decocms 4.499.0 → 4.499.1

package/dist/server/server.js

@@ -1159,7 +1159,7 @@ Caused by: ${Z.stack}`}};Wi=class Wi extends NX{constructor($,Z){super($,Z);this
 `).filter((Z)=>!/^Co-authored-by:\s/i.test(Z)).join(`
 `).trimEnd()}function js4($){let Z=$.userName.trim(),Q=$.userEmail?.trim();if(Q)return`Co-authored-by: ${Z} <${Q}>`;return`Co-authored-by: ${Z}`}function KQ1($,Z){let Q=Ai(Z);if(!Q)return $;let Y=$V$($),X=js4(Q);if(Y.includes(X))return Y;let J=Y.trimEnd();return J.length>0?`${J}
 
-${X}`:X}var eI$,ws4;var HQ1=L(()=>{eI$=/[\r\n<>]/,ws4=/^[^\s@<>]+@[^\s@<>]+\.[^\s@<>]+$/});var Rq0=L(()=>{r$();HQ1()});function Es4($){if($ instanceof TypeError)return!0;if($ instanceof Error&&!($ instanceof DOMException)&&typeof $.code==="string")return!0;if($ instanceof DOMException&&$.name==="AbortError")return!0;return!1}async function FQ1($,Z,Q,Y){try{return await D8(async()=>{let J=await fetch($,{...Z,signal:AbortSignal.timeout(Y)});return{status:J.status,ok:J.ok,body:await J.text()}},{maxAttempts:3,minTimeout:50,maxTimeout:500,multiplier:2,jitter:0.5,isRetriable:Es4})}catch(X){let J=X instanceof Error?X.message:String(X);throw Error(`[SANDBOX_UNREACHABLE] sandbox daemon ${Q} request failed: ${J}`,{cause:X})}}async function qq0($){try{let Z=await fetch(`${$}/health`,{signal:AbortSignal.timeout(Ps4)});if(!Z.ok){try{await Z.text()}catch{}return null}let Q=await Z.json();if(typeof Q==="object"&&Q!==null&&typeof Q.bootId==="string"&&typeof Q.ready==="boolean"&&Q.setup&&typeof Q.setup.running==="boolean"&&typeof Q.setup.done==="boolean")return Q;return null}catch{return null}}async function NQ1($){for(let Z=0;Z<ZV$;Z++){if(await qq0($)!==null)return;let Q=(Math.random()*2-1)*zs4;await F$(QV$+Q)}throw Error(`sandbox daemon at ${$} did not respond on /health within ${ZV$*QV$/1000}s`)}async function zK($,Z,Q,Y,X){return As4($,Z,"POST",Q,Y,X)}async function As4($,Z,Q,Y,X,J){let G={...Y};if(X&&X.rotateToken!==void 0)G.auth=X;let W=await FQ1(`${$}/_sandbox/config`,{method:Q,headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:JSON.stringify(G)},"/_sandbox/config",J?.timeoutMs??UQ1);if(!W.ok)throw new AJ(W.status,W.body);return XV$(W.body,"/_sandbox/config")}async function YV$($,Z,Q){let Y=await FQ1(`${$}/_sandbox/setup/${Q}`,{method:"POST",headers:{Authorization:`Bearer ${Z}`}},`/_sandbox/setup/${Q}`,UQ1);if(!Y.ok)throw Error(`sandbox daemon /_sandbox/setup/${Q} returned ${Y.status}: ${Y.body}`)}async function I80($,Z,Q){let Y=await FQ1(`${$}/_sandbox/orgfs-config`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:Q},"/_sandbox/orgfs-config",UQ1);if(!Y.ok)throw Error(`sandbox daemon /_sandbox/orgfs-config returned ${Y.status}: ${Y.body}`);return XV$(Y.body,"/_sandbox/orgfs-config")}function XV$($,Z){try{return JSON.parse($)}catch(Q){throw Error(`sandbox daemon ${Z} returned a malformed JSON body: ${$.slice(0,200)}`,{cause:Q})}}async function Mq0($,Z,Q,Y){let X=new Headers(Y.headers);for(let W of Ts4)X.delete(W);X.set("authorization",`Bearer ${Z}`);let J=Y.method!=="GET"&&Y.method!=="HEAD",G=`${$}${Q.startsWith("/")?Q:`/${Q}`}`;return fetch(G,{method:Y.method,headers:X,body:J?Y.body:void 0,redirect:"manual",signal:Y.signal,duplex:J?"half":void 0})}var AJ,Ps4=500,UQ1=30000,ZV$=25,QV$=200,zs4=50,Ts4;var vy=L(()=>{Rq0();r$();AJ=class AJ extends Error{status;constructor($,Z){super(`sandbox daemon /_sandbox/config returned ${$}: ${Z}`);this.status=$;this.name="ConfigRequestError"}};Ts4=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length"]});class Iq0{counted=new Set;markCounted($){this.counted.add($)}consume($){return this.counted.delete($)}}class by{map=new Map;async run($,Z){let Q=this.map.get($);if(Q)return Q;let Y=Z();this.map.set($,Y);try{return await Y}finally{this.map.delete($)}}}function Vq0($,Z,Q){if(!$)return Q(null);if(!$.withLock)return Q($);return $.withLock(Z,Q)}function V80($){if(!$.orgId||!$.virtualMcpId||!$.branch)throw Error("composeSandboxRef: orgId, virtualMcpId and branch are all required for agent refs");return`agent:${$.orgId}:${$.virtualMcpId}:${$.branch}`}function JV$($){if(!$.startsWith("agent:"))return"";let Z=$.split(":");return Z.length>=4?Z.slice(3).join(":"):""}import{hash as Rs4}from"crypto";function qs4($,Z=16){return Rs4("sha256",pz$($),"hex").slice(0,Z)}function m3($){let Z=qs4($),Q=Ms4(JV$($.projectRef));return Q?`${Q}-${Z}`:`s-${Z}`}function Ms4($){if(!$)return"";let Z=$.split("/").pop()??"",Q="",Y=!1;for(let X of Z.toLowerCase()){let J=X.charCodeAt(0),G=J>=97&&J<=122,W=J>=48&&J<=57;if(!G&&!W){Y||=Q.length>0;continue}if(Y){if(Q.length+1>=GV$)break;Q+="-",Y=!1}if(Q+=X,Q.length===GV$)break}return Q}var GV$=24;var WV$=L(()=>{KZ1()});function kq0($,Z){let Q=$.replace(/\/+$/,"");if(Q.includes("{handle}"))return`${Q.replace("{handle}",Z)}/`;try{let Y=new URL(Q);return Y.hostname=`${Z}.${Y.hostname}`,`${Y.toString()}/`}catch{return`${Q}/${Z}/`}}function Ti($){let Z=$.repo,Q=Z?{repository:{cloneUrl:Z.cloneUrl,repoName:Z.displayName??Is4(Z.cloneUrl),...Z.branch?{branch:Z.branch}:{},submoduleCredentials:Z.submoduleCredentials??[]},repositories:($.extraRepos??[]).filter((K)=>!!K.directoryName).map((K)=>({cloneUrl:K.cloneUrl,repoName:K.directoryName,...K.branch?{branch:K.branch}:{},submoduleCredentials:K.submoduleCredentials??[]})),...Z.userName.trim()||Z.userEmail.trim()?{identity:{userName:Z.userName,userEmail:Z.userEmail}}:{}}:void 0,Y=$.tenant,X=Ai({userName:Y?.userName,userEmail:Y?.userEmail})??void 0,J=$.packageManager?{name:$.packageManager.name,...$.packageManager.path?{path:$.packageManager.path}:{}}:void 0,G=J?{packageManager:J,runtime:$.runtime,...$.port!==void 0?{port:$.port}:{}}:void 0,W=Y?.orgId;if(!Q&&!G&&!X&&$.cloneOnly===void 0&&!W)return null;return{...Q?{git:Q}:{},...X?{operator:X}:{},...W?{orgId:W}:{},...$.cloneOnly!==void 0?{cloneOnly:$.cloneOnly}:{},...G?{application:G}:{}}}function Is4($){try{let Z=new URL($);return Z.pathname.replace(/^\/+/,"").replace(/\.git$/,"")||Z.hostname}catch{return $}}var KV$=L(()=>{HQ1()});function Vs4($){try{return new URL($).username.length>0}catch{return!1}}function k80($){let Z=$.repo?.cloneUrl;if(!Z||!Vs4(Z))return null;return{git:{repository:{cloneUrl:Z}}}}var Ri=L(()=>{WV$();KV$()});async function*UV$($){let Z=$.now??(()=>Date.now()),Q=Z(),Y=$.schedulingTimeoutMs??Ss4,X={pod:{},sandbox:{},events:{hasPulling:!1,hasPulled:!1},startedAt:Q},J=[],G=null,W=!1,K=(E)=>{if(W)return;if(G){let P=G;G=null,P(E)}else J.push(E)},H=()=>{if(J.length>0)return Promise.resolve(J.shift());if(W)return Promise.resolve(null);return new Promise((E)=>{G=E})},F=()=>{if(W)return;if(W=!0,G){let E=G;G=null,E(null)}},U=new AbortController,N=()=>{U.abort(),F()};if($.signal)if($.signal.aborted)U.abort(),F();else $.signal.addEventListener("abort",N,{once:!0});let B=Math.max(0,Y-(Z()-Q)),D=setTimeout(()=>K("tick"),B+100),O,w=new Promise((E)=>{O=E}),j=Promise.allSettled([_s4($.kc,$.namespace,$.claimName,U.signal,X,K,Z,O),bs4($.kc,$.namespace,$.claimName,U.signal,X,K),xs4($.kc,$.namespace,$.claimName,w,U.signal,X,K,Z)]);try{let E=null,P=-1,T=HV$(X,Y,Z);if(E=DQ1(T),!BQ1(T))P=FV$(T);if(yield T,BQ1(T))return;while(!W){if(await H()===null)break;let A=HV$(X,Y,Z);if(BQ1(A)){let _=DQ1(A);if(_!==E)E=_,yield A;return}let q=FV$(A);if(q<P)continue;let x=DQ1(A);if(x!==E)E=x,P=q,yield A}}finally{if(clearTimeout(D),U.abort(),$.signal)$.signal.removeEventListener("abort",N);F(),await j.catch(()=>{})}}async function NV$($,Z=Cs4){let Q=new AbortController,Y="claiming",X,J=()=>{clearTimeout(X),X=setTimeout(()=>Q.abort(),Z)};try{J();for await(let G of $(Q.signal)){if(G.kind==="ready")return;if(G.kind==="failed")throw new NX(G.message);Y=G.kind,J()}}finally{clearTimeout(X),Q.abort()}throw new Wi(`Sandbox did not become ready: no progress for ${Math.round(Z/1000)}s while ${Y}`)}function HV$($,Z,Q){let{pod:Y,sandbox:X,events:J,startedAt:G}=$;if(X.ready)return{kind:"ready"};let W=Y.containerWaitingReason;if(W==="ImagePullBackOff"||W==="ErrImagePull")return{kind:"failed",reason:"image-pull-backoff",message:"Sandbox image failed to download. The cluster may be missing pull credentials or the image tag may not exist."};if(W==="CrashLoopBackOff")return{kind:"failed",reason:"crash-loop-backoff",message:"Sandbox crashed during startup and is now in CrashLoopBackOff. Check pod logs."};if(!Y.scheduled&&J.lastFailedSchedulingAt!==void 0&&Q()-G>Z)return{kind:"failed",reason:"scheduling-timeout",message:J.failedSchedulingMessage??`Pod could not be scheduled within ${Math.round(Z/1000)}s.`};if(Y.containerRunning&&!Y.containerReady)return{kind:"warming-daemon",since:G};if(J.hasPulling&&!J.hasPulled)return{kind:"pulling-image",since:G};if(W==="ContainerCreating"||W==="PodInitializing"||Y.scheduled&&!Y.containerRunning)return{kind:"starting-container",since:G};if(Y.scheduledFalseReason==="Unschedulable"||J.lastFailedSchedulingAt!==void 0&&!Y.scheduled)return{kind:"waiting-for-capacity",since:G,message:J.failedSchedulingMessage??Y.scheduledFalseMessage,nodeClaim:J.nominatedNodeClaim};return{kind:"claiming",since:G}}function BQ1($){return $.kind==="ready"||$.kind==="failed"}function FV$($){switch($.kind){case"claiming":return 0;case"waiting-for-capacity":return 1;case"pulling-image":return 2;case"starting-container":return 3;case"warming-daemon":return 4;case"ready":case"failed":return 99}}function DQ1($){switch($.kind){case"claiming":case"pulling-image":case"starting-container":case"warming-daemon":return $.kind;case"waiting-for-capacity":return`waiting-for-capacity:${$.message??""}:${$.nodeClaim??""}`;case"ready":return"ready";case"failed":return`failed:${$.reason}:${$.message}`}}async function _s4($,Z,Q,Y,X,J,G,W){let K=`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?watch=true&labelSelector=${encodeURIComponent(`${ks4}=${Q}`)}`;return Sq0({kc:$,path:K,signal:Y,label:`pod/${Q}`,onEvent:(H)=>{if(H.type!=="ADDED"&&H.type!=="MODIFIED")return;let F=H.object;if(F.metadata?.name)W(F.metadata.name);vs4(F,X,G),J("pod")}})}function vs4($,Z,Q){let X=($.status?.conditions??[]).find((G)=>G.type==="PodScheduled");if(X?.status==="True")Z.pod.scheduled=!0,Z.pod.scheduledFalseReason=void 0,Z.pod.scheduledFalseMessage=void 0;else if(X?.status==="False")Z.pod.scheduled=!1,Z.pod.scheduledFalseReason=X.reason,Z.pod.scheduledFalseMessage=X.message;let J=($.status?.containerStatuses??[]).find((G)=>G.name===Y7.MAIN_CONTAINER_NAME);if(J)Z.pod.containerWaitingReason=J.state?.waiting?.reason,Z.pod.containerRunning=!!J.state?.running,Z.pod.containerReady=J.ready===!0}async function bs4($,Z,Q,Y,X,J){let G=`/apis/${Y7.CLAIM_API_GROUP}/${Y7.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(Z)}/${Y7.CLAIM_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${Q}`)}`;return Sq0({kc:$,path:G,signal:Y,label:`sandboxclaim/${Q}`,onEvent:(W)=>{if(W.type!=="ADDED"&&W.type!=="MODIFIED")return;let H=W.object.status?.conditions?.find((F)=>F.type==="Ready");if(!H)return;if(H.status==="True")X.sandbox.ready=!0,X.sandbox.notReadyReason=void 0,X.sandbox.notReadyMessage=void 0;else X.sandbox.ready=!1,X.sandbox.notReadyReason=H.reason,X.sandbox.notReadyMessage=H.message;J("sandbox")}})}async function xs4($,Z,Q,Y,X,J,G,W){let K=await Promise.race([Y,new Promise((F)=>{if(X.aborted){F(Q);return}X.addEventListener("abort",()=>F(Q),{once:!0})})]);if(X.aborted)return;let H=`/api/v1/namespaces/${encodeURIComponent(Z)}/events?watch=true&fieldSelector=${encodeURIComponent(`involvedObject.name=${K},involvedObject.kind=Pod`)}`;return Sq0({kc:$,path:H,signal:X,label:`events/${Q}`,onEvent:(F)=>{if(F.type!=="ADDED"&&F.type!=="MODIFIED")return;let U=F.object,N=U.reason;if(!N)return;switch(N){case"Pulling":J.events.hasPulling=!0;break;case"Pulled":J.events.hasPulling=!0,J.events.hasPulled=!0;break;case"FailedScheduling":J.events.lastFailedSchedulingAt=W(),J.events.failedSchedulingMessage=U.message;break;case"Nominated":{let B=U.message?.match(/nodeclaim\/([\w-]+)/);if(B)J.events.nominatedNodeClaim=B[1];break}default:return}G("event")}})}async function BV$($){let{kc:Z,namespace:Q,labelSelector:Y,signal:X,onDelete:J}=$,G=`/apis/${Y7.CLAIM_API_GROUP}/${Y7.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(Q)}/${Y7.CLAIM_PLURAL}?watch=true&labelSelector=${encodeURIComponent(Y)}`;return Sq0({kc:Z,path:G,signal:X,label:"sandboxclaim-reaper",onEvent:(W)=>{if(W.type!=="DELETED")return;let K=W.object.metadata?.name;if(K)J(K)}})}async function Sq0($){let{kc:Z,path:Q,signal:Y,label:X,onEvent:J}=$,G=0;while(!Y.aborted){try{let K=await EK(Z,{method:"GET",path:Q,signal:Y,headers:{accept:"application/json"},stream:!0});if(!K.ok||!K.body){try{await K.body?.cancel()}catch{}if(K.status===401||K.status===403){console.warn(`[lifecycle-watcher] ${X} stopped: watch denied (${K.status} ${K.statusText}). `+"The kubeconfig in use cannot watch SandboxClaims \u2014 if you are running locally, "+"this provider should not be active (check STUDIO_AGENT_SANDBOX_ENABLED).");return}throw Error(`watch handshake failed: ${K.status} ${K.statusText}`)}G=0;for await(let H of R2$(K.body)){if(Y.aborted)return;try{J(H)}catch(F){console.warn(`[lifecycle-watcher] ${X} onEvent threw: ${F instanceof Error?F.message:String(F)}`)}}}catch(K){if(Y.aborted)return;let H=K instanceof Error?K.message:String(K);console.warn(`[lifecycle-watcher] ${X} watch ended: ${H}`)}if(Y.aborted)return;let W=I7(5000,250,G,2,0);G+=1,await F$(W,{signal:Y}).catch(()=>{})}}var ks4="studio.decocms.com/sandbox-handle",Ss4=300000,Cs4=600000;var DV$=L(()=>{r$();J80();WN0()});import{createHash as fs4}from"crypto";import{z as TJ}from"zod";function AK($){let Z;try{Z=new URL($.trim())}catch{return null}if(Z.protocol!=="https:"||Z.search||Z.hash)return null;let Q=Z.pathname.replace(/\/+$/,"").replace(/\.git$/,"").replace(/\/+$/,"");return Q?`https://${Z.host.toLowerCase()}${Q}`:null}function S80($){return AK($)?.toLowerCase()??null}function ls4($){let Z=new Set;for(let Q of $){let Y=`${S80(Q.repoUrl)??Q.repoUrl}#${Q.branch}`;if(Z.has(Y))return Q;Z.add(Y)}return null}function LV$($){return $.reduce((Z,Q)=>Z+Q.replicas,0)}function wV$($,Z){if(Z.warmPoolName)return Z.warmPoolName;let Q=fs4("sha256").update(`${Z.repoUrl}#${Z.branch}`).digest("hex").slice(0,8);return`${$}-${Q}`}function jV$($){return Math.max(0,$.size-LV$($.repos))}function qi($){return $.flatMap((Z)=>Z.repos.map((Q)=>({pool:Z,repo:Q,warmPoolName:wV$(Z.name,Q)})))}function cs4($,Z){return AV$(void 0,$,!0,Z)}function EV$($,{templateName:Z}){let Q=cs4(Z,$.image),Y=(X,J)=>({apiVersion:`${Y7.CLAIM_API_GROUP}/${Y7.CLAIM_API_VERSION}`,kind:"SandboxWarmPool",metadata:{name:X,labels:{[ms4]:$.name}},spec:{replicas:J,updateStrategy:{type:"OnReplenish"},sandboxTemplateRef:{name:Q}}});return[...$.repos.map((X)=>Y(wV$($.name,X),X.replicas)),Y($.name,jV$($))]}function PV$($){return $.tenant?.orgId}function OQ1($,Z){if(!Z.tenant)return null;let Q=$.filter((J)=>J.tenant===Z.tenant&&J.image===Z.image),Y=Z.cloneUrl?S80(Z.cloneUrl):null;if(Y){let J=qi(Q).filter((W)=>S80(W.repo.repoUrl)===Y),G=J.find((W)=>W.repo.branch===Z.branch)??J[0];if(G)return G}let X=Q.find((J)=>jV$(J)>0);return X?{pool:X,repo:null,warmPoolName:X.name}:null}function zV$($,Z,Q){return $?.warmPoolName??(Z?Q:"none")}function AV$($,Z,Q=!1,Y){let X=Y&&Y!=="default"?`-${Y}`:"";return`${Z}${X}${$==="harness-run"||Q?"-medium":""}`}async function wQ1($){let Z=AV$($.purpose,$.templateName,$.tenantPool,$.sandboxImage);if(Z===$.templateName)return{name:Z,probes:$.probes};let Q=$.probes[Z]??null,Y=Q!==null&&$.now-Q.checkedAt<$.ttlMs?Q:{checkedAt:$.now,present:await $.exists(Z)},X={...$.probes,[Z]:Y};if(Y.present)return{name:Z,probes:X};if(Q?.present!==!1)$.onAbsent?.(Z);if($.sandboxImage&&$.sandboxImage!=="default")return wQ1({...$,sandboxImage:void 0,probes:X});return{name:$.templateName,probes:X}}function jQ1($,Z,Q){let Y=S80(Z);if(!Y)return[];let X=Q.replace(/^refs\/heads\//,"");return qi($).filter(({repo:J})=>S80(J.repoUrl)===Y&&J.branch===X)}class EQ1{source;dirty=new Set;pods=new Map;known=new Map;constructor($){this.source=$}pools(){return this.source()}resolve($){return OQ1(this.pools(),$)}markDirty($,Z){let Q=jQ1(this.pools(),$,Z).map((Y)=>Y.warmPoolName);for(let Y of Q)this.dirty.add(Y);return Q}takeDirty($){return this.dirty.delete($)}pod($){return this.pods.get($)}setPod($,Z){this.pods.set($,Z)}retainPods($,Z){for(let[Q,Y]of this.pods)if(Y.pool===$&&!Z.has(Q))this.pods.delete(Q)}retain($){let Z=new Map($.map((Y)=>[Y.warmPoolName,Y])),Q=[...this.known.values()].filter((Y)=>!Z.has(Y.warmPoolName));for(let Y of this.dirty)if(!Z.has(Y))this.dirty.delete(Y);for(let[Y,X]of this.pods)if(!Z.has(X.pool))this.pods.delete(Y);return this.known=Z,Q}}var ys4=54,gs4,hs4=2048,us4,C80,Cq0,LQ1,OV$,ms4="studio.decocms.com/tenant-pool";var _80=L(()=>{t4();J80();gs4=/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/;us4=TJ.object({runtime:TJ.enum(["node","bun","deno"]).default("node"),packageManager:TJ.enum(["npm","pnpm","yarn","bun","deno"]).optional(),packageManagerPath:TJ.string().optional(),devPort:TJ.number().int().positive().optional()}).default({runtime:"node"}),C80=TJ.object({repoUrl:TJ.string().max(hs4).transform(($,Z)=>{let Q=AK($);if(Q)return Q;return Z.addIssue({code:"custom",message:"repoUrl must be an https clone URL"}),TJ.NEVER}),branch:TJ.string().min(1).default("main"),workload:us4,replicas:TJ.number().int().min(1)});Cq0=class Cq0 extends Error{poolName;size;allocated;constructor($,Z,Q){super(`pool ${$}: repos take ${Q} replicas, more than its size ${Z}`);this.poolName=$;this.size=Z;this.allocated=Q;this.name="TenantPoolCapacityError"}};LQ1=TJ.object({name:TJ.string().max(ys4).regex(gs4,"pool name must be a DNS label (lowercase alphanumeric and '-')"),tenant:TJ.string().min(1).max(512),size:TJ.number().int().min(1),image:FN.default("default")}),OV$=LQ1.extend({repos:TJ.array(C80).default([])}).superRefine(($,Z)=>{let Q=ls4($.repos);if(Q)Z.addIssue({code:"custom",path:["repos"],message:`duplicate repo allocation ${Q.repoUrl}#${Q.branch}`});let Y=LV$($.repos);if(Y>$.size)Z.addIssue({code:"custom",path:["repos"],message:new Cq0($.name,$.size,Y).message})})});async function TV$($,Z,Q){let Y=new Map;for(let X of $){let J=Z(X);if(!J)continue;let G=Y.get(J);if(G)G.push(X);else Y.set(J,[X])}await Promise.allSettled([...Y.values()].map(async(X)=>{for(let J of X)await Q(J).catch(()=>{})}))}function ds4($){try{let Z=new URL($);if(Z.hostname.toLowerCase()!=="github.com")return null;let[Q,Y]=Z.pathname.replace(/^\/+/,"").split("/"),X=Y?.replace(/\.git$/,"");return Q&&X?`${Q}/${X}`.toLowerCase():null}catch{return null}}function RV$($){if($.repositoryId)return{repositoryId:$.repositoryId};let Z=$.connectionId?ds4($.cloneUrl):null;return $.connectionId&&Z?{connectionId:$.connectionId,repo:Z}:null}var qV$=L(()=>{_80()});async function Mi($,Z,Q,Y){let X=(G)=>Mq0(G.url,G.token,Z,Q),J=!(Q.body instanceof ReadableStream);try{let G=await X($);if(G.status!==401||!J)return G;let W=await Y.unauthorized();if(!W)return G;return await G.body?.cancel().catch(()=>{}),await X(W)}catch(G){if(!J)throw G;let W=await Y.unreachable();if(!W)throw G;return X(W)}}var _q0=L(()=>{vy()});function VV$($,Z){return new Response(JSON.stringify(Z),{status:$,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function MV$($){let Z=new Headers;for(let[Q,Y]of $.headers.entries())if(!ps4.includes(Q.toLowerCase()))Z.set(Q,Y);return new Response($.body,{status:$.status,statusText:$.statusText,headers:Z})}function IV$($,Z){let Q=VV$($,{error:Z});return Q.headers.set("x-sandbox-preview-not-ready","1"),Q}async function Vi($,Z,Q){let Y=await Z.base();if(!Y)return IV$(404,"sandbox not found");let X=new URL($.url);if((X.pathname==="/_sandbox"||X.pathname.startsWith("/_sandbox/"))&&$.method!=="GET")return VV$(404,{error:"not found"});let G=(F)=>`${F}${X.pathname}${X.search}`,W=new Headers($.headers);for(let F of is4)W.delete(F);let K=$.method!=="GET"&&$.method!=="HEAD",H={method:$.method,headers:W,body:K?$.body:void 0,redirect:"manual",signal:$.signal,duplex:K?"half":void 0};try{return MV$(await fetch(G(Y),H))}catch(F){let U=`${Y}${X.pathname}`;if(console.warn(`[${Q}] preview fetch to ${U} failed: ${F instanceof Error?F.message:String(F)}`),Z.invalidate(),$.method==="GET"||$.method==="HEAD"){let N=await Z.retryBase();if(N)try{return MV$(await fetch(G(N),H))}catch(B){console.warn(`[${Q}] preview fetch retry to ${U} failed: ${B instanceof Error?B.message:String(B)}`)}}return IV$(502,"sandbox daemon unreachable")}}var Ii="x-sandbox-preview-not-ready",is4,ps4;var vq0=L(()=>{is4=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length","upgrade"],ps4=["connection","keep-alive","transfer-encoding","content-encoding","content-length"]});import{createHash as ns4,randomBytes as ts4,randomUUID as kV$}from"crypto";import*as fV$ from"net";import{PassThrough as os4}from"stream";function SV$($){if($ instanceof Error)return $.message;if($&&typeof $==="object"){let Z=$;if(Z.error instanceof Error)return Z.error.message;if(typeof Z.message==="string"&&Z.message)return Z.message}return String($)}function vV$($){return{pool:$.warmPoolName,org:$.pool.tenant}}class MQ1{records=new Map;inflight=new by;activeGauge=new Iq0;stateStore;previewUrlPattern;kubeConfig;capacityProbe;portForward;namespace;sandboxTemplateName;envName;tokenGenerator;idleTtlMs;metrics;previewGateway;sentinelToken;mintCloneUrl;mintPoolCloneUrl;mintOrgFsConfig;forwardPort;daemonAddress;persistCredentials;tenantPools;tenantPoolRefreshMs;templateProbes={};closed=!1;claimWatchAbort=new AbortController;constructor($={}){this.stateStore=$.stateStore??null,this.previewUrlPattern=$.previewUrlPattern??null,this.kubeConfig=$.kubeConfig??Kr4(),this.portForward=new p71(this.kubeConfig),this.namespace=$.namespace??ss4,this.sandboxTemplateName=$.sandboxTemplateName??rs4,this.envName=Br4($.envName),this.tokenGenerator=$.tokenGenerator??(()=>ts4(es4).toString("hex")),this.idleTtlMs=$.idleTtlMs??Zr4,this.metrics=$.meter?Wr4($.meter):null,this.previewGateway=$.previewGateway&&$.previewUrlPattern?{...$.previewGateway}:null;let Z=$.sentinelToken?.trim()??"";this.sentinelToken=Z.length>0?Z:null,this.mintCloneUrl=$.mintCloneUrl,this.mintPoolCloneUrl=$.mintPoolCloneUrl,this.mintOrgFsConfig=$.mintOrgFsConfig,this.forwardPort=$.forwardPort,this.daemonAddress=$.daemonAddress??"forward",this.persistCredentials=$.persistCredentials??!0;let Q=$.tenantPools;if(this.tenantPools=this.sentinelToken===null?null:new EQ1(typeof Q==="function"?Q:()=>Q??[]),this.sentinelToken===null&&(typeof Q==="function"||(Q?.length??0)>0))console.warn(`[${I6}] tenant pools configured without a sentinel token \u2014 ignoring them (warm-pool mode is off)`);this.tenantPoolRefreshMs=$.tenantPoolRefreshMs??Yr4,this.startClaimReaper(),this.startCredentialRefresher(),this.startTenantPoolReconciler()}startClaimReaper(){let $=["app.kubernetes.io/managed-by=studio","app.kubernetes.io/name=studio-sandbox",...this.envName?[`${RJ.env}=${this.envName}`]:[]].join(",");BV$({kc:this.kubeConfig,namespace:this.namespace,labelSelector:$,signal:this.claimWatchAbort.signal,onDelete:(Z)=>this.invalidateRecord(Z)})}async ensure($,Z={}){let Q=m3($);if(Q.startsWith("s-"))throw Error(`ensure: projectRef has no slug source: ${$.projectRef}`);return this.inflight.run(Q,()=>Vq0(this.stateStore,$,(Y)=>this.ensureLocked($,Q,Z,Y)))}async delete($){let Z=await this.getRecord($);if(this.records.delete($),Z)this.dropRecord(Z);if(await this.deleteHttpRouteIfManaged($).catch((Q)=>{console.warn(`[${I6}] HTTPRoute delete failed for ${$}: ${Q instanceof Error?Q.message:String(Q)}`)}),await JR(this.kubeConfig,this.namespace,$),this.stateStore)if(Z)await this.stateStore.delete(Z.id);else await this.stateStore.deleteByHandle($)}lastTermination($){return L2$(this.kubeConfig,this.namespace,RJ.sandboxHandle,$,Y7.MAIN_CONTAINER_NAME)}async alive($){return await OL(this.kubeConfig,this.namespace,$)!==void 0}watchClaimLifecycle($,Z){return UV$({kc:this.kubeConfig,namespace:this.namespace,claimName:$,signal:Z})}hasSchedulableCapacity(){return this.capacityProbe??=M2$(this.kubeConfig,this.namespace),this.capacityProbe()}async getPreviewUrl($){let Z=await this.getRecord($);if(!Z)return null;return this.composePreviewUrl(Z)}async proxyDaemonRequest($,Z,Q){let Y=await this.getRecord($);if(!Y&&this.previewUrlPattern&&this.stateStore){let K=await this.stateStore.getByHandle($),H=K?.state,F=H?.token;if(K&&F){let N=`http://${H?.adoptedSandboxName??$}.${this.namespace}.svc.cluster.local:${vN}`;try{let B=await Mq0(N,F,Z,Q);if(B.status!==404)return B;try{await B.body?.cancel()}catch{}}catch{}}}if(!Y)Y=await this.resurrectByHandle($);if(!Y)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let X=Y,J=performance.now(),G=0,W=(K)=>{return X=K,{url:K.daemonUrl,token:K.token}};try{let K=await Mi(W(Y),Z,Q,{unauthorized:async()=>{this.invalidateRecord($);let H=await this.getRecord($).catch(()=>null)??await this.resurrectByHandle($).catch(()=>null);return H?W(H):null},unreachable:async()=>{this.invalidateRecord($);let H=await this.resurrectByHandle($)??await this.getRecord($).catch(()=>null);return H?W(H):null}});return G=K.status,K}finally{this.recordProxyDuration("daemon",G,X,performance.now()-J)}}async adoptLiveClaim($,Z){if(this.records.has(Z))return!0;let Q=await OL(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!Q||Q.metadata?.deletionTimestamp)return!1;return await this.inflight.run(Z,async()=>{let X=this.records.get(Z);if(X)return this.toSandbox(X);let J=await this.adopt($,Z,Q);if(!J)throw Error(`cannot adopt live claim ${Z}`);return Vq0(this.stateStore,$,(G)=>this.finish(J,G,!0,!0,"adopt"))}).catch(()=>null)!=null}async resolvePreviewUpstreamUrl($){if(this.previewUrlPattern)return`http://${await this.resolveServiceNameForHandle($)}.${this.namespace}.svc.cluster.local:${vN}`;let Z=await this.getRecord($);if(Z)return Z.daemonUrl;let Q=await this.resurrectByHandle($);return Q?Q.daemonUrl:null}async daemonEndpoint($){let Z=await this.getRecord($)??await this.resurrectByHandle($);if(!Z)return null;return{url:this.daemonAddress==="service"?`http://${Z.adoptedSandboxName}.${this.namespace}.svc.cluster.local:${vN}`:Z.daemonUrl,token:Z.token}}listSandboxes(){return[...this.records.values()].map(($)=>{let Z=$.ensureOpts,Q=Z?.tenant;return{handle:$.handle,tenant:Q?{orgId:Q.orgId,userId:Q.userId}:null,repos:[Z?.repo,...Z?.extraRepos??[]].filter((Y)=>Y!==void 0).map(RV$).filter((Y)=>Y!==null),orgFs:Boolean(Z?.orgFsConfigJson)||$.orgFsRedacted===!0}})}async resolveServiceNameForHandle($){let Z=this.records.get($);if(Z)return Z.adoptedSandboxName;if(this.stateStore){let Y=(await this.stateStore.getByHandle($).catch(()=>null))?.state?.adoptedSandboxName;if(Y)return Y}return $}async proxyPreviewRequest($,Z){let Q=performance.now(),Y=this.records.get($)??null,X=0;try{let J=await Vi(Z,{base:()=>this.resolvePreviewUpstreamUrl($),invalidate:()=>this.invalidateRecord($),retryBase:async()=>{return await this.resurrectByHandle($).catch(()=>null)?this.resolvePreviewUpstreamUrl($):null}},I6);return X=J.status,J}finally{this.recordProxyDuration("preview",X,Y,performance.now()-Q,$)}}async ensureLocked($,Z,Q,Y){if(Q.image)console.warn(`[${I6}] opts.image ignored (template ${this.sandboxTemplateName} pins image): got ${Q.image}`);if(Y){let G=await Y.get($);if(G){let W=await this.rehydrate($,Z,G);if(W)return await this.refreshDaemonGitCredential(W,Q),await this.relayOrgFsConfig(W.daemonUrl,W.token,Q.orgFsConfigJson),this.finish(W,Y,!1,!0,"resume");await Y.delete($)}}let X=await OL(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(X)if(X.metadata?.deletionTimestamp)await K80(this.kubeConfig,this.namespace,Z).catch((G)=>{console.warn(`[${I6}] wait for terminating claim ${Z} failed: ${G instanceof Error?G.message:String(G)}`)});else if(!PQ1(X)){let G=await this.join($,Z,Q,X).catch((W)=>{return console.warn(`[${I6}] join of starting claim ${Z} failed, recreating: ${W instanceof Error?W.message:String(W)}`),null});if(G)return this.finish(G,Y,!0,!0,"adopt");await JR(this.kubeConfig,this.namespace,Z).catch(()=>{}),await K80(this.kubeConfig,this.namespace,Z).catch((W)=>{console.warn(`[${I6}] wait for deleted claim ${Z} failed: ${W instanceof Error?W.message:String(W)}`)})}else{let G=await this.adopt($,Z,X).catch((W)=>{return console.warn(`[${I6}] adopt ${Z} failed, recreating: ${W instanceof Error?W.message:String(W)}`),null});if(G)return await this.refreshDaemonGitCredential(G,Q),await this.relayOrgFsConfig(G.daemonUrl,G.token,Q.orgFsConfigJson),this.finish(G,Y,!0,!0,"adopt");await JR(this.kubeConfig,this.namespace,Z).catch(()=>{}),await K80(this.kubeConfig,this.namespace,Z).catch((W)=>{console.warn(`[${I6}] wait for deleted claim ${Z} failed: ${W instanceof Error?W.message:String(W)}`)})}let J=await this.provision($,Z,Q);return this.finish(J,Y,!0,!1,"fresh")}async finish($,Z,Q,Y,X){let J=this.records.get($.handle),G=J!==void 0;if(J&&J.daemonForward!==$.daemonForward)this.closeForwarder(J.daemonForward);if(this.records.set($.handle,$),Q)await this.persist(Z,$);if(Y)await GN0(this.kubeConfig,this.namespace,$.handle,this.computeShutdownTime()).catch((W)=>console.warn(`[${I6}] TTL refresh failed for ${$.handle}: ${W instanceof Error?W.message:String(W)}`));if(this.metrics){let W=TQ1($.tenant);if(this.metrics.ensureOutcome.add(1,{...W,outcome:X}),!G)this.metrics.active.add(1,W),this.activeGauge.markCounted($.handle)}return this.toSandbox($)}buildEnvMap($,Z){let Q={},Y=[];for(let[X,J]of Object.entries($.env??{}))if($r4.has(X))Y.push(X);else Q[X]=J;if(Y.length>0)console.warn(`[${I6}] opts.env keys overlap reserved bootstrap names and were dropped: ${Y.join(",")}`);return{...Q,DAEMON_TOKEN:Z.token,DAEMON_BOOT_ID:Z.daemonBootId,APP_ROOT:Z.workdir,PROXY_PORT:String(vN)}}async resolveTemplateName($,Z,Q){let{name:Y,probes:X}=await wQ1({purpose:$,tenantPool:Z,...Q?{sandboxImage:Q}:{},templateName:this.sandboxTemplateName,probes:this.templateProbes,now:Date.now(),ttlMs:as4,exists:(J)=>U2$(this.kubeConfig,this.namespace,J),onAbsent:(J)=>console.warn(`[${I6}] SandboxTemplate ${J} not found (or not readable) \u2014 this claim falls back to a template without that suffix. Upgrade the sandbox-env chart to the version that renders it.`)});return this.templateProbes=X,Y}buildClaim($,Z,Q,Y,X){let J=this.sentinelToken!==null,G=J?[]:Object.entries(this.buildEnvMap(Z,Q)).sort(([H],[F])=>H<F?-1:H>F?1:0).map(([H,F])=>({name:H,value:F})),W=Or4(Z),K=Object.keys(W).length>0;return{apiVersion:`${Y7.CLAIM_API_GROUP}/${Y7.CLAIM_API_VERSION}`,kind:"SandboxClaim",metadata:{name:$,namespace:this.namespace,labels:{"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[RJ.env]:this.envName}:{},...AQ1(Z.tenant)},...K?{annotations:W}:{}},spec:{sandboxTemplateRef:{name:X},additionalPodMetadata:{labels:AQ1(Z.tenant,{[RJ.role]:"claimed",[RJ.sandboxHandle]:$,...this.envName?{[RJ.env]:this.envName}:{}}),...K?{annotations:W}:{}},env:G,warmpool:zV$(Y,J,X),lifecycle:{shutdownPolicy:"Delete",shutdownTime:this.computeShutdownTime()}}}}async provision($,Z,Q){let Y=this.tokenGenerator(),X=kV$(),J=bq0,G=this.claimTenantPoolBinding(Q),W=this.buildClaim(Z,Q,{token:Y,daemonBootId:X,workdir:J},G,await this.resolveTemplateName(Q.purpose,G!==null,Q.sandboxImage));try{await BZ1(this.kubeConfig,this.namespace,W)}catch(K){if(K instanceof X80)await K80(this.kubeConfig,this.namespace,Z),await BZ1(this.kubeConfig,this.namespace,W);else throw K}return this.bind($,Z,Q,G,{token:Y,daemonBootId:X,workdir:J})}claimTenantPoolBinding($){return this.tenantPools?.resolve({tenant:PV$($),image:$.sandboxImage??"default",cloneUrl:$.repo?.cloneUrl,branch:$.repo?.branch})??null}async bind($,Z,Q,Y,{token:X,daemonBootId:J,workdir:G}){let W;try{W=await N2$(this.kubeConfig,this.namespace,Z),await NV$((B)=>this.watchClaimLifecycle(Z,B))}catch(B){throw await JR(this.kubeConfig,this.namespace,Z).catch(()=>{}),B}try{await this.ensureServicePortForAdoptedSandbox(W),await this.ensureHttpRouteForHandle(Z,W,Q.tenant??null)}catch(B){throw await JR(this.kubeConfig,this.namespace,Z).catch(()=>{}),B}let K=await this.openForwarder(W,vN,Z),H=`http://127.0.0.1:${K.localPort}`,F=Y?.repo!=null&&W!==Z,U=this.workloadConfigPayload(Q,F),N=J;try{if(await NQ1(H),this.sentinelToken!==null){let B=await qq0(H);if(B)N=B.bootId;try{await zK(H,this.sentinelToken,U??{},{rotateToken:X})}catch(D){if(D instanceof AJ&&D.status===401)console.warn(`[${I6}] sentinel rejected by adopted pod (handle=${Z}, sandbox=${W}): pod belongs to another claim; tearing down and reprovisioning`);throw D}}else if(U)await zK(H,X,U);await this.relayOrgFsConfig(H,X,Q.orgFsConfigJson)}catch(B){throw this.closeForwarder(K),await this.deleteHttpRouteIfManaged(Z).catch(()=>{}),await JR(this.kubeConfig,this.namespace,Z).catch(()=>{}),B}return{id:$,handle:Z,adoptedSandboxName:W,token:X,workdir:G,daemonUrl:H,daemonForward:K,workload:Q.workload??null,daemonBootId:N,tenant:Q.tenant??null,tenantPoolPodBound:F,ensureOpts:Ar4(Q)}}workloadConfigPayload($,Z){return Ti({runtime:$?.workload?.runtime??"node",packageManager:$?.workload?.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:$?.repo??null,extraRepos:$?.extraRepos??[],port:$?.workload?.devPort??CV$,tenant:$?.tenant??void 0,...$?{cloneOnly:$.cloneOnly===!0&&!Z}:{}})}async relayOrgFsConfig($,Z,Q){if(!Q)return;await I80($,Z,Q).catch((Y)=>console.warn("[org-fs] sidecar config relay failed",Y))}async refreshDaemonGitCredential($,Z){let Q=k80(Z);if(!Q)return;try{await zK($.daemonUrl,$.token,Q)}catch(Y){console.warn(`[${I6}] git credential refresh failed for ${$.handle}: ${Y instanceof Error?Y.message:String(Y)}`)}}async withFreshCloneUrl($,Z={}){if(!this.mintCloneUrl)return $;try{let Q=await this.mintCloneUrl($,Z);if(!Q)return $;let{credentialExpiresAt:Y,...X}=$;return{...X,cloneUrl:Q}}catch(Q){return console.warn(`[${I6}] clone credential re-mint failed: ${Q instanceof Error?Q.message:String(Q)}`),$}}async withFreshCredentials($,Z=!1){return{...$,...$.repo?{repo:await this.withFreshCloneUrl($.repo,{tenant:$.tenant})}:{},...$.orgFsConfigJson||Z?{orgFsConfigJson:await Pr4($,this.mintOrgFsConfig)}:{}}}startCredentialRefresher(){if(!this.mintCloneUrl)return;let{signal:$}=this.claimWatchAbort;(async()=>{while(!$.aborted){if(await F$(Xr4,{signal:$}).catch(()=>{}),$.aborted)break;try{await this.refreshAllGitCredentials()}catch(Z){console.warn(`[${I6}] periodic credential refresh failed: ${Z instanceof Error?Z.message:String(Z)}`)}}})()}startTenantPoolReconciler(){let $=this.tenantPools;if(!$)return;let{signal:Z}=this.claimWatchAbort;(async()=>{while(!Z.aborted){try{await this.reconcileTenantPools($)}catch(Q){console.warn(`[${I6}] tenant pool reconcile failed: ${Q instanceof Error?Q.message:String(Q)}`)}await F$(Qr4,{signal:Z}).catch(()=>{})}})()}listTenantPools(){return this.tenantPools?.pools()??[]}markTenantPoolsDirty($,Z){return Promise.resolve(this.tenantPools?.markDirty($,Z)??[])}async reconcileTenantPools($){let Z=qi($.pools());for(let Q of $.retain(Z))this.recordPoolGone(Q);for(let Q of Z){let Y=Q.warmPoolName,X=await B2$(this.kubeConfig,this.namespace,Y);if(X===null){console.warn(`[${I6}] tenant pool ${Y}: no SandboxWarmPool (or no selector yet) in ${this.namespace}`);continue}let J=$.takeDirty(Y),G=X.filter((W)=>!W.labels[RJ.sandboxHandle]);$.retainPods(Y,new Set(X.map((W)=>W.uid)));for(let W of G){if(this.claimWatchAbort.signal.aborted)return;await this.warmPoolPod($,Q,W,J)}this.recordPoolDepth($,Q,X,G)}}recordPoolGone($){let Z=vV$($);for(let Q of["ready","bound","pending","failed"])this.metrics?.poolPods.record(0,{...Z,state:Q})}recordPoolDepth($,Z,Q,Y){let X=this.metrics?.poolPods;if(!X)return;let J=0,G=0;for(let K of Y){let H=$.pod(K.uid);if(!H)continue;if(H.failures>=xq0)G++;else if(H.lastConfigAt>0)J++}let W=vV$(Z);X.record(J,{...W,state:"ready"}),X.record(Q.length-Y.length,{...W,state:"bound"}),X.record(Y.length-J-G,{...W,state:"pending"}),X.record(G,{...W,state:"failed"})}async warmPoolPod($,Z,Q,Y){let X=Z.warmPoolName,{workload:J}=Z.repo,G=$.pod(Q.uid);if(G&&G.failures>=xq0){if(Date.now()-G.lastFailureAt<_V$)return;$.setPod(Q.uid,{...G,failures:0})}let W=Y||G!==void 0&&Date.now()-G.lastConfigAt>=this.tenantPoolRefreshMs;if(G&&!W)return;let K=await this.allocationCloneUrl(Z);if(!K){this.recordPoolFailure($,Q,X,"clone credential mint failed");return}let H={cloneUrl:K,branch:Z.repo.branch,userName:"",userEmail:""},F=await this.openForwarder(Q.name,vN,Q.name).catch(()=>null);if(!F){this.recordPoolFailure($,Q,X,"port-forward failed");return}let U=`http://127.0.0.1:${F.localPort}`;try{await NQ1(U);let N=this.sentinelToken;if(!N)return;if(!await this.isPoolPodUnbound(Q))return;let B=Ti({runtime:J.runtime,packageManager:J.packageManager?{name:J.packageManager,...J.packageManagerPath?{path:J.packageManagerPath}:{}}:null,repo:H,port:J.devPort??CV$})??{},{transition:D}=await zK(U,N,B);if(W&&D!=="bootstrap"&&await this.isPoolPodUnbound(Q))await YV$(U,N,"clone");$.setPod(Q.uid,{pool:X,lastConfigAt:Date.now(),lastFailureAt:0,failures:0}),console.log(`[${I6}] tenant pool ${X}: warmed ${Q.name} (${D})`)}catch(N){this.recordPoolFailure($,Q,X,N instanceof Error?N.message:String(N))}finally{this.closeForwarder(F)}}async allocationCloneUrl({pool:$,repo:Z}){if(!this.mintPoolCloneUrl)return`${Z.repoUrl}.git`;try{return await this.mintPoolCloneUrl({tenant:$.tenant,repoUrl:Z.repoUrl,branch:Z.branch})}catch(Q){return console.warn(`[${I6}] tenant pool clone credential mint failed: ${Q instanceof Error?Q.message:String(Q)}`),null}}isPoolPodUnbound($){return D2$(this.kubeConfig,this.namespace,$.name,RJ.sandboxHandle)}recordPoolFailure($,Z,Q,Y){let X=$.pod(Z.uid),J=(X?.failures??0)+1;$.setPod(Z.uid,{pool:Q,lastConfigAt:X?.lastConfigAt??0,lastFailureAt:Date.now(),failures:J});let G=J>=xq0?` \u2014 backing off ${_V$/60000}min`:"";console.warn(`[${I6}] tenant pool ${Q}: warming ${Z.name} failed (${J}/${xq0})${G}: ${Y}`)}async refreshAllGitCredentials(){await TV$(this.records.values(),($)=>$.ensureOpts?.repo?.connectionId,async($)=>{if(this.claimWatchAbort.signal.aborted)return;let Z=$.ensureOpts?.repo;if(!Z)return;try{let Q=await this.withFreshCloneUrl(Z,{bufferMs:Jr4,tenant:$.ensureOpts?.tenant});await this.refreshDaemonGitCredential($,{...$.ensureOpts,repo:Q}),$.ensureOpts={...$.ensureOpts,repo:Q}}catch(Q){throw console.warn(`[${I6}] git credential refresh failed for ${$.handle}: ${Q instanceof Error?Q.message:String(Q)}`),Q}})}async rebootstrapDaemon($,Z,Q){if(this.sentinelToken===null)return!1;let Y=this.workloadConfigPayload(Q,!1)??{};try{return await zK($,this.sentinelToken,Y,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,Q?.orgFsConfigJson),!0}catch(X){if(X instanceof AJ&&X.status===401)try{return await zK($,Z,Y,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,Q?.orgFsConfigJson),!0}catch(J){return console.warn(`[${I6}] re-bootstrap retry with claim token failed: ${J instanceof Error?J.message:String(J)}`),!1}return console.warn(`[${I6}] re-bootstrap failed: ${X instanceof Error?X.message:String(X)}`),!1}}async ensureServicePortForAdoptedSandbox($){if(!this.previewGateway||!this.previewUrlPattern)return;await T2$(this.kubeConfig,this.namespace,$,{name:"daemon",port:vN,targetPort:vN})}async ensureHttpRouteForHandle($,Z,Q){if(!this.previewGateway||!this.previewUrlPattern)return;let Y=Tr4(this.previewUrlPattern,$);if(!Y)throw new NX(`Unable to derive preview hostname for ${$} from pattern: ${this.previewUrlPattern}`);let X={apiVersion:`${LZ1.API_GROUP}/${LZ1.API_VERSION}`,kind:"HTTPRoute",metadata:{name:$,namespace:this.namespace,labels:AQ1(Q??void 0,{[RJ.role]:"claimed",[RJ.sandboxHandle]:$,"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[RJ.env]:this.envName}:{}})},spec:{parentRefs:[{kind:"Gateway",group:"gateway.networking.k8s.io",name:this.previewGateway.name,namespace:this.previewGateway.namespace}],hostnames:[Y],rules:[{backendRefs:[{group:"",kind:"Service",name:Z,port:vN}]}]}};await P2$(this.kubeConfig,this.namespace,X)}async deleteHttpRouteIfManaged($){if(!this.previewGateway)return;await z2$(this.kubeConfig,this.namespace,$)}async rehydrate($,Z,Q){let Y=Q.state;if(!Y.adoptedSandboxName&&!Y.podName||!Y.token)return null;let X=await OL(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!X||!PQ1(X))return null;let J=X.status?.sandbox?.name??Y.adoptedSandboxName??Y.podName??Z,G=await this.openAndProbeDaemon(J,Z);if(!G)return null;if(Y.daemonBootId&&Y.daemonBootId!==G.bootId){if(this.sentinelToken!==null){let W=Y.ensureOpts?await this.withFreshCredentials(Y.ensureOpts,Y.orgFsRedacted===!0):null;if(!await this.rebootstrapDaemon(G.daemonUrl,Y.token,W))return this.closeForwarder(G.daemonForward),null}else console.warn(`[${I6}] daemon restart detected (handle=${Z}): stored bootId=${Y.daemonBootId} live bootId=${G.bootId}`);await this.stateStore?.put($,{handle:Z,state:{...Y,daemonBootId:G.bootId}}).catch((W)=>console.warn(`[${I6}] bootId persist failed for ${Z}: ${W instanceof Error?W.message:String(W)}`))}return{id:$,handle:Z,adoptedSandboxName:J,tenantPoolPodBound:!1,token:Y.token,workdir:Y.workdir??bq0,daemonUrl:G.daemonUrl,daemonForward:G.daemonForward,workload:Y.workload??null,daemonBootId:G.bootId,tenant:Y.tenant??null,ensureOpts:Y.ensureOpts??null,orgFsRedacted:Y.orgFsRedacted===!0}}join($,Z,Q,Y){let X=this.sentinelToken!==null,J=X?this.tokenGenerator():zQ1(Y,"DAEMON_TOKEN"),G=X?kV$():zQ1(Y,"DAEMON_BOOT_ID");if(!J||!G)throw new NX(`claim ${Z} carries no daemon token`);return this.bind($,Z,Q,this.claimTenantPoolBinding(Q),{token:J,daemonBootId:G,workdir:bq0})}async adopt($,Z,Q){if(!PQ1(Q))return null;let Y=Q.status?.sandbox?.name??Z;if(this.sentinelToken!==null)return null;let X=zQ1(Q,"DAEMON_TOKEN");if(!X)return null;let J=await this.openAndProbeDaemon(Y,Z);if(!J)return null;let G=wr4(Q);if(this.previewGateway)await this.ensureServicePortForAdoptedSandbox(Y).catch((W)=>{console.warn(`[${I6}] Service port backfill failed for ${Z}: ${W instanceof Error?W.message:String(W)}`)}),await this.ensureHttpRouteForHandle(Z,Y,G).catch((W)=>{console.warn(`[${I6}] HTTPRoute backfill failed for ${Z}: ${W instanceof Error?W.message:String(W)}`)});return{id:$,handle:Z,adoptedSandboxName:Y,tenantPoolPodBound:!1,token:X,workdir:bq0,daemonUrl:J.daemonUrl,daemonForward:J.daemonForward,workload:null,daemonBootId:J.bootId,tenant:G,ensureOpts:null}}async openAndProbeDaemon($,Z){let Q=await this.openForwarder($,vN,Z).catch(()=>null);if(!Q)return null;let Y=`http://127.0.0.1:${Q.localPort}`,X=await qq0(Y);if(!X)return this.closeForwarder(Q),null;return{daemonForward:Q,daemonUrl:Y,bootId:X.bootId}}async getRecord($){let Z=this.records.get($);if(Z)return Z;if(!this.stateStore)return null;let Q=await this.stateStore.getByHandle($);if(!Q)return null;let Y=await this.rehydrate(Q.id,$,Q);if(Y)this.records.set($,Y);return Y}async resurrectByHandle($){if(!this.stateStore)return null;let Z=await this.stateStore.getByHandle($);if(!Z)return null;let Q=Z.state,Y=Q.ensureOpts;if(!Y)return null;let X=await this.withFreshCredentials(Y,Q.orgFsRedacted===!0);if(m3(Z.id)!==$)return null;return await this.ensure(Z.id,X),this.records.get($)??null}invalidateRecord($){let Z=this.records.get($);if(!Z)return;this.records.delete($),this.dropRecord(Z)}dropRecord($){if(this.closeForwarder($.daemonForward),this.metrics&&this.activeGauge.consume($.handle))this.metrics.active.add(-1,TQ1($.tenant))}recordProxyDuration($,Z,Q,Y,X){if(!this.metrics)return;this.metrics.proxyDurationMs.record(Y,{...TQ1(Q?.tenant??null),source:$,sandbox_handle:Q?.handle??X??"",status_code:Z||0})}composePreviewUrl($){if(this.previewUrlPattern)return kq0(this.previewUrlPattern,$.handle);return`http://127.0.0.1:${$.daemonForward.localPort}/`}toSandbox($){return{handle:$.handle,workdir:$.workdir,previewUrl:this.composePreviewUrl($),warmPoolAdopted:$.tenantPoolPodBound===!0,provider:"kubernetes"}}async persist($,Z){if(!$)return;let Q={adoptedSandboxName:Z.adoptedSandboxName,token:Z.token,workdir:Z.workdir,workload:Z.workload,daemonBootId:Z.daemonBootId,tenant:Z.tenant,...Z.ensureOpts?this.persistCredentials?{ensureOpts:Z.ensureOpts}:zr4(Z.ensureOpts,Z.orgFsRedacted===!0):{}};await $.put(Z.id,{handle:Z.handle,state:Q})}computeShutdownTime(){return new Date(Date.now()+this.idleTtlMs).toISOString()}async releaseAfter($,Z){let Q=await OL(this.kubeConfig,this.namespace,$);if(!Q)return;let Y=jr4(Q.spec?.lifecycle?.shutdownTime,new Date(Date.now()+Z));if(!Y)return;await GN0(this.kubeConfig,this.namespace,$,Y).catch((X)=>console.warn(`[${I6}] release failed for ${$}: ${X instanceof Error?X.message:String(X)}`))}async renewTtl($){let Z=await OL(this.kubeConfig,this.namespace,$);if(!Z)return;let Q=Er4(Z.spec?.lifecycle?.shutdownTime,new Date(Date.now()+this.idleTtlMs));if(!Q)return;await GN0(this.kubeConfig,this.namespace,$,Q).catch((Y)=>console.warn(`[${I6}] TTL renew failed for ${$}: ${Y instanceof Error?Y.message:String(Y)}`))}openForwarder($,Z,Q=$){if(this.forwardPort)return this.forwardPort($,Z,Q);let Y=Hr4(Q,Z);return new Promise((X,J)=>{let G=(W,K)=>{let H=fV$.createServer((F)=>this.handleForwardedConnection(F,$,Z,Q));H.once("error",(F)=>{if(F.code==="EADDRINUSE"&&K<Gr4){try{H.close()}catch{}let U=RQ1+(W-RQ1+1)%yV$;G(U,K+1);return}J(F)}),H.listen(W,"127.0.0.1",()=>{let F=H.address();if(!F||typeof F==="string"){H.close(),J(Error("port-forward listener failed to bind"));return}let U=F.port;X({localPort:U,close:()=>H.close((N)=>{if(N)console.warn(`[${I6}] port-forward close on :${U} errored: ${N.message}`)})})})};G(Y,0)})}handleForwardedConnection($,Z,Q,Y){let X=new os4,J=null,G=!1,W=()=>{if(G)return;if(G=!0,X.destroy(),J)try{J.close()}catch{}if(!$.destroyed)$.destroy()};$.pipe(X),$.on("error",W),$.on("close",W),this.portForward.portForward(this.namespace,Z,[Q],$,null,X).then((K)=>{let H=typeof K==="function"?K():K;if(!H){W();return}if(J=H,J.on("close",W),J.on("error",(F)=>{console.warn(`[${I6}] port-forward to ${Z}:${Q} dropped mid-connection: ${SV$(F)}`,JSON.stringify(qQ1(F))),this.invalidateRecord(Y),W()}),G)try{J.close()}catch{}}).catch((K)=>{console.warn(`[${I6}] port-forward to ${Z}:${Q} failed: ${SV$(K)}`,JSON.stringify(qQ1(K))),this.invalidateRecord(Y),W()})}closeForwarder($){$.close()}close(){if(this.closed)return;this.closed=!0,this.claimWatchAbort.abort();for(let $ of this.records.values())this.dropRecord($);this.records.clear()}}function Wr4($){return{active:$.createUpDownCounter("studio.sandbox.active",{description:"Active sandbox count, by runner kind, owning org, and daemon impl. Cross-checks the cAdvisor-derived count from the cluster \u2014 divergence between the two indicates orphaned claims (studio deleted but K8s didn't reap) or unattributed pods.",unit:"{sandbox}"}),ensureOutcome:$.createCounter("studio.sandbox.ensure.outcome",{description:"Outcome of each ensure() call: fresh provision, resume from state-store after restart, or adopt of a cluster-side claim studio didn't know about. Cold-start ratio is the primary input for warm-pool sizing.",unit:"{call}"}),proxyDurationMs:$.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of studio-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"}),poolPods:$.createGauge("studio.sandbox.pool.pods",{description:"Tenant warm pool depth by pool and state: ready (warmed and unbound \u2014 what a claim can actually bind instantly), bound (serving a user), pending (unbound, not yet warmed), failed (gave up after repeated bootstrap failures). Alert on sustained ready=0: a pool that is always empty is doing nothing while costing N pods.",unit:"{pod}"})}}function qQ1($){let Z=[],Q=$;for(let Y=0;Y<5&&Q instanceof Error;Y++){let X=Q;if(Z.push({name:X.name,message:X.message,...X.code!==void 0?{code:X.code}:{},...X.errno!==void 0?{errno:X.errno}:{}}),X.cause===Q)break;Q=X.cause}if(Q!==void 0&&!(Q instanceof Error)&&Q!==null){let Y=Q,X=Y.error instanceof Error?qQ1(Y.error).chain:void 0;Z.push({nonError:String(Q),...typeof Y.type==="string"?{type:Y.type}:{},...typeof Y.message==="string"?{message:Y.message}:{},...Y.code!==void 0?{code:Y.code}:{},...typeof Y.reason==="string"?{reason:Y.reason}:{},...X?{error:X}:{},...X===void 0&&Y.error!==void 0?{rawError:String(Y.error)}:{},keys:Object.keys(Y)})}return{chain:Z}}function Kr4(){let $=new Wq0;return $.loadFromDefault(),$}function PQ1($){return Boolean($.status?.conditions?.some((Z)=>Z.type==="Ready"&&Z.status==="True"))}function zQ1($,Z){let Q=$.spec?.env;if(!Q)return null;for(let Y of Q)if(Y.name===Z&&Y.value)return Y.value;return null}function Hr4($,Z){let Q=ns4("sha256").update(`${$}:${Z}`).digest();return RQ1+Q.readUInt32BE(0)%yV$}function bV$($){let Z=$.slice(0,Ur4);return Fr4.test(Z)?Z:""}function Br4($){if($===void 0)return null;let Z=$.trim();if(Z==="")return null;if(!Nr4.test(Z))throw Error(`AgentSandboxProvider: envName=${JSON.stringify(Z)} is not a valid DNS-label-safe environment name (lowercase alphanumeric or '-', starts with a letter, ends alphanumeric, \u226432 chars). Studio sets this from STUDIO_ENV; check the studio chart's configMap.`);return Z}function AQ1($,Z={}){let Q={...Z};if($){let Y=bV$($.orgId),X=bV$($.userId);if(Y)Q[RJ.orgId]=Y;if(X)Q[RJ.userId]=X}return Q}function xy($){let Z="";for(let Q of $){let Y=Q.codePointAt(0)??0;Z+=Y<32||Y===127?" ":Q}return Z.slice(0,Dr4)}function Lr4($){try{let Z=new URL($);return Z.username="",Z.password="",Z.toString()}catch{return""}}function Or4($){let Z={},Q=$.tenant;if(Q?.orgSlug)Z[LF.orgSlug]=xy(Q.orgSlug);if(Q?.orgName)Z[LF.orgName]=xy(Q.orgName);if(Q?.userEmail)Z[LF.userEmail]=xy(Q.userEmail);if(Q?.userName)Z[LF.userName]=xy(Q.userName);let Y=$.repo;if(Y){if(Y.displayName)Z[LF.gitRepo]=xy(Y.displayName);let X=Lr4(Y.cloneUrl);if(X)Z[LF.gitRepoUrl]=xy(X);let J=$.branch??Y.branch;if(J)Z[LF.gitBranch]=xy(J)}return Z}function wr4($){let Z=$.metadata?.labels;if(!Z)return null;let Q=Z[RJ.orgId],Y=Z[RJ.userId];if(!Q||!Y)return null;let X=$.metadata?.annotations??{};return{orgId:Q,userId:Y,orgSlug:X[LF.orgSlug],orgName:X[LF.orgName],userEmail:X[LF.userEmail],userName:X[LF.userName]}}function jr4($,Z){if($){let Q=new Date($).getTime();if(Number.isFinite(Q)&&Q<=Z.getTime())return null}return Z.toISOString()}function Er4($,Z){if($){let Q=new Date($).getTime();if(Number.isFinite(Q)&&Q>=Z.getTime())return null}return Z.toISOString()}function TQ1($){return{org_id:$?.orgId??"",user_id:$?.userId??"",runner_kind:"agent-sandbox"}}async function Pr4($,Z){if(!Z||!$.tenant)return $.orgFsConfigJson;try{return await Z($.tenant)??$.orgFsConfigJson}catch(Q){return console.warn(`[${I6}] org-fs credential re-mint failed: ${Q instanceof Error?Q.message:String(Q)}`),$.orgFsConfigJson}}function xV$($){try{let Z=new URL($.cloneUrl);Z.username="",Z.password="";let{submoduleCredentials:Q,credentialExpiresAt:Y,...X}=$;return{...X,cloneUrl:Z.toString()}}catch{return null}}function zr4($,Z){let{orgFsConfigJson:Q,repo:Y,extraRepos:X,...J}=$,G=J,W=Y&&xV$(Y);if(W)G.repo=W;if(X)G.extraRepos=X.map(xV$).filter((K)=>K!==null);return Q||Z?{ensureOpts:G,orgFsRedacted:!0}:{ensureOpts:G}}function Ar4($){let Z={};if($.branch)Z.branch=$.branch;if($.repo)Z.repo=$.repo;if($.workload)Z.workload=$.workload;if($.env&&Object.keys($.env).length>0)Z.env=$.env;if($.tenant)Z.tenant=$.tenant;if($.cloneOnly)Z.cloneOnly=!0;if($.purpose)Z.purpose=$.purpose;if($.sandboxImage)Z.sandboxImage=$.sandboxImage;if($.orgFsConfigJson)Z.orgFsConfigJson=$.orgFsConfigJson;return Object.keys(Z).length>0?Z:null}function Tr4($,Z){try{return new URL(kq0($,Z)).hostname||null}catch{return null}}var I6="AgentSandboxProvider",ss4="agent-sandbox-system",rs4="studio-sandbox",as4=300000,vN=9000,CV$=3000,bq0="/app",es4=32,$r4,Zr4=900000,Qr4=60000,Yr4=1800000,xq0=3,_V$=1800000,Xr4=900000,Jr4=1800000,RQ1=40000,yV$=1e4,Gr4=256,RJ,LF,Fr4,Ur4=63,Nr4,Dr4=253;var gV$=L(()=>{r$();I2$();aI$();vy();Ri();WN0();J80();DV$();_80();qV$();_q0();vq0();$r4=new Set(["DAEMON_TOKEN","DAEMON_BOOT_ID","APP_ROOT","PROXY_PORT"]);RJ={role:"studio.decocms.com/role",sandboxHandle:"studio.decocms.com/sandbox-handle",orgId:"studio.decocms.com/org-id",userId:"studio.decocms.com/user-id",env:"studio.decocms.com/env"},LF={orgSlug:"studio.decocms.com/org-slug",orgName:"studio.decocms.com/org-name",userEmail:"studio.decocms.com/user-email",userName:"studio.decocms.com/user-name",gitRepo:"studio.decocms.com/git-repo",gitRepoUrl:"studio.decocms.com/git-repo-url",gitBranch:"studio.decocms.com/git-branch"},Fr4=/^([A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?)?$/;Nr4=/^[a-z]([a-z0-9-]{0,30}[a-z0-9])?$/});var hV$={};O6(hV$,{tenantPoolSchema:()=>OV$,tenantPoolRepoSchema:()=>C80,tenantPoolFieldsSchema:()=>LQ1,tenantPoolAllocations:()=>qi,resolveTenantPoolBinding:()=>OQ1,renderTenantPoolWarmPools:()=>EV$,normalizeRepoUrl:()=>AK,allocationsMatchingPush:()=>jQ1,TenantPoolCapacityError:()=>Cq0,PREVIEW_NOT_READY_HEADER:()=>Ii,AgentSandboxProvider:()=>MQ1});var v80=L(()=>{gV$();_80()});import{z as fy}from"zod";function fq0($){if(!$||$.trim()==="")return[];let Z=fy.array(Rr4).parse(JSON.parse($)),Q=new Set;for(let Y of Z){if(Q.has(Y.name))throw Error(`tenant pools: duplicate pool name ${Y.name}`);Q.add(Y.name)}return Z}function uV$($){let Z=AK(`https://github.com/${$.repo}`);if(!Z)throw Error(`tenant pools: bad repo ${$.repo}`);return Z}function lV$($){return $.map((Z)=>({name:Z.name,tenant:Z.orgId,size:1,image:"default",repos:[{repoUrl:uV$(Z),branch:Z.branch,workload:Z.workload,replicas:1,warmPoolName:Z.name}]}))}function IQ1($,Z){let Q=AK(Z.repoUrl)?.toLowerCase(),Y=$.find((J)=>J.orgId===Z.tenant&&J.branch===Z.branch&&uV$(J).toLowerCase()===Q);if(!Y)return null;let X=`https://github.com/${Y.repo}.git`;return Y.connectionId?{cloneUrl:X,connectionId:Y.connectionId}:{cloneUrl:X}}function cV$($,Z){return async(Q)=>{let Y=IQ1($,Q);if(!Y)return null;return Y.connectionId?Z(Y):Y.cloneUrl}}var Rr4;var yq0=L(()=>{v80();Rr4=fy.object({name:fy.string().max(63).regex(/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/,"pool name must be a DNS label (lowercase alphanumeric and '-')"),orgId:fy.string().min(1),repo:fy.string().regex(/^[^/\s]+\/[^/\s]+$/,"repo must be `owner/name`"),connectionId:fy.string().min(1).optional(),branch:fy.string().min(1).default("main"),workload:C80.shape.workload})});function _Q1($,Z=Date.now()){if($===void 0)return;return $===null?Z+qr4:$.getTime()}function CQ1($){return JSON.stringify([$.orgId,$.userId])}function mV$($,Z){let Q=AK(Z);return Q?JSON.stringify([$,Q.toLowerCase()]):null}function Ir4($,Z){return"repositoryId"in Z?$.repositoryOrgs.get(Z.repositoryId):$.connectionOrgs.get(Z.connectionId)}function dV$($){let{records:Z,now:Q}=$,Y=new Map,X=new Map,J=new Map,G=0;for(let W of $.pools)for(let{repoUrl:K,branch:H}of W.repos){let F=mV$(W.tenant,K),U=IQ1($.legacyPools??[],{tenant:W.tenant,repoUrl:K,branch:H});if(F&&U){if(U.connectionId)X.set(F,{tenant:W.tenant,repoUrl:K,connectionId:U.connectionId,cloneUrl:U.cloneUrl});continue}let N=F?Z.orgRepositories.get(F):void 0;if(!F||!N){G++;continue}X.set(F,{tenant:W.tenant,repoUrl:K,repositoryId:N})}for(let W of $.sandboxes){let K=W.tenant;if(!K)continue;let H=Z.members.get(CQ1(K));if(H===void 0){G++;continue}for(let U of W.repos){if(Ir4(Z,U)!==K.orgId){G++;continue}let N="repositoryId"in U?{repositoryId:U.repositoryId}:{connectionId:U.connectionId,repo:U.repo.toLowerCase()},B={orgId:K.orgId,userId:K.userId};Y.set(JSON.stringify([B,N]),{tenant:B,repo:N})}let F=W.orgFsConfigExpiresAt;if(W.orgFs&&(F===null||F-Q<Mr4))J.set(CQ1(K),{orgId:K.orgId,userId:K.userId,orgSlug:H})}return{clones:[...Y.values()],poolClones:[...X.values()],orgFs:[...J.values()],refused:G}}async function iV$($,Z,Q){let Y=new Set,X=new Set,J=new Set,G=new Set,W=new Set(Q.map((D)=>D.tenant)),K=new Set;for(let D of Q)for(let{repoUrl:O}of D.repos){let w=YX(O);if(w)K.add(w.path.toLowerCase())}for(let D of Z){if(D.tenant)Y.add(D.tenant.orgId),X.add(D.tenant.userId);for(let O of D.repos)if("repositoryId"in O)G.add(O.repositoryId);else J.add(O.connectionId)}let[H,F,U,N]=await Promise.all([Y.size===0?[]:$.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.organizationId as orgId","member.userId as userId","organization.slug as slug"]).where("member.organizationId","in",[...Y]).where("member.userId","in",[...X]).execute(),J.size===0?[]:$.selectFrom("connections").select(["id","organization_id"]).where("id","in",[...J]).execute(),G.size===0?[]:$.selectFrom("repositories").select(["id","organization_id"]).where("id","in",[...G]).execute(),K.size===0?[]:$.selectFrom("repositories").select(["id","organization_id","provider","host","path"]).where("organization_id","in",[...W]).where((D)=>D(D.fn("lower",["path"]),"in",[...K])).execute()]),B=new Map;for(let D of N){let O=mV$(D.organization_id,m10({provider:D.provider,host:D.host,path:D.path}));if(O&&!B.has(O))B.set(O,D.id)}return{members:new Map(H.map((D)=>[CQ1(D),D.slug])),connectionOrgs:new Map(F.map((D)=>[D.id,D.organization_id])),repositoryOrgs:new Map(U.map((D)=>[D.id,D.organization_id])),orgRepositories:B}}function SQ1($){return $ instanceof Error?$.message:String($)}async function pV$($,Z,Q){let Y=0;if($.clones.length>ki||$.poolClones.length>ki||$.orgFs.length>kQ1)console.warn(`[sandbox-credential-push] ${$.clones.length} clone, ${$.poolClones.length} pool clone and ${$.orgFs.length} org-fs mints planned; minting the first ${ki}, ${ki} and ${kQ1}`);let X=await I5($.clones.slice(0,ki),VQ1,async(U)=>{let N="repositoryId"in U.repo?{cloneUrl:"",repositoryId:U.repo.repositoryId}:{cloneUrl:`https://github.com/${U.repo.repo}.git`,connectionId:U.repo.connectionId};try{let B=await Z.mintCloneUrl(N,{bufferMs:gq0});return B?{tenant:U.tenant,repo:U.repo,cloneUrl:B,expiresAt:Q.now+gq0}:null}catch(B){return Y++,console.warn(`[sandbox-credential-push] clone mint failed: ${SQ1(B)}`),null}}),J=await I5($.poolClones.slice(0,ki),VQ1,async(U)=>{try{let N=await Z.mintCloneUrl("repositoryId"in U?{cloneUrl:"",repositoryId:U.repositoryId}:{cloneUrl:U.cloneUrl,connectionId:U.connectionId},{bufferMs:gq0});return N?{tenant:U.tenant,repoUrl:U.repoUrl,cloneUrl:N,expiresAt:Q.now+gq0}:null}catch(N){return Y++,console.warn(`[sandbox-credential-push] pool clone mint failed: ${SQ1(N)}`),null}}),G=await I5($.orgFs.slice(0,kQ1),VQ1,async(U)=>{try{let N=await Z.mintOrgFsConfig(U);return N?{tenant:{orgId:U.orgId,userId:U.userId},orgFsConfigJson:N,expiresAt:Q.now+Q.orgFsLifetimeMs}:null}catch(N){return Y++,console.warn(`[sandbox-credential-push] org-fs mint failed: ${SQ1(N)}`),null}}),W=X.filter((U)=>U!==null),K=J.filter((U)=>U!==null),H=G.filter((U)=>U!==null),F=[];for(let U=0;U<Math.max(W.length,K.length,H.length);U+=tE)F.push({cloneUrls:W.slice(U,U+tE),poolCloneUrls:K.slice(U,U+tE),orgFsConfigs:H.slice(U,U+tE)});return{batches:F,failed:Y}}var gq0=2700000,hq0,qr4=86400000,Mr4=86400000,VQ1=8,ki=2000,kQ1=200;var uq0=L(()=>{UZ1();v80();t4();r$();MN();yq0();hq0=lz$-3600000});var qJ;var b80=L(()=>{qJ=class qJ extends Error{code;status;path;constructor($,Z,Q){super(Z.message||`Freestyle API error: ${Z.code}`);this.name="FreestyleApiError",this.code=Z.code,this.status=$,this.path=Q,Object.setPrototypeOf(this,qJ.prototype)}}});function nV$(){return typeof process<"u"&&Boolean(process.versions?.node)}var lq0=($,Z)=>globalThis.fetch($,Z);async function Vr4(){if(!nV$())return null;try{return await import("undici")}catch{return null}}async function Sr4(){let $=await Vr4();if(!$)return null;let Z=new $.Agent({allowH2:!0,connections:kr4});return(Q,Y)=>$.fetch(Q,{...Y,dispatcher:Z})}function Cr4($){return(typeof $==="string"?$:$ instanceof URL?$.href:$.url).startsWith("https:")}function tV$(){let $,Z=()=>{return $??=Sr4().then((Q)=>Q??lq0).catch(()=>lq0),$};return(Q,Y)=>Cr4(Q)?Z().then((X)=>X(Q,Y)):lq0(Q,Y)}var kr4=4;var oV$=()=>{};function yr4($){return new Promise((Z)=>setTimeout(Z,$))}function gr4($){if(!$)return"";let Z=new URLSearchParams;for(let[Y,X]of Object.entries($)){if(X===void 0||X===null)continue;Z.set(Y,String(X))}let Q=Z.toString();return Q?`?${Q}`:""}function i6($){return encodeURIComponent($)}class vQ1{baseUrl;authenticationHeaders;fetchImpl;backgroundEligible;constructor($={}){if(this.baseUrl=($.baseUrl??fr4).replace(/\/+$/,""),!$.fetch&&!globalThis.fetch)throw Error("No fetch implementation available. Pass `fetch` in FreestyleOptions when running on a runtime without a global fetch.");if(this.fetchImpl=$.fetch??tV$(),"identityAccessToken"in $&&$.identityAccessToken){this.authenticationHeaders={[_r4]:$.identityAccessToken},this.backgroundEligible=!1;return}if(this.backgroundEligible=!0,"stackAccessToken"in $&&$.stackAccessToken){this.authenticationHeaders={Authorization:`Bearer ${$.stackAccessToken}`,"X-Freestyle-Team-Id":$.teamId};return}let Z=$.apiKey??globalThis.process?.env?.FREESTYLE_API_KEY;if(!Z)throw Error("No Freestyle API key provided. Pass `apiKey` in FreestyleOptions or set FREESTYLE_API_KEY.");this.authenticationHeaders={Authorization:`Bearer ${Z}`}}authHeaders(){return{...this.authenticationHeaders}}url($,Z){return`${this.baseUrl}${$}${gr4(Z)}`}async fetch($,Z={}){let Q=new Headers(Z.headers);for(let[Y,X]of Object.entries(this.authHeaders()))if(!Q.has(Y))Q.set(Y,X);return this.fetchImpl(this.absoluteUrl($),{...Z,headers:Q})}absoluteUrl($){return/^https?:\/\//i.test($)?$:`${this.baseUrl}${$}`}async request($,Z,{query:Q,body:Y,rawBody:X,signal:J}={}){let G={...this.authHeaders()};if(this.backgroundEligible)G[sV$]=String(br4);let W;if(X!==void 0)G["Content-Type"]="application/octet-stream",W=X;else if(Y!==void 0)G["Content-Type"]="application/json",W=JSON.stringify(Y);let K=this.url(Z,Q),H=await this.fetchImpl(K,{method:$,headers:G,body:W,signal:J});if(this.backgroundEligible&&H.status===202)try{return await this.pollBackgroundRequest(H,Z)}catch(F){if($==="GET"&&F instanceof qJ&&F.code==="BACKGROUND_RESULT_UNSTORABLE"){delete G[sV$];let U=await this.fetchImpl(K,{method:$,headers:G,body:W});return this.finalize(U,Z)}throw F}return this.finalize(H,Z)}async pollBackgroundRequest($,Z){let Q=await $.json().catch(()=>({})),Y=$.headers.get(vr4)??Q.requestId,X=Q.resultUrl??(Y?`/v5/background-requests/${i6(Y)}`:void 0);if(!X)throw new qJ($.status,{code:"BACKGROUND_PROTOCOL_ERROR",message:"202 Accepted carried no background request id"},Z);let J=0;for(;;){await yr4(xr4);let G;try{G=await this.fetch(X,{method:"GET"}),J=0}catch(W){if(++J>=5)throw W;continue}if(G.status===202)continue;return this.finalize(G,Z)}}async finalize($,Z){if(!$.ok){let Y;try{Y=await $.json()}catch{Y={code:"UNKNOWN_ERROR",message:await $.text().catch(()=>$.statusText)}}throw new qJ($.status,Y,Z)}if($.status===204)return;let Q=await $.text();if(!Q)return;return JSON.parse(Q)}get($,Z){return this.request("GET",$,{query:Z})}post($,Z){return this.request("POST",$,{body:Z??{}})}patch($,Z){return this.request("PATCH",$,{body:Z??{}})}put($,Z){return this.request("PUT",$,{body:Z??{}})}putEmpty($){return this.request("PUT",$,{})}putBytes($,Z,Q,Y){return this.request("PUT",$,{query:Q,rawBody:Z,signal:Y})}async getBytes($,Z,Q={}){let Y={...this.authHeaders()};if(Q.range)Y.Range=Q.range;let X=await this.fetchImpl(this.url($,Z),{method:"GET",headers:Y,signal:Q.signal});if(!X.ok){let J;try{J=await X.json()}catch{J={code:"UNKNOWN_ERROR",message:await X.text().catch(()=>X.statusText)}}throw new qJ(X.status,J,$)}return X}delete($,Z){return this.request("DELETE",$,{query:Z})}}var _r4="x-freestyle-identity-access-token",sV$="x-freestyle-background-after-secs",vr4="x-freestyle-background-request-id",br4=5,xr4=2000,fr4="https://api.freestyle.sh";var TK=L(()=>{b80();oV$()});class bQ1{client;verifications;certificates;placeholder;constructor($){this.client=$,this.verifications=new rV$($),this.certificates=new aV$($),this.placeholder=new eV$($)}async list(){let{domains:$}=await this.client.get("/v5/domains");return $}}class rV${client;constructor($){this.client=$}create($){return this.client.post("/v5/verifications",{domain:$})}async list($={}){let{verifications:Z}=await this.client.get("/v5/verifications",$);return Z}get($){return this.client.get(`/v5/verifications/${i6($)}`)}complete($){return this.client.putEmpty(`/v5/verifications/${i6($)}`)}delete($){return this.client.delete(`/v5/verifications/${i6($)}`)}}class aV${client;constructor($){this.client=$}async list(){let{certificates:$}=await this.client.get("/v5/certificates");return $}createWildcard($){return this.client.post("/v5/certificates/wildcard",{domain:$})}}class eV${client;constructor($){this.client=$}async get(){try{return await this.client.get("/v5/domains/placeholder")}catch($){if($ instanceof qJ&&$.status===404)return null;throw $}}set($){return this.client.put("/v5/domains/placeholder",$)}delete(){return this.client.delete("/v5/domains/placeholder")}}var xQ1=L(()=>{TK();b80()});function Q5($,Z){throw new yQ1($,Z)}function fQ1($){return hr4.some((Z)=>$[Z]!==void 0)}function gQ1($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function lr4($,Z){let Q=Z.lastIndexOf("/");if(Q<0)Q5($,`${$} \`${Z}\` is not a CIDR: expected address/prefix, e.g. 203.0.113.0/24 or 2001:db8::/32`);let Y=Z.slice(0,Q),X=Z.slice(Q+1);if(!/^\d+$/.test(X))Q5($,`${$} \`${Z}\`: prefix length must be a number`);let J=Number(X),G=Y.includes(":"),W=G?128:32;if(J>W)Q5($,`${$} \`${Z}\`: prefix length must be 0\u2013${W}`);if(!G&&!/^\d{1,3}(\.\d{1,3}){3}$/.test(Y))Q5($,`${$} \`${Z}\`: \`${Y}\` is not an IP address`)}function Yk$($,Z){if(!gQ1($))Q5(Z,`${Z} must be an object`);for(let Y of Object.keys($))if(!$k$.includes(Y))Q5(`${Z}.${Y}`,`${Z} has unknown field \`${Y}\`. Expected one of: ${$k$.join(", ")}`);let Q=$;for(let Y of["vmId","vpcId","tunnelId","cidr"]){let X=Q[Y];if(X!==void 0&&(typeof X!=="string"||X.length===0))Q5(`${Z}.${Y}`,`${Z}.${Y} must be a non-empty string`)}if(Q.public!==void 0&&Q.public!==!0)Q5(`${Z}.public`,`${Z}.public must be true when present: it declares the public Internet. Omit the field to match something else`);if(Q.public===!0){if(Q.vmId!==void 0)Q5(`${Z}.public`,`${Z} cannot combine \`public: true\` with \`vmId\`: that would mean the VM only when reached over its public address, a distinction this API does not make yet. Use \`vmId\` alone to match the VM on any path, or \`public: true\` alone to match public addresses`);if(Q.vpcId!==void 0)Q5(`${Z}.public`,`${Z} cannot combine \`public: true\` with \`vpcId\`: that would mean the network's members only when reached over their public addresses, a distinction this API does not make yet. Use \`vpcId\` alone or \`public: true\` alone`);if(Q.tunnelId!==void 0)Q5(`${Z}.public`,`${Z} cannot combine \`public: true\` with \`tunnelId\`: traffic through a tunnel arrives over the tunnel, not over the public Internet. Use \`tunnelId\` alone`)}if(Q.cidr!==void 0)lr4(`${Z}.cidr`,Q.cidr);if(Q.protocol!==void 0&&!Zk$.includes(Q.protocol))Q5(`${Z}.protocol`,`${Z}.protocol must be one of: ${Zk$.join(", ")} (got \`${String(Q.protocol)}\`)`);if(Q.port!==void 0){if(!Number.isInteger(Q.port)||Q.port<1||Q.port>65535)Q5(`${Z}.port`,`${Z}.port must be an integer between 1 and 65535`);if(Q.protocol===void 0)Q5(`${Z}.protocol`,`${Z}.port ${Q.port} requires ${Z}.protocol: set it to "tcp" or "udp" so the rule opens one transport rather than both`);if(!ur4.includes(Q.protocol))Q5(`${Z}.port`,`${Z}.protocol "${Q.protocol}" has no ports; remove ${Z}.port ${Q.port}`)}}function Gk$($,Z){if(!gQ1($))Q5(Z||"rule",`${Z||"rule"} must be an object`);for(let Y of Object.keys($))if(!Xk$.includes(Y))Q5(`${Z}${Y}`,`Unknown field \`${Y}\`. Expected one of: ${Xk$.join(", ")}`);let Q=$;if(Q.action===void 0)Q5(`${Z}action`,`${Z}action is required. Write \`action: "allow"\` \u2014 every rule states what it does rather than defaulting to it`);if(Q.action!=="allow")Q5(`${Z}action`,`${Z}action must be "allow" (got \`${String(Q.action)}\`). Only allow rules exist today`);if(Q.description!==void 0){if(typeof Q.description!=="string")Q5(`${Z}description`,"description must be a string");if(Q.description.length>Qk$)Q5(`${Z}description`,`description is too long (${Q.description.length} characters, maximum ${Qk$})`)}if(Q.source===void 0)Q5(`${Z}source`,`${Z}source is required`);if(Q.destination===void 0)Q5(`${Z}destination`,`${Z}destination is required`);return Yk$(Q.source,`${Z}source`),Yk$(Q.destination,`${Z}destination`),Q}function cr4($){let Z=Gk$($,"");for(let Q of["source","destination"]){let Y=Z[Q];if(fQ1(Y))continue;let X=[Y.port!==void 0?`port ${Y.port}`:void 0,Y.protocol!==void 0?`protocol ${Y.protocol}`:void 0].filter(Boolean).join(", ");Q5(Q,X?`${Q} only narrows traffic (${X}) without saying what it is. Add \`vmId\`, \`vpcId\`, \`tunnelId\`, \`cidr\`, or \`public: true\`. Leaving it out to mean "this VM" only works inside vms.create`:`${Q} is empty. A matcher must say what the traffic is: \`vmId\`, \`vpcId\`, \`tunnelId\`, \`cidr\`, or \`public: true\` for the public Internet`)}return Z}function cq0($,Z="VM"){if($===void 0||$===null)Q5("firewall",`firewall is required on a ${Z} create. A ${Z} gets nothing implicitly, so state what it may reach \u2014 \`{ rules: [] }\` if the answer is nothing`);if(!gQ1($))Q5("firewall","firewall must be an object with a `rules` array");for(let Y of Object.keys($))if(Y!=="rules")Q5(`firewall.${Y}`,`firewall has unknown field \`${Y}\`. Expected: rules`);let Q=$.rules;if(!Array.isArray(Q))Q5("firewall.rules","firewall.rules must be an array");return Q.forEach((Y,X)=>{let J=`firewall.rules[${X}].`,G=Gk$(Y,J),W=fQ1(G.source),K=fQ1(G.destination);if(!W&&!K&&Z!=="network")Q5(`firewall.rules[${X}]`,`firewall.rules[${X}]: both source and destination refer to the ${Z} being created, which allows nothing. Give one of them a \`vmId\`, \`vpcId\`, \`tunnelId\`, \`cidr\`, or \`public: true\``);if(W&&K)Q5(`firewall.rules[${X}]`,`firewall.rules[${X}]: neither end refers to the ${Z} being created. Leave one endpoint's identity unset so it means this ${Z}, or create the rule with firewall.rules.create instead`)}),$}function Jk$($){return`/v5/firewall/rules/${i6($)}`}class Wk${client;constructor($){this.client=$}async create($){let Z=cr4($);return this.client.post("/v5/firewall/rules",Z)}list($={}){return this.client.get("/v5/firewall/rules",$)}get($){return this.client.get(Jk$($))}delete($){return this.client.delete(Jk$($))}}class hQ1{client;rules;constructor($){this.client=$,this.rules=new Wk$($)}evaluate($){return this.client.post("/v5/firewall/evaluate",$)}}var yQ1,$k$,hr4,Zk$,ur4,Qk$=1024,Xk$;var x80=L(()=>{TK();yQ1=class yQ1 extends Error{path;constructor($,Z){super(Z);this.name="FirewallRuleValidationError",this.path=$,Object.setPrototypeOf(this,yQ1.prototype)}};$k$=["vmId","vpcId","tunnelId","cidr","public","port","protocol"],hr4=["vmId","vpcId","tunnelId","cidr","public"],Zk$=["tcp","udp","icmp"],ur4=["tcp","udp"];Xk$=["action","source","destination","description"]});function uQ1($){return`/v5/identities/${i6($)}`}class Kk${client;basePath;constructor($,Z){this.client=$,this.basePath=Z}create(){return this.client.post(`${this.basePath}/tokens`)}list(){return this.client.get(`${this.basePath}/tokens`)}revoke($){return this.client.delete(`${this.basePath}/tokens/${i6($)}`)}}class Hk${client;basePath;constructor($,Z){this.client=$,this.basePath=Z}list(){return this.client.get(`${this.basePath}/permissions/vm`)}grant($){return this.client.post(`${this.basePath}/permissions/vm`,$)}get($){return this.client.get(`${this.basePath}/permissions/vm/${i6($)}`)}update($,Z){return this.client.patch(`${this.basePath}/permissions/vm/${i6($)}`,{allowedLinuxUsers:Z})}revoke($){return this.client.delete(`${this.basePath}/permissions/vm/${i6($)}`)}}class lQ1{id;tokens;permissions;client;basePath;constructor($,Z){this.client=$,this.id=Z,this.basePath=uQ1(Z),this.tokens=new Kk$($,this.basePath),this.permissions={vm:new Hk$($,this.basePath)}}data(){return this.client.get(this.basePath)}delete(){return this.client.delete(this.basePath)}}class cQ1{client;constructor($){this.client=$}async create($={}){let Z=await this.client.post("/v5/identities",$);return{identity:new lQ1(this.client,Z.id),identityId:Z.id,data:Z}}list($={}){return this.client.get("/v5/identities",$)}get($){return this.client.get(uQ1($))}ref($){return new lQ1(this.client,$)}delete($){return this.client.delete(uQ1($))}}var mQ1=L(()=>{TK()});function h1($,Z){throw new nQ1($,Z)}function j7($,Z){throw new tQ1($,Z)}function f80($){return mr4.some((Z)=>$[Z]!==void 0)}function rr4($){return!f80($)&&$.port===void 0}function LX($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function Tk$($,Z,Q){if(typeof $!=="string"||!nr4.test($))j7(Z,`${Z} must be a valid HTTP header name`);let Y=$.toLowerCase();if(sr4.has(Y)||Y.startsWith("x-forwarded-")||Y.startsWith("x-freestyle-")||Q&&(Y==="cookie"||Y==="set-cookie"))j7(Z,`${Z} may not use reserved header \`${$}\``)}function ar4($,Z){if(!Array.isArray($))j7(Z,`${Z} must be an array of header names`);if($.length>Ok$)j7(Z,`${Z} may contain at most ${Ok$} names`);let Q=new Set;$.forEach((Y,X)=>{Tk$(Y,`${Z}[${X}]`,!0);let J=Y.toLowerCase();if(Q.has(J))j7(`${Z}[${X}]`,`${Z} contains duplicate header \`${Y}\``);Q.add(J)})}function jk$($){if(!LX($))j7("forwardAuth","forwardAuth must be an object");for(let Y of Object.keys($))if(!Nk$.includes(Y))j7(Y,`Unknown field \`${Y}\`. Expected one of: ${Nk$.join(", ")}`);let Z=$;if(typeof Z.url!=="string"||Z.url.length===0||Z.url.length>tr4)j7("url","url is required and must be an absolute HTTPS URL");let Q;try{Q=new URL(Z.url)}catch{j7("url","url must be an absolute HTTPS URL")}if(Q.protocol!=="https:"||Q.hostname.length===0||Q.username.length>0||Q.password.length>0||Q.hash.length>0||Q.port==="0")j7("url","url must be an absolute HTTPS URL");if(Z.headers!==void 0){if(!LX(Z.headers))j7("headers","headers must be an object of header name to value");let Y=Object.entries(Z.headers);if(Y.length>Dk$)j7("headers",`headers may contain at most ${Dk$} entries`);let X=0,J=new Set;for(let[G,W]of Y){Tk$(G,`headers.${G}`,!1);let K=G.toLowerCase();if(J.has(K))j7(`headers.${G}`,`headers contains duplicate header \`${G}\``);if(J.add(K),typeof W!=="string"||/[\0\r\n]/.test(W))j7(`headers.${G}`,`headers.${G} must be a string`);X+=G.length+W.length}if(X>Lk$)j7("headers",`headers may contain at most ${Lk$} bytes`)}if(Z.timeoutMs!==void 0&&(!Number.isInteger(Z.timeoutMs)||Z.timeoutMs<100||Z.timeoutMs>5000))j7("timeoutMs","timeoutMs must be an integer between 100 and 5000");if(Z.protectedCookies!==void 0){if(!Array.isArray(Z.protectedCookies))j7("protectedCookies","protectedCookies must be an array of cookie names");if(Z.protectedCookies.length>wk$)j7("protectedCookies",`protectedCookies may contain at most ${wk$} names`);let Y=new Set;Z.protectedCookies.forEach((X,J)=>{if(typeof X!=="string"||X.length>or4||!pr4.test(X))j7(`protectedCookies[${J}]`,`protectedCookies[${J}] must be a valid HTTP cookie name`);if(Y.has(X))j7(`protectedCookies[${J}]`,`protectedCookies contains duplicate cookie \`${X}\``);Y.add(X)})}if(Z.authResponseHeaders!==void 0)ar4(Z.authResponseHeaders,"authResponseHeaders");return Z}function er4($,Z){if(!LX($))h1(Z,`${Z} must be an object with an \`id\``);for(let Y of Object.keys($))if(!Bk$.includes(Y))h1(`${Z}.${Y}`,`${Z} has unknown field \`${Y}\`. Expected: ${Bk$.join(", ")}`);let Q=$.id;if(typeof Q!=="string"||Q.length===0)h1(`${Z}.id`,`${Z}.id is required and must be a non-empty string`)}function pQ1($){if(typeof $!=="string")h1("domain","domain is required and must be a string");if($==="*")return;let Z=$.startsWith("*.")?$.slice(2):$;if(Z.length===0||Z.length>dr4)h1("domain",`domain \`${$}\` is not a hostname`);let Q=Z.split(".");if(Q.length<2)h1("domain",`domain \`${$}\` must have at least two labels, e.g. acme.com`);for(let Y of Q){if(Y.length===0||Y.length>ir4)h1("domain",`domain \`${$}\` has an empty or over-long label`);if(!/^[a-z0-9-]+$/.test(Y))h1("domain",`domain \`${$}\`: labels are lowercase letters, digits, and hyphens (a \`*.\` prefix is the only wildcard)`);if(Y.startsWith("-")||Y.endsWith("-"))h1("domain",`domain \`${$}\`: a label cannot start or end with a hyphen`)}}function $a4($){if(typeof $!=="string")h1("domain","domain is required and must be a string");let Z=$.lastIndexOf("@");if(Z===-1){pQ1($);return}let Q=$.slice(0,Z),Y=$.slice(Z+1);if(Q.length===0||Q.length>64)h1("domain",`mail route \`${$}\`: the part before \`@\` must be 1-64 characters`);if(Q.startsWith(".")||Q.endsWith(".")||Q.includes(".."))h1("domain",`mail route \`${$}\`: the part before \`@\` cannot start or end with a dot, or contain \`..\``);for(let X of Q)if(!/[a-zA-Z0-9]/.test(X)&&!Ek$.includes(X))h1("domain",`mail route \`${$}\`: the part before \`@\` may use letters, digits, dots, and \`${Ek$.slice(0,-1)}\` (quoted mailboxes are not supported)`);if(Y==="*")h1("domain",`mail route \`${$}\`: \`*\` is not a mail domain \u2014 name the domain the mailbox lives at`);pQ1(Y)}function Pk$($,Z){if(!LX($))h1(Z,`${Z} must be an object`);for(let Y of Object.keys($))if(!Fk$.includes(Y))h1(`${Z}.${Y}`,`${Z} has unknown field \`${Y}\`. Expected one of: ${Fk$.join(", ")}`);let Q=$;for(let Y of["vmId","vpcId","host"]){let X=Q[Y];if(X!==void 0&&(typeof X!=="string"||X.length===0))h1(`${Z}.${Y}`,`${Z}.${Y} must be a non-empty string`)}if(Q.public!==void 0&&Q.public!==!0)h1(`${Z}.public`,`${Z}.public must be true when present. Omit the field to match something else`);if(Z==="source"){if(Q.host!==void 0)h1("source.host","source.host is not allowed: a source is who opens the session, not where it lands. Put `host` on the destination");if(Q.port!==void 0)h1("source.port","source.port is not allowed: a source is who opens the session, not where it lands. Put `port` on the destination");if(Q.public===!0&&(Q.vmId!==void 0||Q.vpcId!==void 0))h1("source.public","source cannot combine `public: true` with `vmId` or `vpcId`: use one alone. `public` is every client on the Internet; `vmId`/`vpcId` is a specific dialer")}else{if(Q.vpcId!==void 0)h1("destination.vpcId","destination.vpcId is not allowed: a session lands in one place, not on a whole network. Name a `vmId`, a `host`, or `public: true` for the domain's own origin. A whole network may be a source");if([Q.vmId!==void 0,Q.host!==void 0,Q.public===!0].filter(Boolean).length>1)h1("destination","destination names more than one landing: give exactly one of `vmId`, `host`, or `public: true`");if((Q.vmId!==void 0||Q.host!==void 0)&&Q.port===void 0)h1("destination.port",`destination.port is required with ${Q.vmId!==void 0?"`vmId`":"`host`"}: say which port the session lands on`)}if(Q.port!==void 0){if(!Number.isInteger(Q.port)||Q.port<1||Q.port>65535)h1(`${Z}.port`,`${Z}.port must be an integer between 1 and 65535`)}}function Za4($){if("postgres"in $)return"postgres";if("smtp"in $)return"smtp";if("socks5"in $)return"socks5";return"http"}function Qa4($,Z){function Q(W,K,H){if(!LX(W)||Object.keys(W).some((F)=>!K.includes(F)))h1(H,`${H} must contain only ${K.join(", ")}`)}if(Q($,["region","credentials","scope"],Z),typeof $.region!=="string"||!/^[a-z0-9-]{1,63}$/.test($.region))h1(`${Z}.region`,"invalid s3.region");Q($.credentials,["accessKeyId","secretAccessKey","sessionToken"],`${Z}.credentials`);for(let W of["accessKeyId","secretAccessKey","sessionToken"]){let K=$.credentials[W];if(W==="sessionToken"&&K===void 0)continue;if(typeof K!=="string"||!/^[\x21-\x7e]{1,16384}$/.test(K))h1(`${Z}.credentials.${W}`,"invalid s3 credentials")}if(!/^[a-zA-Z0-9]+$/.test($.credentials.accessKeyId))h1(`${Z}.credentials.accessKeyId`,"invalid s3 access key id");Q($.scope,["bucket","prefix","operations"],`${Z}.scope`);let{bucket:Y,prefix:X,operations:J}=$.scope;if(typeof Y!=="string"||!/^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/.test(Y)||Y.includes(".."))h1(`${Z}.scope.bucket`,"invalid s3.scope.bucket");if(typeof X!=="string"||Buffer.byteLength(X,"utf8")>1024||/[\x00-\x1f\x7f-\x9f]/u.test(X))h1(`${Z}.scope.prefix`,"invalid s3.scope.prefix");let G=["GetObject","HeadObject","PutObject","DeleteObject","ListObjectsV2","CreateMultipartUpload","UploadPart","ListParts","CompleteMultipartUpload","AbortMultipartUpload","ListMultipartUploads"];if(!Array.isArray(J)||J.length===0||J.length>G.length||J.some((W)=>!G.includes(W))||new Set(J).size!==J.length)h1(`${Z}.scope.operations`,"s3.scope.operations must be a nonempty list of distinct supported operations")}function Ya4($,Z){if(!LX($))h1(Z,`${Z} must be an object: \`{ headers: { \u2026 } }\`, \`{ postgres: { \u2026 } }\`, \`{ smtp: { \u2026 } }\` or \`{ socks5: { \u2026 } }\``);let Q=Object.keys($);if(Q.length!==1||!["headers","jsonPatch","postgres","smtp","socks5","s3"].includes(Q[0]??""))h1(Z,`${Z} must have exactly one of \`headers\`, \`jsonPatch\`, \`postgres\`, \`smtp\`, \`socks5\` or \`s3\` (got: ${Q.length===0?"nothing":Q.join(", ")})`);if(Q[0]==="s3"){Qa4($.s3,`${Z}.s3`);return}if(Q[0]==="jsonPatch"){let Y=$.jsonPatch;if(!Array.isArray(Y)||Y.length>128)h1(Z,`${Z}.jsonPatch must be an array of at most 128 operations`);let X=(W)=>typeof W==="string"&&(W===""||W.startsWith("/"))&&!/~(?:[^01]|$)/u.test(W),J=(W,K=new Set,H=0)=>{if(H>64)return!1;if(W===null||typeof W==="string"||typeof W==="boolean")return!0;if(typeof W==="number")return Number.isFinite(W);if(typeof W!=="object"||K.has(W))return!1;K.add(W);let F=(Array.isArray(W)?Array.from(W):LX(W)?Object.values(W):[void 0]).every((U)=>J(U,K,H+1));return K.delete(W),F};for(let[W,K]of Y.entries()){if(!LX(K)||!["add","remove","replace","move","copy","test"].includes(String(K.op))||!X(K.path))h1(Z,`${Z}.jsonPatch[${W}] requires a standard op and valid JSON Pointer path`);if(["move","copy"].includes(K.op)&&!X(K.from))h1(Z,`${Z}.jsonPatch[${W}].from must be a JSON Pointer`);if(["add","replace","test"].includes(K.op)&&(!Object.hasOwn(K,"value")||!J(K.value)))h1(Z,`${Z}.jsonPatch[${W}].value must be a JSON value (null is allowed)`)}let G;try{G=JSON.stringify(Y)}catch{h1(Z,"jsonPatch must be JSON serializable")}if(Buffer.byteLength(G,"utf8")>65536)h1(Z,"jsonPatch exceeds 64 KiB");return}if(Q[0]==="socks5"){let Y=$.socks5;if(!LX(Y))h1(`${Z}.socks5`,`${Z}.socks5 must be an object with \`username\` and \`password\``);for(let X of Object.keys(Y))if(!["username","password"].includes(X))h1(`${Z}.socks5.${X}`,`${Z}.socks5 has unknown field \`${X}\`. Expected: username, password`);for(let X of["username","password"])if(typeof Y[X]!=="string"||Y[X].length===0)h1(`${Z}.socks5.${X}`,`${Z}.socks5.${X} is required and must be a non-empty string`);return}if(Q[0]==="smtp"){let Y=$.smtp;if(!LX(Y))h1(`${Z}.smtp`,`${Z}.smtp must be an object with \`username\` and \`password\``);for(let X of Object.keys(Y))if(!["username","password"].includes(X))h1(`${Z}.smtp.${X}`,`${Z}.smtp has unknown field \`${X}\`. Expected: username, password`);for(let X of["username","password"])if(typeof Y[X]!=="string"||Y[X].length===0)h1(`${Z}.smtp.${X}`,`${Z}.smtp.${X} is required and must be a non-empty string`);return}if(Q[0]==="headers"){let Y=$.headers;if(!LX(Y))h1(`${Z}.headers`,`${Z}.headers must be an object of header name to value`);for(let[X,J]of Object.entries(Y))if(typeof J!=="string")h1(`${Z}.headers.${X}`,`${Z}.headers.${X} must be a string`)}else{let Y=$.postgres;if(!LX(Y))h1(`${Z}.postgres`,`${Z}.postgres must be an object with \`username\` and \`password\``);for(let J of Object.keys(Y))if(!["username","password","database"].includes(J))h1(`${Z}.postgres.${J}`,`${Z}.postgres has unknown field \`${J}\`. Expected: username, password, database`);let X=Y;for(let J of["username","password"])if(typeof X[J]!=="string"||X[J].length===0)h1(`${Z}.postgres.${J}`,`${Z}.postgres.${J} is required and must be a non-empty string`);if(X.database!==void 0&&typeof X.database!=="string")h1(`${Z}.postgres.database`,`${Z}.postgres.database must be a string`)}}function Xa4($,Z){let Q=$;return Z.forEach((Y,X)=>{let J=Za4(Y);if(Q===void 0)Q=J;else if(Q!==J)h1(`transform[${X}]`,`transform requires protocol \`${J}\` but the rule is \`${Q}\`; a rule terminates one protocol`)}),Q??"http"}function Ja4($,Z){if(!LX($)||Object.keys($).some((Q)=>Q!=="method"&&Q!=="path"))h1(Z,`${Z} must be an object containing only method and path`);if($.method!==void 0&&(!Array.isArray($.method)||$.method.some((Q)=>typeof Q!=="string"||Q.length===0||/[^!#$%&'*+.^_`|~0-9A-Za-z-]/.test(Q))))h1(`${Z}.method`,`${Z}.method must be an array of HTTP method tokens`);if($.path!==void 0){let Q=$.path;if(!LX(Q)||Object.keys(Q).length!==1||typeof Q.exact!=="string"||!Q.exact.startsWith("/")||/[\s?#]/.test(Q.exact))h1(`${Z}.path`,`${Z}.path must contain exact: an absolute path without a query or fragment`)}}function Rk$($,Z){if(!LX($))h1(Z||"rule",`${Z||"rule"} must be an object`);for(let H of Object.keys($))if(!zk$.includes(H))h1(`${Z}${H}`,`Unknown field \`${H}\`. Expected one of: ${zk$.join(", ")}`);let Q=$;if(Q.action===void 0)h1(`${Z}action`,`${Z}action is required. Write \`action: "allow"\` \u2014 every rule states what it does rather than defaulting to it`);if(Q.action!=="allow")h1(`${Z}action`,`${Z}action must be "allow" (got \`${String(Q.action)}\`). Only allow rules exist today`);if(Q.protocol!==void 0&&!Uk$.includes(Q.protocol))h1(`${Z}protocol`,`${Z}protocol must be one of: ${Uk$.join(", ")} (got \`${String(Q.protocol)}\`)`);let Y=Q.source??{},X=Q.destination??{};Pk$(Y,"source"),Pk$(X,"destination");let J=Q.transform??[];if(!Array.isArray(J))h1(`${Z}transform`,`${Z}transform must be an array`);J.forEach((H,F)=>Ya4(H,`${Z}transform[${F}]`));let G=Xa4(Q.protocol,J);if(Q.match!==void 0){if(Ja4(Q.match,`${Z}match`),G!=="http"||Y.public===!0||!(X.public===!0||X.host!==void 0))h1(`${Z}match`,"match requires HTTP egress from a VM or VPC to a public origin or host")}if(J.some((H)=>("s3"in H))){if(J.length!==1||Q.match!==void 0||Y.public===!0||!(X.public===!0||X.host!==void 0)||Q.domain.includes("*"))h1(`${Z}transform`,"s3 requires a sole transform on HTTP egress to a concrete origin, without match")}let W=J.filter((H)=>("jsonPatch"in H));if(W.length>1)h1(`${Z}transform`,"a rule may carry only one jsonPatch transform");if(W.length&&(Y.public===!0||!(X.public===!0||X.host!==void 0)))h1(`${Z}transform`,"jsonPatch requires HTTP egress from a VM or VPC to a public origin or host");if(Q.forwardAuth!==void 0){er4(Q.forwardAuth,`${Z}forwardAuth`);let H=X.vmId!==void 0||!f80(X)&&X.port!==void 0;if(G!=="http"||Y.public!==!0||!H||Q.domain==="*")h1(`${Z}forwardAuth`,`${Z}forwardAuth is only supported on HTTP public ingress: \`{ public: true } -> { vmId, port }\``)}if(G==="smtp")$a4(Q.domain);else pQ1(Q.domain);if((Y.vmId!==void 0||Y.vpcId!==void 0)&&X.vmId!==void 0&&J.length>0)h1(`${Z}transform`,"a VM-to-VM rule cannot carry a transform yet \u2014 remove it (only public ingress/egress rules run transforms)");if(G==="tcp"){let H=X.public===!0||X.host!==void 0,F=Y.vmId!==void 0||Y.vpcId!==void 0;if(H||F)h1(`${Z}protocol`,"a `tcp` rule is public ingress only \u2014 `{ public: true } -> { vmId, port }`. The edge splices the session without terminating it, so outbound there is nothing to broker (an outbound allow is a firewall rule, and injecting into one needs `http` or `postgres`) and inward there is no certificate to answer the source with. Give the source `public: true`, or drop `protocol` to be served as HTTPS")}else if(G==="imap"||G==="imaps"){let H=X.public===!0||X.host!==void 0,F=Y.vmId!==void 0||Y.vpcId!==void 0;if(H||F)h1(`${Z}protocol`,`an \`${G}\` rule is public ingress only \u2014 \`{ public: true } -> { vmId, port }\`. The 993 front serves mail clients reaching a VM's IMAP server; outbound there is nothing to broker (an outbound allow is a firewall rule) and inward there is no certificate to answer the source with`)}else if(G==="socks5"){let H=X.public===!0||X.host!==void 0;if(Y.public===!0||!H)h1(`${Z}protocol`,'a `socks5` rule is egress only \u2014 `{ vmId } -> { host: "gate.provider.com", port: 1080 }`. The front exists so a guest can open sessions through a proxy whose credentials it never holds; inbound there is nothing to serve, and publishing one would be an open proxy on a platform address');if(X.host===void 0)h1(`${Z}destination`,"a `socks5` rule has to name the proxy it goes through: give the destination a `host` and the `port` the provider listens on. `{ public: true }` on its own asks the edge to be the proxy, which would let the guest out on our address rather than through yours")}else if(G==="postgres"){let H=J.some((U)=>U!==null&&typeof U==="object"&&("postgres"in U)),F=X.public===!0||X.host!==void 0;if(H&&!F)h1(`${Z}transform`,"a `postgres` transform belongs on an egress rule: the edge spends a credential the guest never holds, so pointing it at your own VM would hand every client a logged-in session. Give the destination `public: true` or a `host`, or drop the transform")}else if(G==="smtp"){let H=J.some((U)=>U!==null&&typeof U==="object"&&("smtp"in U)),F=X.public===!0||X.host!==void 0;if(H&&!F)h1(`${Z}transform`,"an `smtp` transform belongs on an egress rule: the edge spends a credential the guest never holds, so pointing it at your own VM would turn it into an open relay. Give the destination `public: true` or a `host`, or drop the transform");if(typeof Q.domain==="string"&&Q.domain.includes("@")&&Y.public!==!0)h1(`${Z}domain`,`\`${Q.domain}\` names a mailbox, which only makes sense on a rule that receives mail. An egress or VM-to-VM rule names the host the guest submits through \u2014 drop the part before \`@\``)}return{...Q,source:Y,destination:X}}function Ga4($,Z){if($==="source")return rr4(Z)?"source is empty. Say who opens the session: `vmId`, `vpcId`, or `public: true`":"source only narrows the session without saying who opens it. Add `vmId`, `vpcId`, or `public: true`";return"destination is empty. Say where the session lands: `vmId` + `port`, `host` + `port`, or `public: true` for the domain's own origin"}function Ak$($){let Z=Rk$($,"");for(let Q of["source","destination"]){let Y=Z[Q];if(!f80(Y))h1(Q,Ga4(Q,Y))}if(Z.source.public===!0&&Z.destination.public===!0)h1("destination","a rule from the public Internet to the domain's own origin allows nothing the world cannot already do. Did you mean a `vmId` destination (ingress) or a `vmId` source (egress)?");return Z}function qk$($){if(!LX($))h1("tls","tls must be an object with a `rules` array");for(let Q of Object.keys($))if(Q!=="rules")h1(`tls.${Q}`,`tls has unknown field \`${Q}\`. Expected: rules`);let Z=$.rules;if(!Array.isArray(Z))h1("tls.rules","tls.rules must be an array");return Z.forEach((Q,Y)=>{let X=`tls.rules[${Y}].`,J=Rk$(Q,X),G=f80(J.source),W=f80(J.destination);if(!G&&!W)h1(`tls.rules[${Y}]`,`tls.rules[${Y}]: both source and destination refer to the VM being created, which allows nothing. Give one of them a \`vmId\`, \`vpcId\`, or \`public: true\``);if(G&&W)h1(`tls.rules[${Y}]`,`tls.rules[${Y}]: neither end refers to the VM being created. Leave one endpoint's identity unset so it means this VM, or create the rule with tls.rules.create instead`);if(!W&&J.destination.port===void 0)h1(`tls.rules[${Y}].destination.port`,`tls.rules[${Y}]: destination.port is required: say which port on this VM the session lands on`)}),$}function dQ1($){return`/v5/tls/${i6($)}`}function iQ1($){return`/v5/tls/forward-auth/${i6($)}`}class Mk${client;constructor($){this.client=$}list(){return this.client.get("/v5/tls/forward-auth")}async create($){let Z=jk$($);return this.client.post("/v5/tls/forward-auth",Z)}get($){return this.client.get(iQ1($))}async update($,Z){let Q=jk$(Z);return this.client.put(iQ1($),Q)}delete($){return this.client.delete(iQ1($))}}class Ik${client;constructor($){this.client=$}async create($){let Z=Ak$($);return this.client.post("/v5/tls",Z)}list($={}){return this.client.get("/v5/tls",$)}get($){return this.client.get(dQ1($))}async update($,Z){let Q=Ak$(Z);return this.client.put(dQ1($),Q)}delete($){return this.client.delete(dQ1($))}}class oQ1{client;rules;forwardAuth;constructor($){this.client=$,this.rules=new Ik$($),this.forwardAuth=new Mk$($)}}var nQ1,tQ1,Fk$,mr4,Uk$,dr4=253,ir4=63,Nk$,Bk$,pr4,nr4,tr4=2048,Dk$=32,Lk$=16384,Ok$=32,wk$=32,or4=128,sr4,Ek$="!#$%&'*+-/=?^_`{|}~.",zk$;var mq0=L(()=>{TK();nQ1=class nQ1 extends Error{path;constructor($,Z){super(Z);this.name="TlsRuleValidationError",this.path=$,Object.setPrototypeOf(this,nQ1.prototype)}};tQ1=class tQ1 extends Error{path;constructor($,Z){super(Z);this.name="TlsForwardAuthValidationError",this.path=$,Object.setPrototypeOf(this,tQ1.prototype)}};Fk$=["vmId","vpcId","public","host","port"],mr4=["vmId","vpcId","public","host"],Uk$=["tcp","http","postgres","minecraft","smtp","imap","imaps","socks5"],Nk$=["url","headers","timeoutMs","protectedCookies","authResponseHeaders"],Bk$=["id"],pr4=/^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/,nr4=/^[0-9A-Za-z-]+$/,sr4=new Set(["host","content-length","connection","keep-alive","proxy-authenticate","proxy-authorization","proxy-connection","te","trailer","transfer-encoding","upgrade"]);zk$=["action","domain","protocol","source","destination","transform","match","forwardAuth"]});function Si($){return`/v5/tunnels/${i6($)}`}function yy($){return $.tunnelId??=$.id,$}class sQ1{client;constructor($){this.client=$}list(){return this.client.get("/v5/tunnels").then(($)=>{return $.tunnels.forEach(yy),$})}create($={}){return this.client.post("/v5/tunnels",$).then(yy)}get($){return this.client.get(Si($)).then(yy)}update($,Z){return this.client.patch(Si($),Z).then(yy)}rotateKey($,Z={}){return this.client.post(`${Si($)}/rotate-key`,Z).then(yy)}delete($){return this.client.delete(Si($))}attachVpc($,Z,Q={}){return this.client.post(`${Si($)}/vpcs/${i6(Z)}`,Q).then(yy)}detachVpc($,Z){return this.client.delete(`${Si($)}/vpcs/${i6(Z)}`).then(yy)}}var rQ1=L(()=>{TK()});class aQ1{client;basePath;constructor($,Z){this.client=$,this.basePath=Z}async readFile($,Z={}){let Q=await this.openRead($,Z);return new Uint8Array(await Q.arrayBuffer())}async readTextFile($,Z={}){return await(await this.openRead($,Z)).text()}async readFileStream($,Z={}){let Q=await this.openRead($,Z);if(!Q.body)throw Error(`no response body reading ${$}`);return Q.body}async writeFile($,Z,Q={}){let Y=typeof Z==="string"?new TextEncoder().encode(Z):Z,X=Y instanceof Uint8Array?Y.byteLength:Y.size;if(X>Wa4)return this.uploadInChunks($,Y,X,Q);let J=Y instanceof Uint8Array?Y:new Uint8Array(await Y.arrayBuffer());await this.client.putBytes(`${this.basePath}/fs/write`,J,{path:$,mode:Q.mode,sha256:await Vk$(J)},Q.signal),Q.onProgress?.({completedBytes:X,totalBytes:X})}writeTextFile($,Z,Q={}){return this.writeFile($,Z,Q)}async readDir($){let{entries:Z}=await this.client.get(`${this.basePath}/fs/dir`,{path:$});return Z}async mkdir($){await this.client.post(`${this.basePath}/fs/mkdir`,{path:$})}async remove($){await this.client.delete(`${this.basePath}/fs/remove`,{path:$})}async exists($){let{exists:Z}=await this.client.get(`${this.basePath}/fs/exists`,{path:$});return Z}stat($){return this.client.get(`${this.basePath}/fs/stat`,{path:$})}openRead($,Z){let{offset:Q,length:Y}=Z,X;if(Q!==void 0||Y!==void 0){let J=Q??0;X=Y===void 0?`bytes=${J}-`:`bytes=${J}-${J+Y-1}`}return this.client.getBytes(`${this.basePath}/fs/read`,{path:$},{range:X,signal:Z.signal})}async uploadInChunks($,Z,Q,Y){let X=Y.chunkSize??Ka4,J=Y.maxAttempts??Ha4,G=Z instanceof Uint8Array?await Vk$(Z):void 0,W=await this.client.post(`${this.basePath}/fs/uploads`,{path:$,size:Q,sha256:G,mode:Y.mode}),K=`${this.basePath}/fs/uploads/${W.uploadId}`;try{let H=W.receivedBytes;while(H<Q){let F=Math.min(H+X,Q),U=Z instanceof Uint8Array?Z.subarray(H,F):Z.slice(H,F);H=(await this.putChunkWithRetry(K,U,H,J,Y.signal)).receivedBytes,Y.onProgress?.({completedBytes:Math.min(H,Q),totalBytes:Q})}await this.client.post(`${K}/commit`)}catch(H){throw await this.client.delete(K).catch(()=>{}),H}}async putChunkWithRetry($,Z,Q,Y,X){let J;for(let G=1;G<=Y;G++){X?.throwIfAborted?.();try{return await this.client.putBytes($,Z,{offset:Q},X)}catch(W){if(J=W,!(!(W instanceof qJ)||W.status>=500||W.status===408||W.status===409||W.status===429)||X?.aborted||G===Y)throw W;await Fa4(Math.min(500*2**(G-1),8000));let H=await this.client.get($).catch(()=>{return});if(H&&H.receivedBytes>Q)return H}}throw J}}async function Vk$($){let Z=globalThis.crypto?.subtle;if(!Z)return;let Q=await Z.digest("SHA-256",$);return Array.from(new Uint8Array(Q),(Y)=>Y.toString(16).padStart(2,"0")).join("")}function Fa4($){return new Promise((Z)=>setTimeout(Z,$))}var Wa4=8388608,Ka4=16777216,Ha4=5;var eQ1=L(()=>{b80()});function Ua4(){return typeof process<"u"&&Boolean(process.versions?.node)}async function kk$($,Z){if(Ua4()){let Y;try{Y=await import("ws")}catch{throw Error("PTY sessions need the `ws` package in Node. Install it with `npm install ws`.")}return new Y.default($,{headers:Z})}let Q=globalThis.WebSocket;if(!Q)throw Error("PTY sessions need a WebSocket client; no global WebSocket is available in this environment.");return new Q($)}function y80($,Z,Q){if($.on){$.on(Z,Q);return}$.addEventListener?.(Z,Q)}function Ba4($,Z){if($&&typeof $==="object"&&"data"in $){let Q=$.data;if(typeof Q==="string")return{text:Q};if(Q instanceof ArrayBuffer)return{binary:new Uint8Array(Q)};return{}}if($ instanceof Uint8Array)return Z?{binary:$}:{text:Na4.decode($)};if(typeof $==="string")return{text:$};return{}}class $Y1{_sessionId;_slug;_created=!1;socket;constructor($,Z,Q={}){this.socket=$,this._sessionId=Z,y80($,"message",(Y,X)=>{let{text:J,binary:G}=Ba4(Y,X);if(G){Q.onData?.(G);return}if(!J)return;let W;try{W=JSON.parse(J)}catch{return}if(W.type==="exited")Q.onExit?.(W.exitCode);else if(W.type==="error")Q.onError?.(Error(W.message));else if(W.type==="sessionInfo")this._sessionId=W.sessionId,this._slug=W.slug,this._created=W.created??!0,Q.onSessionInfo?.(W.sessionId)}),y80($,"close",(Y)=>{let X=Y;Q.onClose?.({wasClean:X?.wasClean??!0,code:X?.code??1000,reason:X?.reason??""})}),y80($,"error",(Y)=>Q.onError?.(Y))}write($){this.socket.send(typeof $==="string"?new TextEncoder().encode($):$)}resize($){this.sendControl({type:"resize",cols:$.cols,rows:$.rows})}signal($){this.sendControl({type:"signal",signal:$})}sendControl($){this.socket.send(JSON.stringify($))}detach(){this.socket.close()}get sessionId(){return this._sessionId}get slug(){return this._slug}get created(){return this._created}get readyState(){return this.socket.readyState}}function Da4($){return new Promise((Z,Q)=>{if($.readyState===1){Z();return}y80($,"open",()=>Z()),y80($,"error",(Y)=>Q(Y))})}class ZY1{client;basePath;constructor($,Z){this.client=$,this.basePath=Z}async open($={}){let{exec:Z,cols:Q,rows:Y,linuxUser:X,slug:J,replaceOnExit:G,onData:W,onExit:K,onClose:H,onError:F}=$,U={};if(Z!==void 0)U.exec=Z;if(Q!==void 0)U.cols=Q;if(Y!==void 0)U.rows=Y;if(X!==void 0)U.linuxUser=X;if(J!==void 0)U.slug=J;if(G!==void 0)U.replaceOnExit=String(G);let N=Sk$(this.client,`${this.basePath}/pty`,U),B=this.client.authHeaders(),D=await kk$(N,B);return new Promise((O,w)=>{let j=!1,E=new $Y1(D,-1,{onData:W,onExit:K,onClose:(P)=>{if(!j)j=!0,w(Error("connection closed before sessionInfo"));H?.(P)},onError:(P)=>{if(!j)j=!0,w(P);F?.(P)},onSessionInfo:()=>{j=!0,O(E)}})})}async attach($){let{session:Z,linuxUser:Q,onData:Y,onExit:X,onClose:J,onError:G}=$,W=Sk$(this.client,`${this.basePath}/pty/sessions/${i6(String(Z))}`,{...Q!==void 0?{linuxUser:Q}:{}}),K=this.client.authHeaders(),H=await kk$(W,K),F=new $Y1(H,typeof Z==="number"?Z:-1,{onData:Y,onExit:X,onClose:J,onError:G});return await Da4(H),F}list($={}){return this.client.get(`${this.basePath}/pty/sessions`,$)}close($,Z={}){return this.client.delete(`${this.basePath}/pty/sessions/${i6(String($))}`,Z)}}class QY1{pty;linuxUser;constructor($,Z){this.pty=$,this.linuxUser=Z}open($={}){return this.pty.open({...$,linuxUser:this.linuxUser})}attach($){return this.pty.attach({...$,linuxUser:this.linuxUser})}list(){return this.pty.list({linuxUser:this.linuxUser})}close($){return this.pty.close($,{linuxUser:this.linuxUser})}}function Sk$($,Z,Q){return $.url(Z,Q).replace(/^http/,"ws")}var Na4;var YY1=L(()=>{TK();Na4=new TextDecoder});class XY1{client;constructor($){this.client=$}list($={}){return this.client.get("/v5/snapshots",$)}get($){return this.client.get(`/v5/snapshots/${i6($)}`)}update($,Z){return this.client.patch(`/v5/snapshots/${i6($)}`,Z)}delete($){return this.client.delete(`/v5/snapshots/${i6($)}`)}}var JY1=L(()=>{TK()});var Ck$=()=>{};function GY1($){return`/v5/vms/${i6($)}`}class WY1{id;fs;pty;client;basePath;constructor($,Z){this.client=$,this.id=Z,this.basePath=GY1(Z),this.fs=new aQ1($,this.basePath),this.pty=new ZY1($,this.basePath)}data(){return this.client.get(this.basePath)}firewallRules(){return this.client.get("/v5/firewall/rules",{vmId:this.id})}update($){return this.client.patch(this.basePath,$)}start(){return this.client.post(`${this.basePath}/start`)}pause(){return this.client.post(`${this.basePath}/pause`)}resize($){return this.client.post(`${this.basePath}/resize`,$)}delete(){return this.client.delete(this.basePath)}exec($){let Z=typeof $==="string"?{command:$}:$;return this.client.post(`${this.basePath}/exec-await`,Z)}linuxUser($){return new _k$(this,$)}snapshot($={}){return this.client.post(`${this.basePath}/snapshot`,$)}}class _k${vm;linuxUser;pty;constructor($,Z){this.vm=$,this.linuxUser=Z,this.pty=new QY1($.pty,Z)}exec($){let Z=typeof $==="string"?{command:$}:$;return this.vm.exec({...Z,linuxUser:this.linuxUser})}}class KY1{client;snapshots;constructor($){this.client=$,this.snapshots=new XY1($)}async create($){if(cq0($.firewall,"VM"),$.tls!==void 0)qk$($.tls);let Z=await this.client.post("/v5/vms",$);return{vm:new WY1(this.client,Z.id),vmId:Z.id,data:Z,firewallRules:Z.firewallRules??[],tlsRules:Z.tlsRules??[]}}list($={}){return this.client.get("/v5/vms",$)}get($){return this.client.get(GY1($))}ref($){return new WY1(this.client,$)}delete($){return this.client.delete(GY1($))}}var HY1=L(()=>{x80();mq0();TK();eQ1();YY1();JY1();Ck$();eQ1();YY1();JY1()});function FY1($){return`/v5/vpcs/${i6($)}`}class vk${client;basePath;constructor($,Z){this.client=$,this.basePath=Z}list(){return this.client.get(`${this.basePath}/tunnels`)}}class UY1{id;tunnels;client;basePath;constructor($,Z){this.client=$,this.id=Z,this.basePath=FY1(Z),this.tunnels=new vk$($,this.basePath)}data(){return this.client.get(this.basePath)}update($){return this.client.patch(this.basePath,$)}delete(){return this.client.delete(this.basePath)}}class NY1{client;constructor($){this.client=$}list(){return this.client.get("/v5/vpcs")}async create($={}){if($.firewall!==void 0)cq0($.firewall,"network");let Z=await this.client.post("/v5/vpcs",$);return{vpc:new UY1(this.client,Z.id),vpcId:Z.id,data:Z,firewallRules:Z.firewallRules??[]}}get($){return this.client.get(FY1($))}ref($){return new UY1(this.client,$)}delete($){return this.client.delete(FY1($))}}var BY1=L(()=>{x80();TK()});class dq0{client;vms;vpc;tunnels;firewall;tls;domains;identities;constructor($={}){this.client=new vQ1($),this.vms=new KY1(this.client),this.vpc=new NY1(this.client),this.tunnels=new sQ1(this.client),this.firewall=new hQ1(this.client),this.tls=new oQ1(this.client),this.domains=new bQ1(this.client),this.identities=new cQ1(this.client)}fetch($,Z){return this.client.fetch($,Z)}}var bk$=L(()=>{TK();xQ1();x80();mQ1();mq0();rQ1();HY1();BY1();TK();b80();HY1();BY1();rQ1();xQ1();x80();mq0();mQ1()});var fk$;var xk$=L(()=>{fk$={name:"@decocms/sandbox",version:"1.92.0",private:!0,type:"module",description:"Sandbox runtime for isolated Studio tool execution",scripts:{check:"tsc --noEmit",test:"bun test",build:"bun run build:typegen && bun run build:harness-runner","build:typegen":"mkdir -p dist && bun run --cwd=../typegen build && bun --cwd=../typegen pm pack --filename $PWD/dist/typegen.tgz --quiet","build:harness-runner":"mkdir -p dist && bun --cwd=../harness-runner pm pack --filename $PWD/dist/harness-runner.tgz --quiet"},exports:{"./shared":"./shared.ts","./provider":"./server/provider/index.ts","./provider/agent-sandbox":"./server/provider/agent-sandbox/index.ts","./provider/postgres-state-store":"./server/provider/postgres-state-store.ts","./provider/freestyle":"./server/provider/freestyle.ts","./provider/remote":"./server/provider/remote.ts","./provider/router":"./server/provider/router.ts","./provider/sandbox-api":"./server/provider/sandbox-api.ts","./provider/sandbox-server":"./server/provider/sandbox-server.ts","./daemon-client":"./server/daemon-client.ts","./org-fs":"./org-fs.ts","./dispatch":"./dispatch/index.ts","./dispatch/*":"./dispatch/*.ts","./proxy/http":"./proxy/http.ts","./proxy/websocket":"./proxy/websocket.ts"},dependencies:{"@decocms/shared":"workspace:*","@kubernetes/client-node":"^1.4.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0",freestyle:"0.2.16",zod:"4.3.6"},devDependencies:{"@types/bun":"latest",postgres:"^3.4.5",typescript:"^7.0.2"}}});function iq0($){let Z=$?.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of studio-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"});return async(Q,Y)=>{if(!Z)return Y();let X=performance.now(),J=(G)=>Z.record(performance.now()-X,{runner_kind:Q,source:"daemon",status_code:G});try{let G=await Y();return J(G.status),G}catch(G){throw J(0),G}}}var TL;var pq0=L(()=>{TL={kubernetes:"agent-sandbox",freestyle:"freestyle"}});var pk$={};O6(pk$,{FreestyleSandboxProvider:()=>dk$});import{createHash as yk$,createHmac as Oa4,randomBytes as wa4}from"crypto";class dk${apiKey;freestyle;lookupClient;image;sidecarImage;idleTimeoutSeconds;idlePauseMs;autoDeleteSeconds;domainSuffix;timeDaemonRequest;inflight=new by;snapshotInflight=new by;knownSnapshots=new Set;lookups=new Map;releaseTimers=new Map;idleSweep=null;sweeping=!1;repoSnapshots=new Map;repoSnapshotBuilds=new Set;repoSnapshotFailures=new Map;constructor($){if(this.apiKey=$.apiKey,this.freestyle=$.client??new dq0({apiKey:$.apiKey}),this.lookupClient=$.client??new dq0({apiKey:$.apiKey,fetch:Object.assign((Z,Q)=>fetch(Z,{...Q,signal:Q?.signal?AbortSignal.any([Q.signal,AbortSignal.timeout(jY1)]):AbortSignal.timeout(jY1)}),{preconnect:fetch.preconnect})}),this.image=$.image??`ghcr.io/decocms/studio/studio-sandbox-go:${fk$.version}`,this.sidecarImage=$.orgFsSidecarImage??Ea4,this.idleTimeoutSeconds=$.idleTimeoutSeconds??300,this.idlePauseMs=$.idlePauseMs??600000,this.autoDeleteSeconds=$.autoDeleteSeconds??86400,this.domainSuffix=$.domainSuffix??"style.dev",this.timeDaemonRequest=iq0($.meter),this.idlePauseMs>0)this.idleSweep=setInterval(()=>void this.pauseIdle(),ka4),this.idleSweep.unref?.()}async owns($){return await this.find($)!==null}daemonUrl($){return`https://${$}.${this.domainSuffix}`}async find($,Z={}){let Q=this.lookups.get($);if(!Z.refresh&&Q&&Date.now()-Q.at<(Q.found?qa4:Ma4))return Q.found;let Y=null;try{let X=await this.lookupClient.vms.get($),J=X.metadata[DY1];if(J)Y={vm:this.freestyle.vms.ref(X.id),daemon:{url:this.daemonUrl($),token:J}}}catch(X){if(!(X instanceof qJ&&X.status===404))throw X}return this.remember($,Y),Y}remember($,Z){if(this.lookups.delete($),this.lookups.size>=Ia4){let Q=this.lookups.keys().next();if(!Q.done)this.lookups.delete(Q.value)}this.lookups.set($,{found:Z,at:Date.now()})}async warm(){await this.baseSnapshot().catch(($)=>console.warn(`[${s7}] base snapshot warm failed: ${hy($)}`))}baseSnapshot(){let{image:$,sidecarImage:Z}=this,Q=`studio-sandbox-${yk$("sha256").update(`${$}
+${X}`:X}var eI$,ws4;var HQ1=L(()=>{eI$=/[\r\n<>]/,ws4=/^[^\s@<>]+@[^\s@<>]+\.[^\s@<>]+$/});var Rq0=L(()=>{r$();HQ1()});function Es4($){if($ instanceof TypeError)return!0;if($ instanceof Error&&!($ instanceof DOMException)&&typeof $.code==="string")return!0;if($ instanceof DOMException&&$.name==="AbortError")return!0;return!1}async function FQ1($,Z,Q,Y){try{return await D8(async()=>{let J=await fetch($,{...Z,signal:AbortSignal.timeout(Y)});return{status:J.status,ok:J.ok,body:await J.text()}},{maxAttempts:3,minTimeout:50,maxTimeout:500,multiplier:2,jitter:0.5,isRetriable:Es4})}catch(X){let J=X instanceof Error?X.message:String(X);throw Error(`[SANDBOX_UNREACHABLE] sandbox daemon ${Q} request failed: ${J}`,{cause:X})}}async function qq0($){try{let Z=await fetch(`${$}/health`,{signal:AbortSignal.timeout(Ps4)});if(!Z.ok){try{await Z.text()}catch{}return null}let Q=await Z.json();if(typeof Q==="object"&&Q!==null&&typeof Q.bootId==="string"&&typeof Q.ready==="boolean"&&Q.setup&&typeof Q.setup.running==="boolean"&&typeof Q.setup.done==="boolean")return Q;return null}catch{return null}}async function NQ1($){for(let Z=0;Z<ZV$;Z++){if(await qq0($)!==null)return;let Q=(Math.random()*2-1)*zs4;await F$(QV$+Q)}throw Error(`sandbox daemon at ${$} did not respond on /health within ${ZV$*QV$/1000}s`)}async function zK($,Z,Q,Y,X){return As4($,Z,"POST",Q,Y,X)}async function As4($,Z,Q,Y,X,J){let G={...Y};if(X&&X.rotateToken!==void 0)G.auth=X;let W=await FQ1(`${$}/_sandbox/config`,{method:Q,headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:JSON.stringify(G)},"/_sandbox/config",J?.timeoutMs??UQ1);if(!W.ok)throw new AJ(W.status,W.body);return XV$(W.body,"/_sandbox/config")}async function YV$($,Z,Q){let Y=await FQ1(`${$}/_sandbox/setup/${Q}`,{method:"POST",headers:{Authorization:`Bearer ${Z}`}},`/_sandbox/setup/${Q}`,UQ1);if(!Y.ok)throw Error(`sandbox daemon /_sandbox/setup/${Q} returned ${Y.status}: ${Y.body}`)}async function I80($,Z,Q){let Y=await FQ1(`${$}/_sandbox/orgfs-config`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:Q},"/_sandbox/orgfs-config",UQ1);if(!Y.ok)throw Error(`sandbox daemon /_sandbox/orgfs-config returned ${Y.status}: ${Y.body}`);return XV$(Y.body,"/_sandbox/orgfs-config")}function XV$($,Z){try{return JSON.parse($)}catch(Q){throw Error(`sandbox daemon ${Z} returned a malformed JSON body: ${$.slice(0,200)}`,{cause:Q})}}async function Mq0($,Z,Q,Y){let X=new Headers(Y.headers);for(let W of Ts4)X.delete(W);X.set("authorization",`Bearer ${Z}`);let J=Y.method!=="GET"&&Y.method!=="HEAD",G=`${$}${Q.startsWith("/")?Q:`/${Q}`}`;return fetch(G,{method:Y.method,headers:X,body:J?Y.body:void 0,redirect:"manual",signal:Y.signal,duplex:J?"half":void 0})}var AJ,Ps4=500,UQ1=30000,ZV$=25,QV$=200,zs4=50,Ts4;var vy=L(()=>{Rq0();r$();AJ=class AJ extends Error{status;constructor($,Z){super(`sandbox daemon /_sandbox/config returned ${$}: ${Z}`);this.status=$;this.name="ConfigRequestError"}};Ts4=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length"]});class Iq0{counted=new Set;markCounted($){this.counted.add($)}consume($){return this.counted.delete($)}}class by{map=new Map;async run($,Z){let Q=this.map.get($);if(Q)return Q;let Y=Z();this.map.set($,Y);try{return await Y}finally{this.map.delete($)}}}function Vq0($,Z,Q){if(!$)return Q(null);if(!$.withLock)return Q($);return $.withLock(Z,Q)}function V80($){if(!$.orgId||!$.virtualMcpId||!$.branch)throw Error("composeSandboxRef: orgId, virtualMcpId and branch are all required for agent refs");return`agent:${$.orgId}:${$.virtualMcpId}:${$.branch}`}function JV$($){if(!$.startsWith("agent:"))return"";let Z=$.split(":");return Z.length>=4?Z.slice(3).join(":"):""}import{hash as Rs4}from"crypto";function qs4($,Z=16){return Rs4("sha256",pz$($),"hex").slice(0,Z)}function m3($){let Z=qs4($),Q=Ms4(JV$($.projectRef));return Q?`${Q}-${Z}`:`s-${Z}`}function Ms4($){if(!$)return"";let Z=$.split("/").pop()??"",Q="",Y=!1;for(let X of Z.toLowerCase()){let J=X.charCodeAt(0),G=J>=97&&J<=122,W=J>=48&&J<=57;if(!G&&!W){Y||=Q.length>0;continue}if(Y){if(Q.length+1>=GV$)break;Q+="-",Y=!1}if(Q+=X,Q.length===GV$)break}return Q}var GV$=24;var WV$=L(()=>{KZ1()});function kq0($,Z){let Q=$.replace(/\/+$/,"");if(Q.includes("{handle}"))return`${Q.replace("{handle}",Z)}/`;try{let Y=new URL(Q);return Y.hostname=`${Z}.${Y.hostname}`,`${Y.toString()}/`}catch{return`${Q}/${Z}/`}}function Ti($){let Z=$.repo,Q=Z?{repository:{cloneUrl:Z.cloneUrl,repoName:Z.displayName??Is4(Z.cloneUrl),...Z.branch?{branch:Z.branch}:{},submoduleCredentials:Z.submoduleCredentials??[]},repositories:($.extraRepos??[]).filter((K)=>!!K.directoryName).map((K)=>({cloneUrl:K.cloneUrl,repoName:K.directoryName,...K.branch?{branch:K.branch}:{},submoduleCredentials:K.submoduleCredentials??[]})),...Z.userName.trim()||Z.userEmail.trim()?{identity:{userName:Z.userName,userEmail:Z.userEmail}}:{}}:void 0,Y=$.tenant,X=Ai({userName:Y?.userName,userEmail:Y?.userEmail})??void 0,J=$.packageManager?{name:$.packageManager.name,...$.packageManager.path?{path:$.packageManager.path}:{}}:void 0,G=J?{packageManager:J,runtime:$.runtime,...$.port!==void 0?{port:$.port}:{}}:void 0,W=Y?.orgId;if(!Q&&!G&&!X&&$.cloneOnly===void 0&&!W)return null;return{...Q?{git:Q}:{},...X?{operator:X}:{},...W?{orgId:W}:{},...$.cloneOnly!==void 0?{cloneOnly:$.cloneOnly}:{},...G?{application:G}:{}}}function Is4($){try{let Z=new URL($);return Z.pathname.replace(/^\/+/,"").replace(/\.git$/,"")||Z.hostname}catch{return $}}var KV$=L(()=>{HQ1()});function Vs4($){try{return new URL($).username.length>0}catch{return!1}}function k80($){let Z=$.repo?.cloneUrl;if(!Z||!Vs4(Z))return null;return{git:{repository:{cloneUrl:Z}}}}var Ri=L(()=>{WV$();KV$()});async function*UV$($){let Z=$.now??(()=>Date.now()),Q=Z(),Y=$.schedulingTimeoutMs??Ss4,X={pod:{},sandbox:{},events:{hasPulling:!1,hasPulled:!1},startedAt:Q},J=[],G=null,W=!1,K=(E)=>{if(W)return;if(G){let P=G;G=null,P(E)}else J.push(E)},H=()=>{if(J.length>0)return Promise.resolve(J.shift());if(W)return Promise.resolve(null);return new Promise((E)=>{G=E})},F=()=>{if(W)return;if(W=!0,G){let E=G;G=null,E(null)}},U=new AbortController,N=()=>{U.abort(),F()};if($.signal)if($.signal.aborted)U.abort(),F();else $.signal.addEventListener("abort",N,{once:!0});let B=Math.max(0,Y-(Z()-Q)),D=setTimeout(()=>K("tick"),B+100),O,w=new Promise((E)=>{O=E}),j=Promise.allSettled([_s4($.kc,$.namespace,$.claimName,U.signal,X,K,Z,O),bs4($.kc,$.namespace,$.claimName,U.signal,X,K),xs4($.kc,$.namespace,$.claimName,w,U.signal,X,K,Z)]);try{let E=null,P=-1,T=HV$(X,Y,Z);if(E=DQ1(T),!BQ1(T))P=FV$(T);if(yield T,BQ1(T))return;while(!W){if(await H()===null)break;let A=HV$(X,Y,Z);if(BQ1(A)){let _=DQ1(A);if(_!==E)E=_,yield A;return}let q=FV$(A);if(q<P)continue;let x=DQ1(A);if(x!==E)E=x,P=q,yield A}}finally{if(clearTimeout(D),U.abort(),$.signal)$.signal.removeEventListener("abort",N);F(),await j.catch(()=>{})}}async function NV$($,Z=Cs4){let Q=new AbortController,Y="claiming",X,J=()=>{clearTimeout(X),X=setTimeout(()=>Q.abort(),Z)};try{J();for await(let G of $(Q.signal)){if(G.kind==="ready")return;if(G.kind==="failed")throw new NX(G.message);Y=G.kind,J()}}finally{clearTimeout(X),Q.abort()}throw new Wi(`Sandbox did not become ready: no progress for ${Math.round(Z/1000)}s while ${Y}`)}function HV$($,Z,Q){let{pod:Y,sandbox:X,events:J,startedAt:G}=$;if(X.ready)return{kind:"ready"};let W=Y.containerWaitingReason;if(W==="ImagePullBackOff"||W==="ErrImagePull")return{kind:"failed",reason:"image-pull-backoff",message:"Sandbox image failed to download. The cluster may be missing pull credentials or the image tag may not exist."};if(W==="CrashLoopBackOff")return{kind:"failed",reason:"crash-loop-backoff",message:"Sandbox crashed during startup and is now in CrashLoopBackOff. Check pod logs."};if(!Y.scheduled&&J.lastFailedSchedulingAt!==void 0&&Q()-G>Z)return{kind:"failed",reason:"scheduling-timeout",message:J.failedSchedulingMessage??`Pod could not be scheduled within ${Math.round(Z/1000)}s.`};if(Y.containerRunning&&!Y.containerReady)return{kind:"warming-daemon",since:G};if(J.hasPulling&&!J.hasPulled)return{kind:"pulling-image",since:G};if(W==="ContainerCreating"||W==="PodInitializing"||Y.scheduled&&!Y.containerRunning)return{kind:"starting-container",since:G};if(Y.scheduledFalseReason==="Unschedulable"||J.lastFailedSchedulingAt!==void 0&&!Y.scheduled)return{kind:"waiting-for-capacity",since:G,message:J.failedSchedulingMessage??Y.scheduledFalseMessage,nodeClaim:J.nominatedNodeClaim};return{kind:"claiming",since:G}}function BQ1($){return $.kind==="ready"||$.kind==="failed"}function FV$($){switch($.kind){case"claiming":return 0;case"waiting-for-capacity":return 1;case"pulling-image":return 2;case"starting-container":return 3;case"warming-daemon":return 4;case"ready":case"failed":return 99}}function DQ1($){switch($.kind){case"claiming":case"pulling-image":case"starting-container":case"warming-daemon":return $.kind;case"waiting-for-capacity":return`waiting-for-capacity:${$.message??""}:${$.nodeClaim??""}`;case"ready":return"ready";case"failed":return`failed:${$.reason}:${$.message}`}}async function _s4($,Z,Q,Y,X,J,G,W){let K=`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?watch=true&labelSelector=${encodeURIComponent(`${ks4}=${Q}`)}`;return Sq0({kc:$,path:K,signal:Y,label:`pod/${Q}`,onEvent:(H)=>{if(H.type!=="ADDED"&&H.type!=="MODIFIED")return;let F=H.object;if(F.metadata?.name)W(F.metadata.name);vs4(F,X,G),J("pod")}})}function vs4($,Z,Q){let X=($.status?.conditions??[]).find((G)=>G.type==="PodScheduled");if(X?.status==="True")Z.pod.scheduled=!0,Z.pod.scheduledFalseReason=void 0,Z.pod.scheduledFalseMessage=void 0;else if(X?.status==="False")Z.pod.scheduled=!1,Z.pod.scheduledFalseReason=X.reason,Z.pod.scheduledFalseMessage=X.message;let J=($.status?.containerStatuses??[]).find((G)=>G.name===Y7.MAIN_CONTAINER_NAME);if(J)Z.pod.containerWaitingReason=J.state?.waiting?.reason,Z.pod.containerRunning=!!J.state?.running,Z.pod.containerReady=J.ready===!0}async function bs4($,Z,Q,Y,X,J){let G=`/apis/${Y7.CLAIM_API_GROUP}/${Y7.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(Z)}/${Y7.CLAIM_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${Q}`)}`;return Sq0({kc:$,path:G,signal:Y,label:`sandboxclaim/${Q}`,onEvent:(W)=>{if(W.type!=="ADDED"&&W.type!=="MODIFIED")return;let H=W.object.status?.conditions?.find((F)=>F.type==="Ready");if(!H)return;if(H.status==="True")X.sandbox.ready=!0,X.sandbox.notReadyReason=void 0,X.sandbox.notReadyMessage=void 0;else X.sandbox.ready=!1,X.sandbox.notReadyReason=H.reason,X.sandbox.notReadyMessage=H.message;J("sandbox")}})}async function xs4($,Z,Q,Y,X,J,G,W){let K=await Promise.race([Y,new Promise((F)=>{if(X.aborted){F(Q);return}X.addEventListener("abort",()=>F(Q),{once:!0})})]);if(X.aborted)return;let H=`/api/v1/namespaces/${encodeURIComponent(Z)}/events?watch=true&fieldSelector=${encodeURIComponent(`involvedObject.name=${K},involvedObject.kind=Pod`)}`;return Sq0({kc:$,path:H,signal:X,label:`events/${Q}`,onEvent:(F)=>{if(F.type!=="ADDED"&&F.type!=="MODIFIED")return;let U=F.object,N=U.reason;if(!N)return;switch(N){case"Pulling":J.events.hasPulling=!0;break;case"Pulled":J.events.hasPulling=!0,J.events.hasPulled=!0;break;case"FailedScheduling":J.events.lastFailedSchedulingAt=W(),J.events.failedSchedulingMessage=U.message;break;case"Nominated":{let B=U.message?.match(/nodeclaim\/([\w-]+)/);if(B)J.events.nominatedNodeClaim=B[1];break}default:return}G("event")}})}async function BV$($){let{kc:Z,namespace:Q,labelSelector:Y,signal:X,onDelete:J}=$,G=`/apis/${Y7.CLAIM_API_GROUP}/${Y7.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(Q)}/${Y7.CLAIM_PLURAL}?watch=true&labelSelector=${encodeURIComponent(Y)}`;return Sq0({kc:Z,path:G,signal:X,label:"sandboxclaim-reaper",onEvent:(W)=>{if(W.type!=="DELETED")return;let K=W.object.metadata?.name;if(K)J(K)}})}async function Sq0($){let{kc:Z,path:Q,signal:Y,label:X,onEvent:J}=$,G=0;while(!Y.aborted){try{let K=await EK(Z,{method:"GET",path:Q,signal:Y,headers:{accept:"application/json"},stream:!0});if(!K.ok||!K.body){try{await K.body?.cancel()}catch{}if(K.status===401||K.status===403){console.warn(`[lifecycle-watcher] ${X} stopped: watch denied (${K.status} ${K.statusText}). `+"The kubeconfig in use cannot watch SandboxClaims \u2014 if you are running locally, "+"this provider should not be active (check STUDIO_AGENT_SANDBOX_ENABLED).");return}throw Error(`watch handshake failed: ${K.status} ${K.statusText}`)}G=0;for await(let H of R2$(K.body)){if(Y.aborted)return;try{J(H)}catch(F){console.warn(`[lifecycle-watcher] ${X} onEvent threw: ${F instanceof Error?F.message:String(F)}`)}}}catch(K){if(Y.aborted)return;let H=K instanceof Error?K.message:String(K);console.warn(`[lifecycle-watcher] ${X} watch ended: ${H}`)}if(Y.aborted)return;let W=I7(5000,250,G,2,0);G+=1,await F$(W,{signal:Y}).catch(()=>{})}}var ks4="studio.decocms.com/sandbox-handle",Ss4=300000,Cs4=600000;var DV$=L(()=>{r$();J80();WN0()});import{createHash as fs4}from"crypto";import{z as TJ}from"zod";function AK($){let Z;try{Z=new URL($.trim())}catch{return null}if(Z.protocol!=="https:"||Z.search||Z.hash)return null;let Q=Z.pathname.replace(/\/+$/,"").replace(/\.git$/,"").replace(/\/+$/,"");return Q?`https://${Z.host.toLowerCase()}${Q}`:null}function S80($){return AK($)?.toLowerCase()??null}function ls4($){let Z=new Set;for(let Q of $){let Y=`${S80(Q.repoUrl)??Q.repoUrl}#${Q.branch}`;if(Z.has(Y))return Q;Z.add(Y)}return null}function LV$($){return $.reduce((Z,Q)=>Z+Q.replicas,0)}function wV$($,Z){if(Z.warmPoolName)return Z.warmPoolName;let Q=fs4("sha256").update(`${Z.repoUrl}#${Z.branch}`).digest("hex").slice(0,8);return`${$}-${Q}`}function jV$($){return Math.max(0,$.size-LV$($.repos))}function qi($){return $.flatMap((Z)=>Z.repos.map((Q)=>({pool:Z,repo:Q,warmPoolName:wV$(Z.name,Q)})))}function cs4($,Z){return AV$(void 0,$,!0,Z)}function EV$($,{templateName:Z}){let Q=cs4(Z,$.image),Y=(X,J)=>({apiVersion:`${Y7.CLAIM_API_GROUP}/${Y7.CLAIM_API_VERSION}`,kind:"SandboxWarmPool",metadata:{name:X,labels:{[ms4]:$.name}},spec:{replicas:J,updateStrategy:{type:"OnReplenish"},sandboxTemplateRef:{name:Q}}});return[...$.repos.map((X)=>Y(wV$($.name,X),X.replicas)),Y($.name,jV$($))]}function PV$($){return $.tenant?.orgId}function OQ1($,Z){if(!Z.tenant)return null;let Q=$.filter((J)=>J.tenant===Z.tenant&&J.image===Z.image),Y=Z.cloneUrl?S80(Z.cloneUrl):null;if(Y){let J=qi(Q).filter((W)=>S80(W.repo.repoUrl)===Y),G=J.find((W)=>W.repo.branch===Z.branch)??J[0];if(G)return G}let X=Q.find((J)=>jV$(J)>0);return X?{pool:X,repo:null,warmPoolName:X.name}:null}function zV$($,Z,Q){return $?.warmPoolName??(Z?Q:"none")}function AV$($,Z,Q=!1,Y){let X=Y&&Y!=="default"?`-${Y}`:"";return`${Z}${X}${$==="harness-run"||Q?"-medium":""}`}async function wQ1($){let Z=AV$($.purpose,$.templateName,$.tenantPool,$.sandboxImage);if(Z===$.templateName)return{name:Z,probes:$.probes};let Q=$.probes[Z]??null,Y=Q!==null&&$.now-Q.checkedAt<$.ttlMs?Q:{checkedAt:$.now,present:await $.exists(Z)},X={...$.probes,[Z]:Y};if(Y.present)return{name:Z,probes:X};if(Q?.present!==!1)$.onAbsent?.(Z);if($.sandboxImage&&$.sandboxImage!=="default")return wQ1({...$,sandboxImage:void 0,probes:X});return{name:$.templateName,probes:X}}function jQ1($,Z,Q){let Y=S80(Z);if(!Y)return[];let X=Q.replace(/^refs\/heads\//,"");return qi($).filter(({repo:J})=>S80(J.repoUrl)===Y&&J.branch===X)}class EQ1{source;dirty=new Set;pods=new Map;known=new Map;constructor($){this.source=$}pools(){return this.source()}resolve($){return OQ1(this.pools(),$)}markDirty($,Z){let Q=jQ1(this.pools(),$,Z).map((Y)=>Y.warmPoolName);for(let Y of Q)this.dirty.add(Y);return Q}takeDirty($){return this.dirty.delete($)}pod($){return this.pods.get($)}setPod($,Z){this.pods.set($,Z)}retainPods($,Z){for(let[Q,Y]of this.pods)if(Y.pool===$&&!Z.has(Q))this.pods.delete(Q)}retain($){let Z=new Map($.map((Y)=>[Y.warmPoolName,Y])),Q=[...this.known.values()].filter((Y)=>!Z.has(Y.warmPoolName));for(let Y of this.dirty)if(!Z.has(Y))this.dirty.delete(Y);for(let[Y,X]of this.pods)if(!Z.has(X.pool))this.pods.delete(Y);return this.known=Z,Q}}var ys4=54,gs4,hs4=2048,us4,C80,Cq0,LQ1,OV$,ms4="studio.decocms.com/tenant-pool";var _80=L(()=>{t4();J80();gs4=/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/;us4=TJ.object({runtime:TJ.enum(["node","bun","deno"]).default("node"),packageManager:TJ.enum(["npm","pnpm","yarn","bun","deno"]).optional(),packageManagerPath:TJ.string().optional(),devPort:TJ.number().int().positive().optional()}).default({runtime:"node"}),C80=TJ.object({repoUrl:TJ.string().max(hs4).transform(($,Z)=>{let Q=AK($);if(Q)return Q;return Z.addIssue({code:"custom",message:"repoUrl must be an https clone URL"}),TJ.NEVER}),branch:TJ.string().min(1).default("main"),workload:us4,replicas:TJ.number().int().min(1)});Cq0=class Cq0 extends Error{poolName;size;allocated;constructor($,Z,Q){super(`pool ${$}: repos take ${Q} replicas, more than its size ${Z}`);this.poolName=$;this.size=Z;this.allocated=Q;this.name="TenantPoolCapacityError"}};LQ1=TJ.object({name:TJ.string().max(ys4).regex(gs4,"pool name must be a DNS label (lowercase alphanumeric and '-')"),tenant:TJ.string().min(1).max(512),size:TJ.number().int().min(1),image:FN.default("default")}),OV$=LQ1.extend({repos:TJ.array(C80).default([])}).superRefine(($,Z)=>{let Q=ls4($.repos);if(Q)Z.addIssue({code:"custom",path:["repos"],message:`duplicate repo allocation ${Q.repoUrl}#${Q.branch}`});let Y=LV$($.repos);if(Y>$.size)Z.addIssue({code:"custom",path:["repos"],message:new Cq0($.name,$.size,Y).message})})});async function TV$($,Z,Q){let Y=new Map;for(let X of $){let J=Z(X);if(!J)continue;let G=Y.get(J);if(G)G.push(X);else Y.set(J,[X])}await Promise.allSettled([...Y.values()].map(async(X)=>{for(let J of X)await Q(J).catch(()=>{})}))}function ds4($){try{let Z=new URL($);if(Z.hostname.toLowerCase()!=="github.com")return null;let[Q,Y]=Z.pathname.replace(/^\/+/,"").split("/"),X=Y?.replace(/\.git$/,"");return Q&&X?`${Q}/${X}`.toLowerCase():null}catch{return null}}function RV$($){if($.repositoryId)return{repositoryId:$.repositoryId};let Z=$.connectionId?ds4($.cloneUrl):null;return $.connectionId&&Z?{connectionId:$.connectionId,repo:Z}:null}var qV$=L(()=>{_80()});async function Mi($,Z,Q,Y){let X=(G)=>Mq0(G.url,G.token,Z,Q),J=!(Q.body instanceof ReadableStream);try{let G=await X($);if(G.status!==401||!J)return G;let W=await Y.unauthorized();if(!W)return G;return await G.body?.cancel().catch(()=>{}),await X(W)}catch(G){if(!J)throw G;let W=await Y.unreachable();if(!W)throw G;return X(W)}}var _q0=L(()=>{vy()});function VV$($,Z){return new Response(JSON.stringify(Z),{status:$,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function MV$($){let Z=new Headers;for(let[Q,Y]of $.headers.entries())if(!ps4.includes(Q.toLowerCase()))Z.set(Q,Y);return new Response($.body,{status:$.status,statusText:$.statusText,headers:Z})}function IV$($,Z){let Q=VV$($,{error:Z});return Q.headers.set("x-sandbox-preview-not-ready","1"),Q}async function Vi($,Z,Q){let Y=await Z.base();if(!Y)return IV$(404,"sandbox not found");let X=new URL($.url);if((X.pathname==="/_sandbox"||X.pathname.startsWith("/_sandbox/"))&&$.method!=="GET")return VV$(404,{error:"not found"});let G=(F)=>`${F}${X.pathname}${X.search}`,W=new Headers($.headers);for(let F of is4)W.delete(F);let K=$.method!=="GET"&&$.method!=="HEAD",H={method:$.method,headers:W,body:K?$.body:void 0,redirect:"manual",signal:$.signal,duplex:K?"half":void 0};try{return MV$(await fetch(G(Y),H))}catch(F){let U=`${Y}${X.pathname}`;if(console.warn(`[${Q}] preview fetch to ${U} failed: ${F instanceof Error?F.message:String(F)}`),Z.invalidate(),$.method==="GET"||$.method==="HEAD"){let N=await Z.retryBase();if(N)try{return MV$(await fetch(G(N),H))}catch(B){console.warn(`[${Q}] preview fetch retry to ${U} failed: ${B instanceof Error?B.message:String(B)}`)}}return IV$(502,"sandbox daemon unreachable")}}var Ii="x-sandbox-preview-not-ready",is4,ps4;var vq0=L(()=>{is4=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length","upgrade"],ps4=["connection","keep-alive","transfer-encoding","content-encoding","content-length"]});import{createHash as ns4,randomBytes as ts4,randomUUID as kV$}from"crypto";import*as fV$ from"net";import{PassThrough as os4}from"stream";function SV$($){if($ instanceof Error)return $.message;if($&&typeof $==="object"){let Z=$;if(Z.error instanceof Error)return Z.error.message;if(typeof Z.message==="string"&&Z.message)return Z.message}return String($)}function vV$($){return{pool:$.warmPoolName,org:$.pool.tenant}}class MQ1{records=new Map;inflight=new by;activeGauge=new Iq0;stateStore;previewUrlPattern;kubeConfig;capacityProbe;portForward;namespace;sandboxTemplateName;envName;tokenGenerator;idleTtlMs;metrics;previewGateway;sentinelToken;mintCloneUrl;mintPoolCloneUrl;mintOrgFsConfig;forwardPort;daemonAddress;persistCredentials;tenantPools;tenantPoolRefreshMs;templateProbes={};closed=!1;claimWatchAbort=new AbortController;constructor($={}){this.stateStore=$.stateStore??null,this.previewUrlPattern=$.previewUrlPattern??null,this.kubeConfig=$.kubeConfig??Kr4(),this.portForward=new p71(this.kubeConfig),this.namespace=$.namespace??ss4,this.sandboxTemplateName=$.sandboxTemplateName??rs4,this.envName=Br4($.envName),this.tokenGenerator=$.tokenGenerator??(()=>ts4(es4).toString("hex")),this.idleTtlMs=$.idleTtlMs??Zr4,this.metrics=$.meter?Wr4($.meter):null,this.previewGateway=$.previewGateway&&$.previewUrlPattern?{...$.previewGateway}:null;let Z=$.sentinelToken?.trim()??"";this.sentinelToken=Z.length>0?Z:null,this.mintCloneUrl=$.mintCloneUrl,this.mintPoolCloneUrl=$.mintPoolCloneUrl,this.mintOrgFsConfig=$.mintOrgFsConfig,this.forwardPort=$.forwardPort,this.daemonAddress=$.daemonAddress??"forward",this.persistCredentials=$.persistCredentials??!0;let Q=$.tenantPools;if(this.tenantPools=this.sentinelToken===null?null:new EQ1(typeof Q==="function"?Q:()=>Q??[]),this.sentinelToken===null&&(typeof Q==="function"||(Q?.length??0)>0))console.warn(`[${I6}] tenant pools configured without a sentinel token \u2014 ignoring them (warm-pool mode is off)`);this.tenantPoolRefreshMs=$.tenantPoolRefreshMs??Yr4,this.startClaimReaper(),this.startCredentialRefresher(),this.startTenantPoolReconciler()}startClaimReaper(){let $=["app.kubernetes.io/managed-by=studio","app.kubernetes.io/name=studio-sandbox",...this.envName?[`${RJ.env}=${this.envName}`]:[]].join(",");BV$({kc:this.kubeConfig,namespace:this.namespace,labelSelector:$,signal:this.claimWatchAbort.signal,onDelete:(Z)=>this.invalidateRecord(Z)})}async ensure($,Z={}){let Q=m3($);if(Q.startsWith("s-"))throw Error(`ensure: projectRef has no slug source: ${$.projectRef}`);return this.inflight.run(Q,()=>Vq0(this.stateStore,$,(Y)=>this.ensureLocked($,Q,Z,Y)))}async delete($){let Z=await this.getRecord($);if(this.records.delete($),Z)this.dropRecord(Z);if(await this.deleteHttpRouteIfManaged($).catch((Q)=>{console.warn(`[${I6}] HTTPRoute delete failed for ${$}: ${Q instanceof Error?Q.message:String(Q)}`)}),await JR(this.kubeConfig,this.namespace,$),this.stateStore)if(Z)await this.stateStore.delete(Z.id);else await this.stateStore.deleteByHandle($)}lastTermination($){return L2$(this.kubeConfig,this.namespace,RJ.sandboxHandle,$,Y7.MAIN_CONTAINER_NAME)}async alive($){return await OL(this.kubeConfig,this.namespace,$)!==void 0}watchClaimLifecycle($,Z){return UV$({kc:this.kubeConfig,namespace:this.namespace,claimName:$,signal:Z})}hasSchedulableCapacity(){return this.capacityProbe??=M2$(this.kubeConfig,this.namespace),this.capacityProbe()}async getPreviewUrl($){let Z=await this.getRecord($);if(!Z)return null;return this.composePreviewUrl(Z)}async proxyDaemonRequest($,Z,Q){let Y=await this.getRecord($);if(!Y&&this.previewUrlPattern&&this.stateStore){let K=await this.stateStore.getByHandle($),H=K?.state,F=H?.token;if(K&&F){let N=`http://${H?.adoptedSandboxName??$}.${this.namespace}.svc.cluster.local:${vN}`;try{let B=await Mq0(N,F,Z,Q);if(B.status!==404)return B;try{await B.body?.cancel()}catch{}}catch{}}}if(!Y)Y=await this.resurrectByHandle($);if(!Y)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let X=Y,J=performance.now(),G=0,W=(K)=>{return X=K,{url:K.daemonUrl,token:K.token}};try{let K=await Mi(W(Y),Z,Q,{unauthorized:async()=>{this.invalidateRecord($);let H=await this.getRecord($).catch(()=>null)??await this.resurrectByHandle($).catch(()=>null);return H?W(H):null},unreachable:async()=>{this.invalidateRecord($);let H=await this.resurrectByHandle($)??await this.getRecord($).catch(()=>null);return H?W(H):null}});return G=K.status,K}finally{this.recordProxyDuration("daemon",G,X,performance.now()-J)}}async adoptLiveClaim($,Z){if(this.records.has(Z))return!0;let Q=await OL(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!Q||Q.metadata?.deletionTimestamp)return!1;return await this.inflight.run(Z,async()=>{let X=this.records.get(Z);if(X)return this.toSandbox(X);let J=await this.adopt($,Z,Q);if(!J)throw Error(`cannot adopt live claim ${Z}`);return Vq0(this.stateStore,$,(G)=>this.finish(J,G,!0,!0,"adopt"))}).catch(()=>null)!=null}async resolvePreviewUpstreamUrl($){if(this.previewUrlPattern)return`http://${await this.resolveServiceNameForHandle($)}.${this.namespace}.svc.cluster.local:${vN}`;let Z=await this.getRecord($);if(Z)return Z.daemonUrl;let Q=await this.resurrectByHandle($);return Q?Q.daemonUrl:null}async daemonEndpoint($){let Z=await this.getRecord($)??await this.resurrectByHandle($);if(!Z)return null;return{url:this.daemonAddress==="service"?`http://${Z.adoptedSandboxName}.${this.namespace}.svc.cluster.local:${vN}`:Z.daemonUrl,token:Z.token}}listSandboxes(){return[...this.records.values()].map(($)=>{let Z=$.ensureOpts,Q=Z?.tenant;return{handle:$.handle,tenant:Q?{orgId:Q.orgId,userId:Q.userId}:null,repos:[Z?.repo,...Z?.extraRepos??[]].filter((Y)=>Y!==void 0).map(RV$).filter((Y)=>Y!==null),orgFs:Boolean(Z?.orgFsConfigJson)||$.orgFsRedacted===!0}})}async resolveServiceNameForHandle($){let Z=this.records.get($);if(Z)return Z.adoptedSandboxName;if(this.stateStore){let Y=(await this.stateStore.getByHandle($).catch(()=>null))?.state?.adoptedSandboxName;if(Y)return Y}return $}async proxyPreviewRequest($,Z){let Q=performance.now(),Y=this.records.get($)??null,X=0;try{let J=await Vi(Z,{base:()=>this.resolvePreviewUpstreamUrl($),invalidate:()=>this.invalidateRecord($),retryBase:async()=>{return await this.resurrectByHandle($).catch(()=>null)?this.resolvePreviewUpstreamUrl($):null}},I6);return X=J.status,J}finally{this.recordProxyDuration("preview",X,Y,performance.now()-Q,$)}}async ensureLocked($,Z,Q,Y){if(Q.image)console.warn(`[${I6}] opts.image ignored (template ${this.sandboxTemplateName} pins image): got ${Q.image}`);if(Y){let G=await Y.get($);if(G){let W=await this.rehydrate($,Z,G);if(W)return await this.refreshDaemonGitCredential(W,Q),await this.relayOrgFsConfig(W.daemonUrl,W.token,Q.orgFsConfigJson),this.finish(W,Y,!1,!0,"resume");await Y.delete($)}}let X=await OL(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(X)if(X.metadata?.deletionTimestamp)await K80(this.kubeConfig,this.namespace,Z).catch((G)=>{console.warn(`[${I6}] wait for terminating claim ${Z} failed: ${G instanceof Error?G.message:String(G)}`)});else if(!PQ1(X)){let G=await this.join($,Z,Q,X).catch((W)=>{return console.warn(`[${I6}] join of starting claim ${Z} failed, recreating: ${W instanceof Error?W.message:String(W)}`),null});if(G)return this.finish(G,Y,!0,!0,"adopt");await JR(this.kubeConfig,this.namespace,Z).catch(()=>{}),await K80(this.kubeConfig,this.namespace,Z).catch((W)=>{console.warn(`[${I6}] wait for deleted claim ${Z} failed: ${W instanceof Error?W.message:String(W)}`)})}else{let G=await this.adopt($,Z,X).catch((W)=>{return console.warn(`[${I6}] adopt ${Z} failed, recreating: ${W instanceof Error?W.message:String(W)}`),null});if(G)return await this.refreshDaemonGitCredential(G,Q),await this.relayOrgFsConfig(G.daemonUrl,G.token,Q.orgFsConfigJson),this.finish(G,Y,!0,!0,"adopt");await JR(this.kubeConfig,this.namespace,Z).catch(()=>{}),await K80(this.kubeConfig,this.namespace,Z).catch((W)=>{console.warn(`[${I6}] wait for deleted claim ${Z} failed: ${W instanceof Error?W.message:String(W)}`)})}let J=await this.provision($,Z,Q);return this.finish(J,Y,!0,!1,"fresh")}async finish($,Z,Q,Y,X){let J=this.records.get($.handle),G=J!==void 0;if(J&&J.daemonForward!==$.daemonForward)this.closeForwarder(J.daemonForward);if(this.records.set($.handle,$),Q)await this.persist(Z,$);if(Y)await GN0(this.kubeConfig,this.namespace,$.handle,this.computeShutdownTime()).catch((W)=>console.warn(`[${I6}] TTL refresh failed for ${$.handle}: ${W instanceof Error?W.message:String(W)}`));if(this.metrics){let W=TQ1($.tenant);if(this.metrics.ensureOutcome.add(1,{...W,outcome:X}),!G)this.metrics.active.add(1,W),this.activeGauge.markCounted($.handle)}return this.toSandbox($)}buildEnvMap($,Z){let Q={},Y=[];for(let[X,J]of Object.entries($.env??{}))if($r4.has(X))Y.push(X);else Q[X]=J;if(Y.length>0)console.warn(`[${I6}] opts.env keys overlap reserved bootstrap names and were dropped: ${Y.join(",")}`);return{...Q,DAEMON_TOKEN:Z.token,DAEMON_BOOT_ID:Z.daemonBootId,APP_ROOT:Z.workdir,PROXY_PORT:String(vN)}}async resolveTemplateName($,Z,Q){let{name:Y,probes:X}=await wQ1({purpose:$,tenantPool:Z,...Q?{sandboxImage:Q}:{},templateName:this.sandboxTemplateName,probes:this.templateProbes,now:Date.now(),ttlMs:as4,exists:(J)=>U2$(this.kubeConfig,this.namespace,J),onAbsent:(J)=>console.warn(`[${I6}] SandboxTemplate ${J} not found (or not readable) \u2014 this claim falls back to a template without that suffix. Upgrade the sandbox-env chart to the version that renders it.`)});return this.templateProbes=X,Y}buildClaim($,Z,Q,Y,X){let J=this.sentinelToken!==null,G=J?[]:Object.entries(this.buildEnvMap(Z,Q)).sort(([H],[F])=>H<F?-1:H>F?1:0).map(([H,F])=>({name:H,value:F})),W=Or4(Z),K=Object.keys(W).length>0;return{apiVersion:`${Y7.CLAIM_API_GROUP}/${Y7.CLAIM_API_VERSION}`,kind:"SandboxClaim",metadata:{name:$,namespace:this.namespace,labels:{"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[RJ.env]:this.envName}:{},...AQ1(Z.tenant)},...K?{annotations:W}:{}},spec:{sandboxTemplateRef:{name:X},additionalPodMetadata:{labels:AQ1(Z.tenant,{[RJ.role]:"claimed",[RJ.sandboxHandle]:$,...this.envName?{[RJ.env]:this.envName}:{}}),...K?{annotations:W}:{}},env:G,warmpool:zV$(Y,J,X),lifecycle:{shutdownPolicy:"Delete",shutdownTime:this.computeShutdownTime()}}}}async provision($,Z,Q){let Y=this.tokenGenerator(),X=kV$(),J=bq0,G=this.claimTenantPoolBinding(Q),W=this.buildClaim(Z,Q,{token:Y,daemonBootId:X,workdir:J},G,await this.resolveTemplateName(Q.purpose,G!==null,Q.sandboxImage));try{await BZ1(this.kubeConfig,this.namespace,W)}catch(K){if(K instanceof X80)await K80(this.kubeConfig,this.namespace,Z),await BZ1(this.kubeConfig,this.namespace,W);else throw K}return this.bind($,Z,Q,G,{token:Y,daemonBootId:X,workdir:J})}claimTenantPoolBinding($){return this.tenantPools?.resolve({tenant:PV$($),image:$.sandboxImage??"default",cloneUrl:$.repo?.cloneUrl,branch:$.repo?.branch})??null}async bind($,Z,Q,Y,{token:X,daemonBootId:J,workdir:G}){let W;try{W=await N2$(this.kubeConfig,this.namespace,Z),await NV$((B)=>this.watchClaimLifecycle(Z,B))}catch(B){throw await JR(this.kubeConfig,this.namespace,Z).catch(()=>{}),B}try{await this.ensureServicePortForAdoptedSandbox(W),await this.ensureHttpRouteForHandle(Z,W,Q.tenant??null)}catch(B){throw await JR(this.kubeConfig,this.namespace,Z).catch(()=>{}),B}let K=await this.openForwarder(W,vN,Z),H=`http://127.0.0.1:${K.localPort}`,F=Y?.repo!=null&&W!==Z,U=this.workloadConfigPayload(Q,F),N=J;try{if(await NQ1(H),this.sentinelToken!==null){let B=await qq0(H);if(B)N=B.bootId;try{await zK(H,this.sentinelToken,U??{},{rotateToken:X})}catch(D){if(D instanceof AJ&&D.status===401)console.warn(`[${I6}] sentinel rejected by adopted pod (handle=${Z}, sandbox=${W}): pod belongs to another claim; tearing down and reprovisioning`);throw D}}else if(U)await zK(H,X,U);await this.relayOrgFsConfig(H,X,Q.orgFsConfigJson)}catch(B){throw this.closeForwarder(K),await this.deleteHttpRouteIfManaged(Z).catch(()=>{}),await JR(this.kubeConfig,this.namespace,Z).catch(()=>{}),B}return{id:$,handle:Z,adoptedSandboxName:W,token:X,workdir:G,daemonUrl:H,daemonForward:K,workload:Q.workload??null,daemonBootId:N,tenant:Q.tenant??null,tenantPoolPodBound:F,ensureOpts:Ar4(Q)}}workloadConfigPayload($,Z){return Ti({runtime:$?.workload?.runtime??"node",packageManager:$?.workload?.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:$?.repo??null,extraRepos:$?.extraRepos??[],port:$?.workload?.devPort??CV$,tenant:$?.tenant??void 0,...$?{cloneOnly:$.cloneOnly===!0&&!Z}:{}})}async relayOrgFsConfig($,Z,Q){if(!Q)return;await I80($,Z,Q).catch((Y)=>console.warn("[org-fs] sidecar config relay failed",Y))}async refreshDaemonGitCredential($,Z){let Q=k80(Z);if(!Q)return;try{await zK($.daemonUrl,$.token,Q)}catch(Y){console.warn(`[${I6}] git credential refresh failed for ${$.handle}: ${Y instanceof Error?Y.message:String(Y)}`)}}async withFreshCloneUrl($,Z={}){if(!this.mintCloneUrl)return $;try{let Q=await this.mintCloneUrl($,Z);if(!Q)return $;let{credentialExpiresAt:Y,...X}=$;return{...X,cloneUrl:Q}}catch(Q){return console.warn(`[${I6}] clone credential re-mint failed: ${Q instanceof Error?Q.message:String(Q)}`),$}}async withFreshCredentials($,Z=!1){return{...$,...$.repo?{repo:await this.withFreshCloneUrl($.repo,{tenant:$.tenant})}:{},...$.orgFsConfigJson||Z?{orgFsConfigJson:await Pr4($,this.mintOrgFsConfig)}:{}}}startCredentialRefresher(){if(!this.mintCloneUrl)return;let{signal:$}=this.claimWatchAbort;(async()=>{while(!$.aborted){if(await F$(Xr4,{signal:$}).catch(()=>{}),$.aborted)break;try{await this.refreshAllGitCredentials()}catch(Z){console.warn(`[${I6}] periodic credential refresh failed: ${Z instanceof Error?Z.message:String(Z)}`)}}})()}startTenantPoolReconciler(){let $=this.tenantPools;if(!$)return;let{signal:Z}=this.claimWatchAbort;(async()=>{while(!Z.aborted){try{await this.reconcileTenantPools($)}catch(Q){console.warn(`[${I6}] tenant pool reconcile failed: ${Q instanceof Error?Q.message:String(Q)}`)}await F$(Qr4,{signal:Z}).catch(()=>{})}})()}listTenantPools(){return this.tenantPools?.pools()??[]}markTenantPoolsDirty($,Z){return Promise.resolve(this.tenantPools?.markDirty($,Z)??[])}async reconcileTenantPools($){let Z=qi($.pools());for(let Q of $.retain(Z))this.recordPoolGone(Q);for(let Q of Z){let Y=Q.warmPoolName,X=await B2$(this.kubeConfig,this.namespace,Y);if(X===null){console.warn(`[${I6}] tenant pool ${Y}: no SandboxWarmPool (or no selector yet) in ${this.namespace}`);continue}let J=$.takeDirty(Y),G=X.filter((W)=>!W.labels[RJ.sandboxHandle]);$.retainPods(Y,new Set(X.map((W)=>W.uid)));for(let W of G){if(this.claimWatchAbort.signal.aborted)return;await this.warmPoolPod($,Q,W,J)}this.recordPoolDepth($,Q,X,G)}}recordPoolGone($){let Z=vV$($);for(let Q of["ready","bound","pending","failed"])this.metrics?.poolPods.record(0,{...Z,state:Q})}recordPoolDepth($,Z,Q,Y){let X=this.metrics?.poolPods;if(!X)return;let J=0,G=0;for(let K of Y){let H=$.pod(K.uid);if(!H)continue;if(H.failures>=xq0)G++;else if(H.lastConfigAt>0)J++}let W=vV$(Z);X.record(J,{...W,state:"ready"}),X.record(Q.length-Y.length,{...W,state:"bound"}),X.record(Y.length-J-G,{...W,state:"pending"}),X.record(G,{...W,state:"failed"})}async warmPoolPod($,Z,Q,Y){let X=Z.warmPoolName,{workload:J}=Z.repo,G=$.pod(Q.uid);if(G&&G.failures>=xq0){if(Date.now()-G.lastFailureAt<_V$)return;$.setPod(Q.uid,{...G,failures:0})}let W=Y||G!==void 0&&Date.now()-G.lastConfigAt>=this.tenantPoolRefreshMs;if(G&&!W)return;let K=await this.allocationCloneUrl(Z);if(!K){this.recordPoolFailure($,Q,X,"clone credential mint failed");return}let H={cloneUrl:K,branch:Z.repo.branch,userName:"",userEmail:""},F=await this.openForwarder(Q.name,vN,Q.name).catch(()=>null);if(!F){this.recordPoolFailure($,Q,X,"port-forward failed");return}let U=`http://127.0.0.1:${F.localPort}`;try{await NQ1(U);let N=this.sentinelToken;if(!N)return;if(!await this.isPoolPodUnbound(Q))return;let B=Ti({runtime:J.runtime,packageManager:J.packageManager?{name:J.packageManager,...J.packageManagerPath?{path:J.packageManagerPath}:{}}:null,repo:H,port:J.devPort??CV$})??{},{transition:D}=await zK(U,N,B);if(W&&D!=="bootstrap"&&await this.isPoolPodUnbound(Q))await YV$(U,N,"clone");$.setPod(Q.uid,{pool:X,lastConfigAt:Date.now(),lastFailureAt:0,failures:0}),console.log(`[${I6}] tenant pool ${X}: warmed ${Q.name} (${D})`)}catch(N){this.recordPoolFailure($,Q,X,N instanceof Error?N.message:String(N))}finally{this.closeForwarder(F)}}async allocationCloneUrl({pool:$,repo:Z}){if(!this.mintPoolCloneUrl)return`${Z.repoUrl}.git`;try{return await this.mintPoolCloneUrl({tenant:$.tenant,repoUrl:Z.repoUrl,branch:Z.branch})}catch(Q){return console.warn(`[${I6}] tenant pool clone credential mint failed: ${Q instanceof Error?Q.message:String(Q)}`),null}}isPoolPodUnbound($){return D2$(this.kubeConfig,this.namespace,$.name,RJ.sandboxHandle)}recordPoolFailure($,Z,Q,Y){let X=$.pod(Z.uid),J=(X?.failures??0)+1;$.setPod(Z.uid,{pool:Q,lastConfigAt:X?.lastConfigAt??0,lastFailureAt:Date.now(),failures:J});let G=J>=xq0?` \u2014 backing off ${_V$/60000}min`:"";console.warn(`[${I6}] tenant pool ${Q}: warming ${Z.name} failed (${J}/${xq0})${G}: ${Y}`)}async refreshAllGitCredentials(){await TV$(this.records.values(),($)=>$.ensureOpts?.repo?.connectionId,async($)=>{if(this.claimWatchAbort.signal.aborted)return;let Z=$.ensureOpts?.repo;if(!Z)return;try{let Q=await this.withFreshCloneUrl(Z,{bufferMs:Jr4,tenant:$.ensureOpts?.tenant});await this.refreshDaemonGitCredential($,{...$.ensureOpts,repo:Q}),$.ensureOpts={...$.ensureOpts,repo:Q}}catch(Q){throw console.warn(`[${I6}] git credential refresh failed for ${$.handle}: ${Q instanceof Error?Q.message:String(Q)}`),Q}})}async rebootstrapDaemon($,Z,Q){if(this.sentinelToken===null)return!1;let Y=this.workloadConfigPayload(Q,!1)??{};try{return await zK($,this.sentinelToken,Y,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,Q?.orgFsConfigJson),!0}catch(X){if(X instanceof AJ&&X.status===401)try{return await zK($,Z,Y,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,Q?.orgFsConfigJson),!0}catch(J){return console.warn(`[${I6}] re-bootstrap retry with claim token failed: ${J instanceof Error?J.message:String(J)}`),!1}return console.warn(`[${I6}] re-bootstrap failed: ${X instanceof Error?X.message:String(X)}`),!1}}async ensureServicePortForAdoptedSandbox($){if(!this.previewGateway||!this.previewUrlPattern)return;await T2$(this.kubeConfig,this.namespace,$,{name:"daemon",port:vN,targetPort:vN})}async ensureHttpRouteForHandle($,Z,Q){if(!this.previewGateway||!this.previewUrlPattern)return;let Y=Tr4(this.previewUrlPattern,$);if(!Y)throw new NX(`Unable to derive preview hostname for ${$} from pattern: ${this.previewUrlPattern}`);let X={apiVersion:`${LZ1.API_GROUP}/${LZ1.API_VERSION}`,kind:"HTTPRoute",metadata:{name:$,namespace:this.namespace,labels:AQ1(Q??void 0,{[RJ.role]:"claimed",[RJ.sandboxHandle]:$,"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[RJ.env]:this.envName}:{}})},spec:{parentRefs:[{kind:"Gateway",group:"gateway.networking.k8s.io",name:this.previewGateway.name,namespace:this.previewGateway.namespace}],hostnames:[Y],rules:[{backendRefs:[{group:"",kind:"Service",name:Z,port:vN}]}]}};await P2$(this.kubeConfig,this.namespace,X)}async deleteHttpRouteIfManaged($){if(!this.previewGateway)return;await z2$(this.kubeConfig,this.namespace,$)}async rehydrate($,Z,Q){let Y=Q.state;if(!Y.adoptedSandboxName&&!Y.podName||!Y.token)return null;let X=await OL(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!X||!PQ1(X))return null;let J=X.status?.sandbox?.name??Y.adoptedSandboxName??Y.podName??Z,G=await this.openAndProbeDaemon(J,Z);if(!G)return null;if(Y.daemonBootId&&Y.daemonBootId!==G.bootId){if(this.sentinelToken!==null){let W=Y.ensureOpts?await this.withFreshCredentials(Y.ensureOpts,Y.orgFsRedacted===!0):null;if(!await this.rebootstrapDaemon(G.daemonUrl,Y.token,W))return this.closeForwarder(G.daemonForward),null}else console.warn(`[${I6}] daemon restart detected (handle=${Z}): stored bootId=${Y.daemonBootId} live bootId=${G.bootId}`);await this.stateStore?.put($,{handle:Z,state:{...Y,daemonBootId:G.bootId}}).catch((W)=>console.warn(`[${I6}] bootId persist failed for ${Z}: ${W instanceof Error?W.message:String(W)}`))}return{id:$,handle:Z,adoptedSandboxName:J,tenantPoolPodBound:!1,token:Y.token,workdir:Y.workdir??bq0,daemonUrl:G.daemonUrl,daemonForward:G.daemonForward,workload:Y.workload??null,daemonBootId:G.bootId,tenant:Y.tenant??null,ensureOpts:Y.ensureOpts??null,orgFsRedacted:Y.orgFsRedacted===!0}}join($,Z,Q,Y){let X=this.sentinelToken!==null,J=X?this.tokenGenerator():zQ1(Y,"DAEMON_TOKEN"),G=X?kV$():zQ1(Y,"DAEMON_BOOT_ID");if(!J||!G)throw new NX(`claim ${Z} carries no daemon token`);return this.bind($,Z,Q,this.claimTenantPoolBinding(Q),{token:J,daemonBootId:G,workdir:bq0})}async adopt($,Z,Q){if(!PQ1(Q))return null;let Y=Q.status?.sandbox?.name??Z;if(this.sentinelToken!==null)return null;let X=zQ1(Q,"DAEMON_TOKEN");if(!X)return null;let J=await this.openAndProbeDaemon(Y,Z);if(!J)return null;let G=wr4(Q);if(this.previewGateway)await this.ensureServicePortForAdoptedSandbox(Y).catch((W)=>{console.warn(`[${I6}] Service port backfill failed for ${Z}: ${W instanceof Error?W.message:String(W)}`)}),await this.ensureHttpRouteForHandle(Z,Y,G).catch((W)=>{console.warn(`[${I6}] HTTPRoute backfill failed for ${Z}: ${W instanceof Error?W.message:String(W)}`)});return{id:$,handle:Z,adoptedSandboxName:Y,tenantPoolPodBound:!1,token:X,workdir:bq0,daemonUrl:J.daemonUrl,daemonForward:J.daemonForward,workload:null,daemonBootId:J.bootId,tenant:G,ensureOpts:null}}async openAndProbeDaemon($,Z){let Q=await this.openForwarder($,vN,Z).catch(()=>null);if(!Q)return null;let Y=`http://127.0.0.1:${Q.localPort}`,X=await qq0(Y);if(!X)return this.closeForwarder(Q),null;return{daemonForward:Q,daemonUrl:Y,bootId:X.bootId}}async getRecord($){let Z=this.records.get($);if(Z)return Z;if(!this.stateStore)return null;let Q=await this.stateStore.getByHandle($);if(!Q)return null;let Y=await this.rehydrate(Q.id,$,Q);if(Y)this.records.set($,Y);return Y}async resurrectByHandle($){if(!this.stateStore)return null;let Z=await this.stateStore.getByHandle($);if(!Z)return null;let Q=Z.state,Y=Q.ensureOpts;if(!Y)return null;let X=await this.withFreshCredentials(Y,Q.orgFsRedacted===!0);if(m3(Z.id)!==$)return null;return await this.ensure(Z.id,X),this.records.get($)??null}invalidateRecord($){let Z=this.records.get($);if(!Z)return;this.records.delete($),this.dropRecord(Z)}dropRecord($){if(this.closeForwarder($.daemonForward),this.metrics&&this.activeGauge.consume($.handle))this.metrics.active.add(-1,TQ1($.tenant))}recordProxyDuration($,Z,Q,Y,X){if(!this.metrics)return;this.metrics.proxyDurationMs.record(Y,{...TQ1(Q?.tenant??null),source:$,sandbox_handle:Q?.handle??X??"",status_code:Z||0})}composePreviewUrl($){if(this.previewUrlPattern)return kq0(this.previewUrlPattern,$.handle);return`http://127.0.0.1:${$.daemonForward.localPort}/`}toSandbox($){return{handle:$.handle,workdir:$.workdir,previewUrl:this.composePreviewUrl($),warmPoolAdopted:$.tenantPoolPodBound===!0,provider:"kubernetes"}}async persist($,Z){if(!$)return;let Q={adoptedSandboxName:Z.adoptedSandboxName,token:Z.token,workdir:Z.workdir,workload:Z.workload,daemonBootId:Z.daemonBootId,tenant:Z.tenant,...Z.ensureOpts?this.persistCredentials?{ensureOpts:Z.ensureOpts}:zr4(Z.ensureOpts,Z.orgFsRedacted===!0):{}};await $.put(Z.id,{handle:Z.handle,state:Q})}computeShutdownTime(){return new Date(Date.now()+this.idleTtlMs).toISOString()}async releaseAfter($,Z){let Q=await OL(this.kubeConfig,this.namespace,$);if(!Q)return;let Y=jr4(Q.spec?.lifecycle?.shutdownTime,new Date(Date.now()+Z));if(!Y)return;await GN0(this.kubeConfig,this.namespace,$,Y).catch((X)=>console.warn(`[${I6}] release failed for ${$}: ${X instanceof Error?X.message:String(X)}`))}async renewTtl($){let Z=await OL(this.kubeConfig,this.namespace,$);if(!Z)return;let Q=Er4(Z.spec?.lifecycle?.shutdownTime,new Date(Date.now()+this.idleTtlMs));if(!Q)return;await GN0(this.kubeConfig,this.namespace,$,Q).catch((Y)=>console.warn(`[${I6}] TTL renew failed for ${$}: ${Y instanceof Error?Y.message:String(Y)}`))}openForwarder($,Z,Q=$){if(this.forwardPort)return this.forwardPort($,Z,Q);let Y=Hr4(Q,Z);return new Promise((X,J)=>{let G=(W,K)=>{let H=fV$.createServer((F)=>this.handleForwardedConnection(F,$,Z,Q));H.once("error",(F)=>{if(F.code==="EADDRINUSE"&&K<Gr4){try{H.close()}catch{}let U=RQ1+(W-RQ1+1)%yV$;G(U,K+1);return}J(F)}),H.listen(W,"127.0.0.1",()=>{let F=H.address();if(!F||typeof F==="string"){H.close(),J(Error("port-forward listener failed to bind"));return}let U=F.port;X({localPort:U,close:()=>H.close((N)=>{if(N)console.warn(`[${I6}] port-forward close on :${U} errored: ${N.message}`)})})})};G(Y,0)})}handleForwardedConnection($,Z,Q,Y){let X=new os4,J=null,G=!1,W=()=>{if(G)return;if(G=!0,X.destroy(),J)try{J.close()}catch{}if(!$.destroyed)$.destroy()};$.pipe(X),$.on("error",W),$.on("close",W),this.portForward.portForward(this.namespace,Z,[Q],$,null,X).then((K)=>{let H=typeof K==="function"?K():K;if(!H){W();return}if(J=H,J.on("close",W),J.on("error",(F)=>{console.warn(`[${I6}] port-forward to ${Z}:${Q} dropped mid-connection: ${SV$(F)}`,JSON.stringify(qQ1(F))),this.invalidateRecord(Y),W()}),G)try{J.close()}catch{}}).catch((K)=>{console.warn(`[${I6}] port-forward to ${Z}:${Q} failed: ${SV$(K)}`,JSON.stringify(qQ1(K))),this.invalidateRecord(Y),W()})}closeForwarder($){$.close()}close(){if(this.closed)return;this.closed=!0,this.claimWatchAbort.abort();for(let $ of this.records.values())this.dropRecord($);this.records.clear()}}function Wr4($){return{active:$.createUpDownCounter("studio.sandbox.active",{description:"Active sandbox count, by runner kind, owning org, and daemon impl. Cross-checks the cAdvisor-derived count from the cluster \u2014 divergence between the two indicates orphaned claims (studio deleted but K8s didn't reap) or unattributed pods.",unit:"{sandbox}"}),ensureOutcome:$.createCounter("studio.sandbox.ensure.outcome",{description:"Outcome of each ensure() call: fresh provision, resume from state-store after restart, or adopt of a cluster-side claim studio didn't know about. Cold-start ratio is the primary input for warm-pool sizing.",unit:"{call}"}),proxyDurationMs:$.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of studio-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"}),poolPods:$.createGauge("studio.sandbox.pool.pods",{description:"Tenant warm pool depth by pool and state: ready (warmed and unbound \u2014 what a claim can actually bind instantly), bound (serving a user), pending (unbound, not yet warmed), failed (gave up after repeated bootstrap failures). Alert on sustained ready=0: a pool that is always empty is doing nothing while costing N pods.",unit:"{pod}"})}}function qQ1($){let Z=[],Q=$;for(let Y=0;Y<5&&Q instanceof Error;Y++){let X=Q;if(Z.push({name:X.name,message:X.message,...X.code!==void 0?{code:X.code}:{},...X.errno!==void 0?{errno:X.errno}:{}}),X.cause===Q)break;Q=X.cause}if(Q!==void 0&&!(Q instanceof Error)&&Q!==null){let Y=Q,X=Y.error instanceof Error?qQ1(Y.error).chain:void 0;Z.push({nonError:String(Q),...typeof Y.type==="string"?{type:Y.type}:{},...typeof Y.message==="string"?{message:Y.message}:{},...Y.code!==void 0?{code:Y.code}:{},...typeof Y.reason==="string"?{reason:Y.reason}:{},...X?{error:X}:{},...X===void 0&&Y.error!==void 0?{rawError:String(Y.error)}:{},keys:Object.keys(Y)})}return{chain:Z}}function Kr4(){let $=new Wq0;return $.loadFromDefault(),$}function PQ1($){return Boolean($.status?.conditions?.some((Z)=>Z.type==="Ready"&&Z.status==="True"))}function zQ1($,Z){let Q=$.spec?.env;if(!Q)return null;for(let Y of Q)if(Y.name===Z&&Y.value)return Y.value;return null}function Hr4($,Z){let Q=ns4("sha256").update(`${$}:${Z}`).digest();return RQ1+Q.readUInt32BE(0)%yV$}function bV$($){let Z=$.slice(0,Ur4);return Fr4.test(Z)?Z:""}function Br4($){if($===void 0)return null;let Z=$.trim();if(Z==="")return null;if(!Nr4.test(Z))throw Error(`AgentSandboxProvider: envName=${JSON.stringify(Z)} is not a valid DNS-label-safe environment name (lowercase alphanumeric or '-', starts with a letter, ends alphanumeric, \u226432 chars). Studio sets this from STUDIO_ENV; check the studio chart's configMap.`);return Z}function AQ1($,Z={}){let Q={...Z};if($){let Y=bV$($.orgId),X=bV$($.userId);if(Y)Q[RJ.orgId]=Y;if(X)Q[RJ.userId]=X}return Q}function xy($){let Z="";for(let Q of $){let Y=Q.codePointAt(0)??0;Z+=Y<32||Y===127?" ":Q}return Z.slice(0,Dr4)}function Lr4($){try{let Z=new URL($);return Z.username="",Z.password="",Z.toString()}catch{return""}}function Or4($){let Z={},Q=$.tenant;if(Q?.orgSlug)Z[LF.orgSlug]=xy(Q.orgSlug);if(Q?.orgName)Z[LF.orgName]=xy(Q.orgName);if(Q?.userEmail)Z[LF.userEmail]=xy(Q.userEmail);if(Q?.userName)Z[LF.userName]=xy(Q.userName);let Y=$.repo;if(Y){if(Y.displayName)Z[LF.gitRepo]=xy(Y.displayName);let X=Lr4(Y.cloneUrl);if(X)Z[LF.gitRepoUrl]=xy(X);let J=$.branch??Y.branch;if(J)Z[LF.gitBranch]=xy(J)}return Z}function wr4($){let Z=$.metadata?.labels;if(!Z)return null;let Q=Z[RJ.orgId],Y=Z[RJ.userId];if(!Q||!Y)return null;let X=$.metadata?.annotations??{};return{orgId:Q,userId:Y,orgSlug:X[LF.orgSlug],orgName:X[LF.orgName],userEmail:X[LF.userEmail],userName:X[LF.userName]}}function jr4($,Z){if($){let Q=new Date($).getTime();if(Number.isFinite(Q)&&Q<=Z.getTime())return null}return Z.toISOString()}function Er4($,Z){if($){let Q=new Date($).getTime();if(Number.isFinite(Q)&&Q>=Z.getTime())return null}return Z.toISOString()}function TQ1($){return{org_id:$?.orgId??"",user_id:$?.userId??"",runner_kind:"agent-sandbox"}}async function Pr4($,Z){if(!Z||!$.tenant)return $.orgFsConfigJson;try{return await Z($.tenant)??$.orgFsConfigJson}catch(Q){return console.warn(`[${I6}] org-fs credential re-mint failed: ${Q instanceof Error?Q.message:String(Q)}`),$.orgFsConfigJson}}function xV$($){try{let Z=new URL($.cloneUrl);Z.username="",Z.password="";let{submoduleCredentials:Q,credentialExpiresAt:Y,...X}=$;return{...X,cloneUrl:Z.toString()}}catch{return null}}function zr4($,Z){let{orgFsConfigJson:Q,repo:Y,extraRepos:X,...J}=$,G=J,W=Y&&xV$(Y);if(W)G.repo=W;if(X)G.extraRepos=X.map(xV$).filter((K)=>K!==null);return Q||Z?{ensureOpts:G,orgFsRedacted:!0}:{ensureOpts:G}}function Ar4($){let Z={};if($.branch)Z.branch=$.branch;if($.repo)Z.repo=$.repo;if($.workload)Z.workload=$.workload;if($.env&&Object.keys($.env).length>0)Z.env=$.env;if($.tenant)Z.tenant=$.tenant;if($.cloneOnly)Z.cloneOnly=!0;if($.purpose)Z.purpose=$.purpose;if($.sandboxImage)Z.sandboxImage=$.sandboxImage;if($.orgFsConfigJson)Z.orgFsConfigJson=$.orgFsConfigJson;return Object.keys(Z).length>0?Z:null}function Tr4($,Z){try{return new URL(kq0($,Z)).hostname||null}catch{return null}}var I6="AgentSandboxProvider",ss4="agent-sandbox-system",rs4="studio-sandbox",as4=300000,vN=9000,CV$=3000,bq0="/app",es4=32,$r4,Zr4=900000,Qr4=60000,Yr4=1800000,xq0=3,_V$=1800000,Xr4=900000,Jr4=1800000,RQ1=40000,yV$=1e4,Gr4=256,RJ,LF,Fr4,Ur4=63,Nr4,Dr4=253;var gV$=L(()=>{r$();I2$();aI$();vy();Ri();WN0();J80();DV$();_80();qV$();_q0();vq0();$r4=new Set(["DAEMON_TOKEN","DAEMON_BOOT_ID","APP_ROOT","PROXY_PORT"]);RJ={role:"studio.decocms.com/role",sandboxHandle:"studio.decocms.com/sandbox-handle",orgId:"studio.decocms.com/org-id",userId:"studio.decocms.com/user-id",env:"studio.decocms.com/env"},LF={orgSlug:"studio.decocms.com/org-slug",orgName:"studio.decocms.com/org-name",userEmail:"studio.decocms.com/user-email",userName:"studio.decocms.com/user-name",gitRepo:"studio.decocms.com/git-repo",gitRepoUrl:"studio.decocms.com/git-repo-url",gitBranch:"studio.decocms.com/git-branch"},Fr4=/^([A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?)?$/;Nr4=/^[a-z]([a-z0-9-]{0,30}[a-z0-9])?$/});var hV$={};O6(hV$,{tenantPoolSchema:()=>OV$,tenantPoolRepoSchema:()=>C80,tenantPoolFieldsSchema:()=>LQ1,tenantPoolAllocations:()=>qi,resolveTenantPoolBinding:()=>OQ1,renderTenantPoolWarmPools:()=>EV$,normalizeRepoUrl:()=>AK,allocationsMatchingPush:()=>jQ1,TenantPoolCapacityError:()=>Cq0,PREVIEW_NOT_READY_HEADER:()=>Ii,AgentSandboxProvider:()=>MQ1});var v80=L(()=>{gV$();_80()});import{z as fy}from"zod";function fq0($){if(!$||$.trim()==="")return[];let Z=fy.array(Rr4).parse(JSON.parse($)),Q=new Set;for(let Y of Z){if(Q.has(Y.name))throw Error(`tenant pools: duplicate pool name ${Y.name}`);Q.add(Y.name)}return Z}function uV$($){let Z=AK(`https://github.com/${$.repo}`);if(!Z)throw Error(`tenant pools: bad repo ${$.repo}`);return Z}function lV$($){return $.map((Z)=>({name:Z.name,tenant:Z.orgId,size:1,image:"default",repos:[{repoUrl:uV$(Z),branch:Z.branch,workload:Z.workload,replicas:1,warmPoolName:Z.name}]}))}function IQ1($,Z){let Q=AK(Z.repoUrl)?.toLowerCase(),Y=$.find((J)=>J.orgId===Z.tenant&&J.branch===Z.branch&&uV$(J).toLowerCase()===Q);if(!Y)return null;let X=`https://github.com/${Y.repo}.git`;return Y.connectionId?{cloneUrl:X,connectionId:Y.connectionId}:{cloneUrl:X}}function cV$($,Z){return async(Q)=>{let Y=IQ1($,Q);if(!Y)return null;return Y.connectionId?Z(Y):Y.cloneUrl}}var Rr4;var yq0=L(()=>{v80();Rr4=fy.object({name:fy.string().max(63).regex(/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/,"pool name must be a DNS label (lowercase alphanumeric and '-')"),orgId:fy.string().min(1),repo:fy.string().regex(/^[^/\s]+\/[^/\s]+$/,"repo must be `owner/name`"),connectionId:fy.string().min(1).optional(),branch:fy.string().min(1).default("main"),workload:C80.shape.workload})});function _Q1($,Z=Date.now()){if($===void 0)return;return $===null?Z+qr4:$.getTime()}function CQ1($){return JSON.stringify([$.orgId,$.userId])}function mV$($,Z){let Q=AK(Z);return Q?JSON.stringify([$,Q.toLowerCase()]):null}function Ir4($,Z){return"repositoryId"in Z?$.repositoryOrgs.get(Z.repositoryId):$.connectionOrgs.get(Z.connectionId)}function dV$($){let{records:Z,now:Q}=$,Y=new Map,X=new Map,J=new Map,G=0;for(let W of $.pools)for(let{repoUrl:K,branch:H}of W.repos){let F=mV$(W.tenant,K),U=IQ1($.legacyPools??[],{tenant:W.tenant,repoUrl:K,branch:H});if(F&&U){if(U.connectionId)X.set(F,{tenant:W.tenant,repoUrl:K,connectionId:U.connectionId,cloneUrl:U.cloneUrl});continue}let N=F?Z.orgRepositories.get(F):void 0;if(!F||!N){G++;continue}X.set(F,{tenant:W.tenant,repoUrl:K,repositoryId:N})}for(let W of $.sandboxes){let K=W.tenant;if(!K)continue;let H=Z.members.get(CQ1(K));if(H===void 0){G++;continue}for(let U of W.repos){if(Ir4(Z,U)!==K.orgId){G++;continue}let N="repositoryId"in U?{repositoryId:U.repositoryId}:{connectionId:U.connectionId,repo:U.repo.toLowerCase()},B={orgId:K.orgId,userId:K.userId};Y.set(JSON.stringify([B,N]),{tenant:B,repo:N})}let F=W.orgFsConfigExpiresAt;if(W.orgFs&&(F===null||F-Q<Mr4))J.set(CQ1(K),{orgId:K.orgId,userId:K.userId,orgSlug:H})}return{clones:[...Y.values()],poolClones:[...X.values()],orgFs:[...J.values()],refused:G}}async function iV$($,Z,Q){let Y=new Set,X=new Set,J=new Set,G=new Set,W=new Set(Q.map((D)=>D.tenant)),K=new Set;for(let D of Q)for(let{repoUrl:O}of D.repos){let w=YX(O);if(w)K.add(w.path.toLowerCase())}for(let D of Z){if(D.tenant)Y.add(D.tenant.orgId),X.add(D.tenant.userId);for(let O of D.repos)if("repositoryId"in O)G.add(O.repositoryId);else J.add(O.connectionId)}let[H,F,U,N]=await Promise.all([Y.size===0?[]:$.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.organizationId as orgId","member.userId as userId","organization.slug as slug"]).where("member.organizationId","in",[...Y]).where("member.userId","in",[...X]).execute(),J.size===0?[]:$.selectFrom("connections").select(["id","organization_id"]).where("id","in",[...J]).execute(),G.size===0?[]:$.selectFrom("repositories").select(["id","organization_id"]).where("id","in",[...G]).execute(),K.size===0?[]:$.selectFrom("repositories").select(["id","organization_id","provider","host","path"]).where("organization_id","in",[...W]).where((D)=>D(D.fn("lower",["path"]),"in",[...K])).execute()]),B=new Map;for(let D of N){let O=mV$(D.organization_id,m10({provider:D.provider,host:D.host,path:D.path}));if(O&&!B.has(O))B.set(O,D.id)}return{members:new Map(H.map((D)=>[CQ1(D),D.slug])),connectionOrgs:new Map(F.map((D)=>[D.id,D.organization_id])),repositoryOrgs:new Map(U.map((D)=>[D.id,D.organization_id])),orgRepositories:B}}function SQ1($){return $ instanceof Error?$.message:String($)}async function pV$($,Z,Q){let Y=0;if($.clones.length>ki||$.poolClones.length>ki||$.orgFs.length>kQ1)console.warn(`[sandbox-credential-push] ${$.clones.length} clone, ${$.poolClones.length} pool clone and ${$.orgFs.length} org-fs mints planned; minting the first ${ki}, ${ki} and ${kQ1}`);let X=await I5($.clones.slice(0,ki),VQ1,async(U)=>{let N="repositoryId"in U.repo?{cloneUrl:"",repositoryId:U.repo.repositoryId}:{cloneUrl:`https://github.com/${U.repo.repo}.git`,connectionId:U.repo.connectionId};try{let B=await Z.mintCloneUrl(N,{bufferMs:gq0});return B?{tenant:U.tenant,repo:U.repo,cloneUrl:B,expiresAt:Q.now+gq0}:null}catch(B){return Y++,console.warn(`[sandbox-credential-push] clone mint failed: ${SQ1(B)}`),null}}),J=await I5($.poolClones.slice(0,ki),VQ1,async(U)=>{try{let N=await Z.mintCloneUrl("repositoryId"in U?{cloneUrl:"",repositoryId:U.repositoryId}:{cloneUrl:U.cloneUrl,connectionId:U.connectionId},{bufferMs:gq0});return N?{tenant:U.tenant,repoUrl:U.repoUrl,cloneUrl:N,expiresAt:Q.now+gq0}:null}catch(N){return Y++,console.warn(`[sandbox-credential-push] pool clone mint failed: ${SQ1(N)}`),null}}),G=await I5($.orgFs.slice(0,kQ1),VQ1,async(U)=>{try{let N=await Z.mintOrgFsConfig(U);return N?{tenant:{orgId:U.orgId,userId:U.userId},orgFsConfigJson:N,expiresAt:Q.now+Q.orgFsLifetimeMs}:null}catch(N){return Y++,console.warn(`[sandbox-credential-push] org-fs mint failed: ${SQ1(N)}`),null}}),W=X.filter((U)=>U!==null),K=J.filter((U)=>U!==null),H=G.filter((U)=>U!==null),F=[];for(let U=0;U<Math.max(W.length,K.length,H.length);U+=tE)F.push({cloneUrls:W.slice(U,U+tE),poolCloneUrls:K.slice(U,U+tE),orgFsConfigs:H.slice(U,U+tE)});return{batches:F,failed:Y}}var gq0=2700000,hq0,qr4=86400000,Mr4=86400000,VQ1=8,ki=2000,kQ1=200;var uq0=L(()=>{UZ1();v80();t4();r$();MN();yq0();hq0=lz$-3600000});var qJ;var b80=L(()=>{qJ=class qJ extends Error{code;status;path;constructor($,Z,Q){super(Z.message||`Freestyle API error: ${Z.code}`);this.name="FreestyleApiError",this.code=Z.code,this.status=$,this.path=Q,Object.setPrototypeOf(this,qJ.prototype)}}});function nV$(){return typeof process<"u"&&Boolean(process.versions?.node)}var lq0=($,Z)=>globalThis.fetch($,Z);async function Vr4(){if(!nV$())return null;try{return await import("undici")}catch{return null}}async function Sr4(){let $=await Vr4();if(!$)return null;let Z=new $.Agent({allowH2:!0,connections:kr4});return(Q,Y)=>$.fetch(Q,{...Y,dispatcher:Z})}function Cr4($){return(typeof $==="string"?$:$ instanceof URL?$.href:$.url).startsWith("https:")}function tV$(){let $,Z=()=>{return $??=Sr4().then((Q)=>Q??lq0).catch(()=>lq0),$};return(Q,Y)=>Cr4(Q)?Z().then((X)=>X(Q,Y)):lq0(Q,Y)}var kr4=4;var oV$=()=>{};function yr4($){return new Promise((Z)=>setTimeout(Z,$))}function gr4($){if(!$)return"";let Z=new URLSearchParams;for(let[Y,X]of Object.entries($)){if(X===void 0||X===null)continue;Z.set(Y,String(X))}let Q=Z.toString();return Q?`?${Q}`:""}function i6($){return encodeURIComponent($)}class vQ1{baseUrl;authenticationHeaders;fetchImpl;backgroundEligible;constructor($={}){if(this.baseUrl=($.baseUrl??fr4).replace(/\/+$/,""),!$.fetch&&!globalThis.fetch)throw Error("No fetch implementation available. Pass `fetch` in FreestyleOptions when running on a runtime without a global fetch.");if(this.fetchImpl=$.fetch??tV$(),"identityAccessToken"in $&&$.identityAccessToken){this.authenticationHeaders={[_r4]:$.identityAccessToken},this.backgroundEligible=!1;return}if(this.backgroundEligible=!0,"stackAccessToken"in $&&$.stackAccessToken){this.authenticationHeaders={Authorization:`Bearer ${$.stackAccessToken}`,"X-Freestyle-Team-Id":$.teamId};return}let Z=$.apiKey??globalThis.process?.env?.FREESTYLE_API_KEY;if(!Z)throw Error("No Freestyle API key provided. Pass `apiKey` in FreestyleOptions or set FREESTYLE_API_KEY.");this.authenticationHeaders={Authorization:`Bearer ${Z}`}}authHeaders(){return{...this.authenticationHeaders}}url($,Z){return`${this.baseUrl}${$}${gr4(Z)}`}async fetch($,Z={}){let Q=new Headers(Z.headers);for(let[Y,X]of Object.entries(this.authHeaders()))if(!Q.has(Y))Q.set(Y,X);return this.fetchImpl(this.absoluteUrl($),{...Z,headers:Q})}absoluteUrl($){return/^https?:\/\//i.test($)?$:`${this.baseUrl}${$}`}async request($,Z,{query:Q,body:Y,rawBody:X,signal:J}={}){let G={...this.authHeaders()};if(this.backgroundEligible)G[sV$]=String(br4);let W;if(X!==void 0)G["Content-Type"]="application/octet-stream",W=X;else if(Y!==void 0)G["Content-Type"]="application/json",W=JSON.stringify(Y);let K=this.url(Z,Q),H=await this.fetchImpl(K,{method:$,headers:G,body:W,signal:J});if(this.backgroundEligible&&H.status===202)try{return await this.pollBackgroundRequest(H,Z)}catch(F){if($==="GET"&&F instanceof qJ&&F.code==="BACKGROUND_RESULT_UNSTORABLE"){delete G[sV$];let U=await this.fetchImpl(K,{method:$,headers:G,body:W});return this.finalize(U,Z)}throw F}return this.finalize(H,Z)}async pollBackgroundRequest($,Z){let Q=await $.json().catch(()=>({})),Y=$.headers.get(vr4)??Q.requestId,X=Q.resultUrl??(Y?`/v5/background-requests/${i6(Y)}`:void 0);if(!X)throw new qJ($.status,{code:"BACKGROUND_PROTOCOL_ERROR",message:"202 Accepted carried no background request id"},Z);let J=0;for(;;){await yr4(xr4);let G;try{G=await this.fetch(X,{method:"GET"}),J=0}catch(W){if(++J>=5)throw W;continue}if(G.status===202)continue;return this.finalize(G,Z)}}async finalize($,Z){if(!$.ok){let Y;try{Y=await $.json()}catch{Y={code:"UNKNOWN_ERROR",message:await $.text().catch(()=>$.statusText)}}throw new qJ($.status,Y,Z)}if($.status===204)return;let Q=await $.text();if(!Q)return;return JSON.parse(Q)}get($,Z){return this.request("GET",$,{query:Z})}post($,Z){return this.request("POST",$,{body:Z??{}})}patch($,Z){return this.request("PATCH",$,{body:Z??{}})}put($,Z){return this.request("PUT",$,{body:Z??{}})}putEmpty($){return this.request("PUT",$,{})}putBytes($,Z,Q,Y){return this.request("PUT",$,{query:Q,rawBody:Z,signal:Y})}async getBytes($,Z,Q={}){let Y={...this.authHeaders()};if(Q.range)Y.Range=Q.range;let X=await this.fetchImpl(this.url($,Z),{method:"GET",headers:Y,signal:Q.signal});if(!X.ok){let J;try{J=await X.json()}catch{J={code:"UNKNOWN_ERROR",message:await X.text().catch(()=>X.statusText)}}throw new qJ(X.status,J,$)}return X}delete($,Z){return this.request("DELETE",$,{query:Z})}}var _r4="x-freestyle-identity-access-token",sV$="x-freestyle-background-after-secs",vr4="x-freestyle-background-request-id",br4=5,xr4=2000,fr4="https://api.freestyle.sh";var TK=L(()=>{b80();oV$()});class bQ1{client;verifications;certificates;placeholder;constructor($){this.client=$,this.verifications=new rV$($),this.certificates=new aV$($),this.placeholder=new eV$($)}async list(){let{domains:$}=await this.client.get("/v5/domains");return $}}class rV${client;constructor($){this.client=$}create($){return this.client.post("/v5/verifications",{domain:$})}async list($={}){let{verifications:Z}=await this.client.get("/v5/verifications",$);return Z}get($){return this.client.get(`/v5/verifications/${i6($)}`)}complete($){return this.client.putEmpty(`/v5/verifications/${i6($)}`)}delete($){return this.client.delete(`/v5/verifications/${i6($)}`)}}class aV${client;constructor($){this.client=$}async list(){let{certificates:$}=await this.client.get("/v5/certificates");return $}createWildcard($){return this.client.post("/v5/certificates/wildcard",{domain:$})}}class eV${client;constructor($){this.client=$}async get(){try{return await this.client.get("/v5/domains/placeholder")}catch($){if($ instanceof qJ&&$.status===404)return null;throw $}}set($){return this.client.put("/v5/domains/placeholder",$)}delete(){return this.client.delete("/v5/domains/placeholder")}}var xQ1=L(()=>{TK();b80()});function Q5($,Z){throw new yQ1($,Z)}function fQ1($){return hr4.some((Z)=>$[Z]!==void 0)}function gQ1($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function lr4($,Z){let Q=Z.lastIndexOf("/");if(Q<0)Q5($,`${$} \`${Z}\` is not a CIDR: expected address/prefix, e.g. 203.0.113.0/24 or 2001:db8::/32`);let Y=Z.slice(0,Q),X=Z.slice(Q+1);if(!/^\d+$/.test(X))Q5($,`${$} \`${Z}\`: prefix length must be a number`);let J=Number(X),G=Y.includes(":"),W=G?128:32;if(J>W)Q5($,`${$} \`${Z}\`: prefix length must be 0\u2013${W}`);if(!G&&!/^\d{1,3}(\.\d{1,3}){3}$/.test(Y))Q5($,`${$} \`${Z}\`: \`${Y}\` is not an IP address`)}function Yk$($,Z){if(!gQ1($))Q5(Z,`${Z} must be an object`);for(let Y of Object.keys($))if(!$k$.includes(Y))Q5(`${Z}.${Y}`,`${Z} has unknown field \`${Y}\`. Expected one of: ${$k$.join(", ")}`);let Q=$;for(let Y of["vmId","vpcId","tunnelId","cidr"]){let X=Q[Y];if(X!==void 0&&(typeof X!=="string"||X.length===0))Q5(`${Z}.${Y}`,`${Z}.${Y} must be a non-empty string`)}if(Q.public!==void 0&&Q.public!==!0)Q5(`${Z}.public`,`${Z}.public must be true when present: it declares the public Internet. Omit the field to match something else`);if(Q.public===!0){if(Q.vmId!==void 0)Q5(`${Z}.public`,`${Z} cannot combine \`public: true\` with \`vmId\`: that would mean the VM only when reached over its public address, a distinction this API does not make yet. Use \`vmId\` alone to match the VM on any path, or \`public: true\` alone to match public addresses`);if(Q.vpcId!==void 0)Q5(`${Z}.public`,`${Z} cannot combine \`public: true\` with \`vpcId\`: that would mean the network's members only when reached over their public addresses, a distinction this API does not make yet. Use \`vpcId\` alone or \`public: true\` alone`);if(Q.tunnelId!==void 0)Q5(`${Z}.public`,`${Z} cannot combine \`public: true\` with \`tunnelId\`: traffic through a tunnel arrives over the tunnel, not over the public Internet. Use \`tunnelId\` alone`)}if(Q.cidr!==void 0)lr4(`${Z}.cidr`,Q.cidr);if(Q.protocol!==void 0&&!Zk$.includes(Q.protocol))Q5(`${Z}.protocol`,`${Z}.protocol must be one of: ${Zk$.join(", ")} (got \`${String(Q.protocol)}\`)`);if(Q.port!==void 0){if(!Number.isInteger(Q.port)||Q.port<1||Q.port>65535)Q5(`${Z}.port`,`${Z}.port must be an integer between 1 and 65535`);if(Q.protocol===void 0)Q5(`${Z}.protocol`,`${Z}.port ${Q.port} requires ${Z}.protocol: set it to "tcp" or "udp" so the rule opens one transport rather than both`);if(!ur4.includes(Q.protocol))Q5(`${Z}.port`,`${Z}.protocol "${Q.protocol}" has no ports; remove ${Z}.port ${Q.port}`)}}function Gk$($,Z){if(!gQ1($))Q5(Z||"rule",`${Z||"rule"} must be an object`);for(let Y of Object.keys($))if(!Xk$.includes(Y))Q5(`${Z}${Y}`,`Unknown field \`${Y}\`. Expected one of: ${Xk$.join(", ")}`);let Q=$;if(Q.action===void 0)Q5(`${Z}action`,`${Z}action is required. Write \`action: "allow"\` \u2014 every rule states what it does rather than defaulting to it`);if(Q.action!=="allow")Q5(`${Z}action`,`${Z}action must be "allow" (got \`${String(Q.action)}\`). Only allow rules exist today`);if(Q.description!==void 0){if(typeof Q.description!=="string")Q5(`${Z}description`,"description must be a string");if(Q.description.length>Qk$)Q5(`${Z}description`,`description is too long (${Q.description.length} characters, maximum ${Qk$})`)}if(Q.source===void 0)Q5(`${Z}source`,`${Z}source is required`);if(Q.destination===void 0)Q5(`${Z}destination`,`${Z}destination is required`);return Yk$(Q.source,`${Z}source`),Yk$(Q.destination,`${Z}destination`),Q}function cr4($){let Z=Gk$($,"");for(let Q of["source","destination"]){let Y=Z[Q];if(fQ1(Y))continue;let X=[Y.port!==void 0?`port ${Y.port}`:void 0,Y.protocol!==void 0?`protocol ${Y.protocol}`:void 0].filter(Boolean).join(", ");Q5(Q,X?`${Q} only narrows traffic (${X}) without saying what it is. Add \`vmId\`, \`vpcId\`, \`tunnelId\`, \`cidr\`, or \`public: true\`. Leaving it out to mean "this VM" only works inside vms.create`:`${Q} is empty. A matcher must say what the traffic is: \`vmId\`, \`vpcId\`, \`tunnelId\`, \`cidr\`, or \`public: true\` for the public Internet`)}return Z}function cq0($,Z="VM"){if($===void 0||$===null)Q5("firewall",`firewall is required on a ${Z} create. A ${Z} gets nothing implicitly, so state what it may reach \u2014 \`{ rules: [] }\` if the answer is nothing`);if(!gQ1($))Q5("firewall","firewall must be an object with a `rules` array");for(let Y of Object.keys($))if(Y!=="rules")Q5(`firewall.${Y}`,`firewall has unknown field \`${Y}\`. Expected: rules`);let Q=$.rules;if(!Array.isArray(Q))Q5("firewall.rules","firewall.rules must be an array");return Q.forEach((Y,X)=>{let J=`firewall.rules[${X}].`,G=Gk$(Y,J),W=fQ1(G.source),K=fQ1(G.destination);if(!W&&!K&&Z!=="network")Q5(`firewall.rules[${X}]`,`firewall.rules[${X}]: both source and destination refer to the ${Z} being created, which allows nothing. Give one of them a \`vmId\`, \`vpcId\`, \`tunnelId\`, \`cidr\`, or \`public: true\``);if(W&&K)Q5(`firewall.rules[${X}]`,`firewall.rules[${X}]: neither end refers to the ${Z} being created. Leave one endpoint's identity unset so it means this ${Z}, or create the rule with firewall.rules.create instead`)}),$}function Jk$($){return`/v5/firewall/rules/${i6($)}`}class Wk${client;constructor($){this.client=$}async create($){let Z=cr4($);return this.client.post("/v5/firewall/rules",Z)}list($={}){return this.client.get("/v5/firewall/rules",$)}get($){return this.client.get(Jk$($))}delete($){return this.client.delete(Jk$($))}}class hQ1{client;rules;constructor($){this.client=$,this.rules=new Wk$($)}evaluate($){return this.client.post("/v5/firewall/evaluate",$)}}var yQ1,$k$,hr4,Zk$,ur4,Qk$=1024,Xk$;var x80=L(()=>{TK();yQ1=class yQ1 extends Error{path;constructor($,Z){super(Z);this.name="FirewallRuleValidationError",this.path=$,Object.setPrototypeOf(this,yQ1.prototype)}};$k$=["vmId","vpcId","tunnelId","cidr","public","port","protocol"],hr4=["vmId","vpcId","tunnelId","cidr","public"],Zk$=["tcp","udp","icmp"],ur4=["tcp","udp"];Xk$=["action","source","destination","description"]});function uQ1($){return`/v5/identities/${i6($)}`}class Kk${client;basePath;constructor($,Z){this.client=$,this.basePath=Z}create(){return this.client.post(`${this.basePath}/tokens`)}list(){return this.client.get(`${this.basePath}/tokens`)}revoke($){return this.client.delete(`${this.basePath}/tokens/${i6($)}`)}}class Hk${client;basePath;constructor($,Z){this.client=$,this.basePath=Z}list(){return this.client.get(`${this.basePath}/permissions/vm`)}grant($){return this.client.post(`${this.basePath}/permissions/vm`,$)}get($){return this.client.get(`${this.basePath}/permissions/vm/${i6($)}`)}update($,Z){return this.client.patch(`${this.basePath}/permissions/vm/${i6($)}`,{allowedLinuxUsers:Z})}revoke($){return this.client.delete(`${this.basePath}/permissions/vm/${i6($)}`)}}class lQ1{id;tokens;permissions;client;basePath;constructor($,Z){this.client=$,this.id=Z,this.basePath=uQ1(Z),this.tokens=new Kk$($,this.basePath),this.permissions={vm:new Hk$($,this.basePath)}}data(){return this.client.get(this.basePath)}delete(){return this.client.delete(this.basePath)}}class cQ1{client;constructor($){this.client=$}async create($={}){let Z=await this.client.post("/v5/identities",$);return{identity:new lQ1(this.client,Z.id),identityId:Z.id,data:Z}}list($={}){return this.client.get("/v5/identities",$)}get($){return this.client.get(uQ1($))}ref($){return new lQ1(this.client,$)}delete($){return this.client.delete(uQ1($))}}var mQ1=L(()=>{TK()});function h1($,Z){throw new nQ1($,Z)}function j7($,Z){throw new tQ1($,Z)}function f80($){return mr4.some((Z)=>$[Z]!==void 0)}function rr4($){return!f80($)&&$.port===void 0}function LX($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function Tk$($,Z,Q){if(typeof $!=="string"||!nr4.test($))j7(Z,`${Z} must be a valid HTTP header name`);let Y=$.toLowerCase();if(sr4.has(Y)||Y.startsWith("x-forwarded-")||Y.startsWith("x-freestyle-")||Q&&(Y==="cookie"||Y==="set-cookie"))j7(Z,`${Z} may not use reserved header \`${$}\``)}function ar4($,Z){if(!Array.isArray($))j7(Z,`${Z} must be an array of header names`);if($.length>Ok$)j7(Z,`${Z} may contain at most ${Ok$} names`);let Q=new Set;$.forEach((Y,X)=>{Tk$(Y,`${Z}[${X}]`,!0);let J=Y.toLowerCase();if(Q.has(J))j7(`${Z}[${X}]`,`${Z} contains duplicate header \`${Y}\``);Q.add(J)})}function jk$($){if(!LX($))j7("forwardAuth","forwardAuth must be an object");for(let Y of Object.keys($))if(!Nk$.includes(Y))j7(Y,`Unknown field \`${Y}\`. Expected one of: ${Nk$.join(", ")}`);let Z=$;if(typeof Z.url!=="string"||Z.url.length===0||Z.url.length>tr4)j7("url","url is required and must be an absolute HTTPS URL");let Q;try{Q=new URL(Z.url)}catch{j7("url","url must be an absolute HTTPS URL")}if(Q.protocol!=="https:"||Q.hostname.length===0||Q.username.length>0||Q.password.length>0||Q.hash.length>0||Q.port==="0")j7("url","url must be an absolute HTTPS URL");if(Z.headers!==void 0){if(!LX(Z.headers))j7("headers","headers must be an object of header name to value");let Y=Object.entries(Z.headers);if(Y.length>Dk$)j7("headers",`headers may contain at most ${Dk$} entries`);let X=0,J=new Set;for(let[G,W]of Y){Tk$(G,`headers.${G}`,!1);let K=G.toLowerCase();if(J.has(K))j7(`headers.${G}`,`headers contains duplicate header \`${G}\``);if(J.add(K),typeof W!=="string"||/[\0\r\n]/.test(W))j7(`headers.${G}`,`headers.${G} must be a string`);X+=G.length+W.length}if(X>Lk$)j7("headers",`headers may contain at most ${Lk$} bytes`)}if(Z.timeoutMs!==void 0&&(!Number.isInteger(Z.timeoutMs)||Z.timeoutMs<100||Z.timeoutMs>5000))j7("timeoutMs","timeoutMs must be an integer between 100 and 5000");if(Z.protectedCookies!==void 0){if(!Array.isArray(Z.protectedCookies))j7("protectedCookies","protectedCookies must be an array of cookie names");if(Z.protectedCookies.length>wk$)j7("protectedCookies",`protectedCookies may contain at most ${wk$} names`);let Y=new Set;Z.protectedCookies.forEach((X,J)=>{if(typeof X!=="string"||X.length>or4||!pr4.test(X))j7(`protectedCookies[${J}]`,`protectedCookies[${J}] must be a valid HTTP cookie name`);if(Y.has(X))j7(`protectedCookies[${J}]`,`protectedCookies contains duplicate cookie \`${X}\``);Y.add(X)})}if(Z.authResponseHeaders!==void 0)ar4(Z.authResponseHeaders,"authResponseHeaders");return Z}function er4($,Z){if(!LX($))h1(Z,`${Z} must be an object with an \`id\``);for(let Y of Object.keys($))if(!Bk$.includes(Y))h1(`${Z}.${Y}`,`${Z} has unknown field \`${Y}\`. Expected: ${Bk$.join(", ")}`);let Q=$.id;if(typeof Q!=="string"||Q.length===0)h1(`${Z}.id`,`${Z}.id is required and must be a non-empty string`)}function pQ1($){if(typeof $!=="string")h1("domain","domain is required and must be a string");if($==="*")return;let Z=$.startsWith("*.")?$.slice(2):$;if(Z.length===0||Z.length>dr4)h1("domain",`domain \`${$}\` is not a hostname`);let Q=Z.split(".");if(Q.length<2)h1("domain",`domain \`${$}\` must have at least two labels, e.g. acme.com`);for(let Y of Q){if(Y.length===0||Y.length>ir4)h1("domain",`domain \`${$}\` has an empty or over-long label`);if(!/^[a-z0-9-]+$/.test(Y))h1("domain",`domain \`${$}\`: labels are lowercase letters, digits, and hyphens (a \`*.\` prefix is the only wildcard)`);if(Y.startsWith("-")||Y.endsWith("-"))h1("domain",`domain \`${$}\`: a label cannot start or end with a hyphen`)}}function $a4($){if(typeof $!=="string")h1("domain","domain is required and must be a string");let Z=$.lastIndexOf("@");if(Z===-1){pQ1($);return}let Q=$.slice(0,Z),Y=$.slice(Z+1);if(Q.length===0||Q.length>64)h1("domain",`mail route \`${$}\`: the part before \`@\` must be 1-64 characters`);if(Q.startsWith(".")||Q.endsWith(".")||Q.includes(".."))h1("domain",`mail route \`${$}\`: the part before \`@\` cannot start or end with a dot, or contain \`..\``);for(let X of Q)if(!/[a-zA-Z0-9]/.test(X)&&!Ek$.includes(X))h1("domain",`mail route \`${$}\`: the part before \`@\` may use letters, digits, dots, and \`${Ek$.slice(0,-1)}\` (quoted mailboxes are not supported)`);if(Y==="*")h1("domain",`mail route \`${$}\`: \`*\` is not a mail domain \u2014 name the domain the mailbox lives at`);pQ1(Y)}function Pk$($,Z){if(!LX($))h1(Z,`${Z} must be an object`);for(let Y of Object.keys($))if(!Fk$.includes(Y))h1(`${Z}.${Y}`,`${Z} has unknown field \`${Y}\`. Expected one of: ${Fk$.join(", ")}`);let Q=$;for(let Y of["vmId","vpcId","host"]){let X=Q[Y];if(X!==void 0&&(typeof X!=="string"||X.length===0))h1(`${Z}.${Y}`,`${Z}.${Y} must be a non-empty string`)}if(Q.public!==void 0&&Q.public!==!0)h1(`${Z}.public`,`${Z}.public must be true when present. Omit the field to match something else`);if(Z==="source"){if(Q.host!==void 0)h1("source.host","source.host is not allowed: a source is who opens the session, not where it lands. Put `host` on the destination");if(Q.port!==void 0)h1("source.port","source.port is not allowed: a source is who opens the session, not where it lands. Put `port` on the destination");if(Q.public===!0&&(Q.vmId!==void 0||Q.vpcId!==void 0))h1("source.public","source cannot combine `public: true` with `vmId` or `vpcId`: use one alone. `public` is every client on the Internet; `vmId`/`vpcId` is a specific dialer")}else{if(Q.vpcId!==void 0)h1("destination.vpcId","destination.vpcId is not allowed: a session lands in one place, not on a whole network. Name a `vmId`, a `host`, or `public: true` for the domain's own origin. A whole network may be a source");if([Q.vmId!==void 0,Q.host!==void 0,Q.public===!0].filter(Boolean).length>1)h1("destination","destination names more than one landing: give exactly one of `vmId`, `host`, or `public: true`");if((Q.vmId!==void 0||Q.host!==void 0)&&Q.port===void 0)h1("destination.port",`destination.port is required with ${Q.vmId!==void 0?"`vmId`":"`host`"}: say which port the session lands on`)}if(Q.port!==void 0){if(!Number.isInteger(Q.port)||Q.port<1||Q.port>65535)h1(`${Z}.port`,`${Z}.port must be an integer between 1 and 65535`)}}function Za4($){if("postgres"in $)return"postgres";if("smtp"in $)return"smtp";if("socks5"in $)return"socks5";return"http"}function Qa4($,Z){function Q(W,K,H){if(!LX(W)||Object.keys(W).some((F)=>!K.includes(F)))h1(H,`${H} must contain only ${K.join(", ")}`)}if(Q($,["region","credentials","scope"],Z),typeof $.region!=="string"||!/^[a-z0-9-]{1,63}$/.test($.region))h1(`${Z}.region`,"invalid s3.region");Q($.credentials,["accessKeyId","secretAccessKey","sessionToken"],`${Z}.credentials`);for(let W of["accessKeyId","secretAccessKey","sessionToken"]){let K=$.credentials[W];if(W==="sessionToken"&&K===void 0)continue;if(typeof K!=="string"||!/^[\x21-\x7e]{1,16384}$/.test(K))h1(`${Z}.credentials.${W}`,"invalid s3 credentials")}if(!/^[a-zA-Z0-9]+$/.test($.credentials.accessKeyId))h1(`${Z}.credentials.accessKeyId`,"invalid s3 access key id");Q($.scope,["bucket","prefix","operations"],`${Z}.scope`);let{bucket:Y,prefix:X,operations:J}=$.scope;if(typeof Y!=="string"||!/^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/.test(Y)||Y.includes(".."))h1(`${Z}.scope.bucket`,"invalid s3.scope.bucket");if(typeof X!=="string"||Buffer.byteLength(X,"utf8")>1024||/[\x00-\x1f\x7f-\x9f]/u.test(X))h1(`${Z}.scope.prefix`,"invalid s3.scope.prefix");let G=["GetObject","HeadObject","PutObject","DeleteObject","ListObjectsV2","CreateMultipartUpload","UploadPart","ListParts","CompleteMultipartUpload","AbortMultipartUpload","ListMultipartUploads"];if(!Array.isArray(J)||J.length===0||J.length>G.length||J.some((W)=>!G.includes(W))||new Set(J).size!==J.length)h1(`${Z}.scope.operations`,"s3.scope.operations must be a nonempty list of distinct supported operations")}function Ya4($,Z){if(!LX($))h1(Z,`${Z} must be an object: \`{ headers: { \u2026 } }\`, \`{ postgres: { \u2026 } }\`, \`{ smtp: { \u2026 } }\` or \`{ socks5: { \u2026 } }\``);let Q=Object.keys($);if(Q.length!==1||!["headers","jsonPatch","postgres","smtp","socks5","s3"].includes(Q[0]??""))h1(Z,`${Z} must have exactly one of \`headers\`, \`jsonPatch\`, \`postgres\`, \`smtp\`, \`socks5\` or \`s3\` (got: ${Q.length===0?"nothing":Q.join(", ")})`);if(Q[0]==="s3"){Qa4($.s3,`${Z}.s3`);return}if(Q[0]==="jsonPatch"){let Y=$.jsonPatch;if(!Array.isArray(Y)||Y.length>128)h1(Z,`${Z}.jsonPatch must be an array of at most 128 operations`);let X=(W)=>typeof W==="string"&&(W===""||W.startsWith("/"))&&!/~(?:[^01]|$)/u.test(W),J=(W,K=new Set,H=0)=>{if(H>64)return!1;if(W===null||typeof W==="string"||typeof W==="boolean")return!0;if(typeof W==="number")return Number.isFinite(W);if(typeof W!=="object"||K.has(W))return!1;K.add(W);let F=(Array.isArray(W)?Array.from(W):LX(W)?Object.values(W):[void 0]).every((U)=>J(U,K,H+1));return K.delete(W),F};for(let[W,K]of Y.entries()){if(!LX(K)||!["add","remove","replace","move","copy","test"].includes(String(K.op))||!X(K.path))h1(Z,`${Z}.jsonPatch[${W}] requires a standard op and valid JSON Pointer path`);if(["move","copy"].includes(K.op)&&!X(K.from))h1(Z,`${Z}.jsonPatch[${W}].from must be a JSON Pointer`);if(["add","replace","test"].includes(K.op)&&(!Object.hasOwn(K,"value")||!J(K.value)))h1(Z,`${Z}.jsonPatch[${W}].value must be a JSON value (null is allowed)`)}let G;try{G=JSON.stringify(Y)}catch{h1(Z,"jsonPatch must be JSON serializable")}if(Buffer.byteLength(G,"utf8")>65536)h1(Z,"jsonPatch exceeds 64 KiB");return}if(Q[0]==="socks5"){let Y=$.socks5;if(!LX(Y))h1(`${Z}.socks5`,`${Z}.socks5 must be an object with \`username\` and \`password\``);for(let X of Object.keys(Y))if(!["username","password"].includes(X))h1(`${Z}.socks5.${X}`,`${Z}.socks5 has unknown field \`${X}\`. Expected: username, password`);for(let X of["username","password"])if(typeof Y[X]!=="string"||Y[X].length===0)h1(`${Z}.socks5.${X}`,`${Z}.socks5.${X} is required and must be a non-empty string`);return}if(Q[0]==="smtp"){let Y=$.smtp;if(!LX(Y))h1(`${Z}.smtp`,`${Z}.smtp must be an object with \`username\` and \`password\``);for(let X of Object.keys(Y))if(!["username","password"].includes(X))h1(`${Z}.smtp.${X}`,`${Z}.smtp has unknown field \`${X}\`. Expected: username, password`);for(let X of["username","password"])if(typeof Y[X]!=="string"||Y[X].length===0)h1(`${Z}.smtp.${X}`,`${Z}.smtp.${X} is required and must be a non-empty string`);return}if(Q[0]==="headers"){let Y=$.headers;if(!LX(Y))h1(`${Z}.headers`,`${Z}.headers must be an object of header name to value`);for(let[X,J]of Object.entries(Y))if(typeof J!=="string")h1(`${Z}.headers.${X}`,`${Z}.headers.${X} must be a string`)}else{let Y=$.postgres;if(!LX(Y))h1(`${Z}.postgres`,`${Z}.postgres must be an object with \`username\` and \`password\``);for(let J of Object.keys(Y))if(!["username","password","database"].includes(J))h1(`${Z}.postgres.${J}`,`${Z}.postgres has unknown field \`${J}\`. Expected: username, password, database`);let X=Y;for(let J of["username","password"])if(typeof X[J]!=="string"||X[J].length===0)h1(`${Z}.postgres.${J}`,`${Z}.postgres.${J} is required and must be a non-empty string`);if(X.database!==void 0&&typeof X.database!=="string")h1(`${Z}.postgres.database`,`${Z}.postgres.database must be a string`)}}function Xa4($,Z){let Q=$;return Z.forEach((Y,X)=>{let J=Za4(Y);if(Q===void 0)Q=J;else if(Q!==J)h1(`transform[${X}]`,`transform requires protocol \`${J}\` but the rule is \`${Q}\`; a rule terminates one protocol`)}),Q??"http"}function Ja4($,Z){if(!LX($)||Object.keys($).some((Q)=>Q!=="method"&&Q!=="path"))h1(Z,`${Z} must be an object containing only method and path`);if($.method!==void 0&&(!Array.isArray($.method)||$.method.some((Q)=>typeof Q!=="string"||Q.length===0||/[^!#$%&'*+.^_`|~0-9A-Za-z-]/.test(Q))))h1(`${Z}.method`,`${Z}.method must be an array of HTTP method tokens`);if($.path!==void 0){let Q=$.path;if(!LX(Q)||Object.keys(Q).length!==1||typeof Q.exact!=="string"||!Q.exact.startsWith("/")||/[\s?#]/.test(Q.exact))h1(`${Z}.path`,`${Z}.path must contain exact: an absolute path without a query or fragment`)}}function Rk$($,Z){if(!LX($))h1(Z||"rule",`${Z||"rule"} must be an object`);for(let H of Object.keys($))if(!zk$.includes(H))h1(`${Z}${H}`,`Unknown field \`${H}\`. Expected one of: ${zk$.join(", ")}`);let Q=$;if(Q.action===void 0)h1(`${Z}action`,`${Z}action is required. Write \`action: "allow"\` \u2014 every rule states what it does rather than defaulting to it`);if(Q.action!=="allow")h1(`${Z}action`,`${Z}action must be "allow" (got \`${String(Q.action)}\`). Only allow rules exist today`);if(Q.protocol!==void 0&&!Uk$.includes(Q.protocol))h1(`${Z}protocol`,`${Z}protocol must be one of: ${Uk$.join(", ")} (got \`${String(Q.protocol)}\`)`);let Y=Q.source??{},X=Q.destination??{};Pk$(Y,"source"),Pk$(X,"destination");let J=Q.transform??[];if(!Array.isArray(J))h1(`${Z}transform`,`${Z}transform must be an array`);J.forEach((H,F)=>Ya4(H,`${Z}transform[${F}]`));let G=Xa4(Q.protocol,J);if(Q.match!==void 0){if(Ja4(Q.match,`${Z}match`),G!=="http"||Y.public===!0||!(X.public===!0||X.host!==void 0))h1(`${Z}match`,"match requires HTTP egress from a VM or VPC to a public origin or host")}if(J.some((H)=>("s3"in H))){if(J.length!==1||Q.match!==void 0||Y.public===!0||!(X.public===!0||X.host!==void 0)||Q.domain.includes("*"))h1(`${Z}transform`,"s3 requires a sole transform on HTTP egress to a concrete origin, without match")}let W=J.filter((H)=>("jsonPatch"in H));if(W.length>1)h1(`${Z}transform`,"a rule may carry only one jsonPatch transform");if(W.length&&(Y.public===!0||!(X.public===!0||X.host!==void 0)))h1(`${Z}transform`,"jsonPatch requires HTTP egress from a VM or VPC to a public origin or host");if(Q.forwardAuth!==void 0){er4(Q.forwardAuth,`${Z}forwardAuth`);let H=X.vmId!==void 0||!f80(X)&&X.port!==void 0;if(G!=="http"||Y.public!==!0||!H||Q.domain==="*")h1(`${Z}forwardAuth`,`${Z}forwardAuth is only supported on HTTP public ingress: \`{ public: true } -> { vmId, port }\``)}if(G==="smtp")$a4(Q.domain);else pQ1(Q.domain);if((Y.vmId!==void 0||Y.vpcId!==void 0)&&X.vmId!==void 0&&J.length>0)h1(`${Z}transform`,"a VM-to-VM rule cannot carry a transform yet \u2014 remove it (only public ingress/egress rules run transforms)");if(G==="tcp"){let H=X.public===!0||X.host!==void 0,F=Y.vmId!==void 0||Y.vpcId!==void 0;if(H||F)h1(`${Z}protocol`,"a `tcp` rule is public ingress only \u2014 `{ public: true } -> { vmId, port }`. The edge splices the session without terminating it, so outbound there is nothing to broker (an outbound allow is a firewall rule, and injecting into one needs `http` or `postgres`) and inward there is no certificate to answer the source with. Give the source `public: true`, or drop `protocol` to be served as HTTPS")}else if(G==="imap"||G==="imaps"){let H=X.public===!0||X.host!==void 0,F=Y.vmId!==void 0||Y.vpcId!==void 0;if(H||F)h1(`${Z}protocol`,`an \`${G}\` rule is public ingress only \u2014 \`{ public: true } -> { vmId, port }\`. The 993 front serves mail clients reaching a VM's IMAP server; outbound there is nothing to broker (an outbound allow is a firewall rule) and inward there is no certificate to answer the source with`)}else if(G==="socks5"){let H=X.public===!0||X.host!==void 0;if(Y.public===!0||!H)h1(`${Z}protocol`,'a `socks5` rule is egress only \u2014 `{ vmId } -> { host: "gate.provider.com", port: 1080 }`. The front exists so a guest can open sessions through a proxy whose credentials it never holds; inbound there is nothing to serve, and publishing one would be an open proxy on a platform address');if(X.host===void 0)h1(`${Z}destination`,"a `socks5` rule has to name the proxy it goes through: give the destination a `host` and the `port` the provider listens on. `{ public: true }` on its own asks the edge to be the proxy, which would let the guest out on our address rather than through yours")}else if(G==="postgres"){let H=J.some((U)=>U!==null&&typeof U==="object"&&("postgres"in U)),F=X.public===!0||X.host!==void 0;if(H&&!F)h1(`${Z}transform`,"a `postgres` transform belongs on an egress rule: the edge spends a credential the guest never holds, so pointing it at your own VM would hand every client a logged-in session. Give the destination `public: true` or a `host`, or drop the transform")}else if(G==="smtp"){let H=J.some((U)=>U!==null&&typeof U==="object"&&("smtp"in U)),F=X.public===!0||X.host!==void 0;if(H&&!F)h1(`${Z}transform`,"an `smtp` transform belongs on an egress rule: the edge spends a credential the guest never holds, so pointing it at your own VM would turn it into an open relay. Give the destination `public: true` or a `host`, or drop the transform");if(typeof Q.domain==="string"&&Q.domain.includes("@")&&Y.public!==!0)h1(`${Z}domain`,`\`${Q.domain}\` names a mailbox, which only makes sense on a rule that receives mail. An egress or VM-to-VM rule names the host the guest submits through \u2014 drop the part before \`@\``)}return{...Q,source:Y,destination:X}}function Ga4($,Z){if($==="source")return rr4(Z)?"source is empty. Say who opens the session: `vmId`, `vpcId`, or `public: true`":"source only narrows the session without saying who opens it. Add `vmId`, `vpcId`, or `public: true`";return"destination is empty. Say where the session lands: `vmId` + `port`, `host` + `port`, or `public: true` for the domain's own origin"}function Ak$($){let Z=Rk$($,"");for(let Q of["source","destination"]){let Y=Z[Q];if(!f80(Y))h1(Q,Ga4(Q,Y))}if(Z.source.public===!0&&Z.destination.public===!0)h1("destination","a rule from the public Internet to the domain's own origin allows nothing the world cannot already do. Did you mean a `vmId` destination (ingress) or a `vmId` source (egress)?");return Z}function qk$($){if(!LX($))h1("tls","tls must be an object with a `rules` array");for(let Q of Object.keys($))if(Q!=="rules")h1(`tls.${Q}`,`tls has unknown field \`${Q}\`. Expected: rules`);let Z=$.rules;if(!Array.isArray(Z))h1("tls.rules","tls.rules must be an array");return Z.forEach((Q,Y)=>{let X=`tls.rules[${Y}].`,J=Rk$(Q,X),G=f80(J.source),W=f80(J.destination);if(!G&&!W)h1(`tls.rules[${Y}]`,`tls.rules[${Y}]: both source and destination refer to the VM being created, which allows nothing. Give one of them a \`vmId\`, \`vpcId\`, or \`public: true\``);if(G&&W)h1(`tls.rules[${Y}]`,`tls.rules[${Y}]: neither end refers to the VM being created. Leave one endpoint's identity unset so it means this VM, or create the rule with tls.rules.create instead`);if(!W&&J.destination.port===void 0)h1(`tls.rules[${Y}].destination.port`,`tls.rules[${Y}]: destination.port is required: say which port on this VM the session lands on`)}),$}function dQ1($){return`/v5/tls/${i6($)}`}function iQ1($){return`/v5/tls/forward-auth/${i6($)}`}class Mk${client;constructor($){this.client=$}list(){return this.client.get("/v5/tls/forward-auth")}async create($){let Z=jk$($);return this.client.post("/v5/tls/forward-auth",Z)}get($){return this.client.get(iQ1($))}async update($,Z){let Q=jk$(Z);return this.client.put(iQ1($),Q)}delete($){return this.client.delete(iQ1($))}}class Ik${client;constructor($){this.client=$}async create($){let Z=Ak$($);return this.client.post("/v5/tls",Z)}list($={}){return this.client.get("/v5/tls",$)}get($){return this.client.get(dQ1($))}async update($,Z){let Q=Ak$(Z);return this.client.put(dQ1($),Q)}delete($){return this.client.delete(dQ1($))}}class oQ1{client;rules;forwardAuth;constructor($){this.client=$,this.rules=new Ik$($),this.forwardAuth=new Mk$($)}}var nQ1,tQ1,Fk$,mr4,Uk$,dr4=253,ir4=63,Nk$,Bk$,pr4,nr4,tr4=2048,Dk$=32,Lk$=16384,Ok$=32,wk$=32,or4=128,sr4,Ek$="!#$%&'*+-/=?^_`{|}~.",zk$;var mq0=L(()=>{TK();nQ1=class nQ1 extends Error{path;constructor($,Z){super(Z);this.name="TlsRuleValidationError",this.path=$,Object.setPrototypeOf(this,nQ1.prototype)}};tQ1=class tQ1 extends Error{path;constructor($,Z){super(Z);this.name="TlsForwardAuthValidationError",this.path=$,Object.setPrototypeOf(this,tQ1.prototype)}};Fk$=["vmId","vpcId","public","host","port"],mr4=["vmId","vpcId","public","host"],Uk$=["tcp","http","postgres","minecraft","smtp","imap","imaps","socks5"],Nk$=["url","headers","timeoutMs","protectedCookies","authResponseHeaders"],Bk$=["id"],pr4=/^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/,nr4=/^[0-9A-Za-z-]+$/,sr4=new Set(["host","content-length","connection","keep-alive","proxy-authenticate","proxy-authorization","proxy-connection","te","trailer","transfer-encoding","upgrade"]);zk$=["action","domain","protocol","source","destination","transform","match","forwardAuth"]});function Si($){return`/v5/tunnels/${i6($)}`}function yy($){return $.tunnelId??=$.id,$}class sQ1{client;constructor($){this.client=$}list(){return this.client.get("/v5/tunnels").then(($)=>{return $.tunnels.forEach(yy),$})}create($={}){return this.client.post("/v5/tunnels",$).then(yy)}get($){return this.client.get(Si($)).then(yy)}update($,Z){return this.client.patch(Si($),Z).then(yy)}rotateKey($,Z={}){return this.client.post(`${Si($)}/rotate-key`,Z).then(yy)}delete($){return this.client.delete(Si($))}attachVpc($,Z,Q={}){return this.client.post(`${Si($)}/vpcs/${i6(Z)}`,Q).then(yy)}detachVpc($,Z){return this.client.delete(`${Si($)}/vpcs/${i6(Z)}`).then(yy)}}var rQ1=L(()=>{TK()});class aQ1{client;basePath;constructor($,Z){this.client=$,this.basePath=Z}async readFile($,Z={}){let Q=await this.openRead($,Z);return new Uint8Array(await Q.arrayBuffer())}async readTextFile($,Z={}){return await(await this.openRead($,Z)).text()}async readFileStream($,Z={}){let Q=await this.openRead($,Z);if(!Q.body)throw Error(`no response body reading ${$}`);return Q.body}async writeFile($,Z,Q={}){let Y=typeof Z==="string"?new TextEncoder().encode(Z):Z,X=Y instanceof Uint8Array?Y.byteLength:Y.size;if(X>Wa4)return this.uploadInChunks($,Y,X,Q);let J=Y instanceof Uint8Array?Y:new Uint8Array(await Y.arrayBuffer());await this.client.putBytes(`${this.basePath}/fs/write`,J,{path:$,mode:Q.mode,sha256:await Vk$(J)},Q.signal),Q.onProgress?.({completedBytes:X,totalBytes:X})}writeTextFile($,Z,Q={}){return this.writeFile($,Z,Q)}async readDir($){let{entries:Z}=await this.client.get(`${this.basePath}/fs/dir`,{path:$});return Z}async mkdir($){await this.client.post(`${this.basePath}/fs/mkdir`,{path:$})}async remove($){await this.client.delete(`${this.basePath}/fs/remove`,{path:$})}async exists($){let{exists:Z}=await this.client.get(`${this.basePath}/fs/exists`,{path:$});return Z}stat($){return this.client.get(`${this.basePath}/fs/stat`,{path:$})}openRead($,Z){let{offset:Q,length:Y}=Z,X;if(Q!==void 0||Y!==void 0){let J=Q??0;X=Y===void 0?`bytes=${J}-`:`bytes=${J}-${J+Y-1}`}return this.client.getBytes(`${this.basePath}/fs/read`,{path:$},{range:X,signal:Z.signal})}async uploadInChunks($,Z,Q,Y){let X=Y.chunkSize??Ka4,J=Y.maxAttempts??Ha4,G=Z instanceof Uint8Array?await Vk$(Z):void 0,W=await this.client.post(`${this.basePath}/fs/uploads`,{path:$,size:Q,sha256:G,mode:Y.mode}),K=`${this.basePath}/fs/uploads/${W.uploadId}`;try{let H=W.receivedBytes;while(H<Q){let F=Math.min(H+X,Q),U=Z instanceof Uint8Array?Z.subarray(H,F):Z.slice(H,F);H=(await this.putChunkWithRetry(K,U,H,J,Y.signal)).receivedBytes,Y.onProgress?.({completedBytes:Math.min(H,Q),totalBytes:Q})}await this.client.post(`${K}/commit`)}catch(H){throw await this.client.delete(K).catch(()=>{}),H}}async putChunkWithRetry($,Z,Q,Y,X){let J;for(let G=1;G<=Y;G++){X?.throwIfAborted?.();try{return await this.client.putBytes($,Z,{offset:Q},X)}catch(W){if(J=W,!(!(W instanceof qJ)||W.status>=500||W.status===408||W.status===409||W.status===429)||X?.aborted||G===Y)throw W;await Fa4(Math.min(500*2**(G-1),8000));let H=await this.client.get($).catch(()=>{return});if(H&&H.receivedBytes>Q)return H}}throw J}}async function Vk$($){let Z=globalThis.crypto?.subtle;if(!Z)return;let Q=await Z.digest("SHA-256",$);return Array.from(new Uint8Array(Q),(Y)=>Y.toString(16).padStart(2,"0")).join("")}function Fa4($){return new Promise((Z)=>setTimeout(Z,$))}var Wa4=8388608,Ka4=16777216,Ha4=5;var eQ1=L(()=>{b80()});function Ua4(){return typeof process<"u"&&Boolean(process.versions?.node)}async function kk$($,Z){if(Ua4()){let Y;try{Y=await import("ws")}catch{throw Error("PTY sessions need the `ws` package in Node. Install it with `npm install ws`.")}return new Y.default($,{headers:Z})}let Q=globalThis.WebSocket;if(!Q)throw Error("PTY sessions need a WebSocket client; no global WebSocket is available in this environment.");return new Q($)}function y80($,Z,Q){if($.on){$.on(Z,Q);return}$.addEventListener?.(Z,Q)}function Ba4($,Z){if($&&typeof $==="object"&&"data"in $){let Q=$.data;if(typeof Q==="string")return{text:Q};if(Q instanceof ArrayBuffer)return{binary:new Uint8Array(Q)};return{}}if($ instanceof Uint8Array)return Z?{binary:$}:{text:Na4.decode($)};if(typeof $==="string")return{text:$};return{}}class $Y1{_sessionId;_slug;_created=!1;socket;constructor($,Z,Q={}){this.socket=$,this._sessionId=Z,y80($,"message",(Y,X)=>{let{text:J,binary:G}=Ba4(Y,X);if(G){Q.onData?.(G);return}if(!J)return;let W;try{W=JSON.parse(J)}catch{return}if(W.type==="exited")Q.onExit?.(W.exitCode);else if(W.type==="error")Q.onError?.(Error(W.message));else if(W.type==="sessionInfo")this._sessionId=W.sessionId,this._slug=W.slug,this._created=W.created??!0,Q.onSessionInfo?.(W.sessionId)}),y80($,"close",(Y)=>{let X=Y;Q.onClose?.({wasClean:X?.wasClean??!0,code:X?.code??1000,reason:X?.reason??""})}),y80($,"error",(Y)=>Q.onError?.(Y))}write($){this.socket.send(typeof $==="string"?new TextEncoder().encode($):$)}resize($){this.sendControl({type:"resize",cols:$.cols,rows:$.rows})}signal($){this.sendControl({type:"signal",signal:$})}sendControl($){this.socket.send(JSON.stringify($))}detach(){this.socket.close()}get sessionId(){return this._sessionId}get slug(){return this._slug}get created(){return this._created}get readyState(){return this.socket.readyState}}function Da4($){return new Promise((Z,Q)=>{if($.readyState===1){Z();return}y80($,"open",()=>Z()),y80($,"error",(Y)=>Q(Y))})}class ZY1{client;basePath;constructor($,Z){this.client=$,this.basePath=Z}async open($={}){let{exec:Z,cols:Q,rows:Y,linuxUser:X,slug:J,replaceOnExit:G,onData:W,onExit:K,onClose:H,onError:F}=$,U={};if(Z!==void 0)U.exec=Z;if(Q!==void 0)U.cols=Q;if(Y!==void 0)U.rows=Y;if(X!==void 0)U.linuxUser=X;if(J!==void 0)U.slug=J;if(G!==void 0)U.replaceOnExit=String(G);let N=Sk$(this.client,`${this.basePath}/pty`,U),B=this.client.authHeaders(),D=await kk$(N,B);return new Promise((O,w)=>{let j=!1,E=new $Y1(D,-1,{onData:W,onExit:K,onClose:(P)=>{if(!j)j=!0,w(Error("connection closed before sessionInfo"));H?.(P)},onError:(P)=>{if(!j)j=!0,w(P);F?.(P)},onSessionInfo:()=>{j=!0,O(E)}})})}async attach($){let{session:Z,linuxUser:Q,onData:Y,onExit:X,onClose:J,onError:G}=$,W=Sk$(this.client,`${this.basePath}/pty/sessions/${i6(String(Z))}`,{...Q!==void 0?{linuxUser:Q}:{}}),K=this.client.authHeaders(),H=await kk$(W,K),F=new $Y1(H,typeof Z==="number"?Z:-1,{onData:Y,onExit:X,onClose:J,onError:G});return await Da4(H),F}list($={}){return this.client.get(`${this.basePath}/pty/sessions`,$)}close($,Z={}){return this.client.delete(`${this.basePath}/pty/sessions/${i6(String($))}`,Z)}}class QY1{pty;linuxUser;constructor($,Z){this.pty=$,this.linuxUser=Z}open($={}){return this.pty.open({...$,linuxUser:this.linuxUser})}attach($){return this.pty.attach({...$,linuxUser:this.linuxUser})}list(){return this.pty.list({linuxUser:this.linuxUser})}close($){return this.pty.close($,{linuxUser:this.linuxUser})}}function Sk$($,Z,Q){return $.url(Z,Q).replace(/^http/,"ws")}var Na4;var YY1=L(()=>{TK();Na4=new TextDecoder});class XY1{client;constructor($){this.client=$}list($={}){return this.client.get("/v5/snapshots",$)}get($){return this.client.get(`/v5/snapshots/${i6($)}`)}update($,Z){return this.client.patch(`/v5/snapshots/${i6($)}`,Z)}delete($){return this.client.delete(`/v5/snapshots/${i6($)}`)}}var JY1=L(()=>{TK()});var Ck$=()=>{};function GY1($){return`/v5/vms/${i6($)}`}class WY1{id;fs;pty;client;basePath;constructor($,Z){this.client=$,this.id=Z,this.basePath=GY1(Z),this.fs=new aQ1($,this.basePath),this.pty=new ZY1($,this.basePath)}data(){return this.client.get(this.basePath)}firewallRules(){return this.client.get("/v5/firewall/rules",{vmId:this.id})}update($){return this.client.patch(this.basePath,$)}start(){return this.client.post(`${this.basePath}/start`)}pause(){return this.client.post(`${this.basePath}/pause`)}resize($){return this.client.post(`${this.basePath}/resize`,$)}delete(){return this.client.delete(this.basePath)}exec($){let Z=typeof $==="string"?{command:$}:$;return this.client.post(`${this.basePath}/exec-await`,Z)}linuxUser($){return new _k$(this,$)}snapshot($={}){return this.client.post(`${this.basePath}/snapshot`,$)}}class _k${vm;linuxUser;pty;constructor($,Z){this.vm=$,this.linuxUser=Z,this.pty=new QY1($.pty,Z)}exec($){let Z=typeof $==="string"?{command:$}:$;return this.vm.exec({...Z,linuxUser:this.linuxUser})}}class KY1{client;snapshots;constructor($){this.client=$,this.snapshots=new XY1($)}async create($){if(cq0($.firewall,"VM"),$.tls!==void 0)qk$($.tls);let Z=await this.client.post("/v5/vms",$);return{vm:new WY1(this.client,Z.id),vmId:Z.id,data:Z,firewallRules:Z.firewallRules??[],tlsRules:Z.tlsRules??[]}}list($={}){return this.client.get("/v5/vms",$)}get($){return this.client.get(GY1($))}ref($){return new WY1(this.client,$)}delete($){return this.client.delete(GY1($))}}var HY1=L(()=>{x80();mq0();TK();eQ1();YY1();JY1();Ck$();eQ1();YY1();JY1()});function FY1($){return`/v5/vpcs/${i6($)}`}class vk${client;basePath;constructor($,Z){this.client=$,this.basePath=Z}list(){return this.client.get(`${this.basePath}/tunnels`)}}class UY1{id;tunnels;client;basePath;constructor($,Z){this.client=$,this.id=Z,this.basePath=FY1(Z),this.tunnels=new vk$($,this.basePath)}data(){return this.client.get(this.basePath)}update($){return this.client.patch(this.basePath,$)}delete(){return this.client.delete(this.basePath)}}class NY1{client;constructor($){this.client=$}list(){return this.client.get("/v5/vpcs")}async create($={}){if($.firewall!==void 0)cq0($.firewall,"network");let Z=await this.client.post("/v5/vpcs",$);return{vpc:new UY1(this.client,Z.id),vpcId:Z.id,data:Z,firewallRules:Z.firewallRules??[]}}get($){return this.client.get(FY1($))}ref($){return new UY1(this.client,$)}delete($){return this.client.delete(FY1($))}}var BY1=L(()=>{x80();TK()});class dq0{client;vms;vpc;tunnels;firewall;tls;domains;identities;constructor($={}){this.client=new vQ1($),this.vms=new KY1(this.client),this.vpc=new NY1(this.client),this.tunnels=new sQ1(this.client),this.firewall=new hQ1(this.client),this.tls=new oQ1(this.client),this.domains=new bQ1(this.client),this.identities=new cQ1(this.client)}fetch($,Z){return this.client.fetch($,Z)}}var bk$=L(()=>{TK();xQ1();x80();mQ1();mq0();rQ1();HY1();BY1();TK();b80();HY1();BY1();rQ1();xQ1();x80();mq0();mQ1()});var fk$;var xk$=L(()=>{fk$={name:"@decocms/sandbox",version:"1.92.1",private:!0,type:"module",description:"Sandbox runtime for isolated Studio tool execution",scripts:{check:"tsc --noEmit",test:"bun test",build:"bun run build:typegen && bun run build:harness-runner","build:typegen":"mkdir -p dist && bun run --cwd=../typegen build && bun --cwd=../typegen pm pack --filename $PWD/dist/typegen.tgz --quiet","build:harness-runner":"mkdir -p dist && bun --cwd=../harness-runner pm pack --filename $PWD/dist/harness-runner.tgz --quiet"},exports:{"./shared":"./shared.ts","./provider":"./server/provider/index.ts","./provider/agent-sandbox":"./server/provider/agent-sandbox/index.ts","./provider/postgres-state-store":"./server/provider/postgres-state-store.ts","./provider/freestyle":"./server/provider/freestyle.ts","./provider/remote":"./server/provider/remote.ts","./provider/router":"./server/provider/router.ts","./provider/sandbox-api":"./server/provider/sandbox-api.ts","./provider/sandbox-server":"./server/provider/sandbox-server.ts","./daemon-client":"./server/daemon-client.ts","./org-fs":"./org-fs.ts","./dispatch":"./dispatch/index.ts","./dispatch/*":"./dispatch/*.ts","./proxy/http":"./proxy/http.ts","./proxy/websocket":"./proxy/websocket.ts"},dependencies:{"@decocms/shared":"workspace:*","@kubernetes/client-node":"^1.4.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0",freestyle:"0.2.16",zod:"4.3.6"},devDependencies:{"@types/bun":"latest",postgres:"^3.4.5",typescript:"^7.0.2"}}});function iq0($){let Z=$?.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of studio-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"});return async(Q,Y)=>{if(!Z)return Y();let X=performance.now(),J=(G)=>Z.record(performance.now()-X,{runner_kind:Q,source:"daemon",status_code:G});try{let G=await Y();return J(G.status),G}catch(G){throw J(0),G}}}var TL;var pq0=L(()=>{TL={kubernetes:"agent-sandbox",freestyle:"freestyle"}});var pk$={};O6(pk$,{FreestyleSandboxProvider:()=>dk$});import{createHash as yk$,createHmac as Oa4,randomBytes as wa4}from"crypto";class dk${apiKey;freestyle;lookupClient;image;sidecarImage;idleTimeoutSeconds;idlePauseMs;autoDeleteSeconds;domainSuffix;timeDaemonRequest;inflight=new by;snapshotInflight=new by;knownSnapshots=new Set;lookups=new Map;releaseTimers=new Map;idleSweep=null;sweeping=!1;repoSnapshots=new Map;repoSnapshotBuilds=new Set;repoSnapshotFailures=new Map;constructor($){if(this.apiKey=$.apiKey,this.freestyle=$.client??new dq0({apiKey:$.apiKey}),this.lookupClient=$.client??new dq0({apiKey:$.apiKey,fetch:Object.assign((Z,Q)=>fetch(Z,{...Q,signal:Q?.signal?AbortSignal.any([Q.signal,AbortSignal.timeout(jY1)]):AbortSignal.timeout(jY1)}),{preconnect:fetch.preconnect})}),this.image=$.image??`ghcr.io/decocms/studio/studio-sandbox-go:${fk$.version}`,this.sidecarImage=$.orgFsSidecarImage??Ea4,this.idleTimeoutSeconds=$.idleTimeoutSeconds??300,this.idlePauseMs=$.idlePauseMs??600000,this.autoDeleteSeconds=$.autoDeleteSeconds??86400,this.domainSuffix=$.domainSuffix??"style.dev",this.timeDaemonRequest=iq0($.meter),this.idlePauseMs>0)this.idleSweep=setInterval(()=>void this.pauseIdle(),ka4),this.idleSweep.unref?.()}async owns($){return await this.find($)!==null}daemonUrl($){return`https://${$}.${this.domainSuffix}`}async find($,Z={}){let Q=this.lookups.get($);if(!Z.refresh&&Q&&Date.now()-Q.at<(Q.found?qa4:Ma4))return Q.found;let Y=null;try{let X=await this.lookupClient.vms.get($),J=X.metadata[DY1];if(J)Y={vm:this.freestyle.vms.ref(X.id),daemon:{url:this.daemonUrl($),token:J}}}catch(X){if(!(X instanceof qJ&&X.status===404))throw X}return this.remember($,Y),Y}remember($,Z){if(this.lookups.delete($),this.lookups.size>=Ia4){let Q=this.lookups.keys().next();if(!Q.done)this.lookups.delete(Q.value)}this.lookups.set($,{found:Z,at:Date.now()})}async warm(){await this.baseSnapshot().catch(($)=>console.warn(`[${s7}] base snapshot warm failed: ${hy($)}`))}baseSnapshot(){let{image:$,sidecarImage:Z}=this,Q=`studio-sandbox-${yk$("sha256").update(`${$}
 ${Z}
 running`).digest("hex").slice(0,16)}`;if(this.knownSnapshots.has(Q))return Promise.resolve(Q);return this.snapshotInflight.run(Q,async()=>{if(await this.snapshotExists(Q))return this.knownSnapshots.add(Q),Q;console.log(`[${s7}] building base snapshot ${Q} for ${$}`);let{vm:Y}=await this.freestyle.vms.create({ttlSeconds:1800,firewall:{rules:[{action:"allow",source:{},destination:{public:!0}}]}});try{await this.run(Y,`docker pull -q ${_i($)} && docker pull -q ${_i(Z)}`,{timeoutMs:LY1}),await this.startContainers(Y,this.sentinelToken(Q)),await this.run(Y,`for i in $(seq 1 240); do curl -sf -o /dev/null http://127.0.0.1:${gy}/health && exit 0; sleep 0.5; done; exit 1`,{timeoutMs:tq0+1e4}),await Y.snapshot({slug:Q}),this.knownSnapshots.add(Q)}catch(X){if(!await this.snapshotExists(Q))throw X}finally{await Y.delete().catch(()=>{})}return Q})}sentinelToken($){return Oa4("sha256",this.apiKey).update(`daemon-sentinel:${$}`).digest("hex").slice(0,48)}async startContainers($,Z){let Q={DAEMON_TOKEN:Z,APP_ROOT:JP,PROXY_PORT:String(gy),ORGFS_SIDECAR_CONFIG_PATH:`${nq0}/config.json`,ORGFS_SIDECAR_STATUS_PATH:`${nq0}/status.json`},Y=Object.keys(Q).map((X)=>`-e ${_i(X)}`).join(" ");await this.run($,`sudo sh -c ${_i(Pa4)} && docker run -d --name ${gk$} --restart=always --privileged --device /dev/fuse -e APP_ROOT=${JP} -e ORGFS_FEED_IDLE_MS=60000 -v ${GP}:${JP}/org:rshared -v ${vi}:${nq0} ${_i(this.sidecarImage)}`,{timeoutMs:LY1}),await this.run($,`docker run -d --name ${Ci} --restart=always -p ${gy}:${gy} -v ${GP}:${JP}/org:rslave -v ${vi}:${nq0} ${Y} ${_i(this.image)}`,{env:Q,timeoutMs:LY1})}async repoSnapshotFor($,Z){let Q=$.repo;if(!$.repoSnapshot||!Q||!$.tenant)return null;if(($.sandboxImage??"default")!=="default")return null;let Y=AK(Q.cloneUrl)?.toLowerCase();if(!Y)return null;let X=`${Z}
 ${$.tenant.orgId}
@@ -1500,7 +1500,7 @@ Guidelines:
 Guidelines:
 - Include file paths, function names, and specific code locations discovered during exploration.
 - List concrete implementation steps in order.
-- Note any risks, dependencies, or trade-offs.`,LI0=t$({description:VZ6,inputSchema:s(MZ6),outputSchema:s(IZ6)})});function AF($){return`studio-storage://${$}`}function $g($){if($.startsWith("studio-storage://"))return $.slice(17);if($.startsWith("mesh-storage://"))return $.slice(15);return null}function SJ1(){return/(?:studio|mesh)-storage:\/\/([^\s"'<>[\]]+)/g}var OI0=()=>{};import{lookup as kZ6}from"dns/promises";import{z as Zg}from"zod";function wI0($){if($>Bg$){let Z=($/1048576).toFixed(1),Q=Bg$/1048576;throw Error(`Reference image too large: ${Z} MB (max ${Q} MB). Use a smaller image.`)}}function _Z6($,Z){let Q;try{Q=new URL($)}catch{throw Error("Invalid image URL")}if(Q.protocol!=="https:"&&!(Z&&Q.protocol==="http:"))throw Error("Image URL must use HTTPS");for(let Y of CZ6)if(Y.test(Q.hostname))throw Error("Image URL must not point to a private network address")}function vZ6($){let Z=$.match(/^(\d+)\.(\d+)\.(\d+)\.(\d+)$/);if(Z){let Y=Number(Z[1]),X=Number(Z[2]);if(Y===127||Y===10||Y===0)return!0;if(Y===172&&X>=16&&X<=31)return!0;if(Y===192&&X===168)return!0;if(Y===169&&X===254)return!0;return!1}let Q=$.toLowerCase();return Q==="::1"||Q.startsWith("::ffff:")||Q.startsWith("fc")||Q.startsWith("fd")||Q.startsWith("fe80")}async function bZ6($,Z=async(Q)=>(await kZ6(Q,{all:!0})).map((Y)=>Y.address)){let Q=new URL($).hostname;if(/^\d+\.\d+\.\d+\.\d+$/.test(Q)||Q.startsWith("[")&&Q.endsWith("]"))return;let X;try{X=await Z(Q)}catch{throw Error("Image URL must not point to a private network address")}if(X.length===0||X.some(vZ6))throw Error("Image URL must not point to a private network address")}async function Og$($,Z){if(!Z?.getBytes)throw Error("Object storage read is not available");if(Z.head){let{size:Y}=await Z.head($);wI0(Y)}let Q=await Z.getBytes($);return wI0(Q.byteLength),Q}async function xZ6($,Z){let Q=$g($);if(Q!==null)return Og$(Q,Z.objectStorage);let Y=$.match(SZ6);if(Y)return Og$(Y[1],Z.objectStorage);if($.startsWith("data:")){let K=$.match(/^data:[^;]+;base64,(.+)$/s);if(!K)throw Error("Invalid data: URI");let H=Buffer.from(K[1],"base64");return wI0(H.byteLength),H}_Z6($,Z.allowHttpExternalUrls===!0),await bZ6($);let X=AbortSignal.timeout(Dg$),J=Z.abortSignal?AbortSignal.any([Z.abortSignal,X]):X,G;try{G=await fetch($,{signal:J,redirect:"manual"})}catch(K){if(K instanceof Error&&K.name==="TimeoutError")throw Error(`Fetching image from ${$} timed out after ${Dg$}ms`);throw K}if(G.status>=300&&G.status<400)throw Error(`Refusing to follow a redirect fetching image from ${$}`);if(!G.ok)throw Error(`Failed to fetch image from ${$}: ${G.status}`);let W=new Uint8Array(await G.arrayBuffer());return wI0(W.byteLength),W}async function k40($,Z){let{provider:Q,imageModelInfo:Y,objectStorage:X}=Z,J=Q.aiSdk.imageModel(Y.id),G=$.referenceImages&&$.referenceImages.length>0,W=G?await Promise.all($.referenceImages.map((O)=>{let w=O.uri??O.url;if(!w)throw Error("Reference image missing uri");return xZ6(w,Z)})):[],K=G?{text:$.prompt,images:W}:$.prompt,H=AbortSignal.timeout(Lg$),F=Z.abortSignal?AbortSignal.any([Z.abortSignal,H]):H,U;try{U=await $I0({model:J,prompt:K,n:$.n??1,...$.aspectRatio?{aspectRatio:$.aspectRatio}:{},abortSignal:F})}catch(O){if(H.aborted&&!Z.abortSignal?.aborted)throw Error(`Image generation timed out after ${Lg$}ms`);throw O}if(!X)throw Error("Object storage is unavailable; cannot persist the generated image.");let N=$.n??1,B=U.images.length>N?U.images.slice(-N):U.images;return{success:!0,images:await Promise.all(B.map(async(O)=>{let w=O.mediaType??"image/png",j=w.split("/")[1]??"png",E=`generated-images/${crypto.randomUUID()}.${j}`,P=Uint8Array.from(atob(O.base64),(T)=>T.charCodeAt(0));return await X.put(E,P,{contentType:w}),{uri:AF(E),mediaType:w}})),prompt:$.prompt,model:Y.id,usage:{inputTokens:U.usage.inputTokens??0,outputTokens:U.usage.outputTokens??0},usedReferenceImages:G?$.referenceImages.length:0}}function jI0($,Z){return t$({description:CJ1,inputSchema:s(Qg),execute:async(Q,Y)=>{let X=performance.now();try{return await k40(Q,Z)}finally{$.write({type:"data-tool-metadata",id:Y.toolCallId,data:{latencyMs:performance.now()-X}})}}})}var SZ6,Bg$=20971520,Dg$=45000,Lg$=120000,Qg,CZ6,CJ1;var Np=L(()=>{u4();u4();OI0();SZ6=/\/api\/[^/]+\/files\/([^?#]+)/,Qg=Zg.object({prompt:Zg.string().max(1e4).describe("Detailed description of the image to generate. Be specific about style, composition, colors, and subject matter."),referenceImages:Zg.array(Zg.object({uri:Zg.string().describe("URI of the reference image (e.g. studio-storage://generated-images/uuid.png).")})).max(10).optional().describe("Reference images to use as input for image-to-image generation. Pass the URI of any image from the conversation (uploaded files, previously generated images, etc.) when the user wants to modify, transform, or use an existing image as a starting point."),aspectRatio:Zg.enum(["1:1","16:9","9:16","4:3","3:4","3:2","2:3"]).optional().describe("Aspect ratio for the generated image. Defaults to 1:1."),n:Zg.number().int().min(1).max(4).optional().describe("Number of images to generate. Defaults to 1.")}),CZ6=[/^127\./,/^10\./,/^172\.(1[6-9]|2\d|3[01])\./,/^192\.168\./,/^169\.254\./,/^0\./,/^\[::1\]$/,/^\[f[cd]/,/^\[fe80:/,/^\[::ffff:/i,/^localhost$/i];CJ1="Generate an image from a text description, optionally using reference images. Use this when the user asks you to create, generate, draw, or design an image. If the user has attached images and wants to modify or use them as a reference, pass them as referenceImages. "+"The image is displayed automatically by the UI \u2014 do NOT include image URLs or markdown images in your response."});function wg$($,Z){return jI0($,{provider:Z.provider,imageModelInfo:Z.imageModelInfo,objectStorage:Z.objectStorage,allowHttpExternalUrls:Z.allowHttpExternalUrls})}var jg$=L(()=>{Np()});import{z as fZ6}from"zod";function Eg$($){return{background:!0,status:"started",jobId:$,note:yZ6}}function hZ6($){return!!$&&typeof $==="object"&&$.status==="started"&&$.background===!0}function S40($,Z,Q,Y,X){if(!Y)return Q;let J=Q.execute,G=s(Z.extend(gZ6)),K=J.constructor.name==="AsyncGeneratorFunction"?async function*(F,U){let{background:N,...B}=F,D=async function*(){let{jobId:P}=await Y.start({toolName:$,input:B,toolCallId:U.toolCallId});yield Eg$(P)};if(N){yield*D();return}let O=X?.(U.toolCallId);if(!O){yield*J(B,U);return}let w=new AbortController,j=()=>w.abort();U.abortSignal?.addEventListener("abort",j,{once:!0});let E=J(B,{...U,abortSignal:w.signal})[Symbol.asyncIterator]();try{let P=E.next(),T=P.then((z)=>({kind:"next",r:z}));while(!0){let z=await Promise.race([T,O.flipped.then(()=>({kind:"flip"}))]);if(z.kind==="flip"){w.abort(),T.catch(()=>{}),(async()=>{try{await P}catch{}try{await E.return?.(void 0)}catch{}})(),yield*D();return}if(z.r.done)return;yield z.r.value,P=E.next(),T=P.then((A)=>({kind:"next",r:A}))}}finally{U.abortSignal?.removeEventListener("abort",j),O.dispose()}}:async(F,U)=>{let{background:N,...B}=F;if(N){let{jobId:D}=await Y.start({toolName:$,input:B,toolCallId:U.toolCallId});return Eg$(D)}return J(B,U)};return{...Q,inputSchema:G,execute:K,toModelOutput:(F)=>{if(hZ6(F.output))return{type:"text",value:F.output.note};if(Q.toModelOutput)return Q.toModelOutput(F);return{type:"text",value:JSON.stringify(F.output)}}}}var yZ6,gZ6;var _J1=L(()=>{u4();yZ6="Running in the background. The result will appear in the conversation as "+"soon as it's ready \u2014 keep helping the user in the meantime, and do not "+"wait for it or call this tool again for the same request.",gZ6={background:fZ6.boolean().optional().describe("Run this in the BACKGROUND and return immediately instead of blocking this turn. Set true for long, fire-and-forget work whose result you do "+"NOT need in this same reply \u2014 it's delivered to the conversation when "+"it finishes and you'll be nudged to use it then. Leave false/omit when you need the result now to act on it this turn.")}});function Pg$($,Z){let Q=C40.get($);if(!Q)Q=new Map,C40.set($,Q);let Y,X=new Promise((J)=>{Y=J});return Q.set(Z,Y),{flipped:X,dispose(){let J=C40.get($);if(!J)return;if(J.delete(Z),J.size===0)C40.delete($)}}}function vJ1($,Z){C40.get($)?.get(Z)?.()}var C40;var bJ1=L(()=>{C40=new Map});import{z as zg$}from"zod";function fJ1($,Z){let{researchJob:Q,toolOutputMap:Y,taskId:X}=Z;return t$({description:Z.description??xJ1,inputSchema:s(EI0),execute:async(J,G)=>{let W=performance.now(),K=(H)=>{$.write({type:"data-web-search",id:G.toolCallId,data:{text:H}})};try{let H=Q({query:J.query,taskId:X,toolCallId:G.toolCallId,abortSignal:G.abortSignal}),F=await H.next();while(!F.done)K(F.value.progress),F=await H.next();let U=F.value;return Y.set(G.toolCallId,U.text),yJ1({query:J.query,text:U.text,citations:U.citations,usage:U.usage,resultUri:U.resultUri??null,preview:U.preview??""})}finally{let H=performance.now()-W;$.write({type:"data-tool-metadata",id:G.toolCallId,data:{latencyMs:H}})}}})}function yJ1($){if($.resultUri)return{success:!0,uri:$.resultUri,preview:$.preview,query:$.query,usage:$.usage,...$.citations.length>0&&{citations:$.citations}};return{success:!0,content:$.text,query:$.query,usage:$.usage,...$.citations.length>0&&{citations:$.citations}}}var EI0,xJ1="Search the web for up-to-date information and synthesize a concise answer. Use this for quick lookups, fact-checking, current events, or when the answer requires knowledge beyond your training data and a fast response is enough. For exhaustive, multi-source reports prefer `deep_research` when available.",PI0;var gJ1=L(()=>{u4();EI0=zg$.object({query:zg$.string().max(1e4).describe("The research query. Be specific about what information you need. The research model will search the web and synthesize a comprehensive answer.")}),PI0="Run in-depth, multi-source research and synthesize a comprehensive, cited report. Use this when the user needs thorough analysis, a literature/market review, or a question that warrants exploring many "+"sources \u2014 accuracy and depth matter more than latency. For quick "+"lookups or fact-checks, use `web_search` instead."});var Ag$=L(()=>{A41()});var Tg$=L(()=>{Ag$()});var hJ1=32000;function n3($,Z,Q){let Y=Object.entries(Q).filter(([,J])=>J!==void 0&&J!==null).map(([J,G])=>`${J}=${typeof G==="string"?G:JSON.stringify(G)}`).join(" "),X=`[web-search] ${Z} ${Y}`.trim();if($==="error")console.error(X);else if($==="warn")console.warn(X);else console.log(X)}function _40($){let{provider:Z,modelInfo:Q,ctx:Y,mode:X,toolName:J}=$,G=Q.id;return async function*(K){let H=Z.asyncResearch;if(X==="deep"&&H?.canHandle(G)===!0&&H)return yield*uZ6({params:K,asyncResearch:H,providerId:Z.info.id,modelId:G,toolName:J,ctx:Y});return yield*cZ6({params:K,provider:Z,modelId:G,ctx:Y})}}async function*uZ6({params:$,asyncResearch:Z,providerId:Q,modelId:Y,toolName:X,ctx:J}){let{toolCallId:G,taskId:W}=$,K={tc:G,thread:W,provider:Q,model:Y},H=await J.storage.asyncResearchJobs.upsertPending({threadId:W,toolCallId:G,provider:Q,modelId:Y,query:$.query});if(H.status==="completed"&&H.resultPreview!=null)return n3("info","replay-completed",{...K,job:H.id}),lZ6(H);if(H.status==="failed"||H.status==="cancelled")throw n3("warn",`replay-${H.status}`,{...K,job:H.id,err:H.lastError}),Error(H.lastError??`previous research ${H.status}`);if(!H.interactionId){n3("info","submit",{...K,job:H.id});let B;try{B=(await Z.start({modelId:Y,query:$.query,abortSignal:$.abortSignal})).jobId}catch(D){let O=D.message??String(D);throw await J.storage.asyncResearchJobs.markFailed(G,O),n3("error","submit-failed",{...K,job:H.id,err:O}),D}await J.storage.asyncResearchJobs.markPolling(G,B,{threadId:W,toolName:X,query:$.query}),H={...H,interactionId:B,status:"polling"},n3("info","polling-started",{...K,job:H.id,interaction:B})}else n3("info","polling-resumed",{...K,job:H.id,interaction:H.interactionId,attempts:H.attempts});let F=0,U=50,N=[];try{let B=!1,D,O=Z.resume({jobId:H.interactionId,abortSignal:$.abortSignal,onProgress:(z)=>{let A=Date.now();if(A-F>=U)F=A,N.push(z);J.storage.asyncResearchJobs.recordPoll(G).catch((q)=>{n3("warn","record-poll-failed",{...K,job:H.id,err:q.message})})}}).catch((z)=>{D=z;return}).finally(()=>{B=!0});while(!B){while(N.length>0)yield{progress:N.shift()};await Promise.race([O,F$(U)])}while(N.length>0)yield{progress:N.shift()};if(await O,D!==void 0)throw D;let w=await O;if(yield{progress:w.text},w.text.trim()==="")throw n3("error","empty-result",{...K,job:H.id,tokens:w.usage.outputTokens}),new zT("research completed with empty result");let j={inputTokens:w.usage.inputTokens,outputTokens:w.usage.outputTokens},E=w.usage.outputTokens>hJ1&&J.objectStorage!=null,P=null;if(E&&J.objectStorage){let z=`web-search/${crypto.randomUUID()}.md`;try{await J.objectStorage.put(z,new TextEncoder().encode(w.text),{contentType:"text/markdown"}),P=AF(z)}catch(A){n3("warn","blob-upload-failed",{...K,job:H.id,err:A.message})}}let T=ey(w.text);return await J.storage.asyncResearchJobs.markCompleted(G,{inputTokens:j.inputTokens,outputTokens:j.outputTokens,citations:w.citations,resultUri:P,resultPreview:T,resultContent:P?null:w.text}),n3("info","completed",{...K,job:H.id,tokens:j.outputTokens,citations:w.citations.length,uri:P??"inline"}),{text:w.text,citations:w.citations,usage:j,resultUri:P,preview:P?T:void 0}}catch(B){if($.abortSignal?.aborted)throw await J.storage.asyncResearchJobs.markCancelled(G,"aborted"),n3("info","cancelled",{...K,job:H.id}),B;let D=B.message??String(B);if(B instanceof zT||B instanceof Error&&B.name==="AsyncResearchTerminalError")throw await J.storage.asyncResearchJobs.markFailed(G,D),n3("error","terminal-failure",{...K,job:H.id,err:D}),B;throw await J.storage.asyncResearchJobs.recordPoll(G,D).catch(()=>{}),n3("warn","transient-error",{...K,job:H.id,err:D}),B}}function lZ6($){if($.resultUri)return{text:"",citations:[],usage:{inputTokens:0,outputTokens:0},resultUri:$.resultUri,preview:$.resultPreview??""};return{text:$.resultContent??$.resultPreview??"",citations:[],usage:{inputTokens:0,outputTokens:0},resultUri:null}}async function*cZ6({params:$,provider:Z,modelId:Q,ctx:Y}){let X=Z.aiSdk.languageModel(Q),J=Jp({model:X,prompt:$.query,abortSignal:$.abortSignal}),G="",W=0,K=50;for await(let w of J.textStream){G+=w;let j=Date.now();if(j-W>=K)W=j,yield{progress:G}}yield{progress:G};let[H,F,U]=await Promise.all([J.usage,J.sources,J.providerMetadata]),N=H.inputTokens??0,B=H.outputTokens??0;dJ0(U);let D=[];if(F&&Array.isArray(F)){for(let w of F)if(w&&typeof w==="object"&&"sourceType"in w&&w.sourceType==="url"&&"url"in w&&typeof w.url==="string")D.push({url:w.url,title:"title"in w&&typeof w.title==="string"?w.title:void 0})}let O={inputTokens:N,outputTokens:B};if(B>hJ1&&Y.objectStorage){let w=`web-search/${crypto.randomUUID()}.md`,j=new TextEncoder().encode(G);try{return await Y.objectStorage.put(w,j,{contentType:"text/markdown"}),{text:G,citations:D,usage:O,resultUri:AF(w),preview:ey(G)}}catch(E){console.error("[web-search] Failed to upload to storage, returning inline",E)}}return{text:G,citations:D,usage:O,resultUri:null}}var uJ1=L(()=>{u4();r$();Tg$();R8();OI0();zF()});function Rg$($){let{writer:Z,toolOutputMap:Q,objectStorage:Y,imageTool:X}=$,J={user_ask:NI0,todo_write:BI0,propose_plan:LI0,read_tool_output:GI0({toolOutputMap:Q})};if(X)J.generate_image=S40("generate_image",Qg,jI0(Z,{...X,objectStorage:Y}),null);return J}var qg$=L(()=>{RJ1();qJ1();kJ1();zF();Np();_J1()});async function zI0($,Z,Q){let Y=await $.findById(Z,Q);if(!Y||Y.organization_id!==Q)throw Error(`Virtual MCP not found: ${Z}`);return Y}function v40($,Z=Date.now()){let Q=new Date($.updated_at).getTime(),Y=$.last_progress_at?new Date($.last_progress_at).getTime():Number.NaN,X=Math.max(Number.isFinite(Q)?Q:Number.NEGATIVE_INFINITY,Number.isFinite(Y)?Y:Number.NEGATIVE_INFINITY);return!Number.isFinite(X)||Z-X>lJ1}function IK($,Z=Date.now()){let Q=$.status;if(Q==="in_progress"&&v40($,Z))Q="expired";return{id:$.id,organization_id:$.organization_id,title:$.title,description:$.description,created_at:$.created_at,updated_at:$.updated_at,created_by:$.created_by,updated_by:$.updated_by,hidden:$.hidden??!1,status:Q,virtual_mcp_id:$.virtual_mcp_id||void 0,trigger_id:$.trigger_id,branch:$.branch,harness_id:$.harness_id,metadata:$.metadata&&Object.keys($.metadata).length>0?$.metadata:void 0,run_config:$.run_config}}var lJ1=1800000;var cJ1,b40;var AI0=L(()=>{cJ1=["in_progress","requires_action","failed","completed"],b40=["ended_after_delivery","superseded"]});import{z as l$}from"zod";var Mg$,mZ6,Ig$,cN,dZ6=128,Vg$=255,kg$,Sg$;var Yg=L(()=>{AI0();ci();Mg$=l$.object({id:l$.string().describe("Unique message ID"),thread_id:l$.string().describe("ID of the parent thread"),metadata:l$.unknown().optional().describe("Optional message metadata"),parts:l$.array(l$.record(l$.string(),l$.unknown())).describe("Message content parts (AI SDK UIMessagePart format)"),role:l$.enum(["user","assistant","system"]).describe("Message role"),created_at:l$.string().datetime().describe("Timestamp of creation"),updated_at:l$.string().datetime().describe("Timestamp of last update")}),mZ6=l$.object({toolName:l$.string().describe("Fully qualified tool name"),appId:l$.string().describe("App ID that owns the tool"),args:l$.record(l$.string(),l$.unknown()).describe("Arguments used when expanding the tool"),expandedAt:l$.string().datetime().describe("When the tool was expanded")}),Ig$=l$.object({expanded_tools:l$.array(mZ6).optional(),read_only:l$.boolean().optional().describe("The thread takes no further input (an autonomous run the user cannot continue)"),runtime:l$.enum(hY1).optional().describe("Session runtime, stamped once at creation and immutable afterwards: 'cms' is a sandbox-less content session, 'sandbox' a coding session with a pod. Absent only on threads created before the stamp existed."),source:l$.enum(["jira"]).optional().describe("What started the run: 'jira' for a run the Jira integration dispatched when an issue entered an automated status. Absent for a person's thread."),jira_issue_key:l$.string().optional().describe("The Jira issue a 'jira' run works on, e.g. EX-12. Absent on a run started on several issues at once \u2014 see jira_issue_keys."),jira_issue_keys:l$.array(l$.string()).optional().describe("Every Jira issue a 'jira' run may act on. One entry for a run on one issue; several for a run a person started on a batch, whose Jira tools take an issueKey to say which."),jira_created_issue_keys:l$.array(l$.string()).optional().describe("The Jira issues a 'jira' run created itself, so a repeated create returns the one it made.")}).catchall(l$.unknown()),cN=l$.object({id:l$.string().describe("Unique thread ID"),organization_id:l$.string().describe("Organization this thread belongs to"),title:l$.string().describe("Thread title"),description:l$.string().nullable().describe("Thread description"),created_at:l$.string().datetime().describe("Timestamp of creation"),updated_at:l$.string().datetime().describe("Timestamp of last update"),hidden:l$.boolean().optional().describe("Whether the thread is hidden"),status:l$.enum([...cJ1,"expired"]).describe("Thread execution status. 'expired' is virtual -- computed at read time for stale in_progress threads"),created_by:l$.string().describe("User ID who created the thread"),updated_by:l$.string().optional().describe("User ID who last updated the thread"),virtual_mcp_id:l$.string().optional().describe("Virtual MCP (agent) this thread was initiated with"),trigger_id:l$.string().nullable().optional().describe("Automation trigger that created this thread; null/absent for human-initiated threads."),branch:l$.string().nullable().optional().describe("Git branch this thread is pinned to (repository-linked projects only)"),harness_id:l$.string().nullable().optional().describe("Pinned on first message; selects which harness runs the thread (e.g. 'claude-code', 'codex', 'decopilot')."),metadata:Ig$.optional().describe("Free-form per-thread UI state (e.g. expanded_tools)"),run_config:l$.record(l$.string(),l$.unknown()).nullable().optional().describe("Persisted run configuration (contains agent and model info)")}),kg$=l$.object({id:l$.string().max(dZ6).optional().describe("Optional custom ID for the thread"),title:l$.string().optional().describe("Thread title"),description:l$.string().nullish().describe("Thread description"),virtual_mcp_id:l$.string().describe("Virtual MCP (agent) this thread is bound to"),branch:l$.string().min(1).max(Vg$).optional().describe("Preferred branch. Used only when the vMCP has a repository; ignored otherwise. When omitted, the server picks the most-recently-touched branch from the user's sandboxMap, falling back to a freshly generated name."),runtime:l$.enum(hY1).optional().describe("Session runtime for the new thread, honored verbatim and immutable for the thread's life. 'sandbox' starts a coding session even on a Fast Preview project, sharing the given branch (it continues the CMS draft). Omitted \u21D2 stamped with the project's default (Fast Preview capable \u21D2 'cms', else 'sandbox').")}),Sg$=l$.object({title:l$.string().optional().describe("New thread title"),description:l$.string().nullish().describe("New thread description"),hidden:l$.boolean().optional().describe("Whether the thread is hidden"),status:l$.enum(cJ1).optional().describe("New thread status (user-set override). 'expired' is a computed virtual status and cannot be set directly."),metadata:Ig$.superRefine(($,Z)=>{if("sandboxMap"in $)Z.addIssue({code:"custom",path:["sandboxMap"],message:"sandboxMap is managed by the sandbox lifecycle"})}).optional().describe("Full replacement of the thread's user-managed metadata"),branch:l$.string().min(1).max(Vg$).nullish().describe("New git branch for this thread"),virtual_mcp_id:l$.string().optional().describe("Re-point the thread at a different agent. Only meaningful for an unsent thread (changing the recipient of a new chat); the UI restricts it accordingly.")})});import{z as SG}from"zod";var iZ6,pZ6,Xg;var mJ1=L(()=>{jG();q0();Yg();iZ6=WF.extend({where:SG.object({created_by:SG.string().optional(),trigger_ids:SG.array(SG.string()).max(1000).optional(),virtual_mcp_id:SG.string().optional(),hidden:SG.boolean().optional(),has_trigger:SG.boolean().optional()}).optional(),startDate:SG.string().datetime().optional().describe("Filter threads updated at or after this ISO timestamp"),endDate:SG.string().datetime().optional().describe("Filter threads updated at or before this ISO timestamp"),search:SG.string().optional().describe("Full-text search on thread title (case-insensitive)"),status:SG.string().optional().describe("Filter by thread status (e.g. completed, failed, in_progress)"),userId:SG.string().optional().describe("Filter by the user who created the thread"),agentId:SG.string().optional().describe("Filter by agent (connection or virtual MCP) ID"),source:SG.string().optional().describe("Filter by what started the run (`metadata.source`), e.g. `jira` for runs the Jira integration dispatched")}),pZ6=$L(cN),Xg=u({name:"COLLECTION_THREADS_LIST",description:"List threads with filtering, sorting, and pagination.",annotations:{title:"List Threads",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:iZ6,outputSchema:pZ6,handler:async($,Z)=>{await Z.access.check();let Q=Z.auth.user?.id;if(!Q)throw Error("User ID required to list threads");Y0(Z);let Y=$.offset??0,X=$.limit??100,J=$.where?.trigger_ids,G=$.where?.virtual_mcp_id,W=$.userId??($.where?.created_by==="me"?Q:$.where?.created_by),{threads:K,total:H}=J?.length?await Z.storage.threads.listByTriggerIds(J,{limit:X,offset:Y}):await Z.storage.threads.list(W,{limit:X,offset:Y,virtualMcpId:G,startDate:$.startDate,endDate:$.endDate,search:$.search,status:$.status,agentId:$.agentId,includeArchived:$.where?.hidden,hasTrigger:$.where?.has_trigger,source:$.source}),F=Y+X<H,U=Date.now();return{items:K.map((N)=>IK(N,U)),totalCount:H,hasMore:F}}})});var nZ6,Jg;var dJ1=L(()=>{jG();q0();Yg();nZ6=X$0(cN),Jg=u({name:"COLLECTION_THREADS_GET",description:"Get a thread's details and metadata by ID.",annotations:{title:"Get Thread",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:Y$0,outputSchema:nZ6,handler:async($,Z)=>{p(Z),Y0(Z),await Z.access.check();let Q=await Z.storage.threads.get($.id);if(!Q)return{item:null};return{item:IK(Q)}}})});import{z as tZ6}from"zod";function Cg$($){if(!$)return null;if("field"in $&&$.field[0]==="thread_id"&&$.operator==="eq")return String($.value);if("conditions"in $&&($.operator==="and"||$.operator==="or"))for(let Z of $.conditions){let Q=Cg$(Z);if(Q)return Q}return null}var oZ6,sZ6,Gg;var iJ1=L(()=>{jG();q0();Yg();oZ6=WF.extend({thread_id:tZ6.string().optional().describe("ID of the thread to list messages for (required)")}),sZ6=$L(Mg$),Gg=u({name:"COLLECTION_THREAD_MESSAGES_LIST",description:"List messages in a thread with pagination. Requires thread_id. Returns messages in chronological order.",annotations:{title:"List Thread Messages",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:oZ6,outputSchema:sZ6,handler:async($,Z)=>{Y0(Z),await Z.access.check();let Q=$.thread_id??Cg$($.where);if(!Q)throw Error("thread_id is required (provide as top-level param or in where clause)");let Y=$.offset??0,X=$.limit??100,J=$.orderBy?.[0]?.direction??"asc",G=await Z.storage.threads.get(Q);if(!G)return{items:[],totalCount:0,hasMore:!1};if(G.message_storage_version===2){let{messages:F,total:U}=await Z.storage.threads.messageParts().loadWindow(Q,{limit:X,offset:Y,includeInFlight:!0});return{items:F.map((N)=>({id:N.id,thread_id:Q,role:N.role,parts:N.parts,metadata:N.metadata??null,created_at:N.created_at,updated_at:N.created_at})),totalCount:U,hasMore:Y+X<U}}let{messages:W,total:K}=await Z.storage.threads.listMessages(Q,{limit:X,offset:Y,sort:J}),H=Y+X<K;return{items:W,totalCount:K,hasMore:H}}})});function _g$($){return{search_threads:t$({description:Xg.description,inputSchema:s(Xg.inputSchema),execute:(Z)=>Xg.execute(Z,$)}),get_thread:t$({description:Jg.description,inputSchema:s(Jg.inputSchema),execute:(Z)=>Jg.execute(Z,$)}),list_thread_messages:t$({description:Gg.description,inputSchema:s(Gg.inputSchema),execute:(Z)=>Gg.execute(Z,$)})}}var vg$=L(()=>{u4();mJ1();dJ1();iJ1()});import{randomBytes as rZ6}from"crypto";function RI0(){if(TI0)return TI0;let $;try{let Z=L0();$=Z.studioJwtSecret??Z.betterAuthSecret}catch{$=void 0}return TI0=$?Buffer.from($):rZ6(32),TI0}var TI0=null;var pJ1=L(()=>{r1()});import{createHmac as aZ6,timingSafeEqual as eZ6}from"crypto";function bg$($){return aZ6("sha256",RI0()).update($).digest("base64url")}function qI0($){let Z=Buffer.from(JSON.stringify($)).toString("base64url");return`${Z}.${bg$(Z)}`}function MI0($){let Z=$.indexOf(".");if(Z<=0)return null;let Q=$.slice(0,Z),Y=Buffer.from($.slice(Z+1)),X=Buffer.from(bg$(Q));if(Y.length!==X.length||!eZ6(Y,X))return null;try{return JSON.parse(Buffer.from(Q,"base64url").toString("utf8"))}catch{return null}}var nJ1=L(()=>{pJ1()});function fg$($){return qI0($)}function yg$($,Z=Date.now()){let Q=MI0($);if(typeof Q!=="object"||Q===null||typeof Q.organizationId!=="string"||typeof Q.attachmentId!=="string"||typeof Q.expiresAt!=="number")return null;let Y=Q;if(Y.expiresAt<=Z)return null;return Y}var xg$=600000;var tJ1=L(()=>{nJ1()});function tg$($){let Z=[];return SI0({lines:og$($),i:0},{media:ng$,allowMedia:!0,onImage:(Q)=>Z.push(Q)}),Z}function eJ1($,Z={}){let Q=SI0({lines:og$($),i:0},{media:Z.media??ng$,allowMedia:!0});if(Z.header)Q.unshift($G1(Z.header));return{type:"doc",version:1,content:Q.length>0?Q:[{type:"paragraph",content:[]}]}}function og$($){return $.replace(/\r\n?/g,`
+- Note any risks, dependencies, or trade-offs.`,LI0=t$({description:VZ6,inputSchema:s(MZ6),outputSchema:s(IZ6)})});function AF($){return`studio-storage://${$}`}function $g($){if($.startsWith("studio-storage://"))return $.slice(17);if($.startsWith("mesh-storage://"))return $.slice(15);return null}function SJ1(){return/(?:studio|mesh)-storage:\/\/([^\s"'<>[\]]+)/g}var OI0=()=>{};import{lookup as kZ6}from"dns/promises";import{z as Zg}from"zod";function wI0($){if($>Bg$){let Z=($/1048576).toFixed(1),Q=Bg$/1048576;throw Error(`Reference image too large: ${Z} MB (max ${Q} MB). Use a smaller image.`)}}function _Z6($,Z){let Q;try{Q=new URL($)}catch{throw Error("Invalid image URL")}if(Q.protocol!=="https:"&&!(Z&&Q.protocol==="http:"))throw Error("Image URL must use HTTPS");for(let Y of CZ6)if(Y.test(Q.hostname))throw Error("Image URL must not point to a private network address")}function vZ6($){let Z=$.match(/^(\d+)\.(\d+)\.(\d+)\.(\d+)$/);if(Z){let Y=Number(Z[1]),X=Number(Z[2]);if(Y===127||Y===10||Y===0)return!0;if(Y===172&&X>=16&&X<=31)return!0;if(Y===192&&X===168)return!0;if(Y===169&&X===254)return!0;return!1}let Q=$.toLowerCase();return Q==="::1"||Q.startsWith("::ffff:")||Q.startsWith("fc")||Q.startsWith("fd")||Q.startsWith("fe80")}async function bZ6($,Z=async(Q)=>(await kZ6(Q,{all:!0})).map((Y)=>Y.address)){let Q=new URL($).hostname;if(/^\d+\.\d+\.\d+\.\d+$/.test(Q)||Q.startsWith("[")&&Q.endsWith("]"))return;let X;try{X=await Z(Q)}catch{throw Error("Image URL must not point to a private network address")}if(X.length===0||X.some(vZ6))throw Error("Image URL must not point to a private network address")}async function Og$($,Z){if(!Z?.getBytes)throw Error("Object storage read is not available");if(Z.head){let{size:Y}=await Z.head($);wI0(Y)}let Q=await Z.getBytes($);return wI0(Q.byteLength),Q}async function xZ6($,Z){let Q=$g($);if(Q!==null)return Og$(Q,Z.objectStorage);let Y=$.match(SZ6);if(Y)return Og$(Y[1],Z.objectStorage);if($.startsWith("data:")){let K=$.match(/^data:[^;]+;base64,(.+)$/s);if(!K)throw Error("Invalid data: URI");let H=Buffer.from(K[1],"base64");return wI0(H.byteLength),H}_Z6($,Z.allowHttpExternalUrls===!0),await bZ6($);let X=AbortSignal.timeout(Dg$),J=Z.abortSignal?AbortSignal.any([Z.abortSignal,X]):X,G;try{G=await fetch($,{signal:J,redirect:"manual"})}catch(K){if(K instanceof Error&&K.name==="TimeoutError")throw Error(`Fetching image from ${$} timed out after ${Dg$}ms`);throw K}if(G.status>=300&&G.status<400)throw Error(`Refusing to follow a redirect fetching image from ${$}`);if(!G.ok)throw Error(`Failed to fetch image from ${$}: ${G.status}`);let W=new Uint8Array(await G.arrayBuffer());return wI0(W.byteLength),W}async function k40($,Z){let{provider:Q,imageModelInfo:Y,objectStorage:X}=Z,J=Q.aiSdk.imageModel(Y.id),G=$.referenceImages&&$.referenceImages.length>0,W=G?await Promise.all($.referenceImages.map((O)=>{let w=O.uri??O.url;if(!w)throw Error("Reference image missing uri");return xZ6(w,Z)})):[],K=G?{text:$.prompt,images:W}:$.prompt,H=AbortSignal.timeout(Lg$),F=Z.abortSignal?AbortSignal.any([Z.abortSignal,H]):H,U;try{U=await $I0({model:J,prompt:K,n:$.n??1,...$.aspectRatio?{aspectRatio:$.aspectRatio}:{},abortSignal:F})}catch(O){if(H.aborted&&!Z.abortSignal?.aborted)throw Error(`Image generation timed out after ${Lg$}ms`);throw O}if(!X)throw Error("Object storage is unavailable; cannot persist the generated image.");let N=$.n??1,B=U.images.length>N?U.images.slice(-N):U.images;return{success:!0,images:await Promise.all(B.map(async(O)=>{let w=O.mediaType??"image/png",j=w.split("/")[1]??"png",E=`generated-images/${crypto.randomUUID()}.${j}`,P=Uint8Array.from(atob(O.base64),(T)=>T.charCodeAt(0));return await X.put(E,P,{contentType:w}),{uri:AF(E),mediaType:w}})),prompt:$.prompt,model:Y.id,usage:{inputTokens:U.usage.inputTokens??0,outputTokens:U.usage.outputTokens??0},usedReferenceImages:G?$.referenceImages.length:0}}function jI0($,Z){return t$({description:CJ1,inputSchema:s(Qg),execute:async(Q,Y)=>{let X=performance.now();try{return await k40(Q,Z)}finally{$.write({type:"data-tool-metadata",id:Y.toolCallId,data:{latencyMs:performance.now()-X}})}}})}var SZ6,Bg$=20971520,Dg$=45000,Lg$=120000,Qg,CZ6,CJ1;var Np=L(()=>{u4();u4();OI0();SZ6=/\/api\/[^/]+\/files\/([^?#]+)/,Qg=Zg.object({prompt:Zg.string().max(1e4).describe("Detailed description of the image to generate. Be specific about style, composition, colors, and subject matter."),referenceImages:Zg.array(Zg.object({uri:Zg.string().describe("URI of the reference image (e.g. studio-storage://generated-images/uuid.png).")})).max(10).optional().describe("Reference images to use as input for image-to-image generation. Pass the URI of any image from the conversation (uploaded files, previously generated images, etc.) when the user wants to modify, transform, or use an existing image as a starting point."),aspectRatio:Zg.enum(["1:1","16:9","9:16","4:3","3:4","3:2","2:3"]).optional().describe("Aspect ratio for the generated image. Defaults to 1:1."),n:Zg.number().int().min(1).max(4).optional().describe("Number of images to generate. Defaults to 1.")}),CZ6=[/^127\./,/^10\./,/^172\.(1[6-9]|2\d|3[01])\./,/^192\.168\./,/^169\.254\./,/^0\./,/^\[::1\]$/,/^\[f[cd]/,/^\[fe80:/,/^\[::ffff:/i,/^localhost$/i];CJ1="Generate an image from a text description, optionally using reference images. Use this when the user asks you to create, generate, draw, or design an image. If the user has attached images and wants to modify or use them as a reference, pass them as referenceImages. "+"The image is displayed automatically by the UI \u2014 do NOT include image URLs or markdown images in your response."});function wg$($,Z){return jI0($,{provider:Z.provider,imageModelInfo:Z.imageModelInfo,objectStorage:Z.objectStorage,allowHttpExternalUrls:Z.allowHttpExternalUrls})}var jg$=L(()=>{Np()});import{z as fZ6}from"zod";function Eg$($){return{background:!0,status:"started",jobId:$,note:yZ6}}function hZ6($){return!!$&&typeof $==="object"&&$.status==="started"&&$.background===!0}function S40($,Z,Q,Y,X){if(!Y)return Q;let J=Q.execute,G=s(Z.extend(gZ6)),K=J.constructor.name==="AsyncGeneratorFunction"?async function*(F,U){let{background:N,...B}=F,D=async function*(){let{jobId:P}=await Y.start({toolName:$,input:B,toolCallId:U.toolCallId});yield Eg$(P)};if(N){yield*D();return}let O=X?.(U.toolCallId);if(!O){yield*J(B,U);return}let w=new AbortController,j=()=>w.abort();U.abortSignal?.addEventListener("abort",j,{once:!0});let E=J(B,{...U,abortSignal:w.signal})[Symbol.asyncIterator]();try{let P=E.next(),T=P.then((z)=>({kind:"next",r:z}));while(!0){let z=await Promise.race([T,O.flipped.then(()=>({kind:"flip"}))]);if(z.kind==="flip"){w.abort(),T.catch(()=>{}),(async()=>{try{await P}catch{}try{await E.return?.(void 0)}catch{}})(),yield*D();return}if(z.r.done)return;yield z.r.value,P=E.next(),T=P.then((A)=>({kind:"next",r:A}))}}finally{U.abortSignal?.removeEventListener("abort",j),O.dispose()}}:async(F,U)=>{let{background:N,...B}=F;if(N){let{jobId:D}=await Y.start({toolName:$,input:B,toolCallId:U.toolCallId});return Eg$(D)}return J(B,U)};return{...Q,inputSchema:G,execute:K,toModelOutput:(F)=>{if(hZ6(F.output))return{type:"text",value:F.output.note};if(Q.toModelOutput)return Q.toModelOutput(F);return{type:"text",value:JSON.stringify(F.output)}}}}var yZ6,gZ6;var _J1=L(()=>{u4();yZ6="Running in the background. The result will appear in the conversation as "+"soon as it's ready \u2014 keep helping the user in the meantime, and do not "+"wait for it or call this tool again for the same request.",gZ6={background:fZ6.boolean().optional().describe("Run this in the BACKGROUND and return immediately instead of blocking this turn. Set true for long, fire-and-forget work whose result you do "+"NOT need in this same reply \u2014 it's delivered to the conversation when "+"it finishes and you'll be nudged to use it then. Leave false/omit when you need the result now to act on it this turn.")}});function Pg$($,Z){let Q=C40.get($);if(!Q)Q=new Map,C40.set($,Q);let Y,X=new Promise((J)=>{Y=J});return Q.set(Z,Y),{flipped:X,dispose(){let J=C40.get($);if(!J)return;if(J.delete(Z),J.size===0)C40.delete($)}}}function vJ1($,Z){C40.get($)?.get(Z)?.()}var C40;var bJ1=L(()=>{C40=new Map});import{z as zg$}from"zod";function fJ1($,Z){let{researchJob:Q,toolOutputMap:Y,taskId:X}=Z;return t$({description:Z.description??xJ1,inputSchema:s(EI0),execute:async(J,G)=>{let W=performance.now(),K=(H)=>{$.write({type:"data-web-search",id:G.toolCallId,data:{text:H}})};try{let H=Q({query:J.query,taskId:X,toolCallId:G.toolCallId,abortSignal:G.abortSignal}),F=await H.next();while(!F.done)K(F.value.progress),F=await H.next();let U=F.value;return Y.set(G.toolCallId,U.text),yJ1({query:J.query,text:U.text,citations:U.citations,usage:U.usage,resultUri:U.resultUri??null,preview:U.preview??""})}finally{let H=performance.now()-W;$.write({type:"data-tool-metadata",id:G.toolCallId,data:{latencyMs:H}})}}})}function yJ1($){if($.resultUri)return{success:!0,uri:$.resultUri,preview:$.preview,query:$.query,usage:$.usage,...$.citations.length>0&&{citations:$.citations}};return{success:!0,content:$.text,query:$.query,usage:$.usage,...$.citations.length>0&&{citations:$.citations}}}var EI0,xJ1="Search the web for up-to-date information and synthesize a concise answer. Use this for quick lookups, fact-checking, current events, or when the answer requires knowledge beyond your training data and a fast response is enough. For exhaustive, multi-source reports prefer `deep_research` when available.",PI0;var gJ1=L(()=>{u4();EI0=zg$.object({query:zg$.string().max(1e4).describe("The research query. Be specific about what information you need. The research model will search the web and synthesize a comprehensive answer.")}),PI0="Run in-depth, multi-source research and synthesize a comprehensive, cited report. Use this when the user needs thorough analysis, a literature/market review, or a question that warrants exploring many "+"sources \u2014 accuracy and depth matter more than latency. For quick "+"lookups or fact-checks, use `web_search` instead."});var Ag$=L(()=>{A41()});var Tg$=L(()=>{Ag$()});var hJ1=32000;function n3($,Z,Q){let Y=Object.entries(Q).filter(([,J])=>J!==void 0&&J!==null).map(([J,G])=>`${J}=${typeof G==="string"?G:JSON.stringify(G)}`).join(" "),X=`[web-search] ${Z} ${Y}`.trim();if($==="error")console.error(X);else if($==="warn")console.warn(X);else console.log(X)}function _40($){let{provider:Z,modelInfo:Q,ctx:Y,mode:X,toolName:J}=$,G=Q.id;return async function*(K){let H=Z.asyncResearch;if(X==="deep"&&H?.canHandle(G)===!0&&H)return yield*uZ6({params:K,asyncResearch:H,providerId:Z.info.id,modelId:G,toolName:J,ctx:Y});return yield*cZ6({params:K,provider:Z,modelId:G,ctx:Y})}}async function*uZ6({params:$,asyncResearch:Z,providerId:Q,modelId:Y,toolName:X,ctx:J}){let{toolCallId:G,taskId:W}=$,K={tc:G,thread:W,provider:Q,model:Y},H=await J.storage.asyncResearchJobs.upsertPending({threadId:W,toolCallId:G,provider:Q,modelId:Y,query:$.query});if(H.status==="completed"&&H.resultPreview!=null)return n3("info","replay-completed",{...K,job:H.id}),lZ6(H);if(H.status==="failed"||H.status==="cancelled")throw n3("warn",`replay-${H.status}`,{...K,job:H.id,err:H.lastError}),Error(H.lastError??`previous research ${H.status}`);if(!H.interactionId){n3("info","submit",{...K,job:H.id});let B;try{B=(await Z.start({modelId:Y,query:$.query,abortSignal:$.abortSignal})).jobId}catch(D){let O=D.message??String(D);throw await J.storage.asyncResearchJobs.markFailed(G,O),n3("error","submit-failed",{...K,job:H.id,err:O}),D}await J.storage.asyncResearchJobs.markPolling(G,B,{threadId:W,toolName:X,query:$.query}),H={...H,interactionId:B,status:"polling"},n3("info","polling-started",{...K,job:H.id,interaction:B})}else n3("info","polling-resumed",{...K,job:H.id,interaction:H.interactionId,attempts:H.attempts});let F=0,U=50,N=[];try{let B=!1,D,O=Z.resume({jobId:H.interactionId,abortSignal:$.abortSignal,onProgress:(z)=>{let A=Date.now();if(A-F>=U)F=A,N.push(z);J.storage.asyncResearchJobs.recordPoll(G).catch((q)=>{n3("warn","record-poll-failed",{...K,job:H.id,err:q.message})})}}).catch((z)=>{D=z;return}).finally(()=>{B=!0});while(!B){while(N.length>0)yield{progress:N.shift()};await Promise.race([O,F$(U)])}while(N.length>0)yield{progress:N.shift()};if(await O,D!==void 0)throw D;let w=await O;if(yield{progress:w.text},w.text.trim()==="")throw n3("error","empty-result",{...K,job:H.id,tokens:w.usage.outputTokens}),new zT("research completed with empty result");let j={inputTokens:w.usage.inputTokens,outputTokens:w.usage.outputTokens},E=w.usage.outputTokens>hJ1&&J.objectStorage!=null,P=null;if(E&&J.objectStorage){let z=`web-search/${crypto.randomUUID()}.md`;try{await J.objectStorage.put(z,new TextEncoder().encode(w.text),{contentType:"text/markdown"}),P=AF(z)}catch(A){n3("warn","blob-upload-failed",{...K,job:H.id,err:A.message})}}let T=ey(w.text);return await J.storage.asyncResearchJobs.markCompleted(G,{inputTokens:j.inputTokens,outputTokens:j.outputTokens,citations:w.citations,resultUri:P,resultPreview:T,resultContent:P?null:w.text}),n3("info","completed",{...K,job:H.id,tokens:j.outputTokens,citations:w.citations.length,uri:P??"inline"}),{text:w.text,citations:w.citations,usage:j,resultUri:P,preview:P?T:void 0}}catch(B){if($.abortSignal?.aborted)throw await J.storage.asyncResearchJobs.markCancelled(G,"aborted"),n3("info","cancelled",{...K,job:H.id}),B;let D=B.message??String(B);if(B instanceof zT||B instanceof Error&&B.name==="AsyncResearchTerminalError")throw await J.storage.asyncResearchJobs.markFailed(G,D),n3("error","terminal-failure",{...K,job:H.id,err:D}),B;throw await J.storage.asyncResearchJobs.recordPoll(G,D).catch(()=>{}),n3("warn","transient-error",{...K,job:H.id,err:D}),B}}function lZ6($){if($.resultUri)return{text:"",citations:[],usage:{inputTokens:0,outputTokens:0},resultUri:$.resultUri,preview:$.resultPreview??""};return{text:$.resultContent??$.resultPreview??"",citations:[],usage:{inputTokens:0,outputTokens:0},resultUri:null}}async function*cZ6({params:$,provider:Z,modelId:Q,ctx:Y}){let X=Z.aiSdk.languageModel(Q),J=Jp({model:X,prompt:$.query,abortSignal:$.abortSignal}),G="",W=0,K=50;for await(let w of J.textStream){G+=w;let j=Date.now();if(j-W>=K)W=j,yield{progress:G}}yield{progress:G};let[H,F,U]=await Promise.all([J.usage,J.sources,J.providerMetadata]),N=H.inputTokens??0,B=H.outputTokens??0;dJ0(U);let D=[];if(F&&Array.isArray(F)){for(let w of F)if(w&&typeof w==="object"&&"sourceType"in w&&w.sourceType==="url"&&"url"in w&&typeof w.url==="string")D.push({url:w.url,title:"title"in w&&typeof w.title==="string"?w.title:void 0})}let O={inputTokens:N,outputTokens:B};if(B>hJ1&&Y.objectStorage){let w=`web-search/${crypto.randomUUID()}.md`,j=new TextEncoder().encode(G);try{return await Y.objectStorage.put(w,j,{contentType:"text/markdown"}),{text:G,citations:D,usage:O,resultUri:AF(w),preview:ey(G)}}catch(E){console.error("[web-search] Failed to upload to storage, returning inline",E)}}return{text:G,citations:D,usage:O,resultUri:null}}var uJ1=L(()=>{u4();r$();Tg$();R8();OI0();zF()});function Rg$($){let{writer:Z,toolOutputMap:Q,objectStorage:Y,imageTool:X}=$,J={user_ask:NI0,todo_write:BI0,propose_plan:LI0,read_tool_output:GI0({toolOutputMap:Q})};if(X)J.generate_image=S40("generate_image",Qg,jI0(Z,{...X,objectStorage:Y}),null);return J}var qg$=L(()=>{RJ1();qJ1();kJ1();zF();Np();_J1()});async function zI0($,Z,Q){let Y=await $.findById(Z,Q);if(!Y||Y.organization_id!==Q)throw Error(`Virtual MCP not found: ${Z}`);return Y}function v40($,Z=Date.now()){let Q=new Date($.updated_at).getTime(),Y=$.last_progress_at?new Date($.last_progress_at).getTime():Number.NaN,X=Math.max(Number.isFinite(Q)?Q:Number.NEGATIVE_INFINITY,Number.isFinite(Y)?Y:Number.NEGATIVE_INFINITY);return!Number.isFinite(X)||Z-X>lJ1}function IK($,Z=Date.now()){let Q=$.status;if(Q==="in_progress"&&v40($,Z))Q="expired";return{id:$.id,organization_id:$.organization_id,title:$.title,description:$.description,created_at:$.created_at,updated_at:$.updated_at,created_by:$.created_by,updated_by:$.updated_by,hidden:$.hidden??!1,status:Q,virtual_mcp_id:$.virtual_mcp_id||void 0,trigger_id:$.trigger_id,branch:$.branch,harness_id:$.harness_id,metadata:$.metadata&&Object.keys($.metadata).length>0?$.metadata:void 0,run_config:$.run_config}}var lJ1=1800000;var cJ1,b40;var AI0=L(()=>{cJ1=["in_progress","requires_action","failed","completed"],b40=["ended_after_delivery","superseded"]});import{z as l$}from"zod";var Mg$,mZ6,Ig$,cN,dZ6=128,Vg$=255,kg$,Sg$;var Yg=L(()=>{AI0();ci();Mg$=l$.object({id:l$.string().describe("Unique message ID"),thread_id:l$.string().describe("ID of the parent thread"),metadata:l$.unknown().optional().describe("Optional message metadata"),parts:l$.array(l$.record(l$.string(),l$.unknown())).describe("Message content parts (AI SDK UIMessagePart format)"),role:l$.enum(["user","assistant","system"]).describe("Message role"),created_at:l$.string().datetime().describe("Timestamp of creation"),updated_at:l$.string().datetime().describe("Timestamp of last update")}),mZ6=l$.object({toolName:l$.string().describe("Fully qualified tool name"),appId:l$.string().describe("App ID that owns the tool"),args:l$.record(l$.string(),l$.unknown()).describe("Arguments used when expanding the tool"),expandedAt:l$.string().datetime().describe("When the tool was expanded")}),Ig$=l$.object({expanded_tools:l$.array(mZ6).optional(),read_only:l$.boolean().optional().describe("The thread takes no further input (an autonomous run the user cannot continue)"),runtime:l$.enum(hY1).optional().describe("Session runtime, stamped once at creation and immutable afterwards: 'cms' is a sandbox-less content session, 'sandbox' a coding session with a pod. Absent only on threads created before the stamp existed."),source:l$.enum(["jira"]).optional().describe("What started the run: 'jira' for a run the Jira integration dispatched when an issue entered an automated status. Absent for a person's thread."),jira_issue_key:l$.string().optional().describe("The Jira issue a 'jira' run works on, e.g. EX-12. Absent on a run started on several issues at once \u2014 see jira_issue_keys."),jira_issue_keys:l$.array(l$.string()).optional().describe("Every Jira issue a 'jira' run may act on. One entry for a run on one issue; several for a run a person started on a batch, whose Jira tools take an issueKey to say which."),jira_created_issue_keys:l$.array(l$.string()).optional().describe("The Jira issues a 'jira' run created itself, so a repeated create returns the one it made.")}).catchall(l$.unknown()),cN=l$.object({id:l$.string().describe("Unique thread ID"),organization_id:l$.string().describe("Organization this thread belongs to"),title:l$.string().describe("Thread title"),description:l$.string().nullable().describe("Thread description"),created_at:l$.string().datetime().describe("Timestamp of creation"),updated_at:l$.string().datetime().describe("Timestamp of last update"),hidden:l$.boolean().optional().describe("Whether the thread is hidden"),status:l$.enum([...cJ1,"expired"]).describe("Thread execution status. 'expired' is virtual -- computed at read time for stale in_progress threads"),created_by:l$.string().describe("User ID who created the thread"),updated_by:l$.string().optional().describe("User ID who last updated the thread"),virtual_mcp_id:l$.string().optional().describe("Virtual MCP (agent) this thread was initiated with"),trigger_id:l$.string().nullable().optional().describe("Automation trigger that created this thread; null/absent for human-initiated threads."),branch:l$.string().nullable().optional().describe("Git branch this thread is pinned to (repository-linked projects only)"),harness_id:l$.string().nullable().optional().describe("Pinned on first message; selects which harness runs the thread (e.g. 'claude-code', 'codex', 'decopilot')."),metadata:Ig$.optional().describe("Free-form per-thread UI state (e.g. expanded_tools)"),run_config:l$.record(l$.string(),l$.unknown()).nullable().optional().describe("Persisted run configuration (contains agent and model info)")}),kg$=l$.object({id:l$.string().max(dZ6).optional().describe("Optional custom ID for the thread"),title:l$.string().optional().describe("Thread title"),description:l$.string().nullish().describe("Thread description"),virtual_mcp_id:l$.string().describe("Virtual MCP (agent) this thread is bound to"),branch:l$.string().min(1).max(Vg$).optional().describe("Preferred branch. Used only when the vMCP has a repository; ignored otherwise. When omitted, the server picks the most-recently-touched branch from the user's sandboxMap, falling back to a freshly generated name."),runtime:l$.enum(hY1).optional().describe("Session runtime for the new thread, honored verbatim and immutable for the thread's life. 'sandbox' starts a coding session even on a Fast Preview project, sharing the given branch (it continues the CMS draft). Omitted \u21D2 stamped with the project's default (Fast Preview capable \u21D2 'cms', else 'sandbox').")}),Sg$=l$.object({title:l$.string().optional().describe("New thread title"),description:l$.string().nullish().describe("New thread description"),hidden:l$.boolean().optional().describe("Whether the thread is hidden"),status:l$.enum(cJ1).optional().describe("New thread status (user-set override). 'expired' is a computed virtual status and cannot be set directly."),metadata:Ig$.superRefine(($,Z)=>{if("sandboxMap"in $)Z.addIssue({code:"custom",path:["sandboxMap"],message:"sandboxMap is managed by the sandbox lifecycle"})}).optional().describe("Full replacement of the thread's user-managed metadata"),branch:l$.string().min(1).max(Vg$).nullish().describe("New git branch for this thread"),virtual_mcp_id:l$.string().optional().describe("Re-point the thread at a different agent. Only meaningful for an unsent thread (changing the recipient of a new chat); the UI restricts it accordingly.")})});import{z as SG}from"zod";var iZ6,pZ6,Xg;var mJ1=L(()=>{jG();q0();Yg();iZ6=WF.extend({where:SG.object({created_by:SG.string().optional(),trigger_ids:SG.array(SG.string().max(128)).max(1000).optional(),virtual_mcp_id:SG.string().optional(),hidden:SG.boolean().optional(),has_trigger:SG.boolean().optional()}).optional(),startDate:SG.string().datetime().optional().describe("Filter threads updated at or after this ISO timestamp"),endDate:SG.string().datetime().optional().describe("Filter threads updated at or before this ISO timestamp"),search:SG.string().optional().describe("Full-text search on thread title (case-insensitive)"),status:SG.string().optional().describe("Filter by thread status (e.g. completed, failed, in_progress)"),userId:SG.string().optional().describe("Filter by the user who created the thread"),agentId:SG.string().optional().describe("Filter by agent (connection or virtual MCP) ID"),source:SG.string().optional().describe("Filter by what started the run (`metadata.source`), e.g. `jira` for runs the Jira integration dispatched")}),pZ6=$L(cN),Xg=u({name:"COLLECTION_THREADS_LIST",description:"List threads with filtering, sorting, and pagination.",annotations:{title:"List Threads",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:iZ6,outputSchema:pZ6,handler:async($,Z)=>{await Z.access.check();let Q=Z.auth.user?.id;if(!Q)throw Error("User ID required to list threads");Y0(Z);let Y=$.offset??0,X=$.limit??100,J=$.where?.trigger_ids,G=$.where?.virtual_mcp_id,W=$.userId??($.where?.created_by==="me"?Q:$.where?.created_by),{threads:K,total:H}=J?.length?await Z.storage.threads.listByTriggerIds(J,{limit:X,offset:Y}):await Z.storage.threads.list(W,{limit:X,offset:Y,virtualMcpId:G,startDate:$.startDate,endDate:$.endDate,search:$.search,status:$.status,agentId:$.agentId,includeArchived:$.where?.hidden,hasTrigger:$.where?.has_trigger,source:$.source}),F=Y+X<H,U=Date.now();return{items:K.map((N)=>IK(N,U)),totalCount:H,hasMore:F}}})});var nZ6,Jg;var dJ1=L(()=>{jG();q0();Yg();nZ6=X$0(cN),Jg=u({name:"COLLECTION_THREADS_GET",description:"Get a thread's details and metadata by ID.",annotations:{title:"Get Thread",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:Y$0,outputSchema:nZ6,handler:async($,Z)=>{p(Z),Y0(Z),await Z.access.check();let Q=await Z.storage.threads.get($.id);if(!Q)return{item:null};return{item:IK(Q)}}})});import{z as tZ6}from"zod";function Cg$($){if(!$)return null;if("field"in $&&$.field[0]==="thread_id"&&$.operator==="eq")return String($.value);if("conditions"in $&&($.operator==="and"||$.operator==="or"))for(let Z of $.conditions){let Q=Cg$(Z);if(Q)return Q}return null}var oZ6,sZ6,Gg;var iJ1=L(()=>{jG();q0();Yg();oZ6=WF.extend({thread_id:tZ6.string().optional().describe("ID of the thread to list messages for (required)")}),sZ6=$L(Mg$),Gg=u({name:"COLLECTION_THREAD_MESSAGES_LIST",description:"List messages in a thread with pagination. Requires thread_id. Returns messages in chronological order.",annotations:{title:"List Thread Messages",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},inputSchema:oZ6,outputSchema:sZ6,handler:async($,Z)=>{Y0(Z),await Z.access.check();let Q=$.thread_id??Cg$($.where);if(!Q)throw Error("thread_id is required (provide as top-level param or in where clause)");let Y=$.offset??0,X=$.limit??100,J=$.orderBy?.[0]?.direction??"asc",G=await Z.storage.threads.get(Q);if(!G)return{items:[],totalCount:0,hasMore:!1};if(G.message_storage_version===2){let{messages:F,total:U}=await Z.storage.threads.messageParts().loadWindow(Q,{limit:X,offset:Y,includeInFlight:!0});return{items:F.map((N)=>({id:N.id,thread_id:Q,role:N.role,parts:N.parts,metadata:N.metadata??null,created_at:N.created_at,updated_at:N.created_at})),totalCount:U,hasMore:Y+X<U}}let{messages:W,total:K}=await Z.storage.threads.listMessages(Q,{limit:X,offset:Y,sort:J}),H=Y+X<K;return{items:W,totalCount:K,hasMore:H}}})});function _g$($){return{search_threads:t$({description:Xg.description,inputSchema:s(Xg.inputSchema),execute:(Z)=>Xg.execute(Z,$)}),get_thread:t$({description:Jg.description,inputSchema:s(Jg.inputSchema),execute:(Z)=>Jg.execute(Z,$)}),list_thread_messages:t$({description:Gg.description,inputSchema:s(Gg.inputSchema),execute:(Z)=>Gg.execute(Z,$)})}}var vg$=L(()=>{u4();mJ1();dJ1();iJ1()});import{randomBytes as rZ6}from"crypto";function RI0(){if(TI0)return TI0;let $;try{let Z=L0();$=Z.studioJwtSecret??Z.betterAuthSecret}catch{$=void 0}return TI0=$?Buffer.from($):rZ6(32),TI0}var TI0=null;var pJ1=L(()=>{r1()});import{createHmac as aZ6,timingSafeEqual as eZ6}from"crypto";function bg$($){return aZ6("sha256",RI0()).update($).digest("base64url")}function qI0($){let Z=Buffer.from(JSON.stringify($)).toString("base64url");return`${Z}.${bg$(Z)}`}function MI0($){let Z=$.indexOf(".");if(Z<=0)return null;let Q=$.slice(0,Z),Y=Buffer.from($.slice(Z+1)),X=Buffer.from(bg$(Q));if(Y.length!==X.length||!eZ6(Y,X))return null;try{return JSON.parse(Buffer.from(Q,"base64url").toString("utf8"))}catch{return null}}var nJ1=L(()=>{pJ1()});function fg$($){return qI0($)}function yg$($,Z=Date.now()){let Q=MI0($);if(typeof Q!=="object"||Q===null||typeof Q.organizationId!=="string"||typeof Q.attachmentId!=="string"||typeof Q.expiresAt!=="number")return null;let Y=Q;if(Y.expiresAt<=Z)return null;return Y}var xg$=600000;var tJ1=L(()=>{nJ1()});function tg$($){let Z=[];return SI0({lines:og$($),i:0},{media:ng$,allowMedia:!0,onImage:(Q)=>Z.push(Q)}),Z}function eJ1($,Z={}){let Q=SI0({lines:og$($),i:0},{media:Z.media??ng$,allowMedia:!0});if(Z.header)Q.unshift($G1(Z.header));return{type:"doc",version:1,content:Q.length>0?Q:[{type:"paragraph",content:[]}]}}function og$($){return $.replace(/\r\n?/g,`
 `).split(`
 `).map((Z)=>Z.replace(/^\t+/,(Q)=>" ".repeat(Q.length*4)))}function $G1($){return{type:"paragraph",content:$===""?[]:[{type:"text",text:$}]}}function $76($){return{...$,allowMedia:!1}}function SI0($,Z){let Q=[];while($.i<$.lines.length){let Y=$.lines[$.i]??"";if(Y.trim()===""){$.i++;continue}let X=rg$.exec(Y);if(X){Q.push(X76($,X));continue}if(ag$.test(Y)){$.i++,Q.push({type:"rule"});continue}let J=sg$.exec(Y);if(J){$.i++,Q.push({type:"heading",attrs:{level:(J[1]??"#").length},content:Wg(J[2]?.trim()??"",$76(Z))});continue}if(ZG1.test(Y)){Q.push(G76($,Z));continue}let G=QG1(Y);if(G){Q.push(W76($,G,Z));continue}let W=B76($,Z);if(W){Q.push(W);continue}Q.push(...D76($,Z))}return Q}function Y76($){return rg$.test($)||ag$.test($)||sg$.test($)||ZG1.test($)||QG1($)!==null}function sJ1($){let Z=0;while($[Z]===" ")Z++;return Z}function X76($,Z){let Q=Z[1]??"```",Y=J76(Z[2]??""),X=sJ1($.lines[$.i]??""),J=new RegExp(`^ {0,3}\\${Q[0]}{${Q.length},}[ 	]*$`);$.i++;let G=[];while($.i<$.lines.length){let K=$.lines[$.i]??"";if($.i++,J.test(K))break;G.push(K.slice(Math.min(X,sJ1(K))))}let W=G.join(`
 `);return{type:"codeBlock",...Y?{attrs:{language:Y}}:{},content:W===""?[]:[{type:"text",text:W}]}}function J76($){return $.toLowerCase().replace(/[^a-z0-9+#._-]/g,"").slice(0,20)}function G76($,Z){let Q=[];while($.i<$.lines.length){let X=ZG1.exec($.lines[$.i]??"");if(!X)break;Q.push(X[1]??""),$.i++}let Y=YG1(SI0({lines:Q,i:0},Z),eg$);return{type:"blockquote",content:Y.length>0?Y:[{type:"paragraph",content:[]}]}}function QG1($){let Z=Z76.exec($);if(Z){let Y=(Z[1]??"").length;return{indent:Y,contentIndent:Y+1+Math.min((Z[3]??" ").length,4),ordered:!1,start:1,text:Z[4]??""}}let Q=Q76.exec($);if(Q){let Y=(Q[1]??"").length,X=Q[2]??"1";return{indent:Y,contentIndent:Y+X.length+1+Math.min((Q[4]??" ").length,4),ordered:!0,start:Number(X),text:Q[5]??""}}return null}function W76($,Z,Q){let Y=[],X=Z;while(X){let J=[X.text];$.i++;let G=0;while($.i<$.lines.length){let K=$.lines[$.i]??"";if(K.trim()===""){G++,$.i++;continue}if(sJ1(K)<X.contentIndent)break;for(let H=0;H<G;H++)J.push("");G=0,J.push(K.slice(X.contentIndent)),$.i++}Y.push({type:"listItem",content:H76(SI0({lines:J,i:0},Q))});let W=QG1($.lines[$.i]??"");X=W&&W.ordered===X.ordered&&W.indent>=Z.indent?W:null}return Z.ordered?{type:"orderedList",...Z.start!==1?{attrs:{order:Z.start}}:{},content:Y}:{type:"bulletList",content:Y}}function H76($){let Z=YG1($,K76),Q=Z[0]?.type;if(Q!=="paragraph"&&Q!=="codeBlock")Z.unshift({type:"paragraph",content:[]});return Z}function YG1($,Z){let Q=[];for(let Y of $){if(Z.has(Y.type)){Q.push(Y);continue}if(Y.type==="heading"){Q.push({type:"paragraph",content:Y.content??[]});continue}if(Y.type==="blockquote"){Q.push(...YG1(Y.content??[],Z));continue}if(Y.type==="rule")continue;if(Y.type==="mediaSingle"){let J=R76(Y);if(J)Q.push($G1(J));continue}let X=F76(Y);if(X)Q.push(X)}return Q}function F76($){let Z=[],Q=(X)=>{if(X.type==="text"&&X.text)Z.push(X.text);for(let J of X.content??[])Q(J)};Q($);let Y=Z.join(" ").trim();return Y===""?null:$G1(Y)}function B76($,Z){let Q=II0($.lines[$.i]??"");if(!Q)return null;let Y=II0($.lines[$.i+1]??"");if(!Y||Y.length!==Q.length||!Y.every((G)=>N76.test(G)))return null;$.i+=2;let X=Math.min(Q.length,U76);if(Q.length>X)console.warn(`[jira] table has ${Q.length} columns; keeping the first ${X}`);let J=[hg$(Q,"tableHeader",X,Z)];while($.i<$.lines.length&&J.length<=gg$){let G=II0($.lines[$.i]??"");if(!G)break;J.push(hg$(G,"tableCell",X,Z)),$.i++}if(II0($.lines[$.i]??""))console.warn(`[jira] table exceeds ${gg$} rows; the rest render as text`);return{type:"table",attrs:{isNumberColumnEnabled:!1,layout:"default"},content:J}}function II0($){if(!$h$.test($))return null;let Z=[],Q=$.trim(),Y="";for(let X=1;X<Q.length;X++){let J=Q[X];if(J==="\\"&&Q[X+1]==="|"){Y+="|",X++;continue}if(J==="|"){Z.push(Y.trim()),Y="";continue}Y+=J}if(Y.trim()!=="")Z.push(Y.trim());return Z.length>0?Z:null}function hg$($,Z,Q,Y){return{type:"tableRow",content:Array.from({length:Q},(X,J)=>({type:Z,attrs:{},content:Zh$(Wg($[J]??"",Y))}))}}function ug$($){return{type:"paragraph",content:$}}function D76($,Z){let Q=[];while($.i<$.lines.length){let Y=$.lines[$.i]??"";if(Y.trim()==="")break;if(Q.length>0&&(Y76(Y)||$h$.test(Y)))break;Q.push(Q.length===0?Y:Y.trimStart()),$.i++}return Zh$(Wg(L76(Q),Z))}function Zh$($){let Z=[],Q=[],Y=()=>{while(Q[0]?.type==="hardBreak")Q.shift();while(Q.at(-1)?.type==="hardBreak")Q.pop();if(Q.length>0)Z.push(ug$(Q));Q=[]};for(let X of $){if(X.type==="mediaSingle"){Y(),Z.push(X);continue}Q.push(X)}return Y(),Z.length>0?Z:[ug$([])]}function L76($){let Z="";return $.forEach((Q,Y)=>{let X=Q.replace(/[ \t]+$/,""),J=/[ \t]{2,}$/.test(Q);if(!J&&/(?:^|[^\\])\\$/.test(X))J=!0,X=X.slice(0,-1);if(Z+=X,Y<$.length-1)Z+=J?`
@@ -4328,7 +4328,7 @@ ${J.join(`
 `)}`:X}function _55($){let Z=new Set;for(let Q of $)for(let Y of Q.split(`
 `)){let X=Y.trim();if(/^Co-authored-by:\s/i.test(X))Z.add(X)}return[...Z]}var mH8=200,P55=12,z55,T55,R55=6,M55=300,Dx0=3;var oE1=L(()=>{O7();UZ0();r$();Bx0();z55={aheadBy:0,behindBy:0,files:[]};T55=/(?:^|\/)\.deco\/blocks\/[^/]+\.json$/i});function b55($){if(!$||$.includes(".."))return!1;return v55.test($)}function pH8($){return x55.includes($)}function sE1($){let Z=typeof $.__resolveType==="string"?$.__resolveType:null;if(!Z||!b55(Z))return null;let{__resolveType:Q,...Y}=$;return{resolveType:Z,payload:Y}}function rE1($,Z){return`${$.replace(/\/+$/,"")}/deco/invoke/${Z}`}var v55,x55;var nH8=L(()=>{v55=/^[\w./@-]+$/;x55=["vtex/loaders/intelligentSearch/productList.ts","vtex/loaders/categories/tree.ts"]});function OZ0($,Z){let Q=$?.repository;if(!Q?.owner||!Q?.name)return null;if(!Q.connectionId)return Q;if(!Z.includes(Q.connectionId))return null;return Q}async function oH8($,Z,Q,Y){let X=$.organization?.id;if(!X)throw new Tz(t7);let J=await qN($.storage,X,Y);if(J&&await DL($.storage,J)){let F=await RN($,J,{forceRefresh:!0}).catch((U)=>{throw new Tz(U instanceof Error?U.message:t7)});await tH8($,Z,Q,F);return}let G=Y.connectionId??J?.legacyConnectionId;if(!G)throw new Tz("Push requires a connected git account. Connect the repository's provider for this project and restart the sandbox.");await Ji({ctx:$,connectionId:G,organizationId:X,forceRefresh:!0,onLegacyMintError:(F)=>{let U=F instanceof Error?F.message:t7;throw new Tz(U)}});let{cloneUrl:W,gitUserName:K,gitUserEmail:H}=await IN(G,Y.owner,Y.name,$.db,$.vault).catch((F)=>{let{code:U,message:N}=mz$(F instanceof Error?F.message:String(F));throw U?new Tz(N):F});await tH8($,Z,Q,{cloneUrl:W,gitUserName:K,gitUserEmail:H})}async function tH8($,Z,Q,Y){let{cloneUrl:X,gitUserName:J,gitUserEmail:G}=Y,W=kt($),K=await Z.proxyDaemonRequest(Q,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({git:{repository:{cloneUrl:X},identity:{userName:J,userEmail:G}},...W?{operator:W}:{}})});if(!K.ok){let H=await FP(K,f55).catch(()=>K.statusText);throw Error(`Failed to refresh sandbox git credentials (${K.status}): ${H}`)}}var f55=10485760,Tz;var aE1=L(()=>{v3();Yx0();t80();YN0();e$0();O7();Tz=class Tz extends Error{constructor($){super($);this.name="GitPushAuthError"}}});function g55($){let Z=$.startsWith("thread:")?$.slice(7):$;if(!Z||Z.length>255||Z.includes("..")||Z.startsWith("/")||Z.endsWith("/")||Z.endsWith(".lock")||!y55.test(Z))throw Error(`Invalid branch name: ${$}`)}function bh($){return AbortSignal.any([$.req.raw.signal,AbortSignal.timeout(u55)])}async function c55($,Z){let Q=$.var.studioContext,Y=LY(Z.branch),X=$.req.query("thread")??Y,J=X&&X===Y?Z.branchThread:X?await Q.storage.threads.get(X).catch(()=>null):null,G=J?.virtual_mcp_id===Z.virtualMcpId?J:null,W=ly(G?.metadata?.runtime);if(W)return W;let K=KM0(Z.virtualMcpMetadata),H=K==="cms"?await IE1(Q,{claimName:Z.claimName}):"alive",F=K==="cms"&&H!=="alive"?"cms":"sandbox",U=!!G&&(H==="gone"||H==="alive"&&K==="cms");if(U&&G)o80(Q,G.id,F);if(K==="cms")console.log("sandbox proxy: no runtime stamp",{route:$.req.path,method:$.req.method,reason:G?"unstamped":"threadless",liveness:H,resolved:F,stamped:U});return F}async function m55($){let Z=$.get("vmClaim");if(Z.runner)return Z.runner;try{return await WZ($.var.studioContext)}catch{return null}}function xt($){let{runner:Z}=$.get("vmClaim");if(!Z)return $.json({error:"No sandbox runner configured"},503);return Z}async function jZ0($){let{virtualMcpMetadata:Z,connectionIds:Q}=$.get("vmClaim"),Y=$.var.studioContext,X=OZ0(Z,Q);if(!X)throw new y0({provider:"github",status:404,message:"Project has no repository"});let J=Y0(Y);return Qi(Y,J.id,X)}function $P1($,Z){let Q=Z instanceof Error?Z.message:String(Z),Y=YP$(Z);if(Y!==void 0)return $.json({error:Q},429,{...uZ,...Y===null?{}:{"Retry-After":String(Math.ceil(Y/1000))}});if(Z instanceof Z5)return $.json({error:Q},409,uZ);let X=OK(Z);if(X!==null){let J=X===404?404:X===409||X===422?409:502;return $.json({error:Q},J,uZ)}return $.json({error:Q},502,uZ)}async function eE1($,Z,Q){let Y;try{Y=await fetch(Z,Q)}catch{return $.json({error:"Preview unreachable"},502)}let X;try{X=await Y.text()}catch{return $.json({error:"Preview unreachable"},502)}return new Response(X,{status:Y.status,headers:{"content-type":Y.headers.get("content-type")??"application/json"}})}async function aH8($){try{let Z=await jZ0($),Q=await nE1(Z,$.get("vmClaim").branch);return $.json(Q,200,uZ)}catch(Z){return $P1($,Z)}}function wZ0($,Z){let Y=(Ox0.get($)??Promise.resolve()).catch(()=>{}).then(Z),X=Y.catch(()=>{});return Ox0.set($,X),X.finally(()=>{if(Ox0.get($)===X)Ox0.delete($)}),Y}async function yQ($,Z,Q){if(!Q?.runner&&$.get("vmClaim").runtime==="cms")return $.json({error:"sandbox not found: this session is sandbox-less"},404,uZ);let Y=Q?.runner??xt($);if(Y instanceof Response)return Y;let{claimName:X,userId:J,projectRef:G}=$.get("vmClaim"),W=Q?.method??"POST",K=null,H=new Headers;if(Q?.jsonBody!==void 0)K=Q.jsonBody,H.set("content-type","application/json");else if(Q?.forwardJsonBody)K=await $.req.text(),H.set("content-type","application/json");let F=Q?.signal,U={method:W,headers:H,body:K,...F?{signal:F}:{}},N=async()=>{let B=await Y.proxyDaemonRequest(X,Z,U);if(Q?.map404to410&&B.status===404){try{await B.body?.cancel()}catch{}if(await Y.adoptLiveClaim({userId:J,projectRef:G},X))B=await Y.proxyDaemonRequest(X,Z,U);if(B.status===404){try{await B.body?.cancel()}catch{}return new Response(JSON.stringify({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."}),{status:410,headers:{"content-type":"application/json",...uZ}})}}let D=await B.text(),O=Q?.redactRepoDir?d55(D):D,w=B.headers.get("content-type")??"application/json";return new Response(O,{status:B.status,headers:{"content-type":w,...uZ}})};try{if(F){let B=N();return B.catch(()=>{}),await Promise.race([B,new Promise((O,w)=>{if(F.aborted)return w(F.reason);F.addEventListener("abort",()=>w(F.reason),{once:!0})})])}return await N()}catch(B){let D=B instanceof Error?B.message:String(B);return $.json({error:`Daemon unreachable: ${D}`},502)}}function d55($){try{let Z=JSON.parse($);if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&"repoDir"in Z)return JSON.stringify({...Z,repoDir:null})}catch{}return $}async function eH8($,Z,Q,Y="GET",X){let J=await $.proxyDaemonRequest(Z,Q,{method:Y,headers:new Headers,body:null});if(J.status===404&&X){try{await J.body?.cancel()}catch{}if(await $.adoptLiveClaim(X,Z))J=await $.proxyDaemonRequest(Z,Q,{method:Y,headers:new Headers,body:null})}if(J.status===404){try{await J.body?.cancel()}catch{}throw Error("SANDBOX_GONE")}let G=await J.text();if(!J.ok){let W=`Daemon error (${J.status})`;try{W=JSON.parse(G).error??W}catch{}throw Error(W)}return JSON.parse(G)}function i55($){return $F8.includes($)}var y55,h55=524288,sH8=65536,u55=1e4,rH8=2000,l55,Ox0,uZ,$F8,ZF8=()=>{let $=new Q1;$.use("/:virtualMcpId/:branch/*",l55),$.post("/:virtualMcpId/:branch/write",(Q)=>yQ(Q,"/_sandbox/write",{forwardJsonBody:!0,signal:bh(Q)})),$.post("/:virtualMcpId/:branch/unlink",(Q)=>yQ(Q,"/_sandbox/unlink",{forwardJsonBody:!0,signal:bh(Q)})),$.post("/:virtualMcpId/:branch/mkdir",(Q)=>yQ(Q,"/_sandbox/mkdir",{forwardJsonBody:!0,signal:bh(Q)})),$.post("/:virtualMcpId/:branch/rename",(Q)=>yQ(Q,"/_sandbox/rename",{forwardJsonBody:!0,signal:bh(Q)})),$.post("/:virtualMcpId/:branch/read",(Q)=>yQ(Q,"/_sandbox/read",{forwardJsonBody:!0,signal:bh(Q)})),$.post("/:virtualMcpId/:branch/glob",(Q)=>yQ(Q,"/_sandbox/glob",{forwardJsonBody:!0,signal:bh(Q)})),$.post("/:virtualMcpId/:branch/grep",(Q)=>yQ(Q,"/_sandbox/grep",{forwardJsonBody:!0,signal:bh(Q)})),$.post("/:virtualMcpId/:branch/exec/:script",async(Q)=>{let Y=Q.req.param("script");if(!Y)return Q.json({error:"missing script name"},400);return yQ(Q,`/_sandbox/exec/${encodeURIComponent(Y)}`)}),$.post("/:virtualMcpId/:branch/exec/:script/kill",async(Q)=>{let Y=Q.req.param("script");if(!Y)return Q.json({error:"missing script name"},400);return yQ(Q,`/_sandbox/exec/${encodeURIComponent(Y)}/kill`)}),$.get("/:virtualMcpId/:branch/config",(Q)=>yQ(Q,"/_sandbox/config",{method:"GET",map404to410:!0,redactRepoDir:!0})),$.put("/:virtualMcpId/:branch/config",(Q)=>yQ(Q,"/_sandbox/config",{method:"PUT",forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/setup/:step",async(Q)=>{let Y=Q.req.param("step");if(!Y||!i55(Y))return Q.json({error:`step must be one of: ${$F8.join(", ")}`},400);let X=Q.get("vmClaim"),J=await IE1(Q.var.studioContext,{claimName:X.claimName})==="gone"?null:await m55(Q);if(!J)return Q.json({error:"sandbox not found: nothing is running at this ref"},404,uZ);if(Y==="start"){let G=Y0(Q.var.studioContext),W=ui(X.virtualMcpMetadata);try{await XM0({ctx:Q.var.studioContext,runner:J,handle:X.claimName,orgId:G.id,userId:X.callerUserId,entries:W})}catch(K){let H=K instanceof Error?K.message:String(K);return Q.json({error:`Failed to push env to daemon: ${H}`},502)}}return yQ(Q,`/_sandbox/setup/${Y}`,{signal:Q.req.raw.signal,map404to410:!0,runner:J})}),$.get("/:virtualMcpId/:branch/events",(Q)=>{let Y=Q.get("vmClaim");if(!Y.runner)return PO(Q,async(X)=>{await X.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:"No sandbox runner configured on this studio instance."})})});return rK8(Q,{ctx:Q.var.studioContext,claimName:Y.claimName,runner:Y.runner,virtualMcpId:Y.virtualMcpId,branch:Y.branch,userId:Y.userId,projectRef:Y.projectRef,virtualMcpMetadata:Y.virtualMcpMetadata})}),$.get("/:virtualMcpId/:branch/git/status",(Q)=>{if(Q.get("vmClaim").runtime==="cms")return aH8(Q);return Z(Q)});let Z=(Q)=>yQ(Q,"/_sandbox/git/status",{method:"GET",map404to410:!0,signal:AbortSignal.any([Q.req.raw.signal,AbortSignal.timeout(rH8)])});return $.post("/:virtualMcpId/:branch/git/status",(Q)=>{if(Q.get("vmClaim").runtime==="cms")return aH8(Q);return yQ(Q,"/_sandbox/git/status",{map404to410:!0,signal:AbortSignal.any([Q.req.raw.signal,AbortSignal.timeout(rH8)])})}),$.post("/:virtualMcpId/:branch/git/diff",async(Q)=>{let Y=Q.get("vmClaim");if(Y.runtime==="cms")try{let X=await Q.req.json().catch(()=>({})),J=await jZ0(Q),G=await tE1(J,Y.branch,X.base);return Q.json(G,200,uZ)}catch(X){return $P1(Q,X)}return yQ(Q,"/_sandbox/git/diff",{forwardJsonBody:!0,map404to410:!0})}),$.post("/:virtualMcpId/:branch/git/publish",async(Q)=>{if(Q.get("vmClaim").runtime==="cms")return Q.json({ok:!0},200,uZ);let Y=xt(Q);if(Y instanceof Response)return Y;let{claimName:X,virtualMcpMetadata:J,connectionIds:G}=Q.get("vmClaim"),W=Q.var.studioContext;return wZ0(X,async()=>{try{await VE1(W,Y,X);let K=OZ0(J,G);if(K)await oH8(W,Y,X,K)}catch(K){if(K instanceof Tz)return Q.json({error:K.message},403,uZ);let H=K instanceof Error?K.message:String(K);return Q.json({error:H},502,uZ)}return yQ(Q,"/_sandbox/git/publish",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/discard",async(Q)=>{let Y=Q.get("vmClaim");if(Y.runtime==="cms")return wZ0(Y.claimName,async()=>{let X=await Q.req.json().catch(()=>({})),J=Array.isArray(X.filepaths)?X.filepaths.filter((G)=>typeof G==="string"):[];if(J.length===0)return Q.json({error:"filepaths is required"},400,uZ);try{let G=await jZ0(Q);return await iH8(G,Y.branch,J),Q.json({ok:!0},200,uZ)}catch(G){let W=OK(G)===409||G instanceof Z5?409:502,K=G instanceof Error?G.message:String(G);return Q.json({error:K},W,uZ)}});return wZ0(Y.claimName,()=>yQ(Q,"/_sandbox/git/discard",{forwardJsonBody:!0,map404to410:!0}))}),$.post("/:virtualMcpId/:branch/git/rebase",async(Q)=>{let Y=Q.get("vmClaim");if(Y.runtime==="cms")return wZ0(Y.claimName,async()=>{try{let W=await Q.req.json().catch(()=>({})),K=await jZ0(Q),H=W.base??await K.getDefaultBranch();return await Lx0(K,Y.branch,H),Q.json({ok:!0},200,uZ)}catch(W){return $P1(Q,W)}});let X=xt(Q);if(X instanceof Response)return X;let{claimName:J}=Q.get("vmClaim"),G=Q.var.studioContext;return wZ0(J,async()=>{try{await VE1(G,X,J)}catch(W){let K=W instanceof Error?W.message:String(W);return Q.json({error:K},502,uZ)}return yQ(Q,"/_sandbox/git/rebase",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/judge-review",h5({maxSize:h55,onError:(Q)=>Q.json({error:"Payload too large"},413,uZ)}),async(Q)=>{let Y=Q.get("vmClaim"),X=null;if(Y.runtime!=="cms"){let H=xt(Q);if(H instanceof Response)return H;X=H}let{claimName:J,userId:G,projectRef:W}=Y,K=Q.var.studioContext;try{let H=await Q.req.json().catch(()=>({})),F=H.status,U=H.diff,N=U!=null&&typeof U.diffs==="object"&&U.diffs!==null,[B,D]=$H8(F)&&N?[F,U]:X?await Promise.all([eH8(X,J,"/_sandbox/git/status","GET",{userId:G,projectRef:W}),eH8(X,J,"/_sandbox/git/diff","GET",{userId:G,projectRef:W})]):await(async()=>{let w=await jZ0(Q);return Promise.all([nE1(w,Y.branch),tE1(w,Y.branch)])})();await WK(K,Y0(K).id,"judging whether a change needs review");let O=await YH8(K,B,D,typeof H.language==="string"?H.language:void 0);return Q.json(O,200,uZ)}catch(H){let F=H instanceof Error?H.message:String(H);if(F==="SANDBOX_GONE")return Q.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,uZ);return Q.json({error:F},502,uZ)}}),$.get("/:virtualMcpId/:branch/preview-fetch",async(Q)=>{let Y=xt(Q);if(Y instanceof Response)return Y;let{claimName:X}=Q.get("vmClaim"),J=Q.req.query("path");if(!J||!J.startsWith("/")||J.startsWith("//")||J.includes("..")||J.includes("\\"))return Q.json({error:"Path not allowed"},403);let G;try{G=await Y.getPreviewUrl(X)}catch{return Q.json({error:"Preview not available"},502)}if(!G)return Q.json({error:"Preview not available"},502);let W=G.replace(/\/+$/,"");return eE1(Q,`${W}${J}`)}),$.post("/:virtualMcpId/:branch/preview-invoke",h5({maxSize:sH8,onError:(Q)=>Q.json({error:"Payload too large"},413)}),async(Q)=>{let Y=xt(Q);if(Y instanceof Response)return Y;let{claimName:X}=Q.get("vmClaim"),J;try{J=await Y.getPreviewUrl(X)}catch{return Q.json({error:"Preview not available"},502)}if(!J)return Q.json({error:"Preview not available"},502);let G;try{G=await Q.req.json()}catch{return Q.json({error:"Invalid JSON body"},400)}if(!G||typeof G!=="object"||Array.isArray(G))return Q.json({error:"Invalid JSON body"},400);let W=sE1(G);if(!W)return Q.json({error:"Invalid or missing __resolveType"},400);let K=rE1(J,W.resolveType);return eE1(Q,K,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(W.payload),signal:AbortSignal.timeout(30000)})}),$.post("/:virtualMcpId/:branch/catalog-invoke",h5({maxSize:sH8,onError:(Q)=>Q.json({error:"Payload too large"},413)}),async(Q)=>{let{runner:Y,claimName:X,virtualMcpMetadata:J}=Q.get("vmClaim"),G;try{G=Y?await Y.getPreviewUrl(X):li(J)}catch{return Q.json({error:"Preview not available"},502)}if(!G)return Q.json({error:"Preview not available"},502);let W;try{W=await Q.req.json()}catch{return Q.json({error:"Invalid JSON body"},400)}if(!W||typeof W!=="object"||Array.isArray(W))return Q.json({error:"Invalid JSON body"},400);let K=sE1(W);if(!K)return Q.json({error:"Invalid or missing __resolveType"},400);if(!pH8(K.resolveType))return Q.json({error:"resolveType not allowed"},403);let H=rE1(G,K.resolveType);return eE1(Q,H,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(K.payload),signal:AbortSignal.timeout(30000)})}),$};var QF8=L(()=>{W8();aK();Vt();ME1();hi();tK8();VQ();ci();oK8();OX();XF();sK8();aK8();gY1();n80();XH8();O7();k5();oE1();nH8();s80();aE1();y55=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;l55=Qx0(async($,Z)=>{let Q=$.var.studioContext;try{p(Q)}catch{return $.json({error:"Unauthorized"},401)}let Y=C0(Q);if(!Y)return $.json({error:"Unauthorized"},401);let X;try{X=Y0(Q)}catch{return $.json({error:"Organization scope required"},403)}let J=$.req.param("virtualMcpId"),G=$.req.param("branch");if(!J||!G)return $.json({error:"virtualMcpId and branch are required"},400);try{g55(G)}catch(O){let w=O instanceof Error?O.message:String(O);return $.json({error:w},400)}let W=await Q.storage.virtualMcps.findById(J);if(!W||W.organization_id!==X.id)return $.json({error:"Virtual MCP not found"},404);let K=V80({orgId:X.id,virtualMcpId:J,branch:G}),H=await pY1(Q,G),F=nY1(H,Y),U=nK8({userId:F,projectRef:K}),N=W.metadata??null,B=await c55($,{claimName:U,branch:G,virtualMcpId:J,sandboxUserId:F,virtualMcpMetadata:N,branchThread:H});if(B==="cms")return $.set("vmClaim",{claimName:U,callerUserId:Y,runner:null,virtualMcpId:J,branch:G,userId:F,projectRef:K,virtualMcpMetadata:N,connectionIds:W.connections?.map((O)=>O.connection_id)??[],runtime:B}),Z();let D;try{D=await WZ(Q)}catch{D=null}if(!D)return $.json({error:"No sandbox runner found"},404);return $.set("vmClaim",{claimName:U,callerUserId:Y,runner:D,virtualMcpId:J,branch:G,userId:F,projectRef:K,virtualMcpMetadata:N,connectionIds:W.connections?.map((O)=>O.connection_id)??[],runtime:B}),Z()});Ox0=new Map;uZ={"Cache-Control":"no-store, no-cache, must-revalidate",Pragma:"no-cache"};$F8=["clone","install","start"]});function YF8($,Z,Q){let Y=ZP1.get($);if(!Y)Y={pending:null,running:!1},ZP1.set($,Y);if(!Y.pending)Y.pending={patches:[],deps:Z};let X=Y.pending;X.deps=Z;let J=new Promise((G,W)=>{X.patches.push({patch:Q,resolve:G,reject:W})});if(!Y.running)n55($,Y);return J}async function n55($,Z){Z.running=!0;try{while(Z.pending){let Q=Z.pending;Z.pending=null;try{let{sha:Y,accepted:X,conflicts:J}=await s55(Q);for(let G of X)G.resolve(Y);for(let{queued:G,blocks:W}of J)G.reject(new wx0(W))}catch(Y){for(let X of Q.patches)X.reject(Y)}}}finally{if(Z.running=!1,!Z.pending)ZP1.delete($)}}async function t55($,Z,Q,Y){let X=new Map,J=[];for(let W of Q){let K=Nx0(Z,W)[0],H=K?Z.find((F)=>F.path===K):void 0;if(!H)X.set(W,null);else J.push({key:W,stem:H.stem,sha:H.sha})}let G=await iE1($,J,Y);for(let[W,{content:K}]of G.entries()){let H=J[W].key;try{X.set(H,await Jx0(JSON.parse(K)))}catch{X.set(H,XF8)}}return X}async function o55($,Z){let Q=new Map(Z),Y=[],X=[];for(let J of $){let{patch:G}=J,W=Object.entries(G.expect??{}).filter(([K,H])=>{let F=Q.get(K);return F!==XF8&&F!==H}).map(([K])=>K);if(W.length>0){X.push({queued:J,blocks:W});continue}Y.push(J);for(let[K,H]of Object.entries(G.set??{}))if(Q.has(K))Q.set(K,await Jx0(H));for(let K of G.delete??[])if(Q.has(K))Q.set(K,null)}return{accepted:Y,conflicts:X}}async function s55($){let{client:Z,branch:Q,packagePath:Y}=$.deps,X=new Map;for(let J=0;;J++){let G=await bt(Z,Q),W=await Z.listDecofileEntries(G,Y),K=dE1(W,Y),H=new Set($.patches.flatMap(({patch:j})=>Object.keys(j.expect??{}))),{accepted:F,conflicts:U}=await o55($.patches,H.size>0?await t55(Z,K,H,X):new Map),N=new Map,B=new Set;for(let{patch:j}of F){for(let[E,P]of Object.entries(j.set??{}))N.set(E,P),B.delete(E);for(let E of j.delete??[])B.add(E),N.delete(E)}let D=[],O=new Map(K.map((j)=>[j.path,{stem:j.stem,sha:j.sha}]));for(let[j,E]of N){let P=Nx0(K,j),T=`${JSON.stringify(E,null,2)}
 `;await uH8(Z.repo,T);let z=P[0]??`${Ux0(Y)}/${vE1(j)}.json`;D.push({path:z,content:T});let A=z.slice(z.lastIndexOf("/")+1,-5);O.set(z,{stem:A,content:T});for(let q of P.slice(1))D.push({path:q,deleted:!0}),O.delete(q)}for(let j of B)for(let E of Nx0(K,j))D.push({path:E,deleted:!0}),O.delete(E);if(D.length===0)return{sha:G,accepted:F,conflicts:U};let w=Y?`${Y}/.deco/blocks.gen.json`:".deco/blocks.gen.json";if(W.some((j)=>j.type==="blob"&&j.path===w)){let j=await iE1(Z,O.values(),X),{decofile:E,skipped:P}=KZ0(j);if(P.length>0)console.warn("decofile gen: dropped blocks that were not valid JSON",{repo:JF(Z.repo),branch:Q,packagePath:Y,blocks:P.map((T)=>T.key)});D.push({path:w,content:E})}try{let{sha:j}=await Z.commitFiles({branch:Q,message:r55(N,B,$.deps.coAuthor),expectedHead:G,changes:D});return{sha:j,accepted:F,conflicts:U}}catch(j){if(!(j instanceof Z5)||J>=p55-1)throw j;await F$(I7(2000,200,J,2,0.5))}}}function r55($,Z,Q){let Y=(G)=>{let W=G.slice(0,3).join(", ");return G.length>3?`${W} (+${G.length-3} more)`:W},X=[];if($.size>0)X.push(`update ${Y([...$.keys()])}`);if(Z.size>0)X.push(`delete ${Y([...Z])}`);let J=`chore(decofile): ${X.join("; ")}`;return KQ1(J,Q)}var p55=3,wx0,ZP1,XF8;var JF8=L(()=>{Rq0();UZ0();t4();r$();O7();Bx0();wx0=class wx0 extends Error{blocks;constructor($){super(`Blocks changed since they were loaded: ${$.join(", ")}`);this.blocks=$;this.name="BlockConflictError"}};ZP1=new Map;XF8=Symbol("unreadable")});import{createHmac as GF8,randomBytes as a55,timingSafeEqual as e55}from"crypto";function WF8(){if(jx0)return jx0;let $;try{let Z=L0();$=Z.studioJwtSecret??Z.betterAuthSecret}catch{$=void 0}return jx0=$?Buffer.from($):a55(32),jx0}function QP1($){let Z=$.nowMs??Date.now(),Q={o:$.organizationId,m:$.virtualMcpId,b:$.branch,e:Math.floor((Z+$95)/1000)},Y=Buffer.from(JSON.stringify(Q)).toString("base64url"),X=GF8("sha256",WF8()).update(Y).digest("base64url");return`${Y}.${X}`}function KF8($,Z){let Q=$.indexOf(".");if(Q<0)return!1;let Y=$.slice(0,Q),X=Buffer.from($.slice(Q+1)),J=Buffer.from(GF8("sha256",WF8()).update(Y).digest("base64url"));if(X.length!==J.length||!e55(X,J))return!1;let G;try{G=JSON.parse(Buffer.from(Y,"base64url").toString())}catch{return!1}let W=Math.floor((Z.nowMs??Date.now())/1000);return G.o===Z.organizationId&&G.m===Z.virtualMcpId&&G.b===Z.branch&&typeof G.e==="number"&&G.e>=W}var $95=21600000,jx0=null;var HF8=L(()=>{r1()});function Ex0($){return $&&typeof $==="object"&&!Array.isArray($)?$:null}function Z95($){for(let[Z,Q]of Object.entries($)){if(!Z.startsWith("collections/blog/posts/"))continue;let Y=Ex0(Q)?.__resolveType;if(typeof Y==="string"&&Y)return Y}return"blog/loaders/Blogpost.ts"}function FF8($){let Z;try{Z=Ex0(JSON.parse($))}catch{return $}if(!Z)return $;let Q=Z95(Z),Y={...Z},X=0;for(let[J,G]of Object.entries(Z)){if(!J.startsWith("blog-manager/posts/"))continue;let W=Ex0(G),K=W&&Ex0(W.post);if(!K)continue;if(K.status==="archived")continue;if(typeof K.slug!=="string"||!K.slug)continue;let F=`collections/blog/posts/${J.slice(19)}`;if(Object.hasOwn(Y,F))continue;Y[F]={name:F,__resolveType:Q,["post"]:{...K,status:"published"}},X++}return X>0?JSON.stringify(Y):$}import{z as AO}from"zod";function Y95($){return $.length>0&&$.length<=255&&!$.includes("..")&&!$.endsWith("/")&&!$.endsWith(".lock")&&Q95.test($)}function LF8($){return $.req.header("x-forwarded-host")??new URL($.req.url).host}async function EZ0($){let Z=$.get("decofileScope");return Qi($.var.studioContext,Z.organizationId,Z.repository)}function PZ0($,Z){let Q=Z instanceof Error?Z.message:String(Z);if(Z instanceof wx0)return $.json({error:Q,code:"block-conflict",blocks:Z.blocks},409);if(Z instanceof Z5)return $.json({error:Q},409);let Y=OK(Z);if(Y!==null){let X=Y===404?404:Y===409||Y===422?409:502;return $.json({error:Q},X)}return $.json({error:Q},500)}function OF8(){let $=new Q1;return $.use("/:virtualMcpId/:branch",DF8),$.use("/:virtualMcpId/:branch/*",DF8),$.get("/:virtualMcpId/:branch",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await EZ0(Z),X=await lH8(Y,Q.branch,Q.packagePath,{createBranchIfMissing:!!Q.userId}),J={ETag:`"${X.sha}"`,"Cache-Control":"no-store","Access-Control-Allow-Origin":"*"};if(Z.req.header("if-none-match")===`"${X.sha}"`)return Z.body(null,304,J);if(!Q.userId)return Z.body(FF8(X.decofile),200,{...J,"content-type":"application/json"});let G=QP1({organizationId:Q.organizationId,virtualMcpId:Q.virtualMcpId,branch:Q.branch});return Z.body(`{"version":${JSON.stringify(X.sha)},"token":${JSON.stringify(G)},"apiHost":${JSON.stringify(LF8(Z))},"decofile":${X.decofile}}`,200,{...J,"content-type":"application/json"})}catch(Y){return PZ0(Z,Y)}}),$.get("/:virtualMcpId/:branch/meta",async(Z)=>{let Q=Z.get("decofileScope"),Y=Q.packagePath?`${Q.packagePath}/.deco/meta.gen.json`:".deco/meta.gen.json";try{let X=await EZ0(Z),J=await X.readFileAtRef(Q.branch,Y);if(J===null){let G=await X.getDefaultBranch();if(G!==Q.branch)J=await X.readFileAtRef(G,Y)}if(J===null)return Z.json({error:"meta.gen.json not committed"},404);return Z.body(J,200,{"content-type":"application/json","Cache-Control":"no-store","Access-Control-Allow-Origin":"*"})}catch(X){return PZ0(Z,X)}}),$.patch("/:virtualMcpId/:branch",J95,async(Z)=>{let Q=Z.get("decofileScope"),Y=Z.var.studioContext,X=G95.safeParse(await Z.req.json().catch(()=>null));if(!X.success)return Z.json({error:"Invalid body",details:X.error.issues},400);let J;try{J=_h(X.data)}catch(G){if(G instanceof HZ0)return Z.json({error:G.message},400);throw G}for(let G of[...Object.keys(J.set??{}),...J.delete??[]])try{Xx0(G)}catch(W){let K=W instanceof Error?W.message:String(W);return Z.json({error:K},400)}for(let[G,W]of Object.entries(J.set??{})){if(typeof W!=="object"||W===null||Array.isArray(W))return Z.json({error:`Block "${G}" must be a JSON object`},400);if(_E1(G))return Z.json({error:`Block key "${G}" collides with a framework resolver module and cannot be written`},400)}try{let G=await EZ0(Z),W=await YF8(`${Q.organizationId}/${Q.virtualMcpId}/${Q.branch}`,{client:G,branch:Q.branch,packagePath:Q.packagePath,coAuthor:kt(Y)},J),K=QP1({organizationId:Q.organizationId,virtualMcpId:Q.virtualMcpId,branch:Q.branch});return Z.json({version:W,token:K,apiHost:LF8(Z)})}catch(G){return PZ0(Z,G)}}),$.post("/:virtualMcpId/:branch/publish",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await EZ0(Z),X=await Y.getDefaultBranch();if(X===Q.branch)return Z.json({error:"Branch is already the default branch"},400);let J=`chore(decofile): publish ${Q.branch}`;try{let G;try{G=await Y.mergeBranches(X,Q.branch,J)}catch(W){if(OK(W)!==409)throw W;await Lx0(Y,Q.branch,X),G=await Y.mergeBranches(X,Q.branch,J)}return G?Z.json({result:"merged",sha:G}):Z.json({result:"up-to-date"})}catch(G){if(OK(G)===409)return Z.json({error:"merge-conflict"},409);if(OK(G)===405){let K=await Y.findOpenChangeRequest(X,Q.branch)??await Y.createChangeRequest({base:X,head:Q.branch,title:`Publish ${Q.branch}`});return Z.json({result:"pull-request",number:K.number,url:K.url})}throw G}}catch(Y){return PZ0(Z,Y)}}),$.get("/:virtualMcpId/:branch/status",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await EZ0(Z),X=await Y.getDefaultBranch();if(X===Q.branch)return Z.json({baseBranch:X,aheadBy:0,behindBy:0});try{let{aheadBy:J,behindBy:G}=await Y.compare(X,Q.branch);return Z.json({baseBranch:X,aheadBy:J,behindBy:G})}catch(J){if(OK(J)===404)return Z.json({baseBranch:X,aheadBy:0,behindBy:0});throw J}}catch(Y){return PZ0(Z,Y)}}),$}var Q95,UF8=500,NF8=1048576,BF8=1024,X95=8388608,J95,G95,DF8;var wF8=L(()=>{s80();UZ0();W8();aK();ME1();Yx0();aE1();O7();JF8();HF8();oE1();Bx0();XF();Q95=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;J95=h5({maxSize:X95,onError:($)=>$.json({error:"Payload too large"},413)}),G95=AO.object({set:AO.record(AO.string(),AO.unknown()).optional(),delete:AO.array(AO.string()).optional(),expect:AO.record(AO.string(),AO.string().regex(/^[0-9a-f]{64}$/).nullable()).optional()}).refine(($)=>Object.keys($.set??{}).length>0||($.delete?.length??0)>0,{message:"Patch must set or delete at least one block"}).refine(($)=>Object.keys($.set??{}).length+($.delete?.length??0)<=UF8,{message:`Patch cannot touch more than ${UF8} blocks`}).refine(($)=>Object.values($.set??{}).every((Z)=>JSON.stringify(Z).length<=NF8),{message:`Each block must be at most ${NF8} bytes`}).refine(($)=>[...Object.keys($.set??{}),...$.delete??[]].every((Z)=>Z.length<=BF8),{message:`Each block key must be at most ${BF8} characters`}).refine(($)=>Object.keys($.expect??{}).every((Z)=>(Z in($.set??{}))||($.delete??[]).includes(Z)),{message:"Each expected block must be one the patch sets or deletes"}).refine(($)=>Object.keys($.set??{}).every((Z)=>!($.delete??[]).includes(Z)),{message:"A block cannot be both set and deleted in the same patch"}),DF8=Qx0(async($,Z)=>{let Q=$.var.studioContext,Y=Q.organization;if(!Y)return $.json({error:"Organization scope required"},500);let X=$.req.param("virtualMcpId"),J=$.req.param("branch");if(!X||!J)return $.json({error:"virtualMcpId and branch are required"},400);if(!Y95(J))return $.json({error:`Invalid branch name: ${J}`},400);let G=Q.auth?.user?.id??null;if(!G){let B=$.req.query("token");if(!($.req.method==="GET"&&!$.req.path.match(/\/(publish|status)$/)))return $.json({error:"Unauthorized"},401);if(!B||!KF8(B,{organizationId:Y.id,virtualMcpId:X,branch:J}))return $.json({error:"Unauthorized"},401)}if(!await LG(Q,Y.id,"cms"))return $.json({error:"This organization's plan does not include the CMS",code:"feature_not_in_plan"},403);let W=await Q.storage.virtualMcps.findById(X);if(!W||W.organization_id!==Y.id)return $.json({error:"Virtual MCP not found"},404);let K=W.metadata??null;if(!li(K))return $.json({error:"Project has no preview server configured"},404);let F=W.connections?.map((B)=>B.connection_id)??[],U=OZ0(K,F);if(!U)return $.json({error:"Project has no repository"},404);let N=K?.runtime;return $.set("decofileScope",{organizationId:Y.id,virtualMcpId:X,branch:J,packagePath:N?.path?.replace(/^\/+|\/+$/g,"")||null,repository:U,userId:G}),Z()})});var jF8=($)=>{let Z=new Q1;if(Z.use("*",Jt),Z.use("*",mJ8),Z.route("/",lJ8($.voiceSessions)),Z.route("/",Ub0()),Z.route("/",OG8()),Z.route("/",VG8()),Z.route("/",UG8()),Z.route("/",_K8()),Z.route("/",bK8()),Z.route("/",RK8()),Z.route("/",SK8()),Z.route("/",MK8()),Z.route("/",eb0()),Z.route("/tools",lK8()),Z.route("/",gK8()),Z.route("/",XK8({kvStorage:$.kvStorage})),Z.route("/",QK8()),Z.route("/fs",LK8({getConnection:$.getNatsConnection})),Z.route("/sandbox",ZF8()),Z.route("/decofile",OF8()),Z.route("/",zK8()),Z.route("/",wK8()),Z.route("/deco-sites",Bb0()),Z.route("/hosting",$G8()),Z.route("/monitor",WG8()),Z.route("/sso",Jb0()),Z.route("/",$x0({tokenStorage:$.tokenStorage,automationEventDispatcher:$.automationEventDispatcher})),Z.route("/webhooks",oJ8()),$.mountDevAssets)Z.route("/dev-assets",wb0({orgFromPath:!0}));Z.use("/mcp/:connectionId?",$.mcpAuth),Z.use("/mcp/:connectionId/ui-resource",$.mcpAuth),Z.use("/mcp/gateway/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/virtual-mcp/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/self",$.mcpAuth);for(let Q of wE1)Z.use(`${Q}/:threadId`,$.mcpAuth);Z.route("/",gQ8()),Z.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",$.betterAuthProtectedResourceHandler),Z.get("/mcp/.well-known/oauth-protected-resource",$.betterAuthProtectedResourceHandler);for(let Q of wE1)Z.route(Q,EK8());return Z.route("/mcp",ck0()),Z.route("/mcp/self",ob0()),Z.route("/mcp",ik0()),Z.all("/oauth-proxy/:connectionId/*",$.oauthProxyHandler),Z.get("/watch",$.watchHandler),Z};var EF8=L(()=>{W8();cJ8();dJ8();tv0();sJ8();iw1();ZG8();KG8();jb0();wz();uw1();wG8();sw1();YK8();JK8();OK8();jK8();t60();Cw1();pk0();OE1();PK8();AK8();qK8();IK8();PE1();vK8();xK8();hK8();zE1();cK8();AE1();mk0();QF8();wF8()});import{z as xh}from"zod";class YP1{adapter;getConnection;kvPromise;constructor($,Z){this.adapter=$;this.getConnection=Z}kv(){let $=this.getConnection();if(!$||$.isClosed())throw new I1(503,{message:"Voice transport is unavailable"});return this.kvPromise??=new AF8.Kvm(Px0.jetstream($)).create("STUDIO_VOICE_SESSIONS",{storage:Px0.StorageType.Memory,ttl:TF8.nanos(IL),max_bytes:10485760}).catch((Z)=>{throw this.kvPromise=void 0,Z}),this.kvPromise}async conversationAgent($){let Z=await this.kv(),Q=`agent.${$.conversationKey}`,Y=Date.now()+45000;while(Date.now()<Y){let X=await Z.get(Q),J=X?.operation==="PUT"?zF8.parse(X.json()):null;if(J?.state==="ready")return J.agentId;if(J?.state==="creating"&&J.expiresAt>Date.now()){await F$(200);continue}let G=PF8.encode(JSON.stringify({state:"creating",expiresAt:Date.now()+40000})),W;try{W=X&&J?await Z.update(Q,G,X.revision):await Z.create(Q,G)}catch{await F$(200);continue}try{let K=await $.ensureConversationAgent();return await Z.update(Q,PF8.encode(JSON.stringify({state:"ready",agentId:K})),W),K}catch(K){throw await Z.delete(Q,{previousSeq:W}).catch(()=>{}),K}}throw new I1(503,{message:"Voice conversation is starting; try again"})}async createSession($){let Z=this.adapter.forConversationModel($.model),Q=await this.conversationAgent(Z);try{return{provider:"elevenlabs",conversationToken:await Z.createConversationToken(Q)}}catch(Y){let X=await this.kv(),J=`agent.${Z.conversationKey}`,G=await X.get(J),W=G?.operation==="PUT"?zF8.parse(G.json()):null;if(G&&W?.state==="ready"&&W.agentId===Q)await X.delete(J,{previousSeq:G.revision}).catch(()=>{});throw Y}}}var Px0,AF8,TF8,PF8,zF8;var RF8=L(()=>{$G();hN();r$();Px0=C(UH(),1),AF8=C(ST(),1),TF8=C(iz(),1),PF8=new TextEncoder,zF8=xh.discriminatedUnion("state",[xh.object({state:xh.literal("ready"),agentId:xh.string()}),xh.object({state:xh.literal("creating"),expiresAt:xh.number()})])});import{z as ft}from"zod";function W95($){return{model:$.model,instructions:`${NC$}
-Start in ${$.language==="pt"?"Brazilian Portuguese":"English"}, and follow the user's language.`,delegation:{type:"client"},audio:{output:{voice:$.voice}},store:!1}}class XP1{config;constructor($){this.config=$}async createSession(){return{provider:"openai",transport:"webrtc"}}async negotiate($){let Z=await fetch("https://api.openai.com/v1/live/sessions",{method:"POST",headers:{Authorization:`Bearer ${this.config.apiKey}`,"Content-Type":"application/json","OpenAI-Safety-Identifier":$.safetyIdentifier},body:JSON.stringify({session:W95({...this.config,language:$.language,model:$.model}),transport:{type:"webrtc",sdp:$.sdp}}),signal:AbortSignal.timeout(15000)});if(!Z.ok)throw await Z.body?.cancel(),Error(`OpenAI Live request failed (${Z.status})`);return{sdp:ft.object({session:ft.object({id:ft.string().min(1)}),transport:ft.object({type:ft.literal("webrtc"),sdp:ft.string().min(1).max(1e5)})}).parse(await Z.json()).transport.sdp}}}var qF8=L(()=>{hN()});var MF8;var IF8=L(()=>{MF8=[{name:"delegate_to_agent",description:"Submit a complete request to the selected Studio agent. Returns after acceptance while work continues in the background. Results arrive later.",parameters:{type:"object",properties:{request:{type:"string",description:"The complete user request, with relevant conversational details. Preserve intent and constraints."}},required:["request"]}},{name:"get_agent_status",description:"Read the current chat's work status and known results. This does not track independent organization tasks; delegate fresh task-status queries to the Studio agent. Use when asked, never poll.",parameters:{type:"object",properties:{}}},{name:"stop_agent_work",description:"Request cancellation in the current chat ONLY when the user explicitly asks. Speaking over the companion is not cancellation. To stop independent tasks, delegate that request to the Studio agent.",parameters:{type:"object",properties:{}}}]});function JP1($){return{conversation_config:{agent:{first_message:"",language:"en",prompt:{prompt:FC$,llm:$.conversationModel,thinking_budget:0,max_tokens:512,tools:MF8.map((Z)=>({...Z,type:"client",expects_response:!0,response_timeout_secs:Z.name==="delegate_to_agent"?20:5,...Z.name==="delegate_to_agent"?{execution_mode:"async",interruption_mode:"allow",pre_tool_speech:"off"}:{}}))}},asr:{provider:"scribe_realtime",quality:"high"},turn:{turn_eagerness:"normal",turn_timeout:-1,silence_end_call_timeout:-1},tts:{voice_id:$.voiceId,model_id:$.model},conversation:{max_duration_seconds:IL/1000,client_events:["audio","interruption","user_transcript","agent_response","client_tool_call","vad_score"]}},platform_settings:{auth:{enable_auth:!0},privacy:{record_voice:!1,retention_days:1,delete_audio:!0,delete_transcript_and_pii:!0},overrides:{conversation_config_override:{agent:{language:!0}}}}}}var VF8=L(()=>{hN();IF8()});import{z as vJ}from"zod";import{createHash as K95,createHmac as H95}from"crypto";class zx0{config;conversationKey;configurationKey;constructor($){this.config=$;this.configurationKey=K95("sha256").update(JSON.stringify(JP1($))).digest("hex"),this.conversationKey=H95("sha256",$.apiKey).update(this.configurationKey).digest("hex")}forConversationModel($){return $===this.config.conversationModel?this:new zx0({...this.config,conversationModel:$})}async request($,Z,Q){let Y=await fetch(`https://api.elevenlabs.io/v1${$}`,{method:Z===void 0?"GET":"POST",headers:{"xi-api-key":this.config.apiKey,"Content-Type":"application/json"},body:JSON.stringify(Z),signal:Q});if(!Y.ok)throw await Y.body?.cancel(),Error(`ElevenLabs request failed (${Y.status})`);return Y}async ensureConversationAgent(){let $=`Studio voice ${this.configurationKey.slice(0,24)}`,Z=await this.request(`/convai/agents?search=${encodeURIComponent($)}&page_size=100`,void 0,AbortSignal.timeout(15000)),{agents:Q}=vJ.object({agents:vJ.array(vJ.object({agent_id:vJ.string(),name:vJ.string()}))}).parse(await Z.json()),Y=Q.find((J)=>J.name===$);if(Y){let J=await this.request(`/convai/agents/${encodeURIComponent(Y.agent_id)}`,void 0,AbortSignal.timeout(15000));return vJ.object({platform_settings:vJ.object({auth:vJ.object({enable_auth:vJ.literal(!0)})})}).parse(await J.json()),Y.agent_id}let X=await this.request("/convai/agents/create",{name:$,...JP1(this.config)},AbortSignal.timeout(15000));return vJ.object({agent_id:vJ.string().min(1)}).parse(await X.json()).agent_id}async createConversationToken($){let Z=await this.request(`/convai/conversation/token?agent_id=${encodeURIComponent($)}`,void 0,AbortSignal.timeout(15000));return vJ.object({token:vJ.string().min(1)}).parse(await Z.json()).token}async createTranscriptionToken(){let $=await this.request("/single-use-token/realtime_scribe",{},AbortSignal.timeout(15000));return vJ.object({token:vJ.string().min(1)}).parse(await $.json()).token}synthesize($,Z){return this.request(`/text-to-speech/${encodeURIComponent(this.config.voiceId)}/stream?output_format=mp3_44100_128`,{text:$,model_id:this.config.model},AbortSignal.any([Z,AbortSignal.timeout(60000)]))}}var kF8=L(()=>{VF8()});import{createHmac as F95,timingSafeEqual as U95}from"crypto";import{z as yt}from"zod";function CF8($,Z){if(!Z)throw Error("Voice requires a shared authentication secret");return F95("sha256",Z).update(`studio-voice-session:v1:${$}`).digest("base64url")}function _F8($,Z){let Q=Buffer.from(JSON.stringify(SF8.parse($))).toString("base64url");return`${Q}.${CF8(Q,Z)}`}function vF8($,Z,Q=Date.now()){if(!Z||$.length>4096)return null;let Y=$.split(".");if(Y.length!==2)return null;let[X,J]=Y;if(!X||!J)return null;let G=Buffer.from(CF8(X,Z)),W=Buffer.from(J);if(W.length!==G.length||!U95(W,G))return null;try{let K=SF8.safeParse(JSON.parse(Buffer.from(X,"base64url").toString()));if(!K.success||K.data.expiresAt<=Q||K.data.expiresAt>Q+IL)return null;return K.data}catch{return null}}var SF8;var bF8=L(()=>{hN();SF8=yt.object({sessionId:yt.string().uuid(),organizationId:yt.string().min(1).max(256),userId:yt.string().min(1).max(256),threadId:yt.string().min(1).max(256),expiresAt:yt.number().int().positive()})});import{z as GP1}from"zod";function xF8($,Z){if(Z?.voice_model!=null&&Z.voice_provider==null)throw Error("A voice model override requires a provider");let Q=Z?.voice_provider??$.voiceConversationProvider;return WP1.parse({provider:Q,model:Z?.voice_model??(Q==="openai"?$.openaiLiveModel:$.elevenlabsConversationModel)})}var WP1;var fF8=L(()=>{WP1=GP1.object({provider:GP1.enum(["elevenlabs","openai"]),model:GP1.string().trim().min(1).max(128)})});import{createHash as N95}from"crypto";import{z as gt}from"zod";function ht($){return`user.${N95("sha256").update(JSON.stringify([$.organizationId,$.userId])).digest("hex")}`}class HP1{deps;kvPromise;constructor($){this.deps=$}kv(){let $=this.deps.getConnection();if(!$||$.isClosed())throw new I1(503,{message:"Voice transport is unavailable"});return this.kvPromise??=new yF8.Kvm(Tx0.jetstream($)).create("STUDIO_VOICE_SESSIONS",{storage:Tx0.StorageType.Memory,ttl:gF8.nanos(IL),max_bytes:10485760}).catch((Z)=>{throw this.kvPromise=void 0,Z}),this.kvPromise}adapter(){if(!this.deps.adapter)throw new I1(503,{message:"Voice is not configured on this deployment"});return this.deps.adapter}async create($,Z=!1,Q="en",Y){let X;if(Z)try{X=xF8(this.deps.defaults,Y)}catch{throw new I1(503,{message:"Voice configuration is invalid"})}let J=X?this.deps.conversationAdapters[X.provider]:this.adapter();if(!J)throw new I1(503,{message:"Voice is not configured on this deployment"});let G={...$,sessionId:crypto.randomUUID(),expiresAt:Date.now()+IL},W=_F8(G,this.deps.secret),K=await this.kv(),H=ht(G),F=await K.get(H),U=F?.operation==="PUT"?Ax0.parse(F.json()):null,N=KP1.encode(JSON.stringify({sessionId:G.sessionId,expiresAt:G.expiresAt,conversation:X,characters:0,requests:0}));try{if(F&&U&&U.expiresAt<=Date.now())await K.update(H,N,F.revision);else await K.create(H,N)}catch{throw new I1(409,{message:"Close your other voice session before starting a new one"})}try{if(X&&"createSession"in J){let D=await J.createSession({language:Q,model:X.model,safetyIdentifier:ht($)});return{token:W,...D,expiresAt:G.expiresAt}}let B=await this.adapter().createTranscriptionToken();return{token:W,transcriptionToken:B,expiresAt:G.expiresAt}}catch(B){throw await this.release(G),B}}authorize($,Z){let Q=vF8(Z,this.deps.secret);if(!Q||Q.organizationId!==$.organizationId||Q.userId!==$.userId||Q.threadId!==$.threadId)throw new I1(403,{message:"Invalid voice session"});return Q}async connect($,Z){let Q=this.authorize($,Z.token),Y=await this.kv(),X=ht(Q),J=await Y.get(X),G=J?.operation==="PUT"?Ax0.parse(J.json()):null;if(!J||!G||G.sessionId!==Q.sessionId||G.expiresAt<=Date.now())throw new I1(403,{message:"Voice session expired"});let W=G.conversation?this.deps.conversationAdapters[G.conversation.provider]:null;if(!W?.negotiate||!G.conversation)throw new I1(409,{message:"Voice session does not support SDP negotiation"});if(G.connected)throw new I1(409,{message:"Voice session already connected"});try{await Y.update(X,KP1.encode(JSON.stringify({...G,connected:!0})),J.revision)}catch{throw new I1(409,{message:"Voice session is busy"})}return W.negotiate({sdp:Z.sdp,language:Z.language,model:G.conversation.model,safetyIdentifier:X})}async speak($,Z,Q,Y){let X=this.authorize($,Z),J=await this.kv(),G=ht(X);for(let W=0;;W++){let K=await J.get(G),H=K?.operation==="PUT"?Ax0.parse(K.json()):null;if(!K||!H||H.sessionId!==X.sessionId||H.expiresAt<=Date.now())throw new I1(403,{message:"Voice session expired"});if(H.characters+Q.length>24000||H.requests>=120)throw new I1(429,{message:"Voice session speech limit reached"});try{await J.update(G,KP1.encode(JSON.stringify({...H,characters:H.characters+Q.length,requests:H.requests+1})),K.revision);break}catch{if(W>=2)throw new I1(409,{message:"Voice session is busy"})}}return this.adapter().synthesize(Q,Y)}async release($){let Z=await this.kv(),Q=await Z.get(ht($));if(Q?.operation==="PUT"&&Ax0.parse(Q.json()).sessionId===$.sessionId)await Z.delete(ht($),{previousSeq:Q.revision})}async revoke($,Z){await this.release(this.authorize($,Z))}}var Tx0,yF8,gF8,Ax0,KP1;var hF8=L(()=>{$G();hN();bF8();fF8();Tx0=C(UH(),1),yF8=C(ST(),1),gF8=C(iz(),1),Ax0=gt.object({sessionId:gt.string().uuid(),expiresAt:gt.number(),connected:gt.boolean().optional(),conversation:WP1.optional(),characters:gt.number().int().nonnegative(),requests:gt.number().int().nonnegative()}),KP1=new TextEncoder});function B95($){return $.filter((Z)=>Z.vendors?.alias).map((Z)=>({name:Z.name,title:Z.title,description:Z.description,logo:Z.logo,category:Z.category,vendor:{alias:Z.vendors.alias,url:Z.vendors.url}}))}var D95=async($,Z)=>{if(!$.get("studioContext").auth.user?.id)return $.json({error:"Unauthorized"},401);return Z()},uF8=()=>{let $=new Q1;return $.use("*",D95),$.get("/",async(Z)=>{let Q=L0(),Y=Q.decoSupabaseUrl,X=Q.decoSupabaseServiceKey;if(!Y||!X)return Z.json({apps:[]});try{let J=await hG(Y,X,"apps?select=name,title,description,logo,category,vendors(alias,url)");return Z.json({apps:B95(J)})}catch(J){return console.error("[deco-apps] GET error:",J),Z.json({error:"Failed to fetch apps"},502)}}),$};var lF8=L(()=>{W8();r1();b_0()});import{z as c1}from"zod";function PB($,Z="invalid_request_error",Q=null,Y=null){return{error:{message:$,type:Z,param:Q,code:Y}}}function R95($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let Q=$.substring(0,Z),Y=$.substring(Z+1);if(!Q||!Y)return null;return{credentialId:Q,modelId:Y}}function q95($,Z,Q){try{return JSON.parse($)}catch{throw new dF8(`Invalid JSON in tool call arguments for function '${Q}' (tool_call_id: ${Z}): ${$}`)}}function M95($){let Z={};for(let Q of $)if(Q.role==="assistant"&&Q.tool_calls)for(let Y of Q.tool_calls)Z[Y.id]=Y.function.name;return $.map((Q)=>{switch(Q.role){case"system":return{role:"system",content:Q.content};case"user":if(typeof Q.content==="string")return{role:"user",content:Q.content};return{role:"user",content:Q.content.map((X)=>{if(X.type==="text")return{type:"text",text:X.text};return{type:"image",image:X.image_url.url}})};case"assistant":if(Q.tool_calls&&Q.tool_calls.length>0)return{role:"assistant",content:Q.tool_calls.map((X)=>({type:"tool-call",toolCallId:X.id,toolName:X.function.name,input:q95(X.function.arguments,X.id,X.function.name)}))};return{role:"assistant",content:Q.content??""};case"tool":let Y=Z[Q.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:Q.tool_call_id,toolName:Y,output:{type:"text",value:Q.content}}]}}})}function I95($){let Z=$.map((Q)=>{let Y=Q.function.parameters?nU(Q.function.parameters):nU({type:"object",properties:{}});return[Q.function.name,t$({description:Q.function.description,inputSchema:Y})]});return Object.fromEntries(Z)}function V95($){if(!$)return;return{openai:{response_format:$}}}function k95(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function cF8($,Z,Q,Y,X,J){let G={model:$,instructions:Z.filter((W)=>W.role==="system"),messages:Z.filter((W)=>W.role!=="system"),tools:Q,temperature:Y.temperature,maxOutputTokens:Y.max_tokens,topP:Y.top_p,frequencyPenalty:Y.frequency_penalty,presencePenalty:Y.presence_penalty,stopSequences:Y.stop?Array.isArray(Y.stop)?Y.stop:[Y.stop]:void 0,abortSignal:J};return X?{...G,providerOptions:X}:G}function mF8($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var L95=256,O95,w95,j95,E95,P95,z95,A95,T95,dF8,iF8,pF8;var nF8=L(()=>{u4();W8();Vt();VF();O95=c1.object({type:c1.literal("function"),function:c1.object({name:c1.string(),description:c1.string().optional(),parameters:c1.record(c1.string(),c1.unknown()).optional()})}),w95=c1.object({id:c1.string(),type:c1.literal("function"),function:c1.object({name:c1.string(),arguments:c1.string()})}),j95=c1.discriminatedUnion("role",[c1.object({role:c1.literal("system"),content:c1.string(),name:c1.string().optional()}),c1.object({role:c1.literal("user"),content:c1.union([c1.string(),c1.array(c1.union([c1.object({type:c1.literal("text"),text:c1.string()}),c1.object({type:c1.literal("image_url"),image_url:c1.object({url:c1.string(),detail:c1.string().optional()})})]))]),name:c1.string().optional()}),c1.object({role:c1.literal("assistant"),content:c1.string().nullable().optional(),name:c1.string().optional(),tool_calls:c1.array(w95).optional()}),c1.object({role:c1.literal("tool"),content:c1.string(),tool_call_id:c1.string()})]),E95=c1.object({type:c1.literal("text")}),P95=c1.object({type:c1.literal("json_object")}),z95=c1.object({type:c1.literal("json_schema"),json_schema:c1.object({name:c1.string(),description:c1.string().optional(),schema:c1.record(c1.string(),c1.unknown()),strict:c1.boolean().optional()})}),A95=c1.union([E95,P95,z95]),T95=c1.object({model:c1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:c1.array(j95),stream:c1.boolean().optional().default(!1),temperature:c1.number().min(0).max(2).optional(),max_tokens:c1.number().positive().optional(),top_p:c1.number().min(0).max(1).optional(),frequency_penalty:c1.number().min(-2).max(2).optional(),presence_penalty:c1.number().min(-2).max(2).optional(),stop:c1.union([c1.string(),c1.array(c1.string())]).optional(),tools:c1.array(O95).optional(),tool_choice:c1.union([c1.literal("auto"),c1.literal("none"),c1.literal("required"),c1.object({type:c1.literal("function"),function:c1.object({name:c1.string()})})]).optional(),response_format:A95.optional(),user:c1.string().optional()});dF8=class dF8 extends Error{constructor($){super($);this.name="MessageConversionError"}};iF8=new Q1;iF8.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("studioContext"),Q=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(PB("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(PB("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==Q)return $.json(PB("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let Y=await $.req.json(),X=T95.safeParse(Y);if(!X.success){let w=X.error.issues[0]??{message:"Invalid request",path:[]};return $.json(PB(`Invalid request: ${w.message}`,"invalid_request_error",w.path.length>0?w.path.join("."):null),400)}let J=X.data,G=R95(J.model);if(!G)return $.json(PB("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=G,{modelId:K}=G;if(!W){let j=(await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id})).find((E)=>h2(E.providerId));if(!j)return $.json(PB("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=j.id}let H;try{H=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(PB(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let F=H.aiSdk.languageModel(K),U=M95(J.messages),N=J.tools?I95(J.tools):void 0,B=V95(J.response_format),D=k95(),O=Math.floor(Date.now()/1000);if(J.stream)return PO($,async(w)=>{let j=cF8(F,U,N,J,B,$.req.raw.signal);try{let E=Jp(j),P=!1,T=0,z="",A=async()=>{if(z.length===0)return;let q=z;z="",await w.writeSSE({data:JSON.stringify({id:D,object:"chat.completion.chunk",created:O,model:J.model,choices:[{index:0,delta:{content:q},finish_reason:null}]})})};for await(let q of E.stream){if(!P&&(q.type==="text-delta"||q.type==="tool-call"))await w.writeSSE({data:JSON.stringify({id:D,object:"chat.completion.chunk",created:O,model:J.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),P=!0;if(q.type==="text-delta"){if(z+=q.text,z.length>=L95)await A()}else if(q.type==="tool-call"){await A();let x=T++;await w.writeSSE({data:JSON.stringify({id:D,object:"chat.completion.chunk",created:O,model:J.model,choices:[{index:0,delta:{tool_calls:[{index:x,id:q.toolCallId,type:"function",function:{name:q.toolName,arguments:JSON.stringify(q.input)}}]},finish_reason:null}]})})}else if(q.type==="finish")await A(),await w.writeSSE({data:JSON.stringify({id:D,object:"chat.completion.chunk",created:O,model:J.model,choices:[{index:0,delta:{},finish_reason:mF8(q.finishReason)}],usage:q.totalUsage?{prompt_tokens:q.totalUsage.inputTokens??0,completion_tokens:q.totalUsage.outputTokens??0,total_tokens:q.totalUsage.totalTokens??0}:void 0})})}await A(),await w.writeSSE({data:"[DONE]"})}catch(E){let P=E;console.error("[openai-compat:stream] Error:",P.message),await w.writeSSE({data:JSON.stringify({error:{message:P.message,type:"server_error"}})})}});else{let w=cF8(F,U,N,J,B,$.req.raw.signal),j=await CL(w),E={role:"assistant",content:j.text||null};if(j.toolCalls&&j.toolCalls.length>0)E.tool_calls=j.toolCalls.map((P)=>({id:P.toolCallId,type:"function",function:{name:P.toolName,arguments:JSON.stringify("input"in P?P.input:{})}})),E.content=null;return $.json({id:D,object:"chat.completion",created:O,model:J.model,choices:[{index:0,message:E,finish_reason:mF8(j.finishReason)}],usage:{prompt_tokens:j.usage?.inputTokens??0,completion_tokens:j.usage?.outputTokens??0,total_tokens:j.usage?.totalTokens??0}})}}catch(Y){let X=Y;if(X.name==="AbortError")return $.json(PB("Request aborted","invalid_request_error"),400);if(X.name==="MessageConversionError")return $.json(PB(X.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",X.message,X.stack),$.json(PB(X.message,"server_error"),500)}});pF8=iF8});function S95($){if(typeof $!=="object"||$===null)return!1;let Q=$.repository?.url;return typeof Q==="string"&&Q.length>0}function tF8(){let $=new Q1;return $.use("*",async(Z,Q)=>{await Q(),Z.header("Cache-Control","private, no-store"),Z.header("Vary","Cookie")}),$.get("/",async(Z)=>{let Q=Z.get("studioContext"),Y=C0(Q);if(!Y)return Z.json({error:"Authentication required"},401);let J=(Z.req.query("site")??"").trim().toLowerCase();if(!G9(J))return Z.json({error:"Invalid site slug"},400);let G=await Q.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.id as id","organization.slug as slug","organization.name as name","organization.metadata as metadata"]).where("member.userId","=",Y).execute(),W=[];for(let H of G){if(!H.slug||y9(H))continue;let F=await Q.storage.virtualMcps.list(H.id);for(let U of F){if(d2(U)!==J)continue;if(!S95(U.metadata))continue;W.push({orgSlug:H.slug,orgName:H.name??H.slug,project:{id:U.id,title:U.title,icon:U.icon??null}})}}let K={matches:W};return Z.json(K)}),$}var oF8=L(()=>{W8();tX()});var Rx0;var FP1=L(()=>{Rx0={name:"decocms",version:"4.499.0",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run dev:server","dev:server":"NODE_ENV=development bun --env-file=.env --watch run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js","db:migrate:dbos":"bun run ./dist/server/migrate-dbos.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts","migrate:dbos":"bun run src/database/migrate-dbos.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^4.0.58","@ai-sdk/google":"^4.0.76","@ai-sdk/openai":"^4.0.71","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^3.1.0","@opentelemetry/core":"^2.6.0",kysely:"^0.28.12","posthog-node":"^5.0.0"},devDependencies:{"@ai-sdk/provider":"^4.0.17","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^7.0.107","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});function v95(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??_95}}var sF8,_95="https://ph.studio.decocms.com",rF8;var aF8=L(()=>{W8();ke();jg();w9();r1();ww1();FP1();sF8=new Q1;sF8.get("/",($)=>{let Z={version:Rx0.version,theme:kY$(),...cH().logo&&{logo:cH().logo},...lL()&&{internalUrl:sr1()},...L0().enableDecoImport&&{enableDecoImport:!0},hostingEnabled:!!L0().controlplaneRestUrl&&!!L0().controlplaneServiceToken,hostingControlPlaneGa:L0().hostingControlPlaneGa,monitorEnabled:!!L0().clickhouseAnalyticsUrl&&!!L0().clickhouseAnalyticsPassword,monitorGa:L0().monitorGa,plansEnabled:L0().plansEnabled,auth:vX8(),posthog:v95(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:nF()}};return $.header("Cache-Control","no-store"),$.json({success:!0,config:Z})});rF8=sF8});import{z as q$}from"zod";var b95,eF8;var $U8=L(()=>{b95=q$.object({check_id:q$.string(),title:q$.string(),description:q$.string().optional(),impact:q$.string().optional(),why:q$.string().optional(),category:q$.string(),severity:q$.string(),value_band:q$.string().optional(),value_driver:q$.string().optional(),controllability:q$.string().optional(),pages:q$.array(q$.string()),tasks:q$.array(q$.string()),evidence:q$.string(),sample_scope:q$.string().optional(),sources:q$.array(q$.string())}),eF8=q$.object({domain:q$.string(),brand:q$.string(),favicon:q$.string().optional(),scanned_at:q$.string().nullable(),lang:q$.string(),score:q$.number().nullable(),band:q$.string().nullable(),totals:q$.object({measured:q$.number(),registry_total:q$.number(),passed:q$.number(),failed:q$.number(),blocked:q$.number()}),buckets:q$.array(q$.object({id:q$.enum(["critical","important","worth"]),label:q$.string(),items:q$.array(b95)})),passing:q$.object({count:q$.number(),items:q$.array(q$.object({check_id:q$.string(),title:q$.string()}))}),not_measured:q$.object({count:q$.number(),groups:q$.array(q$.object({reason:q$.string(),label:q$.string(),count:q$.number(),checks:q$.array(q$.string())}))}),categories:q$.array(q$.object({key:q$.string(),label:q$.string(),score:q$.number().nullable(),band:q$.string().nullable(),pass:q$.number(),fail:q$.number()})),screenshots:q$.array(q$.object({url:q$.string(),page_type:q$.string().optional(),viewport:q$.enum(["desktop","mobile"]),image_url:q$.string()}))})});function ZU8($,Z,Q){let Y=Q?`?${new URLSearchParams({lang:Q}).toString()}`:"";return`${KK({})}/api/v2/public/diagnostics/${encodeURIComponent($)}/onepager${Z}${Y}`}async function qx0($,Z={}){let Q=await fetch(ZU8($,"",Z.lang),{headers:{Accept:"application/json"},signal:Z.signal});if(Q.status===404)return null;if(!Q.ok)throw Error(`onepager read HTTP ${Q.status}`);return eF8.parse(await Q.json())}async function QU8($,Z={}){let Q=await fetch(ZU8($,".md",Z.lang),{headers:{Accept:"text/markdown"},signal:Z.signal});if(Q.status===404)return null;if(!Q.ok)throw Error(`onepager markdown HTTP ${Q.status}`);return Q.text()}var UP1=L(()=>{$U8();aD()});import{join as YU8}from"path";async function f95($){try{let Z=await qx0($,{signal:AbortSignal.timeout(x95)});if(!Z?.scanned_at)return null;return{brand:Z.brand.trim()||NL1($),...Z.score!==null?{score:Z.score}:{}}}catch{return null}}function mG($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function y95($,Z){let Q=Oh($),Y=Z?.brand?.trim()||NL1(Q),X=_Z8(Q,128),G=`${(L0().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(Q)}`,{title:W,description:K}=vZ8({brand:Y,domain:Q,score:Z?.score}),H=`${G}/og.png`,F=`${Y} Deco Score by decocms`;return[`<title>${mG(W)}</title>`,`<meta name="description" content="${mG(K)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${mG(W)}" />`,`<meta property="og:description" content="${mG(K)}" />`,`<meta property="og:url" content="${mG(G)}" />`,`<meta property="og:image" content="${mG(H)}" />`,'<meta property="og:image:width" content="1200" />','<meta property="og:image:height" content="630" />',`<meta property="og:image:alt" content="${mG(F)}" />`,'<meta name="twitter:card" content="summary_large_image" />',`<meta name="twitter:title" content="${mG(W)}" />`,`<meta name="twitter:description" content="${mG(K)}" />`,`<meta name="twitter:image" content="${mG(H)}" />`,`<meta name="twitter:image:alt" content="${mG(F)}" />`,`<link rel="canonical" href="${mG(G)}" />`,`<link rel="alternate" type="text/markdown" href="${mG(G)}.md" />`,`<link rel="icon" href="${mG(X)}" sizes="any" />`].join(`
+Start in ${$.language==="pt"?"Brazilian Portuguese":"English"}, and follow the user's language.`,delegation:{type:"client"},audio:{output:{voice:$.voice}},store:!1}}class XP1{config;constructor($){this.config=$}async createSession(){return{provider:"openai",transport:"webrtc"}}async negotiate($){let Z=await fetch("https://api.openai.com/v1/live/sessions",{method:"POST",headers:{Authorization:`Bearer ${this.config.apiKey}`,"Content-Type":"application/json","OpenAI-Safety-Identifier":$.safetyIdentifier},body:JSON.stringify({session:W95({...this.config,language:$.language,model:$.model}),transport:{type:"webrtc",sdp:$.sdp}}),signal:AbortSignal.timeout(15000)});if(!Z.ok)throw await Z.body?.cancel(),Error(`OpenAI Live request failed (${Z.status})`);return{sdp:ft.object({session:ft.object({id:ft.string().min(1)}),transport:ft.object({type:ft.literal("webrtc"),sdp:ft.string().min(1).max(1e5)})}).parse(await Z.json()).transport.sdp}}}var qF8=L(()=>{hN()});var MF8;var IF8=L(()=>{MF8=[{name:"delegate_to_agent",description:"Submit a complete request to the selected Studio agent. Returns after acceptance while work continues in the background. Results arrive later.",parameters:{type:"object",properties:{request:{type:"string",description:"The complete user request, with relevant conversational details. Preserve intent and constraints."}},required:["request"]}},{name:"get_agent_status",description:"Read the current chat's work status and known results. This does not track independent organization tasks; delegate fresh task-status queries to the Studio agent. Use when asked, never poll.",parameters:{type:"object",properties:{}}},{name:"stop_agent_work",description:"Request cancellation in the current chat ONLY when the user explicitly asks. Speaking over the companion is not cancellation. To stop independent tasks, delegate that request to the Studio agent.",parameters:{type:"object",properties:{}}}]});function JP1($){return{conversation_config:{agent:{first_message:"",language:"en",prompt:{prompt:FC$,llm:$.conversationModel,thinking_budget:0,max_tokens:512,tools:MF8.map((Z)=>({...Z,type:"client",expects_response:!0,response_timeout_secs:Z.name==="delegate_to_agent"?20:5,...Z.name==="delegate_to_agent"?{execution_mode:"async",interruption_mode:"allow",pre_tool_speech:"off"}:{}}))}},asr:{provider:"scribe_realtime",quality:"high"},turn:{turn_eagerness:"normal",turn_timeout:-1,silence_end_call_timeout:-1},tts:{voice_id:$.voiceId,model_id:$.model},conversation:{max_duration_seconds:IL/1000,client_events:["audio","interruption","user_transcript","agent_response","client_tool_call","vad_score"]}},platform_settings:{auth:{enable_auth:!0},privacy:{record_voice:!1,retention_days:1,delete_audio:!0,delete_transcript_and_pii:!0},overrides:{conversation_config_override:{agent:{language:!0}}}}}}var VF8=L(()=>{hN();IF8()});import{z as vJ}from"zod";import{createHash as K95,createHmac as H95}from"crypto";class zx0{config;conversationKey;configurationKey;constructor($){this.config=$;this.configurationKey=K95("sha256").update(JSON.stringify(JP1($))).digest("hex"),this.conversationKey=H95("sha256",$.apiKey).update(this.configurationKey).digest("hex")}forConversationModel($){return $===this.config.conversationModel?this:new zx0({...this.config,conversationModel:$})}async request($,Z,Q){let Y=await fetch(`https://api.elevenlabs.io/v1${$}`,{method:Z===void 0?"GET":"POST",headers:{"xi-api-key":this.config.apiKey,"Content-Type":"application/json"},body:JSON.stringify(Z),signal:Q});if(!Y.ok)throw await Y.body?.cancel(),Error(`ElevenLabs request failed (${Y.status})`);return Y}async ensureConversationAgent(){let $=`Studio voice ${this.configurationKey.slice(0,24)}`,Z=await this.request(`/convai/agents?search=${encodeURIComponent($)}&page_size=100`,void 0,AbortSignal.timeout(15000)),{agents:Q}=vJ.object({agents:vJ.array(vJ.object({agent_id:vJ.string(),name:vJ.string()}))}).parse(await Z.json()),Y=Q.find((J)=>J.name===$);if(Y){let J=await this.request(`/convai/agents/${encodeURIComponent(Y.agent_id)}`,void 0,AbortSignal.timeout(15000));return vJ.object({platform_settings:vJ.object({auth:vJ.object({enable_auth:vJ.literal(!0)})})}).parse(await J.json()),Y.agent_id}let X=await this.request("/convai/agents/create",{name:$,...JP1(this.config)},AbortSignal.timeout(15000));return vJ.object({agent_id:vJ.string().min(1)}).parse(await X.json()).agent_id}async createConversationToken($){let Z=await this.request(`/convai/conversation/token?agent_id=${encodeURIComponent($)}`,void 0,AbortSignal.timeout(15000));return vJ.object({token:vJ.string().min(1)}).parse(await Z.json()).token}async createTranscriptionToken(){let $=await this.request("/single-use-token/realtime_scribe",{},AbortSignal.timeout(15000));return vJ.object({token:vJ.string().min(1)}).parse(await $.json()).token}synthesize($,Z){return this.request(`/text-to-speech/${encodeURIComponent(this.config.voiceId)}/stream?output_format=mp3_44100_128`,{text:$,model_id:this.config.model},AbortSignal.any([Z,AbortSignal.timeout(60000)]))}}var kF8=L(()=>{VF8()});import{createHmac as F95,timingSafeEqual as U95}from"crypto";import{z as yt}from"zod";function CF8($,Z){if(!Z)throw Error("Voice requires a shared authentication secret");return F95("sha256",Z).update(`studio-voice-session:v1:${$}`).digest("base64url")}function _F8($,Z){let Q=Buffer.from(JSON.stringify(SF8.parse($))).toString("base64url");return`${Q}.${CF8(Q,Z)}`}function vF8($,Z,Q=Date.now()){if(!Z||$.length>4096)return null;let Y=$.split(".");if(Y.length!==2)return null;let[X,J]=Y;if(!X||!J)return null;let G=Buffer.from(CF8(X,Z)),W=Buffer.from(J);if(W.length!==G.length||!U95(W,G))return null;try{let K=SF8.safeParse(JSON.parse(Buffer.from(X,"base64url").toString()));if(!K.success||K.data.expiresAt<=Q||K.data.expiresAt>Q+IL)return null;return K.data}catch{return null}}var SF8;var bF8=L(()=>{hN();SF8=yt.object({sessionId:yt.string().uuid(),organizationId:yt.string().min(1).max(256),userId:yt.string().min(1).max(256),threadId:yt.string().min(1).max(256),expiresAt:yt.number().int().positive()})});import{z as GP1}from"zod";function xF8($,Z){if(Z?.voice_model!=null&&Z.voice_provider==null)throw Error("A voice model override requires a provider");let Q=Z?.voice_provider??$.voiceConversationProvider;return WP1.parse({provider:Q,model:Z?.voice_model??(Q==="openai"?$.openaiLiveModel:$.elevenlabsConversationModel)})}var WP1;var fF8=L(()=>{WP1=GP1.object({provider:GP1.enum(["elevenlabs","openai"]),model:GP1.string().trim().min(1).max(128)})});import{createHash as N95}from"crypto";import{z as gt}from"zod";function ht($){return`user.${N95("sha256").update(JSON.stringify([$.organizationId,$.userId])).digest("hex")}`}class HP1{deps;kvPromise;constructor($){this.deps=$}kv(){let $=this.deps.getConnection();if(!$||$.isClosed())throw new I1(503,{message:"Voice transport is unavailable"});return this.kvPromise??=new yF8.Kvm(Tx0.jetstream($)).create("STUDIO_VOICE_SESSIONS",{storage:Tx0.StorageType.Memory,ttl:gF8.nanos(IL),max_bytes:10485760}).catch((Z)=>{throw this.kvPromise=void 0,Z}),this.kvPromise}adapter(){if(!this.deps.adapter)throw new I1(503,{message:"Voice is not configured on this deployment"});return this.deps.adapter}async create($,Z=!1,Q="en",Y){let X;if(Z)try{X=xF8(this.deps.defaults,Y)}catch{throw new I1(503,{message:"Voice configuration is invalid"})}let J=X?this.deps.conversationAdapters[X.provider]:this.adapter();if(!J)throw new I1(503,{message:"Voice is not configured on this deployment"});let G={...$,sessionId:crypto.randomUUID(),expiresAt:Date.now()+IL},W=_F8(G,this.deps.secret),K=await this.kv(),H=ht(G),F=await K.get(H),U=F?.operation==="PUT"?Ax0.parse(F.json()):null,N=KP1.encode(JSON.stringify({sessionId:G.sessionId,expiresAt:G.expiresAt,conversation:X,characters:0,requests:0}));try{if(F&&U&&U.expiresAt<=Date.now())await K.update(H,N,F.revision);else await K.create(H,N)}catch{throw new I1(409,{message:"Close your other voice session before starting a new one"})}try{if(X&&"createSession"in J){let D=await J.createSession({language:Q,model:X.model,safetyIdentifier:ht($)});return{token:W,...D,expiresAt:G.expiresAt}}let B=await this.adapter().createTranscriptionToken();return{token:W,transcriptionToken:B,expiresAt:G.expiresAt}}catch(B){throw await this.release(G),B}}authorize($,Z){let Q=vF8(Z,this.deps.secret);if(!Q||Q.organizationId!==$.organizationId||Q.userId!==$.userId||Q.threadId!==$.threadId)throw new I1(403,{message:"Invalid voice session"});return Q}async connect($,Z){let Q=this.authorize($,Z.token),Y=await this.kv(),X=ht(Q),J=await Y.get(X),G=J?.operation==="PUT"?Ax0.parse(J.json()):null;if(!J||!G||G.sessionId!==Q.sessionId||G.expiresAt<=Date.now())throw new I1(403,{message:"Voice session expired"});let W=G.conversation?this.deps.conversationAdapters[G.conversation.provider]:null;if(!W?.negotiate||!G.conversation)throw new I1(409,{message:"Voice session does not support SDP negotiation"});if(G.connected)throw new I1(409,{message:"Voice session already connected"});try{await Y.update(X,KP1.encode(JSON.stringify({...G,connected:!0})),J.revision)}catch{throw new I1(409,{message:"Voice session is busy"})}return W.negotiate({sdp:Z.sdp,language:Z.language,model:G.conversation.model,safetyIdentifier:X})}async speak($,Z,Q,Y){let X=this.authorize($,Z),J=await this.kv(),G=ht(X);for(let W=0;;W++){let K=await J.get(G),H=K?.operation==="PUT"?Ax0.parse(K.json()):null;if(!K||!H||H.sessionId!==X.sessionId||H.expiresAt<=Date.now())throw new I1(403,{message:"Voice session expired"});if(H.characters+Q.length>24000||H.requests>=120)throw new I1(429,{message:"Voice session speech limit reached"});try{await J.update(G,KP1.encode(JSON.stringify({...H,characters:H.characters+Q.length,requests:H.requests+1})),K.revision);break}catch{if(W>=2)throw new I1(409,{message:"Voice session is busy"})}}return this.adapter().synthesize(Q,Y)}async release($){let Z=await this.kv(),Q=await Z.get(ht($));if(Q?.operation==="PUT"&&Ax0.parse(Q.json()).sessionId===$.sessionId)await Z.delete(ht($),{previousSeq:Q.revision})}async revoke($,Z){await this.release(this.authorize($,Z))}}var Tx0,yF8,gF8,Ax0,KP1;var hF8=L(()=>{$G();hN();bF8();fF8();Tx0=C(UH(),1),yF8=C(ST(),1),gF8=C(iz(),1),Ax0=gt.object({sessionId:gt.string().uuid(),expiresAt:gt.number(),connected:gt.boolean().optional(),conversation:WP1.optional(),characters:gt.number().int().nonnegative(),requests:gt.number().int().nonnegative()}),KP1=new TextEncoder});function B95($){return $.filter((Z)=>Z.vendors?.alias).map((Z)=>({name:Z.name,title:Z.title,description:Z.description,logo:Z.logo,category:Z.category,vendor:{alias:Z.vendors.alias,url:Z.vendors.url}}))}var D95=async($,Z)=>{if(!$.get("studioContext").auth.user?.id)return $.json({error:"Unauthorized"},401);return Z()},uF8=()=>{let $=new Q1;return $.use("*",D95),$.get("/",async(Z)=>{let Q=L0(),Y=Q.decoSupabaseUrl,X=Q.decoSupabaseServiceKey;if(!Y||!X)return Z.json({apps:[]});try{let J=await hG(Y,X,"apps?select=name,title,description,logo,category,vendors(alias,url)");return Z.json({apps:B95(J)})}catch(J){return console.error("[deco-apps] GET error:",J),Z.json({error:"Failed to fetch apps"},502)}}),$};var lF8=L(()=>{W8();r1();b_0()});import{z as c1}from"zod";function PB($,Z="invalid_request_error",Q=null,Y=null){return{error:{message:$,type:Z,param:Q,code:Y}}}function R95($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let Q=$.substring(0,Z),Y=$.substring(Z+1);if(!Q||!Y)return null;return{credentialId:Q,modelId:Y}}function q95($,Z,Q){try{return JSON.parse($)}catch{throw new dF8(`Invalid JSON in tool call arguments for function '${Q}' (tool_call_id: ${Z}): ${$}`)}}function M95($){let Z={};for(let Q of $)if(Q.role==="assistant"&&Q.tool_calls)for(let Y of Q.tool_calls)Z[Y.id]=Y.function.name;return $.map((Q)=>{switch(Q.role){case"system":return{role:"system",content:Q.content};case"user":if(typeof Q.content==="string")return{role:"user",content:Q.content};return{role:"user",content:Q.content.map((X)=>{if(X.type==="text")return{type:"text",text:X.text};return{type:"image",image:X.image_url.url}})};case"assistant":if(Q.tool_calls&&Q.tool_calls.length>0)return{role:"assistant",content:Q.tool_calls.map((X)=>({type:"tool-call",toolCallId:X.id,toolName:X.function.name,input:q95(X.function.arguments,X.id,X.function.name)}))};return{role:"assistant",content:Q.content??""};case"tool":let Y=Z[Q.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:Q.tool_call_id,toolName:Y,output:{type:"text",value:Q.content}}]}}})}function I95($){let Z=$.map((Q)=>{let Y=Q.function.parameters?nU(Q.function.parameters):nU({type:"object",properties:{}});return[Q.function.name,t$({description:Q.function.description,inputSchema:Y})]});return Object.fromEntries(Z)}function V95($){if(!$)return;return{openai:{response_format:$}}}function k95(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function cF8($,Z,Q,Y,X,J){let G={model:$,instructions:Z.filter((W)=>W.role==="system"),messages:Z.filter((W)=>W.role!=="system"),tools:Q,temperature:Y.temperature,maxOutputTokens:Y.max_tokens,topP:Y.top_p,frequencyPenalty:Y.frequency_penalty,presencePenalty:Y.presence_penalty,stopSequences:Y.stop?Array.isArray(Y.stop)?Y.stop:[Y.stop]:void 0,abortSignal:J};return X?{...G,providerOptions:X}:G}function mF8($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var L95=256,O95,w95,j95,E95,P95,z95,A95,T95,dF8,iF8,pF8;var nF8=L(()=>{u4();W8();Vt();VF();O95=c1.object({type:c1.literal("function"),function:c1.object({name:c1.string(),description:c1.string().optional(),parameters:c1.record(c1.string(),c1.unknown()).optional()})}),w95=c1.object({id:c1.string(),type:c1.literal("function"),function:c1.object({name:c1.string(),arguments:c1.string()})}),j95=c1.discriminatedUnion("role",[c1.object({role:c1.literal("system"),content:c1.string(),name:c1.string().optional()}),c1.object({role:c1.literal("user"),content:c1.union([c1.string(),c1.array(c1.union([c1.object({type:c1.literal("text"),text:c1.string()}),c1.object({type:c1.literal("image_url"),image_url:c1.object({url:c1.string(),detail:c1.string().optional()})})]))]),name:c1.string().optional()}),c1.object({role:c1.literal("assistant"),content:c1.string().nullable().optional(),name:c1.string().optional(),tool_calls:c1.array(w95).optional()}),c1.object({role:c1.literal("tool"),content:c1.string(),tool_call_id:c1.string()})]),E95=c1.object({type:c1.literal("text")}),P95=c1.object({type:c1.literal("json_object")}),z95=c1.object({type:c1.literal("json_schema"),json_schema:c1.object({name:c1.string(),description:c1.string().optional(),schema:c1.record(c1.string(),c1.unknown()),strict:c1.boolean().optional()})}),A95=c1.union([E95,P95,z95]),T95=c1.object({model:c1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:c1.array(j95),stream:c1.boolean().optional().default(!1),temperature:c1.number().min(0).max(2).optional(),max_tokens:c1.number().positive().optional(),top_p:c1.number().min(0).max(1).optional(),frequency_penalty:c1.number().min(-2).max(2).optional(),presence_penalty:c1.number().min(-2).max(2).optional(),stop:c1.union([c1.string(),c1.array(c1.string())]).optional(),tools:c1.array(O95).optional(),tool_choice:c1.union([c1.literal("auto"),c1.literal("none"),c1.literal("required"),c1.object({type:c1.literal("function"),function:c1.object({name:c1.string()})})]).optional(),response_format:A95.optional(),user:c1.string().optional()});dF8=class dF8 extends Error{constructor($){super($);this.name="MessageConversionError"}};iF8=new Q1;iF8.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("studioContext"),Q=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(PB("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(PB("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==Q)return $.json(PB("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let Y=await $.req.json(),X=T95.safeParse(Y);if(!X.success){let w=X.error.issues[0]??{message:"Invalid request",path:[]};return $.json(PB(`Invalid request: ${w.message}`,"invalid_request_error",w.path.length>0?w.path.join("."):null),400)}let J=X.data,G=R95(J.model);if(!G)return $.json(PB("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=G,{modelId:K}=G;if(!W){let j=(await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id})).find((E)=>h2(E.providerId));if(!j)return $.json(PB("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=j.id}let H;try{H=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(PB(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let F=H.aiSdk.languageModel(K),U=M95(J.messages),N=J.tools?I95(J.tools):void 0,B=V95(J.response_format),D=k95(),O=Math.floor(Date.now()/1000);if(J.stream)return PO($,async(w)=>{let j=cF8(F,U,N,J,B,$.req.raw.signal);try{let E=Jp(j),P=!1,T=0,z="",A=async()=>{if(z.length===0)return;let q=z;z="",await w.writeSSE({data:JSON.stringify({id:D,object:"chat.completion.chunk",created:O,model:J.model,choices:[{index:0,delta:{content:q},finish_reason:null}]})})};for await(let q of E.stream){if(!P&&(q.type==="text-delta"||q.type==="tool-call"))await w.writeSSE({data:JSON.stringify({id:D,object:"chat.completion.chunk",created:O,model:J.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),P=!0;if(q.type==="text-delta"){if(z+=q.text,z.length>=L95)await A()}else if(q.type==="tool-call"){await A();let x=T++;await w.writeSSE({data:JSON.stringify({id:D,object:"chat.completion.chunk",created:O,model:J.model,choices:[{index:0,delta:{tool_calls:[{index:x,id:q.toolCallId,type:"function",function:{name:q.toolName,arguments:JSON.stringify(q.input)}}]},finish_reason:null}]})})}else if(q.type==="finish")await A(),await w.writeSSE({data:JSON.stringify({id:D,object:"chat.completion.chunk",created:O,model:J.model,choices:[{index:0,delta:{},finish_reason:mF8(q.finishReason)}],usage:q.totalUsage?{prompt_tokens:q.totalUsage.inputTokens??0,completion_tokens:q.totalUsage.outputTokens??0,total_tokens:q.totalUsage.totalTokens??0}:void 0})})}await A(),await w.writeSSE({data:"[DONE]"})}catch(E){let P=E;console.error("[openai-compat:stream] Error:",P.message),await w.writeSSE({data:JSON.stringify({error:{message:P.message,type:"server_error"}})})}});else{let w=cF8(F,U,N,J,B,$.req.raw.signal),j=await CL(w),E={role:"assistant",content:j.text||null};if(j.toolCalls&&j.toolCalls.length>0)E.tool_calls=j.toolCalls.map((P)=>({id:P.toolCallId,type:"function",function:{name:P.toolName,arguments:JSON.stringify("input"in P?P.input:{})}})),E.content=null;return $.json({id:D,object:"chat.completion",created:O,model:J.model,choices:[{index:0,message:E,finish_reason:mF8(j.finishReason)}],usage:{prompt_tokens:j.usage?.inputTokens??0,completion_tokens:j.usage?.outputTokens??0,total_tokens:j.usage?.totalTokens??0}})}}catch(Y){let X=Y;if(X.name==="AbortError")return $.json(PB("Request aborted","invalid_request_error"),400);if(X.name==="MessageConversionError")return $.json(PB(X.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",X.message,X.stack),$.json(PB(X.message,"server_error"),500)}});pF8=iF8});function S95($){if(typeof $!=="object"||$===null)return!1;let Q=$.repository?.url;return typeof Q==="string"&&Q.length>0}function tF8(){let $=new Q1;return $.use("*",async(Z,Q)=>{await Q(),Z.header("Cache-Control","private, no-store"),Z.header("Vary","Cookie")}),$.get("/",async(Z)=>{let Q=Z.get("studioContext"),Y=C0(Q);if(!Y)return Z.json({error:"Authentication required"},401);let J=(Z.req.query("site")??"").trim().toLowerCase();if(!G9(J))return Z.json({error:"Invalid site slug"},400);let G=await Q.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.id as id","organization.slug as slug","organization.name as name","organization.metadata as metadata"]).where("member.userId","=",Y).execute(),W=[];for(let H of G){if(!H.slug||y9(H))continue;let F=await Q.storage.virtualMcps.list(H.id);for(let U of F){if(d2(U)!==J)continue;if(!S95(U.metadata))continue;W.push({orgSlug:H.slug,orgName:H.name??H.slug,project:{id:U.id,title:U.title,icon:U.icon??null}})}}let K={matches:W};return Z.json(K)}),$}var oF8=L(()=>{W8();tX()});var Rx0;var FP1=L(()=>{Rx0={name:"decocms",version:"4.499.1",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run dev:server","dev:server":"NODE_ENV=development bun --env-file=.env --watch run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js","db:migrate:dbos":"bun run ./dist/server/migrate-dbos.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts","migrate:dbos":"bun run src/database/migrate-dbos.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^4.0.58","@ai-sdk/google":"^4.0.76","@ai-sdk/openai":"^4.0.71","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^3.1.0","@opentelemetry/core":"^2.6.0",kysely:"^0.28.12","posthog-node":"^5.0.0"},devDependencies:{"@ai-sdk/provider":"^4.0.17","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^7.0.107","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});function v95(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??_95}}var sF8,_95="https://ph.studio.decocms.com",rF8;var aF8=L(()=>{W8();ke();jg();w9();r1();ww1();FP1();sF8=new Q1;sF8.get("/",($)=>{let Z={version:Rx0.version,theme:kY$(),...cH().logo&&{logo:cH().logo},...lL()&&{internalUrl:sr1()},...L0().enableDecoImport&&{enableDecoImport:!0},hostingEnabled:!!L0().controlplaneRestUrl&&!!L0().controlplaneServiceToken,hostingControlPlaneGa:L0().hostingControlPlaneGa,monitorEnabled:!!L0().clickhouseAnalyticsUrl&&!!L0().clickhouseAnalyticsPassword,monitorGa:L0().monitorGa,plansEnabled:L0().plansEnabled,auth:vX8(),posthog:v95(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:nF()}};return $.header("Cache-Control","no-store"),$.json({success:!0,config:Z})});rF8=sF8});import{z as q$}from"zod";var b95,eF8;var $U8=L(()=>{b95=q$.object({check_id:q$.string(),title:q$.string(),description:q$.string().optional(),impact:q$.string().optional(),why:q$.string().optional(),category:q$.string(),severity:q$.string(),value_band:q$.string().optional(),value_driver:q$.string().optional(),controllability:q$.string().optional(),pages:q$.array(q$.string()),tasks:q$.array(q$.string()),evidence:q$.string(),sample_scope:q$.string().optional(),sources:q$.array(q$.string())}),eF8=q$.object({domain:q$.string(),brand:q$.string(),favicon:q$.string().optional(),scanned_at:q$.string().nullable(),lang:q$.string(),score:q$.number().nullable(),band:q$.string().nullable(),totals:q$.object({measured:q$.number(),registry_total:q$.number(),passed:q$.number(),failed:q$.number(),blocked:q$.number()}),buckets:q$.array(q$.object({id:q$.enum(["critical","important","worth"]),label:q$.string(),items:q$.array(b95)})),passing:q$.object({count:q$.number(),items:q$.array(q$.object({check_id:q$.string(),title:q$.string()}))}),not_measured:q$.object({count:q$.number(),groups:q$.array(q$.object({reason:q$.string(),label:q$.string(),count:q$.number(),checks:q$.array(q$.string())}))}),categories:q$.array(q$.object({key:q$.string(),label:q$.string(),score:q$.number().nullable(),band:q$.string().nullable(),pass:q$.number(),fail:q$.number()})),screenshots:q$.array(q$.object({url:q$.string(),page_type:q$.string().optional(),viewport:q$.enum(["desktop","mobile"]),image_url:q$.string()}))})});function ZU8($,Z,Q){let Y=Q?`?${new URLSearchParams({lang:Q}).toString()}`:"";return`${KK({})}/api/v2/public/diagnostics/${encodeURIComponent($)}/onepager${Z}${Y}`}async function qx0($,Z={}){let Q=await fetch(ZU8($,"",Z.lang),{headers:{Accept:"application/json"},signal:Z.signal});if(Q.status===404)return null;if(!Q.ok)throw Error(`onepager read HTTP ${Q.status}`);return eF8.parse(await Q.json())}async function QU8($,Z={}){let Q=await fetch(ZU8($,".md",Z.lang),{headers:{Accept:"text/markdown"},signal:Z.signal});if(Q.status===404)return null;if(!Q.ok)throw Error(`onepager markdown HTTP ${Q.status}`);return Q.text()}var UP1=L(()=>{$U8();aD()});import{join as YU8}from"path";async function f95($){try{let Z=await qx0($,{signal:AbortSignal.timeout(x95)});if(!Z?.scanned_at)return null;return{brand:Z.brand.trim()||NL1($),...Z.score!==null?{score:Z.score}:{}}}catch{return null}}function mG($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function y95($,Z){let Q=Oh($),Y=Z?.brand?.trim()||NL1(Q),X=_Z8(Q,128),G=`${(L0().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(Q)}`,{title:W,description:K}=vZ8({brand:Y,domain:Q,score:Z?.score}),H=`${G}/og.png`,F=`${Y} Deco Score by decocms`;return[`<title>${mG(W)}</title>`,`<meta name="description" content="${mG(K)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${mG(W)}" />`,`<meta property="og:description" content="${mG(K)}" />`,`<meta property="og:url" content="${mG(G)}" />`,`<meta property="og:image" content="${mG(H)}" />`,'<meta property="og:image:width" content="1200" />','<meta property="og:image:height" content="630" />',`<meta property="og:image:alt" content="${mG(F)}" />`,'<meta name="twitter:card" content="summary_large_image" />',`<meta name="twitter:title" content="${mG(W)}" />`,`<meta name="twitter:description" content="${mG(K)}" />`,`<meta name="twitter:image" content="${mG(H)}" />`,`<meta name="twitter:image:alt" content="${mG(F)}" />`,`<link rel="canonical" href="${mG(G)}" />`,`<link rel="alternate" type="text/markdown" href="${mG(G)}.md" />`,`<link rel="icon" href="${mG(X)}" sizes="any" />`].join(`
     `)}function g95($,Z){return $.replace(/<title>[\s\S]*?<\/title>\s*/i,"").replace(/<meta\s+name="(?:description|twitter:[^"]*)"[^>]*>\s*/gi,"").replace(/<meta\s+property="og:[^"]*"[^>]*>\s*/gi,"").replace(/<link\s+rel="icon"[^>]*>\s*/gi,"").replace("</head>",`    ${Z}
   </head>`)}function XU8($){let Z=new Q1;return Z.get("/:domain/og.png",async(Q)=>{let Y=Oh(Q.req.param("domain")),X=async()=>{let J=$?Bun.file(YU8($,"report-og-fallback.png")):null;if(!J||!await J.exists())return Q.notFound();return Q.body(new Uint8Array(await J.arrayBuffer()),200,{"Content-Type":"image/png","Cache-Control":"public, max-age=0, s-maxage=3600"})};try{let J=await fetch(`${KK({})}/api/v2/public/diagnostics/${encodeURIComponent(Y)}/og.png`,{signal:AbortSignal.timeout(h95)}),G=J.headers.get("content-type")??"";if(!J.ok||!G.startsWith("image/")||!J.body)return X();return Q.body(J.body,200,{"Content-Type":G,"Cache-Control":"public, max-age=0, s-maxage=604800"})}catch{return X()}}),Z.get("/:file{.+\\.md}",async(Q)=>{let Y=Oh(Q.req.param("file").replace(/\.md$/,""));try{let X=await QU8(Y,{lang:Q.req.query("lang")?.trim()||void 0,signal:AbortSignal.timeout(u95)});if(X===null)return Q.text("Deco Score not found",404);return Q.body(X,200,{"Content-Type":"text/markdown; charset=utf-8","Cache-Control":"public, max-age=600, stale-while-revalidate=3600","Access-Control-Allow-Origin":"*"})}catch{return Q.text("Deco Score unavailable",502)}}),Z.get("/:domain",async(Q)=>{let Y=Q.req.param("domain"),X=$?YU8($,"index.html"):null,J=X?Bun.file(X):null;if(!J||!await J.exists())return Q.notFound();let G=await J.text();try{let W=await f95(Oh(Y)),K=y95(Y,W);return Q.html(g95(G,K),200,{"Cache-Control":"public, max-age=0, s-maxage=300"})}catch{return Q.html(G)}}),Z}var x95=2500,h95=1e4,u95=1e4;var JU8=L(()=>{W8();aD();UP1();r1()});function Mx0($,Z){return fetch(`${KK({})}${$}`,Z)}async function l95($,Z){let Q=await qx0($,{lang:Z});if(!Q)return{status:"not_found",report:null};return Q.scanned_at?{status:"ready",report:Q}:{status:"empty",report:null}}function m95($){let Z=typeof $==="object"&&$!==null?$:{},Q=typeof Z.domain==="string"?Z.domain.trim():"",Y=typeof Z.distinctId==="string"&&Z.distinctId.trim()&&Z.distinctId.length<=200?Z.distinctId.trim():void 0;return{domain:Q,distinctId:Y}}var c95,TO,GU8=async($,Z)=>{if(!$.get("reportUser"))return $.json({error:"Authentication required"},401);await Z();return},WU8;var KU8=L(()=>{W8();LK();aD();UP1();c95=new Set(["complete","errored","terminated","unknown"]);TO=new Q1;TO.use("*",async($,Z)=>{let Q=await B4.api.getSession({headers:$.req.raw.headers});$.set("reportUser",Q?.user?.id?{email:Q.user.email}:void 0),await Z(),$.header("Cache-Control","private, no-store"),$.header("Vary","Cookie");return});TO.use("/link-token/*",GU8);TO.use("/suggest",GU8);TO.get("/site/:domain",async($)=>{let Z=$.req.param("domain").trim();if(!Z)return $.json({error:"domain is required"},400);let Q=$.req.query("lang")?.trim()||void 0;try{return $.json(await l95(Z,Q))}catch{return $.json({error:"report read failed"},502)}});TO.post("/run",async($)=>{let Z=$.get("reportUser"),Q;try{Q=await $.req.json()}catch{return $.json({error:"invalid JSON"},400)}let{domain:Y,distinctId:X}=m95(Q);if(!Y)return $.json({error:"domain is required"},400);let J=Z?.email;try{let G=await Mx0("/api/v2/diagnostics/run",{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${LE({})}`},body:JSON.stringify({url:Y,...J?{email:J}:{},distinct_id:X})});if(!G.ok)return $.json({error:`run HTTP ${G.status}`},502);let W=await G.json(),K=W.blocked?{state:"blocked"}:W.status==="fresh"?{state:"fresh"}:W.mode==="sync"?{state:"sync"}:{state:"running",id:W.id??null};return $.json(K)}catch{return $.json({error:"run failed"},502)}});TO.get("/status",async($)=>{let Z=$.req.query("id");if(!Z)return $.json({error:"id is required"},400);try{let Q=await Mx0(`/api/v2/diagnostics/status?id=${encodeURIComponent(Z)}`,{headers:{Authorization:`Bearer ${LE({})}`}});if(!Q.ok)return $.json({error:`status HTTP ${Q.status}`},502);let X=(await Q.json()).status??"unknown",J={done:c95.has(X),status:X};return $.json(J)}catch{return $.json({error:"status failed"},502)}});TO.get("/link-token/:id",async($)=>{let Z=$.req.param("id");try{let Q=await Mx0(`/api/v2/public/link-tokens/${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(Q.status===404)return $.json(null);if(!Q.ok)return $.json({error:`link token HTTP ${Q.status}`},502);return $.json(await Q.json())}catch{return $.json({error:"link token resolve failed"},502)}});TO.get("/suggest",async($)=>{let Z=($.req.query("q")??"").trim().slice(0,64);if(Z.length<2)return $.json({suggestions:[]});try{let Q=await Mx0(`/api/v2/public/suggest?q=${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(!Q.ok)return $.json({suggestions:[]});let Y=await Q.json();return $.json({suggestions:Array.isArray(Y.suggestions)?Y.suggestions:[]})}catch{return $.json({suggestions:[]})}});WU8=TO});var d95=1048576,NP1;var HU8=L(()=>{W8();aK();r1();Qw1();NP1=new Q1;NP1.post("/webhook",h5({maxSize:d95,onError:($)=>$.json({error:"payload too large"},413)}),async($)=>{let Z=L0().stripeWebhookSecret;if(!Z)return $.json({error:"stripe billing not configured"},503);let Q=await $.req.text();if(!pY8(Q,$.req.header("stripe-signature"),Z))return $.json({error:"invalid signature"},400);let X=nY8(Q);if(!X)return $.json({error:"invalid payload"},400);let J=await tY8(X);return console.log("stripe webhook",{eventId:X.id,type:X.type,livemode:X.livemode,...J}),$.json({received:!0})})});import{timingSafeEqual as i95}from"crypto";function t95($,Z,Q){if(!Z?.startsWith("sha256="))return!1;let Y=new Bun.CryptoHasher("sha256",Q).update($).digest("hex"),X=Z.slice(7);if(X.length!==Y.length)return!1;return i95(Buffer.from(X),Buffer.from(Y))}function o95($,Z){let Q=Z,Y=Q?.repository?.name,X=Q?.repository?.owner?.login;if(typeof Y!=="string"||typeof X!=="string")return[];let J=[];if($==="check_suite"){if(Q.action!=="completed")return[];let G=Q.check_suite?.pull_requests;for(let W of Array.isArray(G)?G:[]){let K=W?.number;if(typeof K==="number")J.push(K)}}else if($==="issue_comment"&&Q.issue?.pull_request){let G=Q.issue.number;if(typeof G==="number")J.push(G)}return[...new Set(J)].map((G)=>({repoOwner:X,repoName:Y,number:G}))}function FU8($){let Z=new Q1;return Z.post("/webhook",h5({maxSize:p95,onError:(Q)=>Q.json({error:"payload too large"},413)}),async(Q)=>{let Y=process.env.GITHUB_WEBHOOK_SECRET;if(!Y)return Q.json({error:"github webhook not configured"},503);let X=await Q.req.text();if(!t95(X,Q.req.header("x-hub-signature-256"),Y))return Q.json({error:"invalid signature"},400);let J=Q.req.header("x-github-event");if(J!=="push"&&!n95.has(J??""))return Q.json({ok:!0,ignored:"event"});let G;try{G=JSON.parse(X)}catch{return Q.json({error:"invalid payload"},400)}if(J==="push"){let H=G.ref,F=G.repository?.full_name;if(!H||!F)return Q.json({ok:!0,ignored:"shape"});return l80().then((U)=>U?.markTenantPoolsDirty(`https://github.com/${F}`,H)).catch((U)=>console.warn(`[github-webhook] tenant pool refresh for ${F}@${H} failed: ${U instanceof Error?U.message:String(U)}`)),Q.json({ok:!0})}let W=o95(J??"",G);if(W.length===0)return Q.json({ok:!0,ignored:"no-pr"});let K=await s95($,W);return Q.json({ok:!0,refreshed:K})}),Z}async function s95($,Z){let Q=0;for(let Y of Z){let X=$.taskBoard(),J;try{J=await X.findPrLinks(Y)}catch(G){console.error("[github-webhook] pr link lookup failed:",G);continue}for(let G of J)try{let W=await X.getById(G.taskBoardItemId,G.organizationId),K=W?await $.contextFactory()(G.organizationId,W.assignedBy??W.createdBy):null;if(!K)continue;if(await Cu$(K,G.organizationId,G.taskBoardItemId)!==null)Q++}catch(W){console.error(`[github-webhook] pr card refresh failed for ${G.taskBoardItemId}:`,W)}}return Q}var p95=5242880,n95;var UU8=L(()=>{W8();aK();OX();kQ();n95=new Set(["check_suite","issue_comment"])});import{DBOS as DP1,SchedulerMode as r95}from"@dbos-inc/dbos-sdk";async function e95(){try{return await $Z5()}catch($){return console.warn(`[sandbox-credential-push] push failed: ${$ instanceof Error?$.message:String($)}`),null}}async function $Z5(){if(!u80())return null;let[{RemoteSandboxProvider:$},{SandboxProviderRouter:Z}]=await Promise.all([Promise.resolve().then(() => (TY1(),AY1)),Promise.resolve().then(() => (zY1(),PY1))]),Q=await l80(),Y=Q instanceof Z?Q.providers.kubernetes:Q;if(!(Y instanceof $))return null;let{db:X}=z8(),{sandboxes:J,pools:G}=await Y.list(),W=Date.now(),K=dV$({sandboxes:J,pools:G,records:await iV$(X,J,G),legacyPools:fq0(process.env.STUDIO_SANDBOX_TENANT_POOLS),now:W}),{batches:H,failed:F}=await pV$(K,XN0(X,new nX(L0().encryptionKey)),{now:W,orgFsLifetimeMs:hq0}),U=0,N=0,B=0;for(let D of H)try{let O=await Y.pushCredentials(D);U+=O.stored,N+=O.kept}catch(O){B++,console.warn(`[sandbox-credential-push] a push batch failed: ${O instanceof Error?O.message:String(O)}`)}return{sandboxes:J.length,pushed:U,kept:N,refused:K.refused,failed:F+B}}async function ZZ5($,Z){let Q=await DP1.runStep(e95,{name:"pushSandboxCredentials"});if(Q&&(Q.refused>0||Q.failed>0))console.warn(`[sandbox-credential-push] ${Q.sandboxes} sandboxes: pushed ${Q.pushed}, kept ${Q.kept}, refused ${Q.refused}, failed ${Q.failed}`)}function NU8(){if(BP1)return;if(!L0().agentSandboxEnabled||!u80())return;BP1=DP1.registerWorkflow(ZZ5,{name:"sandboxCredentialPushWorkflow"}),DP1.registerScheduled(BP1,{name:"sandboxCredentialPushWorkflow",crontab:a95,mode:r95.ExactlyOncePerIntervalWhenActive})}var a95="1-59/10 * * * *",BP1=null;var BU8=L(()=>{D3();zw();WZ1();uq0();yq0();OX();r1()});function DU8($){let Z=new HO($.db,new nX($.encryptionKey)),Q=new Q1;return Q.get("/attachments/:token",async(Y)=>{let X=yg$(Y.req.param("token"));if(!X)return Y.json({error:"Invalid or expired link"},404);let J=await Z.getByOrg(X.organizationId);if(!J)return Y.json({error:"Jira is not connected"},404);let W=await new r7(J.siteUrl,J.email,J.apiToken).downloadAttachment(X.attachmentId);if(!W.ok||!W.body)return Y.json({error:"Jira refused the download"},502);let K=new Headers;for(let H of["content-type","content-length","content-disposition"]){let F=W.headers.get(H);if(F)K.set(H,F)}return K.set("cache-control","no-store"),new Response(W.body,{status:200,headers:K})}),Q}var LU8=L(()=>{W8();zw();tJ1();_L()});function Ix0(){try{return L0().jiraSettleSeconds*1000}catch{return vP}}function OU8($,Z){let Q=Z.windowMs??vP,Y=$.at(-1);if(!Y)return null;if(Z.changeId!==void 0&&Y.id!==Z.changeId)return{kind:"superseded"};if(Z.now!==void 0&&Z.now-Y.at<Q)return{kind:"moving"};let X=QZ5($,Q);if((X.id&&Y.toId?X.id===Y.toId:!1)||!X.id&&X.name===Y.to)return{kind:"returned",change:Y};return{kind:"moved",change:Y,from:X}}function QZ5($,Z){for(let Y=$.length-2;Y>=0;Y--){let X=$[Y],J=$[Y+1];if(X&&J&&J.at-X.at>=Z)return{id:X.toId,name:X.to}}let Q=$[0];return{id:Q?.fromId??null,name:Q?.from??null}}var LP1=L(()=>{cL();r1()});function wU8($){if(typeof $!=="object"||$===null)return null;let Z=$;if(Z.webhookEvent!=="jira:issue_updated")return null;let Q=Z.issue?.id,Y=Z.issue?.key,X=Z.changelog?.id;if(typeof Q!=="string"&&typeof Q!=="number"||typeof Y!=="string"||typeof X!=="string"&&typeof X!=="number")return null;let J=Z.changelog?.items?.find((G)=>G.field==="status");if(!J||typeof J.toString!=="string")return null;return{issueId:String(Q),issueKey:Y,toStatus:J.toString,changelogId:String(X)}}async function OP1($,Z,Q){if(!Z.enabled)return"disabled";let Y=Z.organizationId,X=new r7(Z.siteUrl,Z.email,Z.apiToken),J=OU8(await X.listStatusChanges(Q.issueId),{changeId:Q.changelogId,now:Q.now,windowMs:Ix0()});if(!J)return"no_rule";if(J.kind!=="moved")return J.kind;let{change:G,from:W}=J,K=(await $.storage.automations.listJiraTransitionTriggers(Y,{jiraStatus:G.to,activeOnly:!0})).map((N)=>({...N,from:_P(N)})),H=Td$(K)&&Z.boardId?Ad$(await X.getBoardColumnStatusIds(Z.boardId),W.id,G.toId):null,F=zd$(K,W.name,H);if(!F)return"no_rule";if(!await $.storage.jiraIntegrations.claimTrigger(Y,Q.issueId,G.id))return"duplicate";return await kK({automationId:F.automation_id,organizationId:Y,triggerId:F.id,target:{kind:"jira",issues:[Q.issueId],move:{toStatus:G.to,fromStatus:W.name,movedBy:G.by,movedAt:new Date(G.at).toISOString()},eventKey:G.id}},{idempotencyKey:`jira:${F.id}:${G.id}`}),"fired"}var wP1=L(()=>{MF();_L();up();LP1()});import{DBOS as Rz,SchedulerMode as YZ5}from"@dbos-inc/dbos-sdk";function jU8($){EP1=$}function zP1(){if(!EP1)throw Error("[jira-trigger] runtime not initialized \u2014 setJiraTriggerSweepRuntime() must run before the workflow fires");return EP1}function AP1(){let $=zP1();return new HO($.db,new nX($.encryptionKey))}async function KZ5($){try{let Z=await AP1().getById($);if(!Z?.enabled||!Z.boardId)return{integrationId:$,fired:0};let Q=await o3(zP1().db,Z.organizationId);if(!Q)return{integrationId:$,fired:0};if((await Q.storage.automations.listJiraTransitionTriggers(Z.organizationId,{activeOnly:!0})).length===0)return{integrationId:$,fired:0};let X=new r7(Z.siteUrl,Z.email,Z.apiToken),G=`(${await X.getBoardScopeJql(Z.boardId)}) AND status CHANGED AFTER "-${JZ5}m"`,W=0,K;for(let H=0;H<GZ5;H++){let F=await X.searchIssues({jql:G,nextPageToken:K});for(let U of F.issues)if(await OP1(Q,Z,{issueId:U.id,now:Date.now()})==="fired")W++;if(K=F.nextPageToken??void 0,!K)break}return{integrationId:$,fired:W}}catch(Z){return{integrationId:$,fired:0,error:Z instanceof Error?Z.message:String(Z)}}}async function HZ5($,Z){let Q=await Rz.runStep(()=>AP1().listEnabledIds(),{name:"loadJiraIntegrations"});if(Q.length===0)return;let Y=await Promise.all(Q.map((X)=>Rz.runStep(()=>KZ5(X),{name:`sweepJira:${X}`})));for(let X of Y)if(X.error)console.warn(`[jira-trigger] integration ${X.integrationId} failed: ${X.error}`);else if(X.fired>0)console.log(`[jira-trigger] integration ${X.integrationId} fired ${X.fired} automation(s) the webhook missed`)}async function FZ5($,Z){try{let Q=await AP1().getById($);if(!Q?.enabled)return"disabled";let Y=await o3(zP1().db,Q.organizationId);if(!Y)return"disabled";let X=await OP1(Y,Q,{issueId:Z.issueId,changelogId:Z.changelogId});if(X==="fired")console.log(`[jira-trigger] fired an automation for ${Z.issueKey} after it settled`);else if(X==="returned")console.log(`[jira-trigger] ${Z.issueKey} went back where it was before settling in "${Z.toStatus}"; no fire`);return X}catch(Q){return console.error(`[jira-trigger] settling ${Z.issueKey} failed`,Q instanceof Error?Q.message:Q),"error"}}async function UZ5($,Z){await Rz.sleep(Ix0()+WZ5),await Rz.runStep(()=>FZ5($,Z),{name:"settleJiraMove"})}async function EU8($,Z){if(!PP1)throw Error("[jira-trigger] settle workflow is not registered");await Rz.startWorkflow(PP1,{workflowID:`jira-settle:${$}:${Z.changelogId}`})($,Z)}function PU8(){if(jP1)return;PP1=Rz.registerWorkflow(UZ5,{name:"jiraSettleWorkflow"}),jP1=Rz.registerWorkflow(HZ5,{name:"jiraTriggerSweepWorkflow"}),Rz.registerScheduled(jP1,{name:"jiraTriggerSweepWorkflow",crontab:XZ5,mode:YZ5.ExactlyOncePerIntervalWhenActive})}var XZ5="*/5 * * * *",JZ5=20,GZ5=5,WZ5=5000,EP1=null,PP1=null,jP1=null;var TP1=L(()=>{zw();Dg();_L();LP1();wP1()});function zU8($){let Z=new HO($.db,new nX($.encryptionKey)),Q=Hj($.db);async function Y(J,G){let W=wU8(G);if(!W)return;let K=await Z.getByWebhookSecret(J);if(!K?.enabled)return;if((await Q.listJiraTransitionTriggers(K.organizationId,{activeOnly:!0})).length===0)return;await EU8(K.id,W)}let X=new Q1;return X.post("/webhook/:secret",h5({maxSize:NZ5}),async(J)=>{let G=J.req.param("secret");if(!await Z.getByWebhookSecret(G))return J.json({error:"Unknown webhook"},404);let K;try{K=await J.req.json()}catch{return J.json({error:"Body must be JSON"},400)}return Y(G,K).catch((H)=>{console.error("[jira-webhook] trigger failed",H)}),J.body(null,202)}),X}var NZ5=1048576;var AU8=L(()=>{W8();aK();zw();TP1();wP1();Ca()});function TU8($,Z){if(Z.startsWith("text/html")||Z.startsWith("image/svg"))$.set("Content-Security-Policy","sandbox allow-scripts allow-modals allow-same-origin")}var RU8,BZ5,DZ5,qU8;var MU8=L(()=>{W8();$G();kp();bd();RU8=new Q1,BZ5=["range","if-none-match","if-modified-since"],DZ5=["content-type","content-length","content-range","accept-ranges","etag","last-modified"];RU8.get("/:org/files/*",async($)=>{let Z=$.get("studioContext"),Q=Z.organization?.id;if(!Z.auth?.user?.id){if(Xt($))return $.redirect(`/login?next=${encodeURIComponent($.req.path)}`,302);throw new I1(401,{message:"Authentication required"})}if(!Q)throw new I1(401,{message:"Organization context required"});let Y=$.req.path.replace(/^.*\/files\//,"");if(!Y)throw new I1(400,{message:"Missing file key"});let X=await z60(Y,Z);if(!X)throw new I1(503,{message:"Object storage not configured"});if(X.startsWith("data:")&&UK()){let K=X.match(/^data:([^;]+);base64,(.+)$/s);if(!K)throw new I1(500,{message:"Invalid data URL from storage"});let[,H,F]=K,U=Buffer.from(F,"base64"),N=new Headers({"Content-Type":H,"Cache-Control":"private, max-age=86400"});return TU8(N,H),new Response(U,{status:200,headers:N})}let J=new Headers;for(let K of BZ5){let H=$.req.header(K);if(H)J.set(K,H)}let G=await fetch(X,{headers:J});if(G.status===403||G.status===404)throw new I1(404,{message:"File not found"});if(!G.ok&&G.status!==304&&G.status!==416)throw console.error(`[files] upstream storage error ${G.status} for key:`,Y),new I1(502,{message:"Upstream storage error"});let W=new Headers;for(let K of DZ5){let H=G.headers.get(K);if(H)W.set(K,H)}return W.set("Cache-Control","private, max-age=86400"),TU8(W,W.get("content-type")??""),new Response(G.body,{status:G.status,headers:W})});qU8=RU8});var zZ0=b((fh)=>{var LZ5=fh&&fh.__createBinding||(Object.create?function($,Z,Q,Y){if(Y===void 0)Y=Q;var X=Object.getOwnPropertyDescriptor(Z,Q);if(!X||("get"in X?!Z.__esModule:X.writable||X.configurable))X={enumerable:!0,get:function(){return Z[Q]}};Object.defineProperty($,Y,X)}:function($,Z,Q,Y){if(Y===void 0)Y=Q;$[Y]=Z[Q]}),OZ5=fh&&fh.__exportStar||function($,Z){for(var Q in $)if(Q!=="default"&&!Object.prototype.hasOwnProperty.call(Z,Q))LZ5(Z,$,Q)};Object.defineProperty(fh,"__esModule",{value:!0});OZ5(rG(),fh)});var kU8=b((IU8)=>{Object.defineProperty(IU8,"__esModule",{value:!0});IU8.version=void 0;IU8.version="3.4.0"});var _U8=b((zB)=>{var wZ5=zB&&zB.__importDefault||function($){return $&&$.__esModule?$:{default:$}};Object.defineProperty(zB,"__esModule",{value:!0});zB.NodeTransport=zB.VERSION=void 0;zB.nodeResolveHost=TZ5;var Q9=zZ0(),jZ5=I0("net"),RP1=I0("tls"),EZ5=I0("path"),SU8=I0("fs"),PZ5=wZ5(I0("dns")),zZ5=kU8();zB.VERSION=zZ5.version;var AZ5="nats.js";class CU8{socket;version;lang;yields=[];signal=(0,Q9.deferred)();closedNotification=(0,Q9.deferred)();options;connected=!1;tlsName="";done=!1;closeError;constructor(){this.lang=AZ5,this.version=zB.VERSION}async connect($,Z){this.tlsName=$.tlsName,this.options=Z;let{tls:Q}=this.options,{handshakeFirst:Y}=Q||{};try{if(Y===!0)this.socket=await this.tlsFirst($);else this.socket=await this.dial($);if(this.done)this.socket?.destroy();let X=await this.peekInfo();(0,Q9.checkOptions)(X,Z);let{tls_required:J,tls_available:G}=X,W=G===!0&&Z.tls!==null;if(!Y&&(J||W))this.socket=await this.startTLS();if(this.done)this.socket?.destroy();if(J&&this.socket.encrypted!==!0)throw Q9.errors.InvalidArgumentError.format("tls","is not available on this server");return this.connected=!0,this.setupHandlers(),this.signal.resolve(),Promise.resolve()}catch(X){let J=X;if(!J)J=new Q9.errors.ConnectionError("error connecting - node provided an undefined error");let{code:G}=J,W=G==="ECONNREFUSED"?new Q9.errors.ConnectionError("connection refused",{cause:J}):J;throw this.socket?.destroy(),W}}dial($){let Z=(0,Q9.deferred)(),Q,Y=(0,jZ5.createConnection)($.port,$.hostname,()=>{Z.resolve(Y),Y.removeAllListeners()});return Y.on("error",(X)=>{Q=X}),Y.on("close",()=>{Y.removeAllListeners(),Z.reject(Q)}),Y.setNoDelay(!0),Z}get isClosed(){return this.done}close($){return this._closed($,!1)}peekInfo(){let $=(0,Q9.deferred)(),Z;return this.socket.on("data",(Q)=>{this.yields.push(Q);let Y=Q9.DataBuffer.concat(...this.yields),X=(0,Q9.extractProtocolMessage)(Y);if(X!=="")try{let J=Q9.INFO.exec(X);if(!J)throw Error("unexpected response from server");let G=JSON.parse(J[1]);$.resolve(G)}catch(J){$.reject(J)}finally{this.socket.removeAllListeners()}}),this.socket.on("error",(Q)=>{Z=Q}),this.socket.on("close",()=>{this.socket.removeAllListeners(),$.reject(Z)}),$}loadFile($){if(!$)return Promise.resolve();let Z=(0,Q9.deferred)();try{if($=(0,EZ5.resolve)($),!(0,SU8.existsSync)($))Z.reject(Error(`${$} doesn't exist`));(0,SU8.readFile)($,(Q,Y)=>{if(Q)return Z.reject(Q);Z.resolve(Y)})}catch(Q){Z.reject(Q)}return Z}async loadClientCerts(){let $={},{certFile:Z,cert:Q,caFile:Y,ca:X,keyFile:J,key:G}=this.options.tls;try{if(Z){let W=await this.loadFile(Z);if(W)$.cert=W}else if(Q)$.cert=Q;if(J){let W=await this.loadFile(J);if(W)$.key=W}else if(G)$.key=G;if(Y){let W=await this.loadFile(Y);if(W)$.ca=[W]}else if(X)$.ca=X;return Promise.resolve($)}catch(W){return Promise.reject(W)}}async tlsFirst($){let Z,Q={servername:this.tlsName,rejectUnauthorized:!0};if(this.socket)Q.socket=this.socket;if(typeof this.options.tls==="object")try{let X=await this.loadClientCerts()||{};Q=(0,Q9.extend)(Q,this.options.tls,X)}catch(X){return Promise.reject(new Q9.errors.ConnectionError(X.message,{cause:X}))}let Y=(0,Q9.deferred)();try{let X=(0,RP1.connect)($.port,$.hostname,Q,()=>{X.removeAllListeners(),Y.resolve(X)});X.on("error",(J)=>{Z=J}),X.on("secureConnect",()=>{if(Q.rejectUnauthorized===!1)return;if(!X.authorized)throw X.authorizationError}),X.on("close",()=>{Y.reject(Z),X.removeAllListeners()}),X.setNoDelay(!0)}catch(X){Y.reject(new Q9.errors.ConnectionError(X.message,{cause:X}))}return Y}async startTLS(){let $,Z={socket:this.socket,servername:this.tlsName,rejectUnauthorized:!0};if(typeof this.options.tls==="object")try{let Y=await this.loadClientCerts()||{};Z=(0,Q9.extend)(Z,this.options.tls,Y)}catch(Y){return Promise.reject(new Q9.errors.ConnectionError(Y.message,{cause:Y}))}let Q=(0,Q9.deferred)();try{let Y=(0,RP1.connect)(Z,()=>{Y.removeAllListeners(),Q.resolve(Y)});Y.on("error",(X)=>{$=X}),Y.on("secureConnect",()=>{if(Z.rejectUnauthorized===!1)return;if(!Y.authorized)throw Y.authorizationError}),Y.on("close",()=>{Q.reject($),Y.removeAllListeners()})}catch(Y){Q.reject(new Q9.errors.ConnectionError(Y.message,{cause:Y}))}return Q}setupHandlers(){let $;this.socket.on("data",(Z)=>{return this.yields.push(Z),this.signal.resolve()}),this.socket.on("error",(Z)=>{$=Z}),this.socket.on("end",()=>{if(this.socket?.destroyed)return;this.socket?.write(new Uint8Array(0),()=>{this.socket?.end()})}),this.socket.on("close",()=>{this._closed($,!1)})}[Symbol.asyncIterator](){return this.iterate()}async*iterate(){while(!0){if(this.yields.length===0)await this.signal;let $=this.yields;this.yields=[];for(let Z=0;Z<$.length;Z++){if(this.options.debug)console.info(`> ${(0,Q9.render)($[Z])}`);yield $[Z]}if(this.done)break;else if(this.yields.length===0)$.length=0,this.yields=$,this.signal=(0,Q9.deferred)()}}discard(){if(this.done=!0,this.socket)try{this.socket.removeAllListeners(),this.socket.destroy()}catch{}}disconnect(){this._closed(void 0,!0).then().catch()}isEncrypted(){return this.socket instanceof RP1.TLSSocket}_send($){if(this.isClosed||this.socket===void 0)return Promise.resolve();if(this.options.debug)console.info(`< ${(0,Q9.render)($)}`);let Z=(0,Q9.deferred)();try{this.socket.write($,(Q)=>{if(Q){if(this.options.debug)console.error(`!!! ${(0,Q9.render)($)}: ${Q}`);return Z.reject(Q)}return Z.resolve()})}catch(Q){if(this.options.debug)console.error(`!!! ${(0,Q9.render)($)}: ${Q}`);Z.reject(Q)}return Z}send($){this._send($).catch((Q)=>{})}async _closed($,Z=!0){if(!this.connected)return;if(this.done){this.socket?.destroy();return}if(this.closeError=$,!$&&this.socket&&Z)try{await this._send(new TextEncoder().encode(""))}catch(Q){if(this.options.debug)console.log("transport close terminated with an error",Q)}try{if(this.socket)this.socket.removeAllListeners(),this.socket?.destroy(),this.socket=void 0}catch(Q){console.log(Q)}this.done=!0,this.closedNotification.resolve(this.closeError)}closed(){return this.closedNotification}}zB.NodeTransport=CU8;function TZ5($){let Z=(0,Q9.deferred)();return PZ5.default.lookup($,{all:!0},(Q,Y)=>{if(Q){Z.reject(Q);return}let X=[];for(let J of Y)X.push(J.address);if(X.length===0)X.push($);Z.resolve(X)}),Z}});var yU8=b((fU8)=>{Object.defineProperty(fU8,"__esModule",{value:!0});fU8.connect=RZ5;var vU8=_U8(),bU8=zZ0(),xU8=zZ0();function RZ5($={}){if((0,xU8.hasWsProtocol)($))return Promise.reject(xU8.errors.InvalidArgumentError.format("servers","node client doesn't support websockets, use the 'wsconnect' function instead"));return(0,bU8.setTransportFactory)({factory:()=>{return new vU8.NodeTransport},dnsResolveFn:vU8.nodeResolveHost}),bU8.NatsConnectionImpl.connect($)}});var gU8=b((RO)=>{var MZ5=RO&&RO.__createBinding||(Object.create?function($,Z,Q,Y){if(Y===void 0)Y=Q;var X=Object.getOwnPropertyDescriptor(Z,Q);if(!X||("get"in X?!Z.__esModule:X.writable||X.configurable))X={enumerable:!0,get:function(){return Z[Q]}};Object.defineProperty($,Y,X)}:function($,Z,Q,Y){if(Y===void 0)Y=Q;$[Y]=Z[Q]}),IZ5=RO&&RO.__exportStar||function($,Z){for(var Q in $)if(Q!=="default"&&!Object.prototype.hasOwnProperty.call(Z,Q))MZ5(Z,$,Q)};Object.defineProperty(RO,"__esModule",{value:!0});RO.connect=void 0;var VZ5=yU8();Object.defineProperty(RO,"connect",{enumerable:!0,get:function(){return VZ5.connect}});IZ5(zZ0(),RO)});function lU8($){let Z=$?.connectFn??_Z5,Q=null,Y=null,X=!1,J=!1,G=!1,W=[];function K(){return Q!==null&&!Q.isClosed()&&!Q.isDraining()&&!G}function H(){console.log(`[NatsProvider] fireReady: ${W.length} callbacks`);for(let N of W)try{N()}catch{}}function F(N){(async()=>{for await(let B of N.status())if(B.type==="disconnect")console.log("[NatsProvider] Disconnected"),G=!0;else if(B.type==="reconnect")console.log("[NatsProvider] Reconnected, re-firing ready callbacks"),G=!1,Y=null,H()})().catch(()=>{})}async function U(N,B){let D=0;while(!J)try{Q=await Z({servers:N,timeout:CZ5,reconnect:!0,maxReconnectAttempts:-1,...B?{authenticator:B}:{}}),console.log(`[NatsProvider] Connected to ${Q.getServer()} after ${D} attempt(s)`),Y=null,G=!1,F(Q),H();return}catch{D++;let O=I7(SZ5,kZ5,D-1,2,0.5);await F$(O)}}return{init(N,B){if(X)return;X=!0,J=!1;let D=B?.creds?Vx0.credsAuthenticator(new TextEncoder().encode(B.creds)):B?.user?Vx0.usernamePasswordAuthenticator(B.user,B.password):void 0;U(N,D).catch(()=>{})},isConnected(){return K()},getConnection(){return K()?Q:null},getJetStream(){if(!K())return null;if(!Y)Y=uU8.jetstream(Q);return Y},onReady(N){if(W.push(N),K())try{N()}catch{}},async drain(){if(J=!0,X=!1,Y=null,G=!1,Q){let N=Q;Q=null,await N.drain().catch(()=>{})}}}}function _Z5($){return hU8.connect($)}var Vx0,hU8,uU8,kZ5=100,SZ5=3000,CZ5=3000;var cU8=L(()=>{r$();Vx0=C(iz(),1),hU8=C(gU8(),1),uU8=C(UH(),1)});function kx0($){let Z=$?.ttlMs??60000,Q=$?.maxSize??1e4,Y=$?.updateRecencyOnGet??!1,X=new Map;function J(){if(X.size<=Q)return;let G=Date.now();for(let[W,K]of X)if(K.expiresAt<=G)X.delete(W);while(X.size>Q){let W=X.keys().next().value;if(W===void 0)break;X.delete(W)}}return{get(G){let W=X.get(G);if(!W)return;if(W.expiresAt<=Date.now()){X.delete(G);return}if(Y)X.delete(G),X.set(G,W);return W.value},set(G,W){X.delete(G),X.set(G,{value:W,expiresAt:Date.now()+Z}),J()},delete(G){X.delete(G)},clear(){X.clear()},size(){return X.size}}}function Sx0($,Z){return`${$}.${Z}`}class qP1{cache;constructor($){this.cache=kx0({ttlMs:$?.ttlMs??vZ5,maxSize:$?.maxSize??bZ5})}async get($,Z){return this.cache.get(Sx0($,Z))??null}async set($,Z,Q){this.cache.set(Sx0($,Z),Q)}async invalidate($,Z){this.cache.delete(Sx0($,Z)),this.cache.delete(Sx0($,`${Z}:decisions`))}teardown(){this.cache.clear()}}var vZ5=600000,bZ5=5000;var mU8=()=>{};function Cx0($,Z){return`${$}:${Z}`}function MP1($){let Z=kx0({ttlMs:$?.ttlMs??xZ5,maxSize:$?.maxSize??fZ5}),Q=$?.getConnection,Y=crypto.randomUUID(),X=new TextEncoder,J=new TextDecoder,G=null;function W(K,H){let F=Q?.();if(!F)return;try{F.publish(dU8,X.encode(JSON.stringify({organizationId:K,keyId:H,originId:Y})))}catch(U){console.warn("[ProviderKeyCache] Publish failed (non-critical):",U)}}return{get(K,H){return Z.get(Cx0(K,H))},set(K,H,F){Z.set(Cx0(K,H),F)},invalidate(K,H){Z.delete(Cx0(K,H)),W(K,H)},start(){if(G)return;let K=Q?.();if(!K)return;G=K.subscribe(dU8),(async()=>{for await(let H of G)try{let F=JSON.parse(J.decode(H.data));if(F.originId===Y)continue;Z.delete(Cx0(F.organizationId,F.keyId))}catch{}})().catch(console.error)},teardown(){G?.unsubscribe(),G=null,Z.clear()}}}var dU8="studio.ai-provider-keys.invalidate",xZ5=30000,fZ5=5000;var iU8=()=>{};class IP1{options;subscription=null;onCancel=null;encoder=new TextEncoder;originId=crypto.randomUUID();constructor($){this.options=$}async start($){if($)this.onCancel=$;if(this.subscription)return;if(!this.onCancel)return;let Z=this.options.getConnection();if(!Z)return;let Q=new TextDecoder,Y=Z.subscribe("studio.decopilot.cancel");this.subscription=Y,(async()=>{for await(let X of Y)try{let J=JSON.parse(Q.decode(X.data));if(J.originId===this.originId)continue;this.onCancel?.(J.taskId)}catch{}})().catch(console.error)}broadcast($){if(/[.*>\s]/.test($)){console.warn("[NatsCancelBroadcast] Invalid threadId, skipping broadcast");return}this.onCancel?.($);try{let Z=this.options.getConnection();if(!Z)return;let Q=this.encoder.encode(JSON.stringify({taskId:$,originId:this.originId}));Z.publish("studio.decopilot.cancel",Q)}catch(Z){console.warn("[NatsCancelBroadcast] Publish failed (non-critical):",Z)}}async stop(){this.subscription?.unsubscribe(),this.subscription=null,this.onCancel=null}}var pU8=($)=>{let Z;return()=>Z??=$()},VP1,kP1;var nU8=L(()=>{v6();VP1=pU8(()=>J$.createHistogram("decopilot.stream.encode_ms",{description:"Per-chunk JSON.stringify+encode time for decopilot stream",unit:"ms"})),kP1=pU8(()=>J$.createCounter("decopilot.stream.published_chunks",{description:"Logical decopilot stream chunks published to JetStream",unit:"{chunks}"}))});function mZ5($=sU8){return{name:oN,subjects:[`${yW1}.>`],storage:dF.StorageType.File,max_age:hZ5,max_bytes:lZ5,max_msgs_per_subject:cZ5,discard:dF.DiscardPolicy.Old,retention:dF.RetentionPolicy.Limits,duplicate_window:uZ5,num_replicas:$}}class rU8{chunks=0;encodeMs=0;maxMs=0;bytes=0;windowStart=performance.now();constructor(){setInterval(()=>this.flush(),1e4).unref?.()}record($,Z){if(this.chunks++,this.encodeMs+=$,$>this.maxMs)this.maxMs=$;this.bytes+=Z}flush(){let $=performance.now(),Z=$-this.windowStart;if(this.chunks>0&&Z>0)console.warn(JSON.stringify({msg:"stream-encode-trace",windowMs:Math.round(Z),chunks:this.chunks,encodeMs:Math.round(this.encodeMs),pctOfLoop:+(this.encodeMs/Z*100).toFixed(1),maxChunkMs:+this.maxMs.toFixed(2),mbEncoded:+(this.bytes/1048576).toFixed(2)}));this.chunks=0,this.encodeMs=0,this.maxMs=0,this.bytes=0,this.windowStart=$}}function tU8($){let Z=oU8.headers();for(let[Q,Y]of Object.entries($))Z.set(Q,Y);return Z}function nZ5($,Z){let Q=0;return{publish(Y,X,J,G){Y.publish(X,J,G?{headers:G}:void 0).catch((W)=>{if(Q++,gZ5().add(1,{"org.id":Z??"unknown"}),Q===1||Q%100===0)console.warn(`[Decopilot] JetStream publish failed for thread ${$} (${Q} total):`,W)})},get errorCount(){return Q}}}function tZ5($,Z){return $.info?.cluster?Z:1}function oZ5($){if(!($ instanceof Error))return!1;if(/non-clustered/i.test($.message))return!0;return/replicas?\b/i.test($.message)&&/not supported|can ?not|exceed|insufficient|greater than/i.test($.message)}class SP1{options;js=null;jsm=null;constructor($){this.options=$}async init(){let $=this.options.getConnection();if(!$){console.log("[Decopilot] StreamBuffer.init skipped: NATS not connected yet");return}let Z=async(Y,X)=>{let J=mZ5(X);try{await Y.streams.info(oN),await Y.streams.update(oN,J)}catch(G){if(G instanceof Error&&G.message.includes("stream not found"))await Y.streams.add(J),await Y.streams.update(oN,J);else if(G instanceof Error&&/can ?not change.*storage|storage type/i.test(G.message))await Y.streams.delete(oN),await Y.streams.add(J);else throw G}},Q=await D8(async()=>{let Y=this.options.getJetStreamManager?await this.options.getJetStreamManager():await dF.jetstreamManager($),X=tZ5($,sU8);try{await Z(Y,X)}catch(J){if(X<=1||!oZ5(J))throw J;console.warn(`[Decopilot] StreamBuffer: NATS rejected num_replicas=${X} (${J.message}); falling back to an unreplicated stream`),await Z(Y,1)}return Y},{maxAttempts:5,minTimeout:250,maxTimeout:4000,jitter:0.5,isRetriable:hp});this.js=this.options.getJetStream(),this.jsm=Q,console.log(`[Decopilot] StreamBuffer.init ${this.js?"ready":"degraded (js=null)"}`)}pump($,Z,Q,Y){let X=this.js;if(!X)return console.warn(`[Decopilot] pump: JetStream client unavailable for thread ${Z}; chunks NOT published to NATS`),Promise.resolve();let J=nZ5(Z,Y),G=!1,W=()=>{if(G)return;G=!0;let H=sm$(Z);X.publish(H.subject,H.data).catch(()=>{})};Q.addEventListener("abort",W,{once:!0});let K=(H)=>{let F=performance.now(),U=hW1(H,{runId:Z}),N=performance.now()-F;VP1().record(N),kP1().add(1,{"org.id":Y??"unknown"}),pZ5?.record(N,U.reduce((B,D)=>B+D.data.length,0));for(let B of U)J.publish(X,B.subject,B.data,B.headers?tU8(B.headers):void 0)};return(async()=>{let H=$.getReader(),F=0,U=0,N;try{while(!0){let{done:B,value:D}=await H.read();if(B)break;if(K(D),U++,++F>=64)F=0,await new Promise((O)=>setImmediate(O))}}catch(B){N=B,console.warn(`[Decopilot] stream pump error for thread ${Z}:`,B?.message??B)}finally{if(H.releaseLock(),W(),iZ5)console.warn(JSON.stringify({msg:"decopilot-stream-diag",event:"pump-done",taskId:Z,publishedChunks:U,publishErrors:J.errorCount}))}if(N!==void 0)throw N})()}async publishSerialized($,Z){try{return await D8(()=>$.publish(Z.subject,Z.data,{...Z.headers?{headers:tU8(Z.headers)}:{},...Z.msgId?{msgID:Z.msgId}:{}}),{maxAttempts:6,minTimeout:250,maxTimeout:5000,jitter:0.5,isRetriable:hp}),!0}catch(Q){return console.error(`[Decopilot] publish failed after retries subject=${Z.subject}`,Q),!1}}async publishRawChunk($,Z,Q){let Y=this.js;if(!Y)return!1;let X=performance.now(),J=hW1(Z,{runId:$,dedup:Q});VP1().record(performance.now()-X),kP1().add(1);for(let G of J)if(!await this.publishSerialized(Y,G))return!1;return!0}async publishDone($,Z,Q){let Y=this.js;if(!Y)return!1;let X=om$({runId:$,fenceToken:Z,finalSeq:Q});return await this.publishSerialized(Y,X)}async createTailStream($,Z,Q){let Y=this.js;if(!Y)return console.warn(`[Decopilot] createTailStream: JetStream client unavailable for thread ${$}; no live tail`),null;let X=Q?.deliverPolicy==="new"?dF.DeliverPolicy.New:dF.DeliverPolicy.All,J=Q?.closeOnDone??!1,G=CP($),W;try{W=await D8(async()=>{return(await Y.consumers.get(oN,{filter_subjects:G,deliver_policy:X})).consume()},{maxAttempts:6,minTimeout:250,maxTimeout:5000,jitter:0.5,isRetriable:hp})}catch(O){return console.warn("[Decopilot] JetStream tail unavailable (non-critical):",O?.message??O),null}let F=Wk0({messages:async function*(){try{for await(let O of W)yield{subject:O.subject,data:O.data,headers:O.headers}}finally{W.stop()}}(),onCancel:()=>W.stop()}).pipeThrough(Yk0()).pipeThrough(Xk0()).getReader(),U=!1,N=()=>{if(U)return;U=!0;try{F.releaseLock()}catch{}},B=!1,D=()=>{if(B)return;B=!0,W.stop(),F.cancel().catch(()=>{}),N()};return Z?.addEventListener("abort",D,{once:!0}),new ReadableStream({async pull(O){for(;;){let{done:w,value:j}=await F.read();if(w){D(),O.close();return}let E=j;if(E.kind==="done"){if(J){D(),O.close();return}continue}O.enqueue(E.chunk);return}},cancel(){D()}})}purge($){if(!this.jsm)return;this.jsm.streams.purge(oN,{filter:CP($)}).catch(()=>{})}teardown(){this.js=null,this.jsm=null}}var dF,oU8,yZ5=($)=>{let Z;return()=>Z??=$()},gZ5,hZ5=86400000000000,uZ5=120000000000,lZ5=4294967296,sU8,cZ5=500000,dZ5,iZ5,pZ5;var aU8=L(()=>{r$();uW1();Kk0();Jk0();v6();nU8();dF=C(UH(),1),oU8=C(iz(),1),gZ5=yZ5(()=>J$.createCounter("decopilot.stream.publish_errors",{description:"Number of JetStream publish failures for decopilot stream chunks",unit:"{errors}"})),sU8=Math.max(1,Number(process.env.DECOPILOT_STREAM_REPLICAS??3)||3);dZ5=process.env.STREAM_ENCODE_TRACE==="1",iZ5=process.env.DECOPILOT_STREAM_TRACE==="1";pZ5=dZ5?new rU8:null});function _x0($,Z,Q,Y){if(!Y)return!1;return $.emit(Z,NU(Q,Y.status,{title:Y.title??void 0,virtualMcpId:Y.virtual_mcp_id??void 0,createdBy:Y.created_by??void 0,triggerId:Y.trigger_id??null,branch:Y.branch??null,harnessId:Y.harness_id??void 0,createdAt:Y.created_at,updatedAt:Y.updated_at})),!0}var eU8=L(()=>{R8()});class CP1{storage;options;timer=null;constructor($,Z={}){this.storage=$;this.options=Z}start(){if(this.timer)return;let $=this.options.intervalMs??300000;this.timer=setInterval(()=>{this.runOnce()},$)}async runOnce(){let $=this.options.staleAfterMs??3600000;try{let Z=await this.storage.sweepAbandoned($);if(Z>0)console.log(`[async-research-sweeper] marked ${Z} stale jobs as abandoned`);return Z}catch(Z){return console.error("[async-research-sweeper] sweep failed",Z),0}}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}function sZ5($,Z,Q={}){let Y=$.startsWith("thread:")?wF($,Q):$;return[...new Set([Z,Y].filter((X)=>!!X))]}async function _P1($,Z){let Q=Z.organizationId;try{let Y=await $.storage.taskBoard.linkedThreadIds(Z.id,Q);for(let X of Y){let J=await yN($,X);if(!J?.owner||!J?.name)continue;let G=await $.storage.threads.get(X),W=await gN($,{threadId:X,runBranch:G?.branch}),K=await o$0($,Q,QZ1(J)).catch(()=>null);if(!K){console.warn(`[task-board] no credential for ${J.owner}/${J.name} \u2014 `+`cannot look up ${Z.id}'s change request by branch`);continue}let H=sZ5(W,await HM0($,X),{flat:my(K.repo.provider)});for(let F of H){let U=await K.readForBranch(F).catch(()=>null);if(!U)continue;return await $.storage.taskBoard.linkPr({taskBoardItemId:Z.id,organizationId:Q,url:U.url,prNumber:U.number,repo:K.repo}),await $.storage.taskBoard.openReviewCycleIfInProgress(Z.id,Q),await s3(Q).catch(()=>{}),console.log(`[task-board] ${Z.id}: linked ${U.url} found on branch ${F}`),!0}}}catch(Y){console.error("[task-board] PR lookup by branch failed",Y)}return!1}var $N8=L(()=>{O7();VQ();kQ()});async function ZN8($,Z,Q){let Y=Z.organizationId;if(!IJ(Z))return!1;if(!Lg(Q))return!1;if(!await Im($,Y,se))return!1;if(await $.storage.taskBoard.hasHumanRejectedDone(Z.id,Y))return!1;let X=F1.shipped,J=await $.storage.taskBoard.update(Z.id,Y,{status:X},Z.updatedBy);return await r5($,{taskBoardItemId:Z.id,action:"status_changed",actorId:null,data:{from:Z.status,to:X,reason:"pr_merged"}}),w8(Y,J),console.log(`[task-board-review-sweeper] ${Z.id}: linked PR already merged \u2014 moved to ${X}`),!0}var QN8=L(()=>{XG();m8();zX();zp();RF();a5()});function Y75($){return $ instanceof KX}function YN8($,Z){return Z-$>=Z75}class vP1{taskBoard;contextFactory;billing;options;timer=null;running=!1;cursor=null;constructor($,Z,Q,Y={}){this.taskBoard=$;this.contextFactory=Z;this.billing=Q;this.options=Y}start(){if(this.timer)return;let $=this.options.intervalMs??rZ5;this.timer=setInterval(()=>{this.runOnce()},$),this.timer.unref()}async runOnce(){if(this.running)return 0;this.running=!0;let $=0;try{let Z=this.options.batchSize??eZ5,Q=this.options.itemIntervalMs??aZ5,Y=new Date(Date.now()-Q),X=await this.taskBoard.listItemsPendingReview(Z,this.cursor,Y),J=X.at(-1);this.cursor=X.length===Z&&J?{updatedAt:J.updatedAt,id:J.id}:null;for(let{id:G,organizationId:W}of X)try{if(await this.reconcileItem(G,W,Y))$++}catch(K){console.error(`[task-board-review-sweeper] ${G} failed`,K)}await this.reapNeverStartedThreads(Z),$+=await this.dispatchDueRetries(Z),await this.reactToUnhandledFailures(Z),$+=await this.settleFinishedRunsWithoutPr(Z,Y)}catch(Z){console.error("[task-board-review-sweeper] sweep failed",Z)}finally{this.running=!1}return $}async reapNeverStartedThreads($){try{let Z=await this.taskBoard.failNeverStartedLinkedThreads($,new Date(Date.now()-lJ1),B31);for(let Q of Z)console.warn(`[task-board-review-sweeper] failed never-started thread ${Q.threadId} on ${Q.itemId}`)}catch(Z){console.error("[task-board-review-sweeper] reaping failed",Z)}}async reactToUnhandledFailures($){let Z=await this.taskBoard.listItemsStuckAfterFailure($,new Date(Date.now()-Q75));for(let{id:Q,organizationId:Y,threadId:X}of Z)try{console.warn(`[task-board-review-sweeper] reacting to an unhandled failure on ${Q}`),await U31(this.taskBoard,X,Y),await N31(this.taskBoard,this.billing,X,Y)}catch(J){console.error(`[task-board-review-sweeper] unhandled-failure reaction for ${Q} failed`,J)}}async settleFinishedRunsWithoutPr($,Z){let Q=0,Y=await this.taskBoard.listItemsFinishedWithoutPr($,Z);for(let{id:X,organizationId:J,finishedAt:G}of Y)try{if(!await this.taskBoard.claimSweep(X,J,Z))continue;let W=await this.taskBoard.getById(X,J);if(!W||W.status!==F1.progress||IJ(W)||W.assigneeId!==F8)continue;let K=await this.contextFactory(J,W.assignedBy??W.createdBy);if(!K)continue;if(await _P1(K,W)){if(await this.taskBoard.clearSweepBudget(X,J),await this.reconcileItem(X,J,Z))Q++;continue}if(!YN8(G.getTime(),Date.now()))continue;let H="the run finished without opening a pull request \u2014 there is "+"nothing for a reviewer to review",F=await this.taskBoard.advanceFromProgress(X,J,F1.review,W.updatedBy);if(!F)continue;await this.taskBoard.recordActivity({taskBoardItemId:X,action:"status_changed",actorId:null,data:{from:F1.progress,to:F1.review,reason:H}}).catch(()=>{}),w8(J,F),await qF(K,F,H)}catch(W){console.error(`[task-board-review-sweeper] settling finished run on ${X} failed`,W)}return Q}async dispatchDueRetries($){let Z=0,Q=await this.taskBoard.listItemsDueForRetry($,new Date);for(let{id:Y,organizationId:X,attempts:J}of Q)try{if(!await this.taskBoard.claimDueRetry(Y,X,new Date))continue;let G=await this.taskBoard.getById(Y,X);if(!G||G.status!==F1.progress||G.assigneeId!==F8)continue;let W=await this.contextFactory(X,G.assignedBy??G.createdBy);if(!W)continue;await yL(W,G,{runClass:"retry"}),Z++,console.warn(`[task-board-review-sweeper] re-dispatched ${Y} after a failure (attempt ${J})`)}catch(G){if(console.error(`[task-board-review-sweeper] retry dispatch for ${Y} failed`,G),Y75(G)){await this.returnToBacklog(Y,X,G instanceof Error?G.message:String(G));continue}await this.taskBoard.scheduleRunRetry(Y,X,J,new Date(Date.now()+$75)).catch((W)=>console.error(`[task-board-review-sweeper] re-arming ${Y} failed`,W))}return Z}async returnToBacklog($,Z,Q){try{let Y=await this.taskBoard.getById($,Z);if(!Y||Y.status!==F1.progress)return;let X=await this.taskBoard.returnToBacklogAfterFailure($,Z,Y.updatedBy);if(!X)return;await this.taskBoard.recordActivity({taskBoardItemId:$,action:"status_changed",actorId:null,data:{from:F1.progress,to:F1.intake,reason:Q,retriesSpent:Y.retryAttempts}}).catch(()=>{}),w8(Z,X)}catch(Y){console.error(`[task-board-review-sweeper] returning ${$} to backlog failed`,Y)}}async handOffReviewWithoutPr($,Z){let Q=await this.taskBoard.listActivity(Z.id,Z.organizationId);if(!YN8(CD(Q,Z.reviewCycleStartedAt),Date.now()))return;await qF($,Z,"no pull request is linked to this task \u2014 there is nothing for a "+"reviewer to review")}async reconcileItem($,Z,Q){if(!await this.taskBoard.claimSweep($,Z,Q))return!1;let Y=await this.taskBoard.getById($,Z);if(!Y)return!1;if(!IJ(Y))return!1;let X=Y.assigneeId===F8,J=await this.taskBoard.listPrs($,Z),G=await this.contextFactory(Z,Y.assignedBy??Y.createdBy);if(!G)return!1;if(J.length===0){if(await _P1(G,Y))J=await this.taskBoard.listPrs($,Z);if(J.length===0){if(X)await this.handOffReviewWithoutPr(G,Y);return!1}}let W=await Promise.all(J.map(async(K)=>({...K,...await Rp(Z,K)})));if(W.every((K)=>K.state===null))console.warn(`[task-board-review-sweeper] ${$}: no live PR state from GitHub (${W.length} PR(s)) \u2014 proceeding on unknown`);if(await ZN8(G,Y,W))return!0;if(!X)return!1;if(await nu$(G,Y))return!0;if(!W31(W))return!1;return await Tp(G,Y,{previewMatchesHead:K31(W)}),!0}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}var rZ5=60000,aZ5=300000,eZ5=50,$75=60000,Z75=900000,Q75=120000;var XN8=L(()=>{m8();QV0();$N8();gL();Vp();RF();QN8();a5();x3();D31();kQ();p40()});async function JN8($,Z,Q=vP){return await WN8($,Z,Q,{})}async function GN8($,Z,Q,Y=vP){return await WN8($,Q,Y,{activityId:Z})}async function WN8($,Z,Q,Y){let X=await $.automations.findActiveBoardColumnTriggers();if(X.length===0)return 0;let J=new Map;for(let K of X){let H=K.automation.organization_id;J.set(H,[...J.get(H)??[],K])}let G=await $.taskBoard.listSettledTransitions({organizationIds:[...J.keys()],since:new Date(Z-X75),settledBefore:new Date(Z-Q),limit:J75,...Y}),W=0;for(let K of G)try{let H=(J.get(K.organizationId)??[]).filter((U)=>U.column_key===K.to&&Date.parse(U.created_at)<Date.parse(K.occurredAt));if(H.length===0)continue;let F=await G75($.taskBoard,K,Q);for(let U of H){if(!qd$(U,{from:F,to:K.to}))continue;if(!await $.automations.claimTriggerFire(U.id,K.activityId))continue;await $.fire({automationId:U.automation_id,organizationId:K.organizationId,triggerId:U.id,target:{kind:"card",itemId:K.itemId,columnKey:K.to,eventKey:K.activityId,movedBy:K.actorId}},{idempotencyKey:`board:${U.id}:${K.activityId}`}),W++}}catch(H){console.error(`[automations] board transition ${K.activityId} failed`,H)}return W}async function G75($,Z,Q){let X=(await $.listActivity(Z.itemId,Z.organizationId)).flatMap((J)=>{let G=J.data;if(J.action!=="status_changed"||typeof G?.to!=="string")return[];let W=typeof G.from==="string"?G.from:null;return W===G.to?[]:[{from:W,to:G.to,occurredAt:J.occurredAt}]});return X.length>0?Md$(X,Q):Z.from}var X75=1800000,J75=200;var KN8=L(()=>{cL()});import{DBOS as qz,DBOSClient as W75,SchedulerMode as K75}from"@dbos-inc/dbos-sdk";function HN8($){qO=$}async function U75($){if(!qO)return 0;try{return await GN8(qO,$,Date.now(),qO.settleMs)}catch(Z){return console.error(`[automations] settling board move ${$} failed`,Z),0}}async function N75(){if(!qO)return 0;try{return await JN8(qO,Date.now(),qO.settleMs)}catch($){return console.error("[automations] board transition sweep failed",$),0}}async function B75($){await qz.sleep((qO?.settleMs??vP)+F75),await qz.runStep(()=>U75($),{name:"settleBoardMove"})}async function D75($,Z){let Q=await qz.runStep(()=>N75(),{name:"sweepBoardMoves"});if(Q>0)console.log(`[automations] board transition sweep fired ${Q} trigger(s) the settle wait missed`)}async function UN8($){let Z=qO;if(!Z||!xP1)return;if(!await Z.automations.hasActiveBoardColumnTrigger($.taskBoardItemId,$.to))return;let Q=`board-settle:${$.activityId}`;if(!qz.isWithinWorkflow()){await qz.startWorkflow(xP1,{workflowID:Q,queueName:_z})($.activityId);return}let Y=await W75.create({systemDatabaseUrl:Z.systemDatabaseUrl,systemDatabaseSchemaName:"dbos",systemDatabasePoolSize:1});try{await Y.enqueue({workflowName:FN8,queueName:_z,workflowID:Q},$.activityId)}finally{await Y.destroy()}}function NN8(){if(bP1)return;xP1=qz.registerWorkflow(B75,{name:FN8}),bP1=qz.registerWorkflow(D75,{name:"boardTransitionSweepWorkflow"}),qz.registerScheduled(bP1,{name:"boardTransitionSweepWorkflow",crontab:H75,mode:K75.ExactlyOncePerIntervalWhenActive})}var H75="*/5 * * * *",F75=2000,qO=null,FN8="boardTransitionSettleWorkflow",xP1=null,bP1=null;var BN8=L(()=>{cL();KN8()});import{readdir as L75,rm as vx0}from"fs/promises";import{join as bx0}from"path";async function xx0($){let Z=new Date;Z.setUTCDate(Z.getUTCDate()-O75),Z.setUTCHours(0,0,0,0);let Q=0;try{let Y=await yh($);for(let X of Y)if(/^\d{4}$/.test(X))Q+=await DN8($,X,Z);else if(!X.startsWith(".")){let J=bx0($,X),G=await yh(J);for(let K of G){if(!/^\d{4}$/.test(K))continue;Q+=await DN8(J,K,Z)}if((await yh(J)).length===0)await vx0(J,{recursive:!0,force:!0})}}catch(Y){console.warn("monitoring retention cleanup failed:",Y)}return Q}async function DN8($,Z,Q){let Y=0,X=bx0($,Z),J=await yh(X);for(let W of J){if(!/^\d{2}$/.test(W))continue;let K=bx0(X,W),H=await yh(K);for(let U of H){if(!/^\d{2}$/.test(U))continue;let N=new Date(`${Z}-${W}-${U}T00:00:00Z`);if(isNaN(N.getTime()))continue;if(N<Q){let B=bx0(K,U);await vx0(B,{recursive:!0,force:!0}),Y++}}if((await yh(K)).length===0)await vx0(K,{recursive:!0,force:!0})}if((await yh(X)).length===0)await vx0(X,{recursive:!0,force:!0});return Y}async function yh($){try{return(await L75($)).filter((Q)=>!Q.startsWith("."))}catch{return[]}}var O75=30;var fP1=()=>{};import{DBOS as yP1,SchedulerMode as w75}from"@dbos-inc/dbos-sdk";async function E75(){let $=[YH(),ph(),kB()],Z=0;for(let Q of $)try{Z+=await xx0(Q)}catch(Y){console.error("[monitoring-retention] cleanup failed:",Y)}return console.log(`[monitoring-retention] deleted ${Z} day-dir(s) across ${$.length} signal dir(s)`),{deleted:Z,dirs:$.length}}async function P75($,Z){await yP1.runStep(()=>E75(),{name:"monitoringRetention"})}function ON8(){if(LN8)return;LN8=!0;let $=yP1.registerWorkflow(P75,{name:"monitoringRetentionWorkflow"});yP1.registerScheduled($,{name:"monitoringRetentionWorkflow",crontab:j75,mode:w75.ExactlyOncePerIntervalWhenActive})}var j75="23 4 * * *",LN8=!1;var wN8=L(()=>{PW();fP1()});function jN8($){return async(Z,Q)=>{let Y=await $.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.role","organization.id as orgId","organization.slug as orgSlug","organization.name as orgName"]).where("member.userId","=",Q).where("member.organizationId","=",Z).executeTakeFirst();if(!Y)return console.warn(`[automationContextFactory] User ${Q} not found in org ${Z} \u2014 returning null`),null;let X=await OY.create();X.auth.user={id:Q,role:Y.role},X.organization={id:Y.orgId,slug:Y.orgSlug,name:Y.orgName};let J=await RE($.db,Z,Y.role);return X.boundAuth=tO1({auth:X.authInstance,headers:new Headers,role:Y.role,permissions:J,userId:Q}),X.access=new zA(Q,void 0,X.boundAuth,Y.role,"self"),IP(X,{id:Y.orgId,slug:Y.orgSlug}),X}}var EN8=L(()=>{sX();EN()});function PN8(){return async($,Z)=>{let Q=Date.now(),Y=$.req.method,X=$.req.path;if(X==="/api/auth/get-session"||X.includes("favicon")){await Z();return}let J="",G=!1;if(X.startsWith("/mcp")&&Y==="POST"){G=!0;try{if($.req.header("Content-Type")?.includes("application/json")){let N=await $.req.raw.clone().json();if(N.method==="tools/call"&&N.params?.name){let B=AZ0(N.params.name),D=N.params.arguments||{},O=Object.keys(D).map((j)=>AZ0(j)),w=O.length>0?O.slice(0,3).join(",")+(O.length>3?"\u2026":""):"";J=`${N9.tool}${B}${N9.dim}(${w})${N9.reset}`}else if(N.method)J=`${N9.dim}${AZ0(N.method)}${N9.reset}`}}catch{}}let W=AZ0(X);if(X.startsWith("/mcp/conn_")){let F=X.split("/")[2]??"";W=`/mcp/${N9.mcp}${AZ0(F.slice(0,12))}\u2026${N9.reset}`}else if(X==="/mcp")W=`${N9.mcp}/mcp${N9.reset}`;else if(X==="/mcp/registry")W=`${N9.mcp}/mcp/registry${N9.reset}`;let K=A75(Y),H=G?"\u25C0":"\u2190";console.log(`${N9.dim}${H}${N9.reset} ${K}${Y}${N9.reset} ${W}${J?` ${J}`:""}`);try{await Z()}finally{let F=Date.now()-Q,U=$.res.status,N=z75(U),B=F<1000?`${F}ms`:`${(F/1000).toFixed(1)}s`,D=G?"\u25B6":"\u2192";console.log(`${N9.dim}${D}${N9.reset} ${K}${Y}${N9.reset} ${W}${J?` ${J}`:""} ${N}${U}${N9.reset} ${N9.duration}${B}${N9.reset}`)}}}var N9,z75=($)=>{if($>=500)return N9.serverError;if($>=400)return N9.clientError;if($>=300)return N9.redirect;return N9.ok},A75=($)=>{return N9[$]||N9.reset},AZ0=($)=>{return $.replace(/\r/g,"").replace(/\n/g,"").replace(/\x1b\[[0-9;]*m/g,"").replace(/[\x00-\x1f\x7f-\x9f]/g,"")};var zN8=L(()=>{N9={reset:"\x1B[0m",dim:"\x1B[2m",bold:"\x1B[1m",GET:"\x1B[36m",POST:"\x1B[33m",PUT:"\x1B[35m",DELETE:"\x1B[31m",ok:"\x1B[32m",redirect:"\x1B[36m",clientError:"\x1B[33m",serverError:"\x1B[31m",mcp:"\x1B[35m",tool:"\x1B[96m",duration:"\x1B[90m"}});import{createHmac as qN8}from"crypto";import{mkdir as T75,readdir as R75,rm as AN8,stat as MN8}from"fs/promises";import{join as hP1,relative as q75}from"path";import{z as Y8}from"zod";function VN8($){let Z=$.replace(/[^a-zA-Z0-9_-]/g,"_");return hP1(M75,Z)}function kN8($){return $.replace(/^\/+/,"").replace(/\.\./g,"")}function gP1($,Z){let Q=VN8($),Y=kN8(Z);return hP1(Q,Y)}function I75($,Z,Q,Y){let X=L0().encryptionKey||"dev-secret",J=`${$}:${Z}:${Q}:${Y}`;return qN8("sha256",X).update(J).digest("hex")}function RN8($,Z,Q,Y,X){let J=Math.floor(Date.now()/1000)+Y,G=I75(Z,Q,J,X),W=new URL(`/api/dev-assets/${Z}/${kN8(Q)}`,$);return W.searchParams.set("expires",J.toString()),W.searchParams.set("signature",G),W.searchParams.set("method",X),W.toString()}function SN8($,Z,Q){let Y=`${$}:${Z.getTime()}:${Q}`;return`"${qN8("md5","etag").update(Y).digest("hex")}"`}async function CN8($,Z,Q,Y,X){try{let J=await R75($,{withFileTypes:!0});for(let G of J){let W=hP1($,G.name),H=q75(Z,W).replace(/\\/g,"/");if(Q&&!H.startsWith(Q))continue;if(G.isDirectory())if(Y){let F=H+"/";if(!Q||F.startsWith(Q)){if(!(Q?H.slice(Q.length):H).includes("/"))X.commonPrefixes.add(F)}}else await CN8(W,Z,Q,Y,X);else if(G.isFile()){if(Y&&Q){let F=H.slice(Q.length);if(F.includes(Y)){let U=F.indexOf(Y),N=Q+F.slice(0,U+1);X.commonPrefixes.add(N);continue}}try{let F=await MN8(W);X.objects.push({key:H,size:F.size,lastModified:F.mtime.toISOString(),etag:SN8(W,F.mtime,F.size)})}catch{}}}}catch{}}function _N8($,Z){let Y=Y0($).id;return[{name:"LIST_OBJECTS",description:"List objects in the local assets directory with pagination support",inputSchema:Y8.object({prefix:Y8.string().optional(),maxKeys:Y8.number().optional().default(1000),continuationToken:Y8.string().optional(),delimiter:Y8.string().optional()}),outputSchema:Y8.object({objects:Y8.array(Y8.object({key:Y8.string(),size:Y8.number(),lastModified:Y8.string(),etag:Y8.string()})),nextContinuationToken:Y8.string().optional(),isTruncated:Y8.boolean(),commonPrefixes:Y8.array(Y8.string()).optional()}),handler:async(X)=>{let J=X,G=J.prefix||"",W=J.maxKeys??1000,K=J.delimiter,H=J.continuationToken,F=VN8(Y);await T75(F,{recursive:!0});let U={objects:[],commonPrefixes:new Set};await CN8(F,F,G,K,U),U.objects.sort((w,j)=>w.key.localeCompare(j.key));let N=0;if(H){if(N=U.objects.findIndex((w)=>w.key>H),N===-1)N=U.objects.length}let B=U.objects.slice(N,N+W),D=N+W<U.objects.length,O=D?B[B.length-1]?.key:void 0;return{objects:B,isTruncated:D,nextContinuationToken:O,commonPrefixes:Array.from(U.commonPrefixes).sort()}}},{name:"GET_OBJECT_METADATA",description:"Get metadata for a file in the local assets directory",inputSchema:Y8.object({key:Y8.string()}),outputSchema:Y8.object({contentType:Y8.string().optional(),contentLength:Y8.number(),lastModified:Y8.string(),etag:Y8.string(),metadata:Y8.record(Y8.string(),Y8.string()).optional()}),handler:async(X)=>{let J=X,G=gP1(Y,J.key),W=await MN8(G);return{contentType:tw1(J.key),contentLength:W.size,lastModified:W.mtime.toISOString(),etag:SN8(G,W.mtime,W.size)}}},{name:"GET_PRESIGNED_URL",description:"Generate a presigned URL for downloading a file from local storage",inputSchema:Y8.object({key:Y8.string(),expiresIn:Y8.number().optional()}),outputSchema:Y8.object({url:Y8.string(),expiresIn:Y8.number()}),handler:async(X)=>{let J=X,G=QO(J.expiresIn,TN8);return{url:RN8(Z,Y,J.key,G,"GET"),expiresIn:G}}},{name:"PUT_PRESIGNED_URL",description:"Generate a presigned URL for uploading a file to local storage",inputSchema:Y8.object({key:Y8.string(),expiresIn:Y8.number().optional(),contentType:Y8.string().optional()}),outputSchema:Y8.object({url:Y8.string(),expiresIn:Y8.number()}),handler:async(X)=>{let J=X,G=QO(J.expiresIn,TN8);return{url:RN8(Z,Y,J.key,G,"PUT"),expiresIn:G}}},{name:"DELETE_OBJECT",description:"Delete a single file from local storage",inputSchema:Y8.object({key:Y8.string()}),outputSchema:Y8.object({success:Y8.boolean(),key:Y8.string()}),handler:async(X)=>{let J=X,G=gP1(Y,J.key);try{return await AN8(G),{success:!0,key:J.key}}catch{return{success:!1,key:J.key}}}},{name:"DELETE_OBJECTS",description:"Delete multiple files from local storage",inputSchema:Y8.object({keys:Y8.array(Y8.string()).max(1000)}),outputSchema:Y8.object({deleted:Y8.array(Y8.string()),errors:Y8.array(Y8.object({key:Y8.string(),message:Y8.string()}))}),handler:async(X)=>{let J=X,G=[],W=[];return await Promise.all(J.keys.map(async(K)=>{let H=gP1(Y,K);try{await AN8(H),G.push(K)}catch(F){W.push({key:K,message:F instanceof Error?F.message:"Unknown error"})}})),{deleted:G,errors:W}}}]}async function uP1($,Z,Q){let Y=_N8(Z,Q),X=new Aj({name:"dev-assets-mcp",version:"1.0.0"},{capabilities:{tools:{}},jsonSchemaValidator:o9});for(let G of Y){let W="shape"in G.inputSchema?G.inputSchema.shape:Y8.object({}).shape,K=G.outputSchema&&"shape"in G.outputSchema?G.outputSchema.shape:Y8.object({}).shape;X.registerTool(G.name,{description:G.description??"",inputSchema:W,outputSchema:K,annotations:G.annotations,_meta:G._meta},async(H)=>{try{let F=await G.handler(H);return{content:[{type:"text",text:JSON.stringify(F)}],structuredContent:F}}catch(F){return{content:[{type:"text",text:`Error: ${F.message}`}],isError:!0}}})}let J=new QW({enableJsonResponse:$.headers.get("Accept")?.includes("application/json")??!1});return await X.connect(J),gK(X,J,$,"mcp:dev-assets")}async function vN8($,Z,Q,Y){let J=_N8(Q,Y).find((G)=>G.name===$);if(!J)return{content:[{type:"text",text:`Tool not found: ${$}`}],isError:!0};try{let G=await J.handler(Z);return{content:[{type:"text",text:JSON.stringify(G)}]}}catch(G){return{content:[{type:"text",text:G instanceof Error?G.message:String(G)}],isError:!0}}}var M75="./data/assets",TN8=3600,IN8,bN8;var xN8=L(()=>{r1();sp();W8();FW0();op();ZJ();YO();jb0();IN8=new Q1;IN8.all("/",async($)=>{let Z=$.get("studioContext"),Q=new URL($.req.url),Y=`${Q.protocol}//${Q.host}`;return uP1($.req.raw,Z,Y)});bN8=IN8});var fN8={};O6(fN8,{mountDevRoutes:()=>V75});function V75($,Z){$.all("/mcp/:connectionId{.*_dev-assets$}",Z,async(Y)=>{let X=Y.get("studioContext"),J=new URL(Y.req.url),G=`${J.protocol}//${J.host}`;return uP1(Y.req.raw,X,G)}),$.all("/mcp/:connectionId{.*_dev-assets$}/call-tool/:toolName",Z,async(Y)=>{let X=Y.get("studioContext"),J=new URL(Y.req.url),G=`${J.protocol}//${J.host}`,W=Y.req.param("toolName");if(!W)return Y.json({error:"Missing tool name"},400);let K=await Y.req.json(),H=await vN8(W,K,X,G);if(H.isError)return Y.json(H.content,500);return Y.json(H.content)}),$.use("/mcp/dev-assets",Z),$.route("/mcp/dev-assets",bN8);let Q=new Q1;Q.use("*",cF({mountPath:"/api/dev-assets"})),Q.route("/",wb0({orgFromPath:!1})),$.route("/api/dev-assets",Q)}var yN8=L(()=>{W8();lw1();jb0();xN8()});var nN8={};O6(nN8,{watchHandler:()=>pN8,resolveVoiceSigningSecret:()=>mN8,resolveCorsOrigin:()=>dN8,isSsoExemptPath:()=>cN8,isAllowedOAuthRedirectUri:()=>iN8,createApp:()=>h75});import{readFileSync as k75}from"fs";import{randomBytes as S75}from"crypto";import{PrometheusSerializer as C75}from"@opentelemetry/exporter-prometheus";import{DBOS as AB}from"@dbos-inc/dbos-sdk";import{oAuthDiscoveryMetadata as b75,oAuthProtectedResourceMetadata as x75}from"better-auth/plugins";async function _75($){let Z=$.connect(),Q;try{Q=await Promise.race([Z,hN8(gN8)])}catch{return Z.then((Y)=>Y.release(!0)).catch(()=>{}),!1}try{return await Promise.race([Q.query("SELECT 1"),hN8(gN8)]),Q.release(),!0}catch{return Q.release(!0),!1}}function hN8($){return new Promise((Z,Q)=>setTimeout(()=>Q(Error("pg health-check timeout")),$))}function cN8($){return $.startsWith("/api/org-sso/")||/^\/api\/[^/]+\/sso\//.test($)||$.startsWith("/api/auth/")||$.startsWith("/api/tools/management")||$.startsWith("/oauth-proxy/")||/^\/api\/[^/]+\/oauth-proxy\//.test($)||$.startsWith(`${Qb0}/`)||$.startsWith(`${sv0}/`)}function mN8($){let Z=$.studioJwtSecret||$.betterAuthSecret;if(Z)return Z;return console.warn("STUDIO_JWT_SECRET/BETTER_AUTH_SECRET not set - generating a random secret for voice sessions (not persistent across restarts)"),S75(32).toString("base64")}function dN8($,{baseUrl:Z,requestOrigin:Q}){let Y;try{Y=new URL($).hostname}catch{return null}if(Y==="localhost"||Y==="127.0.0.1")return $;let X=Z??Q;try{if(new URL(X).origin===$)return $}catch{}return null}function iN8($,Z){return $.origin===new URL(Z).origin||$.hostname==="localhost"}async function h75($={}){let Z=$.database??z8(),Q=!1;g6.stop().catch((H0)=>{console.error("[SSEHub] Error stopping previous broadcast (HMR cleanup):",H0)});let Y,X,J,G,W=new qP1,K,H,F,U=null;if($.disableNats)K=MP1(),Y={get:async()=>null,set:async()=>{},invalidate:async()=>{},teardown:()=>{}},X=null,J=null,G=new n60,H={start:async()=>{},broadcast:()=>{},stop:async()=>{}},F={init:async()=>{},pump:(H0)=>{return(async()=>{let J0=H0.getReader();try{while(!0){let{done:P0}=await J0.read();if(P0)break}}catch{}finally{J0.releaseLock()}})()},publishRawChunk:async()=>!1,publishDone:async()=>!1,createTailStream:async()=>null,purge:()=>{},teardown:()=>{}};else{U=lU8();let H0=L0().natsCredsPath,J0;if(H0)try{J0=k75(H0,"utf8")}catch(U8){console.error(`[app] failed to read NATS_CREDS at ${H0}; connecting anonymously`,U8)}U.init(L0().natsUrls,{creds:J0,user:L0().natsUser,password:L0().natsPassword});let P0=u61()?new R61({getJetStream:()=>U.getJetStream(),selfListVersion:Rx0.version}):null;P0?.init().catch(()=>{}),Y=P0;let z0=new F51({getJetStream:()=>U.getJetStream()});z0.init().catch(()=>{}),X=z0;let w1=new Og(Z31,{getJetStream:()=>U.getJetStream()}),b$=new Og(n40,{getJetStream:()=>U.getJetStream()});w1.init().catch(()=>{}),b$.init().catch(()=>{}),J={reads:w1,cards:b$};let o$=new RH1({getJetStream:()=>U.getJetStream()});o$.init().catch(()=>{}),G=o$,K=MP1({getConnection:()=>U.getConnection()}),H=new IP1({getConnection:()=>U.getConnection()}),F=new SP1({getConnection:()=>U.getConnection(),getJetStream:()=>U.getJetStream()}),DX8(U),U.onReady(()=>{P0?.init().catch((U8)=>{console.error("[McpListCache] Deferred init failed:",U8)}),z0.init().catch((U8)=>{console.error("[SkillCatalogCache] Deferred init failed:",U8)}),w1.init().catch((U8)=>{console.error("[PrReadCache] Deferred init failed:",U8)}),b$.init().catch((U8)=>{console.error("[PrCardCache] Deferred init failed:",U8)}),o$.init().catch((U8)=>{console.error("[ConnectionCircuitStore] Deferred init failed:",U8)}),K.start(),Oj$(()=>U.getConnection()),F.init().catch((U8)=>{console.warn("[Decopilot] StreamBuffer init failed (late-join disabled):",U8)})})}if(Mz)await Mz();q61(Y),N51(X),D51(()=>U?.getConnection()??null),Q31(J),qH1(G);let B={storage:new xl(Z.db),sseHub:g6,onThreadFinished:async(H0,J0)=>Mp(new t3(Z.db),H0,J0,new B3(Z.db))},D=new JW1(B),O=new z90(Z.db),w=new CP1(O);w.start(),vd$(H),H.start((H0)=>{pV0(H0),D.execute({type:"CANCEL",taskId:H0}).catch((J0)=>{console.error("[Decopilot] CancelBroadcast execute failed:",J0)})}).catch((H0)=>{console.error("[Decopilot] CancelBroadcast start failed:",H0)}),U?.onReady(()=>{H.start().catch((H0)=>{console.error("[CancelBroadcast] Deferred start failed:",H0)})});let j=()=>U?.getConnection()??null;xw1(j),U?.onReady(()=>xw1(j)),JF1(j),U?.onReady(()=>JF1(j)),F.init().catch((H0)=>{console.warn("[Decopilot] StreamBuffer init failed, attach/late-join disabled:",H0)}),Mz=async()=>{await D.stopAll(),D.dispose(),w.dispose(),H.stop().catch(()=>{}),CJ8(),F.teardown(),Y?.teardown(),X?.teardown(),J?.reads.teardown(),J?.cards.teardown(),W.teardown(),K.teardown(),wj$(),G.teardown(),q61(null),N51(null),D51(null),Q31(null),qH1(null)};let E=new Q1;if(E.use("*",zH1({enabled:(H0)=>Yt(H0,"debug")==="1"})),E.use("*",Yf0),E.use("/*",HX8({origin:(H0,J0)=>dN8(H0,{baseUrl:L0().baseUrl,requestOrigin:new URL(J0.req.url).origin}),credentials:!0,allowMethods:["GET","POST","PUT","DELETE","OPTIONS"],allowHeaders:["Content-Type","Authorization","mcp-protocol-version"],exposeHeaders:["WWW-Authenticate"]})),E.use("*",async(H0,J0)=>{if(await J0(),H0.req.path.includes("/files/"))return;if(H0.req.path.includes("/fs/")&&H0.req.path.endsWith("/read"))return;H0.header("X-Frame-Options","DENY"),H0.header("Content-Security-Policy","frame-ancestors 'none'")}),L0().nodeEnv==="development")E.use("*",PN8());E.use("*",async(H0,J0)=>{if(await J0(),ot(H0.req.path))return;if(H0.res.status>=500){let z0=await H0.res.clone().text();console.error(`[5xx Response] ${H0.req.method} ${H0.req.path} - ${H0.res.status}:`,z0)}}),E.get(bX.HEALTH,(H0)=>{if(Q)return H0.json({status:"shutting_down"},503);return H0.json({status:"ok"})}),E.get(bX.HEALTH_LIVE,(H0)=>{return H0.json({status:"ok"})}),E.get(bX.HEALTH_READY,async(H0)=>{if(Q)return H0.json({status:"shutting_down"},503);let J0={};if(J0.postgres={status:await _75(Z.pool)?"up":"down"},U)J0.nats=U.isConnected()?{status:"up"}:{status:"down"};else J0.nats={status:"down"};let P0=J0.postgres.status==="up",z0=P0?200:503;return H0.json({status:P0?"ready":"not_ready",services:J0},z0)}),E.get(bX.METRICS,async(H0)=>{try{let J0=await Wf0.collect(),P0=v75.serialize(J0.resourceMetrics);return H0.text(P0,200,{"Content-Type":"text/plain; version=0.0.4; charset=utf-8"})}catch(J0){return console.error("Failed to collect metrics:",J0),H0.text("# Error collecting metrics",500)}});let P=1800000;E.get(`${bX.DBOS_QUEUE_DEPTH_PREFIX}:queueName`,async(H0)=>{let J0=H0.req.param("queueName");if(!f75.has(J0))return H0.json({error:`Unknown queue: ${J0}`},404);let[P0,z0]=await Promise.all([AB.listQueuedWorkflows({queueName:J0,status:"ENQUEUED",loadInput:!1,loadOutput:!1}),AB.listQueuedWorkflows({queueName:J0,status:"PENDING",loadInput:!1,loadOutput:!1,dequeuedAfter:new Date(Date.now()-P).toISOString()})]);return H0.json({queue_length:P0.length,in_flight:z0.length})}),E.route("/api/config",rF8),E.route("/api/_reports",WU8),E.route("/api/_stripe",NP1),E.route("/api/_github",FU8({taskBoard:()=>i,contextFactory:()=>g})),E.route("/api/_git",Ut);let T={db:Z.db,encryptionKey:L0().encryptionKey};E.route("/api/_jira",zU8(T)),E.route("/api/_jira",DU8(T)),E.route("/report",XU8($.clientDir)),E.route("/api/auth/custom",bX8),E.all("/api/auth/admin/*",jJ8),E.all("/api/auth/*",async(H0)=>{return await B4.handler(H0.req.raw)});let z=yQ8();z.use("/.well-known/oauth-protected-resource/mcp/:connectionId",_90),z.use("/mcp/:connectionId/.well-known/oauth-protected-resource",_90),E.route("/",z),E.get("/.well-known/oauth-protected-resource/api/:org/mcp/:connectionId",j90),E.route("/",cQ8()),E.use("/oauth-proxy/:connectionId/*",_90),E.all("/oauth-proxy/:connectionId/*",uN8);let A=async(H0)=>{let P0=await y75()(H0.req.raw),z0=await P0.json();return Response.json(z0,P0)};E.use("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",_90),E.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",A);let q=async(H0)=>{let P0=await g75()(H0.req.raw),z0=await P0.json();return Response.json(z0,P0)};E.get("/.well-known/oauth-authorization-server/*/:gateway?/:connectionId?",q);let x=UX8({ttlMs:120000}),_=await fY8({db:Z.db,auth:B4,encryption:{key:L0().encryptionKey},observability:{tracer:vO,meter:J$},modelListCache:W,providerKeyCache:K,memberRoleCache:x});OY.set(_),hr1({db:Z.db,baseUrl:N5()}),yY8({db:Z.db}),lY8({db:Z.db}),oY8({db:Z.db}),jU8({db:Z.db,encryptionKey:L0().encryptionKey}),uh$({db:Z.db}),ZX8({db:Z.db}),wu$({db:Z.db});let V=Hj(Z.db),y=new _a(Z.db),g=jN8({db:Z.db});OK1({storage:V,studioContextFactory:g,orgContextFactory:(H0)=>o3(Z.db,H0),systemDatabaseUrl:ce(L0().databaseUrl,L0().databasePgSsl)}),eW1({systemDatabaseUrl:ce(L0().databaseUrl,L0().databasePgSsl),studioContextFactory:g,deps:{runRegistry:D,cancelBroadcast:H,streamBuffer:F,sseHub:g6}}),pW1({dispatchRunFn:cm$,studioContextFactory:g,deps:{runRegistry:D,cancelBroadcast:H,streamBuffer:F,sseHub:g6}});let h=new xl(Z.db),i=new t3(Z.db),n=new B3(Z.db),U0=new vP1(i,g,n);if(L0().taskBoardReviewSweeperEnabled){U0.start();let H0=Mz;Mz=async()=>{await H0?.(),U0.dispose()}}HN8({automations:V,taskBoard:i,fire:kK,systemDatabaseUrl:ce(L0().databaseUrl,L0().databasePgSsl),settleMs:L0().boardTransitionSettleSeconds*1000}),oh$(UN8),Hd$({getJetStream:()=>U?.getJetStream()??null,getJetStreamManager:async()=>{let H0=U?.getConnection();return H0?await lN8.jetstreamManager(H0):null},messageParts:h.messageParts(),resolveRun:async(H0)=>{let J0=await Z.db.selectFrom("threads").select(["organization_id","created_by","message_storage_version","status","run_fence_token","title"]).where("id","=",H0).executeTakeFirst();return J0?{orgId:J0.organization_id,createdBy:J0.created_by,version:J0.message_storage_version??1,status:J0.status,runFenceToken:J0.run_fence_token,title:J0.title??null}:null},completeRunIfNotCompleted:async(H0,J0)=>{let P0=await h.completeRunIfNotCompleted(H0,J0);if(_x0(g6,J0,H0,P0),P0)await Mp(i,H0,J0,n);return P0},markRunRequiresAction:async(H0,J0)=>{let P0=await h.requiresActionIfInProgress(H0,J0);return _x0(g6,J0,H0,P0),P0},markRunFailed:async(H0,J0,P0,z0)=>{let w1=await h.markRunFailed(H0,J0,P0,z0);if(_x0(g6,J0,H0,w1),w1)await Mp(i,H0,J0,n);return w1},clearSynthesizedError:async(H0,J0)=>{await h.messageParts().replaceMessageParts(H0,SP(H0,J0),[])},persistTitle:(H0,J0,P0)=>h.update(H0,J0,{title:P0}),onTitleUpdated:async({runId:H0,orgId:J0,title:P0})=>{let z0=await h.get(H0,J0).catch(()=>null);g6.emit(J0,NU(H0,z0?.status??"in_progress",{title:P0,virtualMcpId:z0?.virtual_mcp_id??void 0,createdBy:z0?.created_by,triggerId:z0?.trigger_id,branch:z0?.branch??null,harnessId:z0?.harness_id??void 0,createdAt:z0?.created_at,updatedAt:z0?.updated_at}))},bumpProgress:async({runId:H0,orgId:J0})=>{await h.bumpProgress(H0,J0)},recordCompleted:async({runId:H0,orgId:J0,distinctId:P0,usage:z0})=>{l1.capture({distinctId:P0,event:"chat_message_completed",groups:{organization:J0},properties:{organization_id:J0,thread_id:H0,transport:"projector",input_tokens:z0.inputTokens,output_tokens:z0.outputTokens,total_tokens:z0.totalTokens}})},recordFailed:async({runId:H0,orgId:J0,distinctId:P0,reason:z0,kind:w1})=>{l1.capture({distinctId:P0,event:"chat_message_failed",groups:{organization:J0},properties:{organization_id:J0,thread_id:H0,transport:"projector",error_category:w1,error_message:z0}})},purgeRun:async(H0)=>{F.purge(H0)}}),Um$({studioContextFactory:g,systemDatabaseUrl:ce(L0().databaseUrl,L0().databasePgSsl),streamBuffer:F}),ON8(),ur1(),hY8(),mY8(),rY8(),PU8(),NN8(),ih$(),YX8(),ju$(),NU8();let b0=async(H0,J0,P0)=>{let z0=await V.findById(H0,J0);if(!z0)throw Error("Automation not found");return zK1({automationId:z0.id,organizationId:z0.organization_id,triggerId:null})},G0=new Ht(V,({automation:H0,trigger:J0,contextMessages:P0,idempotencyKey:z0})=>kK({automationId:H0.id,organizationId:H0.organization_id,triggerId:J0.id,contextMessages:P0},{idempotencyKey:z0})),N0=[YH(),ph(),kB()];for(let H0 of N0)xx0(H0).then(()=>{}).catch((J0)=>console.error("[monitoring] Retention cleanup failed:",J0));let o=()=>B4.api.deleteAllExpiredApiKeys().catch((H0)=>console.error("[auth] Expired API key cleanup failed:",H0));o(),setInterval(o,86400000).unref(),E.use("*",async(H0,J0)=>{if(Zf0(H0.req.path))return J0();let P0={measure:async(w1,b$)=>{yK(H0,w1);try{return await b$()}finally{YW(H0,w1)}}},z0=await OY.create(H0.req.raw,{timings:P0});z0.automationRunner=b0,H0.set("studioContext",z0);try{await J0()}finally{let w1=z0.pendingRevalidations;if(w1.length>0)Promise.race([Promise.allSettled(w1),F$(30000)]).catch((o$)=>console.error("[studio] revalidation cleanup error:",o$))}}),E.use("/api/:org/decopilot/*",Jt),E.use("/api/:org/v1/*",Jt),E.use("/api/:org/files/*",Jt),E.use("*",async(H0,J0)=>{if(cN8(H0.req.path))return J0();let P0=H0.get("studioContext");if(!P0?.organization?.id||!P0?.auth?.user?.id)return J0();if(!(await P0.storage.orgSsoConfig.getByOrgId(P0.organization.id))?.enforced)return J0();if(!await P0.storage.orgSsoSessions.isValid(P0.auth.user.id,P0.organization.id))return H0.json({error:"SSO authentication required for this organization"},403);return J0()});let e=new Q1;e.use("*",cF({mountPath:"/api/org-sso"})),e.route("/",Jb0()),E.route("/api/org-sso",e),E.get("/api/tools/management",(H0)=>{return H0.json({tools:ya,grouped:EA()})}),E.use("/mcp/*",async(H0,J0)=>{yK(H0,"mcp");try{return await J0()}finally{YW(H0,"mcp")}});let Q0=async(H0,J0)=>{let P0=H0.var.studioContext;if(!P0.auth.user?.id&&!P0.auth.apiKey?.id){let z0=new URL(H0.req.url),w1=H0.req.header("x-forwarded-proto")?.split(",")[0]?.trim(),b$=w1?`${w1}://${z0.host}`:z0.origin;return H0.res=new Response(null,{status:401,headers:{"WWW-Authenticate":`Bearer realm="mcp",resource_metadata="${b$}${z0.pathname}/.well-known/oauth-protected-resource"`}})}return await J0()};if(E.use("/mcp/:connectionId?",Q0),E.use("/mcp/gateway/:virtualMcpId?",Q0),E.use("/mcp/virtual-mcp/:virtualMcpId?",Q0),E.use("/mcp/self",Q0),UK()){let{mountDevRoutes:H0}=(yN8(),mx0(fN8));H0(E,Q0)}let $0=new Q1;$0.use("*",cF({mountPath:"/mcp"})),$0.route("/",ck0()),E.route("/mcp",$0);let X0=new Q1;X0.use("*",cF({mountPath:"/mcp/self"})),X0.route("/",ob0()),E.route("/mcp/self",X0);let h0=new Q1;h0.use("*",cF({mountPath:"/mcp"})),h0.route("/",ik0()),E.route("/mcp",h0),E.use("/api/:org/models/*",async(H0,J0)=>{yK(H0,"llm_models");try{return await J0()}finally{YW(H0,"llm_models")}});let k0=yJ8({cancelBroadcast:H,streamBuffer:F,runRegistry:D});E.route("/api",k0),E.route("/api",qU8);let K1=new Q1;K1.use("*",cF({mountPath:"/api"})),K1.route("/",eb0()),E.route("/api",K1),E.route("/api",pF8);let c0=new Q1;c0.use("*",cF({mountPath:"/api"})),c0.route("/",$x0({tokenStorage:y,automationEventDispatcher:G0})),E.route("/api",c0);let w0=new va(Z.db),E0=new Q1;E0.use("*",cF({mountPath:"/api"})),E0.route("/",Ub0()),E.route("/api",E0),E.route("/api/deco-sites",aJ8()),E.route("/api/deco-apps",uF8());let n0=new Q1;n0.use("*",cF({mountPath:"/api/deco-sites"})),n0.route("/",Bb0()),E.route("/api/deco-sites",n0),E.route(Qb0,EJ8()),E.route(VK8,CK8()),E.route("/api/_editor-resolve",tF8()),E.route(yX8,gX8()),E.route(sv0,eX8());let O1=L0(),o0=O1.elevenlabsApiKey?new zx0({apiKey:O1.elevenlabsApiKey,model:O1.elevenlabsVoiceModel,conversationModel:O1.elevenlabsConversationModel,voiceId:O1.elevenlabsVoiceId}):null,v0={openai:O1.openaiLiveApiKey?new XP1({apiKey:O1.openaiLiveApiKey,voice:O1.openaiLiveVoice}):null,elevenlabs:o0?new YP1(o0,()=>U?.getConnection()??null):null},d0=new HP1({adapter:o0,conversationAdapters:v0,defaults:O1,secret:mN8(O1),getConnection:()=>U?.getConnection()??null}),i0=jF8({voiceSessions:d0,kvStorage:w0,runRegistry:D,streamBuffer:F,sseHub:g6,cancelBroadcast:H,tokenStorage:y,automationEventDispatcher:G0,mountDevAssets:UK(),mcpAuth:Q0,oauthProxyHandler:uN8,watchHandler:pN8,betterAuthProtectedResourceHandler:A,getNatsConnection:()=>U?.getConnection()??null});return E.route("/api/:org",i0),E.notFound((H0)=>{return H0.json({error:"Not Found",path:H0.req.path},404)}),E.onError(hJ8),Object.assign(E,{markShuttingDown:()=>{Q=!0},shutdown:async()=>{if(console.log("[shutdown] Stopping workers..."),await Promise.allSettled([g6.stop(),Mz?Promise.resolve(Mz()).finally(()=>{Mz=null}):Promise.resolve()]),U)await U.drain().catch((H0)=>console.error("[shutdown] NATS drain error:",H0));console.log("[shutdown] Flushing telemetry..."),await xJ().catch((H0)=>console.error("[shutdown] Telemetry flush error:",H0)),console.log("[shutdown] Closing database..."),await iJ$(Z).catch((H0)=>console.error("[shutdown] Database close error:",H0)),console.log("[shutdown] Cleanup complete.")},initDbos:async()=>{await AB.registerQueue(nG,{partitionQueue:!0,concurrency:BK1,minPollingIntervalMs:DK1}),await AB.registerQueue(jW,{partitionQueue:!0,concurrency:rW1,priorityEnabled:!0}),await AB.registerQueue(IB,{workerConcurrency:L0().decopilotMaxConcurrentHostedRuns,priorityEnabled:!0}),await AB.registerQueue(VB,{workerConcurrency:L0().sandboxMaxConcurrentHostedRuns,priorityEnabled:!0}),await AB.registerQueue(_O,{partitionQueue:!0,concurrency:Fm$}),await AB.registerQueue(Cz,Ou$),await AB.registerQueue(_z),await cw1(V),await Promise.allSettled(["automations-gate","automations-global","jira-push"].map((H0)=>AB.deleteQueue(H0))),await LK1(Z.pool),qK$().catch((H0)=>{console.error("[studio-pack-backfill] failed:",H0)}),Mm(Z.db).catch((H0)=>{console.error("[automations] built-in seed failed:",H0)}),lr1().catch((H0)=>{console.error("[org-fs] public-sets boot sync kick failed:",H0)})}})}var lN8,gN8=5000,Mz=null,uN8=async($)=>{let Z=$.req.param("connectionId");if(!Z)return $.json({error:"Missing connectionId"},400);let Q=$.req.path.split("/").filter(Boolean),Y=Q[Q.length-1],X=$.get("studioContext");if(!X)X=await OY.create($.req.raw),$.set("studioContext",X);let J=$.req.param("org")?X.organization?.id:void 0,G=await X.storage.connections.findById(Z,J);if(!G?.connection_url)return $.json({error:"Connection not found"},404);if(Y==="register"&&G.oauth_config?.clientId){let y=await $.req.json().catch(()=>({}));return $.json({...typeof y==="object"&&y!==null?y:{},client_id:G.oauth_config.clientId,...G.oauth_config.clientSecret?{client_secret:G.oauth_config.clientSecret}:{},client_secret_expires_at:0})}let W=await $t(G.connection_url),K,H=new URL(G.connection_url),U=(typeof G.metadata?.oauthResource==="string"&&G.metadata.oauthResource.length>0?G.metadata.oauthResource:void 0)??G.connection_url;if(W.ok)K=wO1(await W.json());if(!K)K=H.origin;let N=await E90(K);if(!N.ok)return $.json({error:"Failed to get auth server metadata"},502);let B=await N.json(),D;if(Y==="authorize")D=B.authorization_endpoint;else if(Y==="token")D=B.token_endpoint;else if(Y==="register")D=B.registration_endpoint;if(!D)return $.json({error:`Unknown OAuth endpoint: ${Y}`},404);let O=lQ8(D);if(O)return O;let w=new URL(D),j=new URL($.req.url);if(w.search=j.search,Y==="authorize"){let y=w.searchParams.get("redirect_uri");if(y){let g=L0().baseUrl??j.origin;try{if(!iN8(new URL(y),g))return $.json({error:"invalid_request",error_description:"redirect_uri is not allowed"},400)}catch{return $.json({error:"invalid_request",error_description:"redirect_uri is malformed"},400)}w.searchParams.set("redirect_uri",y)}if(w.searchParams.has("resource"))w.searchParams.set("resource",U);if(JX8(G.connection_url))w.searchParams.set("auto_personal","true"),w.searchParams.set("force_new","true");return $.redirect(w.toString(),302)}let E={Accept:$.req.header("Accept")||"application/json"},P=$.req.header("Content-Type");if(P)E["Content-Type"]=P;let T=$.req.header("Authorization");if(T)E.Authorization=T;let z,A=null,q=null;if($.req.method!=="GET"&&$.req.method!=="HEAD")if(Y==="token"&&P?.includes("application/x-www-form-urlencoded")){if(T?.toLowerCase().startsWith("basic "))try{let n=atob(T.slice(6).trim()),U0=n.indexOf(":");if(U0!==-1){let b0=decodeURIComponent(n.slice(0,U0)),G0=decodeURIComponent(n.slice(U0+1));A=b0||null,q=G0||null}}catch{}let y=await $.req.formData();if(y.has("resource"))y.set("resource",U);let g=y.get("client_id"),h=y.get("client_secret");if(typeof g==="string"&&g)A=g;if(typeof h==="string"&&h)q=h;let i=new URLSearchParams;for(let[n,U0]of y.entries())i.append(n,U0.toString());z=i.toString()}else if(Y==="register"&&P?.toLowerCase().includes("application/json")){let y=await X.db.selectFrom("organization").select(["id","slug","name"]).where("id","=",G.organization_id).executeTakeFirst(),g=await $.req.text(),h={};try{h=g?JSON.parse(g):{}}catch{z=g}let i=typeof h==="object"&&h!==null&&!Array.isArray(h);if(z===void 0&&!i)z=g;if(z===void 0){let n=h,U0=n.metadata&&typeof n.metadata==="object"?n.metadata:{};n.metadata={...U0,organization_id:G.organization_id,...y?.slug?{organization_slug:y.slug}:{},...y?.name?{organization_name:y.name}:{}},z=JSON.stringify(n),E["Content-Type"]="application/json"}}else z=$.req.raw.body??void 0;let x=await fetch(w.toString(),{method:$.req.method,headers:E,body:z,duplex:"half",redirect:"manual"}),_=new Headers,V=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];for(let[y,g]of x.headers.entries())if(!V.includes(y.toLowerCase()))_.set(y,g);if(Y==="token"&&x.ok){let y=await x.text();try{let g=JSON.parse(y);if(typeof g.access_token==="string"&&g.access_token){let h=typeof g.expires_in==="number"?new Date(Date.now()+g.expires_in*1000):null,i=null;try{i=await Bz(G.connection_url)??D}catch{i=D}let n={connectionId:Z,accessToken:g.access_token,refreshToken:typeof g.refresh_token==="string"?g.refresh_token:null,scope:typeof g.scope==="string"?g.scope:null,expiresAt:h,clientId:A,clientSecret:q,tokenEndpoint:i};await new s5(X.db,X.vault).upsert(n)}}catch(g){console.error("[oauth-proxy] failed to persist downstream token:",g)}return new Response(y,{status:x.status,statusText:x.statusText,headers:_})}return new Response(x.body,{status:x.status,statusText:x.statusText,headers:_})},pN8=async($)=>{let Z=$.var.studioContext,Q=Z.auth.user?.id??Z.auth.apiKey?.userId;if(!Q)return $.json({error:"Unauthorized"},401);let Y=Z.organization?.id;if(!Y)return $.json({error:"organization id missing"},400);let X=$.req.query("types"),J=X?X.split(",").map((H)=>H.trim()).filter(Boolean):null,G=$.req.query("scope")==="all";if(G&&(!iN(Y)||!await pN(Z)))return $.json({error:"forbidden"},403);let W=G?cI0:Y;if(G)fL({action:"watch_all_orgs",actorUserId:Q,actorOrgId:Y,targetOrgId:"all"});let K=crypto.randomUUID();return PO($,async(H)=>{if(await H.writeSSE({event:"connected",data:JSON.stringify({listenerId:K,organizationId:Y,typePatterns:J,connectedAt:new Date().toISOString()})}),!g6.add({id:K,organizationId:W,typePatterns:J?.length?J:null,push:(N,B)=>{H.writeSSE({id:N.id,event:N.type,data:JSON.stringify(G?{...N,organizationId:B}:N)}).catch(()=>{g6.remove(W,K)})}})){await H.writeSSE({event:"error",data:JSON.stringify({error:"Too many connections",message:"SSE connection limit reached. Try again later."})});return}let U=setInterval(()=>{H.writeSSE({event:"keepalive",data:""}).catch(()=>{clearInterval(U),g6.remove(W,K)})},30000);await new Promise((N)=>{H.onAbort(()=>{clearInterval(U),g6.remove(W,K),N()})})})},v75,f75,y75=()=>x75(B4),g75=()=>b75(B4);var tN8=L(()=>{r$();r1();cr1();uY8();dY8();aY8();$50();xG1();XX8();p40();w9();bd();R8();W8();pv0();FX8();AH1();LK();EN();Fw1();D3();v6();Q6();ww1();hX8();$J8();Aw1();PJ8();Cw1();hw1();uw1();NK();P90();lw1();uJ8();tv0();EF8();RF8();qF8();kF8();hF8();iw1();lF8();mk0();t60();nF8();pk0();AE1();oF8();PE1();aF8();JU8();KU8();HU8();UU8();BU8();LU8();AU8();TP1();sw1();MU8();zE1();OE1();yZ0();cU8();FP1();BJ();OU0();O$0();X31();F$0();N$0();IH1();mU8();iU8();fw1();aU8();xV0();eU8();Br();fa();xL();a5();_O1();XN8();BN8();XG();Dg();wN8();yK0();fP1();PW();mw1();bL();dW1();yK0();Qk0();Ca();Kr0();EN8();Fj();zN8();Vt();Fw1();Ep();yp();nV0();lN8=C(UH(),1);v75=new C75,f75=new Set([nG,jW,IB,VB,_O,Cz])});var aN8={};O6(aN8,{resolveClientDir:()=>p75,resolveAssetPathWithTraversalCheck:()=>rN8,isPathWithinDirectory:()=>sN8,createAssetHandler:()=>n75});import{resolve as TZ0,dirname as u75,join as l75,extname as c75,basename as m75,sep as oN8}from"path";function d75($,Z){if($===Z||m75($)==="index.html")return{"Cache-Control":"no-cache"};if($.includes(`${oN8}assets${oN8}`))return{"Cache-Control":"public, max-age=31536000, immutable"};return{}}function sN8($,Z){let Q=TZ0(Z),Y=TZ0($);return Y===Q||Y.startsWith(Q+"/")}function rN8({requestPath:$,clientDir:Z}){let Q=$.startsWith("/")?$.slice(1):$,Y=TZ0(Z,Q);if(!sN8(Y,Z))return null;return Y}function p75($,Z="../client"){let Q=new URL($),Y=u75(Q.pathname);return TZ0(Y,Z)}function n75($={}){let{env:Z="production",clientDir:Q=i75,isServerPath:Y=()=>!1}=$;if(Z==="development")return async function(J){return null};return async function(J){if(J.method!=="GET")return null;let G=new URL(J.url),W;try{W=decodeURIComponent(G.pathname)}catch{return null}if(Y(W))return null;let K=rN8({requestPath:W,clientDir:Q});if(!K)return null;let H=l75(K,"index.html"),F=TZ0(Q,"index.html"),U=J.headers.get("accept"),B=U?.includes("text/html")||U?.includes("*/*")&&["",".html"].includes(c75(K))?[H,F]:[];for(let D of[K,...B])try{let O=Bun.file(D);if(await O.exists())return new Response(O,{headers:d75(D,F)})}catch{}if(W.includes("/assets/"))return new Response("Not Found",{status:404,headers:{"Cache-Control":"no-store"}});return null}}var i75="./dist/client";var eN8=()=>{};var $B8={};O6($B8,{tryUpgradePreviewWs:()=>$Q5,tryHandlePreviewHttp:()=>e75,previewWebSocketHandler:()=>ZQ5,parsePreviewBaseDomain:()=>a75,isPreviewWsData:()=>fx0,extractHandleFromHost:()=>lP1});function s75($){if($.method!=="GET")return!1;return($.headers.get("accept")??"").includes("text/html")}function r75(){return new Response(o75,{status:503,headers:{"content-type":"text/html; charset=utf-8","cache-control":"no-store","retry-after":"1","access-control-allow-origin":"*"}})}function a75($){if(!$||$.trim()==="")return null;let Z=$.includes("{handle}")?$.replace("{handle}","__handle__"):$,Q;try{Q=new URL(Z)}catch{return null}let Y=Q.hostname;if($.includes("{handle}")){let X=Y.indexOf(".");if(X<=0||X===Y.length-1)return null;return Y.slice(X+1)}return Y}function lP1($,Z){if(!$||!Z)return null;let Q=$.indexOf(":"),Y=(Q>=0?$.slice(0,Q):$).toLowerCase(),J=`.${Z.toLowerCase().replace(/^\.+|\.+$/g,"")}`;if(!Y.endsWith(J))return null;let G=Y.slice(0,Y.length-J.length);if(!G||G.includes("."))return null;return G}async function e75($,Z){let Q=lP1($.headers.get("host"),Z.baseDomain);if(!Q)return null;let Y=await Z.getRunner();if(!Y)return qZ0(503,"preview proxy not configured");let X=await Y.proxyPreviewRequest(Q,$);if(X.headers.get(Ii)&&s75($))return r75();return X.headers.delete(Ii),X}function qZ0($,Z){return new Response(JSON.stringify({error:Z}),{status:$,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function fx0($){return typeof $==="object"&&$!==null&&$.kind==="preview"}async function $Q5($,Z,Q){if(($.headers.get("upgrade")??"").toLowerCase()!=="websocket")return null;let Y=lP1($.headers.get("host"),Q.baseDomain);if(!Y)return null;let X=await Q.getRunner();if(!X)return qZ0(503,"preview proxy not configured");let J=await X.resolvePreviewUpstreamUrl(Y);if(!J)return qZ0(404,"sandbox not found");let G=new URL($.url);if(G.pathname.startsWith("/_sandbox"))return qZ0(404,"not found");let W=`${J.replace(/^http/,"ws")}${G.pathname}${G.search}`,K=$.headers.get("sec-websocket-protocol"),H=K?K.split(",").map((N)=>N.trim()).filter(Boolean):[],F={kind:"preview",upstreamUrl:W,upstreamProtocols:H,pending:[],upstream:null,closed:!1};if(!Z.upgrade($,{data:F}))return qZ0(426,"upgrade failed");return}function RZ0($,Z,Q,Y){if(Z.closed)return;Z.closed=!0;try{$.close(Q,Y)}catch{}try{Z.upstream?.close()}catch{}}var t75=256,o75='<!DOCTYPE html><html><head><meta charset="utf-8"><title>Connecting\u2026</title><style>body{font-family:system-ui,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0;background:#fafafa;color:#555}div{text-align:center;max-width:420px;padding:24px}h3{margin:0 0 8px}p{margin:0;font-size:14px;color:#999;line-height:1.5}</style></head><body><div><h3>Connecting to sandbox\u2026</h3><p>Waiting for the sandbox to come online. This page refreshes automatically.</p></div><script>setTimeout(function(){window.location.reload()},1500)</script></body></html>',ZQ5;var ZB8=L(()=>{v80();ZQ5={open($){let Z=$.data;if(!fx0(Z))return;let Q;try{Q=Z.upstreamProtocols.length>0?new WebSocket(Z.upstreamUrl,Z.upstreamProtocols):new WebSocket(Z.upstreamUrl)}catch(Y){console.warn(`[preview-ws] failed to dial upstream ${Z.upstreamUrl}: ${Y instanceof Error?Y.message:String(Y)}`),RZ0($,Z,1011,"upstream connect failed");return}Q.binaryType="arraybuffer",Z.upstream=Q,Q.addEventListener("open",()=>{while(Z.pending.length>0){let Y=Z.pending.shift();if(Y!==void 0)Q.send(Y)}}),Q.addEventListener("message",(Y)=>{if(Z.closed)return;$.send(Y.data)}),Q.addEventListener("close",(Y)=>{RZ0($,Z,Y.code||1000,Y.reason||"")}),Q.addEventListener("error",()=>{RZ0($,Z,1011,"upstream error")})},message($,Z){let Q=$.data;if(!fx0(Q))return;let Y=Q.upstream;if(Y&&Y.readyState===WebSocket.OPEN){Y.send(Z);return}if(Q.pending.length>=t75){RZ0($,Q,1011,"preview ws backlog overflow");return}Q.pending.push(Z)},close($){let Z=$.data;if(!fx0(Z))return;RZ0($,Z,1000,"")}}});r$();var $z1="13";function Zz1($){return{name:"decocms",systemDatabaseUrl:$.systemDatabaseUrl,systemDatabaseSchemaName:"dbos",systemDatabasePoolSize:$.poolSize,runAdminServer:!1,executorID:$.executorID,applicationVersion:$z1,...$.listenQueues!==void 0?{listenQueues:$.listenQueues}:{}}}r$();import EB8 from"pg";var Qz1=8314027461559302n,PB8=600000,zB8=500;async function Yz1($,Z){let{databaseUrl:Q,lockTimeoutMs:Y=PB8}=$,X=$.log??((K)=>console.log(K)),J=new EB8.Client({connectionString:Q});await J.connect();let G=Date.now(),W=!1;try{while(!W){if(W=(await J.query("SELECT pg_try_advisory_lock($1) AS locked",[Qz1.toString()])).rows[0]?.locked===!0,W)break;if(Date.now()-G>=Y)throw Error(`Timed out after ${Y}ms waiting for the DBOS migration lock. Another process is still migrating the dbos schema; this pod will restart and retry.`);await F$(zB8)}let K=Date.now()-G;if(K>1000)X(`[dbos] waited ${K}ms for the migration lock; another process migrated first`);return await Z()}finally{if(W)try{await J.query("SELECT pg_advisory_unlock($1)",[Qz1.toString()])}catch{}await J.end().catch(()=>{})}}r1();nx0();v6();function ED8(){let $=(process.env.BUN_OPTIONS??"").split(/\s+/).filter(Boolean);return[...process.argv.slice(1),...$]}function Ff0($,Z){for(let Q=0;Q<$.length;Q++){let Y=$[Q];if(Y===void 0)continue;if(Y===Z)return $[Q+1];if(Y.startsWith(`${Z}=`))return Y.slice(Z.length+1)}return}function hz1(){let $=ED8();if($.includes("--cpu-prof")){console.log(JSON.stringify({msg:"cpu-profiling-active",dir:Ff0($,"--cpu-prof-dir")??process.cwd(),name:Ff0($,"--cpu-prof-name"),markdown:$.includes("--cpu-prof-md"),intervalUs:Number(Ff0($,"--cpu-prof-interval")??1000),note:"profile is written on process exit"}));return}if(process.env.CPU_PROFILE)console.warn(JSON.stringify({msg:"cpu-profiling-requested-but-inactive",hint:'CPU profiling is a Bun launch flag. Set BUN_OPTIONS="--cpu-prof --cpu-prof-md --cpu-prof-dir=/tmp" before starting the process.'}))}Bf0();var uZ0;function tz1(){if(process.env.HEAP_WATCH!=="1")return()=>{};let $=Number(process.env.HEAP_WATCH_INTERVAL_MS??60000),Z=async()=>{let Q=xz();if(!Q)return;let Y={};try{let{heapStats:X}=await import("bun:jsc"),J=X(),G=Object.entries(J.objectTypeCounts).sort((W,K)=>K[1]-W[1]).slice(0,20);Y={objectCount:J.objectCount,heapSize:J.heapSize,top:Object.fromEntries(G)}}catch{}console.log(JSON.stringify({msg:"heap-watch",ts:new Date().toISOString(),uptimeS:Math.round(process.uptime()),rss:Q.rss,heapUsed:Q.heapUsed,heapTotal:Q.heapTotal,external:Q.external,arrayBuffers:Q.arrayBuffers,...Y}))};return Z().catch(()=>{}),uZ0=setInterval(()=>void Z().catch(()=>{}),$),uZ0.unref?.(),process.on("SIGUSR2",()=>{try{let Q=Bun.generateHeapSnapshot("v8"),Y=typeof Q==="string"?Q:JSON.stringify(Q),X=`/tmp/heap-${process.pid}-${Date.now()}.heapsnapshot`;Bun.write(X,Y),console.log(JSON.stringify({msg:"heap-snapshot-written",path:X}))}catch(Q){console.error("[heap-watch] snapshot failed:",Q)}}),()=>{if(uZ0)clearInterval(uZ0)}}import*as AD8 from"bun:jsc";var{startSamplingProfiler:TD8,samplingProfilerStackTraces:RD8}=AD8;function oz1(){if(process.env.STALL_WATCHDOG!=="1")return()=>{};let $=Number(process.env.STALL_WATCHDOG_MS??100),Z=Number(process.env.STALL_WATCHDOG_TICK_MS??50);try{TD8()}catch(J){return console.error("[stall-watchdog] failed to start sampling profiler:",J),()=>{}}let Q,Y=performance.now()+Z,X=()=>{let J=performance.now(),G=J-Y;Y=J+Z;let W=[];try{W=RD8()?.traces??[]}catch{}if(G>$&&W.length>0){let K=new Map;for(let F of W){let U=F.frames.find((D)=>D.sourceURL&&!/Unknown Executable/.test(D.category??""))??F.frames[0];if(!U)continue;let N=(U.sourceURL??"?").replace(/^.*\/node_modules\//,"node_modules/"),B=`${U.name??"?"} @ ${N}:${U.line??"?"}`;K.set(B,(K.get(B)??0)+1)}let H=[...K.entries()].sort((F,U)=>U[1]-F[1]).slice(0,8).map(([F,U])=>({frame:F,count:U}));console.warn(JSON.stringify({msg:"stall-stack",ts:new Date().toISOString(),lagMs:Math.round(G),samplesInWindow:W.length,top:H}))}Q=setTimeout(X,Z),Q.unref?.()};return Q=setTimeout(X,Z),Q.unref?.(),()=>{if(Q)clearTimeout(Q)}}function sz1(){hz1();let $=[tz1(),nz1(),oz1()];return()=>{for(let Z of $)Z()}}import{existsSync as HQ5}from"fs";var OW=L0();fz1();var{DBOS:MZ0,DBOSClient:QQ5}=await import("@dbos-inc/dbos-sdk");function nP1($,Z){if(!Z)return $;let Q=new URL($);if(!Q.searchParams.has("sslmode"))Q.searchParams.set("sslmode","verify-full");return Q.toString()}var YQ5=[nG,jW,IB,VB,_O,Cz,_z],XQ5=OW.dispatchRole==="worker"?YQ5:OW.dispatchRole==="api"?[]:void 0;MZ0.setConfig(Zz1({systemDatabaseUrl:nP1(OW.databaseUrl,OW.databasePgSsl),poolSize:OW.dbosPoolSize,executorID:OW.podName,listenQueues:XQ5}));var{createApp:JQ5}=await Promise.resolve().then(() => (tN8(),nN8)),{isServerPath:GQ5}=await Promise.resolve().then(() => (yZ0(),Ez1)),{createAssetHandler:WQ5,resolveClientDir:GB8}=await Promise.resolve().then(() => (eN8(),aN8)),KQ5=OW.port,QB8=GB8(import.meta.url,"../client"),WB8=HQ5(QB8)?QB8:GB8(import.meta.url,"../dist/client"),FQ5=WQ5({clientDir:WB8,isServerPath:GQ5}),UQ5={"X-Frame-Options":"DENY","Content-Security-Policy":"frame-ancestors 'none'"};function NQ5($){let Z=new Headers($.headers);for(let[Q,Y]of Object.entries(UQ5))Z.set(Q,Y);return new Response($.body,{status:$.status,statusText:$.statusText,headers:Z})}var{parsePreviewBaseDomain:BQ5,tryHandlePreviewHttp:DQ5,tryUpgradePreviewWs:LQ5,previewWebSocketHandler:cP1,isPreviewWsData:mP1}=await Promise.resolve().then(() => (ZB8(),$B8)),{getOrInitSharedRunner:KB8}=await Promise.resolve().then(() => (OX(),GS$)),HB8=BQ5(process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN),YB8={baseDomain:HB8??"",getRunner:KB8};if(process.env.STUDIO_SANDBOX_TENANT_POOLS?.trim())KB8().catch(($)=>{console.warn("[lifecycle] eager sandbox provider init for tenant pools failed:",$ instanceof Error?$.message:String($))});var yx0=await JQ5({clientDir:WB8}),dP1=process.env.DBOS_CONDUCTOR_KEY?.trim(),XB8=process.env.DBOS_CONDUCTOR_URL?.trim();await Yz1({databaseUrl:nP1(OW.databaseUrl,OW.databasePgSsl)},()=>MZ0.launch({...dP1?{conductorKey:dP1}:{},...dP1&&XB8?{conductorURL:XB8}:{}}));console.log(`[dbos] application version: ${MZ0.applicationVersion}`);var iP1=5,pP1=0;await D8(async()=>{pP1++;try{return await yx0.initDbos()}catch($){let Z=pP1>=iP1?"giving up":"retrying";throw console.warn(`[dbos] initDbos attempt ${pP1}/${iP1} failed, ${Z}`,$),$}},{maxAttempts:iP1,minTimeout:1000,maxTimeout:1e4,jitter:0.5});var OQ5=Bun.serve({idleTimeout:0,port:KQ5,hostname:"0.0.0.0",fetch:async($,Z)=>{if(HB8){let Y=await LQ5($,Z,YB8);if(Y===void 0)return;if(Y)return Y;let X=await DQ5($,YB8);if(X)return X}let Q=await FQ5($);if(Q)return NQ5(Q);return yx0.fetch($,{server:Z})},websocket:{open($){if(mP1($.data))cP1.open($)},message($,Z){if(mP1($.data))cP1.message($,Z)},close($){if(mP1($.data))cP1.close($)}},development:!1}),wQ5=sz1();if(OW.localMode)Promise.resolve().then(() => (jg(),VV0)).then(async({seedLocalMode:$,markSeedComplete:Z,healLocalJwks:Q})=>{try{let Y=await Q();if(Y>0)console.log(`[local-mode] cleared ${Y} undecryptable JWKS key(s); Better Auth will generate a fresh one`);let X=await $()}catch(Y){console.error("Failed to seed local mode:",Y)}finally{Z()}}).catch(async($)=>{console.error("Failed to load local-mode module:",$);try{let{markSeedComplete:Z}=await Promise.resolve().then(() => (jg(),VV0));Z()}catch{}});var JB8=!1;async function jQ5($){let Z;try{Z=await QQ5.create({systemDatabaseUrl:nP1(OW.databaseUrl,OW.databasePgSsl),systemDatabaseSchemaName:"dbos"});let Q=await Z.listWorkflows({status:"PENDING",queueName:jW,executorId:$,loadInput:!1,loadOutput:!1});if(Q.length===0){console.log(`[shutdown] no in-flight thread-gate gates to hand off (executor ${$})`);return}let Y=Q.map((X)=>X.workflowID);await Z.resumeWorkflows(Y,{queueName:jW}),console.log(`[shutdown] re-enqueued ${Y.length} in-flight thread-gate gate(s) for re-adoption by a live executor (from ${$}):`,Y)}catch(Q){console.error("[shutdown] thread-gate handoff failed:",Q)}finally{await Z?.destroy().catch(()=>{})}}async function gx0($){if(JB8)return;JB8=!0,console.log(`
 [shutdown] Received ${$}, shutting down gracefully...`);let Z=Number(process.env.SHUTDOWN_GRACE_SECONDS??60)*1000,Q=Math.max(Z-5000,1e4),Y=setTimeout(()=>{console.error(`[shutdown] Timed out after ${Q}ms, forcing exit.`),process.exit(1)},Q);Y.unref?.();let X=0;try{wQ5(),yx0.markShuttingDown();let J=Xz1(OW.dispatchRole,Q,process.env.SHUTDOWN_DRAIN_MS);await F$(J),await OQ5.stop(!0);let G=MZ0.executorID;await MZ0.shutdown(),await jQ5(G),await yx0.shutdown()}catch(J){console.error("[shutdown] Error during shutdown:",J),X=1}clearTimeout(Y),process.exit(X)}process.on("SIGTERM",()=>gx0("SIGTERM"));process.on("SIGINT",()=>gx0("SIGINT"));process.on("SIGHUP",()=>gx0("SIGHUP"));process.on("unhandledRejection",($)=>{console.error("[process] Unhandled rejection:",$)});process.on("uncaughtException",($)=>{console.error("[process] Uncaught exception:",$),gx0("uncaughtException")});