"SSO authentication required for this organization"},403);return H0()});let Z0=new $1;Z0.use("*",iH({mountPath:"/api/org-sso"})),Z0.route("/",sS0()),E.route("/api/org-sso",Z0),E.get("/api/tools/management",(K0)=>{return K0.json({tools:en0,grouped:sP()})}),E.use("/mcp/*",async(K0,H0)=>{pW(K0,"mcp");try{return await H0()}finally{A3(K0,"mcp")}});let Q0=async(K0,H0)=>{let T0=K0.var.studioContext;if(!T0.auth.user?.id&&!T0.auth.apiKey?.id){let A0=new URL(K0.req.url),D1=K0.req.header("x-forwarded-proto")?.split(",")[0]?.trim(),g$=D1?`${D1}://${A0.host}`:A0.origin;return K0.res=new Response(null,{status:401,headers:{"WWW-Authenticate":`Bearer realm="mcp",resource_metadata="${g$}${A0.pathname}/.well-known/oauth-protected-resource"`}})}return await H0()};if(E.use("/mcp/:connectionId?",Q0),E.use("/mcp/gateway/:virtualMcpId?",Q0),E.use("/mcp/virtual-mcp/:virtualMcpId?",Q0),E.use("/mcp/self",Q0),qW()){let{mountDevRoutes:K0}=(vG8(),__0(_G8));K0(E,Q0)}let s=new $1;s.use("*",iH({mountPath:"/mcp"})),s.route("/",rM0()),E.route("/mcp",s);let Y0=new $1;Y0.use("*",iH({mountPath:"/mcp/self"})),Y0.route("/",uC0()),E.route("/mcp/self",Y0);let i0=new $1;i0.use("*",iH({mountPath:"/mcp"})),i0.route("/",eM0()),E.route("/mcp",i0),E.use("/api/:org/models/*",async(K0,H0)=>{pW(K0,"llm_models");try{return await H0()}finally{A3(K0,"llm_models")}});let C0=b58({cancelBroadcast:H,streamBuffer:F,runRegistry:O});E.route("/api",C0),E.route("/api",IJ8);let G1=new $1;G1.use("*",iH({mountPath:"/api"})),G1.route("/",dC0()),E.route("/api",G1),E.route("/api",pX8);let l0=new $1;l0.use("*",iH({mountPath:"/api"})),l0.route("/",iC0({tokenStorage:y,automationEventDispatcher:G0})),E.route("/api",l0);let L0=new fr(Z.db),E0=new $1;E0.use("*",iH({mountPath:"/api"})),E0.route("/",QC0()),E.route("/api",E0),E.route("/api/deco-sites",o58()),E.route("/api/deco-apps",uX8());let u0=new $1;u0.use("*",iH({mountPath:"/api/deco-sites"})),u0.route("/",XC0()),E.route("/api/deco-sites",u0),E.route(tS0,z58()),E.route(SQ8,vQ8()),E.route("/api/_editor-resolve",tX8()),E.route(g68,h68()),E.route(cS0,$58());let B1=j0(),Z1=B1.elevenlabsApiKey?new B_0({apiKey:B1.elevenlabsApiKey,model:B1.elevenlabsVoiceModel,conversationModel:B1.elevenlabsConversationModel,voiceId:B1.elevenlabsVoiceId}):null,v0={openai:B1.openaiLiveApiKey?new aD1({apiKey:B1.openaiLiveApiKey,voice:B1.openaiLiveVoice}):null,elevenlabs:Z1?new sD1(Z1,()=>U?.getConnection()??null):null},c0=new YO1({adapter:Z1,conversationAdapters:v0,defaults:B1,secret:B1.studioJwtSecret??B1.betterAuthSecret,getConnection:()=>U?.getConnection()??null}),p0=jX8({voiceSessions:c0,kvStorage:L0,runRegistry:O,streamBuffer:F,sseHub:$5,cancelBroadcast:H,tokenStorage:y,automationEventDispatcher:G0,mountDevAssets:qW(),mcpAuth:Q0,oauthProxyHandler:fG8,watchHandler:cG8,betterAuthProtectedResourceHandler:A,getNatsConnection:()=>U?.getConnection()??null});return E.route("/api/:org",p0),E.notFound((K0)=>{return K0.json({error:"Not Found",path:K0.req.path},404)}),E.onError(f58),Object.assign(E,{markShuttingDown:()=>{Q=!0},shutdown:async()=>{if(console.log("[shutdown] Stopping workers..."),await Promise.allSettled([$5.stop(),Jz?Promise.resolve(Jz()).finally(()=>{Jz=null}):Promise.resolve()]),U)await U.drain().catch((K0)=>console.error("[shutdown] NATS drain error:",K0));console.log("[shutdown] Flushing telemetry..."),await sX().catch((K0)=>console.error("[shutdown] Telemetry flush error:",K0)),console.log("[shutdown] Closing database..."),await hZ$(Z).catch((K0)=>console.error("[shutdown] Database close error:",K0)),console.log("[shutdown] Cleanup complete.")},initDbos:async()=>{await EO.registerQueue(v3,{partitionQueue:!0,concurrency:vJ1,minPollingIntervalMs:bJ1}),await EO.registerQueue(_3,{partitionQueue:!0,concurrency:VX1,priorityEnabled:!0}),await EO.registerQueue(IN,{workerConcurrency:j0().decopilotMaxConcurrentHostedRuns,priorityEnabled:!0}),await EO.registerQueue(VN,{workerConcurrency:j0().sandboxMaxConcurrentHostedRuns,priorityEnabled:!0}),await EO.registerQueue(MO,{partitionQueue:!0,concurrency:Ly$}),await EO.registerQueue(Fz,ab$),await uN1(V),await Promise.allSettled(["automations-gate","automations-global","jira-push"].map((K0)=>EO.deleteQueue(K0))),await xJ1(Z.pool),GX$().catch((K0)=>{console.error("[studio-pack-backfill] failed:",K0)}),fp1().catch((K0)=>{console.error("[org-fs] public-sets boot sync kick failed:",K0)})}})}var yG8,bG8=5000,Jz=null,fG8=async($)=>{let Z=$.req.param("connectionId");if(!Z)return $.json({error:"Missing connectionId"},400);let Q=$.req.path.split("/").filter(Boolean),Y=Q[Q.length-1],X=$.get("studioContext");if(!X)X=await iQ.create($.req.raw),$.set("studioContext",X);let J=$.req.param("org")?X.organization?.id:void 0,G=await X.storage.connections.findById(Z,J);if(!G?.connection_url)return $.json({error:"Connection not found"},404);if(Y==="register"&&G.oauth_config?.clientId){let y=await $.req.json().catch(()=>({}));return $.json({...typeof y==="object"&&y!==null?y:{},client_id:G.oauth_config.clientId,...G.oauth_config.clientSecret?{client_secret:G.oauth_config.clientSecret}:{},client_secret_expires_at:0})}let W=await Xp(G.connection_url),K,H=new URL(G.connection_url),U=(typeof G.metadata?.oauthResource==="string"&&G.metadata.oauthResource.length>0?G.metadata.oauthResource:void 0)??G.connection_url;if(W.ok)K=(await W.json()).authorization_servers?.[0];if(!K)K=H.origin;let N=await e40(K);if(!N.ok)return $.json({error:"Failed to get auth server metadata"},502);let B=await N.json(),O;if(Y==="authorize")O=B.authorization_endpoint;else if(Y==="token")O=B.token_endpoint;else if(Y==="register")O=B.registration_endpoint;if(!O)return $.json({error:`Unknown OAuth endpoint: ${Y}`},404);let L=y88(O);if(L)return L;let w=new URL(O),j=new URL($.req.url);if(w.search=j.search,Y==="authorize"){let y=w.searchParams.get("redirect_uri");if(y){let g=j0().baseUrl??j.origin;try{if(!lG8(new URL(y),g))return $.json({error:"invalid_request",error_description:"redirect_uri is not allowed"},400)}catch{return $.json({error:"invalid_request",error_description:"redirect_uri is malformed"},400)}w.searchParams.set("redirect_uri",y)}if(w.searchParams.has("resource"))w.searchParams.set("resource",U);if(Z68(G.connection_url))w.searchParams.set("auto_personal","true"),w.searchParams.set("force_new","true");return $.redirect(w.toString(),302)}let E={Accept:$.req.header("Accept")||"application/json"},z=$.req.header("Content-Type");if(z)E["Content-Type"]=z;let T=$.req.header("Authorization");if(T)E.Authorization=T;let P,A=null,q=null;if($.req.method!=="GET"&&$.req.method!=="HEAD")if(Y==="token"&&z?.includes("application/x-www-form-urlencoded")){if(T?.toLowerCase().startsWith("basic "))try{let p=atob(T.slice(6).trim()),U0=p.indexOf(":");if(U0!==-1){let _0=decodeURIComponent(p.slice(0,U0)),G0=decodeURIComponent(p.slice(U0+1));A=_0||null,q=G0||null}}catch{}let y=await $.req.formData();if(y.has("resource"))y.set("resource",U);let g=y.get("client_id"),l=y.get("client_secret");if(typeof g==="string"&&g)A=g;if(typeof l==="string"&&l)q=l;let i=new URLSearchParams;for(let[p,U0]of y.entries())i.append(p,U0.toString());P=i.toString()}else if(Y==="register"&&z?.toLowerCase().includes("application/json")){let y=await X.db.selectFrom("organization").select(["id","slug","name"]).where("id","=",G.organization_id).executeTakeFirst(),g=await $.req.text(),l={};try{l=g?JSON.parse(g):{}}catch{P=g}let i=typeof l==="object"&&l!==null&&!Array.isArray(l);if(P===void 0&&!i)P=g;if(P===void 0){let p=l,U0=p.metadata&&typeof p.metadata==="object"?p.metadata:{};p.metadata={...U0,organization_id:G.organization_id,...y?.slug?{organization_slug:y.slug}:{},...y?.name?{organization_name:y.name}:{}},P=JSON.stringify(p),E["Content-Type"]="application/json"}}else P=$.req.raw.body??void 0;let f=await fetch(w.toString(),{method:$.req.method,headers:E,body:P,duplex:"half",redirect:"manual"}),_=new Headers,V=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];for(let[y,g]of f.headers.entries())if(!V.includes(y.toLowerCase()))_.set(y,g);if(Y==="token"&&f.ok){let y=await f.text();try{let g=JSON.parse(y);if(typeof g.access_token==="string"&&g.access_token){let l=typeof g.expires_in==="number"?new Date(Date.now()+g.expires_in*1000):null,i=null;try{i=await Jp(G.connection_url)??O}catch{i=O}let p={connectionId:Z,accessToken:g.access_token,refreshToken:typeof g.refresh_token==="string"?g.refresh_token:null,scope:typeof g.scope==="string"?g.scope:null,expiresAt:l,clientId:A,clientSecret:q,tokenEndpoint:i};await new j9(X.db,X.vault).upsert(p)}}catch(g){console.error("[oauth-proxy] failed to persist downstream token:",g)}return new Response(y,{status:f.status,statusText:f.statusText,headers:_})}return new Response(f.body,{status:f.status,statusText:f.statusText,headers:_})},cG8=async($)=>{let Z=$.var.studioContext,Q=Z.auth.user?.id??Z.auth.apiKey?.userId;if(!Q)return $.json({error:"Unauthorized"},401);let Y=Z.organization?.id;if(!Y)return $.json({error:"organization id missing"},400);let X=$.req.query("types"),J=X?X.split(",").map((H)=>H.trim()).filter(Boolean):null,G=$.req.query("scope")==="all";if(G&&(!iU(Y)||!await pU(Z)))return $.json({error:"forbidden"},403);let W=G?Nq0:Y;if(G)yD({action:"watch_all_orgs",actorUserId:Q,actorOrgId:Y,targetOrgId:"all"});let K=crypto.randomUUID();return OO($,async(H)=>{if(await H.writeSSE({event:"connected",data:JSON.stringify({listenerId:K,organizationId:Y,typePatterns:J,connectedAt:new Date().toISOString()})}),!$5.add({id:K,organizationId:W,typePatterns:J?.length?J:null,push:(N,B)=>{H.writeSSE({id:N.id,event:N.type,data:JSON.stringify(G?{...N,organizationId:B}:N)}).catch(()=>{$5.remove(W,K)})}})){await H.writeSSE({event:"error",data:JSON.stringify({error:"Too many connections",message:"SSE connection limit reached. Try again later."})});return}let U=setInterval(()=>{H.writeSSE({event:"keepalive",data:""}).catch(()=>{clearInterval(U),$5.remove(W,K)})},30000);await new Promise((N)=>{H.onAbort(()=>{clearInterval(U),$5.remove(W,K),N()})})})},Ea6,Aa6,Ta6=()=>Pa6(x8),Ra6=()=>za6(x8);var dG8=D(()=>{a$();$$();yp1();f48();u48();t48();h80();lQ1();$68();c$0();V9();ac();p8();J8();gS0();G68();lJ1();Q3();jU();KN1();CG();k6();e4();ON1();x68();u68();Z58();PN1();P58();SN1();yN1();gN1();UH();zS0();hN1();y58();uS0();EX8();RX8();qX8();kX8();hX8();mN1();lX8();sM0();v80();nX8();$I0();jD1();oX8();LD1();$J8();HJ8();NJ8();BJ8();OJ8();wJ8();EJ8();RJ8();DO1();tN1();VJ8();wD1();BD1();j50();iJ8();_J();rT0();WY1();Y00();J00();pJ1();pJ8();tJ8();xN1();ZG8();PX1();QG8();Lo();hr();fD();A9();VU1();WG8();UG8();O30();qO1();b3();lN1();xD();jX1();O30();NM0();hn0();un0();BG8();Zl();wG8();_p();KN1();Cd();pd();YM0();yG8=C(LK(),1);Ea6=new wa6,Aa6=new Set([v3,_3,IN,VN,MO,Fz])});var tG8={};Z6(tG8,{resolveClientDir:()=>_a6,resolveAssetPathWithTraversalCheck:()=>nG8,isPathWithinDirectory:()=>pG8,createAssetHandler:()=>va6});import{resolve as Y50,dirname as Ma6,join as Ia6,extname as Va6,basename as ka6,sep as iG8}from"path";function Sa6($,Z){if($===Z||ka6($)==="index.html")return{"Cache-Control":"no-cache"};if($.includes(`${iG8}assets${iG8}`))return{"Cache-Control":"public, max-age=31536000, immutable"};return{}}function pG8($,Z){let Q=Y50(Z),Y=Y50($);return Y===Q||Y.startsWith(Q+"/")}function nG8({requestPath:$,clientDir:Z}){let Q=$.startsWith("/")?$.slice(1):$,Y=Y50(Z,Q);if(!pG8(Y,Z))return null;return Y}function _a6($,Z="../client"){let Q=new URL($),Y=Ma6(Q.pathname);return Y50(Y,Z)}function va6($={}){let{env:Z="production",clientDir:Q=Ca6,isServerPath:Y=()=>!1}=$;if(Z==="development")return async function(J){return null};return async function(J){if(J.method!=="GET")return null;let G=new URL(J.url),W;try{W=decodeURIComponent(G.pathname)}catch{return null}if(Y(W))return null;let K=nG8({requestPath:W,clientDir:Q});if(!K)return null;let H=Ia6(K,"index.html"),F=Y50(Q,"index.html"),U=J.headers.get("accept"),B=U?.includes("text/html")||U?.includes("*/*")&&["",".html"].includes(Va6(K))?[H,F]:[];for(let O of[K,...B])try{let L=Bun.file(O);if(await L.exists())return new Response(L,{headers:Sa6(O,F)})}catch{}if(W.includes("/assets/"))return new Response("Not Found",{status:404,headers:{"Cache-Control":"no-store"}});return null}}var Ca6="./dist/client";var oG8=()=>{};var rG8={};Z6(rG8,{tryUpgradePreviewWs:()=>ua6,tryHandlePreviewHttp:()=>ha6,previewWebSocketHandler:()=>la6,parsePreviewBaseDomain:()=>ga6,isPreviewWsData:()=>q_0,extractHandleFromHost:()=>bO1});function fa6($){if($.method!=="GET")return!1;return($.headers.get("accept")??"").includes("text/html")}function ya6(){return new Response(xa6,{status:503,headers:{"content-type":"text/html; charset=utf-8","cache-control":"no-store","retry-after":"1","access-control-allow-origin":"*"}})}function ga6($){if(!$||$.trim()==="")return null;let Z=$.includes("{handle}")?$.replace("{handle}","__handle__"):$,Q;try{Q=new URL(Z)}catch{return null}let Y=Q.hostname;if($.includes("{handle}")){let X=Y.indexOf(".");if(X<=0||X===Y.length-1)return null;return Y.slice(X+1)}return Y}function bO1($,Z){if(!$||!Z)return null;let Q=$.indexOf(":"),Y=(Q>=0?$.slice(0,Q):$).toLowerCase(),J=`.${Z.toLowerCase().replace(/^\.+|\.+$/g,"")}`;if(!Y.endsWith(J))return null;let G=Y.slice(0,Y.length-J.length);if(!G||G.includes("."))return null;return G}async function ha6($,Z){let Q=bO1($.headers.get("host"),Z.baseDomain);if(!Q)return null;let Y=await Z.getRunner();if(!Y)return J50(503,"preview proxy not configured");let X=await Y.proxyPreviewRequest(Q,$);if(X.headers.get(mm)&&fa6($))return ya6();return X.headers.delete(mm),X}function J50($,Z){return new Response(JSON.stringify({error:Z}),{status:$,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function q_0($){return typeof $==="object"&&$!==null&&$.kind==="preview"}async function ua6($,Z,Q){if(($.headers.get("upgrade")??"").toLowerCase()!=="websocket")return null;let Y=bO1($.headers.get("host"),Q.baseDomain);if(!Y)return null;let X=await Q.getRunner();if(!X)return J50(503,"preview proxy not configured");let J=await X.resolvePreviewUpstreamUrl(Y);if(!J)return J50(404,"sandbox not found");let G=new URL($.url);if(G.pathname.startsWith("/_sandbox"))return J50(404,"not found");let W=`${J.replace(/^http/,"ws")}${G.pathname}${G.search}`,K=$.headers.get("sec-websocket-protocol"),H=K?K.split(",").map((N)=>N.trim()).filter(Boolean):[],F={kind:"preview",upstreamUrl:W,upstreamProtocols:H,pending:[],upstream:null,closed:!1};if(!Z.upgrade($,{data:F}))return J50(426,"upgrade failed");return}function X50($,Z,Q,Y){if(Z.closed)return;Z.closed=!0;try{$.close(Q,Y)}catch{}try{Z.upstream?.close()}catch{}}var ba6=256,xa6='<!DOCTYPE html><html><head><meta charset="utf-8"><title>Connecting\u2026</title><style>body{font-family:system-ui,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0;background:#fafafa;color:#555}div{text-align:center;max-width:420px;padding:24px}h3{margin:0 0 8px}p{margin:0;font-size:14px;color:#999;line-height:1.5}</style></head><body><div><h3>Connecting to sandbox\u2026</h3><p>Waiting for the sandbox to come online. This page refreshes automatically.</p></div><script>setTimeout(function(){window.location.reload()},1500)</script></body></html>',la6;var sG8=D(()=>{V10();la6={open($){let Z=$.data;if(!q_0(Z))return;let Q;try{Q=Z.upstreamProtocols.length>0?new WebSocket(Z.upstreamUrl,Z.upstreamProtocols):new WebSocket(Z.upstreamUrl)}catch(Y){console.warn(`[preview-ws] failed to dial upstream ${Z.upstreamUrl}: ${Y instanceof Error?Y.message:String(Y)}`),X50($,Z,1011,"upstream connect failed");return}Q.binaryType="arraybuffer",Z.upstream=Q,Q.addEventListener("open",()=>{while(Z.pending.length>0){let Y=Z.pending.shift();if(Y!==void 0)Q.send(Y)}}),Q.addEventListener("message",(Y)=>{if(Z.closed)return;$.send(Y.data)}),Q.addEventListener("close",(Y)=>{X50($,Z,Y.code||1000,Y.reason||"")}),Q.addEventListener("error",()=>{X50($,Z,1011,"upstream error")})},message($,Z){let Q=$.data;if(!q_0(Q))return;let Y=Q.upstream;if(Y&&Y.readyState===WebSocket.OPEN){Y.send(Z);return}if(Q.pending.length>=ba6){X50($,Q,1011,"preview ws backlog overflow");return}Q.pending.push(Z)},close($){let Z=$.data;if(!q_0(Z))return;X50($,Z,1000,"")}}});var Z38={};Z6(Z38,{printBanner:()=>ma6,bannerLines:()=>$38,BANNER_LINES:()=>aG8,BANNER_GRADIENT:()=>eG8});function ca6($){let Z=Number.parseInt($.slice(1),16);return[Z>>16&255,Z>>8&255,Z&255]}function $38($){let Z=aG8.map((Q,Y)=>{let[X,J,G]=ca6(eG8[Y]);return`\x1B[38;2;${X};${J};${G}m${Q}\x1B[39m`});if($!==void 0)Z.push(`\x1B[2m  v${$}\x1B[22m`);return Z}function ma6($){console.log("");for(let Z of $38($))console.log(Z);console.log("")}var aG8,eG8;var Q38=D(()=>{aG8=[" \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588     \u2588\u2588\u2588\u2588\u2588\u2588\u2588   ","\u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588 "," \u2591\u2588\u2588\u2588   \u2591\u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588  \u2588 \u2591  \u2588\u2588\u2588     \u2591\u2591\u2591  \u2588\u2588\u2588     \u2591\u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2588\u2588\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2591\u2591\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2588\u2588\u2588  \u2591\u2588\u2588\u2588 \u2591   \u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588 "," \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588  \u2591\u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2591  ","\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591     \u2591\u2591\u2591\u2591\u2591\u2591\u2591   "],eG8=["#00ff64","#00ee5e","#00dc56","#00c84e","#00b444","#00a03c","#008832","#006e28"]});a$();var nO1="13";function tO1($){return{name:"decocms",systemDatabaseUrl:$.systemDatabaseUrl,systemDatabaseSchemaName:"dbos",systemDatabasePoolSize:$.poolSize,runAdminServer:!1,executorID:$.executorID,applicationVersion:nO1,...$.listenQueues!==void 0?{listenQueues:$.listenQueues}:{}}}a$();import z38 from"pg";var oO1=8314027461559302n,P38=600000,A38=500;async function rO1($,Z){let{databaseUrl:Q,lockTimeoutMs:Y=P38}=$,X=$.log??((K)=>console.log(K)),J=new z38.Client({connectionString:Q});await J.connect();let G=Date.now(),W=!1;try{while(!W){if(W=(await J.query("SELECT pg_try_advisory_lock($1) AS locked",[oO1.toString()])).rows[0]?.locked===!0,W)break;if(Date.now()-G>=Y)throw Error(`Timed out after ${Y}ms waiting for the DBOS migration lock. Another process is still migrating the dbos schema; this pod will restart and retry.`);await L$(A38)}let K=Date.now()-G;if(K>1000)X(`[dbos] waited ${K}ms for the migration lock; another process migrated first`);return await Z()}finally{if(W)try{await J.query("SELECT pg_advisory_unlock($1)",[oO1.toString()])}catch{}await J.end().catch(()=>{})}}$$();f_0();k6();function zW8(){let $=(process.env.BUN_OPTIONS??"").split(/\s+/).filter(Boolean);return[...process.argv.slice(1),...$]}function e_0($,Z){for(let Q=0;Q<$.length;Q++){let Y=$[Q];if(Y===void 0)continue;if(Y===Z)return $[Q+1];if(Y.startsWith(`${Z}=`))return Y.slice(Z.length+1)}return}function vL1(){let $=zW8();if($.includes("--cpu-prof")){console.log(JSON.stringify({msg:"cpu-profiling-active",dir:e_0($,"--cpu-prof-dir")??process.cwd(),name:e_0($,"--cpu-prof-name"),markdown:$.includes("--cpu-prof-md"),intervalUs:Number(e_0($,"--cpu-prof-interval")??1000),note:"profile is written on process exit"}));return}if(process.env.CPU_PROFILE)console.warn(JSON.stringify({msg:"cpu-profiling-requested-but-inactive",hint:'CPU profiling is a Bun launch flag. Set BUN_OPTIONS="--cpu-prof --cpu-prof-md --cpu-prof-dir=/tmp" before starting the process.'}))}Qv0();var P50;function cL1(){if(process.env.HEAP_WATCH!=="1")return()=>{};let $=Number(process.env.HEAP_WATCH_INTERVAL_MS??60000),Z=async()=>{let Q=Bz();if(!Q)return;let Y={};try{let{heapStats:X}=await import("bun:jsc"),J=X(),G=Object.entries(J.objectTypeCounts).sort((W,K)=>K[1]-W[1]).slice(0,20);Y={objectCount:J.objectCount,heapSize:J.heapSize,top:Object.fromEntries(G)}}catch{}console.log(JSON.stringify({msg:"heap-watch",ts:new Date().toISOString(),uptimeS:Math.round(process.uptime()),rss:Q.rss,heapUsed:Q.heapUsed,heapTotal:Q.heapTotal,external:Q.external,arrayBuffers:Q.arrayBuffers,...Y}))};return Z().catch(()=>{}),P50=setInterval(()=>void Z().catch(()=>{}),$),P50.unref?.(),process.on("SIGUSR2",()=>{try{let Q=Bun.generateHeapSnapshot("v8"),Y=typeof Q==="string"?Q:JSON.stringify(Q),X=`/tmp/heap-${process.pid}-${Date.now()}.heapsnapshot`;Bun.write(X,Y),console.log(JSON.stringify({msg:"heap-snapshot-written",path:X}))}catch(Q){console.error("[heap-watch] snapshot failed:",Q)}}),()=>{if(P50)clearInterval(P50)}}import*as TW8 from"bun:jsc";var{startSamplingProfiler:RW8,samplingProfilerStackTraces:qW8}=TW8;function mL1(){if(process.env.STALL_WATCHDOG!=="1")return()=>{};let $=Number(process.env.STALL_WATCHDOG_MS??100),Z=Number(process.env.STALL_WATCHDOG_TICK_MS??50);try{RW8()}catch(J){return console.error("[stall-watchdog] failed to start sampling profiler:",J),()=>{}}let Q,Y=performance.now()+Z,X=()=>{let J=performance.now(),G=J-Y;Y=J+Z;let W=[];try{W=qW8()?.traces??[]}catch{}if(G>$&&W.length>0){let K=new Map;for(let F of W){let U=F.frames.find((O)=>O.sourceURL&&!/Unknown Executable/.test(O.category??""))??F.frames[0];if(!U)continue;let N=(U.sourceURL??"?").replace(/^.*\/node_modules\//,"node_modules/"),B=`${U.name??"?"} @ ${N}:${U.line??"?"}`;K.set(B,(K.get(B)??0)+1)}let H=[...K.entries()].sort((F,U)=>U[1]-F[1]).slice(0,8).map(([F,U])=>({frame:F,count:U}));console.warn(JSON.stringify({msg:"stall-stack",ts:new Date().toISOString(),lagMs:Math.round(G),samplesInWindow:W.length,top:H}))}Q=setTimeout(X,Z),Q.unref?.()};return Q=setTimeout(X,Z),Q.unref?.(),()=>{if(Q)clearTimeout(Q)}}function dL1(){vL1();let $=[cL1(),lL1(),mL1()];return()=>{for(let Z of $)Z()}}import{existsSync as sa6}from"fs";var KG=j0();SL1();var{DBOS:G50,DBOSClient:da6}=await import("@dbos-inc/dbos-sdk");function uO1($,Z){if(!Z)return $;let Q=new URL($);if(!Q.searchParams.has("sslmode"))Q.searchParams.set("sslmode","verify-full");return Q.toString()}var ia6=[v3,_3,IN,VN,MO,Fz],pa6=KG.dispatchRole==="worker"?ia6:KG.dispatchRole==="api"?[]:void 0;G50.setConfig(tO1({systemDatabaseUrl:uO1(KG.databaseUrl,KG.databasePgSsl),poolSize:KG.dbosPoolSize,executorID:KG.podName,listenQueues:pa6}));var{createApp:na6}=await Promise.resolve().then(() => (dG8(),mG8)),{isServerPath:ta6}=await Promise.resolve().then(() => (j50(),BL1)),{createAssetHandler:oa6,resolveClientDir:W38}=await Promise.resolve().then(() => (oG8(),tG8)),ra6=KG.port,Y38=W38(import.meta.url,"../client"),K38=sa6(Y38)?Y38:W38(import.meta.url,"../dist/client"),aa6=oa6({clientDir:K38,isServerPath:ta6}),ea6={"X-Frame-Options":"DENY","Content-Security-Policy":"frame-ancestors 'none'"};function $e6($){let Z=new Headers($.headers);for(let[Q,Y]of Object.entries(ea6))Z.set(Q,Y);return new Response($.body,{status:$.status,statusText:$.statusText,headers:Z})}var{parsePreviewBaseDomain:Ze6,tryHandlePreviewHttp:Qe6,tryUpgradePreviewWs:Ye6,previewWebSocketHandler:xO1,isPreviewWsData:fO1}=await Promise.resolve().then(() => (sG8(),rG8)),{getOrInitSharedRunner:H38}=await Promise.resolve().then(() => (yW(),uR$)),F38=Ze6(process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN),X38={baseDomain:F38??"",getRunner:H38};if(process.env.STUDIO_SANDBOX_TENANT_POOLS?.trim())H38().catch(($)=>{console.warn("[lifecycle] eager sandbox provider init for tenant pools failed:",$ instanceof Error?$.message:String($))});var M_0=await na6({clientDir:K38}),yO1=process.env.DBOS_CONDUCTOR_KEY?.trim(),J38=process.env.DBOS_CONDUCTOR_URL?.trim();await rO1({databaseUrl:uO1(KG.databaseUrl,KG.databasePgSsl)},()=>G50.launch({...yO1?{conductorKey:yO1}:{},...yO1&&J38?{conductorURL:J38}:{}}));console.log(`[dbos] application version: ${G50.applicationVersion}`);var gO1=5,hO1=0;await E8(async()=>{hO1++;try{return await M_0.initDbos()}catch($){let Z=hO1>=gO1?"giving up":"retrying";throw console.warn(`[dbos] initDbos attempt ${hO1}/${gO1} failed, ${Z}`,$),$}},{maxAttempts:gO1,minTimeout:1000,maxTimeout:1e4,jitter:0.5});if(!KG.isCli){let{bannerLines:$}=await Promise.resolve().then(() => (Q38(),Z38));console.log("");for(let Z of $())console.log(Z)}var Xe6=Bun.serve({idleTimeout:0,port:ra6,hostname:"0.0.0.0",fetch:async($,Z)=>{if(F38){let Y=await Ye6($,Z,X38);if(Y===void 0)return;if(Y)return Y;let X=await Qe6($,X38);if(X)return X}let Q=await aa6($);if(Q)return $e6(Q);return M_0.fetch($,{server:Z})},websocket:{open($){if(fO1($.data))xO1.open($)},message($,Z){if(fO1($.data))xO1.message($,Z)},close($){if(fO1($.data))xO1.close($)}},development:!1}),Je6=dL1();if(KG.localMode)Promise.resolve().then(() => (lf(),dq0)).then(async({seedLocalMode:$,markSeedComplete:Z,healLocalJwks:Q})=>{try{let Y=await Q();if(Y>0)console.log(`[local-mode] cleared ${Y} undecryptable JWKS key(s); Better Auth will generate a fresh one`);let X=await $()}catch(Y){console.error("Failed to seed local mode:",Y)}finally{Z()}}).catch(async($)=>{console.error("Failed to load local-mode module:",$);try{let{markSeedComplete:Z}=await Promise.resolve().then(() => (lf(),dq0));Z()}catch{}});var G38=!1;async function Ge6($){let Z;try{Z=await da6.create({systemDatabaseUrl:uO1(KG.databaseUrl,KG.databasePgSsl),systemDatabaseSchemaName:"dbos"});let Q=await Z.listWorkflows({status:"PENDING",queueName:_3,executorId:$,loadInput:!1,loadOutput:!1});if(Q.length===0){console.log(`[shutdown] no in-flight thread-gate gates to hand off (executor ${$})`);return}let Y=Q.map((X)=>X.workflowID);await Z.resumeWorkflows(Y,{queueName:_3}),console.log(`[shutdown] re-enqueued ${Y.length} in-flight thread-gate gate(s) for re-adoption by a live executor (from ${$}):`,Y)}catch(Q){console.error("[shutdown] thread-gate handoff failed:",Q)}finally{await Z?.destroy().catch(()=>{})}}async function I_0($){if(G38)return;G38=!0,console.log(`
 [shutdown] Received ${$}, shutting down gracefully...`);let Z=Number(process.env.SHUTDOWN_GRACE_SECONDS??60)*1000,Q=Math.max(Z-5000,1e4),Y=setTimeout(()=>{console.error(`[shutdown] Timed out after ${Q}ms, forcing exit.`),process.exit(1)},Q);Y.unref?.();let X=0;try{Je6(),M_0.markShuttingDown();let J=aO1(KG.dispatchRole,Q,process.env.SHUTDOWN_DRAIN_MS);await L$(J),await Xe6.stop(!0);let G=G50.executorID;await G50.shutdown(),await Ge6(G),await M_0.shutdown()}catch(J){console.error("[shutdown] Error during shutdown:",J),X=1}clearTimeout(Y),process.exit(X)}process.on("SIGTERM",()=>I_0("SIGTERM"));process.on("SIGINT",()=>I_0("SIGINT"));process.on("SIGHUP",()=>I_0("SIGHUP"));process.on("unhandledRejection",($)=>{console.error("[process] Unhandled rejection:",$)});process.on("uncaughtException",($)=>{console.error("[process] Uncaught exception:",$),I_0("uncaughtException")});