decocms 4.500.3 → 4.500.4

package/dist/server/server.js

@@ -1159,7 +1159,7 @@ Caused by: ${Z.stack}`}};Fi=class Fi extends NX{constructor($,Z){super($,Z);this
 `).filter((Z)=>!/^Co-authored-by:\s/i.test(Z)).join(`
 `).trimEnd()}function is4($){let Z=$.userName.trim(),Q=$.userEmail?.trim();if(Q)return`Co-authored-by: ${Z} <${Q}>`;return`Co-authored-by: ${Z}`}function jQ1($,Z){let Q=qi(Z);if(!Q)return $;let Y=OI$($),X=is4(Q);if(Y.includes(X))return Y;let J=Y.trimEnd();return J.length>0?`${J}
 
-${X}`:X}var LI$,ds4;var EQ1=L(()=>{LI$=/[\r\n<>]/,ds4=/^[^\s@<>]+@[^\s@<>]+\.[^\s@<>]+$/});var Sq0=L(()=>{r$();EQ1()});function ps4($){if($ instanceof TypeError)return!0;if($ instanceof Error&&!($ instanceof DOMException)&&typeof $.code==="string")return!0;if($ instanceof DOMException&&$.name==="AbortError")return!0;return!1}async function PQ1($,Z,Q,Y){try{return await D8(async()=>{let J=await fetch($,{...Z,signal:AbortSignal.timeout(Y)});return{status:J.status,ok:J.ok,body:await J.text()}},{maxAttempts:3,minTimeout:50,maxTimeout:500,multiplier:2,jitter:0.5,isRetriable:ps4})}catch(X){let J=X instanceof Error?X.message:String(X);throw Error(`[SANDBOX_UNREACHABLE] sandbox daemon ${Q} request failed: ${J}`,{cause:X})}}async function Cq0($){try{let Z=await fetch(`${$}/health`,{signal:AbortSignal.timeout(ns4)});if(!Z.ok){try{await Z.text()}catch{}return null}let Q=await Z.json();if(typeof Q==="object"&&Q!==null&&typeof Q.bootId==="string"&&typeof Q.ready==="boolean"&&Q.setup&&typeof Q.setup.running==="boolean"&&typeof Q.setup.done==="boolean")return Q;return null}catch{return null}}async function AQ1($){for(let Z=0;Z<wI$;Z++){if(await Cq0($)!==null)return;let Q=(Math.random()*2-1)*ts4;await F$(jI$+Q)}throw Error(`sandbox daemon at ${$} did not respond on /health within ${wI$*jI$/1000}s`)}async function AK($,Z,Q,Y,X){return os4($,Z,"POST",Q,Y,X)}async function os4($,Z,Q,Y,X,J){let G={...Y};if(X&&X.rotateToken!==void 0)G.auth=X;let W=await PQ1(`${$}/_sandbox/config`,{method:Q,headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:JSON.stringify(G)},"/_sandbox/config",J?.timeoutMs??zQ1);if(!W.ok)throw new AJ(W.status,W.body);return PI$(W.body,"/_sandbox/config")}async function EI$($,Z,Q){let Y=await PQ1(`${$}/_sandbox/setup/${Q}`,{method:"POST",headers:{Authorization:`Bearer ${Z}`}},`/_sandbox/setup/${Q}`,zQ1);if(!Y.ok)throw Error(`sandbox daemon /_sandbox/setup/${Q} returned ${Y.status}: ${Y.body}`)}async function _80($,Z,Q){let Y=await PQ1(`${$}/_sandbox/orgfs-config`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:Q},"/_sandbox/orgfs-config",zQ1);if(!Y.ok)throw Error(`sandbox daemon /_sandbox/orgfs-config returned ${Y.status}: ${Y.body}`);return PI$(Y.body,"/_sandbox/orgfs-config")}function PI$($,Z){try{return JSON.parse($)}catch(Q){throw Error(`sandbox daemon ${Z} returned a malformed JSON body: ${$.slice(0,200)}`,{cause:Q})}}async function _q0($,Z,Q,Y){let X=new Headers(Y.headers);for(let W of ss4)X.delete(W);X.set("authorization",`Bearer ${Z}`);let J=Y.method!=="GET"&&Y.method!=="HEAD",G=`${$}${Q.startsWith("/")?Q:`/${Q}`}`;return fetch(G,{method:Y.method,headers:X,body:J?Y.body:void 0,redirect:"manual",signal:Y.signal,duplex:J?"half":void 0})}var AJ,ns4=500,zQ1=30000,wI$=25,jI$=200,ts4=50,ss4;var fy=L(()=>{Sq0();r$();AJ=class AJ extends Error{status;constructor($,Z){super(`sandbox daemon /_sandbox/config returned ${$}: ${Z}`);this.status=$;this.name="ConfigRequestError"}};ss4=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length"]});class vq0{counted=new Set;markCounted($){this.counted.add($)}consume($){return this.counted.delete($)}}class yy{map=new Map;async run($,Z){let Q=this.map.get($);if(Q)return Q;let Y=Z();this.map.set($,Y);try{return await Y}finally{this.map.delete($)}}}function bq0($,Z,Q){if(!$)return Q(null);if(!$.withLock)return Q($);return $.withLock(Z,Q)}function v80($){if(!$.orgId||!$.virtualMcpId||!$.branch)throw Error("composeSandboxRef: orgId, virtualMcpId and branch are all required for agent refs");return`agent:${$.orgId}:${$.virtualMcpId}:${$.branch}`}function zI$($){if(!$.startsWith("agent:"))return"";let Z=$.split(":");return Z.length>=4?Z.slice(3).join(":"):""}import{hash as rs4}from"crypto";function as4($,Z=16){return rs4("sha256",K2$($),"hex").slice(0,Z)}function m3($){let Z=as4($),Q=es4(zI$($.projectRef));return Q?`${Q}-${Z}`:`s-${Z}`}function es4($){if(!$)return"";let Z=$.split("/").pop()??"",Q="",Y=!1;for(let X of Z.toLowerCase()){let J=X.charCodeAt(0),G=J>=97&&J<=122,W=J>=48&&J<=57;if(!G&&!W){Y||=Q.length>0;continue}if(Y){if(Q.length+1>=AI$)break;Q+="-",Y=!1}if(Q+=X,Q.length===AI$)break}return Q}var AI$=24;var TI$=L(()=>{jZ1()});function xq0($,Z){let Q=$.replace(/\/+$/,"");if(Q.includes("{handle}"))return`${Q.replace("{handle}",Z)}/`;try{let Y=new URL(Q);return Y.hostname=`${Z}.${Y.hostname}`,`${Y.toString()}/`}catch{return`${Q}/${Z}/`}}function Mi($){let Z=$.repo,Q=Z?{repository:{cloneUrl:Z.cloneUrl,repoName:Z.displayName??$r4(Z.cloneUrl),...Z.branch?{branch:Z.branch}:{},submoduleCredentials:Z.submoduleCredentials??[]},repositories:($.extraRepos??[]).filter((K)=>!!K.directoryName).map((K)=>({cloneUrl:K.cloneUrl,repoName:K.directoryName,...K.branch?{branch:K.branch}:{},submoduleCredentials:K.submoduleCredentials??[]})),...Z.userName.trim()||Z.userEmail.trim()?{identity:{userName:Z.userName,userEmail:Z.userEmail}}:{}}:void 0,Y=$.tenant,X=qi({userName:Y?.userName,userEmail:Y?.userEmail})??void 0,J=$.packageManager?{name:$.packageManager.name,...$.packageManager.path?{path:$.packageManager.path}:{}}:void 0,G=J?{packageManager:J,runtime:$.runtime,...$.port!==void 0?{port:$.port}:{}}:void 0,W=Y?.orgId;if(!Q&&!G&&!X&&$.cloneOnly===void 0&&!W)return null;return{...Q?{git:Q}:{},...X?{operator:X}:{},...W?{orgId:W}:{},...$.cloneOnly!==void 0?{cloneOnly:$.cloneOnly}:{},...G?{application:G}:{}}}function $r4($){try{let Z=new URL($);return Z.pathname.replace(/^\/+/,"").replace(/\.git$/,"")||Z.hostname}catch{return $}}var RI$=L(()=>{EQ1()});function Zr4($){try{return new URL($).username.length>0}catch{return!1}}function b80($){let Z=$.repo?.cloneUrl;if(!Z||!Zr4(Z))return null;return{git:{repository:{cloneUrl:Z}}}}var Vi=L(()=>{TI$();RI$()});async function*VI$($){let Z=$.now??(()=>Date.now()),Q=Z(),Y=$.schedulingTimeoutMs??Yr4,X={pod:{},sandbox:{},events:{hasPulling:!1,hasPulled:!1},startedAt:Q},J=[],G=null,W=!1,K=(E)=>{if(W)return;if(G){let P=G;G=null,P(E)}else J.push(E)},H=()=>{if(J.length>0)return Promise.resolve(J.shift());if(W)return Promise.resolve(null);return new Promise((E)=>{G=E})},F=()=>{if(W)return;if(W=!0,G){let E=G;G=null,E(null)}},U=new AbortController,N=()=>{U.abort(),F()};if($.signal)if($.signal.aborted)U.abort(),F();else $.signal.addEventListener("abort",N,{once:!0});let B=Math.max(0,Y-(Z()-Q)),D=setTimeout(()=>K("tick"),B+100),O,w=new Promise((E)=>{O=E}),j=Promise.allSettled([Jr4($.kc,$.namespace,$.claimName,U.signal,X,K,Z,O),Wr4($.kc,$.namespace,$.claimName,U.signal,X,K),Kr4($.kc,$.namespace,$.claimName,w,U.signal,X,K,Z)]);try{let E=null,P=-1,T=qI$(X,Y,Z);if(E=RQ1(T),!TQ1(T))P=MI$(T);if(yield T,TQ1(T))return;while(!W){if(await H()===null)break;let A=qI$(X,Y,Z);if(TQ1(A)){let C=RQ1(A);if(C!==E)E=C,yield A;return}let q=MI$(A);if(q<P)continue;let x=RQ1(A);if(x!==E)E=x,P=q,yield A}}finally{if(clearTimeout(D),U.abort(),$.signal)$.signal.removeEventListener("abort",N);F(),await j.catch(()=>{})}}async function II$($,Z=Xr4){let Q=new AbortController,Y="claiming",X,J=()=>{clearTimeout(X),X=setTimeout(()=>Q.abort(),Z)};try{J();for await(let G of $(Q.signal)){if(G.kind==="ready")return;if(G.kind==="failed")throw new NX(G.message);Y=G.kind,J()}}finally{clearTimeout(X),Q.abort()}throw new Fi(`Sandbox did not become ready: no progress for ${Math.round(Z/1000)}s while ${Y}`)}function qI$($,Z,Q){let{pod:Y,sandbox:X,events:J,startedAt:G}=$;if(X.ready)return{kind:"ready"};let W=Y.containerWaitingReason;if(W==="ImagePullBackOff"||W==="ErrImagePull")return{kind:"failed",reason:"image-pull-backoff",message:"Sandbox image failed to download. The cluster may be missing pull credentials or the image tag may not exist."};if(W==="CrashLoopBackOff")return{kind:"failed",reason:"crash-loop-backoff",message:"Sandbox crashed during startup and is now in CrashLoopBackOff. Check pod logs."};if(!Y.scheduled&&J.lastFailedSchedulingAt!==void 0&&Q()-G>Z)return{kind:"failed",reason:"scheduling-timeout",message:J.failedSchedulingMessage??`Pod could not be scheduled within ${Math.round(Z/1000)}s.`};if(Y.containerRunning&&!Y.containerReady)return{kind:"warming-daemon",since:G};if(J.hasPulling&&!J.hasPulled)return{kind:"pulling-image",since:G};if(W==="ContainerCreating"||W==="PodInitializing"||Y.scheduled&&!Y.containerRunning)return{kind:"starting-container",since:G};if(Y.scheduledFalseReason==="Unschedulable"||J.lastFailedSchedulingAt!==void 0&&!Y.scheduled)return{kind:"waiting-for-capacity",since:G,message:J.failedSchedulingMessage??Y.scheduledFalseMessage,nodeClaim:J.nominatedNodeClaim};return{kind:"claiming",since:G}}function TQ1($){return $.kind==="ready"||$.kind==="failed"}function MI$($){switch($.kind){case"claiming":return 0;case"waiting-for-capacity":return 1;case"pulling-image":return 2;case"starting-container":return 3;case"warming-daemon":return 4;case"ready":case"failed":return 99}}function RQ1($){switch($.kind){case"claiming":case"pulling-image":case"starting-container":case"warming-daemon":return $.kind;case"waiting-for-capacity":return`waiting-for-capacity:${$.message??""}:${$.nodeClaim??""}`;case"ready":return"ready";case"failed":return`failed:${$.reason}:${$.message}`}}async function Jr4($,Z,Q,Y,X,J,G,W){let K=`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?watch=true&labelSelector=${encodeURIComponent(`${Qr4}=${Q}`)}`;return fq0({kc:$,path:K,signal:Y,label:`pod/${Q}`,onEvent:(H)=>{if(H.type!=="ADDED"&&H.type!=="MODIFIED")return;let F=H.object;if(F.metadata?.name)W(F.metadata.name);Gr4(F,X,G),J("pod")}})}function Gr4($,Z,Q){let X=($.status?.conditions??[]).find((G)=>G.type==="PodScheduled");if(X?.status==="True")Z.pod.scheduled=!0,Z.pod.scheduledFalseReason=void 0,Z.pod.scheduledFalseMessage=void 0;else if(X?.status==="False")Z.pod.scheduled=!1,Z.pod.scheduledFalseReason=X.reason,Z.pod.scheduledFalseMessage=X.message;let J=($.status?.containerStatuses??[]).find((G)=>G.name===Y7.MAIN_CONTAINER_NAME);if(J)Z.pod.containerWaitingReason=J.state?.waiting?.reason,Z.pod.containerRunning=!!J.state?.running,Z.pod.containerReady=J.ready===!0}async function Wr4($,Z,Q,Y,X,J){let G=`/apis/${Y7.CLAIM_API_GROUP}/${Y7.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(Z)}/${Y7.CLAIM_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${Q}`)}`;return fq0({kc:$,path:G,signal:Y,label:`sandboxclaim/${Q}`,onEvent:(W)=>{if(W.type!=="ADDED"&&W.type!=="MODIFIED")return;let H=W.object.status?.conditions?.find((F)=>F.type==="Ready");if(!H)return;if(H.status==="True")X.sandbox.ready=!0,X.sandbox.notReadyReason=void 0,X.sandbox.notReadyMessage=void 0;else X.sandbox.ready=!1,X.sandbox.notReadyReason=H.reason,X.sandbox.notReadyMessage=H.message;J("sandbox")}})}async function Kr4($,Z,Q,Y,X,J,G,W){let K=await Promise.race([Y,new Promise((F)=>{if(X.aborted){F(Q);return}X.addEventListener("abort",()=>F(Q),{once:!0})})]);if(X.aborted)return;let H=`/api/v1/namespaces/${encodeURIComponent(Z)}/events?watch=true&fieldSelector=${encodeURIComponent(`involvedObject.name=${K},involvedObject.kind=Pod`)}`;return fq0({kc:$,path:H,signal:X,label:`events/${Q}`,onEvent:(F)=>{if(F.type!=="ADDED"&&F.type!=="MODIFIED")return;let U=F.object,N=U.reason;if(!N)return;switch(N){case"Pulling":J.events.hasPulling=!0;break;case"Pulled":J.events.hasPulling=!0,J.events.hasPulled=!0;break;case"FailedScheduling":J.events.lastFailedSchedulingAt=W(),J.events.failedSchedulingMessage=U.message;break;case"Nominated":{let B=U.message?.match(/nodeclaim\/([\w-]+)/);if(B)J.events.nominatedNodeClaim=B[1];break}default:return}G("event")}})}async function kI$($){let{kc:Z,namespace:Q,labelSelector:Y,signal:X,onDelete:J}=$,G=`/apis/${Y7.CLAIM_API_GROUP}/${Y7.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(Q)}/${Y7.CLAIM_PLURAL}?watch=true&labelSelector=${encodeURIComponent(Y)}`;return fq0({kc:Z,path:G,signal:X,label:"sandboxclaim-reaper",onEvent:(W)=>{if(W.type!=="DELETED")return;let K=W.object.metadata?.name;if(K)J(K)}})}async function fq0($){let{kc:Z,path:Q,signal:Y,label:X,onEvent:J}=$,G=0;while(!Y.aborted){try{let K=await PK(Z,{method:"GET",path:Q,signal:Y,headers:{accept:"application/json"},stream:!0});if(!K.ok||!K.body){try{await K.body?.cancel()}catch{}if(K.status===401||K.status===403){console.warn(`[lifecycle-watcher] ${X} stopped: watch denied (${K.status} ${K.statusText}). `+"The kubeconfig in use cannot watch SandboxClaims \u2014 if you are running locally, "+"this provider should not be active (check STUDIO_AGENT_SANDBOX_ENABLED).");return}throw Error(`watch handshake failed: ${K.status} ${K.statusText}`)}G=0;for await(let H of u2$(K.body)){if(Y.aborted)return;try{J(H)}catch(F){console.warn(`[lifecycle-watcher] ${X} onEvent threw: ${F instanceof Error?F.message:String(F)}`)}}}catch(K){if(Y.aborted)return;let H=K instanceof Error?K.message:String(K);console.warn(`[lifecycle-watcher] ${X} watch ended: ${H}`)}if(Y.aborted)return;let W=V7(5000,250,G,2,0);G+=1,await F$(W,{signal:Y}).catch(()=>{})}}var Qr4="studio.decocms.com/sandbox-handle",Yr4=300000,Xr4=600000;var SI$=L(()=>{r$();F80();BN0()});import{createHash as Hr4}from"crypto";import{z as TJ}from"zod";function TK($){let Z;try{Z=new URL($.trim())}catch{return null}if(Z.protocol!=="https:"||Z.search||Z.hash)return null;let Q=Z.pathname.replace(/\/+$/,"").replace(/\.git$/,"").replace(/\/+$/,"");return Q?`https://${Z.host.toLowerCase()}${Q}`:null}function x80($){return TK($)?.toLowerCase()??null}function Dr4($){let Z=new Set;for(let Q of $){let Y=`${x80(Q.repoUrl)??Q.repoUrl}#${Q.branch}`;if(Z.has(Y))return Q;Z.add(Y)}return null}function CI$($){return $.reduce((Z,Q)=>Z+Q.replicas,0)}function vI$($,Z){if(Z.warmPoolName)return Z.warmPoolName;let Q=Hr4("sha256").update(`${Z.repoUrl}#${Z.branch}`).digest("hex").slice(0,8);return`${$}-${Q}`}function bI$($){return Math.max(0,$.size-CI$($.repos))}function Ii($){return $.flatMap((Z)=>Z.repos.map((Q)=>({pool:Z,repo:Q,warmPoolName:vI$(Z.name,Q)})))}function Lr4($,Z){return gI$(void 0,$,!0,Z)}function xI$($,{templateName:Z}){let Q=Lr4(Z,$.image),Y=(X,J)=>({apiVersion:`${Y7.CLAIM_API_GROUP}/${Y7.CLAIM_API_VERSION}`,kind:"SandboxWarmPool",metadata:{name:X,labels:{[Or4]:$.name}},spec:{replicas:J,updateStrategy:{type:"OnReplenish"},sandboxTemplateRef:{name:Q}}});return[...$.repos.map((X)=>Y(vI$($.name,X),X.replicas)),Y($.name,bI$($))]}function fI$($){return $.tenant?.orgId}function MQ1($,Z){if(!Z.tenant)return null;let Q=$.filter((J)=>J.tenant===Z.tenant&&J.image===Z.image),Y=Z.cloneUrl?x80(Z.cloneUrl):null;if(Y){let J=Ii(Q).filter((W)=>x80(W.repo.repoUrl)===Y),G=J.find((W)=>W.repo.branch===Z.branch)??J[0];if(G)return G}let X=Q.find((J)=>bI$(J)>0);return X?{pool:X,repo:null,warmPoolName:X.name}:null}function yI$($,Z,Q){return $?.warmPoolName??(Z?Q:"none")}function gI$($,Z,Q=!1,Y){let X=Y&&Y!=="default"?`-${Y}`:"";return`${Z}${X}${$==="harness-run"||Q?"-medium":""}`}async function VQ1($){let Z=gI$($.purpose,$.templateName,$.tenantPool,$.sandboxImage);if(Z===$.templateName)return{name:Z,probes:$.probes};let Q=$.probes[Z]??null,Y=Q!==null&&$.now-Q.checkedAt<$.ttlMs?Q:{checkedAt:$.now,present:await $.exists(Z)},X={...$.probes,[Z]:Y};if(Y.present)return{name:Z,probes:X};if(Q?.present!==!1)$.onAbsent?.(Z);if($.sandboxImage&&$.sandboxImage!=="default")return VQ1({...$,sandboxImage:void 0,probes:X});return{name:$.templateName,probes:X}}function IQ1($,Z,Q){let Y=x80(Z);if(!Y)return[];let X=Q.replace(/^refs\/heads\//,"");return Ii($).filter(({repo:J})=>x80(J.repoUrl)===Y&&J.branch===X)}class kQ1{source;dirty=new Set;pods=new Map;known=new Map;constructor($){this.source=$}pools(){return this.source()}resolve($){return MQ1(this.pools(),$)}markDirty($,Z){let Q=IQ1(this.pools(),$,Z).map((Y)=>Y.warmPoolName);for(let Y of Q)this.dirty.add(Y);return Q}takeDirty($){return this.dirty.delete($)}pod($){return this.pods.get($)}setPod($,Z){this.pods.set($,Z)}retainPods($,Z){for(let[Q,Y]of this.pods)if(Y.pool===$&&!Z.has(Q))this.pods.delete(Q)}retain($){let Z=new Map($.map((Y)=>[Y.warmPoolName,Y])),Q=[...this.known.values()].filter((Y)=>!Z.has(Y.warmPoolName));for(let Y of this.dirty)if(!Z.has(Y))this.dirty.delete(Y);for(let[Y,X]of this.pods)if(!Z.has(X.pool))this.pods.delete(Y);return this.known=Z,Q}}var Fr4=54,Ur4,Nr4=2048,Br4,f80,yq0,qQ1,_I$,Or4="studio.decocms.com/tenant-pool";var y80=L(()=>{t4();F80();Ur4=/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/;Br4=TJ.object({runtime:TJ.enum(["node","bun","deno"]).default("node"),packageManager:TJ.enum(["npm","pnpm","yarn","bun","deno"]).optional(),packageManagerPath:TJ.string().optional(),devPort:TJ.number().int().positive().optional()}).default({runtime:"node"}),f80=TJ.object({repoUrl:TJ.string().max(Nr4).transform(($,Z)=>{let Q=TK($);if(Q)return Q;return Z.addIssue({code:"custom",message:"repoUrl must be an https clone URL"}),TJ.NEVER}),branch:TJ.string().min(1).default("main"),workload:Br4,replicas:TJ.number().int().min(1)});yq0=class yq0 extends Error{poolName;size;allocated;constructor($,Z,Q){super(`pool ${$}: repos take ${Q} replicas, more than its size ${Z}`);this.poolName=$;this.size=Z;this.allocated=Q;this.name="TenantPoolCapacityError"}};qQ1=TJ.object({name:TJ.string().max(Fr4).regex(Ur4,"pool name must be a DNS label (lowercase alphanumeric and '-')"),tenant:TJ.string().min(1).max(512),size:TJ.number().int().min(1),image:UN.default("default")}),_I$=qQ1.extend({repos:TJ.array(f80).default([])}).superRefine(($,Z)=>{let Q=Dr4($.repos);if(Q)Z.addIssue({code:"custom",path:["repos"],message:`duplicate repo allocation ${Q.repoUrl}#${Q.branch}`});let Y=CI$($.repos);if(Y>$.size)Z.addIssue({code:"custom",path:["repos"],message:new yq0($.name,$.size,Y).message})})});async function hI$($,Z,Q){let Y=new Map;for(let X of $){let J=Z(X);if(!J)continue;let G=Y.get(J);if(G)G.push(X);else Y.set(J,[X])}await Promise.allSettled([...Y.values()].map(async(X)=>{for(let J of X)await Q(J).catch(()=>{})}))}function wr4($){try{let Z=new URL($);if(Z.hostname.toLowerCase()!=="github.com")return null;let[Q,Y]=Z.pathname.replace(/^\/+/,"").split("/"),X=Y?.replace(/\.git$/,"");return Q&&X?`${Q}/${X}`.toLowerCase():null}catch{return null}}function uI$($){if($.repositoryId)return{repositoryId:$.repositoryId};let Z=$.connectionId?wr4($.cloneUrl):null;return $.connectionId&&Z?{connectionId:$.connectionId,repo:Z}:null}var lI$=L(()=>{y80()});async function ki($,Z,Q,Y){let X=(G)=>_q0(G.url,G.token,Z,Q),J=!(Q.body instanceof ReadableStream);try{let G=await X($);if(G.status!==401||!J)return G;let W=await Y.unauthorized();if(!W)return G;return await G.body?.cancel().catch(()=>{}),await X(W)}catch(G){if(!J)throw G;let W=await Y.unreachable();if(!W)throw G;return X(W)}}var gq0=L(()=>{fy()});function dI$($,Z){return new Response(JSON.stringify(Z),{status:$,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function cI$($){let Z=new Headers;for(let[Q,Y]of $.headers.entries())if(!Er4.includes(Q.toLowerCase()))Z.set(Q,Y);return new Response($.body,{status:$.status,statusText:$.statusText,headers:Z})}function mI$($,Z){let Q=dI$($,{error:Z});return Q.headers.set("x-sandbox-preview-not-ready","1"),Q}async function Ci($,Z,Q){let Y=await Z.base();if(!Y)return mI$(404,"sandbox not found");let X=new URL($.url);if((X.pathname==="/_sandbox"||X.pathname.startsWith("/_sandbox/"))&&$.method!=="GET")return dI$(404,{error:"not found"});let G=(F)=>`${F}${X.pathname}${X.search}`,W=new Headers($.headers);for(let F of jr4)W.delete(F);let K=$.method!=="GET"&&$.method!=="HEAD",H={method:$.method,headers:W,body:K?$.body:void 0,redirect:"manual",signal:$.signal,duplex:K?"half":void 0};try{return cI$(await fetch(G(Y),H))}catch(F){let U=`${Y}${X.pathname}`;if(console.warn(`[${Q}] preview fetch to ${U} failed: ${F instanceof Error?F.message:String(F)}`),Z.invalidate(),$.method==="GET"||$.method==="HEAD"){let N=await Z.retryBase();if(N)try{return cI$(await fetch(G(N),H))}catch(B){console.warn(`[${Q}] preview fetch retry to ${U} failed: ${B instanceof Error?B.message:String(B)}`)}}return mI$(502,"sandbox daemon unreachable")}}var Si="x-sandbox-preview-not-ready",jr4,Er4;var hq0=L(()=>{jr4=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length","upgrade"],Er4=["connection","keep-alive","transfer-encoding","content-encoding","content-length"]});import{createHash as Pr4,randomBytes as zr4,randomUUID as iI$}from"crypto";import*as aI$ from"net";import{PassThrough as Ar4}from"stream";function pI$($){if($ instanceof Error)return $.message;if($&&typeof $==="object"){let Z=$;if(Z.error instanceof Error)return Z.error.message;if(typeof Z.message==="string"&&Z.message)return Z.message}return String($)}function oI$($){return{pool:$.warmPoolName,org:$.pool.tenant}}class fQ1{records=new Map;inflight=new yy;activeGauge=new vq0;stateStore;previewUrlPattern;kubeConfig;capacityProbe;portForward;namespace;sandboxTemplateName;envName;tokenGenerator;idleTtlMs;metrics;previewGateway;sentinelToken;mintCloneUrl;mintPoolCloneUrl;mintOrgFsConfig;forwardPort;daemonAddress;persistCredentials;tenantPools;tenantPoolRefreshMs;templateProbes={};closed=!1;claimWatchAbort=new AbortController;constructor($={}){this.stateStore=$.stateStore??null,this.previewUrlPattern=$.previewUrlPattern??null,this.kubeConfig=$.kubeConfig??xr4(),this.portForward=new QQ1(this.kubeConfig),this.namespace=$.namespace??Tr4,this.sandboxTemplateName=$.sandboxTemplateName??Rr4,this.envName=ur4($.envName),this.tokenGenerator=$.tokenGenerator??(()=>zr4(Mr4).toString("hex")),this.idleTtlMs=$.idleTtlMs??Ir4,this.metrics=$.meter?br4($.meter):null,this.previewGateway=$.previewGateway&&$.previewUrlPattern?{...$.previewGateway}:null;let Z=$.sentinelToken?.trim()??"";this.sentinelToken=Z.length>0?Z:null,this.mintCloneUrl=$.mintCloneUrl,this.mintPoolCloneUrl=$.mintPoolCloneUrl,this.mintOrgFsConfig=$.mintOrgFsConfig,this.forwardPort=$.forwardPort,this.daemonAddress=$.daemonAddress??"forward",this.persistCredentials=$.persistCredentials??!0;let Q=$.tenantPools;if(this.tenantPools=this.sentinelToken===null?null:new kQ1(typeof Q==="function"?Q:()=>Q??[]),this.sentinelToken===null&&(typeof Q==="function"||(Q?.length??0)>0))console.warn(`[${V6}] tenant pools configured without a sentinel token \u2014 ignoring them (warm-pool mode is off)`);this.tenantPoolRefreshMs=$.tenantPoolRefreshMs??Sr4,this.startClaimReaper(),this.startCredentialRefresher(),this.startTenantPoolReconciler()}startClaimReaper(){let $=["app.kubernetes.io/managed-by=studio","app.kubernetes.io/name=studio-sandbox",...this.envName?[`${RJ.env}=${this.envName}`]:[]].join(",");kI$({kc:this.kubeConfig,namespace:this.namespace,labelSelector:$,signal:this.claimWatchAbort.signal,onDelete:(Z)=>this.invalidateRecord(Z)})}async ensure($,Z={}){let Q=m3($);if(Q.startsWith("s-"))throw Error(`ensure: projectRef has no slug source: ${$.projectRef}`);return this.inflight.run(Q,()=>bq0(this.stateStore,$,(Y)=>this.ensureLocked($,Q,Z,Y)))}async delete($){let Z=await this.getRecord($);if(this.records.delete($),Z)this.dropRecord(Z);if(await this.deleteHttpRouteIfManaged($).catch((Q)=>{console.warn(`[${V6}] HTTPRoute delete failed for ${$}: ${Q instanceof Error?Q.message:String(Q)}`)}),await KR(this.kubeConfig,this.namespace,$),this.stateStore)if(Z)await this.stateStore.delete(Z.id);else await this.stateStore.deleteByHandle($)}lastTermination($){return C2$(this.kubeConfig,this.namespace,RJ.sandboxHandle,$,Y7.MAIN_CONTAINER_NAME)}async alive($){return await wL(this.kubeConfig,this.namespace,$)!==void 0}watchClaimLifecycle($,Z){return VI$({kc:this.kubeConfig,namespace:this.namespace,claimName:$,signal:Z})}hasSchedulableCapacity(){return this.capacityProbe??=c2$(this.kubeConfig,this.namespace),this.capacityProbe()}async getPreviewUrl($){let Z=await this.getRecord($);if(!Z)return null;return this.composePreviewUrl(Z)}async proxyDaemonRequest($,Z,Q){let Y=await this.getRecord($);if(!Y&&this.previewUrlPattern&&this.stateStore){let K=await this.stateStore.getByHandle($),H=K?.state,F=H?.token;if(K&&F){let N=`http://${H?.adoptedSandboxName??$}.${this.namespace}.svc.cluster.local:${bN}`;try{let B=await _q0(N,F,Z,Q);if(B.status!==404)return B;try{await B.body?.cancel()}catch{}}catch{}}}if(!Y)Y=await this.resurrectByHandle($);if(!Y)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let X=Y,J=performance.now(),G=0,W=(K)=>{return X=K,{url:K.daemonUrl,token:K.token}};try{let K=await ki(W(Y),Z,Q,{unauthorized:async()=>{this.invalidateRecord($);let H=await this.getRecord($).catch(()=>null)??await this.resurrectByHandle($).catch(()=>null);return H?W(H):null},unreachable:async()=>{this.invalidateRecord($);let H=await this.resurrectByHandle($)??await this.getRecord($).catch(()=>null);return H?W(H):null}});return G=K.status,K}finally{this.recordProxyDuration("daemon",G,X,performance.now()-J)}}async adoptLiveClaim($,Z){if(this.records.has(Z))return!0;let Q=await wL(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!Q||Q.metadata?.deletionTimestamp)return!1;return await this.inflight.run(Z,async()=>{let X=this.records.get(Z);if(X)return this.toSandbox(X);let J=await this.adopt($,Z,Q);if(!J)throw Error(`cannot adopt live claim ${Z}`);return bq0(this.stateStore,$,(G)=>this.finish(J,G,!0,!0,"adopt"))}).catch(()=>null)!=null}async resolvePreviewUpstreamUrl($){if(this.previewUrlPattern)return`http://${await this.resolveServiceNameForHandle($)}.${this.namespace}.svc.cluster.local:${bN}`;let Z=await this.getRecord($);if(Z)return Z.daemonUrl;let Q=await this.resurrectByHandle($);return Q?Q.daemonUrl:null}async daemonEndpoint($){let Z=await this.getRecord($)??await this.resurrectByHandle($);if(!Z)return null;return{url:this.daemonAddress==="service"?`http://${Z.adoptedSandboxName}.${this.namespace}.svc.cluster.local:${bN}`:Z.daemonUrl,token:Z.token}}listSandboxes(){return[...this.records.values()].map(($)=>{let Z=$.ensureOpts,Q=Z?.tenant;return{handle:$.handle,tenant:Q?{orgId:Q.orgId,userId:Q.userId}:null,repos:[Z?.repo,...Z?.extraRepos??[]].filter((Y)=>Y!==void 0).map(uI$).filter((Y)=>Y!==null),orgFs:Boolean(Z?.orgFsConfigJson)||$.orgFsRedacted===!0}})}async resolveServiceNameForHandle($){let Z=this.records.get($);if(Z)return Z.adoptedSandboxName;if(this.stateStore){let Y=(await this.stateStore.getByHandle($).catch(()=>null))?.state?.adoptedSandboxName;if(Y)return Y}return $}async proxyPreviewRequest($,Z){let Q=performance.now(),Y=this.records.get($)??null,X=0;try{let J=await Ci(Z,{base:()=>this.resolvePreviewUpstreamUrl($),invalidate:()=>this.invalidateRecord($),retryBase:async()=>{return await this.resurrectByHandle($).catch(()=>null)?this.resolvePreviewUpstreamUrl($):null}},V6);return X=J.status,J}finally{this.recordProxyDuration("preview",X,Y,performance.now()-Q,$)}}async ensureLocked($,Z,Q,Y){if(Q.image)console.warn(`[${V6}] opts.image ignored (template ${this.sandboxTemplateName} pins image): got ${Q.image}`);if(Y){let G=await Y.get($);if(G){let W=await this.rehydrate($,Z,G);if(W)return await this.refreshDaemonGitCredential(W,Q),await this.relayOrgFsConfig(W.daemonUrl,W.token,Q.orgFsConfigJson),this.finish(W,Y,!1,!0,"resume");await Y.delete($)}}let X=await wL(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(X)if(X.metadata?.deletionTimestamp)await B80(this.kubeConfig,this.namespace,Z).catch((G)=>{console.warn(`[${V6}] wait for terminating claim ${Z} failed: ${G instanceof Error?G.message:String(G)}`)});else if(!SQ1(X)){let G=await this.join($,Z,Q,X).catch((W)=>{return console.warn(`[${V6}] join of starting claim ${Z} failed, recreating: ${W instanceof Error?W.message:String(W)}`),null});if(G)return this.finish(G,Y,!0,!0,"adopt");await KR(this.kubeConfig,this.namespace,Z).catch(()=>{}),await B80(this.kubeConfig,this.namespace,Z).catch((W)=>{console.warn(`[${V6}] wait for deleted claim ${Z} failed: ${W instanceof Error?W.message:String(W)}`)})}else{let G=await this.adopt($,Z,X).catch((W)=>{return console.warn(`[${V6}] adopt ${Z} failed, recreating: ${W instanceof Error?W.message:String(W)}`),null});if(G)return await this.refreshDaemonGitCredential(G,Q),await this.relayOrgFsConfig(G.daemonUrl,G.token,Q.orgFsConfigJson),this.finish(G,Y,!0,!0,"adopt");await KR(this.kubeConfig,this.namespace,Z).catch(()=>{}),await B80(this.kubeConfig,this.namespace,Z).catch((W)=>{console.warn(`[${V6}] wait for deleted claim ${Z} failed: ${W instanceof Error?W.message:String(W)}`)})}let J=await this.provision($,Z,Q);return this.finish(J,Y,!0,!1,"fresh")}async finish($,Z,Q,Y,X){let J=this.records.get($.handle),G=J!==void 0;if(J&&J.daemonForward!==$.daemonForward)this.closeForwarder(J.daemonForward);if(this.records.set($.handle,$),Q)await this.persist(Z,$);if(Y)await NN0(this.kubeConfig,this.namespace,$.handle,this.computeShutdownTime()).catch((W)=>console.warn(`[${V6}] TTL refresh failed for ${$.handle}: ${W instanceof Error?W.message:String(W)}`));if(this.metrics){let W=vQ1($.tenant);if(this.metrics.ensureOutcome.add(1,{...W,outcome:X}),!G)this.metrics.active.add(1,W),this.activeGauge.markCounted($.handle)}return this.toSandbox($)}buildEnvMap($,Z){let Q={},Y=[];for(let[X,J]of Object.entries($.env??{}))if(Vr4.has(X))Y.push(X);else Q[X]=J;if(Y.length>0)console.warn(`[${V6}] opts.env keys overlap reserved bootstrap names and were dropped: ${Y.join(",")}`);return{...Q,DAEMON_TOKEN:Z.token,DAEMON_BOOT_ID:Z.daemonBootId,APP_ROOT:Z.workdir,PROXY_PORT:String(bN)}}async resolveTemplateName($,Z,Q){let{name:Y,probes:X}=await VQ1({purpose:$,tenantPool:Z,...Q?{sandboxImage:Q}:{},templateName:this.sandboxTemplateName,probes:this.templateProbes,now:Date.now(),ttlMs:qr4,exists:(J)=>V2$(this.kubeConfig,this.namespace,J),onAbsent:(J)=>console.warn(`[${V6}] SandboxTemplate ${J} not found (or not readable) \u2014 this claim falls back to a template without that suffix. Upgrade the sandbox-env chart to the version that renders it.`)});return this.templateProbes=X,Y}buildClaim($,Z,Q,Y,X){let J=this.sentinelToken!==null,G=J?[]:Object.entries(this.buildEnvMap(Z,Q)).sort(([H],[F])=>H<F?-1:H>F?1:0).map(([H,F])=>({name:H,value:F})),W=mr4(Z),K=Object.keys(W).length>0;return{apiVersion:`${Y7.CLAIM_API_GROUP}/${Y7.CLAIM_API_VERSION}`,kind:"SandboxClaim",metadata:{name:$,namespace:this.namespace,labels:{"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[RJ.env]:this.envName}:{},..._Q1(Z.tenant)},...K?{annotations:W}:{}},spec:{sandboxTemplateRef:{name:X},additionalPodMetadata:{labels:_Q1(Z.tenant,{[RJ.role]:"claimed",[RJ.sandboxHandle]:$,...this.envName?{[RJ.env]:this.envName}:{}}),...K?{annotations:W}:{}},env:G,warmpool:yI$(Y,J,X),lifecycle:{shutdownPolicy:"Delete",shutdownTime:this.computeShutdownTime()}}}}async provision($,Z,Q){let Y=this.tokenGenerator(),X=iI$(),J=uq0,G=this.claimTenantPoolBinding(Q),W=this.buildClaim(Z,Q,{token:Y,daemonBootId:X,workdir:J},G,await this.resolveTemplateName(Q.purpose,G!==null,Q.sandboxImage));try{await TZ1(this.kubeConfig,this.namespace,W)}catch(K){if(K instanceof H80)await B80(this.kubeConfig,this.namespace,Z),await TZ1(this.kubeConfig,this.namespace,W);else throw K}return this.bind($,Z,Q,G,{token:Y,daemonBootId:X,workdir:J})}claimTenantPoolBinding($){return this.tenantPools?.resolve({tenant:fI$($),image:$.sandboxImage??"default",cloneUrl:$.repo?.cloneUrl,branch:$.repo?.branch})??null}async bind($,Z,Q,Y,{token:X,daemonBootId:J,workdir:G}){let W;try{W=await I2$(this.kubeConfig,this.namespace,Z),await II$((B)=>this.watchClaimLifecycle(Z,B))}catch(B){throw await KR(this.kubeConfig,this.namespace,Z).catch(()=>{}),B}try{await this.ensureServicePortForAdoptedSandbox(W),await this.ensureHttpRouteForHandle(Z,W,Q.tenant??null)}catch(B){throw await KR(this.kubeConfig,this.namespace,Z).catch(()=>{}),B}let K=await this.openForwarder(W,bN,Z),H=`http://127.0.0.1:${K.localPort}`,F=Y?.repo!=null&&W!==Z,U=this.workloadConfigPayload(Q,F),N=J;try{if(await AQ1(H),this.sentinelToken!==null){let B=await Cq0(H);if(B)N=B.bootId;try{await AK(H,this.sentinelToken,U??{},{rotateToken:X})}catch(D){if(D instanceof AJ&&D.status===401)console.warn(`[${V6}] sentinel rejected by adopted pod (handle=${Z}, sandbox=${W}): pod belongs to another claim; tearing down and reprovisioning`);throw D}}else if(U)await AK(H,X,U);await this.relayOrgFsConfig(H,X,Q.orgFsConfigJson)}catch(B){throw this.closeForwarder(K),await this.deleteHttpRouteIfManaged(Z).catch(()=>{}),await KR(this.kubeConfig,this.namespace,Z).catch(()=>{}),B}return{id:$,handle:Z,adoptedSandboxName:W,token:X,workdir:G,daemonUrl:H,daemonForward:K,workload:Q.workload??null,daemonBootId:N,tenant:Q.tenant??null,tenantPoolPodBound:F,ensureOpts:or4(Q)}}workloadConfigPayload($,Z){return Mi({runtime:$?.workload?.runtime??"node",packageManager:$?.workload?.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:$?.repo??null,extraRepos:$?.extraRepos??[],port:$?.workload?.devPort??nI$,tenant:$?.tenant??void 0,...$?{cloneOnly:$.cloneOnly===!0&&!Z}:{}})}async relayOrgFsConfig($,Z,Q){if(!Q)return;await _80($,Z,Q).catch((Y)=>console.warn("[org-fs] sidecar config relay failed",Y))}async refreshDaemonGitCredential($,Z){let Q=b80(Z);if(!Q)return;try{await AK($.daemonUrl,$.token,Q)}catch(Y){console.warn(`[${V6}] git credential refresh failed for ${$.handle}: ${Y instanceof Error?Y.message:String(Y)}`)}}async withFreshCloneUrl($,Z={}){if(!this.mintCloneUrl)return $;try{let Q=await this.mintCloneUrl($,Z);if(!Q)return $;let{credentialExpiresAt:Y,...X}=$;return{...X,cloneUrl:Q}}catch(Q){return console.warn(`[${V6}] clone credential re-mint failed: ${Q instanceof Error?Q.message:String(Q)}`),$}}async withFreshCredentials($,Z=!1){return{...$,...$.repo?{repo:await this.withFreshCloneUrl($.repo,{tenant:$.tenant})}:{},...$.orgFsConfigJson||Z?{orgFsConfigJson:await nr4($,this.mintOrgFsConfig)}:{}}}startCredentialRefresher(){if(!this.mintCloneUrl)return;let{signal:$}=this.claimWatchAbort;(async()=>{while(!$.aborted){if(await F$(Cr4,{signal:$}).catch(()=>{}),$.aborted)break;try{await this.refreshAllGitCredentials()}catch(Z){console.warn(`[${V6}] periodic credential refresh failed: ${Z instanceof Error?Z.message:String(Z)}`)}}})()}startTenantPoolReconciler(){let $=this.tenantPools;if(!$)return;let{signal:Z}=this.claimWatchAbort;(async()=>{while(!Z.aborted){try{await this.reconcileTenantPools($)}catch(Q){console.warn(`[${V6}] tenant pool reconcile failed: ${Q instanceof Error?Q.message:String(Q)}`)}await F$(kr4,{signal:Z}).catch(()=>{})}})()}listTenantPools(){return this.tenantPools?.pools()??[]}markTenantPoolsDirty($,Z){return Promise.resolve(this.tenantPools?.markDirty($,Z)??[])}async reconcileTenantPools($){let Z=Ii($.pools());for(let Q of $.retain(Z))this.recordPoolGone(Q);for(let Q of Z){let Y=Q.warmPoolName,X=await k2$(this.kubeConfig,this.namespace,Y);if(X===null){console.warn(`[${V6}] tenant pool ${Y}: no SandboxWarmPool (or no selector yet) in ${this.namespace}`);continue}let J=$.takeDirty(Y),G=X.filter((W)=>!W.labels[RJ.sandboxHandle]);$.retainPods(Y,new Set(X.map((W)=>W.uid)));for(let W of G){if(this.claimWatchAbort.signal.aborted)return;await this.warmPoolPod($,Q,W,J)}this.recordPoolDepth($,Q,X,G)}}recordPoolGone($){let Z=oI$($);for(let Q of["ready","bound","pending","failed"])this.metrics?.poolPods.record(0,{...Z,state:Q})}recordPoolDepth($,Z,Q,Y){let X=this.metrics?.poolPods;if(!X)return;let J=0,G=0;for(let K of Y){let H=$.pod(K.uid);if(!H)continue;if(H.failures>=lq0)G++;else if(H.lastConfigAt>0)J++}let W=oI$(Z);X.record(J,{...W,state:"ready"}),X.record(Q.length-Y.length,{...W,state:"bound"}),X.record(Y.length-J-G,{...W,state:"pending"}),X.record(G,{...W,state:"failed"})}async warmPoolPod($,Z,Q,Y){let X=Z.warmPoolName,{workload:J}=Z.repo,G=$.pod(Q.uid);if(G&&G.failures>=lq0){if(Date.now()-G.lastFailureAt<tI$)return;$.setPod(Q.uid,{...G,failures:0})}let W=Y||G!==void 0&&Date.now()-G.lastConfigAt>=this.tenantPoolRefreshMs;if(G&&!W)return;let K=await this.allocationCloneUrl(Z);if(!K){this.recordPoolFailure($,Q,X,"clone credential mint failed");return}let H={cloneUrl:K,branch:Z.repo.branch,userName:"",userEmail:""},F=await this.openForwarder(Q.name,bN,Q.name).catch(()=>null);if(!F){this.recordPoolFailure($,Q,X,"port-forward failed");return}let U=`http://127.0.0.1:${F.localPort}`;try{await AQ1(U);let N=this.sentinelToken;if(!N)return;if(!await this.isPoolPodUnbound(Q))return;let B=Mi({runtime:J.runtime,packageManager:J.packageManager?{name:J.packageManager,...J.packageManagerPath?{path:J.packageManagerPath}:{}}:null,repo:H,port:J.devPort??nI$})??{},{transition:D}=await AK(U,N,B);if(W&&D!=="bootstrap"&&await this.isPoolPodUnbound(Q))await EI$(U,N,"clone");$.setPod(Q.uid,{pool:X,lastConfigAt:Date.now(),lastFailureAt:0,failures:0}),console.log(`[${V6}] tenant pool ${X}: warmed ${Q.name} (${D})`)}catch(N){this.recordPoolFailure($,Q,X,N instanceof Error?N.message:String(N))}finally{this.closeForwarder(F)}}async allocationCloneUrl({pool:$,repo:Z}){if(!this.mintPoolCloneUrl)return`${Z.repoUrl}.git`;try{return await this.mintPoolCloneUrl({tenant:$.tenant,repoUrl:Z.repoUrl,branch:Z.branch})}catch(Q){return console.warn(`[${V6}] tenant pool clone credential mint failed: ${Q instanceof Error?Q.message:String(Q)}`),null}}isPoolPodUnbound($){return S2$(this.kubeConfig,this.namespace,$.name,RJ.sandboxHandle)}recordPoolFailure($,Z,Q,Y){let X=$.pod(Z.uid),J=(X?.failures??0)+1;$.setPod(Z.uid,{pool:Q,lastConfigAt:X?.lastConfigAt??0,lastFailureAt:Date.now(),failures:J});let G=J>=lq0?` \u2014 backing off ${tI$/60000}min`:"";console.warn(`[${V6}] tenant pool ${Q}: warming ${Z.name} failed (${J}/${lq0})${G}: ${Y}`)}async refreshAllGitCredentials(){await hI$(this.records.values(),($)=>$.ensureOpts?.repo?.connectionId,async($)=>{if(this.claimWatchAbort.signal.aborted)return;let Z=$.ensureOpts?.repo;if(!Z)return;try{let Q=await this.withFreshCloneUrl(Z,{bufferMs:_r4,tenant:$.ensureOpts?.tenant});await this.refreshDaemonGitCredential($,{...$.ensureOpts,repo:Q}),$.ensureOpts={...$.ensureOpts,repo:Q}}catch(Q){throw console.warn(`[${V6}] git credential refresh failed for ${$.handle}: ${Q instanceof Error?Q.message:String(Q)}`),Q}})}async rebootstrapDaemon($,Z,Q){if(this.sentinelToken===null)return!1;let Y=this.workloadConfigPayload(Q,!1)??{};try{return await AK($,this.sentinelToken,Y,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,Q?.orgFsConfigJson),!0}catch(X){if(X instanceof AJ&&X.status===401)try{return await AK($,Z,Y,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,Q?.orgFsConfigJson),!0}catch(J){return console.warn(`[${V6}] re-bootstrap retry with claim token failed: ${J instanceof Error?J.message:String(J)}`),!1}return console.warn(`[${V6}] re-bootstrap failed: ${X instanceof Error?X.message:String(X)}`),!1}}async ensureServicePortForAdoptedSandbox($){if(!this.previewGateway||!this.previewUrlPattern)return;await h2$(this.kubeConfig,this.namespace,$,{name:"daemon",port:bN,targetPort:bN})}async ensureHttpRouteForHandle($,Z,Q){if(!this.previewGateway||!this.previewUrlPattern)return;let Y=sr4(this.previewUrlPattern,$);if(!Y)throw new NX(`Unable to derive preview hostname for ${$} from pattern: ${this.previewUrlPattern}`);let X={apiVersion:`${qZ1.API_GROUP}/${qZ1.API_VERSION}`,kind:"HTTPRoute",metadata:{name:$,namespace:this.namespace,labels:_Q1(Q??void 0,{[RJ.role]:"claimed",[RJ.sandboxHandle]:$,"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[RJ.env]:this.envName}:{}})},spec:{parentRefs:[{kind:"Gateway",group:"gateway.networking.k8s.io",name:this.previewGateway.name,namespace:this.previewGateway.namespace}],hostnames:[Y],rules:[{backendRefs:[{group:"",kind:"Service",name:Z,port:bN}]}]}};await f2$(this.kubeConfig,this.namespace,X)}async deleteHttpRouteIfManaged($){if(!this.previewGateway)return;await y2$(this.kubeConfig,this.namespace,$)}async rehydrate($,Z,Q){let Y=Q.state;if(!Y.adoptedSandboxName&&!Y.podName||!Y.token)return null;let X=await wL(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!X||!SQ1(X))return null;let J=X.status?.sandbox?.name??Y.adoptedSandboxName??Y.podName??Z,G=await this.openAndProbeDaemon(J,Z);if(!G)return null;if(Y.daemonBootId&&Y.daemonBootId!==G.bootId){if(this.sentinelToken!==null){let W=Y.ensureOpts?await this.withFreshCredentials(Y.ensureOpts,Y.orgFsRedacted===!0):null;if(!await this.rebootstrapDaemon(G.daemonUrl,Y.token,W))return this.closeForwarder(G.daemonForward),null}else console.warn(`[${V6}] daemon restart detected (handle=${Z}): stored bootId=${Y.daemonBootId} live bootId=${G.bootId}`);await this.stateStore?.put($,{handle:Z,state:{...Y,daemonBootId:G.bootId}}).catch((W)=>console.warn(`[${V6}] bootId persist failed for ${Z}: ${W instanceof Error?W.message:String(W)}`))}return{id:$,handle:Z,adoptedSandboxName:J,tenantPoolPodBound:!1,token:Y.token,workdir:Y.workdir??uq0,daemonUrl:G.daemonUrl,daemonForward:G.daemonForward,workload:Y.workload??null,daemonBootId:G.bootId,tenant:Y.tenant??null,ensureOpts:Y.ensureOpts??null,orgFsRedacted:Y.orgFsRedacted===!0}}join($,Z,Q,Y){let X=this.sentinelToken!==null,J=X?this.tokenGenerator():CQ1(Y,"DAEMON_TOKEN"),G=X?iI$():CQ1(Y,"DAEMON_BOOT_ID");if(!J||!G)throw new NX(`claim ${Z} carries no daemon token`);return this.bind($,Z,Q,this.claimTenantPoolBinding(Q),{token:J,daemonBootId:G,workdir:uq0})}async adopt($,Z,Q){if(!SQ1(Q))return null;let Y=Q.status?.sandbox?.name??Z;if(this.sentinelToken!==null)return null;let X=CQ1(Q,"DAEMON_TOKEN");if(!X)return null;let J=await this.openAndProbeDaemon(Y,Z);if(!J)return null;let G=dr4(Q);if(this.previewGateway)await this.ensureServicePortForAdoptedSandbox(Y).catch((W)=>{console.warn(`[${V6}] Service port backfill failed for ${Z}: ${W instanceof Error?W.message:String(W)}`)}),await this.ensureHttpRouteForHandle(Z,Y,G).catch((W)=>{console.warn(`[${V6}] HTTPRoute backfill failed for ${Z}: ${W instanceof Error?W.message:String(W)}`)});return{id:$,handle:Z,adoptedSandboxName:Y,tenantPoolPodBound:!1,token:X,workdir:uq0,daemonUrl:J.daemonUrl,daemonForward:J.daemonForward,workload:null,daemonBootId:J.bootId,tenant:G,ensureOpts:null}}async openAndProbeDaemon($,Z){let Q=await this.openForwarder($,bN,Z).catch(()=>null);if(!Q)return null;let Y=`http://127.0.0.1:${Q.localPort}`,X=await Cq0(Y);if(!X)return this.closeForwarder(Q),null;return{daemonForward:Q,daemonUrl:Y,bootId:X.bootId}}async getRecord($){let Z=this.records.get($);if(Z)return Z;if(!this.stateStore)return null;let Q=await this.stateStore.getByHandle($);if(!Q)return null;let Y=await this.rehydrate(Q.id,$,Q);if(Y)this.records.set($,Y);return Y}async resurrectByHandle($){if(!this.stateStore)return null;let Z=await this.stateStore.getByHandle($);if(!Z)return null;let Q=Z.state,Y=Q.ensureOpts;if(!Y)return null;let X=await this.withFreshCredentials(Y,Q.orgFsRedacted===!0);if(m3(Z.id)!==$)return null;return await this.ensure(Z.id,X),this.records.get($)??null}invalidateRecord($){let Z=this.records.get($);if(!Z)return;this.records.delete($),this.dropRecord(Z)}dropRecord($){if(this.closeForwarder($.daemonForward),this.metrics&&this.activeGauge.consume($.handle))this.metrics.active.add(-1,vQ1($.tenant))}recordProxyDuration($,Z,Q,Y,X){if(!this.metrics)return;this.metrics.proxyDurationMs.record(Y,{...vQ1(Q?.tenant??null),source:$,sandbox_handle:Q?.handle??X??"",status_code:Z||0})}composePreviewUrl($){if(this.previewUrlPattern)return xq0(this.previewUrlPattern,$.handle);return`http://127.0.0.1:${$.daemonForward.localPort}/`}toSandbox($){return{handle:$.handle,workdir:$.workdir,previewUrl:this.composePreviewUrl($),warmPoolAdopted:$.tenantPoolPodBound===!0,provider:"kubernetes"}}async persist($,Z){if(!$)return;let Q={adoptedSandboxName:Z.adoptedSandboxName,token:Z.token,workdir:Z.workdir,workload:Z.workload,daemonBootId:Z.daemonBootId,tenant:Z.tenant,...Z.ensureOpts?this.persistCredentials?{ensureOpts:Z.ensureOpts}:tr4(Z.ensureOpts,Z.orgFsRedacted===!0):{}};await $.put(Z.id,{handle:Z.handle,state:Q})}computeShutdownTime(){return new Date(Date.now()+this.idleTtlMs).toISOString()}async releaseAfter($,Z){let Q=await wL(this.kubeConfig,this.namespace,$);if(!Q)return;let Y=ir4(Q.spec?.lifecycle?.shutdownTime,new Date(Date.now()+Z));if(!Y)return;await NN0(this.kubeConfig,this.namespace,$,Y).catch((X)=>console.warn(`[${V6}] release failed for ${$}: ${X instanceof Error?X.message:String(X)}`))}async renewTtl($){let Z=await wL(this.kubeConfig,this.namespace,$);if(!Z)return;let Q=pr4(Z.spec?.lifecycle?.shutdownTime,new Date(Date.now()+this.idleTtlMs));if(!Q)return;await NN0(this.kubeConfig,this.namespace,$,Q).catch((Y)=>console.warn(`[${V6}] TTL renew failed for ${$}: ${Y instanceof Error?Y.message:String(Y)}`))}openForwarder($,Z,Q=$){if(this.forwardPort)return this.forwardPort($,Z,Q);let Y=fr4(Q,Z);return new Promise((X,J)=>{let G=(W,K)=>{let H=aI$.createServer((F)=>this.handleForwardedConnection(F,$,Z,Q));H.once("error",(F)=>{if(F.code==="EADDRINUSE"&&K<vr4){try{H.close()}catch{}let U=bQ1+(W-bQ1+1)%eI$;G(U,K+1);return}J(F)}),H.listen(W,"127.0.0.1",()=>{let F=H.address();if(!F||typeof F==="string"){H.close(),J(Error("port-forward listener failed to bind"));return}let U=F.port;X({localPort:U,close:()=>H.close((N)=>{if(N)console.warn(`[${V6}] port-forward close on :${U} errored: ${N.message}`)})})})};G(Y,0)})}handleForwardedConnection($,Z,Q,Y){let X=new Ar4,J=null,G=!1,W=()=>{if(G)return;if(G=!0,X.destroy(),J)try{J.close()}catch{}if(!$.destroyed)$.destroy()};$.pipe(X),$.on("error",W),$.on("close",W),this.portForward.portForward(this.namespace,Z,[Q],$,null,X).then((K)=>{let H=typeof K==="function"?K():K;if(!H){W();return}if(J=H,J.on("close",W),J.on("error",(F)=>{console.warn(`[${V6}] port-forward to ${Z}:${Q} dropped mid-connection: ${pI$(F)}`,JSON.stringify(xQ1(F))),this.invalidateRecord(Y),W()}),G)try{J.close()}catch{}}).catch((K)=>{console.warn(`[${V6}] port-forward to ${Z}:${Q} failed: ${pI$(K)}`,JSON.stringify(xQ1(K))),this.invalidateRecord(Y),W()})}closeForwarder($){$.close()}close(){if(this.closed)return;this.closed=!0,this.claimWatchAbort.abort();for(let $ of this.records.values())this.dropRecord($);this.records.clear()}}function br4($){return{active:$.createUpDownCounter("studio.sandbox.active",{description:"Active sandbox count, by runner kind, owning org, and daemon impl. Cross-checks the cAdvisor-derived count from the cluster \u2014 divergence between the two indicates orphaned claims (studio deleted but K8s didn't reap) or unattributed pods.",unit:"{sandbox}"}),ensureOutcome:$.createCounter("studio.sandbox.ensure.outcome",{description:"Outcome of each ensure() call: fresh provision, resume from state-store after restart, or adopt of a cluster-side claim studio didn't know about. Cold-start ratio is the primary input for warm-pool sizing.",unit:"{call}"}),proxyDurationMs:$.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of studio-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"}),poolPods:$.createGauge("studio.sandbox.pool.pods",{description:"Tenant warm pool depth by pool and state: ready (warmed and unbound \u2014 what a claim can actually bind instantly), bound (serving a user), pending (unbound, not yet warmed), failed (gave up after repeated bootstrap failures). Alert on sustained ready=0: a pool that is always empty is doing nothing while costing N pods.",unit:"{pod}"})}}function xQ1($){let Z=[],Q=$;for(let Y=0;Y<5&&Q instanceof Error;Y++){let X=Q;if(Z.push({name:X.name,message:X.message,...X.code!==void 0?{code:X.code}:{},...X.errno!==void 0?{errno:X.errno}:{}}),X.cause===Q)break;Q=X.cause}if(Q!==void 0&&!(Q instanceof Error)&&Q!==null){let Y=Q,X=Y.error instanceof Error?xQ1(Y.error).chain:void 0;Z.push({nonError:String(Q),...typeof Y.type==="string"?{type:Y.type}:{},...typeof Y.message==="string"?{message:Y.message}:{},...Y.code!==void 0?{code:Y.code}:{},...typeof Y.reason==="string"?{reason:Y.reason}:{},...X?{error:X}:{},...X===void 0&&Y.error!==void 0?{rawError:String(Y.error)}:{},keys:Object.keys(Y)})}return{chain:Z}}function xr4(){let $=new Bq0;return $.loadFromDefault(),$}function SQ1($){return Boolean($.status?.conditions?.some((Z)=>Z.type==="Ready"&&Z.status==="True"))}function CQ1($,Z){let Q=$.spec?.env;if(!Q)return null;for(let Y of Q)if(Y.name===Z&&Y.value)return Y.value;return null}function fr4($,Z){let Q=Pr4("sha256").update(`${$}:${Z}`).digest();return bQ1+Q.readUInt32BE(0)%eI$}function sI$($){let Z=$.slice(0,gr4);return yr4.test(Z)?Z:""}function ur4($){if($===void 0)return null;let Z=$.trim();if(Z==="")return null;if(!hr4.test(Z))throw Error(`AgentSandboxProvider: envName=${JSON.stringify(Z)} is not a valid DNS-label-safe environment name (lowercase alphanumeric or '-', starts with a letter, ends alphanumeric, \u226432 chars). Studio sets this from STUDIO_ENV; check the studio chart's configMap.`);return Z}function _Q1($,Z={}){let Q={...Z};if($){let Y=sI$($.orgId),X=sI$($.userId);if(Y)Q[RJ.orgId]=Y;if(X)Q[RJ.userId]=X}return Q}function gy($){let Z="";for(let Q of $){let Y=Q.codePointAt(0)??0;Z+=Y<32||Y===127?" ":Q}return Z.slice(0,lr4)}function cr4($){try{let Z=new URL($);return Z.username="",Z.password="",Z.toString()}catch{return""}}function mr4($){let Z={},Q=$.tenant;if(Q?.orgSlug)Z[OF.orgSlug]=gy(Q.orgSlug);if(Q?.orgName)Z[OF.orgName]=gy(Q.orgName);if(Q?.userEmail)Z[OF.userEmail]=gy(Q.userEmail);if(Q?.userName)Z[OF.userName]=gy(Q.userName);let Y=$.repo;if(Y){if(Y.displayName)Z[OF.gitRepo]=gy(Y.displayName);let X=cr4(Y.cloneUrl);if(X)Z[OF.gitRepoUrl]=gy(X);let J=$.branch??Y.branch;if(J)Z[OF.gitBranch]=gy(J)}return Z}function dr4($){let Z=$.metadata?.labels;if(!Z)return null;let Q=Z[RJ.orgId],Y=Z[RJ.userId];if(!Q||!Y)return null;let X=$.metadata?.annotations??{};return{orgId:Q,userId:Y,orgSlug:X[OF.orgSlug],orgName:X[OF.orgName],userEmail:X[OF.userEmail],userName:X[OF.userName]}}function ir4($,Z){if($){let Q=new Date($).getTime();if(Number.isFinite(Q)&&Q<=Z.getTime())return null}return Z.toISOString()}function pr4($,Z){if($){let Q=new Date($).getTime();if(Number.isFinite(Q)&&Q>=Z.getTime())return null}return Z.toISOString()}function vQ1($){return{org_id:$?.orgId??"",user_id:$?.userId??"",runner_kind:"agent-sandbox"}}async function nr4($,Z){if(!Z||!$.tenant)return $.orgFsConfigJson;try{return await Z($.tenant)??$.orgFsConfigJson}catch(Q){return console.warn(`[${V6}] org-fs credential re-mint failed: ${Q instanceof Error?Q.message:String(Q)}`),$.orgFsConfigJson}}function rI$($){try{let Z=new URL($.cloneUrl);Z.username="",Z.password="";let{submoduleCredentials:Q,credentialExpiresAt:Y,...X}=$;return{...X,cloneUrl:Z.toString()}}catch{return null}}function tr4($,Z){let{orgFsConfigJson:Q,repo:Y,extraRepos:X,...J}=$,G=J,W=Y&&rI$(Y);if(W)G.repo=W;if(X)G.extraRepos=X.map(rI$).filter((K)=>K!==null);return Q||Z?{ensureOpts:G,orgFsRedacted:!0}:{ensureOpts:G}}function or4($){let Z={};if($.branch)Z.branch=$.branch;if($.repo)Z.repo=$.repo;if($.workload)Z.workload=$.workload;if($.env&&Object.keys($.env).length>0)Z.env=$.env;if($.tenant)Z.tenant=$.tenant;if($.cloneOnly)Z.cloneOnly=!0;if($.purpose)Z.purpose=$.purpose;if($.sandboxImage)Z.sandboxImage=$.sandboxImage;if($.orgFsConfigJson)Z.orgFsConfigJson=$.orgFsConfigJson;return Object.keys(Z).length>0?Z:null}function sr4($,Z){try{return new URL(xq0($,Z)).hostname||null}catch{return null}}var V6="AgentSandboxProvider",Tr4="agent-sandbox-system",Rr4="studio-sandbox",qr4=300000,bN=9000,nI$=3000,uq0="/app",Mr4=32,Vr4,Ir4=900000,kr4=60000,Sr4=1800000,lq0=3,tI$=1800000,Cr4=900000,_r4=1800000,bQ1=40000,eI$=1e4,vr4=256,RJ,OF,yr4,gr4=63,hr4,lr4=253;var $k$=L(()=>{r$();m2$();DI$();fy();Vi();BN0();F80();SI$();y80();lI$();gq0();hq0();Vr4=new Set(["DAEMON_TOKEN","DAEMON_BOOT_ID","APP_ROOT","PROXY_PORT"]);RJ={role:"studio.decocms.com/role",sandboxHandle:"studio.decocms.com/sandbox-handle",orgId:"studio.decocms.com/org-id",userId:"studio.decocms.com/user-id",env:"studio.decocms.com/env"},OF={orgSlug:"studio.decocms.com/org-slug",orgName:"studio.decocms.com/org-name",userEmail:"studio.decocms.com/user-email",userName:"studio.decocms.com/user-name",gitRepo:"studio.decocms.com/git-repo",gitRepoUrl:"studio.decocms.com/git-repo-url",gitBranch:"studio.decocms.com/git-branch"},yr4=/^([A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?)?$/;hr4=/^[a-z]([a-z0-9-]{0,30}[a-z0-9])?$/});var Zk$={};O6(Zk$,{tenantPoolSchema:()=>_I$,tenantPoolRepoSchema:()=>f80,tenantPoolFieldsSchema:()=>qQ1,tenantPoolAllocations:()=>Ii,resolveTenantPoolBinding:()=>MQ1,renderTenantPoolWarmPools:()=>xI$,normalizeRepoUrl:()=>TK,allocationsMatchingPush:()=>IQ1,TenantPoolCapacityError:()=>yq0,PREVIEW_NOT_READY_HEADER:()=>Si,AgentSandboxProvider:()=>fQ1});var g80=L(()=>{$k$();y80()});import{z as hy}from"zod";function cq0($){if(!$||$.trim()==="")return[];let Z=hy.array(rr4).parse(JSON.parse($)),Q=new Set;for(let Y of Z){if(Q.has(Y.name))throw Error(`tenant pools: duplicate pool name ${Y.name}`);Q.add(Y.name)}return Z}function Qk$($){let Z=TK(`https://github.com/${$.repo}`);if(!Z)throw Error(`tenant pools: bad repo ${$.repo}`);return Z}function Yk$($){return $.map((Z)=>({name:Z.name,tenant:Z.orgId,size:1,image:"default",repos:[{repoUrl:Qk$(Z),branch:Z.branch,workload:Z.workload,replicas:1,warmPoolName:Z.name}]}))}function yQ1($,Z){let Q=TK(Z.repoUrl)?.toLowerCase(),Y=$.find((J)=>J.orgId===Z.tenant&&J.branch===Z.branch&&Qk$(J).toLowerCase()===Q);if(!Y)return null;let X=`https://github.com/${Y.repo}.git`;return Y.connectionId?{cloneUrl:X,connectionId:Y.connectionId}:{cloneUrl:X}}function Xk$($,Z){return async(Q)=>{let Y=yQ1($,Q);if(!Y)return null;return Y.connectionId?Z(Y):Y.cloneUrl}}var rr4;var mq0=L(()=>{g80();rr4=hy.object({name:hy.string().max(63).regex(/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/,"pool name must be a DNS label (lowercase alphanumeric and '-')"),orgId:hy.string().min(1),repo:hy.string().regex(/^[^/\s]+\/[^/\s]+$/,"repo must be `owner/name`"),connectionId:hy.string().min(1).optional(),branch:hy.string().min(1).default("main"),workload:f80.shape.workload})});function cQ1($,Z=Date.now()){if($===void 0)return;return $===null?Z+ar4:$.getTime()}function lQ1($){return JSON.stringify([$.orgId,$.userId])}function Jk$($,Z){let Q=TK(Z);return Q?JSON.stringify([$,Q.toLowerCase()]):null}function $a4($,Z){return"repositoryId"in Z?$.repositoryOrgs.get(Z.repositoryId):$.connectionOrgs.get(Z.connectionId)}function Gk$($){let{records:Z,now:Q}=$,Y=new Map,X=new Map,J=new Map,G=0;for(let W of $.pools)for(let{repoUrl:K,branch:H}of W.repos){let F=Jk$(W.tenant,K),U=yQ1($.legacyPools??[],{tenant:W.tenant,repoUrl:K,branch:H});if(F&&U){if(U.connectionId)X.set(F,{tenant:W.tenant,repoUrl:K,connectionId:U.connectionId,cloneUrl:U.cloneUrl});continue}let N=F?Z.orgRepositories.get(F):void 0;if(!F||!N){G++;continue}X.set(F,{tenant:W.tenant,repoUrl:K,repositoryId:N})}for(let W of $.sandboxes){let K=W.tenant;if(!K)continue;let H=Z.members.get(lQ1(K));if(H===void 0){G++;continue}for(let U of W.repos){if($a4(Z,U)!==K.orgId){G++;continue}let N="repositoryId"in U?{repositoryId:U.repositoryId}:{connectionId:U.connectionId,repo:U.repo.toLowerCase()},B={orgId:K.orgId,userId:K.userId};Y.set(JSON.stringify([B,N]),{tenant:B,repo:N})}let F=W.orgFsConfigExpiresAt;if(W.orgFs&&(F===null||F-Q<er4))J.set(lQ1(K),{orgId:K.orgId,userId:K.userId,orgSlug:H})}return{clones:[...Y.values()],poolClones:[...X.values()],orgFs:[...J.values()],refused:G}}async function Wk$($,Z,Q){let Y=new Set,X=new Set,J=new Set,G=new Set,W=new Set(Q.map((D)=>D.tenant)),K=new Set;for(let D of Q)for(let{repoUrl:O}of D.repos){let w=YX(O);if(w)K.add(w.path.toLowerCase())}for(let D of Z){if(D.tenant)Y.add(D.tenant.orgId),X.add(D.tenant.userId);for(let O of D.repos)if("repositoryId"in O)G.add(O.repositoryId);else J.add(O.connectionId)}let[H,F,U,N]=await Promise.all([Y.size===0?[]:$.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.organizationId as orgId","member.userId as userId","organization.slug as slug"]).where("member.organizationId","in",[...Y]).where("member.userId","in",[...X]).execute(),J.size===0?[]:$.selectFrom("connections").select(["id","organization_id"]).where("id","in",[...J]).execute(),G.size===0?[]:$.selectFrom("repositories").select(["id","organization_id"]).where("id","in",[...G]).execute(),K.size===0?[]:$.selectFrom("repositories").select(["id","organization_id","provider","host","path"]).where("organization_id","in",[...W]).where((D)=>D(D.fn("lower",["path"]),"in",[...K])).execute()]),B=new Map;for(let D of N){let O=Jk$(D.organization_id,t10({provider:D.provider,host:D.host,path:D.path}));if(O&&!B.has(O))B.set(O,D.id)}return{members:new Map(H.map((D)=>[lQ1(D),D.slug])),connectionOrgs:new Map(F.map((D)=>[D.id,D.organization_id])),repositoryOrgs:new Map(U.map((D)=>[D.id,D.organization_id])),orgRepositories:B}}function uQ1($){return $ instanceof Error?$.message:String($)}async function Kk$($,Z,Q){let Y=0;if($.clones.length>_i||$.poolClones.length>_i||$.orgFs.length>hQ1)console.warn(`[sandbox-credential-push] ${$.clones.length} clone, ${$.poolClones.length} pool clone and ${$.orgFs.length} org-fs mints planned; minting the first ${_i}, ${_i} and ${hQ1}`);let X=await V5($.clones.slice(0,_i),gQ1,async(U)=>{let N="repositoryId"in U.repo?{cloneUrl:"",repositoryId:U.repo.repositoryId}:{cloneUrl:`https://github.com/${U.repo.repo}.git`,connectionId:U.repo.connectionId};try{let B=await Z.mintCloneUrl(N,{bufferMs:dq0});return B?{tenant:U.tenant,repo:U.repo,cloneUrl:B,expiresAt:Q.now+dq0}:null}catch(B){return Y++,console.warn(`[sandbox-credential-push] clone mint failed: ${uQ1(B)}`),null}}),J=await V5($.poolClones.slice(0,_i),gQ1,async(U)=>{try{let N=await Z.mintCloneUrl("repositoryId"in U?{cloneUrl:"",repositoryId:U.repositoryId}:{cloneUrl:U.cloneUrl,connectionId:U.connectionId},{bufferMs:dq0});return N?{tenant:U.tenant,repoUrl:U.repoUrl,cloneUrl:N,expiresAt:Q.now+dq0}:null}catch(N){return Y++,console.warn(`[sandbox-credential-push] pool clone mint failed: ${uQ1(N)}`),null}}),G=await V5($.orgFs.slice(0,hQ1),gQ1,async(U)=>{try{let N=await Z.mintOrgFsConfig(U);return N?{tenant:{orgId:U.orgId,userId:U.userId},orgFsConfigJson:N,expiresAt:Q.now+Q.orgFsLifetimeMs}:null}catch(N){return Y++,console.warn(`[sandbox-credential-push] org-fs mint failed: ${uQ1(N)}`),null}}),W=X.filter((U)=>U!==null),K=J.filter((U)=>U!==null),H=G.filter((U)=>U!==null),F=[];for(let U=0;U<Math.max(W.length,K.length,H.length);U+=rE)F.push({cloneUrls:W.slice(U,U+rE),poolCloneUrls:K.slice(U,U+rE),orgFsConfigs:H.slice(U,U+rE)});return{batches:F,failed:Y}}var dq0=2700000,iq0,ar4=86400000,er4=86400000,gQ1=8,_i=2000,hQ1=200;var pq0=L(()=>{zZ1();g80();t4();r$();VN();mq0();iq0=Y2$-3600000});var qJ;var h80=L(()=>{qJ=class qJ extends Error{code;status;path;constructor($,Z,Q){super(Z.message||`Freestyle API error: ${Z.code}`);this.name="FreestyleApiError",this.code=Z.code,this.status=$,this.path=Q,Object.setPrototypeOf(this,qJ.prototype)}}});function Hk$(){return typeof process<"u"&&Boolean(process.versions?.node)}var nq0=($,Z)=>globalThis.fetch($,Z);async function Za4(){if(!Hk$())return null;try{return await import("undici")}catch{return null}}async function Ya4(){let $=await Za4();if(!$)return null;let Z=new $.Agent({allowH2:!0,connections:Qa4});return(Q,Y)=>$.fetch(Q,{...Y,dispatcher:Z})}function Xa4($){return(typeof $==="string"?$:$ instanceof URL?$.href:$.url).startsWith("https:")}function Fk$(){let $,Z=()=>{return $??=Ya4().then((Q)=>Q??nq0).catch(()=>nq0),$};return(Q,Y)=>Xa4(Q)?Z().then((X)=>X(Q,Y)):nq0(Q,Y)}var Qa4=4;var Uk$=()=>{};function Fa4($){return new Promise((Z)=>setTimeout(Z,$))}function Ua4($){if(!$)return"";let Z=new URLSearchParams;for(let[Y,X]of Object.entries($)){if(X===void 0||X===null)continue;Z.set(Y,String(X))}let Q=Z.toString();return Q?`?${Q}`:""}function i6($){return encodeURIComponent($)}class mQ1{baseUrl;authenticationHeaders;fetchImpl;backgroundEligible;constructor($={}){if(this.baseUrl=($.baseUrl??Ha4).replace(/\/+$/,""),!$.fetch&&!globalThis.fetch)throw Error("No fetch implementation available. Pass `fetch` in FreestyleOptions when running on a runtime without a global fetch.");if(this.fetchImpl=$.fetch??Fk$(),"identityAccessToken"in $&&$.identityAccessToken){this.authenticationHeaders={[Ja4]:$.identityAccessToken},this.backgroundEligible=!1;return}if(this.backgroundEligible=!0,"stackAccessToken"in $&&$.stackAccessToken){this.authenticationHeaders={Authorization:`Bearer ${$.stackAccessToken}`,"X-Freestyle-Team-Id":$.teamId};return}let Z=$.apiKey??globalThis.process?.env?.FREESTYLE_API_KEY;if(!Z)throw Error("No Freestyle API key provided. Pass `apiKey` in FreestyleOptions or set FREESTYLE_API_KEY.");this.authenticationHeaders={Authorization:`Bearer ${Z}`}}authHeaders(){return{...this.authenticationHeaders}}url($,Z){return`${this.baseUrl}${$}${Ua4(Z)}`}async fetch($,Z={}){let Q=new Headers(Z.headers);for(let[Y,X]of Object.entries(this.authHeaders()))if(!Q.has(Y))Q.set(Y,X);return this.fetchImpl(this.absoluteUrl($),{...Z,headers:Q})}absoluteUrl($){return/^https?:\/\//i.test($)?$:`${this.baseUrl}${$}`}async request($,Z,{query:Q,body:Y,rawBody:X,signal:J}={}){let G={...this.authHeaders()};if(this.backgroundEligible)G[Nk$]=String(Wa4);let W;if(X!==void 0)G["Content-Type"]="application/octet-stream",W=X;else if(Y!==void 0)G["Content-Type"]="application/json",W=JSON.stringify(Y);let K=this.url(Z,Q),H=await this.fetchImpl(K,{method:$,headers:G,body:W,signal:J});if(this.backgroundEligible&&H.status===202)try{return await this.pollBackgroundRequest(H,Z)}catch(F){if($==="GET"&&F instanceof qJ&&F.code==="BACKGROUND_RESULT_UNSTORABLE"){delete G[Nk$];let U=await this.fetchImpl(K,{method:$,headers:G,body:W});return this.finalize(U,Z)}throw F}return this.finalize(H,Z)}async pollBackgroundRequest($,Z){let Q=await $.json().catch(()=>({})),Y=$.headers.get(Ga4)??Q.requestId,X=Q.resultUrl??(Y?`/v5/background-requests/${i6(Y)}`:void 0);if(!X)throw new qJ($.status,{code:"BACKGROUND_PROTOCOL_ERROR",message:"202 Accepted carried no background request id"},Z);let J=0;for(;;){await Fa4(Ka4);let G;try{G=await this.fetch(X,{method:"GET"}),J=0}catch(W){if(++J>=5)throw W;continue}if(G.status===202)continue;return this.finalize(G,Z)}}async finalize($,Z){if(!$.ok){let Y;try{Y=await $.json()}catch{Y={code:"UNKNOWN_ERROR",message:await $.text().catch(()=>$.statusText)}}throw new qJ($.status,Y,Z)}if($.status===204)return;let Q=await $.text();if(!Q)return;return JSON.parse(Q)}get($,Z){return this.request("GET",$,{query:Z})}post($,Z){return this.request("POST",$,{body:Z??{}})}patch($,Z){return this.request("PATCH",$,{body:Z??{}})}put($,Z){return this.request("PUT",$,{body:Z??{}})}putEmpty($){return this.request("PUT",$,{})}putBytes($,Z,Q,Y){return this.request("PUT",$,{query:Q,rawBody:Z,signal:Y})}async getBytes($,Z,Q={}){let Y={...this.authHeaders()};if(Q.range)Y.Range=Q.range;let X=await this.fetchImpl(this.url($,Z),{method:"GET",headers:Y,signal:Q.signal});if(!X.ok){let J;try{J=await X.json()}catch{J={code:"UNKNOWN_ERROR",message:await X.text().catch(()=>X.statusText)}}throw new qJ(X.status,J,$)}return X}delete($,Z){return this.request("DELETE",$,{query:Z})}}var Ja4="x-freestyle-identity-access-token",Nk$="x-freestyle-background-after-secs",Ga4="x-freestyle-background-request-id",Wa4=5,Ka4=2000,Ha4="https://api.freestyle.sh";var RK=L(()=>{h80();Uk$()});class dQ1{client;verifications;certificates;placeholder;constructor($){this.client=$,this.verifications=new Bk$($),this.certificates=new Dk$($),this.placeholder=new Lk$($)}async list(){let{domains:$}=await this.client.get("/v5/domains");return $}}class Bk${client;constructor($){this.client=$}create($){return this.client.post("/v5/verifications",{domain:$})}async list($={}){let{verifications:Z}=await this.client.get("/v5/verifications",$);return Z}get($){return this.client.get(`/v5/verifications/${i6($)}`)}complete($){return this.client.putEmpty(`/v5/verifications/${i6($)}`)}delete($){return this.client.delete(`/v5/verifications/${i6($)}`)}}class Dk${client;constructor($){this.client=$}async list(){let{certificates:$}=await this.client.get("/v5/certificates");return $}createWildcard($){return this.client.post("/v5/certificates/wildcard",{domain:$})}}class Lk${client;constructor($){this.client=$}async get(){try{return await this.client.get("/v5/domains/placeholder")}catch($){if($ instanceof qJ&&$.status===404)return null;throw $}}set($){return this.client.put("/v5/domains/placeholder",$)}delete(){return this.client.delete("/v5/domains/placeholder")}}var iQ1=L(()=>{RK();h80()});function Q5($,Z){throw new nQ1($,Z)}function pQ1($){return Na4.some((Z)=>$[Z]!==void 0)}function tQ1($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function Da4($,Z){let Q=Z.lastIndexOf("/");if(Q<0)Q5($,`${$} \`${Z}\` is not a CIDR: expected address/prefix, e.g. 203.0.113.0/24 or 2001:db8::/32`);let Y=Z.slice(0,Q),X=Z.slice(Q+1);if(!/^\d+$/.test(X))Q5($,`${$} \`${Z}\`: prefix length must be a number`);let J=Number(X),G=Y.includes(":"),W=G?128:32;if(J>W)Q5($,`${$} \`${Z}\`: prefix length must be 0\u2013${W}`);if(!G&&!/^\d{1,3}(\.\d{1,3}){3}$/.test(Y))Q5($,`${$} \`${Z}\`: \`${Y}\` is not an IP address`)}function Ek$($,Z){if(!tQ1($))Q5(Z,`${Z} must be an object`);for(let Y of Object.keys($))if(!Ok$.includes(Y))Q5(`${Z}.${Y}`,`${Z} has unknown field \`${Y}\`. Expected one of: ${Ok$.join(", ")}`);let Q=$;for(let Y of["vmId","vpcId","tunnelId","cidr"]){let X=Q[Y];if(X!==void 0&&(typeof X!=="string"||X.length===0))Q5(`${Z}.${Y}`,`${Z}.${Y} must be a non-empty string`)}if(Q.public!==void 0&&Q.public!==!0)Q5(`${Z}.public`,`${Z}.public must be true when present: it declares the public Internet. Omit the field to match something else`);if(Q.public===!0){if(Q.vmId!==void 0)Q5(`${Z}.public`,`${Z} cannot combine \`public: true\` with \`vmId\`: that would mean the VM only when reached over its public address, a distinction this API does not make yet. Use \`vmId\` alone to match the VM on any path, or \`public: true\` alone to match public addresses`);if(Q.vpcId!==void 0)Q5(`${Z}.public`,`${Z} cannot combine \`public: true\` with \`vpcId\`: that would mean the network's members only when reached over their public addresses, a distinction this API does not make yet. Use \`vpcId\` alone or \`public: true\` alone`);if(Q.tunnelId!==void 0)Q5(`${Z}.public`,`${Z} cannot combine \`public: true\` with \`tunnelId\`: traffic through a tunnel arrives over the tunnel, not over the public Internet. Use \`tunnelId\` alone`)}if(Q.cidr!==void 0)Da4(`${Z}.cidr`,Q.cidr);if(Q.protocol!==void 0&&!wk$.includes(Q.protocol))Q5(`${Z}.protocol`,`${Z}.protocol must be one of: ${wk$.join(", ")} (got \`${String(Q.protocol)}\`)`);if(Q.port!==void 0){if(!Number.isInteger(Q.port)||Q.port<1||Q.port>65535)Q5(`${Z}.port`,`${Z}.port must be an integer between 1 and 65535`);if(Q.protocol===void 0)Q5(`${Z}.protocol`,`${Z}.port ${Q.port} requires ${Z}.protocol: set it to "tcp" or "udp" so the rule opens one transport rather than both`);if(!Ba4.includes(Q.protocol))Q5(`${Z}.port`,`${Z}.protocol "${Q.protocol}" has no ports; remove ${Z}.port ${Q.port}`)}}function Ak$($,Z){if(!tQ1($))Q5(Z||"rule",`${Z||"rule"} must be an object`);for(let Y of Object.keys($))if(!Pk$.includes(Y))Q5(`${Z}${Y}`,`Unknown field \`${Y}\`. Expected one of: ${Pk$.join(", ")}`);let Q=$;if(Q.action===void 0)Q5(`${Z}action`,`${Z}action is required. Write \`action: "allow"\` \u2014 every rule states what it does rather than defaulting to it`);if(Q.action!=="allow")Q5(`${Z}action`,`${Z}action must be "allow" (got \`${String(Q.action)}\`). Only allow rules exist today`);if(Q.description!==void 0){if(typeof Q.description!=="string")Q5(`${Z}description`,"description must be a string");if(Q.description.length>jk$)Q5(`${Z}description`,`description is too long (${Q.description.length} characters, maximum ${jk$})`)}if(Q.source===void 0)Q5(`${Z}source`,`${Z}source is required`);if(Q.destination===void 0)Q5(`${Z}destination`,`${Z}destination is required`);return Ek$(Q.source,`${Z}source`),Ek$(Q.destination,`${Z}destination`),Q}function La4($){let Z=Ak$($,"");for(let Q of["source","destination"]){let Y=Z[Q];if(pQ1(Y))continue;let X=[Y.port!==void 0?`port ${Y.port}`:void 0,Y.protocol!==void 0?`protocol ${Y.protocol}`:void 0].filter(Boolean).join(", ");Q5(Q,X?`${Q} only narrows traffic (${X}) without saying what it is. Add \`vmId\`, \`vpcId\`, \`tunnelId\`, \`cidr\`, or \`public: true\`. Leaving it out to mean "this VM" only works inside vms.create`:`${Q} is empty. A matcher must say what the traffic is: \`vmId\`, \`vpcId\`, \`tunnelId\`, \`cidr\`, or \`public: true\` for the public Internet`)}return Z}function tq0($,Z="VM"){if($===void 0||$===null)Q5("firewall",`firewall is required on a ${Z} create. A ${Z} gets nothing implicitly, so state what it may reach \u2014 \`{ rules: [] }\` if the answer is nothing`);if(!tQ1($))Q5("firewall","firewall must be an object with a `rules` array");for(let Y of Object.keys($))if(Y!=="rules")Q5(`firewall.${Y}`,`firewall has unknown field \`${Y}\`. Expected: rules`);let Q=$.rules;if(!Array.isArray(Q))Q5("firewall.rules","firewall.rules must be an array");return Q.forEach((Y,X)=>{let J=`firewall.rules[${X}].`,G=Ak$(Y,J),W=pQ1(G.source),K=pQ1(G.destination);if(!W&&!K&&Z!=="network")Q5(`firewall.rules[${X}]`,`firewall.rules[${X}]: both source and destination refer to the ${Z} being created, which allows nothing. Give one of them a \`vmId\`, \`vpcId\`, \`tunnelId\`, \`cidr\`, or \`public: true\``);if(W&&K)Q5(`firewall.rules[${X}]`,`firewall.rules[${X}]: neither end refers to the ${Z} being created. Leave one endpoint's identity unset so it means this ${Z}, or create the rule with firewall.rules.create instead`)}),$}function zk$($){return`/v5/firewall/rules/${i6($)}`}class Tk${client;constructor($){this.client=$}async create($){let Z=La4($);return this.client.post("/v5/firewall/rules",Z)}list($={}){return this.client.get("/v5/firewall/rules",$)}get($){return this.client.get(zk$($))}delete($){return this.client.delete(zk$($))}}class oQ1{client;rules;constructor($){this.client=$,this.rules=new Tk$($)}evaluate($){return this.client.post("/v5/firewall/evaluate",$)}}var nQ1,Ok$,Na4,wk$,Ba4,jk$=1024,Pk$;var u80=L(()=>{RK();nQ1=class nQ1 extends Error{path;constructor($,Z){super(Z);this.name="FirewallRuleValidationError",this.path=$,Object.setPrototypeOf(this,nQ1.prototype)}};Ok$=["vmId","vpcId","tunnelId","cidr","public","port","protocol"],Na4=["vmId","vpcId","tunnelId","cidr","public"],wk$=["tcp","udp","icmp"],Ba4=["tcp","udp"];Pk$=["action","source","destination","description"]});function sQ1($){return`/v5/identities/${i6($)}`}class Rk${client;basePath;constructor($,Z){this.client=$,this.basePath=Z}create(){return this.client.post(`${this.basePath}/tokens`)}list(){return this.client.get(`${this.basePath}/tokens`)}revoke($){return this.client.delete(`${this.basePath}/tokens/${i6($)}`)}}class qk${client;basePath;constructor($,Z){this.client=$,this.basePath=Z}list(){return this.client.get(`${this.basePath}/permissions/vm`)}grant($){return this.client.post(`${this.basePath}/permissions/vm`,$)}get($){return this.client.get(`${this.basePath}/permissions/vm/${i6($)}`)}update($,Z){return this.client.patch(`${this.basePath}/permissions/vm/${i6($)}`,{allowedLinuxUsers:Z})}revoke($){return this.client.delete(`${this.basePath}/permissions/vm/${i6($)}`)}}class rQ1{id;tokens;permissions;client;basePath;constructor($,Z){this.client=$,this.id=Z,this.basePath=sQ1(Z),this.tokens=new Rk$($,this.basePath),this.permissions={vm:new qk$($,this.basePath)}}data(){return this.client.get(this.basePath)}delete(){return this.client.delete(this.basePath)}}class aQ1{client;constructor($){this.client=$}async create($={}){let Z=await this.client.post("/v5/identities",$);return{identity:new rQ1(this.client,Z.id),identityId:Z.id,data:Z}}list($={}){return this.client.get("/v5/identities",$)}get($){return this.client.get(sQ1($))}ref($){return new rQ1(this.client,$)}delete($){return this.client.delete(sQ1($))}}var eQ1=L(()=>{RK()});function h1($,Z){throw new YY1($,Z)}function j7($,Z){throw new XY1($,Z)}function l80($){return Oa4.some((Z)=>$[Z]!==void 0)}function Ra4($){return!l80($)&&$.port===void 0}function LX($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function hk$($,Z,Q){if(typeof $!=="string"||!Pa4.test($))j7(Z,`${Z} must be a valid HTTP header name`);let Y=$.toLowerCase();if(Ta4.has(Y)||Y.startsWith("x-forwarded-")||Y.startsWith("x-freestyle-")||Q&&(Y==="cookie"||Y==="set-cookie"))j7(Z,`${Z} may not use reserved header \`${$}\``)}function qa4($,Z){if(!Array.isArray($))j7(Z,`${Z} must be an array of header names`);if($.length>_k$)j7(Z,`${Z} may contain at most ${_k$} names`);let Q=new Set;$.forEach((Y,X)=>{hk$(Y,`${Z}[${X}]`,!0);let J=Y.toLowerCase();if(Q.has(J))j7(`${Z}[${X}]`,`${Z} contains duplicate header \`${Y}\``);Q.add(J)})}function bk$($){if(!LX($))j7("forwardAuth","forwardAuth must be an object");for(let Y of Object.keys($))if(!Ik$.includes(Y))j7(Y,`Unknown field \`${Y}\`. Expected one of: ${Ik$.join(", ")}`);let Z=$;if(typeof Z.url!=="string"||Z.url.length===0||Z.url.length>za4)j7("url","url is required and must be an absolute HTTPS URL");let Q;try{Q=new URL(Z.url)}catch{j7("url","url must be an absolute HTTPS URL")}if(Q.protocol!=="https:"||Q.hostname.length===0||Q.username.length>0||Q.password.length>0||Q.hash.length>0||Q.port==="0")j7("url","url must be an absolute HTTPS URL");if(Z.headers!==void 0){if(!LX(Z.headers))j7("headers","headers must be an object of header name to value");let Y=Object.entries(Z.headers);if(Y.length>Sk$)j7("headers",`headers may contain at most ${Sk$} entries`);let X=0,J=new Set;for(let[G,W]of Y){hk$(G,`headers.${G}`,!1);let K=G.toLowerCase();if(J.has(K))j7(`headers.${G}`,`headers contains duplicate header \`${G}\``);if(J.add(K),typeof W!=="string"||/[\0\r\n]/.test(W))j7(`headers.${G}`,`headers.${G} must be a string`);X+=G.length+W.length}if(X>Ck$)j7("headers",`headers may contain at most ${Ck$} bytes`)}if(Z.timeoutMs!==void 0&&(!Number.isInteger(Z.timeoutMs)||Z.timeoutMs<100||Z.timeoutMs>5000))j7("timeoutMs","timeoutMs must be an integer between 100 and 5000");if(Z.protectedCookies!==void 0){if(!Array.isArray(Z.protectedCookies))j7("protectedCookies","protectedCookies must be an array of cookie names");if(Z.protectedCookies.length>vk$)j7("protectedCookies",`protectedCookies may contain at most ${vk$} names`);let Y=new Set;Z.protectedCookies.forEach((X,J)=>{if(typeof X!=="string"||X.length>Aa4||!Ea4.test(X))j7(`protectedCookies[${J}]`,`protectedCookies[${J}] must be a valid HTTP cookie name`);if(Y.has(X))j7(`protectedCookies[${J}]`,`protectedCookies contains duplicate cookie \`${X}\``);Y.add(X)})}if(Z.authResponseHeaders!==void 0)qa4(Z.authResponseHeaders,"authResponseHeaders");return Z}function Ma4($,Z){if(!LX($))h1(Z,`${Z} must be an object with an \`id\``);for(let Y of Object.keys($))if(!kk$.includes(Y))h1(`${Z}.${Y}`,`${Z} has unknown field \`${Y}\`. Expected: ${kk$.join(", ")}`);let Q=$.id;if(typeof Q!=="string"||Q.length===0)h1(`${Z}.id`,`${Z}.id is required and must be a non-empty string`)}function QY1($){if(typeof $!=="string")h1("domain","domain is required and must be a string");if($==="*")return;let Z=$.startsWith("*.")?$.slice(2):$;if(Z.length===0||Z.length>wa4)h1("domain",`domain \`${$}\` is not a hostname`);let Q=Z.split(".");if(Q.length<2)h1("domain",`domain \`${$}\` must have at least two labels, e.g. acme.com`);for(let Y of Q){if(Y.length===0||Y.length>ja4)h1("domain",`domain \`${$}\` has an empty or over-long label`);if(!/^[a-z0-9-]+$/.test(Y))h1("domain",`domain \`${$}\`: labels are lowercase letters, digits, and hyphens (a \`*.\` prefix is the only wildcard)`);if(Y.startsWith("-")||Y.endsWith("-"))h1("domain",`domain \`${$}\`: a label cannot start or end with a hyphen`)}}function Va4($){if(typeof $!=="string")h1("domain","domain is required and must be a string");let Z=$.lastIndexOf("@");if(Z===-1){QY1($);return}let Q=$.slice(0,Z),Y=$.slice(Z+1);if(Q.length===0||Q.length>64)h1("domain",`mail route \`${$}\`: the part before \`@\` must be 1-64 characters`);if(Q.startsWith(".")||Q.endsWith(".")||Q.includes(".."))h1("domain",`mail route \`${$}\`: the part before \`@\` cannot start or end with a dot, or contain \`..\``);for(let X of Q)if(!/[a-zA-Z0-9]/.test(X)&&!xk$.includes(X))h1("domain",`mail route \`${$}\`: the part before \`@\` may use letters, digits, dots, and \`${xk$.slice(0,-1)}\` (quoted mailboxes are not supported)`);if(Y==="*")h1("domain",`mail route \`${$}\`: \`*\` is not a mail domain \u2014 name the domain the mailbox lives at`);QY1(Y)}function fk$($,Z){if(!LX($))h1(Z,`${Z} must be an object`);for(let Y of Object.keys($))if(!Mk$.includes(Y))h1(`${Z}.${Y}`,`${Z} has unknown field \`${Y}\`. Expected one of: ${Mk$.join(", ")}`);let Q=$;for(let Y of["vmId","vpcId","host"]){let X=Q[Y];if(X!==void 0&&(typeof X!=="string"||X.length===0))h1(`${Z}.${Y}`,`${Z}.${Y} must be a non-empty string`)}if(Q.public!==void 0&&Q.public!==!0)h1(`${Z}.public`,`${Z}.public must be true when present. Omit the field to match something else`);if(Z==="source"){if(Q.host!==void 0)h1("source.host","source.host is not allowed: a source is who opens the session, not where it lands. Put `host` on the destination");if(Q.port!==void 0)h1("source.port","source.port is not allowed: a source is who opens the session, not where it lands. Put `port` on the destination");if(Q.public===!0&&(Q.vmId!==void 0||Q.vpcId!==void 0))h1("source.public","source cannot combine `public: true` with `vmId` or `vpcId`: use one alone. `public` is every client on the Internet; `vmId`/`vpcId` is a specific dialer")}else{if(Q.vpcId!==void 0)h1("destination.vpcId","destination.vpcId is not allowed: a session lands in one place, not on a whole network. Name a `vmId`, a `host`, or `public: true` for the domain's own origin. A whole network may be a source");if([Q.vmId!==void 0,Q.host!==void 0,Q.public===!0].filter(Boolean).length>1)h1("destination","destination names more than one landing: give exactly one of `vmId`, `host`, or `public: true`");if((Q.vmId!==void 0||Q.host!==void 0)&&Q.port===void 0)h1("destination.port",`destination.port is required with ${Q.vmId!==void 0?"`vmId`":"`host`"}: say which port the session lands on`)}if(Q.port!==void 0){if(!Number.isInteger(Q.port)||Q.port<1||Q.port>65535)h1(`${Z}.port`,`${Z}.port must be an integer between 1 and 65535`)}}function Ia4($){if("postgres"in $)return"postgres";if("smtp"in $)return"smtp";if("socks5"in $)return"socks5";return"http"}function ka4($,Z){function Q(W,K,H){if(!LX(W)||Object.keys(W).some((F)=>!K.includes(F)))h1(H,`${H} must contain only ${K.join(", ")}`)}if(Q($,["region","credentials","scope"],Z),typeof $.region!=="string"||!/^[a-z0-9-]{1,63}$/.test($.region))h1(`${Z}.region`,"invalid s3.region");Q($.credentials,["accessKeyId","secretAccessKey","sessionToken"],`${Z}.credentials`);for(let W of["accessKeyId","secretAccessKey","sessionToken"]){let K=$.credentials[W];if(W==="sessionToken"&&K===void 0)continue;if(typeof K!=="string"||!/^[\x21-\x7e]{1,16384}$/.test(K))h1(`${Z}.credentials.${W}`,"invalid s3 credentials")}if(!/^[a-zA-Z0-9]+$/.test($.credentials.accessKeyId))h1(`${Z}.credentials.accessKeyId`,"invalid s3 access key id");Q($.scope,["bucket","prefix","operations"],`${Z}.scope`);let{bucket:Y,prefix:X,operations:J}=$.scope;if(typeof Y!=="string"||!/^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/.test(Y)||Y.includes(".."))h1(`${Z}.scope.bucket`,"invalid s3.scope.bucket");if(typeof X!=="string"||Buffer.byteLength(X,"utf8")>1024||/[\x00-\x1f\x7f-\x9f]/u.test(X))h1(`${Z}.scope.prefix`,"invalid s3.scope.prefix");let G=["GetObject","HeadObject","PutObject","DeleteObject","ListObjectsV2","CreateMultipartUpload","UploadPart","ListParts","CompleteMultipartUpload","AbortMultipartUpload","ListMultipartUploads"];if(!Array.isArray(J)||J.length===0||J.length>G.length||J.some((W)=>!G.includes(W))||new Set(J).size!==J.length)h1(`${Z}.scope.operations`,"s3.scope.operations must be a nonempty list of distinct supported operations")}function Sa4($,Z){if(!LX($))h1(Z,`${Z} must be an object: \`{ headers: { \u2026 } }\`, \`{ postgres: { \u2026 } }\`, \`{ smtp: { \u2026 } }\` or \`{ socks5: { \u2026 } }\``);let Q=Object.keys($);if(Q.length!==1||!["headers","jsonPatch","postgres","smtp","socks5","s3"].includes(Q[0]??""))h1(Z,`${Z} must have exactly one of \`headers\`, \`jsonPatch\`, \`postgres\`, \`smtp\`, \`socks5\` or \`s3\` (got: ${Q.length===0?"nothing":Q.join(", ")})`);if(Q[0]==="s3"){ka4($.s3,`${Z}.s3`);return}if(Q[0]==="jsonPatch"){let Y=$.jsonPatch;if(!Array.isArray(Y)||Y.length>128)h1(Z,`${Z}.jsonPatch must be an array of at most 128 operations`);let X=(W)=>typeof W==="string"&&(W===""||W.startsWith("/"))&&!/~(?:[^01]|$)/u.test(W),J=(W,K=new Set,H=0)=>{if(H>64)return!1;if(W===null||typeof W==="string"||typeof W==="boolean")return!0;if(typeof W==="number")return Number.isFinite(W);if(typeof W!=="object"||K.has(W))return!1;K.add(W);let F=(Array.isArray(W)?Array.from(W):LX(W)?Object.values(W):[void 0]).every((U)=>J(U,K,H+1));return K.delete(W),F};for(let[W,K]of Y.entries()){if(!LX(K)||!["add","remove","replace","move","copy","test"].includes(String(K.op))||!X(K.path))h1(Z,`${Z}.jsonPatch[${W}] requires a standard op and valid JSON Pointer path`);if(["move","copy"].includes(K.op)&&!X(K.from))h1(Z,`${Z}.jsonPatch[${W}].from must be a JSON Pointer`);if(["add","replace","test"].includes(K.op)&&(!Object.hasOwn(K,"value")||!J(K.value)))h1(Z,`${Z}.jsonPatch[${W}].value must be a JSON value (null is allowed)`)}let G;try{G=JSON.stringify(Y)}catch{h1(Z,"jsonPatch must be JSON serializable")}if(Buffer.byteLength(G,"utf8")>65536)h1(Z,"jsonPatch exceeds 64 KiB");return}if(Q[0]==="socks5"){let Y=$.socks5;if(!LX(Y))h1(`${Z}.socks5`,`${Z}.socks5 must be an object with \`username\` and \`password\``);for(let X of Object.keys(Y))if(!["username","password"].includes(X))h1(`${Z}.socks5.${X}`,`${Z}.socks5 has unknown field \`${X}\`. Expected: username, password`);for(let X of["username","password"])if(typeof Y[X]!=="string"||Y[X].length===0)h1(`${Z}.socks5.${X}`,`${Z}.socks5.${X} is required and must be a non-empty string`);return}if(Q[0]==="smtp"){let Y=$.smtp;if(!LX(Y))h1(`${Z}.smtp`,`${Z}.smtp must be an object with \`username\` and \`password\``);for(let X of Object.keys(Y))if(!["username","password"].includes(X))h1(`${Z}.smtp.${X}`,`${Z}.smtp has unknown field \`${X}\`. Expected: username, password`);for(let X of["username","password"])if(typeof Y[X]!=="string"||Y[X].length===0)h1(`${Z}.smtp.${X}`,`${Z}.smtp.${X} is required and must be a non-empty string`);return}if(Q[0]==="headers"){let Y=$.headers;if(!LX(Y))h1(`${Z}.headers`,`${Z}.headers must be an object of header name to value`);for(let[X,J]of Object.entries(Y))if(typeof J!=="string")h1(`${Z}.headers.${X}`,`${Z}.headers.${X} must be a string`)}else{let Y=$.postgres;if(!LX(Y))h1(`${Z}.postgres`,`${Z}.postgres must be an object with \`username\` and \`password\``);for(let J of Object.keys(Y))if(!["username","password","database"].includes(J))h1(`${Z}.postgres.${J}`,`${Z}.postgres has unknown field \`${J}\`. Expected: username, password, database`);let X=Y;for(let J of["username","password"])if(typeof X[J]!=="string"||X[J].length===0)h1(`${Z}.postgres.${J}`,`${Z}.postgres.${J} is required and must be a non-empty string`);if(X.database!==void 0&&typeof X.database!=="string")h1(`${Z}.postgres.database`,`${Z}.postgres.database must be a string`)}}function Ca4($,Z){let Q=$;return Z.forEach((Y,X)=>{let J=Ia4(Y);if(Q===void 0)Q=J;else if(Q!==J)h1(`transform[${X}]`,`transform requires protocol \`${J}\` but the rule is \`${Q}\`; a rule terminates one protocol`)}),Q??"http"}function _a4($,Z){if(!LX($)||Object.keys($).some((Q)=>Q!=="method"&&Q!=="path"))h1(Z,`${Z} must be an object containing only method and path`);if($.method!==void 0&&(!Array.isArray($.method)||$.method.some((Q)=>typeof Q!=="string"||Q.length===0||/[^!#$%&'*+.^_`|~0-9A-Za-z-]/.test(Q))))h1(`${Z}.method`,`${Z}.method must be an array of HTTP method tokens`);if($.path!==void 0){let Q=$.path;if(!LX(Q)||Object.keys(Q).length!==1||typeof Q.exact!=="string"||!Q.exact.startsWith("/")||/[\s?#]/.test(Q.exact))h1(`${Z}.path`,`${Z}.path must contain exact: an absolute path without a query or fragment`)}}function uk$($,Z){if(!LX($))h1(Z||"rule",`${Z||"rule"} must be an object`);for(let H of Object.keys($))if(!yk$.includes(H))h1(`${Z}${H}`,`Unknown field \`${H}\`. Expected one of: ${yk$.join(", ")}`);let Q=$;if(Q.action===void 0)h1(`${Z}action`,`${Z}action is required. Write \`action: "allow"\` \u2014 every rule states what it does rather than defaulting to it`);if(Q.action!=="allow")h1(`${Z}action`,`${Z}action must be "allow" (got \`${String(Q.action)}\`). Only allow rules exist today`);if(Q.protocol!==void 0&&!Vk$.includes(Q.protocol))h1(`${Z}protocol`,`${Z}protocol must be one of: ${Vk$.join(", ")} (got \`${String(Q.protocol)}\`)`);let Y=Q.source??{},X=Q.destination??{};fk$(Y,"source"),fk$(X,"destination");let J=Q.transform??[];if(!Array.isArray(J))h1(`${Z}transform`,`${Z}transform must be an array`);J.forEach((H,F)=>Sa4(H,`${Z}transform[${F}]`));let G=Ca4(Q.protocol,J);if(Q.match!==void 0){if(_a4(Q.match,`${Z}match`),G!=="http"||Y.public===!0||!(X.public===!0||X.host!==void 0))h1(`${Z}match`,"match requires HTTP egress from a VM or VPC to a public origin or host")}if(J.some((H)=>("s3"in H))){if(J.length!==1||Q.match!==void 0||Y.public===!0||!(X.public===!0||X.host!==void 0)||Q.domain.includes("*"))h1(`${Z}transform`,"s3 requires a sole transform on HTTP egress to a concrete origin, without match")}let W=J.filter((H)=>("jsonPatch"in H));if(W.length>1)h1(`${Z}transform`,"a rule may carry only one jsonPatch transform");if(W.length&&(Y.public===!0||!(X.public===!0||X.host!==void 0)))h1(`${Z}transform`,"jsonPatch requires HTTP egress from a VM or VPC to a public origin or host");if(Q.forwardAuth!==void 0){Ma4(Q.forwardAuth,`${Z}forwardAuth`);let H=X.vmId!==void 0||!l80(X)&&X.port!==void 0;if(G!=="http"||Y.public!==!0||!H||Q.domain==="*")h1(`${Z}forwardAuth`,`${Z}forwardAuth is only supported on HTTP public ingress: \`{ public: true } -> { vmId, port }\``)}if(G==="smtp")Va4(Q.domain);else QY1(Q.domain);if((Y.vmId!==void 0||Y.vpcId!==void 0)&&X.vmId!==void 0&&J.length>0)h1(`${Z}transform`,"a VM-to-VM rule cannot carry a transform yet \u2014 remove it (only public ingress/egress rules run transforms)");if(G==="tcp"){let H=X.public===!0||X.host!==void 0,F=Y.vmId!==void 0||Y.vpcId!==void 0;if(H||F)h1(`${Z}protocol`,"a `tcp` rule is public ingress only \u2014 `{ public: true } -> { vmId, port }`. The edge splices the session without terminating it, so outbound there is nothing to broker (an outbound allow is a firewall rule, and injecting into one needs `http` or `postgres`) and inward there is no certificate to answer the source with. Give the source `public: true`, or drop `protocol` to be served as HTTPS")}else if(G==="imap"||G==="imaps"){let H=X.public===!0||X.host!==void 0,F=Y.vmId!==void 0||Y.vpcId!==void 0;if(H||F)h1(`${Z}protocol`,`an \`${G}\` rule is public ingress only \u2014 \`{ public: true } -> { vmId, port }\`. The 993 front serves mail clients reaching a VM's IMAP server; outbound there is nothing to broker (an outbound allow is a firewall rule) and inward there is no certificate to answer the source with`)}else if(G==="socks5"){let H=X.public===!0||X.host!==void 0;if(Y.public===!0||!H)h1(`${Z}protocol`,'a `socks5` rule is egress only \u2014 `{ vmId } -> { host: "gate.provider.com", port: 1080 }`. The front exists so a guest can open sessions through a proxy whose credentials it never holds; inbound there is nothing to serve, and publishing one would be an open proxy on a platform address');if(X.host===void 0)h1(`${Z}destination`,"a `socks5` rule has to name the proxy it goes through: give the destination a `host` and the `port` the provider listens on. `{ public: true }` on its own asks the edge to be the proxy, which would let the guest out on our address rather than through yours")}else if(G==="postgres"){let H=J.some((U)=>U!==null&&typeof U==="object"&&("postgres"in U)),F=X.public===!0||X.host!==void 0;if(H&&!F)h1(`${Z}transform`,"a `postgres` transform belongs on an egress rule: the edge spends a credential the guest never holds, so pointing it at your own VM would hand every client a logged-in session. Give the destination `public: true` or a `host`, or drop the transform")}else if(G==="smtp"){let H=J.some((U)=>U!==null&&typeof U==="object"&&("smtp"in U)),F=X.public===!0||X.host!==void 0;if(H&&!F)h1(`${Z}transform`,"an `smtp` transform belongs on an egress rule: the edge spends a credential the guest never holds, so pointing it at your own VM would turn it into an open relay. Give the destination `public: true` or a `host`, or drop the transform");if(typeof Q.domain==="string"&&Q.domain.includes("@")&&Y.public!==!0)h1(`${Z}domain`,`\`${Q.domain}\` names a mailbox, which only makes sense on a rule that receives mail. An egress or VM-to-VM rule names the host the guest submits through \u2014 drop the part before \`@\``)}return{...Q,source:Y,destination:X}}function va4($,Z){if($==="source")return Ra4(Z)?"source is empty. Say who opens the session: `vmId`, `vpcId`, or `public: true`":"source only narrows the session without saying who opens it. Add `vmId`, `vpcId`, or `public: true`";return"destination is empty. Say where the session lands: `vmId` + `port`, `host` + `port`, or `public: true` for the domain's own origin"}function gk$($){let Z=uk$($,"");for(let Q of["source","destination"]){let Y=Z[Q];if(!l80(Y))h1(Q,va4(Q,Y))}if(Z.source.public===!0&&Z.destination.public===!0)h1("destination","a rule from the public Internet to the domain's own origin allows nothing the world cannot already do. Did you mean a `vmId` destination (ingress) or a `vmId` source (egress)?");return Z}function lk$($){if(!LX($))h1("tls","tls must be an object with a `rules` array");for(let Q of Object.keys($))if(Q!=="rules")h1(`tls.${Q}`,`tls has unknown field \`${Q}\`. Expected: rules`);let Z=$.rules;if(!Array.isArray(Z))h1("tls.rules","tls.rules must be an array");return Z.forEach((Q,Y)=>{let X=`tls.rules[${Y}].`,J=uk$(Q,X),G=l80(J.source),W=l80(J.destination);if(!G&&!W)h1(`tls.rules[${Y}]`,`tls.rules[${Y}]: both source and destination refer to the VM being created, which allows nothing. Give one of them a \`vmId\`, \`vpcId\`, or \`public: true\``);if(G&&W)h1(`tls.rules[${Y}]`,`tls.rules[${Y}]: neither end refers to the VM being created. Leave one endpoint's identity unset so it means this VM, or create the rule with tls.rules.create instead`);if(!W&&J.destination.port===void 0)h1(`tls.rules[${Y}].destination.port`,`tls.rules[${Y}]: destination.port is required: say which port on this VM the session lands on`)}),$}function $Y1($){return`/v5/tls/${i6($)}`}function ZY1($){return`/v5/tls/forward-auth/${i6($)}`}class ck${client;constructor($){this.client=$}list(){return this.client.get("/v5/tls/forward-auth")}async create($){let Z=bk$($);return this.client.post("/v5/tls/forward-auth",Z)}get($){return this.client.get(ZY1($))}async update($,Z){let Q=bk$(Z);return this.client.put(ZY1($),Q)}delete($){return this.client.delete(ZY1($))}}class mk${client;constructor($){this.client=$}async create($){let Z=gk$($);return this.client.post("/v5/tls",Z)}list($={}){return this.client.get("/v5/tls",$)}get($){return this.client.get($Y1($))}async update($,Z){let Q=gk$(Z);return this.client.put($Y1($),Q)}delete($){return this.client.delete($Y1($))}}class JY1{client;rules;forwardAuth;constructor($){this.client=$,this.rules=new mk$($),this.forwardAuth=new ck$($)}}var YY1,XY1,Mk$,Oa4,Vk$,wa4=253,ja4=63,Ik$,kk$,Ea4,Pa4,za4=2048,Sk$=32,Ck$=16384,_k$=32,vk$=32,Aa4=128,Ta4,xk$="!#$%&'*+-/=?^_`{|}~.",yk$;var oq0=L(()=>{RK();YY1=class YY1 extends Error{path;constructor($,Z){super(Z);this.name="TlsRuleValidationError",this.path=$,Object.setPrototypeOf(this,YY1.prototype)}};XY1=class XY1 extends Error{path;constructor($,Z){super(Z);this.name="TlsForwardAuthValidationError",this.path=$,Object.setPrototypeOf(this,XY1.prototype)}};Mk$=["vmId","vpcId","public","host","port"],Oa4=["vmId","vpcId","public","host"],Vk$=["tcp","http","postgres","minecraft","smtp","imap","imaps","socks5"],Ik$=["url","headers","timeoutMs","protectedCookies","authResponseHeaders"],kk$=["id"],Ea4=/^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/,Pa4=/^[0-9A-Za-z-]+$/,Ta4=new Set(["host","content-length","connection","keep-alive","proxy-authenticate","proxy-authorization","proxy-connection","te","trailer","transfer-encoding","upgrade"]);yk$=["action","domain","protocol","source","destination","transform","match","forwardAuth"]});function vi($){return`/v5/tunnels/${i6($)}`}function uy($){return $.tunnelId??=$.id,$}class GY1{client;constructor($){this.client=$}list(){return this.client.get("/v5/tunnels").then(($)=>{return $.tunnels.forEach(uy),$})}create($={}){return this.client.post("/v5/tunnels",$).then(uy)}get($){return this.client.get(vi($)).then(uy)}update($,Z){return this.client.patch(vi($),Z).then(uy)}rotateKey($,Z={}){return this.client.post(`${vi($)}/rotate-key`,Z).then(uy)}delete($){return this.client.delete(vi($))}attachVpc($,Z,Q={}){return this.client.post(`${vi($)}/vpcs/${i6(Z)}`,Q).then(uy)}detachVpc($,Z){return this.client.delete(`${vi($)}/vpcs/${i6(Z)}`).then(uy)}}var WY1=L(()=>{RK()});class KY1{client;basePath;constructor($,Z){this.client=$,this.basePath=Z}async readFile($,Z={}){let Q=await this.openRead($,Z);return new Uint8Array(await Q.arrayBuffer())}async readTextFile($,Z={}){return await(await this.openRead($,Z)).text()}async readFileStream($,Z={}){let Q=await this.openRead($,Z);if(!Q.body)throw Error(`no response body reading ${$}`);return Q.body}async writeFile($,Z,Q={}){let Y=typeof Z==="string"?new TextEncoder().encode(Z):Z,X=Y instanceof Uint8Array?Y.byteLength:Y.size;if(X>ba4)return this.uploadInChunks($,Y,X,Q);let J=Y instanceof Uint8Array?Y:new Uint8Array(await Y.arrayBuffer());await this.client.putBytes(`${this.basePath}/fs/write`,J,{path:$,mode:Q.mode,sha256:await dk$(J)},Q.signal),Q.onProgress?.({completedBytes:X,totalBytes:X})}writeTextFile($,Z,Q={}){return this.writeFile($,Z,Q)}async readDir($){let{entries:Z}=await this.client.get(`${this.basePath}/fs/dir`,{path:$});return Z}async mkdir($){await this.client.post(`${this.basePath}/fs/mkdir`,{path:$})}async remove($){await this.client.delete(`${this.basePath}/fs/remove`,{path:$})}async exists($){let{exists:Z}=await this.client.get(`${this.basePath}/fs/exists`,{path:$});return Z}stat($){return this.client.get(`${this.basePath}/fs/stat`,{path:$})}openRead($,Z){let{offset:Q,length:Y}=Z,X;if(Q!==void 0||Y!==void 0){let J=Q??0;X=Y===void 0?`bytes=${J}-`:`bytes=${J}-${J+Y-1}`}return this.client.getBytes(`${this.basePath}/fs/read`,{path:$},{range:X,signal:Z.signal})}async uploadInChunks($,Z,Q,Y){let X=Y.chunkSize??xa4,J=Y.maxAttempts??fa4,G=Z instanceof Uint8Array?await dk$(Z):void 0,W=await this.client.post(`${this.basePath}/fs/uploads`,{path:$,size:Q,sha256:G,mode:Y.mode}),K=`${this.basePath}/fs/uploads/${W.uploadId}`;try{let H=W.receivedBytes;while(H<Q){let F=Math.min(H+X,Q),U=Z instanceof Uint8Array?Z.subarray(H,F):Z.slice(H,F);H=(await this.putChunkWithRetry(K,U,H,J,Y.signal)).receivedBytes,Y.onProgress?.({completedBytes:Math.min(H,Q),totalBytes:Q})}await this.client.post(`${K}/commit`)}catch(H){throw await this.client.delete(K).catch(()=>{}),H}}async putChunkWithRetry($,Z,Q,Y,X){let J;for(let G=1;G<=Y;G++){X?.throwIfAborted?.();try{return await this.client.putBytes($,Z,{offset:Q},X)}catch(W){if(J=W,!(!(W instanceof qJ)||W.status>=500||W.status===408||W.status===409||W.status===429)||X?.aborted||G===Y)throw W;await ya4(Math.min(500*2**(G-1),8000));let H=await this.client.get($).catch(()=>{return});if(H&&H.receivedBytes>Q)return H}}throw J}}async function dk$($){let Z=globalThis.crypto?.subtle;if(!Z)return;let Q=await Z.digest("SHA-256",$);return Array.from(new Uint8Array(Q),(Y)=>Y.toString(16).padStart(2,"0")).join("")}function ya4($){return new Promise((Z)=>setTimeout(Z,$))}var ba4=8388608,xa4=16777216,fa4=5;var HY1=L(()=>{h80()});function ga4(){return typeof process<"u"&&Boolean(process.versions?.node)}async function ik$($,Z){if(ga4()){let Y;try{Y=await import("ws")}catch{throw Error("PTY sessions need the `ws` package in Node. Install it with `npm install ws`.")}return new Y.default($,{headers:Z})}let Q=globalThis.WebSocket;if(!Q)throw Error("PTY sessions need a WebSocket client; no global WebSocket is available in this environment.");return new Q($)}function c80($,Z,Q){if($.on){$.on(Z,Q);return}$.addEventListener?.(Z,Q)}function ua4($,Z){if($&&typeof $==="object"&&"data"in $){let Q=$.data;if(typeof Q==="string")return{text:Q};if(Q instanceof ArrayBuffer)return{binary:new Uint8Array(Q)};return{}}if($ instanceof Uint8Array)return Z?{binary:$}:{text:ha4.decode($)};if(typeof $==="string")return{text:$};return{}}class FY1{_sessionId;_slug;_created=!1;socket;constructor($,Z,Q={}){this.socket=$,this._sessionId=Z,c80($,"message",(Y,X)=>{let{text:J,binary:G}=ua4(Y,X);if(G){Q.onData?.(G);return}if(!J)return;let W;try{W=JSON.parse(J)}catch{return}if(W.type==="exited")Q.onExit?.(W.exitCode);else if(W.type==="error")Q.onError?.(Error(W.message));else if(W.type==="sessionInfo")this._sessionId=W.sessionId,this._slug=W.slug,this._created=W.created??!0,Q.onSessionInfo?.(W.sessionId)}),c80($,"close",(Y)=>{let X=Y;Q.onClose?.({wasClean:X?.wasClean??!0,code:X?.code??1000,reason:X?.reason??""})}),c80($,"error",(Y)=>Q.onError?.(Y))}write($){this.socket.send(typeof $==="string"?new TextEncoder().encode($):$)}resize($){this.sendControl({type:"resize",cols:$.cols,rows:$.rows})}signal($){this.sendControl({type:"signal",signal:$})}sendControl($){this.socket.send(JSON.stringify($))}detach(){this.socket.close()}get sessionId(){return this._sessionId}get slug(){return this._slug}get created(){return this._created}get readyState(){return this.socket.readyState}}function la4($){return new Promise((Z,Q)=>{if($.readyState===1){Z();return}c80($,"open",()=>Z()),c80($,"error",(Y)=>Q(Y))})}class UY1{client;basePath;constructor($,Z){this.client=$,this.basePath=Z}async open($={}){let{exec:Z,cols:Q,rows:Y,linuxUser:X,slug:J,replaceOnExit:G,onData:W,onExit:K,onClose:H,onError:F}=$,U={};if(Z!==void 0)U.exec=Z;if(Q!==void 0)U.cols=Q;if(Y!==void 0)U.rows=Y;if(X!==void 0)U.linuxUser=X;if(J!==void 0)U.slug=J;if(G!==void 0)U.replaceOnExit=String(G);let N=pk$(this.client,`${this.basePath}/pty`,U),B=this.client.authHeaders(),D=await ik$(N,B);return new Promise((O,w)=>{let j=!1,E=new FY1(D,-1,{onData:W,onExit:K,onClose:(P)=>{if(!j)j=!0,w(Error("connection closed before sessionInfo"));H?.(P)},onError:(P)=>{if(!j)j=!0,w(P);F?.(P)},onSessionInfo:()=>{j=!0,O(E)}})})}async attach($){let{session:Z,linuxUser:Q,onData:Y,onExit:X,onClose:J,onError:G}=$,W=pk$(this.client,`${this.basePath}/pty/sessions/${i6(String(Z))}`,{...Q!==void 0?{linuxUser:Q}:{}}),K=this.client.authHeaders(),H=await ik$(W,K),F=new FY1(H,typeof Z==="number"?Z:-1,{onData:Y,onExit:X,onClose:J,onError:G});return await la4(H),F}list($={}){return this.client.get(`${this.basePath}/pty/sessions`,$)}close($,Z={}){return this.client.delete(`${this.basePath}/pty/sessions/${i6(String($))}`,Z)}}class NY1{pty;linuxUser;constructor($,Z){this.pty=$,this.linuxUser=Z}open($={}){return this.pty.open({...$,linuxUser:this.linuxUser})}attach($){return this.pty.attach({...$,linuxUser:this.linuxUser})}list(){return this.pty.list({linuxUser:this.linuxUser})}close($){return this.pty.close($,{linuxUser:this.linuxUser})}}function pk$($,Z,Q){return $.url(Z,Q).replace(/^http/,"ws")}var ha4;var BY1=L(()=>{RK();ha4=new TextDecoder});class DY1{client;constructor($){this.client=$}list($={}){return this.client.get("/v5/snapshots",$)}get($){return this.client.get(`/v5/snapshots/${i6($)}`)}update($,Z){return this.client.patch(`/v5/snapshots/${i6($)}`,Z)}delete($){return this.client.delete(`/v5/snapshots/${i6($)}`)}}var LY1=L(()=>{RK()});var nk$=()=>{};function OY1($){return`/v5/vms/${i6($)}`}class wY1{id;fs;pty;client;basePath;constructor($,Z){this.client=$,this.id=Z,this.basePath=OY1(Z),this.fs=new KY1($,this.basePath),this.pty=new UY1($,this.basePath)}data(){return this.client.get(this.basePath)}firewallRules(){return this.client.get("/v5/firewall/rules",{vmId:this.id})}update($){return this.client.patch(this.basePath,$)}start(){return this.client.post(`${this.basePath}/start`)}pause(){return this.client.post(`${this.basePath}/pause`)}resize($){return this.client.post(`${this.basePath}/resize`,$)}delete(){return this.client.delete(this.basePath)}exec($){let Z=typeof $==="string"?{command:$}:$;return this.client.post(`${this.basePath}/exec-await`,Z)}linuxUser($){return new tk$(this,$)}snapshot($={}){return this.client.post(`${this.basePath}/snapshot`,$)}}class tk${vm;linuxUser;pty;constructor($,Z){this.vm=$,this.linuxUser=Z,this.pty=new NY1($.pty,Z)}exec($){let Z=typeof $==="string"?{command:$}:$;return this.vm.exec({...Z,linuxUser:this.linuxUser})}}class jY1{client;snapshots;constructor($){this.client=$,this.snapshots=new DY1($)}async create($){if(tq0($.firewall,"VM"),$.tls!==void 0)lk$($.tls);let Z=await this.client.post("/v5/vms",$);return{vm:new wY1(this.client,Z.id),vmId:Z.id,data:Z,firewallRules:Z.firewallRules??[],tlsRules:Z.tlsRules??[]}}list($={}){return this.client.get("/v5/vms",$)}get($){return this.client.get(OY1($))}ref($){return new wY1(this.client,$)}delete($){return this.client.delete(OY1($))}}var EY1=L(()=>{u80();oq0();RK();HY1();BY1();LY1();nk$();HY1();BY1();LY1()});function PY1($){return`/v5/vpcs/${i6($)}`}class ok${client;basePath;constructor($,Z){this.client=$,this.basePath=Z}list(){return this.client.get(`${this.basePath}/tunnels`)}}class zY1{id;tunnels;client;basePath;constructor($,Z){this.client=$,this.id=Z,this.basePath=PY1(Z),this.tunnels=new ok$($,this.basePath)}data(){return this.client.get(this.basePath)}update($){return this.client.patch(this.basePath,$)}delete(){return this.client.delete(this.basePath)}}class AY1{client;constructor($){this.client=$}list(){return this.client.get("/v5/vpcs")}async create($={}){if($.firewall!==void 0)tq0($.firewall,"network");let Z=await this.client.post("/v5/vpcs",$);return{vpc:new zY1(this.client,Z.id),vpcId:Z.id,data:Z,firewallRules:Z.firewallRules??[]}}get($){return this.client.get(PY1($))}ref($){return new zY1(this.client,$)}delete($){return this.client.delete(PY1($))}}var TY1=L(()=>{u80();RK()});class sq0{client;vms;vpc;tunnels;firewall;tls;domains;identities;constructor($={}){this.client=new mQ1($),this.vms=new jY1(this.client),this.vpc=new AY1(this.client),this.tunnels=new GY1(this.client),this.firewall=new oQ1(this.client),this.tls=new JY1(this.client),this.domains=new dQ1(this.client),this.identities=new aQ1(this.client)}fetch($,Z){return this.client.fetch($,Z)}}var sk$=L(()=>{RK();iQ1();u80();eQ1();oq0();WY1();EY1();TY1();RK();h80();EY1();TY1();WY1();iQ1();u80();oq0();eQ1()});var ak$;var rk$=L(()=>{ak$={name:"@decocms/sandbox",version:"1.93.0",private:!0,type:"module",description:"Sandbox runtime for isolated Studio tool execution",scripts:{check:"tsc --noEmit",test:"bun test",build:"bun run build:typegen && bun run build:harness-runner","build:typegen":"mkdir -p dist && bun run --cwd=../typegen build && bun --cwd=../typegen pm pack --filename $PWD/dist/typegen.tgz --quiet","build:harness-runner":"mkdir -p dist && bun --cwd=../harness-runner pm pack --filename $PWD/dist/harness-runner.tgz --quiet"},exports:{"./shared":"./shared.ts","./provider":"./server/provider/index.ts","./provider/agent-sandbox":"./server/provider/agent-sandbox/index.ts","./provider/postgres-state-store":"./server/provider/postgres-state-store.ts","./provider/freestyle":"./server/provider/freestyle.ts","./provider/remote":"./server/provider/remote.ts","./provider/router":"./server/provider/router.ts","./provider/sandbox-api":"./server/provider/sandbox-api.ts","./provider/sandbox-server":"./server/provider/sandbox-server.ts","./daemon-client":"./server/daemon-client.ts","./org-fs":"./org-fs.ts","./dispatch":"./dispatch/index.ts","./dispatch/*":"./dispatch/*.ts","./proxy/http":"./proxy/http.ts","./proxy/websocket":"./proxy/websocket.ts"},dependencies:{"@decocms/shared":"workspace:*","@kubernetes/client-node":"^1.4.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0",freestyle:"0.2.16",zod:"4.3.6"},devDependencies:{"@types/bun":"latest",postgres:"^3.4.5",typescript:"^7.0.2"}}});function rq0($){let Z=$?.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of studio-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"});return async(Q,Y)=>{if(!Z)return Y();let X=performance.now(),J=(G)=>Z.record(performance.now()-X,{runner_kind:Q,source:"daemon",status_code:G});try{let G=await Y();return J(G.status),G}catch(G){throw J(0),G}}}var RL;var aq0=L(()=>{RL={kubernetes:"agent-sandbox",freestyle:"freestyle"}});var KS$={};O6(KS$,{FreestyleSandboxProvider:()=>GS$});import{createHash as ek$,createHmac as ma4,randomBytes as da4}from"crypto";class GS${apiKey;freestyle;lookupClient;image;sidecarImage;allowUserNamespaces;idleTimeoutSeconds;idlePauseMs;autoDeleteSeconds;domainSuffix;timeDaemonRequest;inflight=new yy;snapshotInflight=new yy;knownSnapshots=new Set;lookups=new Map;releaseTimers=new Map;idleSweep=null;sweeping=!1;repoSnapshots=new Map;repoSnapshotBuilds=new Set;repoSnapshotFailures=new Map;constructor($){if(this.apiKey=$.apiKey,this.freestyle=$.client??new sq0({apiKey:$.apiKey}),this.lookupClient=$.client??new sq0({apiKey:$.apiKey,fetch:Object.assign((Z,Q)=>fetch(Z,{...Q,signal:Q?.signal?AbortSignal.any([Q.signal,AbortSignal.timeout(IY1)]):AbortSignal.timeout(IY1)}),{preconnect:fetch.preconnect})}),this.image=$.image??`ghcr.io/decocms/studio/studio-sandbox-go:${ak$.version}`,this.sidecarImage=$.orgFsSidecarImage??pa4,this.allowUserNamespaces=$.allowUserNamespaces??!1,this.idleTimeoutSeconds=$.idleTimeoutSeconds??300,this.idlePauseMs=$.idlePauseMs??600000,this.autoDeleteSeconds=$.autoDeleteSeconds??86400,this.domainSuffix=$.domainSuffix??"style.dev",this.timeDaemonRequest=rq0($.meter),this.idlePauseMs>0)this.idleSweep=setInterval(()=>void this.pauseIdle(),Qe4),this.idleSweep.unref?.()}async owns($){return await this.find($)!==null}daemonUrl($){return`https://${$}.${this.domainSuffix}`}async find($,Z={}){let Q=this.lookups.get($);if(!Z.refresh&&Q&&Date.now()-Q.at<(Q.found?aa4:ea4))return Q.found;let Y=null;try{let X=await this.lookupClient.vms.get($),J=X.metadata[RY1];if(J)Y={vm:this.freestyle.vms.ref(X.id),daemon:{url:this.daemonUrl($),token:J}}}catch(X){if(!(X instanceof qJ&&X.status===404))throw X}return this.remember($,Y),Y}remember($,Z){if(this.lookups.delete($),this.lookups.size>=$e4){let Q=this.lookups.keys().next();if(!Q.done)this.lookups.delete(Q.value)}this.lookups.set($,{found:Z,at:Date.now()})}async warm(){await this.baseSnapshot().catch(($)=>console.warn(`[${s7}] base snapshot warm failed: ${cy($)}`))}baseSnapshot(){let{image:$,sidecarImage:Z}=this,Q=this.allowUserNamespaces?`
+${X}`:X}var LI$,ds4;var EQ1=L(()=>{LI$=/[\r\n<>]/,ds4=/^[^\s@<>]+@[^\s@<>]+\.[^\s@<>]+$/});var Sq0=L(()=>{r$();EQ1()});function ps4($){if($ instanceof TypeError)return!0;if($ instanceof Error&&!($ instanceof DOMException)&&typeof $.code==="string")return!0;if($ instanceof DOMException&&$.name==="AbortError")return!0;return!1}async function PQ1($,Z,Q,Y){try{return await D8(async()=>{let J=await fetch($,{...Z,signal:AbortSignal.timeout(Y)});return{status:J.status,ok:J.ok,body:await J.text()}},{maxAttempts:3,minTimeout:50,maxTimeout:500,multiplier:2,jitter:0.5,isRetriable:ps4})}catch(X){let J=X instanceof Error?X.message:String(X);throw Error(`[SANDBOX_UNREACHABLE] sandbox daemon ${Q} request failed: ${J}`,{cause:X})}}async function Cq0($){try{let Z=await fetch(`${$}/health`,{signal:AbortSignal.timeout(ns4)});if(!Z.ok){try{await Z.text()}catch{}return null}let Q=await Z.json();if(typeof Q==="object"&&Q!==null&&typeof Q.bootId==="string"&&typeof Q.ready==="boolean"&&Q.setup&&typeof Q.setup.running==="boolean"&&typeof Q.setup.done==="boolean")return Q;return null}catch{return null}}async function AQ1($){for(let Z=0;Z<wI$;Z++){if(await Cq0($)!==null)return;let Q=(Math.random()*2-1)*ts4;await F$(jI$+Q)}throw Error(`sandbox daemon at ${$} did not respond on /health within ${wI$*jI$/1000}s`)}async function AK($,Z,Q,Y,X){return os4($,Z,"POST",Q,Y,X)}async function os4($,Z,Q,Y,X,J){let G={...Y};if(X&&X.rotateToken!==void 0)G.auth=X;let W=await PQ1(`${$}/_sandbox/config`,{method:Q,headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:JSON.stringify(G)},"/_sandbox/config",J?.timeoutMs??zQ1);if(!W.ok)throw new AJ(W.status,W.body);return PI$(W.body,"/_sandbox/config")}async function EI$($,Z,Q){let Y=await PQ1(`${$}/_sandbox/setup/${Q}`,{method:"POST",headers:{Authorization:`Bearer ${Z}`}},`/_sandbox/setup/${Q}`,zQ1);if(!Y.ok)throw Error(`sandbox daemon /_sandbox/setup/${Q} returned ${Y.status}: ${Y.body}`)}async function _80($,Z,Q){let Y=await PQ1(`${$}/_sandbox/orgfs-config`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:Q},"/_sandbox/orgfs-config",zQ1);if(!Y.ok)throw Error(`sandbox daemon /_sandbox/orgfs-config returned ${Y.status}: ${Y.body}`);return PI$(Y.body,"/_sandbox/orgfs-config")}function PI$($,Z){try{return JSON.parse($)}catch(Q){throw Error(`sandbox daemon ${Z} returned a malformed JSON body: ${$.slice(0,200)}`,{cause:Q})}}async function _q0($,Z,Q,Y){let X=new Headers(Y.headers);for(let W of ss4)X.delete(W);X.set("authorization",`Bearer ${Z}`);let J=Y.method!=="GET"&&Y.method!=="HEAD",G=`${$}${Q.startsWith("/")?Q:`/${Q}`}`;return fetch(G,{method:Y.method,headers:X,body:J?Y.body:void 0,redirect:"manual",signal:Y.signal,duplex:J?"half":void 0})}var AJ,ns4=500,zQ1=30000,wI$=25,jI$=200,ts4=50,ss4;var fy=L(()=>{Sq0();r$();AJ=class AJ extends Error{status;constructor($,Z){super(`sandbox daemon /_sandbox/config returned ${$}: ${Z}`);this.status=$;this.name="ConfigRequestError"}};ss4=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length"]});class vq0{counted=new Set;markCounted($){this.counted.add($)}consume($){return this.counted.delete($)}}class yy{map=new Map;async run($,Z){let Q=this.map.get($);if(Q)return Q;let Y=Z();this.map.set($,Y);try{return await Y}finally{this.map.delete($)}}}function bq0($,Z,Q){if(!$)return Q(null);if(!$.withLock)return Q($);return $.withLock(Z,Q)}function v80($){if(!$.orgId||!$.virtualMcpId||!$.branch)throw Error("composeSandboxRef: orgId, virtualMcpId and branch are all required for agent refs");return`agent:${$.orgId}:${$.virtualMcpId}:${$.branch}`}function zI$($){if(!$.startsWith("agent:"))return"";let Z=$.split(":");return Z.length>=4?Z.slice(3).join(":"):""}import{hash as rs4}from"crypto";function as4($,Z=16){return rs4("sha256",K2$($),"hex").slice(0,Z)}function m3($){let Z=as4($),Q=es4(zI$($.projectRef));return Q?`${Q}-${Z}`:`s-${Z}`}function es4($){if(!$)return"";let Z=$.split("/").pop()??"",Q="",Y=!1;for(let X of Z.toLowerCase()){let J=X.charCodeAt(0),G=J>=97&&J<=122,W=J>=48&&J<=57;if(!G&&!W){Y||=Q.length>0;continue}if(Y){if(Q.length+1>=AI$)break;Q+="-",Y=!1}if(Q+=X,Q.length===AI$)break}return Q}var AI$=24;var TI$=L(()=>{jZ1()});function xq0($,Z){let Q=$.replace(/\/+$/,"");if(Q.includes("{handle}"))return`${Q.replace("{handle}",Z)}/`;try{let Y=new URL(Q);return Y.hostname=`${Z}.${Y.hostname}`,`${Y.toString()}/`}catch{return`${Q}/${Z}/`}}function Mi($){let Z=$.repo,Q=Z?{repository:{cloneUrl:Z.cloneUrl,repoName:Z.displayName??$r4(Z.cloneUrl),...Z.branch?{branch:Z.branch}:{},submoduleCredentials:Z.submoduleCredentials??[]},repositories:($.extraRepos??[]).filter((K)=>!!K.directoryName).map((K)=>({cloneUrl:K.cloneUrl,repoName:K.directoryName,...K.branch?{branch:K.branch}:{},submoduleCredentials:K.submoduleCredentials??[]})),...Z.userName.trim()||Z.userEmail.trim()?{identity:{userName:Z.userName,userEmail:Z.userEmail}}:{}}:void 0,Y=$.tenant,X=qi({userName:Y?.userName,userEmail:Y?.userEmail})??void 0,J=$.packageManager?{name:$.packageManager.name,...$.packageManager.path?{path:$.packageManager.path}:{}}:void 0,G=J?{packageManager:J,runtime:$.runtime,...$.port!==void 0?{port:$.port}:{}}:void 0,W=Y?.orgId;if(!Q&&!G&&!X&&$.cloneOnly===void 0&&!W)return null;return{...Q?{git:Q}:{},...X?{operator:X}:{},...W?{orgId:W}:{},...$.cloneOnly!==void 0?{cloneOnly:$.cloneOnly}:{},...G?{application:G}:{}}}function $r4($){try{let Z=new URL($);return Z.pathname.replace(/^\/+/,"").replace(/\.git$/,"")||Z.hostname}catch{return $}}var RI$=L(()=>{EQ1()});function Zr4($){try{return new URL($).username.length>0}catch{return!1}}function b80($){let Z=$.repo?.cloneUrl;if(!Z||!Zr4(Z))return null;return{git:{repository:{cloneUrl:Z}}}}var Vi=L(()=>{TI$();RI$()});async function*VI$($){let Z=$.now??(()=>Date.now()),Q=Z(),Y=$.schedulingTimeoutMs??Yr4,X={pod:{},sandbox:{},events:{hasPulling:!1,hasPulled:!1},startedAt:Q},J=[],G=null,W=!1,K=(E)=>{if(W)return;if(G){let P=G;G=null,P(E)}else J.push(E)},H=()=>{if(J.length>0)return Promise.resolve(J.shift());if(W)return Promise.resolve(null);return new Promise((E)=>{G=E})},F=()=>{if(W)return;if(W=!0,G){let E=G;G=null,E(null)}},U=new AbortController,N=()=>{U.abort(),F()};if($.signal)if($.signal.aborted)U.abort(),F();else $.signal.addEventListener("abort",N,{once:!0});let B=Math.max(0,Y-(Z()-Q)),D=setTimeout(()=>K("tick"),B+100),O,w=new Promise((E)=>{O=E}),j=Promise.allSettled([Jr4($.kc,$.namespace,$.claimName,U.signal,X,K,Z,O),Wr4($.kc,$.namespace,$.claimName,U.signal,X,K),Kr4($.kc,$.namespace,$.claimName,w,U.signal,X,K,Z)]);try{let E=null,P=-1,T=qI$(X,Y,Z);if(E=RQ1(T),!TQ1(T))P=MI$(T);if(yield T,TQ1(T))return;while(!W){if(await H()===null)break;let A=qI$(X,Y,Z);if(TQ1(A)){let C=RQ1(A);if(C!==E)E=C,yield A;return}let q=MI$(A);if(q<P)continue;let x=RQ1(A);if(x!==E)E=x,P=q,yield A}}finally{if(clearTimeout(D),U.abort(),$.signal)$.signal.removeEventListener("abort",N);F(),await j.catch(()=>{})}}async function II$($,Z=Xr4){let Q=new AbortController,Y="claiming",X,J=()=>{clearTimeout(X),X=setTimeout(()=>Q.abort(),Z)};try{J();for await(let G of $(Q.signal)){if(G.kind==="ready")return;if(G.kind==="failed")throw new NX(G.message);Y=G.kind,J()}}finally{clearTimeout(X),Q.abort()}throw new Fi(`Sandbox did not become ready: no progress for ${Math.round(Z/1000)}s while ${Y}`)}function qI$($,Z,Q){let{pod:Y,sandbox:X,events:J,startedAt:G}=$;if(X.ready)return{kind:"ready"};let W=Y.containerWaitingReason;if(W==="ImagePullBackOff"||W==="ErrImagePull")return{kind:"failed",reason:"image-pull-backoff",message:"Sandbox image failed to download. The cluster may be missing pull credentials or the image tag may not exist."};if(W==="CrashLoopBackOff")return{kind:"failed",reason:"crash-loop-backoff",message:"Sandbox crashed during startup and is now in CrashLoopBackOff. Check pod logs."};if(!Y.scheduled&&J.lastFailedSchedulingAt!==void 0&&Q()-G>Z)return{kind:"failed",reason:"scheduling-timeout",message:J.failedSchedulingMessage??`Pod could not be scheduled within ${Math.round(Z/1000)}s.`};if(Y.containerRunning&&!Y.containerReady)return{kind:"warming-daemon",since:G};if(J.hasPulling&&!J.hasPulled)return{kind:"pulling-image",since:G};if(W==="ContainerCreating"||W==="PodInitializing"||Y.scheduled&&!Y.containerRunning)return{kind:"starting-container",since:G};if(Y.scheduledFalseReason==="Unschedulable"||J.lastFailedSchedulingAt!==void 0&&!Y.scheduled)return{kind:"waiting-for-capacity",since:G,message:J.failedSchedulingMessage??Y.scheduledFalseMessage,nodeClaim:J.nominatedNodeClaim};return{kind:"claiming",since:G}}function TQ1($){return $.kind==="ready"||$.kind==="failed"}function MI$($){switch($.kind){case"claiming":return 0;case"waiting-for-capacity":return 1;case"pulling-image":return 2;case"starting-container":return 3;case"warming-daemon":return 4;case"ready":case"failed":return 99}}function RQ1($){switch($.kind){case"claiming":case"pulling-image":case"starting-container":case"warming-daemon":return $.kind;case"waiting-for-capacity":return`waiting-for-capacity:${$.message??""}:${$.nodeClaim??""}`;case"ready":return"ready";case"failed":return`failed:${$.reason}:${$.message}`}}async function Jr4($,Z,Q,Y,X,J,G,W){let K=`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?watch=true&labelSelector=${encodeURIComponent(`${Qr4}=${Q}`)}`;return fq0({kc:$,path:K,signal:Y,label:`pod/${Q}`,onEvent:(H)=>{if(H.type!=="ADDED"&&H.type!=="MODIFIED")return;let F=H.object;if(F.metadata?.name)W(F.metadata.name);Gr4(F,X,G),J("pod")}})}function Gr4($,Z,Q){let X=($.status?.conditions??[]).find((G)=>G.type==="PodScheduled");if(X?.status==="True")Z.pod.scheduled=!0,Z.pod.scheduledFalseReason=void 0,Z.pod.scheduledFalseMessage=void 0;else if(X?.status==="False")Z.pod.scheduled=!1,Z.pod.scheduledFalseReason=X.reason,Z.pod.scheduledFalseMessage=X.message;let J=($.status?.containerStatuses??[]).find((G)=>G.name===Y7.MAIN_CONTAINER_NAME);if(J)Z.pod.containerWaitingReason=J.state?.waiting?.reason,Z.pod.containerRunning=!!J.state?.running,Z.pod.containerReady=J.ready===!0}async function Wr4($,Z,Q,Y,X,J){let G=`/apis/${Y7.CLAIM_API_GROUP}/${Y7.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(Z)}/${Y7.CLAIM_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${Q}`)}`;return fq0({kc:$,path:G,signal:Y,label:`sandboxclaim/${Q}`,onEvent:(W)=>{if(W.type!=="ADDED"&&W.type!=="MODIFIED")return;let H=W.object.status?.conditions?.find((F)=>F.type==="Ready");if(!H)return;if(H.status==="True")X.sandbox.ready=!0,X.sandbox.notReadyReason=void 0,X.sandbox.notReadyMessage=void 0;else X.sandbox.ready=!1,X.sandbox.notReadyReason=H.reason,X.sandbox.notReadyMessage=H.message;J("sandbox")}})}async function Kr4($,Z,Q,Y,X,J,G,W){let K=await Promise.race([Y,new Promise((F)=>{if(X.aborted){F(Q);return}X.addEventListener("abort",()=>F(Q),{once:!0})})]);if(X.aborted)return;let H=`/api/v1/namespaces/${encodeURIComponent(Z)}/events?watch=true&fieldSelector=${encodeURIComponent(`involvedObject.name=${K},involvedObject.kind=Pod`)}`;return fq0({kc:$,path:H,signal:X,label:`events/${Q}`,onEvent:(F)=>{if(F.type!=="ADDED"&&F.type!=="MODIFIED")return;let U=F.object,N=U.reason;if(!N)return;switch(N){case"Pulling":J.events.hasPulling=!0;break;case"Pulled":J.events.hasPulling=!0,J.events.hasPulled=!0;break;case"FailedScheduling":J.events.lastFailedSchedulingAt=W(),J.events.failedSchedulingMessage=U.message;break;case"Nominated":{let B=U.message?.match(/nodeclaim\/([\w-]+)/);if(B)J.events.nominatedNodeClaim=B[1];break}default:return}G("event")}})}async function kI$($){let{kc:Z,namespace:Q,labelSelector:Y,signal:X,onDelete:J}=$,G=`/apis/${Y7.CLAIM_API_GROUP}/${Y7.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(Q)}/${Y7.CLAIM_PLURAL}?watch=true&labelSelector=${encodeURIComponent(Y)}`;return fq0({kc:Z,path:G,signal:X,label:"sandboxclaim-reaper",onEvent:(W)=>{if(W.type!=="DELETED")return;let K=W.object.metadata?.name;if(K)J(K)}})}async function fq0($){let{kc:Z,path:Q,signal:Y,label:X,onEvent:J}=$,G=0;while(!Y.aborted){try{let K=await PK(Z,{method:"GET",path:Q,signal:Y,headers:{accept:"application/json"},stream:!0});if(!K.ok||!K.body){try{await K.body?.cancel()}catch{}if(K.status===401||K.status===403){console.warn(`[lifecycle-watcher] ${X} stopped: watch denied (${K.status} ${K.statusText}). `+"The kubeconfig in use cannot watch SandboxClaims \u2014 if you are running locally, "+"this provider should not be active (check STUDIO_AGENT_SANDBOX_ENABLED).");return}throw Error(`watch handshake failed: ${K.status} ${K.statusText}`)}G=0;for await(let H of u2$(K.body)){if(Y.aborted)return;try{J(H)}catch(F){console.warn(`[lifecycle-watcher] ${X} onEvent threw: ${F instanceof Error?F.message:String(F)}`)}}}catch(K){if(Y.aborted)return;let H=K instanceof Error?K.message:String(K);console.warn(`[lifecycle-watcher] ${X} watch ended: ${H}`)}if(Y.aborted)return;let W=V7(5000,250,G,2,0);G+=1,await F$(W,{signal:Y}).catch(()=>{})}}var Qr4="studio.decocms.com/sandbox-handle",Yr4=300000,Xr4=600000;var SI$=L(()=>{r$();F80();BN0()});import{createHash as Hr4}from"crypto";import{z as TJ}from"zod";function TK($){let Z;try{Z=new URL($.trim())}catch{return null}if(Z.protocol!=="https:"||Z.search||Z.hash)return null;let Q=Z.pathname.replace(/\/+$/,"").replace(/\.git$/,"").replace(/\/+$/,"");return Q?`https://${Z.host.toLowerCase()}${Q}`:null}function x80($){return TK($)?.toLowerCase()??null}function Dr4($){let Z=new Set;for(let Q of $){let Y=`${x80(Q.repoUrl)??Q.repoUrl}#${Q.branch}`;if(Z.has(Y))return Q;Z.add(Y)}return null}function CI$($){return $.reduce((Z,Q)=>Z+Q.replicas,0)}function vI$($,Z){if(Z.warmPoolName)return Z.warmPoolName;let Q=Hr4("sha256").update(`${Z.repoUrl}#${Z.branch}`).digest("hex").slice(0,8);return`${$}-${Q}`}function bI$($){return Math.max(0,$.size-CI$($.repos))}function Ii($){return $.flatMap((Z)=>Z.repos.map((Q)=>({pool:Z,repo:Q,warmPoolName:vI$(Z.name,Q)})))}function Lr4($,Z){return gI$(void 0,$,!0,Z)}function xI$($,{templateName:Z}){let Q=Lr4(Z,$.image),Y=(X,J)=>({apiVersion:`${Y7.CLAIM_API_GROUP}/${Y7.CLAIM_API_VERSION}`,kind:"SandboxWarmPool",metadata:{name:X,labels:{[Or4]:$.name}},spec:{replicas:J,updateStrategy:{type:"OnReplenish"},sandboxTemplateRef:{name:Q}}});return[...$.repos.map((X)=>Y(vI$($.name,X),X.replicas)),Y($.name,bI$($))]}function fI$($){return $.tenant?.orgId}function MQ1($,Z){if(!Z.tenant)return null;let Q=$.filter((J)=>J.tenant===Z.tenant&&J.image===Z.image),Y=Z.cloneUrl?x80(Z.cloneUrl):null;if(Y){let J=Ii(Q).filter((W)=>x80(W.repo.repoUrl)===Y),G=J.find((W)=>W.repo.branch===Z.branch)??J[0];if(G)return G}let X=Q.find((J)=>bI$(J)>0);return X?{pool:X,repo:null,warmPoolName:X.name}:null}function yI$($,Z,Q){return $?.warmPoolName??(Z?Q:"none")}function gI$($,Z,Q=!1,Y){let X=Y&&Y!=="default"?`-${Y}`:"";return`${Z}${X}${$==="harness-run"||Q?"-medium":""}`}async function VQ1($){let Z=gI$($.purpose,$.templateName,$.tenantPool,$.sandboxImage);if(Z===$.templateName)return{name:Z,probes:$.probes};let Q=$.probes[Z]??null,Y=Q!==null&&$.now-Q.checkedAt<$.ttlMs?Q:{checkedAt:$.now,present:await $.exists(Z)},X={...$.probes,[Z]:Y};if(Y.present)return{name:Z,probes:X};if(Q?.present!==!1)$.onAbsent?.(Z);if($.sandboxImage&&$.sandboxImage!=="default")return VQ1({...$,sandboxImage:void 0,probes:X});return{name:$.templateName,probes:X}}function IQ1($,Z,Q){let Y=x80(Z);if(!Y)return[];let X=Q.replace(/^refs\/heads\//,"");return Ii($).filter(({repo:J})=>x80(J.repoUrl)===Y&&J.branch===X)}class kQ1{source;dirty=new Set;pods=new Map;known=new Map;constructor($){this.source=$}pools(){return this.source()}resolve($){return MQ1(this.pools(),$)}markDirty($,Z){let Q=IQ1(this.pools(),$,Z).map((Y)=>Y.warmPoolName);for(let Y of Q)this.dirty.add(Y);return Q}takeDirty($){return this.dirty.delete($)}pod($){return this.pods.get($)}setPod($,Z){this.pods.set($,Z)}retainPods($,Z){for(let[Q,Y]of this.pods)if(Y.pool===$&&!Z.has(Q))this.pods.delete(Q)}retain($){let Z=new Map($.map((Y)=>[Y.warmPoolName,Y])),Q=[...this.known.values()].filter((Y)=>!Z.has(Y.warmPoolName));for(let Y of this.dirty)if(!Z.has(Y))this.dirty.delete(Y);for(let[Y,X]of this.pods)if(!Z.has(X.pool))this.pods.delete(Y);return this.known=Z,Q}}var Fr4=54,Ur4,Nr4=2048,Br4,f80,yq0,qQ1,_I$,Or4="studio.decocms.com/tenant-pool";var y80=L(()=>{t4();F80();Ur4=/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/;Br4=TJ.object({runtime:TJ.enum(["node","bun","deno"]).default("node"),packageManager:TJ.enum(["npm","pnpm","yarn","bun","deno"]).optional(),packageManagerPath:TJ.string().optional(),devPort:TJ.number().int().positive().optional()}).default({runtime:"node"}),f80=TJ.object({repoUrl:TJ.string().max(Nr4).transform(($,Z)=>{let Q=TK($);if(Q)return Q;return Z.addIssue({code:"custom",message:"repoUrl must be an https clone URL"}),TJ.NEVER}),branch:TJ.string().min(1).default("main"),workload:Br4,replicas:TJ.number().int().min(1)});yq0=class yq0 extends Error{poolName;size;allocated;constructor($,Z,Q){super(`pool ${$}: repos take ${Q} replicas, more than its size ${Z}`);this.poolName=$;this.size=Z;this.allocated=Q;this.name="TenantPoolCapacityError"}};qQ1=TJ.object({name:TJ.string().max(Fr4).regex(Ur4,"pool name must be a DNS label (lowercase alphanumeric and '-')"),tenant:TJ.string().min(1).max(512),size:TJ.number().int().min(1),image:UN.default("default")}),_I$=qQ1.extend({repos:TJ.array(f80).default([])}).superRefine(($,Z)=>{let Q=Dr4($.repos);if(Q)Z.addIssue({code:"custom",path:["repos"],message:`duplicate repo allocation ${Q.repoUrl}#${Q.branch}`});let Y=CI$($.repos);if(Y>$.size)Z.addIssue({code:"custom",path:["repos"],message:new yq0($.name,$.size,Y).message})})});async function hI$($,Z,Q){let Y=new Map;for(let X of $){let J=Z(X);if(!J)continue;let G=Y.get(J);if(G)G.push(X);else Y.set(J,[X])}await Promise.allSettled([...Y.values()].map(async(X)=>{for(let J of X)await Q(J).catch(()=>{})}))}function wr4($){try{let Z=new URL($);if(Z.hostname.toLowerCase()!=="github.com")return null;let[Q,Y]=Z.pathname.replace(/^\/+/,"").split("/"),X=Y?.replace(/\.git$/,"");return Q&&X?`${Q}/${X}`.toLowerCase():null}catch{return null}}function uI$($){if($.repositoryId)return{repositoryId:$.repositoryId};let Z=$.connectionId?wr4($.cloneUrl):null;return $.connectionId&&Z?{connectionId:$.connectionId,repo:Z}:null}var lI$=L(()=>{y80()});async function ki($,Z,Q,Y){let X=(G)=>_q0(G.url,G.token,Z,Q),J=!(Q.body instanceof ReadableStream);try{let G=await X($);if(G.status!==401||!J)return G;let W=await Y.unauthorized();if(!W)return G;return await G.body?.cancel().catch(()=>{}),await X(W)}catch(G){if(!J)throw G;let W=await Y.unreachable();if(!W)throw G;return X(W)}}var gq0=L(()=>{fy()});function dI$($,Z){return new Response(JSON.stringify(Z),{status:$,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function cI$($){let Z=new Headers;for(let[Q,Y]of $.headers.entries())if(!Er4.includes(Q.toLowerCase()))Z.set(Q,Y);return new Response($.body,{status:$.status,statusText:$.statusText,headers:Z})}function mI$($,Z){let Q=dI$($,{error:Z});return Q.headers.set("x-sandbox-preview-not-ready","1"),Q}async function Ci($,Z,Q){let Y=await Z.base();if(!Y)return mI$(404,"sandbox not found");let X=new URL($.url);if((X.pathname==="/_sandbox"||X.pathname.startsWith("/_sandbox/"))&&$.method!=="GET")return dI$(404,{error:"not found"});let G=(F)=>`${F}${X.pathname}${X.search}`,W=new Headers($.headers);for(let F of jr4)W.delete(F);let K=$.method!=="GET"&&$.method!=="HEAD",H={method:$.method,headers:W,body:K?$.body:void 0,redirect:"manual",signal:$.signal,duplex:K?"half":void 0};try{return cI$(await fetch(G(Y),H))}catch(F){let U=`${Y}${X.pathname}`;if(console.warn(`[${Q}] preview fetch to ${U} failed: ${F instanceof Error?F.message:String(F)}`),Z.invalidate(),$.method==="GET"||$.method==="HEAD"){let N=await Z.retryBase();if(N)try{return cI$(await fetch(G(N),H))}catch(B){console.warn(`[${Q}] preview fetch retry to ${U} failed: ${B instanceof Error?B.message:String(B)}`)}}return mI$(502,"sandbox daemon unreachable")}}var Si="x-sandbox-preview-not-ready",jr4,Er4;var hq0=L(()=>{jr4=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length","upgrade"],Er4=["connection","keep-alive","transfer-encoding","content-encoding","content-length"]});import{createHash as Pr4,randomBytes as zr4,randomUUID as iI$}from"crypto";import*as aI$ from"net";import{PassThrough as Ar4}from"stream";function pI$($){if($ instanceof Error)return $.message;if($&&typeof $==="object"){let Z=$;if(Z.error instanceof Error)return Z.error.message;if(typeof Z.message==="string"&&Z.message)return Z.message}return String($)}function oI$($){return{pool:$.warmPoolName,org:$.pool.tenant}}class fQ1{records=new Map;inflight=new yy;activeGauge=new vq0;stateStore;previewUrlPattern;kubeConfig;capacityProbe;portForward;namespace;sandboxTemplateName;envName;tokenGenerator;idleTtlMs;metrics;previewGateway;sentinelToken;mintCloneUrl;mintPoolCloneUrl;mintOrgFsConfig;forwardPort;daemonAddress;persistCredentials;tenantPools;tenantPoolRefreshMs;templateProbes={};closed=!1;claimWatchAbort=new AbortController;constructor($={}){this.stateStore=$.stateStore??null,this.previewUrlPattern=$.previewUrlPattern??null,this.kubeConfig=$.kubeConfig??xr4(),this.portForward=new QQ1(this.kubeConfig),this.namespace=$.namespace??Tr4,this.sandboxTemplateName=$.sandboxTemplateName??Rr4,this.envName=ur4($.envName),this.tokenGenerator=$.tokenGenerator??(()=>zr4(Mr4).toString("hex")),this.idleTtlMs=$.idleTtlMs??Ir4,this.metrics=$.meter?br4($.meter):null,this.previewGateway=$.previewGateway&&$.previewUrlPattern?{...$.previewGateway}:null;let Z=$.sentinelToken?.trim()??"";this.sentinelToken=Z.length>0?Z:null,this.mintCloneUrl=$.mintCloneUrl,this.mintPoolCloneUrl=$.mintPoolCloneUrl,this.mintOrgFsConfig=$.mintOrgFsConfig,this.forwardPort=$.forwardPort,this.daemonAddress=$.daemonAddress??"forward",this.persistCredentials=$.persistCredentials??!0;let Q=$.tenantPools;if(this.tenantPools=this.sentinelToken===null?null:new kQ1(typeof Q==="function"?Q:()=>Q??[]),this.sentinelToken===null&&(typeof Q==="function"||(Q?.length??0)>0))console.warn(`[${V6}] tenant pools configured without a sentinel token \u2014 ignoring them (warm-pool mode is off)`);this.tenantPoolRefreshMs=$.tenantPoolRefreshMs??Sr4,this.startClaimReaper(),this.startCredentialRefresher(),this.startTenantPoolReconciler()}startClaimReaper(){let $=["app.kubernetes.io/managed-by=studio","app.kubernetes.io/name=studio-sandbox",...this.envName?[`${RJ.env}=${this.envName}`]:[]].join(",");kI$({kc:this.kubeConfig,namespace:this.namespace,labelSelector:$,signal:this.claimWatchAbort.signal,onDelete:(Z)=>this.invalidateRecord(Z)})}async ensure($,Z={}){let Q=m3($);if(Q.startsWith("s-"))throw Error(`ensure: projectRef has no slug source: ${$.projectRef}`);return this.inflight.run(Q,()=>bq0(this.stateStore,$,(Y)=>this.ensureLocked($,Q,Z,Y)))}async delete($){let Z=await this.getRecord($);if(this.records.delete($),Z)this.dropRecord(Z);if(await this.deleteHttpRouteIfManaged($).catch((Q)=>{console.warn(`[${V6}] HTTPRoute delete failed for ${$}: ${Q instanceof Error?Q.message:String(Q)}`)}),await KR(this.kubeConfig,this.namespace,$),this.stateStore)if(Z)await this.stateStore.delete(Z.id);else await this.stateStore.deleteByHandle($)}lastTermination($){return C2$(this.kubeConfig,this.namespace,RJ.sandboxHandle,$,Y7.MAIN_CONTAINER_NAME)}async alive($){return await wL(this.kubeConfig,this.namespace,$)!==void 0}watchClaimLifecycle($,Z){return VI$({kc:this.kubeConfig,namespace:this.namespace,claimName:$,signal:Z})}hasSchedulableCapacity(){return this.capacityProbe??=c2$(this.kubeConfig,this.namespace),this.capacityProbe()}async getPreviewUrl($){let Z=await this.getRecord($);if(!Z)return null;return this.composePreviewUrl(Z)}async proxyDaemonRequest($,Z,Q){let Y=await this.getRecord($);if(!Y&&this.previewUrlPattern&&this.stateStore){let K=await this.stateStore.getByHandle($),H=K?.state,F=H?.token;if(K&&F){let N=`http://${H?.adoptedSandboxName??$}.${this.namespace}.svc.cluster.local:${bN}`;try{let B=await _q0(N,F,Z,Q);if(B.status!==404)return B;try{await B.body?.cancel()}catch{}}catch{}}}if(!Y)Y=await this.resurrectByHandle($);if(!Y)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let X=Y,J=performance.now(),G=0,W=(K)=>{return X=K,{url:K.daemonUrl,token:K.token}};try{let K=await ki(W(Y),Z,Q,{unauthorized:async()=>{this.invalidateRecord($);let H=await this.getRecord($).catch(()=>null)??await this.resurrectByHandle($).catch(()=>null);return H?W(H):null},unreachable:async()=>{this.invalidateRecord($);let H=await this.resurrectByHandle($)??await this.getRecord($).catch(()=>null);return H?W(H):null}});return G=K.status,K}finally{this.recordProxyDuration("daemon",G,X,performance.now()-J)}}async adoptLiveClaim($,Z){if(this.records.has(Z))return!0;let Q=await wL(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!Q||Q.metadata?.deletionTimestamp)return!1;return await this.inflight.run(Z,async()=>{let X=this.records.get(Z);if(X)return this.toSandbox(X);let J=await this.adopt($,Z,Q);if(!J)throw Error(`cannot adopt live claim ${Z}`);return bq0(this.stateStore,$,(G)=>this.finish(J,G,!0,!0,"adopt"))}).catch(()=>null)!=null}async resolvePreviewUpstreamUrl($){if(this.previewUrlPattern)return`http://${await this.resolveServiceNameForHandle($)}.${this.namespace}.svc.cluster.local:${bN}`;let Z=await this.getRecord($);if(Z)return Z.daemonUrl;let Q=await this.resurrectByHandle($);return Q?Q.daemonUrl:null}async daemonEndpoint($){let Z=await this.getRecord($)??await this.resurrectByHandle($);if(!Z)return null;return{url:this.daemonAddress==="service"?`http://${Z.adoptedSandboxName}.${this.namespace}.svc.cluster.local:${bN}`:Z.daemonUrl,token:Z.token}}listSandboxes(){return[...this.records.values()].map(($)=>{let Z=$.ensureOpts,Q=Z?.tenant;return{handle:$.handle,tenant:Q?{orgId:Q.orgId,userId:Q.userId}:null,repos:[Z?.repo,...Z?.extraRepos??[]].filter((Y)=>Y!==void 0).map(uI$).filter((Y)=>Y!==null),orgFs:Boolean(Z?.orgFsConfigJson)||$.orgFsRedacted===!0}})}async resolveServiceNameForHandle($){let Z=this.records.get($);if(Z)return Z.adoptedSandboxName;if(this.stateStore){let Y=(await this.stateStore.getByHandle($).catch(()=>null))?.state?.adoptedSandboxName;if(Y)return Y}return $}async proxyPreviewRequest($,Z){let Q=performance.now(),Y=this.records.get($)??null,X=0;try{let J=await Ci(Z,{base:()=>this.resolvePreviewUpstreamUrl($),invalidate:()=>this.invalidateRecord($),retryBase:async()=>{return await this.resurrectByHandle($).catch(()=>null)?this.resolvePreviewUpstreamUrl($):null}},V6);return X=J.status,J}finally{this.recordProxyDuration("preview",X,Y,performance.now()-Q,$)}}async ensureLocked($,Z,Q,Y){if(Q.image)console.warn(`[${V6}] opts.image ignored (template ${this.sandboxTemplateName} pins image): got ${Q.image}`);if(Y){let G=await Y.get($);if(G){let W=await this.rehydrate($,Z,G);if(W)return await this.refreshDaemonGitCredential(W,Q),await this.relayOrgFsConfig(W.daemonUrl,W.token,Q.orgFsConfigJson),this.finish(W,Y,!1,!0,"resume");await Y.delete($)}}let X=await wL(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(X)if(X.metadata?.deletionTimestamp)await B80(this.kubeConfig,this.namespace,Z).catch((G)=>{console.warn(`[${V6}] wait for terminating claim ${Z} failed: ${G instanceof Error?G.message:String(G)}`)});else if(!SQ1(X)){let G=await this.join($,Z,Q,X).catch((W)=>{return console.warn(`[${V6}] join of starting claim ${Z} failed, recreating: ${W instanceof Error?W.message:String(W)}`),null});if(G)return this.finish(G,Y,!0,!0,"adopt");await KR(this.kubeConfig,this.namespace,Z).catch(()=>{}),await B80(this.kubeConfig,this.namespace,Z).catch((W)=>{console.warn(`[${V6}] wait for deleted claim ${Z} failed: ${W instanceof Error?W.message:String(W)}`)})}else{let G=await this.adopt($,Z,X).catch((W)=>{return console.warn(`[${V6}] adopt ${Z} failed, recreating: ${W instanceof Error?W.message:String(W)}`),null});if(G)return await this.refreshDaemonGitCredential(G,Q),await this.relayOrgFsConfig(G.daemonUrl,G.token,Q.orgFsConfigJson),this.finish(G,Y,!0,!0,"adopt");await KR(this.kubeConfig,this.namespace,Z).catch(()=>{}),await B80(this.kubeConfig,this.namespace,Z).catch((W)=>{console.warn(`[${V6}] wait for deleted claim ${Z} failed: ${W instanceof Error?W.message:String(W)}`)})}let J=await this.provision($,Z,Q);return this.finish(J,Y,!0,!1,"fresh")}async finish($,Z,Q,Y,X){let J=this.records.get($.handle),G=J!==void 0;if(J&&J.daemonForward!==$.daemonForward)this.closeForwarder(J.daemonForward);if(this.records.set($.handle,$),Q)await this.persist(Z,$);if(Y)await NN0(this.kubeConfig,this.namespace,$.handle,this.computeShutdownTime()).catch((W)=>console.warn(`[${V6}] TTL refresh failed for ${$.handle}: ${W instanceof Error?W.message:String(W)}`));if(this.metrics){let W=vQ1($.tenant);if(this.metrics.ensureOutcome.add(1,{...W,outcome:X}),!G)this.metrics.active.add(1,W),this.activeGauge.markCounted($.handle)}return this.toSandbox($)}buildEnvMap($,Z){let Q={},Y=[];for(let[X,J]of Object.entries($.env??{}))if(Vr4.has(X))Y.push(X);else Q[X]=J;if(Y.length>0)console.warn(`[${V6}] opts.env keys overlap reserved bootstrap names and were dropped: ${Y.join(",")}`);return{...Q,DAEMON_TOKEN:Z.token,DAEMON_BOOT_ID:Z.daemonBootId,APP_ROOT:Z.workdir,PROXY_PORT:String(bN)}}async resolveTemplateName($,Z,Q){let{name:Y,probes:X}=await VQ1({purpose:$,tenantPool:Z,...Q?{sandboxImage:Q}:{},templateName:this.sandboxTemplateName,probes:this.templateProbes,now:Date.now(),ttlMs:qr4,exists:(J)=>V2$(this.kubeConfig,this.namespace,J),onAbsent:(J)=>console.warn(`[${V6}] SandboxTemplate ${J} not found (or not readable) \u2014 this claim falls back to a template without that suffix. Upgrade the sandbox-env chart to the version that renders it.`)});return this.templateProbes=X,Y}buildClaim($,Z,Q,Y,X){let J=this.sentinelToken!==null,G=J?[]:Object.entries(this.buildEnvMap(Z,Q)).sort(([H],[F])=>H<F?-1:H>F?1:0).map(([H,F])=>({name:H,value:F})),W=mr4(Z),K=Object.keys(W).length>0;return{apiVersion:`${Y7.CLAIM_API_GROUP}/${Y7.CLAIM_API_VERSION}`,kind:"SandboxClaim",metadata:{name:$,namespace:this.namespace,labels:{"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[RJ.env]:this.envName}:{},..._Q1(Z.tenant)},...K?{annotations:W}:{}},spec:{sandboxTemplateRef:{name:X},additionalPodMetadata:{labels:_Q1(Z.tenant,{[RJ.role]:"claimed",[RJ.sandboxHandle]:$,...this.envName?{[RJ.env]:this.envName}:{}}),...K?{annotations:W}:{}},env:G,warmpool:yI$(Y,J,X),lifecycle:{shutdownPolicy:"Delete",shutdownTime:this.computeShutdownTime()}}}}async provision($,Z,Q){let Y=this.tokenGenerator(),X=iI$(),J=uq0,G=this.claimTenantPoolBinding(Q),W=this.buildClaim(Z,Q,{token:Y,daemonBootId:X,workdir:J},G,await this.resolveTemplateName(Q.purpose,G!==null,Q.sandboxImage));try{await TZ1(this.kubeConfig,this.namespace,W)}catch(K){if(K instanceof H80)await B80(this.kubeConfig,this.namespace,Z),await TZ1(this.kubeConfig,this.namespace,W);else throw K}return this.bind($,Z,Q,G,{token:Y,daemonBootId:X,workdir:J})}claimTenantPoolBinding($){return this.tenantPools?.resolve({tenant:fI$($),image:$.sandboxImage??"default",cloneUrl:$.repo?.cloneUrl,branch:$.repo?.branch})??null}async bind($,Z,Q,Y,{token:X,daemonBootId:J,workdir:G}){let W;try{W=await I2$(this.kubeConfig,this.namespace,Z),await II$((B)=>this.watchClaimLifecycle(Z,B))}catch(B){throw await KR(this.kubeConfig,this.namespace,Z).catch(()=>{}),B}try{await this.ensureServicePortForAdoptedSandbox(W),await this.ensureHttpRouteForHandle(Z,W,Q.tenant??null)}catch(B){throw await KR(this.kubeConfig,this.namespace,Z).catch(()=>{}),B}let K=await this.openForwarder(W,bN,Z),H=`http://127.0.0.1:${K.localPort}`,F=Y?.repo!=null&&W!==Z,U=this.workloadConfigPayload(Q,F),N=J;try{if(await AQ1(H),this.sentinelToken!==null){let B=await Cq0(H);if(B)N=B.bootId;try{await AK(H,this.sentinelToken,U??{},{rotateToken:X})}catch(D){if(D instanceof AJ&&D.status===401)console.warn(`[${V6}] sentinel rejected by adopted pod (handle=${Z}, sandbox=${W}): pod belongs to another claim; tearing down and reprovisioning`);throw D}}else if(U)await AK(H,X,U);await this.relayOrgFsConfig(H,X,Q.orgFsConfigJson)}catch(B){throw this.closeForwarder(K),await this.deleteHttpRouteIfManaged(Z).catch(()=>{}),await KR(this.kubeConfig,this.namespace,Z).catch(()=>{}),B}return{id:$,handle:Z,adoptedSandboxName:W,token:X,workdir:G,daemonUrl:H,daemonForward:K,workload:Q.workload??null,daemonBootId:N,tenant:Q.tenant??null,tenantPoolPodBound:F,ensureOpts:or4(Q)}}workloadConfigPayload($,Z){return Mi({runtime:$?.workload?.runtime??"node",packageManager:$?.workload?.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:$?.repo??null,extraRepos:$?.extraRepos??[],port:$?.workload?.devPort??nI$,tenant:$?.tenant??void 0,...$?{cloneOnly:$.cloneOnly===!0&&!Z}:{}})}async relayOrgFsConfig($,Z,Q){if(!Q)return;await _80($,Z,Q).catch((Y)=>console.warn("[org-fs] sidecar config relay failed",Y))}async refreshDaemonGitCredential($,Z){let Q=b80(Z);if(!Q)return;try{await AK($.daemonUrl,$.token,Q)}catch(Y){console.warn(`[${V6}] git credential refresh failed for ${$.handle}: ${Y instanceof Error?Y.message:String(Y)}`)}}async withFreshCloneUrl($,Z={}){if(!this.mintCloneUrl)return $;try{let Q=await this.mintCloneUrl($,Z);if(!Q)return $;let{credentialExpiresAt:Y,...X}=$;return{...X,cloneUrl:Q}}catch(Q){return console.warn(`[${V6}] clone credential re-mint failed: ${Q instanceof Error?Q.message:String(Q)}`),$}}async withFreshCredentials($,Z=!1){return{...$,...$.repo?{repo:await this.withFreshCloneUrl($.repo,{tenant:$.tenant})}:{},...$.orgFsConfigJson||Z?{orgFsConfigJson:await nr4($,this.mintOrgFsConfig)}:{}}}startCredentialRefresher(){if(!this.mintCloneUrl)return;let{signal:$}=this.claimWatchAbort;(async()=>{while(!$.aborted){if(await F$(Cr4,{signal:$}).catch(()=>{}),$.aborted)break;try{await this.refreshAllGitCredentials()}catch(Z){console.warn(`[${V6}] periodic credential refresh failed: ${Z instanceof Error?Z.message:String(Z)}`)}}})()}startTenantPoolReconciler(){let $=this.tenantPools;if(!$)return;let{signal:Z}=this.claimWatchAbort;(async()=>{while(!Z.aborted){try{await this.reconcileTenantPools($)}catch(Q){console.warn(`[${V6}] tenant pool reconcile failed: ${Q instanceof Error?Q.message:String(Q)}`)}await F$(kr4,{signal:Z}).catch(()=>{})}})()}listTenantPools(){return this.tenantPools?.pools()??[]}markTenantPoolsDirty($,Z){return Promise.resolve(this.tenantPools?.markDirty($,Z)??[])}async reconcileTenantPools($){let Z=Ii($.pools());for(let Q of $.retain(Z))this.recordPoolGone(Q);for(let Q of Z){let Y=Q.warmPoolName,X=await k2$(this.kubeConfig,this.namespace,Y);if(X===null){console.warn(`[${V6}] tenant pool ${Y}: no SandboxWarmPool (or no selector yet) in ${this.namespace}`);continue}let J=$.takeDirty(Y),G=X.filter((W)=>!W.labels[RJ.sandboxHandle]);$.retainPods(Y,new Set(X.map((W)=>W.uid)));for(let W of G){if(this.claimWatchAbort.signal.aborted)return;await this.warmPoolPod($,Q,W,J)}this.recordPoolDepth($,Q,X,G)}}recordPoolGone($){let Z=oI$($);for(let Q of["ready","bound","pending","failed"])this.metrics?.poolPods.record(0,{...Z,state:Q})}recordPoolDepth($,Z,Q,Y){let X=this.metrics?.poolPods;if(!X)return;let J=0,G=0;for(let K of Y){let H=$.pod(K.uid);if(!H)continue;if(H.failures>=lq0)G++;else if(H.lastConfigAt>0)J++}let W=oI$(Z);X.record(J,{...W,state:"ready"}),X.record(Q.length-Y.length,{...W,state:"bound"}),X.record(Y.length-J-G,{...W,state:"pending"}),X.record(G,{...W,state:"failed"})}async warmPoolPod($,Z,Q,Y){let X=Z.warmPoolName,{workload:J}=Z.repo,G=$.pod(Q.uid);if(G&&G.failures>=lq0){if(Date.now()-G.lastFailureAt<tI$)return;$.setPod(Q.uid,{...G,failures:0})}let W=Y||G!==void 0&&Date.now()-G.lastConfigAt>=this.tenantPoolRefreshMs;if(G&&!W)return;let K=await this.allocationCloneUrl(Z);if(!K){this.recordPoolFailure($,Q,X,"clone credential mint failed");return}let H={cloneUrl:K,branch:Z.repo.branch,userName:"",userEmail:""},F=await this.openForwarder(Q.name,bN,Q.name).catch(()=>null);if(!F){this.recordPoolFailure($,Q,X,"port-forward failed");return}let U=`http://127.0.0.1:${F.localPort}`;try{await AQ1(U);let N=this.sentinelToken;if(!N)return;if(!await this.isPoolPodUnbound(Q))return;let B=Mi({runtime:J.runtime,packageManager:J.packageManager?{name:J.packageManager,...J.packageManagerPath?{path:J.packageManagerPath}:{}}:null,repo:H,port:J.devPort??nI$})??{},{transition:D}=await AK(U,N,B);if(W&&D!=="bootstrap"&&await this.isPoolPodUnbound(Q))await EI$(U,N,"clone");$.setPod(Q.uid,{pool:X,lastConfigAt:Date.now(),lastFailureAt:0,failures:0}),console.log(`[${V6}] tenant pool ${X}: warmed ${Q.name} (${D})`)}catch(N){this.recordPoolFailure($,Q,X,N instanceof Error?N.message:String(N))}finally{this.closeForwarder(F)}}async allocationCloneUrl({pool:$,repo:Z}){if(!this.mintPoolCloneUrl)return`${Z.repoUrl}.git`;try{return await this.mintPoolCloneUrl({tenant:$.tenant,repoUrl:Z.repoUrl,branch:Z.branch})}catch(Q){return console.warn(`[${V6}] tenant pool clone credential mint failed: ${Q instanceof Error?Q.message:String(Q)}`),null}}isPoolPodUnbound($){return S2$(this.kubeConfig,this.namespace,$.name,RJ.sandboxHandle)}recordPoolFailure($,Z,Q,Y){let X=$.pod(Z.uid),J=(X?.failures??0)+1;$.setPod(Z.uid,{pool:Q,lastConfigAt:X?.lastConfigAt??0,lastFailureAt:Date.now(),failures:J});let G=J>=lq0?` \u2014 backing off ${tI$/60000}min`:"";console.warn(`[${V6}] tenant pool ${Q}: warming ${Z.name} failed (${J}/${lq0})${G}: ${Y}`)}async refreshAllGitCredentials(){await hI$(this.records.values(),($)=>$.ensureOpts?.repo?.connectionId,async($)=>{if(this.claimWatchAbort.signal.aborted)return;let Z=$.ensureOpts?.repo;if(!Z)return;try{let Q=await this.withFreshCloneUrl(Z,{bufferMs:_r4,tenant:$.ensureOpts?.tenant});await this.refreshDaemonGitCredential($,{...$.ensureOpts,repo:Q}),$.ensureOpts={...$.ensureOpts,repo:Q}}catch(Q){throw console.warn(`[${V6}] git credential refresh failed for ${$.handle}: ${Q instanceof Error?Q.message:String(Q)}`),Q}})}async rebootstrapDaemon($,Z,Q){if(this.sentinelToken===null)return!1;let Y=this.workloadConfigPayload(Q,!1)??{};try{return await AK($,this.sentinelToken,Y,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,Q?.orgFsConfigJson),!0}catch(X){if(X instanceof AJ&&X.status===401)try{return await AK($,Z,Y,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,Q?.orgFsConfigJson),!0}catch(J){return console.warn(`[${V6}] re-bootstrap retry with claim token failed: ${J instanceof Error?J.message:String(J)}`),!1}return console.warn(`[${V6}] re-bootstrap failed: ${X instanceof Error?X.message:String(X)}`),!1}}async ensureServicePortForAdoptedSandbox($){if(!this.previewGateway||!this.previewUrlPattern)return;await h2$(this.kubeConfig,this.namespace,$,{name:"daemon",port:bN,targetPort:bN})}async ensureHttpRouteForHandle($,Z,Q){if(!this.previewGateway||!this.previewUrlPattern)return;let Y=sr4(this.previewUrlPattern,$);if(!Y)throw new NX(`Unable to derive preview hostname for ${$} from pattern: ${this.previewUrlPattern}`);let X={apiVersion:`${qZ1.API_GROUP}/${qZ1.API_VERSION}`,kind:"HTTPRoute",metadata:{name:$,namespace:this.namespace,labels:_Q1(Q??void 0,{[RJ.role]:"claimed",[RJ.sandboxHandle]:$,"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[RJ.env]:this.envName}:{}})},spec:{parentRefs:[{kind:"Gateway",group:"gateway.networking.k8s.io",name:this.previewGateway.name,namespace:this.previewGateway.namespace}],hostnames:[Y],rules:[{backendRefs:[{group:"",kind:"Service",name:Z,port:bN}]}]}};await f2$(this.kubeConfig,this.namespace,X)}async deleteHttpRouteIfManaged($){if(!this.previewGateway)return;await y2$(this.kubeConfig,this.namespace,$)}async rehydrate($,Z,Q){let Y=Q.state;if(!Y.adoptedSandboxName&&!Y.podName||!Y.token)return null;let X=await wL(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!X||!SQ1(X))return null;let J=X.status?.sandbox?.name??Y.adoptedSandboxName??Y.podName??Z,G=await this.openAndProbeDaemon(J,Z);if(!G)return null;if(Y.daemonBootId&&Y.daemonBootId!==G.bootId){if(this.sentinelToken!==null){let W=Y.ensureOpts?await this.withFreshCredentials(Y.ensureOpts,Y.orgFsRedacted===!0):null;if(!await this.rebootstrapDaemon(G.daemonUrl,Y.token,W))return this.closeForwarder(G.daemonForward),null}else console.warn(`[${V6}] daemon restart detected (handle=${Z}): stored bootId=${Y.daemonBootId} live bootId=${G.bootId}`);await this.stateStore?.put($,{handle:Z,state:{...Y,daemonBootId:G.bootId}}).catch((W)=>console.warn(`[${V6}] bootId persist failed for ${Z}: ${W instanceof Error?W.message:String(W)}`))}return{id:$,handle:Z,adoptedSandboxName:J,tenantPoolPodBound:!1,token:Y.token,workdir:Y.workdir??uq0,daemonUrl:G.daemonUrl,daemonForward:G.daemonForward,workload:Y.workload??null,daemonBootId:G.bootId,tenant:Y.tenant??null,ensureOpts:Y.ensureOpts??null,orgFsRedacted:Y.orgFsRedacted===!0}}join($,Z,Q,Y){let X=this.sentinelToken!==null,J=X?this.tokenGenerator():CQ1(Y,"DAEMON_TOKEN"),G=X?iI$():CQ1(Y,"DAEMON_BOOT_ID");if(!J||!G)throw new NX(`claim ${Z} carries no daemon token`);return this.bind($,Z,Q,this.claimTenantPoolBinding(Q),{token:J,daemonBootId:G,workdir:uq0})}async adopt($,Z,Q){if(!SQ1(Q))return null;let Y=Q.status?.sandbox?.name??Z;if(this.sentinelToken!==null)return null;let X=CQ1(Q,"DAEMON_TOKEN");if(!X)return null;let J=await this.openAndProbeDaemon(Y,Z);if(!J)return null;let G=dr4(Q);if(this.previewGateway)await this.ensureServicePortForAdoptedSandbox(Y).catch((W)=>{console.warn(`[${V6}] Service port backfill failed for ${Z}: ${W instanceof Error?W.message:String(W)}`)}),await this.ensureHttpRouteForHandle(Z,Y,G).catch((W)=>{console.warn(`[${V6}] HTTPRoute backfill failed for ${Z}: ${W instanceof Error?W.message:String(W)}`)});return{id:$,handle:Z,adoptedSandboxName:Y,tenantPoolPodBound:!1,token:X,workdir:uq0,daemonUrl:J.daemonUrl,daemonForward:J.daemonForward,workload:null,daemonBootId:J.bootId,tenant:G,ensureOpts:null}}async openAndProbeDaemon($,Z){let Q=await this.openForwarder($,bN,Z).catch(()=>null);if(!Q)return null;let Y=`http://127.0.0.1:${Q.localPort}`,X=await Cq0(Y);if(!X)return this.closeForwarder(Q),null;return{daemonForward:Q,daemonUrl:Y,bootId:X.bootId}}async getRecord($){let Z=this.records.get($);if(Z)return Z;if(!this.stateStore)return null;let Q=await this.stateStore.getByHandle($);if(!Q)return null;let Y=await this.rehydrate(Q.id,$,Q);if(Y)this.records.set($,Y);return Y}async resurrectByHandle($){if(!this.stateStore)return null;let Z=await this.stateStore.getByHandle($);if(!Z)return null;let Q=Z.state,Y=Q.ensureOpts;if(!Y)return null;let X=await this.withFreshCredentials(Y,Q.orgFsRedacted===!0);if(m3(Z.id)!==$)return null;return await this.ensure(Z.id,X),this.records.get($)??null}invalidateRecord($){let Z=this.records.get($);if(!Z)return;this.records.delete($),this.dropRecord(Z)}dropRecord($){if(this.closeForwarder($.daemonForward),this.metrics&&this.activeGauge.consume($.handle))this.metrics.active.add(-1,vQ1($.tenant))}recordProxyDuration($,Z,Q,Y,X){if(!this.metrics)return;this.metrics.proxyDurationMs.record(Y,{...vQ1(Q?.tenant??null),source:$,sandbox_handle:Q?.handle??X??"",status_code:Z||0})}composePreviewUrl($){if(this.previewUrlPattern)return xq0(this.previewUrlPattern,$.handle);return`http://127.0.0.1:${$.daemonForward.localPort}/`}toSandbox($){return{handle:$.handle,workdir:$.workdir,previewUrl:this.composePreviewUrl($),warmPoolAdopted:$.tenantPoolPodBound===!0,provider:"kubernetes"}}async persist($,Z){if(!$)return;let Q={adoptedSandboxName:Z.adoptedSandboxName,token:Z.token,workdir:Z.workdir,workload:Z.workload,daemonBootId:Z.daemonBootId,tenant:Z.tenant,...Z.ensureOpts?this.persistCredentials?{ensureOpts:Z.ensureOpts}:tr4(Z.ensureOpts,Z.orgFsRedacted===!0):{}};await $.put(Z.id,{handle:Z.handle,state:Q})}computeShutdownTime(){return new Date(Date.now()+this.idleTtlMs).toISOString()}async releaseAfter($,Z){let Q=await wL(this.kubeConfig,this.namespace,$);if(!Q)return;let Y=ir4(Q.spec?.lifecycle?.shutdownTime,new Date(Date.now()+Z));if(!Y)return;await NN0(this.kubeConfig,this.namespace,$,Y).catch((X)=>console.warn(`[${V6}] release failed for ${$}: ${X instanceof Error?X.message:String(X)}`))}async renewTtl($){let Z=await wL(this.kubeConfig,this.namespace,$);if(!Z)return;let Q=pr4(Z.spec?.lifecycle?.shutdownTime,new Date(Date.now()+this.idleTtlMs));if(!Q)return;await NN0(this.kubeConfig,this.namespace,$,Q).catch((Y)=>console.warn(`[${V6}] TTL renew failed for ${$}: ${Y instanceof Error?Y.message:String(Y)}`))}openForwarder($,Z,Q=$){if(this.forwardPort)return this.forwardPort($,Z,Q);let Y=fr4(Q,Z);return new Promise((X,J)=>{let G=(W,K)=>{let H=aI$.createServer((F)=>this.handleForwardedConnection(F,$,Z,Q));H.once("error",(F)=>{if(F.code==="EADDRINUSE"&&K<vr4){try{H.close()}catch{}let U=bQ1+(W-bQ1+1)%eI$;G(U,K+1);return}J(F)}),H.listen(W,"127.0.0.1",()=>{let F=H.address();if(!F||typeof F==="string"){H.close(),J(Error("port-forward listener failed to bind"));return}let U=F.port;X({localPort:U,close:()=>H.close((N)=>{if(N)console.warn(`[${V6}] port-forward close on :${U} errored: ${N.message}`)})})})};G(Y,0)})}handleForwardedConnection($,Z,Q,Y){let X=new Ar4,J=null,G=!1,W=()=>{if(G)return;if(G=!0,X.destroy(),J)try{J.close()}catch{}if(!$.destroyed)$.destroy()};$.pipe(X),$.on("error",W),$.on("close",W),this.portForward.portForward(this.namespace,Z,[Q],$,null,X).then((K)=>{let H=typeof K==="function"?K():K;if(!H){W();return}if(J=H,J.on("close",W),J.on("error",(F)=>{console.warn(`[${V6}] port-forward to ${Z}:${Q} dropped mid-connection: ${pI$(F)}`,JSON.stringify(xQ1(F))),this.invalidateRecord(Y),W()}),G)try{J.close()}catch{}}).catch((K)=>{console.warn(`[${V6}] port-forward to ${Z}:${Q} failed: ${pI$(K)}`,JSON.stringify(xQ1(K))),this.invalidateRecord(Y),W()})}closeForwarder($){$.close()}close(){if(this.closed)return;this.closed=!0,this.claimWatchAbort.abort();for(let $ of this.records.values())this.dropRecord($);this.records.clear()}}function br4($){return{active:$.createUpDownCounter("studio.sandbox.active",{description:"Active sandbox count, by runner kind, owning org, and daemon impl. Cross-checks the cAdvisor-derived count from the cluster \u2014 divergence between the two indicates orphaned claims (studio deleted but K8s didn't reap) or unattributed pods.",unit:"{sandbox}"}),ensureOutcome:$.createCounter("studio.sandbox.ensure.outcome",{description:"Outcome of each ensure() call: fresh provision, resume from state-store after restart, or adopt of a cluster-side claim studio didn't know about. Cold-start ratio is the primary input for warm-pool sizing.",unit:"{call}"}),proxyDurationMs:$.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of studio-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"}),poolPods:$.createGauge("studio.sandbox.pool.pods",{description:"Tenant warm pool depth by pool and state: ready (warmed and unbound \u2014 what a claim can actually bind instantly), bound (serving a user), pending (unbound, not yet warmed), failed (gave up after repeated bootstrap failures). Alert on sustained ready=0: a pool that is always empty is doing nothing while costing N pods.",unit:"{pod}"})}}function xQ1($){let Z=[],Q=$;for(let Y=0;Y<5&&Q instanceof Error;Y++){let X=Q;if(Z.push({name:X.name,message:X.message,...X.code!==void 0?{code:X.code}:{},...X.errno!==void 0?{errno:X.errno}:{}}),X.cause===Q)break;Q=X.cause}if(Q!==void 0&&!(Q instanceof Error)&&Q!==null){let Y=Q,X=Y.error instanceof Error?xQ1(Y.error).chain:void 0;Z.push({nonError:String(Q),...typeof Y.type==="string"?{type:Y.type}:{},...typeof Y.message==="string"?{message:Y.message}:{},...Y.code!==void 0?{code:Y.code}:{},...typeof Y.reason==="string"?{reason:Y.reason}:{},...X?{error:X}:{},...X===void 0&&Y.error!==void 0?{rawError:String(Y.error)}:{},keys:Object.keys(Y)})}return{chain:Z}}function xr4(){let $=new Bq0;return $.loadFromDefault(),$}function SQ1($){return Boolean($.status?.conditions?.some((Z)=>Z.type==="Ready"&&Z.status==="True"))}function CQ1($,Z){let Q=$.spec?.env;if(!Q)return null;for(let Y of Q)if(Y.name===Z&&Y.value)return Y.value;return null}function fr4($,Z){let Q=Pr4("sha256").update(`${$}:${Z}`).digest();return bQ1+Q.readUInt32BE(0)%eI$}function sI$($){let Z=$.slice(0,gr4);return yr4.test(Z)?Z:""}function ur4($){if($===void 0)return null;let Z=$.trim();if(Z==="")return null;if(!hr4.test(Z))throw Error(`AgentSandboxProvider: envName=${JSON.stringify(Z)} is not a valid DNS-label-safe environment name (lowercase alphanumeric or '-', starts with a letter, ends alphanumeric, \u226432 chars). Studio sets this from STUDIO_ENV; check the studio chart's configMap.`);return Z}function _Q1($,Z={}){let Q={...Z};if($){let Y=sI$($.orgId),X=sI$($.userId);if(Y)Q[RJ.orgId]=Y;if(X)Q[RJ.userId]=X}return Q}function gy($){let Z="";for(let Q of $){let Y=Q.codePointAt(0)??0;Z+=Y<32||Y===127?" ":Q}return Z.slice(0,lr4)}function cr4($){try{let Z=new URL($);return Z.username="",Z.password="",Z.toString()}catch{return""}}function mr4($){let Z={},Q=$.tenant;if(Q?.orgSlug)Z[OF.orgSlug]=gy(Q.orgSlug);if(Q?.orgName)Z[OF.orgName]=gy(Q.orgName);if(Q?.userEmail)Z[OF.userEmail]=gy(Q.userEmail);if(Q?.userName)Z[OF.userName]=gy(Q.userName);let Y=$.repo;if(Y){if(Y.displayName)Z[OF.gitRepo]=gy(Y.displayName);let X=cr4(Y.cloneUrl);if(X)Z[OF.gitRepoUrl]=gy(X);let J=$.branch??Y.branch;if(J)Z[OF.gitBranch]=gy(J)}return Z}function dr4($){let Z=$.metadata?.labels;if(!Z)return null;let Q=Z[RJ.orgId],Y=Z[RJ.userId];if(!Q||!Y)return null;let X=$.metadata?.annotations??{};return{orgId:Q,userId:Y,orgSlug:X[OF.orgSlug],orgName:X[OF.orgName],userEmail:X[OF.userEmail],userName:X[OF.userName]}}function ir4($,Z){if($){let Q=new Date($).getTime();if(Number.isFinite(Q)&&Q<=Z.getTime())return null}return Z.toISOString()}function pr4($,Z){if($){let Q=new Date($).getTime();if(Number.isFinite(Q)&&Q>=Z.getTime())return null}return Z.toISOString()}function vQ1($){return{org_id:$?.orgId??"",user_id:$?.userId??"",runner_kind:"agent-sandbox"}}async function nr4($,Z){if(!Z||!$.tenant)return $.orgFsConfigJson;try{return await Z($.tenant)??$.orgFsConfigJson}catch(Q){return console.warn(`[${V6}] org-fs credential re-mint failed: ${Q instanceof Error?Q.message:String(Q)}`),$.orgFsConfigJson}}function rI$($){try{let Z=new URL($.cloneUrl);Z.username="",Z.password="";let{submoduleCredentials:Q,credentialExpiresAt:Y,...X}=$;return{...X,cloneUrl:Z.toString()}}catch{return null}}function tr4($,Z){let{orgFsConfigJson:Q,repo:Y,extraRepos:X,...J}=$,G=J,W=Y&&rI$(Y);if(W)G.repo=W;if(X)G.extraRepos=X.map(rI$).filter((K)=>K!==null);return Q||Z?{ensureOpts:G,orgFsRedacted:!0}:{ensureOpts:G}}function or4($){let Z={};if($.branch)Z.branch=$.branch;if($.repo)Z.repo=$.repo;if($.workload)Z.workload=$.workload;if($.env&&Object.keys($.env).length>0)Z.env=$.env;if($.tenant)Z.tenant=$.tenant;if($.cloneOnly)Z.cloneOnly=!0;if($.purpose)Z.purpose=$.purpose;if($.sandboxImage)Z.sandboxImage=$.sandboxImage;if($.orgFsConfigJson)Z.orgFsConfigJson=$.orgFsConfigJson;return Object.keys(Z).length>0?Z:null}function sr4($,Z){try{return new URL(xq0($,Z)).hostname||null}catch{return null}}var V6="AgentSandboxProvider",Tr4="agent-sandbox-system",Rr4="studio-sandbox",qr4=300000,bN=9000,nI$=3000,uq0="/app",Mr4=32,Vr4,Ir4=900000,kr4=60000,Sr4=1800000,lq0=3,tI$=1800000,Cr4=900000,_r4=1800000,bQ1=40000,eI$=1e4,vr4=256,RJ,OF,yr4,gr4=63,hr4,lr4=253;var $k$=L(()=>{r$();m2$();DI$();fy();Vi();BN0();F80();SI$();y80();lI$();gq0();hq0();Vr4=new Set(["DAEMON_TOKEN","DAEMON_BOOT_ID","APP_ROOT","PROXY_PORT"]);RJ={role:"studio.decocms.com/role",sandboxHandle:"studio.decocms.com/sandbox-handle",orgId:"studio.decocms.com/org-id",userId:"studio.decocms.com/user-id",env:"studio.decocms.com/env"},OF={orgSlug:"studio.decocms.com/org-slug",orgName:"studio.decocms.com/org-name",userEmail:"studio.decocms.com/user-email",userName:"studio.decocms.com/user-name",gitRepo:"studio.decocms.com/git-repo",gitRepoUrl:"studio.decocms.com/git-repo-url",gitBranch:"studio.decocms.com/git-branch"},yr4=/^([A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?)?$/;hr4=/^[a-z]([a-z0-9-]{0,30}[a-z0-9])?$/});var Zk$={};O6(Zk$,{tenantPoolSchema:()=>_I$,tenantPoolRepoSchema:()=>f80,tenantPoolFieldsSchema:()=>qQ1,tenantPoolAllocations:()=>Ii,resolveTenantPoolBinding:()=>MQ1,renderTenantPoolWarmPools:()=>xI$,normalizeRepoUrl:()=>TK,allocationsMatchingPush:()=>IQ1,TenantPoolCapacityError:()=>yq0,PREVIEW_NOT_READY_HEADER:()=>Si,AgentSandboxProvider:()=>fQ1});var g80=L(()=>{$k$();y80()});import{z as hy}from"zod";function cq0($){if(!$||$.trim()==="")return[];let Z=hy.array(rr4).parse(JSON.parse($)),Q=new Set;for(let Y of Z){if(Q.has(Y.name))throw Error(`tenant pools: duplicate pool name ${Y.name}`);Q.add(Y.name)}return Z}function Qk$($){let Z=TK(`https://github.com/${$.repo}`);if(!Z)throw Error(`tenant pools: bad repo ${$.repo}`);return Z}function Yk$($){return $.map((Z)=>({name:Z.name,tenant:Z.orgId,size:1,image:"default",repos:[{repoUrl:Qk$(Z),branch:Z.branch,workload:Z.workload,replicas:1,warmPoolName:Z.name}]}))}function yQ1($,Z){let Q=TK(Z.repoUrl)?.toLowerCase(),Y=$.find((J)=>J.orgId===Z.tenant&&J.branch===Z.branch&&Qk$(J).toLowerCase()===Q);if(!Y)return null;let X=`https://github.com/${Y.repo}.git`;return Y.connectionId?{cloneUrl:X,connectionId:Y.connectionId}:{cloneUrl:X}}function Xk$($,Z){return async(Q)=>{let Y=yQ1($,Q);if(!Y)return null;return Y.connectionId?Z(Y):Y.cloneUrl}}var rr4;var mq0=L(()=>{g80();rr4=hy.object({name:hy.string().max(63).regex(/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/,"pool name must be a DNS label (lowercase alphanumeric and '-')"),orgId:hy.string().min(1),repo:hy.string().regex(/^[^/\s]+\/[^/\s]+$/,"repo must be `owner/name`"),connectionId:hy.string().min(1).optional(),branch:hy.string().min(1).default("main"),workload:f80.shape.workload})});function cQ1($,Z=Date.now()){if($===void 0)return;return $===null?Z+ar4:$.getTime()}function lQ1($){return JSON.stringify([$.orgId,$.userId])}function Jk$($,Z){let Q=TK(Z);return Q?JSON.stringify([$,Q.toLowerCase()]):null}function $a4($,Z){return"repositoryId"in Z?$.repositoryOrgs.get(Z.repositoryId):$.connectionOrgs.get(Z.connectionId)}function Gk$($){let{records:Z,now:Q}=$,Y=new Map,X=new Map,J=new Map,G=0;for(let W of $.pools)for(let{repoUrl:K,branch:H}of W.repos){let F=Jk$(W.tenant,K),U=yQ1($.legacyPools??[],{tenant:W.tenant,repoUrl:K,branch:H});if(F&&U){if(U.connectionId)X.set(F,{tenant:W.tenant,repoUrl:K,connectionId:U.connectionId,cloneUrl:U.cloneUrl});continue}let N=F?Z.orgRepositories.get(F):void 0;if(!F||!N){G++;continue}X.set(F,{tenant:W.tenant,repoUrl:K,repositoryId:N})}for(let W of $.sandboxes){let K=W.tenant;if(!K)continue;let H=Z.members.get(lQ1(K));if(H===void 0){G++;continue}for(let U of W.repos){if($a4(Z,U)!==K.orgId){G++;continue}let N="repositoryId"in U?{repositoryId:U.repositoryId}:{connectionId:U.connectionId,repo:U.repo.toLowerCase()},B={orgId:K.orgId,userId:K.userId};Y.set(JSON.stringify([B,N]),{tenant:B,repo:N})}let F=W.orgFsConfigExpiresAt;if(W.orgFs&&(F===null||F-Q<er4))J.set(lQ1(K),{orgId:K.orgId,userId:K.userId,orgSlug:H})}return{clones:[...Y.values()],poolClones:[...X.values()],orgFs:[...J.values()],refused:G}}async function Wk$($,Z,Q){let Y=new Set,X=new Set,J=new Set,G=new Set,W=new Set(Q.map((D)=>D.tenant)),K=new Set;for(let D of Q)for(let{repoUrl:O}of D.repos){let w=YX(O);if(w)K.add(w.path.toLowerCase())}for(let D of Z){if(D.tenant)Y.add(D.tenant.orgId),X.add(D.tenant.userId);for(let O of D.repos)if("repositoryId"in O)G.add(O.repositoryId);else J.add(O.connectionId)}let[H,F,U,N]=await Promise.all([Y.size===0?[]:$.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.organizationId as orgId","member.userId as userId","organization.slug as slug"]).where("member.organizationId","in",[...Y]).where("member.userId","in",[...X]).execute(),J.size===0?[]:$.selectFrom("connections").select(["id","organization_id"]).where("id","in",[...J]).execute(),G.size===0?[]:$.selectFrom("repositories").select(["id","organization_id"]).where("id","in",[...G]).execute(),K.size===0?[]:$.selectFrom("repositories").select(["id","organization_id","provider","host","path"]).where("organization_id","in",[...W]).where((D)=>D(D.fn("lower",["path"]),"in",[...K])).execute()]),B=new Map;for(let D of N){let O=Jk$(D.organization_id,t10({provider:D.provider,host:D.host,path:D.path}));if(O&&!B.has(O))B.set(O,D.id)}return{members:new Map(H.map((D)=>[lQ1(D),D.slug])),connectionOrgs:new Map(F.map((D)=>[D.id,D.organization_id])),repositoryOrgs:new Map(U.map((D)=>[D.id,D.organization_id])),orgRepositories:B}}function uQ1($){return $ instanceof Error?$.message:String($)}async function Kk$($,Z,Q){let Y=0;if($.clones.length>_i||$.poolClones.length>_i||$.orgFs.length>hQ1)console.warn(`[sandbox-credential-push] ${$.clones.length} clone, ${$.poolClones.length} pool clone and ${$.orgFs.length} org-fs mints planned; minting the first ${_i}, ${_i} and ${hQ1}`);let X=await V5($.clones.slice(0,_i),gQ1,async(U)=>{let N="repositoryId"in U.repo?{cloneUrl:"",repositoryId:U.repo.repositoryId}:{cloneUrl:`https://github.com/${U.repo.repo}.git`,connectionId:U.repo.connectionId};try{let B=await Z.mintCloneUrl(N,{bufferMs:dq0});return B?{tenant:U.tenant,repo:U.repo,cloneUrl:B,expiresAt:Q.now+dq0}:null}catch(B){return Y++,console.warn(`[sandbox-credential-push] clone mint failed: ${uQ1(B)}`),null}}),J=await V5($.poolClones.slice(0,_i),gQ1,async(U)=>{try{let N=await Z.mintCloneUrl("repositoryId"in U?{cloneUrl:"",repositoryId:U.repositoryId}:{cloneUrl:U.cloneUrl,connectionId:U.connectionId},{bufferMs:dq0});return N?{tenant:U.tenant,repoUrl:U.repoUrl,cloneUrl:N,expiresAt:Q.now+dq0}:null}catch(N){return Y++,console.warn(`[sandbox-credential-push] pool clone mint failed: ${uQ1(N)}`),null}}),G=await V5($.orgFs.slice(0,hQ1),gQ1,async(U)=>{try{let N=await Z.mintOrgFsConfig(U);return N?{tenant:{orgId:U.orgId,userId:U.userId},orgFsConfigJson:N,expiresAt:Q.now+Q.orgFsLifetimeMs}:null}catch(N){return Y++,console.warn(`[sandbox-credential-push] org-fs mint failed: ${uQ1(N)}`),null}}),W=X.filter((U)=>U!==null),K=J.filter((U)=>U!==null),H=G.filter((U)=>U!==null),F=[];for(let U=0;U<Math.max(W.length,K.length,H.length);U+=rE)F.push({cloneUrls:W.slice(U,U+rE),poolCloneUrls:K.slice(U,U+rE),orgFsConfigs:H.slice(U,U+rE)});return{batches:F,failed:Y}}var dq0=2700000,iq0,ar4=86400000,er4=86400000,gQ1=8,_i=2000,hQ1=200;var pq0=L(()=>{zZ1();g80();t4();r$();VN();mq0();iq0=Y2$-3600000});var qJ;var h80=L(()=>{qJ=class qJ extends Error{code;status;path;constructor($,Z,Q){super(Z.message||`Freestyle API error: ${Z.code}`);this.name="FreestyleApiError",this.code=Z.code,this.status=$,this.path=Q,Object.setPrototypeOf(this,qJ.prototype)}}});function Hk$(){return typeof process<"u"&&Boolean(process.versions?.node)}var nq0=($,Z)=>globalThis.fetch($,Z);async function Za4(){if(!Hk$())return null;try{return await import("undici")}catch{return null}}async function Ya4(){let $=await Za4();if(!$)return null;let Z=new $.Agent({allowH2:!0,connections:Qa4});return(Q,Y)=>$.fetch(Q,{...Y,dispatcher:Z})}function Xa4($){return(typeof $==="string"?$:$ instanceof URL?$.href:$.url).startsWith("https:")}function Fk$(){let $,Z=()=>{return $??=Ya4().then((Q)=>Q??nq0).catch(()=>nq0),$};return(Q,Y)=>Xa4(Q)?Z().then((X)=>X(Q,Y)):nq0(Q,Y)}var Qa4=4;var Uk$=()=>{};function Fa4($){return new Promise((Z)=>setTimeout(Z,$))}function Ua4($){if(!$)return"";let Z=new URLSearchParams;for(let[Y,X]of Object.entries($)){if(X===void 0||X===null)continue;Z.set(Y,String(X))}let Q=Z.toString();return Q?`?${Q}`:""}function i6($){return encodeURIComponent($)}class mQ1{baseUrl;authenticationHeaders;fetchImpl;backgroundEligible;constructor($={}){if(this.baseUrl=($.baseUrl??Ha4).replace(/\/+$/,""),!$.fetch&&!globalThis.fetch)throw Error("No fetch implementation available. Pass `fetch` in FreestyleOptions when running on a runtime without a global fetch.");if(this.fetchImpl=$.fetch??Fk$(),"identityAccessToken"in $&&$.identityAccessToken){this.authenticationHeaders={[Ja4]:$.identityAccessToken},this.backgroundEligible=!1;return}if(this.backgroundEligible=!0,"stackAccessToken"in $&&$.stackAccessToken){this.authenticationHeaders={Authorization:`Bearer ${$.stackAccessToken}`,"X-Freestyle-Team-Id":$.teamId};return}let Z=$.apiKey??globalThis.process?.env?.FREESTYLE_API_KEY;if(!Z)throw Error("No Freestyle API key provided. Pass `apiKey` in FreestyleOptions or set FREESTYLE_API_KEY.");this.authenticationHeaders={Authorization:`Bearer ${Z}`}}authHeaders(){return{...this.authenticationHeaders}}url($,Z){return`${this.baseUrl}${$}${Ua4(Z)}`}async fetch($,Z={}){let Q=new Headers(Z.headers);for(let[Y,X]of Object.entries(this.authHeaders()))if(!Q.has(Y))Q.set(Y,X);return this.fetchImpl(this.absoluteUrl($),{...Z,headers:Q})}absoluteUrl($){return/^https?:\/\//i.test($)?$:`${this.baseUrl}${$}`}async request($,Z,{query:Q,body:Y,rawBody:X,signal:J}={}){let G={...this.authHeaders()};if(this.backgroundEligible)G[Nk$]=String(Wa4);let W;if(X!==void 0)G["Content-Type"]="application/octet-stream",W=X;else if(Y!==void 0)G["Content-Type"]="application/json",W=JSON.stringify(Y);let K=this.url(Z,Q),H=await this.fetchImpl(K,{method:$,headers:G,body:W,signal:J});if(this.backgroundEligible&&H.status===202)try{return await this.pollBackgroundRequest(H,Z)}catch(F){if($==="GET"&&F instanceof qJ&&F.code==="BACKGROUND_RESULT_UNSTORABLE"){delete G[Nk$];let U=await this.fetchImpl(K,{method:$,headers:G,body:W});return this.finalize(U,Z)}throw F}return this.finalize(H,Z)}async pollBackgroundRequest($,Z){let Q=await $.json().catch(()=>({})),Y=$.headers.get(Ga4)??Q.requestId,X=Q.resultUrl??(Y?`/v5/background-requests/${i6(Y)}`:void 0);if(!X)throw new qJ($.status,{code:"BACKGROUND_PROTOCOL_ERROR",message:"202 Accepted carried no background request id"},Z);let J=0;for(;;){await Fa4(Ka4);let G;try{G=await this.fetch(X,{method:"GET"}),J=0}catch(W){if(++J>=5)throw W;continue}if(G.status===202)continue;return this.finalize(G,Z)}}async finalize($,Z){if(!$.ok){let Y;try{Y=await $.json()}catch{Y={code:"UNKNOWN_ERROR",message:await $.text().catch(()=>$.statusText)}}throw new qJ($.status,Y,Z)}if($.status===204)return;let Q=await $.text();if(!Q)return;return JSON.parse(Q)}get($,Z){return this.request("GET",$,{query:Z})}post($,Z){return this.request("POST",$,{body:Z??{}})}patch($,Z){return this.request("PATCH",$,{body:Z??{}})}put($,Z){return this.request("PUT",$,{body:Z??{}})}putEmpty($){return this.request("PUT",$,{})}putBytes($,Z,Q,Y){return this.request("PUT",$,{query:Q,rawBody:Z,signal:Y})}async getBytes($,Z,Q={}){let Y={...this.authHeaders()};if(Q.range)Y.Range=Q.range;let X=await this.fetchImpl(this.url($,Z),{method:"GET",headers:Y,signal:Q.signal});if(!X.ok){let J;try{J=await X.json()}catch{J={code:"UNKNOWN_ERROR",message:await X.text().catch(()=>X.statusText)}}throw new qJ(X.status,J,$)}return X}delete($,Z){return this.request("DELETE",$,{query:Z})}}var Ja4="x-freestyle-identity-access-token",Nk$="x-freestyle-background-after-secs",Ga4="x-freestyle-background-request-id",Wa4=5,Ka4=2000,Ha4="https://api.freestyle.sh";var RK=L(()=>{h80();Uk$()});class dQ1{client;verifications;certificates;placeholder;constructor($){this.client=$,this.verifications=new Bk$($),this.certificates=new Dk$($),this.placeholder=new Lk$($)}async list(){let{domains:$}=await this.client.get("/v5/domains");return $}}class Bk${client;constructor($){this.client=$}create($){return this.client.post("/v5/verifications",{domain:$})}async list($={}){let{verifications:Z}=await this.client.get("/v5/verifications",$);return Z}get($){return this.client.get(`/v5/verifications/${i6($)}`)}complete($){return this.client.putEmpty(`/v5/verifications/${i6($)}`)}delete($){return this.client.delete(`/v5/verifications/${i6($)}`)}}class Dk${client;constructor($){this.client=$}async list(){let{certificates:$}=await this.client.get("/v5/certificates");return $}createWildcard($){return this.client.post("/v5/certificates/wildcard",{domain:$})}}class Lk${client;constructor($){this.client=$}async get(){try{return await this.client.get("/v5/domains/placeholder")}catch($){if($ instanceof qJ&&$.status===404)return null;throw $}}set($){return this.client.put("/v5/domains/placeholder",$)}delete(){return this.client.delete("/v5/domains/placeholder")}}var iQ1=L(()=>{RK();h80()});function Q5($,Z){throw new nQ1($,Z)}function pQ1($){return Na4.some((Z)=>$[Z]!==void 0)}function tQ1($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function Da4($,Z){let Q=Z.lastIndexOf("/");if(Q<0)Q5($,`${$} \`${Z}\` is not a CIDR: expected address/prefix, e.g. 203.0.113.0/24 or 2001:db8::/32`);let Y=Z.slice(0,Q),X=Z.slice(Q+1);if(!/^\d+$/.test(X))Q5($,`${$} \`${Z}\`: prefix length must be a number`);let J=Number(X),G=Y.includes(":"),W=G?128:32;if(J>W)Q5($,`${$} \`${Z}\`: prefix length must be 0\u2013${W}`);if(!G&&!/^\d{1,3}(\.\d{1,3}){3}$/.test(Y))Q5($,`${$} \`${Z}\`: \`${Y}\` is not an IP address`)}function Ek$($,Z){if(!tQ1($))Q5(Z,`${Z} must be an object`);for(let Y of Object.keys($))if(!Ok$.includes(Y))Q5(`${Z}.${Y}`,`${Z} has unknown field \`${Y}\`. Expected one of: ${Ok$.join(", ")}`);let Q=$;for(let Y of["vmId","vpcId","tunnelId","cidr"]){let X=Q[Y];if(X!==void 0&&(typeof X!=="string"||X.length===0))Q5(`${Z}.${Y}`,`${Z}.${Y} must be a non-empty string`)}if(Q.public!==void 0&&Q.public!==!0)Q5(`${Z}.public`,`${Z}.public must be true when present: it declares the public Internet. Omit the field to match something else`);if(Q.public===!0){if(Q.vmId!==void 0)Q5(`${Z}.public`,`${Z} cannot combine \`public: true\` with \`vmId\`: that would mean the VM only when reached over its public address, a distinction this API does not make yet. Use \`vmId\` alone to match the VM on any path, or \`public: true\` alone to match public addresses`);if(Q.vpcId!==void 0)Q5(`${Z}.public`,`${Z} cannot combine \`public: true\` with \`vpcId\`: that would mean the network's members only when reached over their public addresses, a distinction this API does not make yet. Use \`vpcId\` alone or \`public: true\` alone`);if(Q.tunnelId!==void 0)Q5(`${Z}.public`,`${Z} cannot combine \`public: true\` with \`tunnelId\`: traffic through a tunnel arrives over the tunnel, not over the public Internet. Use \`tunnelId\` alone`)}if(Q.cidr!==void 0)Da4(`${Z}.cidr`,Q.cidr);if(Q.protocol!==void 0&&!wk$.includes(Q.protocol))Q5(`${Z}.protocol`,`${Z}.protocol must be one of: ${wk$.join(", ")} (got \`${String(Q.protocol)}\`)`);if(Q.port!==void 0){if(!Number.isInteger(Q.port)||Q.port<1||Q.port>65535)Q5(`${Z}.port`,`${Z}.port must be an integer between 1 and 65535`);if(Q.protocol===void 0)Q5(`${Z}.protocol`,`${Z}.port ${Q.port} requires ${Z}.protocol: set it to "tcp" or "udp" so the rule opens one transport rather than both`);if(!Ba4.includes(Q.protocol))Q5(`${Z}.port`,`${Z}.protocol "${Q.protocol}" has no ports; remove ${Z}.port ${Q.port}`)}}function Ak$($,Z){if(!tQ1($))Q5(Z||"rule",`${Z||"rule"} must be an object`);for(let Y of Object.keys($))if(!Pk$.includes(Y))Q5(`${Z}${Y}`,`Unknown field \`${Y}\`. Expected one of: ${Pk$.join(", ")}`);let Q=$;if(Q.action===void 0)Q5(`${Z}action`,`${Z}action is required. Write \`action: "allow"\` \u2014 every rule states what it does rather than defaulting to it`);if(Q.action!=="allow")Q5(`${Z}action`,`${Z}action must be "allow" (got \`${String(Q.action)}\`). Only allow rules exist today`);if(Q.description!==void 0){if(typeof Q.description!=="string")Q5(`${Z}description`,"description must be a string");if(Q.description.length>jk$)Q5(`${Z}description`,`description is too long (${Q.description.length} characters, maximum ${jk$})`)}if(Q.source===void 0)Q5(`${Z}source`,`${Z}source is required`);if(Q.destination===void 0)Q5(`${Z}destination`,`${Z}destination is required`);return Ek$(Q.source,`${Z}source`),Ek$(Q.destination,`${Z}destination`),Q}function La4($){let Z=Ak$($,"");for(let Q of["source","destination"]){let Y=Z[Q];if(pQ1(Y))continue;let X=[Y.port!==void 0?`port ${Y.port}`:void 0,Y.protocol!==void 0?`protocol ${Y.protocol}`:void 0].filter(Boolean).join(", ");Q5(Q,X?`${Q} only narrows traffic (${X}) without saying what it is. Add \`vmId\`, \`vpcId\`, \`tunnelId\`, \`cidr\`, or \`public: true\`. Leaving it out to mean "this VM" only works inside vms.create`:`${Q} is empty. A matcher must say what the traffic is: \`vmId\`, \`vpcId\`, \`tunnelId\`, \`cidr\`, or \`public: true\` for the public Internet`)}return Z}function tq0($,Z="VM"){if($===void 0||$===null)Q5("firewall",`firewall is required on a ${Z} create. A ${Z} gets nothing implicitly, so state what it may reach \u2014 \`{ rules: [] }\` if the answer is nothing`);if(!tQ1($))Q5("firewall","firewall must be an object with a `rules` array");for(let Y of Object.keys($))if(Y!=="rules")Q5(`firewall.${Y}`,`firewall has unknown field \`${Y}\`. Expected: rules`);let Q=$.rules;if(!Array.isArray(Q))Q5("firewall.rules","firewall.rules must be an array");return Q.forEach((Y,X)=>{let J=`firewall.rules[${X}].`,G=Ak$(Y,J),W=pQ1(G.source),K=pQ1(G.destination);if(!W&&!K&&Z!=="network")Q5(`firewall.rules[${X}]`,`firewall.rules[${X}]: both source and destination refer to the ${Z} being created, which allows nothing. Give one of them a \`vmId\`, \`vpcId\`, \`tunnelId\`, \`cidr\`, or \`public: true\``);if(W&&K)Q5(`firewall.rules[${X}]`,`firewall.rules[${X}]: neither end refers to the ${Z} being created. Leave one endpoint's identity unset so it means this ${Z}, or create the rule with firewall.rules.create instead`)}),$}function zk$($){return`/v5/firewall/rules/${i6($)}`}class Tk${client;constructor($){this.client=$}async create($){let Z=La4($);return this.client.post("/v5/firewall/rules",Z)}list($={}){return this.client.get("/v5/firewall/rules",$)}get($){return this.client.get(zk$($))}delete($){return this.client.delete(zk$($))}}class oQ1{client;rules;constructor($){this.client=$,this.rules=new Tk$($)}evaluate($){return this.client.post("/v5/firewall/evaluate",$)}}var nQ1,Ok$,Na4,wk$,Ba4,jk$=1024,Pk$;var u80=L(()=>{RK();nQ1=class nQ1 extends Error{path;constructor($,Z){super(Z);this.name="FirewallRuleValidationError",this.path=$,Object.setPrototypeOf(this,nQ1.prototype)}};Ok$=["vmId","vpcId","tunnelId","cidr","public","port","protocol"],Na4=["vmId","vpcId","tunnelId","cidr","public"],wk$=["tcp","udp","icmp"],Ba4=["tcp","udp"];Pk$=["action","source","destination","description"]});function sQ1($){return`/v5/identities/${i6($)}`}class Rk${client;basePath;constructor($,Z){this.client=$,this.basePath=Z}create(){return this.client.post(`${this.basePath}/tokens`)}list(){return this.client.get(`${this.basePath}/tokens`)}revoke($){return this.client.delete(`${this.basePath}/tokens/${i6($)}`)}}class qk${client;basePath;constructor($,Z){this.client=$,this.basePath=Z}list(){return this.client.get(`${this.basePath}/permissions/vm`)}grant($){return this.client.post(`${this.basePath}/permissions/vm`,$)}get($){return this.client.get(`${this.basePath}/permissions/vm/${i6($)}`)}update($,Z){return this.client.patch(`${this.basePath}/permissions/vm/${i6($)}`,{allowedLinuxUsers:Z})}revoke($){return this.client.delete(`${this.basePath}/permissions/vm/${i6($)}`)}}class rQ1{id;tokens;permissions;client;basePath;constructor($,Z){this.client=$,this.id=Z,this.basePath=sQ1(Z),this.tokens=new Rk$($,this.basePath),this.permissions={vm:new qk$($,this.basePath)}}data(){return this.client.get(this.basePath)}delete(){return this.client.delete(this.basePath)}}class aQ1{client;constructor($){this.client=$}async create($={}){let Z=await this.client.post("/v5/identities",$);return{identity:new rQ1(this.client,Z.id),identityId:Z.id,data:Z}}list($={}){return this.client.get("/v5/identities",$)}get($){return this.client.get(sQ1($))}ref($){return new rQ1(this.client,$)}delete($){return this.client.delete(sQ1($))}}var eQ1=L(()=>{RK()});function h1($,Z){throw new YY1($,Z)}function j7($,Z){throw new XY1($,Z)}function l80($){return Oa4.some((Z)=>$[Z]!==void 0)}function Ra4($){return!l80($)&&$.port===void 0}function LX($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function hk$($,Z,Q){if(typeof $!=="string"||!Pa4.test($))j7(Z,`${Z} must be a valid HTTP header name`);let Y=$.toLowerCase();if(Ta4.has(Y)||Y.startsWith("x-forwarded-")||Y.startsWith("x-freestyle-")||Q&&(Y==="cookie"||Y==="set-cookie"))j7(Z,`${Z} may not use reserved header \`${$}\``)}function qa4($,Z){if(!Array.isArray($))j7(Z,`${Z} must be an array of header names`);if($.length>_k$)j7(Z,`${Z} may contain at most ${_k$} names`);let Q=new Set;$.forEach((Y,X)=>{hk$(Y,`${Z}[${X}]`,!0);let J=Y.toLowerCase();if(Q.has(J))j7(`${Z}[${X}]`,`${Z} contains duplicate header \`${Y}\``);Q.add(J)})}function bk$($){if(!LX($))j7("forwardAuth","forwardAuth must be an object");for(let Y of Object.keys($))if(!Ik$.includes(Y))j7(Y,`Unknown field \`${Y}\`. Expected one of: ${Ik$.join(", ")}`);let Z=$;if(typeof Z.url!=="string"||Z.url.length===0||Z.url.length>za4)j7("url","url is required and must be an absolute HTTPS URL");let Q;try{Q=new URL(Z.url)}catch{j7("url","url must be an absolute HTTPS URL")}if(Q.protocol!=="https:"||Q.hostname.length===0||Q.username.length>0||Q.password.length>0||Q.hash.length>0||Q.port==="0")j7("url","url must be an absolute HTTPS URL");if(Z.headers!==void 0){if(!LX(Z.headers))j7("headers","headers must be an object of header name to value");let Y=Object.entries(Z.headers);if(Y.length>Sk$)j7("headers",`headers may contain at most ${Sk$} entries`);let X=0,J=new Set;for(let[G,W]of Y){hk$(G,`headers.${G}`,!1);let K=G.toLowerCase();if(J.has(K))j7(`headers.${G}`,`headers contains duplicate header \`${G}\``);if(J.add(K),typeof W!=="string"||/[\0\r\n]/.test(W))j7(`headers.${G}`,`headers.${G} must be a string`);X+=G.length+W.length}if(X>Ck$)j7("headers",`headers may contain at most ${Ck$} bytes`)}if(Z.timeoutMs!==void 0&&(!Number.isInteger(Z.timeoutMs)||Z.timeoutMs<100||Z.timeoutMs>5000))j7("timeoutMs","timeoutMs must be an integer between 100 and 5000");if(Z.protectedCookies!==void 0){if(!Array.isArray(Z.protectedCookies))j7("protectedCookies","protectedCookies must be an array of cookie names");if(Z.protectedCookies.length>vk$)j7("protectedCookies",`protectedCookies may contain at most ${vk$} names`);let Y=new Set;Z.protectedCookies.forEach((X,J)=>{if(typeof X!=="string"||X.length>Aa4||!Ea4.test(X))j7(`protectedCookies[${J}]`,`protectedCookies[${J}] must be a valid HTTP cookie name`);if(Y.has(X))j7(`protectedCookies[${J}]`,`protectedCookies contains duplicate cookie \`${X}\``);Y.add(X)})}if(Z.authResponseHeaders!==void 0)qa4(Z.authResponseHeaders,"authResponseHeaders");return Z}function Ma4($,Z){if(!LX($))h1(Z,`${Z} must be an object with an \`id\``);for(let Y of Object.keys($))if(!kk$.includes(Y))h1(`${Z}.${Y}`,`${Z} has unknown field \`${Y}\`. Expected: ${kk$.join(", ")}`);let Q=$.id;if(typeof Q!=="string"||Q.length===0)h1(`${Z}.id`,`${Z}.id is required and must be a non-empty string`)}function QY1($){if(typeof $!=="string")h1("domain","domain is required and must be a string");if($==="*")return;let Z=$.startsWith("*.")?$.slice(2):$;if(Z.length===0||Z.length>wa4)h1("domain",`domain \`${$}\` is not a hostname`);let Q=Z.split(".");if(Q.length<2)h1("domain",`domain \`${$}\` must have at least two labels, e.g. acme.com`);for(let Y of Q){if(Y.length===0||Y.length>ja4)h1("domain",`domain \`${$}\` has an empty or over-long label`);if(!/^[a-z0-9-]+$/.test(Y))h1("domain",`domain \`${$}\`: labels are lowercase letters, digits, and hyphens (a \`*.\` prefix is the only wildcard)`);if(Y.startsWith("-")||Y.endsWith("-"))h1("domain",`domain \`${$}\`: a label cannot start or end with a hyphen`)}}function Va4($){if(typeof $!=="string")h1("domain","domain is required and must be a string");let Z=$.lastIndexOf("@");if(Z===-1){QY1($);return}let Q=$.slice(0,Z),Y=$.slice(Z+1);if(Q.length===0||Q.length>64)h1("domain",`mail route \`${$}\`: the part before \`@\` must be 1-64 characters`);if(Q.startsWith(".")||Q.endsWith(".")||Q.includes(".."))h1("domain",`mail route \`${$}\`: the part before \`@\` cannot start or end with a dot, or contain \`..\``);for(let X of Q)if(!/[a-zA-Z0-9]/.test(X)&&!xk$.includes(X))h1("domain",`mail route \`${$}\`: the part before \`@\` may use letters, digits, dots, and \`${xk$.slice(0,-1)}\` (quoted mailboxes are not supported)`);if(Y==="*")h1("domain",`mail route \`${$}\`: \`*\` is not a mail domain \u2014 name the domain the mailbox lives at`);QY1(Y)}function fk$($,Z){if(!LX($))h1(Z,`${Z} must be an object`);for(let Y of Object.keys($))if(!Mk$.includes(Y))h1(`${Z}.${Y}`,`${Z} has unknown field \`${Y}\`. Expected one of: ${Mk$.join(", ")}`);let Q=$;for(let Y of["vmId","vpcId","host"]){let X=Q[Y];if(X!==void 0&&(typeof X!=="string"||X.length===0))h1(`${Z}.${Y}`,`${Z}.${Y} must be a non-empty string`)}if(Q.public!==void 0&&Q.public!==!0)h1(`${Z}.public`,`${Z}.public must be true when present. Omit the field to match something else`);if(Z==="source"){if(Q.host!==void 0)h1("source.host","source.host is not allowed: a source is who opens the session, not where it lands. Put `host` on the destination");if(Q.port!==void 0)h1("source.port","source.port is not allowed: a source is who opens the session, not where it lands. Put `port` on the destination");if(Q.public===!0&&(Q.vmId!==void 0||Q.vpcId!==void 0))h1("source.public","source cannot combine `public: true` with `vmId` or `vpcId`: use one alone. `public` is every client on the Internet; `vmId`/`vpcId` is a specific dialer")}else{if(Q.vpcId!==void 0)h1("destination.vpcId","destination.vpcId is not allowed: a session lands in one place, not on a whole network. Name a `vmId`, a `host`, or `public: true` for the domain's own origin. A whole network may be a source");if([Q.vmId!==void 0,Q.host!==void 0,Q.public===!0].filter(Boolean).length>1)h1("destination","destination names more than one landing: give exactly one of `vmId`, `host`, or `public: true`");if((Q.vmId!==void 0||Q.host!==void 0)&&Q.port===void 0)h1("destination.port",`destination.port is required with ${Q.vmId!==void 0?"`vmId`":"`host`"}: say which port the session lands on`)}if(Q.port!==void 0){if(!Number.isInteger(Q.port)||Q.port<1||Q.port>65535)h1(`${Z}.port`,`${Z}.port must be an integer between 1 and 65535`)}}function Ia4($){if("postgres"in $)return"postgres";if("smtp"in $)return"smtp";if("socks5"in $)return"socks5";return"http"}function ka4($,Z){function Q(W,K,H){if(!LX(W)||Object.keys(W).some((F)=>!K.includes(F)))h1(H,`${H} must contain only ${K.join(", ")}`)}if(Q($,["region","credentials","scope"],Z),typeof $.region!=="string"||!/^[a-z0-9-]{1,63}$/.test($.region))h1(`${Z}.region`,"invalid s3.region");Q($.credentials,["accessKeyId","secretAccessKey","sessionToken"],`${Z}.credentials`);for(let W of["accessKeyId","secretAccessKey","sessionToken"]){let K=$.credentials[W];if(W==="sessionToken"&&K===void 0)continue;if(typeof K!=="string"||!/^[\x21-\x7e]{1,16384}$/.test(K))h1(`${Z}.credentials.${W}`,"invalid s3 credentials")}if(!/^[a-zA-Z0-9]+$/.test($.credentials.accessKeyId))h1(`${Z}.credentials.accessKeyId`,"invalid s3 access key id");Q($.scope,["bucket","prefix","operations"],`${Z}.scope`);let{bucket:Y,prefix:X,operations:J}=$.scope;if(typeof Y!=="string"||!/^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/.test(Y)||Y.includes(".."))h1(`${Z}.scope.bucket`,"invalid s3.scope.bucket");if(typeof X!=="string"||Buffer.byteLength(X,"utf8")>1024||/[\x00-\x1f\x7f-\x9f]/u.test(X))h1(`${Z}.scope.prefix`,"invalid s3.scope.prefix");let G=["GetObject","HeadObject","PutObject","DeleteObject","ListObjectsV2","CreateMultipartUpload","UploadPart","ListParts","CompleteMultipartUpload","AbortMultipartUpload","ListMultipartUploads"];if(!Array.isArray(J)||J.length===0||J.length>G.length||J.some((W)=>!G.includes(W))||new Set(J).size!==J.length)h1(`${Z}.scope.operations`,"s3.scope.operations must be a nonempty list of distinct supported operations")}function Sa4($,Z){if(!LX($))h1(Z,`${Z} must be an object: \`{ headers: { \u2026 } }\`, \`{ postgres: { \u2026 } }\`, \`{ smtp: { \u2026 } }\` or \`{ socks5: { \u2026 } }\``);let Q=Object.keys($);if(Q.length!==1||!["headers","jsonPatch","postgres","smtp","socks5","s3"].includes(Q[0]??""))h1(Z,`${Z} must have exactly one of \`headers\`, \`jsonPatch\`, \`postgres\`, \`smtp\`, \`socks5\` or \`s3\` (got: ${Q.length===0?"nothing":Q.join(", ")})`);if(Q[0]==="s3"){ka4($.s3,`${Z}.s3`);return}if(Q[0]==="jsonPatch"){let Y=$.jsonPatch;if(!Array.isArray(Y)||Y.length>128)h1(Z,`${Z}.jsonPatch must be an array of at most 128 operations`);let X=(W)=>typeof W==="string"&&(W===""||W.startsWith("/"))&&!/~(?:[^01]|$)/u.test(W),J=(W,K=new Set,H=0)=>{if(H>64)return!1;if(W===null||typeof W==="string"||typeof W==="boolean")return!0;if(typeof W==="number")return Number.isFinite(W);if(typeof W!=="object"||K.has(W))return!1;K.add(W);let F=(Array.isArray(W)?Array.from(W):LX(W)?Object.values(W):[void 0]).every((U)=>J(U,K,H+1));return K.delete(W),F};for(let[W,K]of Y.entries()){if(!LX(K)||!["add","remove","replace","move","copy","test"].includes(String(K.op))||!X(K.path))h1(Z,`${Z}.jsonPatch[${W}] requires a standard op and valid JSON Pointer path`);if(["move","copy"].includes(K.op)&&!X(K.from))h1(Z,`${Z}.jsonPatch[${W}].from must be a JSON Pointer`);if(["add","replace","test"].includes(K.op)&&(!Object.hasOwn(K,"value")||!J(K.value)))h1(Z,`${Z}.jsonPatch[${W}].value must be a JSON value (null is allowed)`)}let G;try{G=JSON.stringify(Y)}catch{h1(Z,"jsonPatch must be JSON serializable")}if(Buffer.byteLength(G,"utf8")>65536)h1(Z,"jsonPatch exceeds 64 KiB");return}if(Q[0]==="socks5"){let Y=$.socks5;if(!LX(Y))h1(`${Z}.socks5`,`${Z}.socks5 must be an object with \`username\` and \`password\``);for(let X of Object.keys(Y))if(!["username","password"].includes(X))h1(`${Z}.socks5.${X}`,`${Z}.socks5 has unknown field \`${X}\`. Expected: username, password`);for(let X of["username","password"])if(typeof Y[X]!=="string"||Y[X].length===0)h1(`${Z}.socks5.${X}`,`${Z}.socks5.${X} is required and must be a non-empty string`);return}if(Q[0]==="smtp"){let Y=$.smtp;if(!LX(Y))h1(`${Z}.smtp`,`${Z}.smtp must be an object with \`username\` and \`password\``);for(let X of Object.keys(Y))if(!["username","password"].includes(X))h1(`${Z}.smtp.${X}`,`${Z}.smtp has unknown field \`${X}\`. Expected: username, password`);for(let X of["username","password"])if(typeof Y[X]!=="string"||Y[X].length===0)h1(`${Z}.smtp.${X}`,`${Z}.smtp.${X} is required and must be a non-empty string`);return}if(Q[0]==="headers"){let Y=$.headers;if(!LX(Y))h1(`${Z}.headers`,`${Z}.headers must be an object of header name to value`);for(let[X,J]of Object.entries(Y))if(typeof J!=="string")h1(`${Z}.headers.${X}`,`${Z}.headers.${X} must be a string`)}else{let Y=$.postgres;if(!LX(Y))h1(`${Z}.postgres`,`${Z}.postgres must be an object with \`username\` and \`password\``);for(let J of Object.keys(Y))if(!["username","password","database"].includes(J))h1(`${Z}.postgres.${J}`,`${Z}.postgres has unknown field \`${J}\`. Expected: username, password, database`);let X=Y;for(let J of["username","password"])if(typeof X[J]!=="string"||X[J].length===0)h1(`${Z}.postgres.${J}`,`${Z}.postgres.${J} is required and must be a non-empty string`);if(X.database!==void 0&&typeof X.database!=="string")h1(`${Z}.postgres.database`,`${Z}.postgres.database must be a string`)}}function Ca4($,Z){let Q=$;return Z.forEach((Y,X)=>{let J=Ia4(Y);if(Q===void 0)Q=J;else if(Q!==J)h1(`transform[${X}]`,`transform requires protocol \`${J}\` but the rule is \`${Q}\`; a rule terminates one protocol`)}),Q??"http"}function _a4($,Z){if(!LX($)||Object.keys($).some((Q)=>Q!=="method"&&Q!=="path"))h1(Z,`${Z} must be an object containing only method and path`);if($.method!==void 0&&(!Array.isArray($.method)||$.method.some((Q)=>typeof Q!=="string"||Q.length===0||/[^!#$%&'*+.^_`|~0-9A-Za-z-]/.test(Q))))h1(`${Z}.method`,`${Z}.method must be an array of HTTP method tokens`);if($.path!==void 0){let Q=$.path;if(!LX(Q)||Object.keys(Q).length!==1||typeof Q.exact!=="string"||!Q.exact.startsWith("/")||/[\s?#]/.test(Q.exact))h1(`${Z}.path`,`${Z}.path must contain exact: an absolute path without a query or fragment`)}}function uk$($,Z){if(!LX($))h1(Z||"rule",`${Z||"rule"} must be an object`);for(let H of Object.keys($))if(!yk$.includes(H))h1(`${Z}${H}`,`Unknown field \`${H}\`. Expected one of: ${yk$.join(", ")}`);let Q=$;if(Q.action===void 0)h1(`${Z}action`,`${Z}action is required. Write \`action: "allow"\` \u2014 every rule states what it does rather than defaulting to it`);if(Q.action!=="allow")h1(`${Z}action`,`${Z}action must be "allow" (got \`${String(Q.action)}\`). Only allow rules exist today`);if(Q.protocol!==void 0&&!Vk$.includes(Q.protocol))h1(`${Z}protocol`,`${Z}protocol must be one of: ${Vk$.join(", ")} (got \`${String(Q.protocol)}\`)`);let Y=Q.source??{},X=Q.destination??{};fk$(Y,"source"),fk$(X,"destination");let J=Q.transform??[];if(!Array.isArray(J))h1(`${Z}transform`,`${Z}transform must be an array`);J.forEach((H,F)=>Sa4(H,`${Z}transform[${F}]`));let G=Ca4(Q.protocol,J);if(Q.match!==void 0){if(_a4(Q.match,`${Z}match`),G!=="http"||Y.public===!0||!(X.public===!0||X.host!==void 0))h1(`${Z}match`,"match requires HTTP egress from a VM or VPC to a public origin or host")}if(J.some((H)=>("s3"in H))){if(J.length!==1||Q.match!==void 0||Y.public===!0||!(X.public===!0||X.host!==void 0)||Q.domain.includes("*"))h1(`${Z}transform`,"s3 requires a sole transform on HTTP egress to a concrete origin, without match")}let W=J.filter((H)=>("jsonPatch"in H));if(W.length>1)h1(`${Z}transform`,"a rule may carry only one jsonPatch transform");if(W.length&&(Y.public===!0||!(X.public===!0||X.host!==void 0)))h1(`${Z}transform`,"jsonPatch requires HTTP egress from a VM or VPC to a public origin or host");if(Q.forwardAuth!==void 0){Ma4(Q.forwardAuth,`${Z}forwardAuth`);let H=X.vmId!==void 0||!l80(X)&&X.port!==void 0;if(G!=="http"||Y.public!==!0||!H||Q.domain==="*")h1(`${Z}forwardAuth`,`${Z}forwardAuth is only supported on HTTP public ingress: \`{ public: true } -> { vmId, port }\``)}if(G==="smtp")Va4(Q.domain);else QY1(Q.domain);if((Y.vmId!==void 0||Y.vpcId!==void 0)&&X.vmId!==void 0&&J.length>0)h1(`${Z}transform`,"a VM-to-VM rule cannot carry a transform yet \u2014 remove it (only public ingress/egress rules run transforms)");if(G==="tcp"){let H=X.public===!0||X.host!==void 0,F=Y.vmId!==void 0||Y.vpcId!==void 0;if(H||F)h1(`${Z}protocol`,"a `tcp` rule is public ingress only \u2014 `{ public: true } -> { vmId, port }`. The edge splices the session without terminating it, so outbound there is nothing to broker (an outbound allow is a firewall rule, and injecting into one needs `http` or `postgres`) and inward there is no certificate to answer the source with. Give the source `public: true`, or drop `protocol` to be served as HTTPS")}else if(G==="imap"||G==="imaps"){let H=X.public===!0||X.host!==void 0,F=Y.vmId!==void 0||Y.vpcId!==void 0;if(H||F)h1(`${Z}protocol`,`an \`${G}\` rule is public ingress only \u2014 \`{ public: true } -> { vmId, port }\`. The 993 front serves mail clients reaching a VM's IMAP server; outbound there is nothing to broker (an outbound allow is a firewall rule) and inward there is no certificate to answer the source with`)}else if(G==="socks5"){let H=X.public===!0||X.host!==void 0;if(Y.public===!0||!H)h1(`${Z}protocol`,'a `socks5` rule is egress only \u2014 `{ vmId } -> { host: "gate.provider.com", port: 1080 }`. The front exists so a guest can open sessions through a proxy whose credentials it never holds; inbound there is nothing to serve, and publishing one would be an open proxy on a platform address');if(X.host===void 0)h1(`${Z}destination`,"a `socks5` rule has to name the proxy it goes through: give the destination a `host` and the `port` the provider listens on. `{ public: true }` on its own asks the edge to be the proxy, which would let the guest out on our address rather than through yours")}else if(G==="postgres"){let H=J.some((U)=>U!==null&&typeof U==="object"&&("postgres"in U)),F=X.public===!0||X.host!==void 0;if(H&&!F)h1(`${Z}transform`,"a `postgres` transform belongs on an egress rule: the edge spends a credential the guest never holds, so pointing it at your own VM would hand every client a logged-in session. Give the destination `public: true` or a `host`, or drop the transform")}else if(G==="smtp"){let H=J.some((U)=>U!==null&&typeof U==="object"&&("smtp"in U)),F=X.public===!0||X.host!==void 0;if(H&&!F)h1(`${Z}transform`,"an `smtp` transform belongs on an egress rule: the edge spends a credential the guest never holds, so pointing it at your own VM would turn it into an open relay. Give the destination `public: true` or a `host`, or drop the transform");if(typeof Q.domain==="string"&&Q.domain.includes("@")&&Y.public!==!0)h1(`${Z}domain`,`\`${Q.domain}\` names a mailbox, which only makes sense on a rule that receives mail. An egress or VM-to-VM rule names the host the guest submits through \u2014 drop the part before \`@\``)}return{...Q,source:Y,destination:X}}function va4($,Z){if($==="source")return Ra4(Z)?"source is empty. Say who opens the session: `vmId`, `vpcId`, or `public: true`":"source only narrows the session without saying who opens it. Add `vmId`, `vpcId`, or `public: true`";return"destination is empty. Say where the session lands: `vmId` + `port`, `host` + `port`, or `public: true` for the domain's own origin"}function gk$($){let Z=uk$($,"");for(let Q of["source","destination"]){let Y=Z[Q];if(!l80(Y))h1(Q,va4(Q,Y))}if(Z.source.public===!0&&Z.destination.public===!0)h1("destination","a rule from the public Internet to the domain's own origin allows nothing the world cannot already do. Did you mean a `vmId` destination (ingress) or a `vmId` source (egress)?");return Z}function lk$($){if(!LX($))h1("tls","tls must be an object with a `rules` array");for(let Q of Object.keys($))if(Q!=="rules")h1(`tls.${Q}`,`tls has unknown field \`${Q}\`. Expected: rules`);let Z=$.rules;if(!Array.isArray(Z))h1("tls.rules","tls.rules must be an array");return Z.forEach((Q,Y)=>{let X=`tls.rules[${Y}].`,J=uk$(Q,X),G=l80(J.source),W=l80(J.destination);if(!G&&!W)h1(`tls.rules[${Y}]`,`tls.rules[${Y}]: both source and destination refer to the VM being created, which allows nothing. Give one of them a \`vmId\`, \`vpcId\`, or \`public: true\``);if(G&&W)h1(`tls.rules[${Y}]`,`tls.rules[${Y}]: neither end refers to the VM being created. Leave one endpoint's identity unset so it means this VM, or create the rule with tls.rules.create instead`);if(!W&&J.destination.port===void 0)h1(`tls.rules[${Y}].destination.port`,`tls.rules[${Y}]: destination.port is required: say which port on this VM the session lands on`)}),$}function $Y1($){return`/v5/tls/${i6($)}`}function ZY1($){return`/v5/tls/forward-auth/${i6($)}`}class ck${client;constructor($){this.client=$}list(){return this.client.get("/v5/tls/forward-auth")}async create($){let Z=bk$($);return this.client.post("/v5/tls/forward-auth",Z)}get($){return this.client.get(ZY1($))}async update($,Z){let Q=bk$(Z);return this.client.put(ZY1($),Q)}delete($){return this.client.delete(ZY1($))}}class mk${client;constructor($){this.client=$}async create($){let Z=gk$($);return this.client.post("/v5/tls",Z)}list($={}){return this.client.get("/v5/tls",$)}get($){return this.client.get($Y1($))}async update($,Z){let Q=gk$(Z);return this.client.put($Y1($),Q)}delete($){return this.client.delete($Y1($))}}class JY1{client;rules;forwardAuth;constructor($){this.client=$,this.rules=new mk$($),this.forwardAuth=new ck$($)}}var YY1,XY1,Mk$,Oa4,Vk$,wa4=253,ja4=63,Ik$,kk$,Ea4,Pa4,za4=2048,Sk$=32,Ck$=16384,_k$=32,vk$=32,Aa4=128,Ta4,xk$="!#$%&'*+-/=?^_`{|}~.",yk$;var oq0=L(()=>{RK();YY1=class YY1 extends Error{path;constructor($,Z){super(Z);this.name="TlsRuleValidationError",this.path=$,Object.setPrototypeOf(this,YY1.prototype)}};XY1=class XY1 extends Error{path;constructor($,Z){super(Z);this.name="TlsForwardAuthValidationError",this.path=$,Object.setPrototypeOf(this,XY1.prototype)}};Mk$=["vmId","vpcId","public","host","port"],Oa4=["vmId","vpcId","public","host"],Vk$=["tcp","http","postgres","minecraft","smtp","imap","imaps","socks5"],Ik$=["url","headers","timeoutMs","protectedCookies","authResponseHeaders"],kk$=["id"],Ea4=/^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/,Pa4=/^[0-9A-Za-z-]+$/,Ta4=new Set(["host","content-length","connection","keep-alive","proxy-authenticate","proxy-authorization","proxy-connection","te","trailer","transfer-encoding","upgrade"]);yk$=["action","domain","protocol","source","destination","transform","match","forwardAuth"]});function vi($){return`/v5/tunnels/${i6($)}`}function uy($){return $.tunnelId??=$.id,$}class GY1{client;constructor($){this.client=$}list(){return this.client.get("/v5/tunnels").then(($)=>{return $.tunnels.forEach(uy),$})}create($={}){return this.client.post("/v5/tunnels",$).then(uy)}get($){return this.client.get(vi($)).then(uy)}update($,Z){return this.client.patch(vi($),Z).then(uy)}rotateKey($,Z={}){return this.client.post(`${vi($)}/rotate-key`,Z).then(uy)}delete($){return this.client.delete(vi($))}attachVpc($,Z,Q={}){return this.client.post(`${vi($)}/vpcs/${i6(Z)}`,Q).then(uy)}detachVpc($,Z){return this.client.delete(`${vi($)}/vpcs/${i6(Z)}`).then(uy)}}var WY1=L(()=>{RK()});class KY1{client;basePath;constructor($,Z){this.client=$,this.basePath=Z}async readFile($,Z={}){let Q=await this.openRead($,Z);return new Uint8Array(await Q.arrayBuffer())}async readTextFile($,Z={}){return await(await this.openRead($,Z)).text()}async readFileStream($,Z={}){let Q=await this.openRead($,Z);if(!Q.body)throw Error(`no response body reading ${$}`);return Q.body}async writeFile($,Z,Q={}){let Y=typeof Z==="string"?new TextEncoder().encode(Z):Z,X=Y instanceof Uint8Array?Y.byteLength:Y.size;if(X>ba4)return this.uploadInChunks($,Y,X,Q);let J=Y instanceof Uint8Array?Y:new Uint8Array(await Y.arrayBuffer());await this.client.putBytes(`${this.basePath}/fs/write`,J,{path:$,mode:Q.mode,sha256:await dk$(J)},Q.signal),Q.onProgress?.({completedBytes:X,totalBytes:X})}writeTextFile($,Z,Q={}){return this.writeFile($,Z,Q)}async readDir($){let{entries:Z}=await this.client.get(`${this.basePath}/fs/dir`,{path:$});return Z}async mkdir($){await this.client.post(`${this.basePath}/fs/mkdir`,{path:$})}async remove($){await this.client.delete(`${this.basePath}/fs/remove`,{path:$})}async exists($){let{exists:Z}=await this.client.get(`${this.basePath}/fs/exists`,{path:$});return Z}stat($){return this.client.get(`${this.basePath}/fs/stat`,{path:$})}openRead($,Z){let{offset:Q,length:Y}=Z,X;if(Q!==void 0||Y!==void 0){let J=Q??0;X=Y===void 0?`bytes=${J}-`:`bytes=${J}-${J+Y-1}`}return this.client.getBytes(`${this.basePath}/fs/read`,{path:$},{range:X,signal:Z.signal})}async uploadInChunks($,Z,Q,Y){let X=Y.chunkSize??xa4,J=Y.maxAttempts??fa4,G=Z instanceof Uint8Array?await dk$(Z):void 0,W=await this.client.post(`${this.basePath}/fs/uploads`,{path:$,size:Q,sha256:G,mode:Y.mode}),K=`${this.basePath}/fs/uploads/${W.uploadId}`;try{let H=W.receivedBytes;while(H<Q){let F=Math.min(H+X,Q),U=Z instanceof Uint8Array?Z.subarray(H,F):Z.slice(H,F);H=(await this.putChunkWithRetry(K,U,H,J,Y.signal)).receivedBytes,Y.onProgress?.({completedBytes:Math.min(H,Q),totalBytes:Q})}await this.client.post(`${K}/commit`)}catch(H){throw await this.client.delete(K).catch(()=>{}),H}}async putChunkWithRetry($,Z,Q,Y,X){let J;for(let G=1;G<=Y;G++){X?.throwIfAborted?.();try{return await this.client.putBytes($,Z,{offset:Q},X)}catch(W){if(J=W,!(!(W instanceof qJ)||W.status>=500||W.status===408||W.status===409||W.status===429)||X?.aborted||G===Y)throw W;await ya4(Math.min(500*2**(G-1),8000));let H=await this.client.get($).catch(()=>{return});if(H&&H.receivedBytes>Q)return H}}throw J}}async function dk$($){let Z=globalThis.crypto?.subtle;if(!Z)return;let Q=await Z.digest("SHA-256",$);return Array.from(new Uint8Array(Q),(Y)=>Y.toString(16).padStart(2,"0")).join("")}function ya4($){return new Promise((Z)=>setTimeout(Z,$))}var ba4=8388608,xa4=16777216,fa4=5;var HY1=L(()=>{h80()});function ga4(){return typeof process<"u"&&Boolean(process.versions?.node)}async function ik$($,Z){if(ga4()){let Y;try{Y=await import("ws")}catch{throw Error("PTY sessions need the `ws` package in Node. Install it with `npm install ws`.")}return new Y.default($,{headers:Z})}let Q=globalThis.WebSocket;if(!Q)throw Error("PTY sessions need a WebSocket client; no global WebSocket is available in this environment.");return new Q($)}function c80($,Z,Q){if($.on){$.on(Z,Q);return}$.addEventListener?.(Z,Q)}function ua4($,Z){if($&&typeof $==="object"&&"data"in $){let Q=$.data;if(typeof Q==="string")return{text:Q};if(Q instanceof ArrayBuffer)return{binary:new Uint8Array(Q)};return{}}if($ instanceof Uint8Array)return Z?{binary:$}:{text:ha4.decode($)};if(typeof $==="string")return{text:$};return{}}class FY1{_sessionId;_slug;_created=!1;socket;constructor($,Z,Q={}){this.socket=$,this._sessionId=Z,c80($,"message",(Y,X)=>{let{text:J,binary:G}=ua4(Y,X);if(G){Q.onData?.(G);return}if(!J)return;let W;try{W=JSON.parse(J)}catch{return}if(W.type==="exited")Q.onExit?.(W.exitCode);else if(W.type==="error")Q.onError?.(Error(W.message));else if(W.type==="sessionInfo")this._sessionId=W.sessionId,this._slug=W.slug,this._created=W.created??!0,Q.onSessionInfo?.(W.sessionId)}),c80($,"close",(Y)=>{let X=Y;Q.onClose?.({wasClean:X?.wasClean??!0,code:X?.code??1000,reason:X?.reason??""})}),c80($,"error",(Y)=>Q.onError?.(Y))}write($){this.socket.send(typeof $==="string"?new TextEncoder().encode($):$)}resize($){this.sendControl({type:"resize",cols:$.cols,rows:$.rows})}signal($){this.sendControl({type:"signal",signal:$})}sendControl($){this.socket.send(JSON.stringify($))}detach(){this.socket.close()}get sessionId(){return this._sessionId}get slug(){return this._slug}get created(){return this._created}get readyState(){return this.socket.readyState}}function la4($){return new Promise((Z,Q)=>{if($.readyState===1){Z();return}c80($,"open",()=>Z()),c80($,"error",(Y)=>Q(Y))})}class UY1{client;basePath;constructor($,Z){this.client=$,this.basePath=Z}async open($={}){let{exec:Z,cols:Q,rows:Y,linuxUser:X,slug:J,replaceOnExit:G,onData:W,onExit:K,onClose:H,onError:F}=$,U={};if(Z!==void 0)U.exec=Z;if(Q!==void 0)U.cols=Q;if(Y!==void 0)U.rows=Y;if(X!==void 0)U.linuxUser=X;if(J!==void 0)U.slug=J;if(G!==void 0)U.replaceOnExit=String(G);let N=pk$(this.client,`${this.basePath}/pty`,U),B=this.client.authHeaders(),D=await ik$(N,B);return new Promise((O,w)=>{let j=!1,E=new FY1(D,-1,{onData:W,onExit:K,onClose:(P)=>{if(!j)j=!0,w(Error("connection closed before sessionInfo"));H?.(P)},onError:(P)=>{if(!j)j=!0,w(P);F?.(P)},onSessionInfo:()=>{j=!0,O(E)}})})}async attach($){let{session:Z,linuxUser:Q,onData:Y,onExit:X,onClose:J,onError:G}=$,W=pk$(this.client,`${this.basePath}/pty/sessions/${i6(String(Z))}`,{...Q!==void 0?{linuxUser:Q}:{}}),K=this.client.authHeaders(),H=await ik$(W,K),F=new FY1(H,typeof Z==="number"?Z:-1,{onData:Y,onExit:X,onClose:J,onError:G});return await la4(H),F}list($={}){return this.client.get(`${this.basePath}/pty/sessions`,$)}close($,Z={}){return this.client.delete(`${this.basePath}/pty/sessions/${i6(String($))}`,Z)}}class NY1{pty;linuxUser;constructor($,Z){this.pty=$,this.linuxUser=Z}open($={}){return this.pty.open({...$,linuxUser:this.linuxUser})}attach($){return this.pty.attach({...$,linuxUser:this.linuxUser})}list(){return this.pty.list({linuxUser:this.linuxUser})}close($){return this.pty.close($,{linuxUser:this.linuxUser})}}function pk$($,Z,Q){return $.url(Z,Q).replace(/^http/,"ws")}var ha4;var BY1=L(()=>{RK();ha4=new TextDecoder});class DY1{client;constructor($){this.client=$}list($={}){return this.client.get("/v5/snapshots",$)}get($){return this.client.get(`/v5/snapshots/${i6($)}`)}update($,Z){return this.client.patch(`/v5/snapshots/${i6($)}`,Z)}delete($){return this.client.delete(`/v5/snapshots/${i6($)}`)}}var LY1=L(()=>{RK()});var nk$=()=>{};function OY1($){return`/v5/vms/${i6($)}`}class wY1{id;fs;pty;client;basePath;constructor($,Z){this.client=$,this.id=Z,this.basePath=OY1(Z),this.fs=new KY1($,this.basePath),this.pty=new UY1($,this.basePath)}data(){return this.client.get(this.basePath)}firewallRules(){return this.client.get("/v5/firewall/rules",{vmId:this.id})}update($){return this.client.patch(this.basePath,$)}start(){return this.client.post(`${this.basePath}/start`)}pause(){return this.client.post(`${this.basePath}/pause`)}resize($){return this.client.post(`${this.basePath}/resize`,$)}delete(){return this.client.delete(this.basePath)}exec($){let Z=typeof $==="string"?{command:$}:$;return this.client.post(`${this.basePath}/exec-await`,Z)}linuxUser($){return new tk$(this,$)}snapshot($={}){return this.client.post(`${this.basePath}/snapshot`,$)}}class tk${vm;linuxUser;pty;constructor($,Z){this.vm=$,this.linuxUser=Z,this.pty=new NY1($.pty,Z)}exec($){let Z=typeof $==="string"?{command:$}:$;return this.vm.exec({...Z,linuxUser:this.linuxUser})}}class jY1{client;snapshots;constructor($){this.client=$,this.snapshots=new DY1($)}async create($){if(tq0($.firewall,"VM"),$.tls!==void 0)lk$($.tls);let Z=await this.client.post("/v5/vms",$);return{vm:new wY1(this.client,Z.id),vmId:Z.id,data:Z,firewallRules:Z.firewallRules??[],tlsRules:Z.tlsRules??[]}}list($={}){return this.client.get("/v5/vms",$)}get($){return this.client.get(OY1($))}ref($){return new wY1(this.client,$)}delete($){return this.client.delete(OY1($))}}var EY1=L(()=>{u80();oq0();RK();HY1();BY1();LY1();nk$();HY1();BY1();LY1()});function PY1($){return`/v5/vpcs/${i6($)}`}class ok${client;basePath;constructor($,Z){this.client=$,this.basePath=Z}list(){return this.client.get(`${this.basePath}/tunnels`)}}class zY1{id;tunnels;client;basePath;constructor($,Z){this.client=$,this.id=Z,this.basePath=PY1(Z),this.tunnels=new ok$($,this.basePath)}data(){return this.client.get(this.basePath)}update($){return this.client.patch(this.basePath,$)}delete(){return this.client.delete(this.basePath)}}class AY1{client;constructor($){this.client=$}list(){return this.client.get("/v5/vpcs")}async create($={}){if($.firewall!==void 0)tq0($.firewall,"network");let Z=await this.client.post("/v5/vpcs",$);return{vpc:new zY1(this.client,Z.id),vpcId:Z.id,data:Z,firewallRules:Z.firewallRules??[]}}get($){return this.client.get(PY1($))}ref($){return new zY1(this.client,$)}delete($){return this.client.delete(PY1($))}}var TY1=L(()=>{u80();RK()});class sq0{client;vms;vpc;tunnels;firewall;tls;domains;identities;constructor($={}){this.client=new mQ1($),this.vms=new jY1(this.client),this.vpc=new AY1(this.client),this.tunnels=new GY1(this.client),this.firewall=new oQ1(this.client),this.tls=new JY1(this.client),this.domains=new dQ1(this.client),this.identities=new aQ1(this.client)}fetch($,Z){return this.client.fetch($,Z)}}var sk$=L(()=>{RK();iQ1();u80();eQ1();oq0();WY1();EY1();TY1();RK();h80();EY1();TY1();WY1();iQ1();u80();oq0();eQ1()});var ak$;var rk$=L(()=>{ak$={name:"@decocms/sandbox",version:"1.93.1",private:!0,type:"module",description:"Sandbox runtime for isolated Studio tool execution",scripts:{check:"tsc --noEmit",test:"bun test",build:"bun run build:typegen && bun run build:harness-runner","build:typegen":"mkdir -p dist && bun run --cwd=../typegen build && bun --cwd=../typegen pm pack --filename $PWD/dist/typegen.tgz --quiet","build:harness-runner":"mkdir -p dist && bun --cwd=../harness-runner pm pack --filename $PWD/dist/harness-runner.tgz --quiet"},exports:{"./shared":"./shared.ts","./provider":"./server/provider/index.ts","./provider/agent-sandbox":"./server/provider/agent-sandbox/index.ts","./provider/postgres-state-store":"./server/provider/postgres-state-store.ts","./provider/freestyle":"./server/provider/freestyle.ts","./provider/remote":"./server/provider/remote.ts","./provider/router":"./server/provider/router.ts","./provider/sandbox-api":"./server/provider/sandbox-api.ts","./provider/sandbox-server":"./server/provider/sandbox-server.ts","./daemon-client":"./server/daemon-client.ts","./org-fs":"./org-fs.ts","./dispatch":"./dispatch/index.ts","./dispatch/*":"./dispatch/*.ts","./proxy/http":"./proxy/http.ts","./proxy/websocket":"./proxy/websocket.ts"},dependencies:{"@decocms/shared":"workspace:*","@kubernetes/client-node":"^1.4.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0",freestyle:"0.2.16",zod:"4.3.6"},devDependencies:{"@types/bun":"latest",postgres:"^3.4.5",typescript:"^7.0.2"}}});function rq0($){let Z=$?.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of studio-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"});return async(Q,Y)=>{if(!Z)return Y();let X=performance.now(),J=(G)=>Z.record(performance.now()-X,{runner_kind:Q,source:"daemon",status_code:G});try{let G=await Y();return J(G.status),G}catch(G){throw J(0),G}}}var RL;var aq0=L(()=>{RL={kubernetes:"agent-sandbox",freestyle:"freestyle"}});var KS$={};O6(KS$,{FreestyleSandboxProvider:()=>GS$});import{createHash as ek$,createHmac as ma4,randomBytes as da4}from"crypto";class GS${apiKey;freestyle;lookupClient;image;sidecarImage;allowUserNamespaces;idleTimeoutSeconds;idlePauseMs;autoDeleteSeconds;domainSuffix;timeDaemonRequest;inflight=new yy;snapshotInflight=new yy;knownSnapshots=new Set;lookups=new Map;releaseTimers=new Map;idleSweep=null;sweeping=!1;repoSnapshots=new Map;repoSnapshotBuilds=new Set;repoSnapshotFailures=new Map;constructor($){if(this.apiKey=$.apiKey,this.freestyle=$.client??new sq0({apiKey:$.apiKey}),this.lookupClient=$.client??new sq0({apiKey:$.apiKey,fetch:Object.assign((Z,Q)=>fetch(Z,{...Q,signal:Q?.signal?AbortSignal.any([Q.signal,AbortSignal.timeout(IY1)]):AbortSignal.timeout(IY1)}),{preconnect:fetch.preconnect})}),this.image=$.image??`ghcr.io/decocms/studio/studio-sandbox-go:${ak$.version}`,this.sidecarImage=$.orgFsSidecarImage??pa4,this.allowUserNamespaces=$.allowUserNamespaces??!1,this.idleTimeoutSeconds=$.idleTimeoutSeconds??300,this.idlePauseMs=$.idlePauseMs??600000,this.autoDeleteSeconds=$.autoDeleteSeconds??86400,this.domainSuffix=$.domainSuffix??"style.dev",this.timeDaemonRequest=rq0($.meter),this.idlePauseMs>0)this.idleSweep=setInterval(()=>void this.pauseIdle(),Qe4),this.idleSweep.unref?.()}async owns($){return await this.find($)!==null}daemonUrl($){return`https://${$}.${this.domainSuffix}`}async find($,Z={}){let Q=this.lookups.get($);if(!Z.refresh&&Q&&Date.now()-Q.at<(Q.found?aa4:ea4))return Q.found;let Y=null;try{let X=await this.lookupClient.vms.get($),J=X.metadata[RY1];if(J)Y={vm:this.freestyle.vms.ref(X.id),daemon:{url:this.daemonUrl($),token:J}}}catch(X){if(!(X instanceof qJ&&X.status===404))throw X}return this.remember($,Y),Y}remember($,Z){if(this.lookups.delete($),this.lookups.size>=$e4){let Q=this.lookups.keys().next();if(!Q.done)this.lookups.delete(Q.value)}this.lookups.set($,{found:Z,at:Date.now()})}async warm(){await this.baseSnapshot().catch(($)=>console.warn(`[${s7}] base snapshot warm failed: ${cy($)}`))}baseSnapshot(){let{image:$,sidecarImage:Z}=this,Q=this.allowUserNamespaces?`
 user-namespaces`:"",Y=`studio-sandbox-${ek$("sha256").update(`${$}
 ${Z}
 running${Q}`).digest("hex").slice(0,16)}`;if(this.knownSnapshots.has(Y))return Promise.resolve(Y);return this.snapshotInflight.run(Y,async()=>{if(await this.snapshotExists(Y))return this.knownSnapshots.add(Y),Y;console.log(`[${s7}] building base snapshot ${Y} for ${$}`);let{vm:X}=await this.freestyle.vms.create({ttlSeconds:1800,firewall:{rules:[{action:"allow",source:{},destination:{public:!0}}]}});try{await this.run(X,`docker pull -q ${xi($)} && docker pull -q ${xi(Z)}`,{timeoutMs:qY1}),await this.startContainers(X,this.sentinelToken(Y)),await this.run(X,`for i in $(seq 1 240); do curl -sf -o /dev/null http://127.0.0.1:${ly}/health && exit 0; sleep 0.5; done; exit 1`,{timeoutMs:$M0+1e4}),await X.snapshot({slug:Y}),this.knownSnapshots.add(Y)}catch(J){if(!await this.snapshotExists(Y))throw J}finally{await X.delete().catch(()=>{})}return Y})}sentinelToken($){return ma4("sha256",this.apiKey).update(`daemon-sentinel:${$}`).digest("hex").slice(0,48)}async startContainers($,Z){let Q={DAEMON_TOKEN:Z,APP_ROOT:KP,PROXY_PORT:String(ly),ORGFS_SIDECAR_CONFIG_PATH:`${eq0}/config.json`,ORGFS_SIDECAR_STATUS_PATH:`${eq0}/status.json`},Y=Object.keys(Q).map((X)=>`-e ${xi(X)}`).join(" ");await this.run($,`sudo sh -c ${xi(na4)} && docker run -d --name ${$S$} --restart=always --privileged --device /dev/fuse -e APP_ROOT=${KP} -e ORGFS_FEED_IDLE_MS=60000 -v ${HP}:${KP}/org:rshared -v ${fi}:${eq0} ${xi(this.sidecarImage)}`,{timeoutMs:qY1}),await this.run($,`docker run -d --name ${bi} --restart=always${this.allowUserNamespaces?" --security-opt seccomp=unconfined --security-opt apparmor=unconfined":""} -p ${ly}:${ly} -v ${HP}:${KP}/org:rslave -v ${fi}:${eq0} ${Y} ${xi(this.image)}`,{env:Q,timeoutMs:qY1})}async repoSnapshotFor($,Z){let Q=$.repo;if(!$.repoSnapshot||!Q||!$.tenant)return null;if(($.sandboxImage??"default")!=="default")return null;let Y=TK(Q.cloneUrl)?.toLowerCase();if(!Y)return null;let X=`${Z}
@@ -4329,7 +4329,7 @@ ${J.join(`
 `)}`:X}function K95($){let Z=new Set;for(let Q of $)for(let Y of Q.split(`
 `)){let X=Y.trim();if(/^Co-authored-by:\s/i.test(X))Z.add(X)}return[...Z]}var OF8=200,s55=12,r55,e55,$95=6,Q95=300,Tx0=3;var HP1=L(()=>{O7();wZ0();r$();Ax0();r55={aheadBy:0,behindBy:0,files:[]};e55=/(?:^|\/)\.deco\/blocks\/[^/]+\.json$/i});function F95($){if(!$||$.includes(".."))return!1;return H95.test($)}function EF8($){return U95.includes($)}function FP1($){let Z=typeof $.__resolveType==="string"?$.__resolveType:null;if(!Z||!F95(Z))return null;let{__resolveType:Q,...Y}=$;return{resolveType:Z,payload:Y}}function UP1($,Z){return`${$.replace(/\/+$/,"")}/deco/invoke/${Z}`}var H95,U95;var PF8=L(()=>{H95=/^[\w./@-]+$/;U95=["vtex/loaders/intelligentSearch/productList.ts","vtex/loaders/categories/tree.ts"]});function AZ0($,Z){let Q=$?.repository;if(!Q?.owner||!Q?.name)return null;if(!Q.connectionId)return Q;if(!Z.includes(Q.connectionId))return null;return Q}async function AF8($,Z,Q,Y){let X=$.organization?.id;if(!X)throw new Mz(t7);let J=await MN($.storage,X,Y);if(J&&await LL($.storage,J)){let F=await qN($,J,{forceRefresh:!0}).catch((U)=>{throw new Mz(U instanceof Error?U.message:t7)});await zF8($,Z,Q,F);return}let G=Y.connectionId??J?.legacyConnectionId;if(!G)throw new Mz("Push requires a connected git account. Connect the repository's provider for this project and restart the sandbox.");await Ki({ctx:$,connectionId:G,organizationId:X,forceRefresh:!0,onLegacyMintError:(F)=>{let U=F instanceof Error?F.message:t7;throw new Mz(U)}});let{cloneUrl:W,gitUserName:K,gitUserEmail:H}=await IN(G,Y.owner,Y.name,$.db,$.vault).catch((F)=>{let{code:U,message:N}=J2$(F instanceof Error?F.message:String(F));throw U?new Mz(N):F});await zF8($,Z,Q,{cloneUrl:W,gitUserName:K,gitUserEmail:H})}async function zF8($,Z,Q,Y){let{cloneUrl:X,gitUserName:J,gitUserEmail:G}=Y,W=bt($),K=await Z.proxyDaemonRequest(Q,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({git:{repository:{cloneUrl:X},identity:{userName:J,userEmail:G}},...W?{operator:W}:{}})});if(!K.ok){let H=await BP(K,N95).catch(()=>K.statusText);throw Error(`Failed to refresh sandbox git credentials (${K.status}): ${H}`)}}var N95=10485760,Mz;var NP1=L(()=>{v3();Nx0();$40();HN0();X80();O7();Mz=class Mz extends Error{constructor($){super($);this.name="GitPushAuthError"}}});function D95($){let Z=$.startsWith("thread:")?$.slice(7):$;if(!Z||Z.length>255||Z.includes("..")||Z.startsWith("/")||Z.endsWith("/")||Z.endsWith(".lock")||!B95.test(Z))throw Error(`Invalid branch name: ${$}`)}function yh($){return AbortSignal.any([$.req.raw.signal,AbortSignal.timeout(O95)])}async function j95($,Z){let Q=$.var.studioContext,Y=LY(Z.branch),X=$.req.query("thread")??Y,J=X&&X===Y?Z.branchThread:X?await Q.storage.threads.get(X).catch(()=>null):null,G=J?.virtual_mcp_id===Z.virtualMcpId?J:null,W=iy(G?.metadata?.runtime);if(W)return W;let K=LM0(Z.virtualMcpMetadata),H=K==="cms"?await lE1(Q,{claimName:Z.claimName}):"alive",F=K==="cms"&&H!=="alive"?"cms":"sandbox",U=!!G&&(H==="gone"||H==="alive"&&K==="cms");if(U&&G)Z40(Q,G.id,F);if(K==="cms")console.log("sandbox proxy: no runtime stamp",{route:$.req.path,method:$.req.method,reason:G?"unstamped":"threadless",liveness:H,resolved:F,stamped:U});return F}async function E95($){let Z=$.get("vmClaim");if(Z.runner)return Z.runner;try{return await WZ($.var.studioContext)}catch{return null}}function ut($){let{runner:Z}=$.get("vmClaim");if(!Z)return $.json({error:"No sandbox runner configured"},503);return Z}async function RZ0($){let{virtualMcpMetadata:Z,connectionIds:Q}=$.get("vmClaim"),Y=$.var.studioContext,X=AZ0(Z,Q);if(!X)throw new y0({provider:"github",status:404,message:"Project has no repository"});let J=Q0(Y);return Ji(Y,J.id,X)}function DP1($,Z){let Q=Z instanceof Error?Z.message:String(Z),Y=EP$(Z);if(Y!==void 0)return $.json({error:Q},429,{...uZ,...Y===null?{}:{"Retry-After":String(Math.ceil(Y/1000))}});if(Z instanceof Z5)return $.json({error:Q},409,uZ);let X=wK(Z);if(X!==null){let J=X===404?404:X===409||X===422?409:502;return $.json({error:Q},J,uZ)}return $.json({error:Q},502,uZ)}async function BP1($,Z,Q){let Y;try{Y=await fetch(Z,Q)}catch{return $.json({error:"Preview unreachable"},502)}let X;try{X=await Y.text()}catch{return $.json({error:"Preview unreachable"},502)}return new Response(X,{status:Y.status,headers:{"content-type":Y.headers.get("content-type")??"application/json"}})}async function qF8($){try{let Z=await RZ0($),Q=await WP1(Z,$.get("vmClaim").branch);return $.json(Q,200,uZ)}catch(Z){return DP1($,Z)}}function TZ0($,Z){let Y=(qx0.get($)??Promise.resolve()).catch(()=>{}).then(Z),X=Y.catch(()=>{});return qx0.set($,X),X.finally(()=>{if(qx0.get($)===X)qx0.delete($)}),Y}async function yQ($,Z,Q){if(!Q?.runner&&$.get("vmClaim").runtime==="cms")return $.json({error:"sandbox not found: this session is sandbox-less"},404,uZ);let Y=Q?.runner??ut($);if(Y instanceof Response)return Y;let{claimName:X,userId:J,projectRef:G}=$.get("vmClaim"),W=Q?.method??"POST",K=null,H=new Headers;if(Q?.jsonBody!==void 0)K=Q.jsonBody,H.set("content-type","application/json");else if(Q?.forwardJsonBody)K=await $.req.text(),H.set("content-type","application/json");let F=Q?.signal,U={method:W,headers:H,body:K,...F?{signal:F}:{}},N=async()=>{let B=await Y.proxyDaemonRequest(X,Z,U);if(Q?.map404to410&&B.status===404){try{await B.body?.cancel()}catch{}if(await Y.adoptLiveClaim({userId:J,projectRef:G},X))B=await Y.proxyDaemonRequest(X,Z,U);if(B.status===404){try{await B.body?.cancel()}catch{}return new Response(JSON.stringify({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."}),{status:410,headers:{"content-type":"application/json",...uZ}})}}let D=await B.text(),O=Q?.redactRepoDir?P95(D):D,w=B.headers.get("content-type")??"application/json";return new Response(O,{status:B.status,headers:{"content-type":w,...uZ}})};try{if(F){let B=N();return B.catch(()=>{}),await Promise.race([B,new Promise((O,w)=>{if(F.aborted)return w(F.reason);F.addEventListener("abort",()=>w(F.reason),{once:!0})})])}return await N()}catch(B){let D=B instanceof Error?B.message:String(B);return $.json({error:`Daemon unreachable: ${D}`},502)}}function P95($){try{let Z=JSON.parse($);if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&"repoDir"in Z)return JSON.stringify({...Z,repoDir:null})}catch{}return $}async function MF8($,Z,Q,Y="GET",X){let J=await $.proxyDaemonRequest(Z,Q,{method:Y,headers:new Headers,body:null});if(J.status===404&&X){try{await J.body?.cancel()}catch{}if(await $.adoptLiveClaim(X,Z))J=await $.proxyDaemonRequest(Z,Q,{method:Y,headers:new Headers,body:null})}if(J.status===404){try{await J.body?.cancel()}catch{}throw Error("SANDBOX_GONE")}let G=await J.text();if(!J.ok){let W=`Daemon error (${J.status})`;try{W=JSON.parse(G).error??W}catch{}throw Error(W)}return JSON.parse(G)}function z95($){return VF8.includes($)}var B95,L95=524288,TF8=65536,O95=1e4,RF8=2000,w95,qx0,uZ,VF8,IF8=()=>{let $=new Q1;$.use("/:virtualMcpId/:branch/*",w95),$.post("/:virtualMcpId/:branch/write",(Q)=>yQ(Q,"/_sandbox/write",{forwardJsonBody:!0,signal:yh(Q)})),$.post("/:virtualMcpId/:branch/unlink",(Q)=>yQ(Q,"/_sandbox/unlink",{forwardJsonBody:!0,signal:yh(Q)})),$.post("/:virtualMcpId/:branch/mkdir",(Q)=>yQ(Q,"/_sandbox/mkdir",{forwardJsonBody:!0,signal:yh(Q)})),$.post("/:virtualMcpId/:branch/rename",(Q)=>yQ(Q,"/_sandbox/rename",{forwardJsonBody:!0,signal:yh(Q)})),$.post("/:virtualMcpId/:branch/read",(Q)=>yQ(Q,"/_sandbox/read",{forwardJsonBody:!0,signal:yh(Q)})),$.post("/:virtualMcpId/:branch/glob",(Q)=>yQ(Q,"/_sandbox/glob",{forwardJsonBody:!0,signal:yh(Q)})),$.post("/:virtualMcpId/:branch/grep",(Q)=>yQ(Q,"/_sandbox/grep",{forwardJsonBody:!0,signal:yh(Q)})),$.post("/:virtualMcpId/:branch/exec/:script",async(Q)=>{let Y=Q.req.param("script");if(!Y)return Q.json({error:"missing script name"},400);return yQ(Q,`/_sandbox/exec/${encodeURIComponent(Y)}`)}),$.post("/:virtualMcpId/:branch/exec/:script/kill",async(Q)=>{let Y=Q.req.param("script");if(!Y)return Q.json({error:"missing script name"},400);return yQ(Q,`/_sandbox/exec/${encodeURIComponent(Y)}/kill`)}),$.get("/:virtualMcpId/:branch/config",(Q)=>yQ(Q,"/_sandbox/config",{method:"GET",map404to410:!0,redactRepoDir:!0})),$.put("/:virtualMcpId/:branch/config",(Q)=>yQ(Q,"/_sandbox/config",{method:"PUT",forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/setup/:step",async(Q)=>{let Y=Q.req.param("step");if(!Y||!z95(Y))return Q.json({error:`step must be one of: ${VF8.join(", ")}`},400);let X=Q.get("vmClaim"),J=await lE1(Q.var.studioContext,{claimName:X.claimName})==="gone"?null:await E95(Q);if(!J)return Q.json({error:"sandbox not found: nothing is running at this ref"},404,uZ);if(Y==="start"){let G=Q0(Q.var.studioContext),W=mi(X.virtualMcpMetadata);try{await UM0({ctx:Q.var.studioContext,runner:J,handle:X.claimName,orgId:G.id,userId:X.callerUserId,entries:W})}catch(K){let H=K instanceof Error?K.message:String(K);return Q.json({error:`Failed to push env to daemon: ${H}`},502)}}return yQ(Q,`/_sandbox/setup/${Y}`,{signal:Q.req.raw.signal,map404to410:!0,runner:J})}),$.get("/:virtualMcpId/:branch/events",(Q)=>{let Y=Q.get("vmClaim");if(!Y.runner)return TO(Q,async(X)=>{await X.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:"No sandbox runner configured on this studio instance."})})});return RH8(Q,{ctx:Q.var.studioContext,claimName:Y.claimName,runner:Y.runner,virtualMcpId:Y.virtualMcpId,branch:Y.branch,userId:Y.userId,projectRef:Y.projectRef,virtualMcpMetadata:Y.virtualMcpMetadata})}),$.get("/:virtualMcpId/:branch/git/status",(Q)=>{if(Q.get("vmClaim").runtime==="cms")return qF8(Q);return Z(Q)});let Z=(Q)=>yQ(Q,"/_sandbox/git/status",{method:"GET",map404to410:!0,signal:AbortSignal.any([Q.req.raw.signal,AbortSignal.timeout(RF8)])});return $.post("/:virtualMcpId/:branch/git/status",(Q)=>{if(Q.get("vmClaim").runtime==="cms")return qF8(Q);return yQ(Q,"/_sandbox/git/status",{map404to410:!0,signal:AbortSignal.any([Q.req.raw.signal,AbortSignal.timeout(RF8)])})}),$.post("/:virtualMcpId/:branch/git/diff",async(Q)=>{let Y=Q.get("vmClaim");if(Y.runtime==="cms")try{let X=await Q.req.json().catch(()=>({})),J=await RZ0(Q),G=await KP1(J,Y.branch,X.base);return Q.json(G,200,uZ)}catch(X){return DP1(Q,X)}return yQ(Q,"/_sandbox/git/diff",{forwardJsonBody:!0,map404to410:!0})}),$.post("/:virtualMcpId/:branch/git/publish",async(Q)=>{if(Q.get("vmClaim").runtime==="cms")return Q.json({ok:!0},200,uZ);let Y=ut(Q);if(Y instanceof Response)return Y;let{claimName:X,virtualMcpMetadata:J,connectionIds:G}=Q.get("vmClaim"),W=Q.var.studioContext;return TZ0(X,async()=>{try{await cE1(W,Y,X);let K=AZ0(J,G);if(K)await AF8(W,Y,X,K)}catch(K){if(K instanceof Mz)return Q.json({error:K.message},403,uZ);let H=K instanceof Error?K.message:String(K);return Q.json({error:H},502,uZ)}return yQ(Q,"/_sandbox/git/publish",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/discard",async(Q)=>{let Y=Q.get("vmClaim");if(Y.runtime==="cms")return TZ0(Y.claimName,async()=>{let X=await Q.req.json().catch(()=>({})),J=Array.isArray(X.filepaths)?X.filepaths.filter((G)=>typeof G==="string"):[];if(J.length===0)return Q.json({error:"filepaths is required"},400,uZ);try{let G=await RZ0(Q);return await jF8(G,Y.branch,J),Q.json({ok:!0},200,uZ)}catch(G){let W=wK(G)===409||G instanceof Z5?409:502,K=G instanceof Error?G.message:String(G);return Q.json({error:K},W,uZ)}});return TZ0(Y.claimName,()=>yQ(Q,"/_sandbox/git/discard",{forwardJsonBody:!0,map404to410:!0}))}),$.post("/:virtualMcpId/:branch/git/rebase",async(Q)=>{let Y=Q.get("vmClaim");if(Y.runtime==="cms")return TZ0(Y.claimName,async()=>{try{let W=await Q.req.json().catch(()=>({})),K=await RZ0(Q),H=W.base??await K.getDefaultBranch();return await Rx0(K,Y.branch,H),Q.json({ok:!0},200,uZ)}catch(W){return DP1(Q,W)}});let X=ut(Q);if(X instanceof Response)return X;let{claimName:J}=Q.get("vmClaim"),G=Q.var.studioContext;return TZ0(J,async()=>{try{await cE1(G,X,J)}catch(W){let K=W instanceof Error?W.message:String(W);return Q.json({error:K},502,uZ)}return yQ(Q,"/_sandbox/git/rebase",{forwardJsonBody:!0,map404to410:!0})})}),$.post("/:virtualMcpId/:branch/git/judge-review",h5({maxSize:L95,onError:(Q)=>Q.json({error:"Payload too large"},413,uZ)}),async(Q)=>{let Y=Q.get("vmClaim"),X=null;if(Y.runtime!=="cms"){let H=ut(Q);if(H instanceof Response)return H;X=H}let{claimName:J,userId:G,projectRef:W}=Y,K=Q.var.studioContext;try{let H=await Q.req.json().catch(()=>({})),F=H.status,U=H.diff,N=U!=null&&typeof U.diffs==="object"&&U.diffs!==null,[B,D]=VH8(F)&&N?[F,U]:X?await Promise.all([MF8(X,J,"/_sandbox/git/status","GET",{userId:G,projectRef:W}),MF8(X,J,"/_sandbox/git/diff","GET",{userId:G,projectRef:W})]):await(async()=>{let w=await RZ0(Q);return Promise.all([WP1(w,Y.branch),KP1(w,Y.branch)])})();await KK(K,Q0(K).id,"judging whether a change needs review");let O=await SH8(K,B,D,typeof H.language==="string"?H.language:void 0);return Q.json(O,200,uZ)}catch(H){let F=H instanceof Error?H.message:String(H);if(F==="SANDBOX_GONE")return Q.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,uZ);return Q.json({error:F},502,uZ)}}),$.get("/:virtualMcpId/:branch/preview-fetch",async(Q)=>{let Y=ut(Q);if(Y instanceof Response)return Y;let{claimName:X}=Q.get("vmClaim"),J=Q.req.query("path");if(!J||!J.startsWith("/")||J.startsWith("//")||J.includes("..")||J.includes("\\"))return Q.json({error:"Path not allowed"},403);let G;try{G=await Y.getPreviewUrl(X)}catch{return Q.json({error:"Preview not available"},502)}if(!G)return Q.json({error:"Preview not available"},502);let W=G.replace(/\/+$/,"");return BP1(Q,`${W}${J}`)}),$.post("/:virtualMcpId/:branch/preview-invoke",h5({maxSize:TF8,onError:(Q)=>Q.json({error:"Payload too large"},413)}),async(Q)=>{let Y=ut(Q);if(Y instanceof Response)return Y;let{claimName:X}=Q.get("vmClaim"),J;try{J=await Y.getPreviewUrl(X)}catch{return Q.json({error:"Preview not available"},502)}if(!J)return Q.json({error:"Preview not available"},502);let G;try{G=await Q.req.json()}catch{return Q.json({error:"Invalid JSON body"},400)}if(!G||typeof G!=="object"||Array.isArray(G))return Q.json({error:"Invalid JSON body"},400);let W=FP1(G);if(!W)return Q.json({error:"Invalid or missing __resolveType"},400);let K=UP1(J,W.resolveType);return BP1(Q,K,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(W.payload),signal:AbortSignal.timeout(30000)})}),$.post("/:virtualMcpId/:branch/catalog-invoke",h5({maxSize:TF8,onError:(Q)=>Q.json({error:"Payload too large"},413)}),async(Q)=>{let{runner:Y,claimName:X,virtualMcpMetadata:J}=Q.get("vmClaim"),G;try{G=Y?await Y.getPreviewUrl(X):di(J)}catch{return Q.json({error:"Preview not available"},502)}if(!G)return Q.json({error:"Preview not available"},502);let W;try{W=await Q.req.json()}catch{return Q.json({error:"Invalid JSON body"},400)}if(!W||typeof W!=="object"||Array.isArray(W))return Q.json({error:"Invalid JSON body"},400);let K=FP1(W);if(!K)return Q.json({error:"Invalid or missing __resolveType"},400);if(!EF8(K.resolveType))return Q.json({error:"resolveType not allowed"},403);let H=UP1(G,K.resolveType);return BP1(Q,H,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(K.payload),signal:AbortSignal.timeout(30000)})}),$};var kF8=L(()=>{W8();eK();vt();uE1();ci();zH8();IQ();ii();AH8();OX();JF();TH8();qH8();tY1();e80();CH8();O7();k5();HP1();PF8();Q40();NP1();B95=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;w95=Ux0(async($,Z)=>{let Q=$.var.studioContext;try{p(Q)}catch{return $.json({error:"Unauthorized"},401)}let Y=C0(Q);if(!Y)return $.json({error:"Unauthorized"},401);let X;try{X=Q0(Q)}catch{return $.json({error:"Organization scope required"},403)}let J=$.req.param("virtualMcpId"),G=$.req.param("branch");if(!J||!G)return $.json({error:"virtualMcpId and branch are required"},400);try{D95(G)}catch(O){let w=O instanceof Error?O.message:String(O);return $.json({error:w},400)}let W=await Q.storage.virtualMcps.findById(J);if(!W||W.organization_id!==X.id)return $.json({error:"Virtual MCP not found"},404);let K=v80({orgId:X.id,virtualMcpId:J,branch:G}),H=await QX1(Q,G),F=YX1(H,Y),U=PH8({userId:F,projectRef:K}),N=W.metadata??null,B=await j95($,{claimName:U,branch:G,virtualMcpId:J,sandboxUserId:F,virtualMcpMetadata:N,branchThread:H});if(B==="cms")return $.set("vmClaim",{claimName:U,callerUserId:Y,runner:null,virtualMcpId:J,branch:G,userId:F,projectRef:K,virtualMcpMetadata:N,connectionIds:W.connections?.map((O)=>O.connection_id)??[],runtime:B}),Z();let D;try{D=await WZ(Q)}catch{D=null}if(!D)return $.json({error:"No sandbox runner found"},404);return $.set("vmClaim",{claimName:U,callerUserId:Y,runner:D,virtualMcpId:J,branch:G,userId:F,projectRef:K,virtualMcpMetadata:N,connectionIds:W.connections?.map((O)=>O.connection_id)??[],runtime:B}),Z()});qx0=new Map;uZ={"Cache-Control":"no-store, no-cache, must-revalidate",Pragma:"no-cache"};VF8=["clone","install","start"]});function SF8($,Z,Q){let Y=LP1.get($);if(!Y)Y={pending:null,running:!1},LP1.set($,Y);if(!Y.pending)Y.pending={patches:[],deps:Z};let X=Y.pending;X.deps=Z;let J=new Promise((G,W)=>{X.patches.push({patch:Q,resolve:G,reject:W})});if(!Y.running)T95($,Y);return J}async function T95($,Z){Z.running=!0;try{while(Z.pending){let Q=Z.pending;Z.pending=null;try{let{sha:Y,accepted:X,conflicts:J}=await M95(Q);for(let G of X)G.resolve(Y);for(let{queued:G,blocks:W}of J)G.reject(new Mx0(W))}catch(Y){for(let X of Q.patches)X.reject(Y)}}}finally{if(Z.running=!1,!Z.pending)LP1.delete($)}}async function R95($,Z,Q,Y){let X=new Map,J=[];for(let W of Q){let K=zx0(Z,W)[0],H=K?Z.find((F)=>F.path===K):void 0;if(!H)X.set(W,null);else J.push({key:W,stem:H.stem,sha:H.sha})}let G=await JP1($,J,Y);for(let[W,{content:K}]of G.entries()){let H=J[W].key;try{X.set(H,await Dx0(JSON.parse(K)))}catch{X.set(H,CF8)}}return X}async function q95($,Z){let Q=new Map(Z),Y=[],X=[];for(let J of $){let{patch:G}=J,W=Object.entries(G.expect??{}).filter(([K,H])=>{let F=Q.get(K);return F!==CF8&&F!==H}).map(([K])=>K);if(W.length>0){X.push({queued:J,blocks:W});continue}Y.push(J);for(let[K,H]of Object.entries(G.set??{}))if(Q.has(K))Q.set(K,await Dx0(H));for(let K of G.delete??[])if(Q.has(K))Q.set(K,null)}return{accepted:Y,conflicts:X}}async function M95($){let{client:Z,branch:Q,packagePath:Y}=$.deps,X=new Map;for(let J=0;;J++){let G=await ht(Z,Q),W=await Z.listDecofileEntries(G,Y),K=XP1(W,Y),H=new Set($.patches.flatMap(({patch:j})=>Object.keys(j.expect??{}))),{accepted:F,conflicts:U}=await q95($.patches,H.size>0?await R95(Z,K,H,X):new Map),N=new Map,B=new Set;for(let{patch:j}of F){for(let[E,P]of Object.entries(j.set??{}))N.set(E,P),B.delete(E);for(let E of j.delete??[])B.add(E),N.delete(E)}let D=[],O=new Map(K.map((j)=>[j.path,{stem:j.stem,sha:j.sha}]));for(let[j,E]of N){let P=zx0(K,j),T=`${JSON.stringify(E,null,2)}
 `;await BF8(Z.repo,T);let z=P[0]??`${Px0(Y)}/${nE1(j)}.json`;D.push({path:z,content:T});let A=z.slice(z.lastIndexOf("/")+1,-5);O.set(z,{stem:A,content:T});for(let q of P.slice(1))D.push({path:q,deleted:!0}),O.delete(q)}for(let j of B)for(let E of zx0(K,j))D.push({path:E,deleted:!0}),O.delete(E);if(D.length===0)return{sha:G,accepted:F,conflicts:U};let w=Y?`${Y}/.deco/blocks.gen.json`:".deco/blocks.gen.json";if(W.some((j)=>j.type==="blob"&&j.path===w)){let j=await JP1(Z,O.values(),X),{decofile:E,skipped:P}=DZ0(j);if(P.length>0)console.warn("decofile gen: dropped blocks that were not valid JSON",{repo:GF(Z.repo),branch:Q,packagePath:Y,blocks:P.map((T)=>T.key)});D.push({path:w,content:E})}try{let{sha:j}=await Z.commitFiles({branch:Q,message:V95(N,B,$.deps.coAuthor),expectedHead:G,changes:D});return{sha:j,accepted:F,conflicts:U}}catch(j){if(!(j instanceof Z5)||J>=A95-1)throw j;await F$(V7(2000,200,J,2,0.5))}}}function V95($,Z,Q){let Y=(G)=>{let W=G.slice(0,3).join(", ");return G.length>3?`${W} (+${G.length-3} more)`:W},X=[];if($.size>0)X.push(`update ${Y([...$.keys()])}`);if(Z.size>0)X.push(`delete ${Y([...Z])}`);let J=`chore(decofile): ${X.join("; ")}`;return jQ1(J,Q)}var A95=3,Mx0,LP1,CF8;var _F8=L(()=>{Sq0();wZ0();t4();r$();O7();Ax0();Mx0=class Mx0 extends Error{blocks;constructor($){super(`Blocks changed since they were loaded: ${$.join(", ")}`);this.blocks=$;this.name="BlockConflictError"}};LP1=new Map;CF8=Symbol("unreadable")});import{createHmac as vF8,randomBytes as I95,timingSafeEqual as k95}from"crypto";function bF8(){if(Vx0)return Vx0;let $;try{let Z=L0();$=Z.studioJwtSecret??Z.betterAuthSecret}catch{$=void 0}return Vx0=$?Buffer.from($):I95(32),Vx0}function OP1($){let Z=$.nowMs??Date.now(),Q={o:$.organizationId,m:$.virtualMcpId,b:$.branch,e:Math.floor((Z+S95)/1000)},Y=Buffer.from(JSON.stringify(Q)).toString("base64url"),X=vF8("sha256",bF8()).update(Y).digest("base64url");return`${Y}.${X}`}function xF8($,Z){let Q=$.indexOf(".");if(Q<0)return!1;let Y=$.slice(0,Q),X=Buffer.from($.slice(Q+1)),J=Buffer.from(vF8("sha256",bF8()).update(Y).digest("base64url"));if(X.length!==J.length||!k95(X,J))return!1;let G;try{G=JSON.parse(Buffer.from(Y,"base64url").toString())}catch{return!1}let W=Math.floor((Z.nowMs??Date.now())/1000);return G.o===Z.organizationId&&G.m===Z.virtualMcpId&&G.b===Z.branch&&typeof G.e==="number"&&G.e>=W}var S95=21600000,Vx0=null;var fF8=L(()=>{r1()});function Ix0($){return $&&typeof $==="object"&&!Array.isArray($)?$:null}function C95($){for(let[Z,Q]of Object.entries($)){if(!Z.startsWith("collections/blog/posts/"))continue;let Y=Ix0(Q)?.__resolveType;if(typeof Y==="string"&&Y)return Y}return"blog/loaders/Blogpost.ts"}function yF8($){let Z;try{Z=Ix0(JSON.parse($))}catch{return $}if(!Z)return $;let Q=C95(Z),Y={...Z},X=0;for(let[J,G]of Object.entries(Z)){if(!J.startsWith("blog-manager/posts/"))continue;let W=Ix0(G),K=W&&Ix0(W.post);if(!K)continue;if(K.status==="archived")continue;if(typeof K.slug!=="string"||!K.slug)continue;let F=`collections/blog/posts/${J.slice(19)}`;if(Object.hasOwn(Y,F))continue;Y[F]={name:F,__resolveType:Q,["post"]:{...K,status:"published"}},X++}return X>0?JSON.stringify(Y):$}import{z as qO}from"zod";function v95($){return $.length>0&&$.length<=255&&!$.includes("..")&&!$.endsWith("/")&&!$.endsWith(".lock")&&_95.test($)}function cF8($){return $.req.header("x-forwarded-host")??new URL($.req.url).host}async function qZ0($){let Z=$.get("decofileScope");return Ji($.var.studioContext,Z.organizationId,Z.repository)}function MZ0($,Z){let Q=Z instanceof Error?Z.message:String(Z);if(Z instanceof Mx0)return $.json({error:Q,code:"block-conflict",blocks:Z.blocks},409);if(Z instanceof Z5)return $.json({error:Q},409);let Y=wK(Z);if(Y!==null){let X=Y===404?404:Y===409||Y===422?409:502;return $.json({error:Q},X)}return $.json({error:Q},500)}function mF8(){let $=new Q1;return $.use("/:virtualMcpId/:branch",lF8),$.use("/:virtualMcpId/:branch/*",lF8),$.get("/:virtualMcpId/:branch",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await qZ0(Z),X=await DF8(Y,Q.branch,Q.packagePath,{createBranchIfMissing:!!Q.userId}),J={ETag:`"${X.sha}"`,"Cache-Control":"no-store","Access-Control-Allow-Origin":"*"};if(Z.req.header("if-none-match")===`"${X.sha}"`)return Z.body(null,304,J);if(!Q.userId)return Z.body(yF8(X.decofile),200,{...J,"content-type":"application/json"});let G=OP1({organizationId:Q.organizationId,virtualMcpId:Q.virtualMcpId,branch:Q.branch});return Z.body(`{"version":${JSON.stringify(X.sha)},"token":${JSON.stringify(G)},"apiHost":${JSON.stringify(cF8(Z))},"decofile":${X.decofile}}`,200,{...J,"content-type":"application/json"})}catch(Y){return MZ0(Z,Y)}}),$.get("/:virtualMcpId/:branch/meta",async(Z)=>{let Q=Z.get("decofileScope"),Y=Q.packagePath?`${Q.packagePath}/.deco/meta.gen.json`:".deco/meta.gen.json";try{let X=await qZ0(Z),J=await X.readFileAtRef(Q.branch,Y);if(J===null){let G=await X.getDefaultBranch();if(G!==Q.branch)J=await X.readFileAtRef(G,Y)}if(J===null)return Z.json({error:"meta.gen.json not committed"},404);return Z.body(J,200,{"content-type":"application/json","Cache-Control":"no-store","Access-Control-Allow-Origin":"*"})}catch(X){return MZ0(Z,X)}}),$.patch("/:virtualMcpId/:branch",x95,async(Z)=>{let Q=Z.get("decofileScope"),Y=Z.var.studioContext,X=f95.safeParse(await Z.req.json().catch(()=>null));if(!X.success)return Z.json({error:"Invalid body",details:X.error.issues},400);let J;try{J=xh(X.data)}catch(G){if(G instanceof LZ0)return Z.json({error:G.message},400);throw G}for(let G of[...Object.keys(J.set??{}),...J.delete??[]])try{Bx0(G)}catch(W){let K=W instanceof Error?W.message:String(W);return Z.json({error:K},400)}for(let[G,W]of Object.entries(J.set??{})){if(typeof W!=="object"||W===null||Array.isArray(W))return Z.json({error:`Block "${G}" must be a JSON object`},400);if(pE1(G))return Z.json({error:`Block key "${G}" collides with a framework resolver module and cannot be written`},400)}try{let G=await qZ0(Z),W=await SF8(`${Q.organizationId}/${Q.virtualMcpId}/${Q.branch}`,{client:G,branch:Q.branch,packagePath:Q.packagePath,coAuthor:bt(Y)},J),K=OP1({organizationId:Q.organizationId,virtualMcpId:Q.virtualMcpId,branch:Q.branch});return Z.json({version:W,token:K,apiHost:cF8(Z)})}catch(G){return MZ0(Z,G)}}),$.post("/:virtualMcpId/:branch/publish",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await qZ0(Z),X=await Y.getDefaultBranch();if(X===Q.branch)return Z.json({error:"Branch is already the default branch"},400);let J=`chore(decofile): publish ${Q.branch}`;try{let G;try{G=await Y.mergeBranches(X,Q.branch,J)}catch(W){if(wK(W)!==409)throw W;await Rx0(Y,Q.branch,X),G=await Y.mergeBranches(X,Q.branch,J)}return G?Z.json({result:"merged",sha:G}):Z.json({result:"up-to-date"})}catch(G){if(wK(G)===409)return Z.json({error:"merge-conflict"},409);if(wK(G)===405){let K=await Y.findOpenChangeRequest(X,Q.branch)??await Y.createChangeRequest({base:X,head:Q.branch,title:`Publish ${Q.branch}`});return Z.json({result:"pull-request",number:K.number,url:K.url})}throw G}}catch(Y){return MZ0(Z,Y)}}),$.get("/:virtualMcpId/:branch/status",async(Z)=>{let Q=Z.get("decofileScope");try{let Y=await qZ0(Z),X=await Y.getDefaultBranch();if(X===Q.branch)return Z.json({baseBranch:X,aheadBy:0,behindBy:0});try{let{aheadBy:J,behindBy:G}=await Y.compare(X,Q.branch);return Z.json({baseBranch:X,aheadBy:J,behindBy:G})}catch(J){if(wK(J)===404)return Z.json({baseBranch:X,aheadBy:0,behindBy:0});throw J}}catch(Y){return MZ0(Z,Y)}}),$}var _95,gF8=500,hF8=1048576,uF8=1024,b95=8388608,x95,f95,lF8;var dF8=L(()=>{Q40();wZ0();W8();eK();uE1();Nx0();NP1();O7();_F8();fF8();HP1();Ax0();JF();_95=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;x95=h5({maxSize:b95,onError:($)=>$.json({error:"Payload too large"},413)}),f95=qO.object({set:qO.record(qO.string(),qO.unknown()).optional(),delete:qO.array(qO.string()).optional(),expect:qO.record(qO.string(),qO.string().regex(/^[0-9a-f]{64}$/).nullable()).optional()}).refine(($)=>Object.keys($.set??{}).length>0||($.delete?.length??0)>0,{message:"Patch must set or delete at least one block"}).refine(($)=>Object.keys($.set??{}).length+($.delete?.length??0)<=gF8,{message:`Patch cannot touch more than ${gF8} blocks`}).refine(($)=>Object.values($.set??{}).every((Z)=>JSON.stringify(Z).length<=hF8),{message:`Each block must be at most ${hF8} bytes`}).refine(($)=>[...Object.keys($.set??{}),...$.delete??[]].every((Z)=>Z.length<=uF8),{message:`Each block key must be at most ${uF8} characters`}).refine(($)=>Object.keys($.expect??{}).every((Z)=>(Z in($.set??{}))||($.delete??[]).includes(Z)),{message:"Each expected block must be one the patch sets or deletes"}).refine(($)=>Object.keys($.set??{}).every((Z)=>!($.delete??[]).includes(Z)),{message:"A block cannot be both set and deleted in the same patch"}),lF8=Ux0(async($,Z)=>{let Q=$.var.studioContext,Y=Q.organization;if(!Y)return $.json({error:"Organization scope required"},500);let X=$.req.param("virtualMcpId"),J=$.req.param("branch");if(!X||!J)return $.json({error:"virtualMcpId and branch are required"},400);if(!v95(J))return $.json({error:`Invalid branch name: ${J}`},400);let G=Q.auth?.user?.id??null;if(!G){let B=$.req.query("token");if(!($.req.method==="GET"&&!$.req.path.match(/\/(publish|status)$/)))return $.json({error:"Unauthorized"},401);if(!B||!xF8(B,{organizationId:Y.id,virtualMcpId:X,branch:J}))return $.json({error:"Unauthorized"},401)}if(!await LG(Q,Y.id,"cms"))return $.json({error:"This organization's plan does not include the CMS",code:"feature_not_in_plan"},403);let W=await Q.storage.virtualMcps.findById(X);if(!W||W.organization_id!==Y.id)return $.json({error:"Virtual MCP not found"},404);let K=W.metadata??null;if(!di(K))return $.json({error:"Project has no preview server configured"},404);let F=W.connections?.map((B)=>B.connection_id)??[],U=AZ0(K,F);if(!U)return $.json({error:"Project has no repository"},404);let N=K?.runtime;return $.set("decofileScope",{organizationId:Y.id,virtualMcpId:X,branch:J,packagePath:N?.path?.replace(/^\/+|\/+$/g,"")||null,repository:U,userId:G}),Z()})});var iF8=($)=>{let Z=new Q1;if(Z.use("*",Ft),Z.use("*",OG8),Z.route("/",DG8($.voiceSessions)),Z.route("/",Pb0()),Z.route("/",mG8()),Z.route("/",Z38()),Z.route("/",gG8()),Z.route("/",JH8()),Z.route("/",WH8()),Z.route("/",rK8()),Z.route("/",YH8()),Z.route("/",eK8()),Z.route("/",Kx0()),Z.route("/tools",DH8()),Z.route("/",UH8()),Z.route("/",CK8({kvStorage:$.kvStorage})),Z.route("/",kK8()),Z.route("/fs",cK8({getConnection:$.getNatsConnection})),Z.route("/sandbox",IF8()),Z.route("/decofile",mF8()),Z.route("/",tK8()),Z.route("/",dK8()),Z.route("/deco-sites",Ab0()),Z.route("/hosting",VG8()),Z.route("/monitor",bG8()),Z.route("/sso",Db0()),Z.route("/",Hx0({tokenStorage:$.tokenStorage,automationEventDispatcher:$.automationEventDispatcher})),Z.route("/webhooks",AG8()),$.mountDevAssets)Z.route("/dev-assets",Mb0({orgFromPath:!0}));Z.use("/mcp/:connectionId?",$.mcpAuth),Z.use("/mcp/:connectionId/ui-resource",$.mcpAuth),Z.use("/mcp/gateway/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/virtual-mcp/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/self",$.mcpAuth);for(let Q of CE1)Z.use(`${Q}/:threadId`,$.mcpAuth);Z.route("/",UY8()),Z.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",$.betterAuthProtectedResourceHandler),Z.get("/mcp/.well-known/oauth-protected-resource",$.betterAuthProtectedResourceHandler);for(let Q of CE1)Z.route(Q,pK8());return Z.route("/mcp",sk0()),Z.route("/mcp/self",Xx0()),Z.route("/mcp",ek0()),Z.all("/oauth-proxy/:connectionId/*",$.oauthProxyHandler),Z.get("/watch",$.watchHandler),Z};var pF8=L(()=>{W8();LG8();wG8();Yb0();TG8();Jj1();IG8();xG8();Vb0();Pz();$j1();dG8();Fj1();SK8();_K8();mK8();iK8();$50();iw1();$S0();SE1();nK8();oK8();aK8();$H8();bE1();GH8();KH8();NH8();xE1();LH8();fE1();rk0();kF8();dF8()});import{z as gh}from"zod";class wP1{adapter;getConnection;kvPromise;constructor($,Z){this.adapter=$;this.getConnection=Z}kv(){let $=this.getConnection();if(!$||$.isClosed())throw new q1(503,{message:"Voice transport is unavailable"});return this.kvPromise??=new oF8.Kvm(kx0.jetstream($)).create("STUDIO_VOICE_SESSIONS",{storage:kx0.StorageType.Memory,ttl:sF8.nanos(kL),max_bytes:10485760}).catch((Z)=>{throw this.kvPromise=void 0,Z}),this.kvPromise}async conversationAgent($){let Z=await this.kv(),Q=`agent.${$.conversationKey}`,Y=Date.now()+45000;while(Date.now()<Y){let X=await Z.get(Q),J=X?.operation==="PUT"?tF8.parse(X.json()):null;if(J?.state==="ready")return J.agentId;if(J?.state==="creating"&&J.expiresAt>Date.now()){await F$(200);continue}let G=nF8.encode(JSON.stringify({state:"creating",expiresAt:Date.now()+40000})),W;try{W=X&&J?await Z.update(Q,G,X.revision):await Z.create(Q,G)}catch{await F$(200);continue}try{let K=await $.ensureConversationAgent();return await Z.update(Q,nF8.encode(JSON.stringify({state:"ready",agentId:K})),W),K}catch(K){throw await Z.delete(Q,{previousSeq:W}).catch(()=>{}),K}}throw new q1(503,{message:"Voice conversation is starting; try again"})}async createSession($){let Z=this.adapter.forConversationModel($.model),Q=await this.conversationAgent(Z);try{return{provider:"elevenlabs",conversationToken:await Z.createConversationToken(Q)}}catch(Y){let X=await this.kv(),J=`agent.${Z.conversationKey}`,G=await X.get(J),W=G?.operation==="PUT"?tF8.parse(G.json()):null;if(G&&W?.state==="ready"&&W.agentId===Q)await X.delete(J,{previousSeq:G.revision}).catch(()=>{});throw Y}}}var kx0,oF8,sF8,nF8,tF8;var rF8=L(()=>{$G();uN();r$();kx0=_(NH(),1),oF8=_(vT(),1),sF8=_(tz(),1),nF8=new TextEncoder,tF8=gh.discriminatedUnion("state",[gh.object({state:gh.literal("ready"),agentId:gh.string()}),gh.object({state:gh.literal("creating"),expiresAt:gh.number()})])});import{z as lt}from"zod";function y95($){return{model:$.model,instructions:`${SC$}
-Start in ${$.language==="pt"?"Brazilian Portuguese":"English"}, and follow the user's language.`,delegation:{type:"client"},audio:{output:{voice:$.voice}},store:!1}}class jP1{config;constructor($){this.config=$}async createSession(){return{provider:"openai",transport:"webrtc"}}async negotiate($){let Z=await fetch("https://api.openai.com/v1/live/sessions",{method:"POST",headers:{Authorization:`Bearer ${this.config.apiKey}`,"Content-Type":"application/json","OpenAI-Safety-Identifier":$.safetyIdentifier},body:JSON.stringify({session:y95({...this.config,language:$.language,model:$.model}),transport:{type:"webrtc",sdp:$.sdp}}),signal:AbortSignal.timeout(15000)});if(!Z.ok)throw await Z.body?.cancel(),Error(`OpenAI Live request failed (${Z.status})`);return{sdp:lt.object({session:lt.object({id:lt.string().min(1)}),transport:lt.object({type:lt.literal("webrtc"),sdp:lt.string().min(1).max(1e5)})}).parse(await Z.json()).transport.sdp}}}var aF8=L(()=>{uN()});var eF8;var $U8=L(()=>{eF8=[{name:"delegate_to_agent",description:"Submit a complete request to the selected Studio agent. Returns after acceptance while work continues in the background. Results arrive later.",parameters:{type:"object",properties:{request:{type:"string",description:"The complete user request, with relevant conversational details. Preserve intent and constraints."}},required:["request"]}},{name:"get_agent_status",description:"Read the current chat's work status and known results. This does not track independent organization tasks; delegate fresh task-status queries to the Studio agent. Use when asked, never poll.",parameters:{type:"object",properties:{}}},{name:"stop_agent_work",description:"Request cancellation in the current chat ONLY when the user explicitly asks. Speaking over the companion is not cancellation. To stop independent tasks, delegate that request to the Studio agent.",parameters:{type:"object",properties:{}}}]});function EP1($){return{conversation_config:{agent:{first_message:"",language:"en",prompt:{prompt:IC$,llm:$.conversationModel,thinking_budget:0,max_tokens:512,tools:eF8.map((Z)=>({...Z,type:"client",expects_response:!0,response_timeout_secs:Z.name==="delegate_to_agent"?20:5,...Z.name==="delegate_to_agent"?{execution_mode:"async",interruption_mode:"allow",pre_tool_speech:"off"}:{}}))}},asr:{provider:"scribe_realtime",quality:"high"},turn:{turn_eagerness:"normal",turn_timeout:-1,silence_end_call_timeout:-1},tts:{voice_id:$.voiceId,model_id:$.model},conversation:{max_duration_seconds:kL/1000,client_events:["audio","interruption","user_transcript","agent_response","client_tool_call","vad_score"]}},platform_settings:{auth:{enable_auth:!0},privacy:{record_voice:!1,retention_days:1,delete_audio:!0,delete_transcript_and_pii:!0},overrides:{conversation_config_override:{agent:{language:!0}}}}}}var ZU8=L(()=>{uN();$U8()});import{z as vJ}from"zod";import{createHash as g95,createHmac as h95}from"crypto";class Sx0{config;conversationKey;configurationKey;constructor($){this.config=$;this.configurationKey=g95("sha256").update(JSON.stringify(EP1($))).digest("hex"),this.conversationKey=h95("sha256",$.apiKey).update(this.configurationKey).digest("hex")}forConversationModel($){return $===this.config.conversationModel?this:new Sx0({...this.config,conversationModel:$})}async request($,Z,Q){let Y=await fetch(`https://api.elevenlabs.io/v1${$}`,{method:Z===void 0?"GET":"POST",headers:{"xi-api-key":this.config.apiKey,"Content-Type":"application/json"},body:JSON.stringify(Z),signal:Q});if(!Y.ok)throw await Y.body?.cancel(),Error(`ElevenLabs request failed (${Y.status})`);return Y}async ensureConversationAgent(){let $=`Studio voice ${this.configurationKey.slice(0,24)}`,Z=await this.request(`/convai/agents?search=${encodeURIComponent($)}&page_size=100`,void 0,AbortSignal.timeout(15000)),{agents:Q}=vJ.object({agents:vJ.array(vJ.object({agent_id:vJ.string(),name:vJ.string()}))}).parse(await Z.json()),Y=Q.find((J)=>J.name===$);if(Y){let J=await this.request(`/convai/agents/${encodeURIComponent(Y.agent_id)}`,void 0,AbortSignal.timeout(15000));return vJ.object({platform_settings:vJ.object({auth:vJ.object({enable_auth:vJ.literal(!0)})})}).parse(await J.json()),Y.agent_id}let X=await this.request("/convai/agents/create",{name:$,...EP1(this.config)},AbortSignal.timeout(15000));return vJ.object({agent_id:vJ.string().min(1)}).parse(await X.json()).agent_id}async createConversationToken($){let Z=await this.request(`/convai/conversation/token?agent_id=${encodeURIComponent($)}`,void 0,AbortSignal.timeout(15000));return vJ.object({token:vJ.string().min(1)}).parse(await Z.json()).token}async createTranscriptionToken(){let $=await this.request("/single-use-token/realtime_scribe",{},AbortSignal.timeout(15000));return vJ.object({token:vJ.string().min(1)}).parse(await $.json()).token}synthesize($,Z){return this.request(`/text-to-speech/${encodeURIComponent(this.config.voiceId)}/stream?output_format=mp3_44100_128`,{text:$,model_id:this.config.model},AbortSignal.any([Z,AbortSignal.timeout(60000)]))}}var QU8=L(()=>{ZU8()});import{createHmac as u95,timingSafeEqual as l95}from"crypto";import{z as ct}from"zod";function XU8($,Z){if(!Z)throw Error("Voice requires a shared authentication secret");return u95("sha256",Z).update(`studio-voice-session:v1:${$}`).digest("base64url")}function JU8($,Z){let Q=Buffer.from(JSON.stringify(YU8.parse($))).toString("base64url");return`${Q}.${XU8(Q,Z)}`}function GU8($,Z,Q=Date.now()){if(!Z||$.length>4096)return null;let Y=$.split(".");if(Y.length!==2)return null;let[X,J]=Y;if(!X||!J)return null;let G=Buffer.from(XU8(X,Z)),W=Buffer.from(J);if(W.length!==G.length||!l95(W,G))return null;try{let K=YU8.safeParse(JSON.parse(Buffer.from(X,"base64url").toString()));if(!K.success||K.data.expiresAt<=Q||K.data.expiresAt>Q+kL)return null;return K.data}catch{return null}}var YU8;var WU8=L(()=>{uN();YU8=ct.object({sessionId:ct.string().uuid(),organizationId:ct.string().min(1).max(256),userId:ct.string().min(1).max(256),threadId:ct.string().min(1).max(256),expiresAt:ct.number().int().positive()})});import{z as PP1}from"zod";function KU8($,Z){if(Z?.voice_model!=null&&Z.voice_provider==null)throw Error("A voice model override requires a provider");let Q=Z?.voice_provider??$.voiceConversationProvider;return zP1.parse({provider:Q,model:Z?.voice_model??(Q==="openai"?$.openaiLiveModel:$.elevenlabsConversationModel)})}var zP1;var HU8=L(()=>{zP1=PP1.object({provider:PP1.enum(["elevenlabs","openai"]),model:PP1.string().trim().min(1).max(128)})});import{createHash as c95}from"crypto";import{z as mt}from"zod";function dt($){return`user.${c95("sha256").update(JSON.stringify([$.organizationId,$.userId])).digest("hex")}`}class TP1{deps;kvPromise;constructor($){this.deps=$}kv(){let $=this.deps.getConnection();if(!$||$.isClosed())throw new q1(503,{message:"Voice transport is unavailable"});return this.kvPromise??=new FU8.Kvm(_x0.jetstream($)).create("STUDIO_VOICE_SESSIONS",{storage:_x0.StorageType.Memory,ttl:UU8.nanos(kL),max_bytes:10485760}).catch((Z)=>{throw this.kvPromise=void 0,Z}),this.kvPromise}adapter(){if(!this.deps.adapter)throw new q1(503,{message:"Voice is not configured on this deployment"});return this.deps.adapter}async create($,Z=!1,Q="en",Y){let X;if(Z)try{X=KU8(this.deps.defaults,Y)}catch{throw new q1(503,{message:"Voice configuration is invalid"})}let J=X?this.deps.conversationAdapters[X.provider]:this.adapter();if(!J)throw new q1(503,{message:"Voice is not configured on this deployment"});let G={...$,sessionId:crypto.randomUUID(),expiresAt:Date.now()+kL},W=JU8(G,this.deps.secret),K=await this.kv(),H=dt(G),F=await K.get(H),U=F?.operation==="PUT"?Cx0.parse(F.json()):null,N=AP1.encode(JSON.stringify({sessionId:G.sessionId,expiresAt:G.expiresAt,conversation:X,characters:0,requests:0}));try{if(F&&U&&U.expiresAt<=Date.now())await K.update(H,N,F.revision);else await K.create(H,N)}catch{throw new q1(409,{message:"Close your other voice session before starting a new one"})}try{if(X&&"createSession"in J){let D=await J.createSession({language:Q,model:X.model,safetyIdentifier:dt($)});return{token:W,...D,expiresAt:G.expiresAt}}let B=await this.adapter().createTranscriptionToken();return{token:W,transcriptionToken:B,expiresAt:G.expiresAt}}catch(B){throw await this.release(G),B}}authorize($,Z){let Q=GU8(Z,this.deps.secret);if(!Q||Q.organizationId!==$.organizationId||Q.userId!==$.userId||Q.threadId!==$.threadId)throw new q1(403,{message:"Invalid voice session"});return Q}async connect($,Z){let Q=this.authorize($,Z.token),Y=await this.kv(),X=dt(Q),J=await Y.get(X),G=J?.operation==="PUT"?Cx0.parse(J.json()):null;if(!J||!G||G.sessionId!==Q.sessionId||G.expiresAt<=Date.now())throw new q1(403,{message:"Voice session expired"});let W=G.conversation?this.deps.conversationAdapters[G.conversation.provider]:null;if(!W?.negotiate||!G.conversation)throw new q1(409,{message:"Voice session does not support SDP negotiation"});if(G.connected)throw new q1(409,{message:"Voice session already connected"});try{await Y.update(X,AP1.encode(JSON.stringify({...G,connected:!0})),J.revision)}catch{throw new q1(409,{message:"Voice session is busy"})}return W.negotiate({sdp:Z.sdp,language:Z.language,model:G.conversation.model,safetyIdentifier:X})}async speak($,Z,Q,Y){let X=this.authorize($,Z),J=await this.kv(),G=dt(X);for(let W=0;;W++){let K=await J.get(G),H=K?.operation==="PUT"?Cx0.parse(K.json()):null;if(!K||!H||H.sessionId!==X.sessionId||H.expiresAt<=Date.now())throw new q1(403,{message:"Voice session expired"});if(H.characters+Q.length>24000||H.requests>=120)throw new q1(429,{message:"Voice session speech limit reached"});try{await J.update(G,AP1.encode(JSON.stringify({...H,characters:H.characters+Q.length,requests:H.requests+1})),K.revision);break}catch{if(W>=2)throw new q1(409,{message:"Voice session is busy"})}}return this.adapter().synthesize(Q,Y)}async release($){let Z=await this.kv(),Q=await Z.get(dt($));if(Q?.operation==="PUT"&&Cx0.parse(Q.json()).sessionId===$.sessionId)await Z.delete(dt($),{previousSeq:Q.revision})}async revoke($,Z){await this.release(this.authorize($,Z))}}var _x0,FU8,UU8,Cx0,AP1;var NU8=L(()=>{$G();uN();WU8();HU8();_x0=_(NH(),1),FU8=_(vT(),1),UU8=_(tz(),1),Cx0=mt.object({sessionId:mt.string().uuid(),expiresAt:mt.number(),connected:mt.boolean().optional(),conversation:zP1.optional(),characters:mt.number().int().nonnegative(),requests:mt.number().int().nonnegative()}),AP1=new TextEncoder});function m95($){return $.filter((Z)=>Z.vendors?.alias).map((Z)=>({name:Z.name,title:Z.title,description:Z.description,logo:Z.logo,category:Z.category,vendor:{alias:Z.vendors.alias,url:Z.vendors.url}}))}var d95=async($,Z)=>{if(!$.get("studioContext").auth.user?.id)return $.json({error:"Unauthorized"},401);return Z()},BU8=()=>{let $=new Q1;return $.use("*",d95),$.get("/",async(Z)=>{let Q=L0(),Y=Q.decoSupabaseUrl,X=Q.decoSupabaseServiceKey;if(!Y||!X)return Z.json({apps:[]});try{let J=await hG(Y,X,"apps?select=name,title,description,logo,category,vendors(alias,url)");return Z.json({apps:m95(J)})}catch(J){return console.error("[deco-apps] GET error:",J),Z.json({error:"Failed to fetch apps"},502)}}),$};var DU8=L(()=>{W8();r1();m_0()});import{z as c1}from"zod";function zB($,Z="invalid_request_error",Q=null,Y=null){return{error:{message:$,type:Z,param:Q,code:Y}}}function $Z5($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let Q=$.substring(0,Z),Y=$.substring(Z+1);if(!Q||!Y)return null;return{credentialId:Q,modelId:Y}}function ZZ5($,Z,Q){try{return JSON.parse($)}catch{throw new wU8(`Invalid JSON in tool call arguments for function '${Q}' (tool_call_id: ${Z}): ${$}`)}}function QZ5($){let Z={};for(let Q of $)if(Q.role==="assistant"&&Q.tool_calls)for(let Y of Q.tool_calls)Z[Y.id]=Y.function.name;return $.map((Q)=>{switch(Q.role){case"system":return{role:"system",content:Q.content};case"user":if(typeof Q.content==="string")return{role:"user",content:Q.content};return{role:"user",content:Q.content.map((X)=>{if(X.type==="text")return{type:"text",text:X.text};return{type:"image",image:X.image_url.url}})};case"assistant":if(Q.tool_calls&&Q.tool_calls.length>0)return{role:"assistant",content:Q.tool_calls.map((X)=>({type:"tool-call",toolCallId:X.id,toolName:X.function.name,input:ZZ5(X.function.arguments,X.id,X.function.name)}))};return{role:"assistant",content:Q.content??""};case"tool":let Y=Z[Q.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:Q.tool_call_id,toolName:Y,output:{type:"text",value:Q.content}}]}}})}function YZ5($){let Z=$.map((Q)=>{let Y=Q.function.parameters?tU(Q.function.parameters):tU({type:"object",properties:{}});return[Q.function.name,t$({description:Q.function.description,inputSchema:Y})]});return Object.fromEntries(Z)}function XZ5($){if(!$)return;return{openai:{response_format:$}}}function JZ5(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function LU8($,Z,Q,Y,X,J){let G={model:$,instructions:Z.filter((W)=>W.role==="system"),messages:Z.filter((W)=>W.role!=="system"),tools:Q,temperature:Y.temperature,maxOutputTokens:Y.max_tokens,topP:Y.top_p,frequencyPenalty:Y.frequency_penalty,presencePenalty:Y.presence_penalty,stopSequences:Y.stop?Array.isArray(Y.stop)?Y.stop:[Y.stop]:void 0,abortSignal:J};return X?{...G,providerOptions:X}:G}function OU8($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var i95=256,p95,n95,t95,o95,s95,r95,a95,e95,wU8,jU8,EU8;var PU8=L(()=>{u4();W8();vt();kF();p95=c1.object({type:c1.literal("function"),function:c1.object({name:c1.string(),description:c1.string().optional(),parameters:c1.record(c1.string(),c1.unknown()).optional()})}),n95=c1.object({id:c1.string(),type:c1.literal("function"),function:c1.object({name:c1.string(),arguments:c1.string()})}),t95=c1.discriminatedUnion("role",[c1.object({role:c1.literal("system"),content:c1.string(),name:c1.string().optional()}),c1.object({role:c1.literal("user"),content:c1.union([c1.string(),c1.array(c1.union([c1.object({type:c1.literal("text"),text:c1.string()}),c1.object({type:c1.literal("image_url"),image_url:c1.object({url:c1.string(),detail:c1.string().optional()})})]))]),name:c1.string().optional()}),c1.object({role:c1.literal("assistant"),content:c1.string().nullable().optional(),name:c1.string().optional(),tool_calls:c1.array(n95).optional()}),c1.object({role:c1.literal("tool"),content:c1.string(),tool_call_id:c1.string()})]),o95=c1.object({type:c1.literal("text")}),s95=c1.object({type:c1.literal("json_object")}),r95=c1.object({type:c1.literal("json_schema"),json_schema:c1.object({name:c1.string(),description:c1.string().optional(),schema:c1.record(c1.string(),c1.unknown()),strict:c1.boolean().optional()})}),a95=c1.union([o95,s95,r95]),e95=c1.object({model:c1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:c1.array(t95),stream:c1.boolean().optional().default(!1),temperature:c1.number().min(0).max(2).optional(),max_tokens:c1.number().positive().optional(),top_p:c1.number().min(0).max(1).optional(),frequency_penalty:c1.number().min(-2).max(2).optional(),presence_penalty:c1.number().min(-2).max(2).optional(),stop:c1.union([c1.string(),c1.array(c1.string())]).optional(),tools:c1.array(p95).optional(),tool_choice:c1.union([c1.literal("auto"),c1.literal("none"),c1.literal("required"),c1.object({type:c1.literal("function"),function:c1.object({name:c1.string()})})]).optional(),response_format:a95.optional(),user:c1.string().optional()});wU8=class wU8 extends Error{constructor($){super($);this.name="MessageConversionError"}};jU8=new Q1;jU8.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("studioContext"),Q=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(zB("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(zB("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==Q)return $.json(zB("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let Y=await $.req.json(),X=e95.safeParse(Y);if(!X.success){let w=X.error.issues[0]??{message:"Invalid request",path:[]};return $.json(zB(`Invalid request: ${w.message}`,"invalid_request_error",w.path.length>0?w.path.join("."):null),400)}let J=X.data,G=$Z5(J.model);if(!G)return $.json(zB("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=G,{modelId:K}=G;if(!W){let j=(await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id})).find((E)=>c2(E.providerId));if(!j)return $.json(zB("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=j.id}let H;try{H=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(zB(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let F=H.aiSdk.languageModel(K),U=QZ5(J.messages),N=J.tools?YZ5(J.tools):void 0,B=XZ5(J.response_format),D=JZ5(),O=Math.floor(Date.now()/1000);if(J.stream)return TO($,async(w)=>{let j=LU8(F,U,N,J,B,$.req.raw.signal);try{let E=Kp(j),P=!1,T=0,z="",A=async()=>{if(z.length===0)return;let q=z;z="",await w.writeSSE({data:JSON.stringify({id:D,object:"chat.completion.chunk",created:O,model:J.model,choices:[{index:0,delta:{content:q},finish_reason:null}]})})};for await(let q of E.stream){if(!P&&(q.type==="text-delta"||q.type==="tool-call"))await w.writeSSE({data:JSON.stringify({id:D,object:"chat.completion.chunk",created:O,model:J.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),P=!0;if(q.type==="text-delta"){if(z+=q.text,z.length>=i95)await A()}else if(q.type==="tool-call"){await A();let x=T++;await w.writeSSE({data:JSON.stringify({id:D,object:"chat.completion.chunk",created:O,model:J.model,choices:[{index:0,delta:{tool_calls:[{index:x,id:q.toolCallId,type:"function",function:{name:q.toolName,arguments:JSON.stringify(q.input)}}]},finish_reason:null}]})})}else if(q.type==="finish")await A(),await w.writeSSE({data:JSON.stringify({id:D,object:"chat.completion.chunk",created:O,model:J.model,choices:[{index:0,delta:{},finish_reason:OU8(q.finishReason)}],usage:q.totalUsage?{prompt_tokens:q.totalUsage.inputTokens??0,completion_tokens:q.totalUsage.outputTokens??0,total_tokens:q.totalUsage.totalTokens??0}:void 0})})}await A(),await w.writeSSE({data:"[DONE]"})}catch(E){let P=E;console.error("[openai-compat:stream] Error:",P.message),await w.writeSSE({data:JSON.stringify({error:{message:P.message,type:"server_error"}})})}});else{let w=LU8(F,U,N,J,B,$.req.raw.signal),j=await vL(w),E={role:"assistant",content:j.text||null};if(j.toolCalls&&j.toolCalls.length>0)E.tool_calls=j.toolCalls.map((P)=>({id:P.toolCallId,type:"function",function:{name:P.toolName,arguments:JSON.stringify("input"in P?P.input:{})}})),E.content=null;return $.json({id:D,object:"chat.completion",created:O,model:J.model,choices:[{index:0,message:E,finish_reason:OU8(j.finishReason)}],usage:{prompt_tokens:j.usage?.inputTokens??0,completion_tokens:j.usage?.outputTokens??0,total_tokens:j.usage?.totalTokens??0}})}}catch(Y){let X=Y;if(X.name==="AbortError")return $.json(zB("Request aborted","invalid_request_error"),400);if(X.name==="MessageConversionError")return $.json(zB(X.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",X.message,X.stack),$.json(zB(X.message,"server_error"),500)}});EU8=jU8});function GZ5($){if(typeof $!=="object"||$===null)return!1;let Q=$.repository?.url;return typeof Q==="string"&&Q.length>0}function zU8(){let $=new Q1;return $.use("*",async(Z,Q)=>{await Q(),Z.header("Cache-Control","private, no-store"),Z.header("Vary","Cookie")}),$.get("/",async(Z)=>{let Q=Z.get("studioContext"),Y=C0(Q);if(!Y)return Z.json({error:"Authentication required"},401);let J=(Z.req.query("site")??"").trim().toLowerCase();if(!G9(J))return Z.json({error:"Invalid site slug"},400);let G=await Q.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.id as id","organization.slug as slug","organization.name as name","organization.metadata as metadata"]).where("member.userId","=",Y).execute(),W=[];for(let H of G){if(!H.slug||y9(H))continue;let F=await Q.storage.virtualMcps.list(H.id);for(let U of F){if(n2(U)!==J)continue;if(!GZ5(U.metadata))continue;W.push({orgSlug:H.slug,orgName:H.name??H.slug,project:{id:U.id,title:U.title,icon:U.icon??null}})}}let K={matches:W};return Z.json(K)}),$}var AU8=L(()=>{W8();tX()});var vx0;var RP1=L(()=>{vx0={name:"decocms",version:"4.500.3",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run dev:server","dev:server":"NODE_ENV=development bun --env-file=.env --watch run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js","db:migrate:dbos":"bun run ./dist/server/migrate-dbos.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts","migrate:dbos":"bun run src/database/migrate-dbos.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^4.0.58","@ai-sdk/google":"^4.0.76","@ai-sdk/openai":"^4.0.71","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^3.1.0","@opentelemetry/core":"^2.6.0",kysely:"^0.28.12","posthog-node":"^5.0.0"},devDependencies:{"@ai-sdk/provider":"^4.0.17","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^7.0.107","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});function HZ5(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??KZ5}}var TU8,KZ5="https://ph.studio.decocms.com",RU8;var qU8=L(()=>{W8();be();Ag();j9();r1();Cw1();RP1();TU8=new Q1;TU8.get("/",($)=>{let Z={version:vx0.version,theme:iY$(),...mH().logo&&{logo:mH().logo},...mL()&&{internalUrl:Na1()},...L0().enableDecoImport&&{enableDecoImport:!0},hostingEnabled:!!L0().controlplaneRestUrl&&!!L0().controlplaneServiceToken,hostingControlPlaneGa:L0().hostingControlPlaneGa,monitorEnabled:!!L0().clickhouseAnalyticsUrl&&!!L0().clickhouseAnalyticsPassword,monitorGa:L0().monitorGa,plansEnabled:L0().plansEnabled,auth:GJ8(),posthog:HZ5(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:tF()}};return $.header("Cache-Control","no-store"),$.json({success:!0,config:Z})});RU8=TU8});import{z as q$}from"zod";var FZ5,MU8;var VU8=L(()=>{FZ5=q$.object({check_id:q$.string(),title:q$.string(),description:q$.string().optional(),impact:q$.string().optional(),why:q$.string().optional(),category:q$.string(),severity:q$.string(),value_band:q$.string().optional(),value_driver:q$.string().optional(),controllability:q$.string().optional(),pages:q$.array(q$.string()),tasks:q$.array(q$.string()),evidence:q$.string(),sample_scope:q$.string().optional(),sources:q$.array(q$.string())}),MU8=q$.object({domain:q$.string(),brand:q$.string(),favicon:q$.string().optional(),scanned_at:q$.string().nullable(),lang:q$.string(),score:q$.number().nullable(),band:q$.string().nullable(),totals:q$.object({measured:q$.number(),registry_total:q$.number(),passed:q$.number(),failed:q$.number(),blocked:q$.number()}),buckets:q$.array(q$.object({id:q$.enum(["critical","important","worth"]),label:q$.string(),items:q$.array(FZ5)})),passing:q$.object({count:q$.number(),items:q$.array(q$.object({check_id:q$.string(),title:q$.string()}))}),not_measured:q$.object({count:q$.number(),groups:q$.array(q$.object({reason:q$.string(),label:q$.string(),count:q$.number(),checks:q$.array(q$.string())}))}),categories:q$.array(q$.object({key:q$.string(),label:q$.string(),score:q$.number().nullable(),band:q$.string().nullable(),pass:q$.number(),fail:q$.number()})),screenshots:q$.array(q$.object({url:q$.string(),page_type:q$.string().optional(),viewport:q$.enum(["desktop","mobile"]),image_url:q$.string()}))})});function IU8($,Z,Q){let Y=Q?`?${new URLSearchParams({lang:Q}).toString()}`:"";return`${HK({})}/api/v2/public/diagnostics/${encodeURIComponent($)}/onepager${Z}${Y}`}async function bx0($,Z={}){let Q=await fetch(IU8($,"",Z.lang),{headers:{Accept:"application/json"},signal:Z.signal});if(Q.status===404)return null;if(!Q.ok)throw Error(`onepager read HTTP ${Q.status}`);return MU8.parse(await Q.json())}async function kU8($,Z={}){let Q=await fetch(IU8($,".md",Z.lang),{headers:{Accept:"text/markdown"},signal:Z.signal});if(Q.status===404)return null;if(!Q.ok)throw Error(`onepager markdown HTTP ${Q.status}`);return Q.text()}var qP1=L(()=>{VU8();eD()});import{join as SU8}from"path";async function NZ5($){try{let Z=await bx0($,{signal:AbortSignal.timeout(UZ5)});if(!Z?.scanned_at)return null;return{brand:Z.brand.trim()||ML1($),...Z.score!==null?{score:Z.score}:{}}}catch{return null}}function mG($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function BZ5($,Z){let Q=Eh($),Y=Z?.brand?.trim()||ML1(Q),X=J78(Q,128),G=`${(L0().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(Q)}`,{title:W,description:K}=G78({brand:Y,domain:Q,score:Z?.score}),H=`${G}/og.png`,F=`${Y} Deco Score by decocms`;return[`<title>${mG(W)}</title>`,`<meta name="description" content="${mG(K)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${mG(W)}" />`,`<meta property="og:description" content="${mG(K)}" />`,`<meta property="og:url" content="${mG(G)}" />`,`<meta property="og:image" content="${mG(H)}" />`,'<meta property="og:image:width" content="1200" />','<meta property="og:image:height" content="630" />',`<meta property="og:image:alt" content="${mG(F)}" />`,'<meta name="twitter:card" content="summary_large_image" />',`<meta name="twitter:title" content="${mG(W)}" />`,`<meta name="twitter:description" content="${mG(K)}" />`,`<meta name="twitter:image" content="${mG(H)}" />`,`<meta name="twitter:image:alt" content="${mG(F)}" />`,`<link rel="canonical" href="${mG(G)}" />`,`<link rel="alternate" type="text/markdown" href="${mG(G)}.md" />`,`<link rel="icon" href="${mG(X)}" sizes="any" />`].join(`
+Start in ${$.language==="pt"?"Brazilian Portuguese":"English"}, and follow the user's language.`,delegation:{type:"client"},audio:{output:{voice:$.voice}},store:!1}}class jP1{config;constructor($){this.config=$}async createSession(){return{provider:"openai",transport:"webrtc"}}async negotiate($){let Z=await fetch("https://api.openai.com/v1/live/sessions",{method:"POST",headers:{Authorization:`Bearer ${this.config.apiKey}`,"Content-Type":"application/json","OpenAI-Safety-Identifier":$.safetyIdentifier},body:JSON.stringify({session:y95({...this.config,language:$.language,model:$.model}),transport:{type:"webrtc",sdp:$.sdp}}),signal:AbortSignal.timeout(15000)});if(!Z.ok)throw await Z.body?.cancel(),Error(`OpenAI Live request failed (${Z.status})`);return{sdp:lt.object({session:lt.object({id:lt.string().min(1)}),transport:lt.object({type:lt.literal("webrtc"),sdp:lt.string().min(1).max(1e5)})}).parse(await Z.json()).transport.sdp}}}var aF8=L(()=>{uN()});var eF8;var $U8=L(()=>{eF8=[{name:"delegate_to_agent",description:"Submit a complete request to the selected Studio agent. Returns after acceptance while work continues in the background. Results arrive later.",parameters:{type:"object",properties:{request:{type:"string",description:"The complete user request, with relevant conversational details. Preserve intent and constraints."}},required:["request"]}},{name:"get_agent_status",description:"Read the current chat's work status and known results. This does not track independent organization tasks; delegate fresh task-status queries to the Studio agent. Use when asked, never poll.",parameters:{type:"object",properties:{}}},{name:"stop_agent_work",description:"Request cancellation in the current chat ONLY when the user explicitly asks. Speaking over the companion is not cancellation. To stop independent tasks, delegate that request to the Studio agent.",parameters:{type:"object",properties:{}}}]});function EP1($){return{conversation_config:{agent:{first_message:"",language:"en",prompt:{prompt:IC$,llm:$.conversationModel,thinking_budget:0,max_tokens:512,tools:eF8.map((Z)=>({...Z,type:"client",expects_response:!0,response_timeout_secs:Z.name==="delegate_to_agent"?20:5,...Z.name==="delegate_to_agent"?{execution_mode:"async",interruption_mode:"allow",pre_tool_speech:"off"}:{}}))}},asr:{provider:"scribe_realtime",quality:"high"},turn:{turn_eagerness:"normal",turn_timeout:-1,silence_end_call_timeout:-1},tts:{voice_id:$.voiceId,model_id:$.model},conversation:{max_duration_seconds:kL/1000,client_events:["audio","interruption","user_transcript","agent_response","client_tool_call","vad_score"]}},platform_settings:{auth:{enable_auth:!0},privacy:{record_voice:!1,retention_days:1,delete_audio:!0,delete_transcript_and_pii:!0},overrides:{conversation_config_override:{agent:{language:!0}}}}}}var ZU8=L(()=>{uN();$U8()});import{z as vJ}from"zod";import{createHash as g95,createHmac as h95}from"crypto";class Sx0{config;conversationKey;configurationKey;constructor($){this.config=$;this.configurationKey=g95("sha256").update(JSON.stringify(EP1($))).digest("hex"),this.conversationKey=h95("sha256",$.apiKey).update(this.configurationKey).digest("hex")}forConversationModel($){return $===this.config.conversationModel?this:new Sx0({...this.config,conversationModel:$})}async request($,Z,Q){let Y=await fetch(`https://api.elevenlabs.io/v1${$}`,{method:Z===void 0?"GET":"POST",headers:{"xi-api-key":this.config.apiKey,"Content-Type":"application/json"},body:JSON.stringify(Z),signal:Q});if(!Y.ok)throw await Y.body?.cancel(),Error(`ElevenLabs request failed (${Y.status})`);return Y}async ensureConversationAgent(){let $=`Studio voice ${this.configurationKey.slice(0,24)}`,Z=await this.request(`/convai/agents?search=${encodeURIComponent($)}&page_size=100`,void 0,AbortSignal.timeout(15000)),{agents:Q}=vJ.object({agents:vJ.array(vJ.object({agent_id:vJ.string(),name:vJ.string()}))}).parse(await Z.json()),Y=Q.find((J)=>J.name===$);if(Y){let J=await this.request(`/convai/agents/${encodeURIComponent(Y.agent_id)}`,void 0,AbortSignal.timeout(15000));return vJ.object({platform_settings:vJ.object({auth:vJ.object({enable_auth:vJ.literal(!0)})})}).parse(await J.json()),Y.agent_id}let X=await this.request("/convai/agents/create",{name:$,...EP1(this.config)},AbortSignal.timeout(15000));return vJ.object({agent_id:vJ.string().min(1)}).parse(await X.json()).agent_id}async createConversationToken($){let Z=await this.request(`/convai/conversation/token?agent_id=${encodeURIComponent($)}`,void 0,AbortSignal.timeout(15000));return vJ.object({token:vJ.string().min(1)}).parse(await Z.json()).token}async createTranscriptionToken(){let $=await this.request("/single-use-token/realtime_scribe",{},AbortSignal.timeout(15000));return vJ.object({token:vJ.string().min(1)}).parse(await $.json()).token}synthesize($,Z){return this.request(`/text-to-speech/${encodeURIComponent(this.config.voiceId)}/stream?output_format=mp3_44100_128`,{text:$,model_id:this.config.model},AbortSignal.any([Z,AbortSignal.timeout(60000)]))}}var QU8=L(()=>{ZU8()});import{createHmac as u95,timingSafeEqual as l95}from"crypto";import{z as ct}from"zod";function XU8($,Z){if(!Z)throw Error("Voice requires a shared authentication secret");return u95("sha256",Z).update(`studio-voice-session:v1:${$}`).digest("base64url")}function JU8($,Z){let Q=Buffer.from(JSON.stringify(YU8.parse($))).toString("base64url");return`${Q}.${XU8(Q,Z)}`}function GU8($,Z,Q=Date.now()){if(!Z||$.length>4096)return null;let Y=$.split(".");if(Y.length!==2)return null;let[X,J]=Y;if(!X||!J)return null;let G=Buffer.from(XU8(X,Z)),W=Buffer.from(J);if(W.length!==G.length||!l95(W,G))return null;try{let K=YU8.safeParse(JSON.parse(Buffer.from(X,"base64url").toString()));if(!K.success||K.data.expiresAt<=Q||K.data.expiresAt>Q+kL)return null;return K.data}catch{return null}}var YU8;var WU8=L(()=>{uN();YU8=ct.object({sessionId:ct.string().uuid(),organizationId:ct.string().min(1).max(256),userId:ct.string().min(1).max(256),threadId:ct.string().min(1).max(256),expiresAt:ct.number().int().positive()})});import{z as PP1}from"zod";function KU8($,Z){if(Z?.voice_model!=null&&Z.voice_provider==null)throw Error("A voice model override requires a provider");let Q=Z?.voice_provider??$.voiceConversationProvider;return zP1.parse({provider:Q,model:Z?.voice_model??(Q==="openai"?$.openaiLiveModel:$.elevenlabsConversationModel)})}var zP1;var HU8=L(()=>{zP1=PP1.object({provider:PP1.enum(["elevenlabs","openai"]),model:PP1.string().trim().min(1).max(128)})});import{createHash as c95}from"crypto";import{z as mt}from"zod";function dt($){return`user.${c95("sha256").update(JSON.stringify([$.organizationId,$.userId])).digest("hex")}`}class TP1{deps;kvPromise;constructor($){this.deps=$}kv(){let $=this.deps.getConnection();if(!$||$.isClosed())throw new q1(503,{message:"Voice transport is unavailable"});return this.kvPromise??=new FU8.Kvm(_x0.jetstream($)).create("STUDIO_VOICE_SESSIONS",{storage:_x0.StorageType.Memory,ttl:UU8.nanos(kL),max_bytes:10485760}).catch((Z)=>{throw this.kvPromise=void 0,Z}),this.kvPromise}adapter(){if(!this.deps.adapter)throw new q1(503,{message:"Voice is not configured on this deployment"});return this.deps.adapter}async create($,Z=!1,Q="en",Y){let X;if(Z)try{X=KU8(this.deps.defaults,Y)}catch{throw new q1(503,{message:"Voice configuration is invalid"})}let J=X?this.deps.conversationAdapters[X.provider]:this.adapter();if(!J)throw new q1(503,{message:"Voice is not configured on this deployment"});let G={...$,sessionId:crypto.randomUUID(),expiresAt:Date.now()+kL},W=JU8(G,this.deps.secret),K=await this.kv(),H=dt(G),F=await K.get(H),U=F?.operation==="PUT"?Cx0.parse(F.json()):null,N=AP1.encode(JSON.stringify({sessionId:G.sessionId,expiresAt:G.expiresAt,conversation:X,characters:0,requests:0}));try{if(F&&U&&U.expiresAt<=Date.now())await K.update(H,N,F.revision);else await K.create(H,N)}catch{throw new q1(409,{message:"Close your other voice session before starting a new one"})}try{if(X&&"createSession"in J){let D=await J.createSession({language:Q,model:X.model,safetyIdentifier:dt($)});return{token:W,...D,expiresAt:G.expiresAt}}let B=await this.adapter().createTranscriptionToken();return{token:W,transcriptionToken:B,expiresAt:G.expiresAt}}catch(B){throw await this.release(G),B}}authorize($,Z){let Q=GU8(Z,this.deps.secret);if(!Q||Q.organizationId!==$.organizationId||Q.userId!==$.userId||Q.threadId!==$.threadId)throw new q1(403,{message:"Invalid voice session"});return Q}async connect($,Z){let Q=this.authorize($,Z.token),Y=await this.kv(),X=dt(Q),J=await Y.get(X),G=J?.operation==="PUT"?Cx0.parse(J.json()):null;if(!J||!G||G.sessionId!==Q.sessionId||G.expiresAt<=Date.now())throw new q1(403,{message:"Voice session expired"});let W=G.conversation?this.deps.conversationAdapters[G.conversation.provider]:null;if(!W?.negotiate||!G.conversation)throw new q1(409,{message:"Voice session does not support SDP negotiation"});if(G.connected)throw new q1(409,{message:"Voice session already connected"});try{await Y.update(X,AP1.encode(JSON.stringify({...G,connected:!0})),J.revision)}catch{throw new q1(409,{message:"Voice session is busy"})}return W.negotiate({sdp:Z.sdp,language:Z.language,model:G.conversation.model,safetyIdentifier:X})}async speak($,Z,Q,Y){let X=this.authorize($,Z),J=await this.kv(),G=dt(X);for(let W=0;;W++){let K=await J.get(G),H=K?.operation==="PUT"?Cx0.parse(K.json()):null;if(!K||!H||H.sessionId!==X.sessionId||H.expiresAt<=Date.now())throw new q1(403,{message:"Voice session expired"});if(H.characters+Q.length>24000||H.requests>=120)throw new q1(429,{message:"Voice session speech limit reached"});try{await J.update(G,AP1.encode(JSON.stringify({...H,characters:H.characters+Q.length,requests:H.requests+1})),K.revision);break}catch{if(W>=2)throw new q1(409,{message:"Voice session is busy"})}}return this.adapter().synthesize(Q,Y)}async release($){let Z=await this.kv(),Q=await Z.get(dt($));if(Q?.operation==="PUT"&&Cx0.parse(Q.json()).sessionId===$.sessionId)await Z.delete(dt($),{previousSeq:Q.revision})}async revoke($,Z){await this.release(this.authorize($,Z))}}var _x0,FU8,UU8,Cx0,AP1;var NU8=L(()=>{$G();uN();WU8();HU8();_x0=_(NH(),1),FU8=_(vT(),1),UU8=_(tz(),1),Cx0=mt.object({sessionId:mt.string().uuid(),expiresAt:mt.number(),connected:mt.boolean().optional(),conversation:zP1.optional(),characters:mt.number().int().nonnegative(),requests:mt.number().int().nonnegative()}),AP1=new TextEncoder});function m95($){return $.filter((Z)=>Z.vendors?.alias).map((Z)=>({name:Z.name,title:Z.title,description:Z.description,logo:Z.logo,category:Z.category,vendor:{alias:Z.vendors.alias,url:Z.vendors.url}}))}var d95=async($,Z)=>{if(!$.get("studioContext").auth.user?.id)return $.json({error:"Unauthorized"},401);return Z()},BU8=()=>{let $=new Q1;return $.use("*",d95),$.get("/",async(Z)=>{let Q=L0(),Y=Q.decoSupabaseUrl,X=Q.decoSupabaseServiceKey;if(!Y||!X)return Z.json({apps:[]});try{let J=await hG(Y,X,"apps?select=name,title,description,logo,category,vendors(alias,url)");return Z.json({apps:m95(J)})}catch(J){return console.error("[deco-apps] GET error:",J),Z.json({error:"Failed to fetch apps"},502)}}),$};var DU8=L(()=>{W8();r1();m_0()});import{z as c1}from"zod";function zB($,Z="invalid_request_error",Q=null,Y=null){return{error:{message:$,type:Z,param:Q,code:Y}}}function $Z5($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let Q=$.substring(0,Z),Y=$.substring(Z+1);if(!Q||!Y)return null;return{credentialId:Q,modelId:Y}}function ZZ5($,Z,Q){try{return JSON.parse($)}catch{throw new wU8(`Invalid JSON in tool call arguments for function '${Q}' (tool_call_id: ${Z}): ${$}`)}}function QZ5($){let Z={};for(let Q of $)if(Q.role==="assistant"&&Q.tool_calls)for(let Y of Q.tool_calls)Z[Y.id]=Y.function.name;return $.map((Q)=>{switch(Q.role){case"system":return{role:"system",content:Q.content};case"user":if(typeof Q.content==="string")return{role:"user",content:Q.content};return{role:"user",content:Q.content.map((X)=>{if(X.type==="text")return{type:"text",text:X.text};return{type:"image",image:X.image_url.url}})};case"assistant":if(Q.tool_calls&&Q.tool_calls.length>0)return{role:"assistant",content:Q.tool_calls.map((X)=>({type:"tool-call",toolCallId:X.id,toolName:X.function.name,input:ZZ5(X.function.arguments,X.id,X.function.name)}))};return{role:"assistant",content:Q.content??""};case"tool":let Y=Z[Q.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:Q.tool_call_id,toolName:Y,output:{type:"text",value:Q.content}}]}}})}function YZ5($){let Z=$.map((Q)=>{let Y=Q.function.parameters?tU(Q.function.parameters):tU({type:"object",properties:{}});return[Q.function.name,t$({description:Q.function.description,inputSchema:Y})]});return Object.fromEntries(Z)}function XZ5($){if(!$)return;return{openai:{response_format:$}}}function JZ5(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function LU8($,Z,Q,Y,X,J){let G={model:$,instructions:Z.filter((W)=>W.role==="system"),messages:Z.filter((W)=>W.role!=="system"),tools:Q,temperature:Y.temperature,maxOutputTokens:Y.max_tokens,topP:Y.top_p,frequencyPenalty:Y.frequency_penalty,presencePenalty:Y.presence_penalty,stopSequences:Y.stop?Array.isArray(Y.stop)?Y.stop:[Y.stop]:void 0,abortSignal:J};return X?{...G,providerOptions:X}:G}function OU8($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var i95=256,p95,n95,t95,o95,s95,r95,a95,e95,wU8,jU8,EU8;var PU8=L(()=>{u4();W8();vt();kF();p95=c1.object({type:c1.literal("function"),function:c1.object({name:c1.string(),description:c1.string().optional(),parameters:c1.record(c1.string(),c1.unknown()).optional()})}),n95=c1.object({id:c1.string(),type:c1.literal("function"),function:c1.object({name:c1.string(),arguments:c1.string()})}),t95=c1.discriminatedUnion("role",[c1.object({role:c1.literal("system"),content:c1.string(),name:c1.string().optional()}),c1.object({role:c1.literal("user"),content:c1.union([c1.string(),c1.array(c1.union([c1.object({type:c1.literal("text"),text:c1.string()}),c1.object({type:c1.literal("image_url"),image_url:c1.object({url:c1.string(),detail:c1.string().optional()})})]))]),name:c1.string().optional()}),c1.object({role:c1.literal("assistant"),content:c1.string().nullable().optional(),name:c1.string().optional(),tool_calls:c1.array(n95).optional()}),c1.object({role:c1.literal("tool"),content:c1.string(),tool_call_id:c1.string()})]),o95=c1.object({type:c1.literal("text")}),s95=c1.object({type:c1.literal("json_object")}),r95=c1.object({type:c1.literal("json_schema"),json_schema:c1.object({name:c1.string(),description:c1.string().optional(),schema:c1.record(c1.string(),c1.unknown()),strict:c1.boolean().optional()})}),a95=c1.union([o95,s95,r95]),e95=c1.object({model:c1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:c1.array(t95),stream:c1.boolean().optional().default(!1),temperature:c1.number().min(0).max(2).optional(),max_tokens:c1.number().positive().optional(),top_p:c1.number().min(0).max(1).optional(),frequency_penalty:c1.number().min(-2).max(2).optional(),presence_penalty:c1.number().min(-2).max(2).optional(),stop:c1.union([c1.string(),c1.array(c1.string())]).optional(),tools:c1.array(p95).optional(),tool_choice:c1.union([c1.literal("auto"),c1.literal("none"),c1.literal("required"),c1.object({type:c1.literal("function"),function:c1.object({name:c1.string()})})]).optional(),response_format:a95.optional(),user:c1.string().optional()});wU8=class wU8 extends Error{constructor($){super($);this.name="MessageConversionError"}};jU8=new Q1;jU8.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("studioContext"),Q=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(zB("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(zB("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==Q)return $.json(zB("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let Y=await $.req.json(),X=e95.safeParse(Y);if(!X.success){let w=X.error.issues[0]??{message:"Invalid request",path:[]};return $.json(zB(`Invalid request: ${w.message}`,"invalid_request_error",w.path.length>0?w.path.join("."):null),400)}let J=X.data,G=$Z5(J.model);if(!G)return $.json(zB("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=G,{modelId:K}=G;if(!W){let j=(await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id})).find((E)=>c2(E.providerId));if(!j)return $.json(zB("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=j.id}let H;try{H=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(zB(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let F=H.aiSdk.languageModel(K),U=QZ5(J.messages),N=J.tools?YZ5(J.tools):void 0,B=XZ5(J.response_format),D=JZ5(),O=Math.floor(Date.now()/1000);if(J.stream)return TO($,async(w)=>{let j=LU8(F,U,N,J,B,$.req.raw.signal);try{let E=Kp(j),P=!1,T=0,z="",A=async()=>{if(z.length===0)return;let q=z;z="",await w.writeSSE({data:JSON.stringify({id:D,object:"chat.completion.chunk",created:O,model:J.model,choices:[{index:0,delta:{content:q},finish_reason:null}]})})};for await(let q of E.stream){if(!P&&(q.type==="text-delta"||q.type==="tool-call"))await w.writeSSE({data:JSON.stringify({id:D,object:"chat.completion.chunk",created:O,model:J.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),P=!0;if(q.type==="text-delta"){if(z+=q.text,z.length>=i95)await A()}else if(q.type==="tool-call"){await A();let x=T++;await w.writeSSE({data:JSON.stringify({id:D,object:"chat.completion.chunk",created:O,model:J.model,choices:[{index:0,delta:{tool_calls:[{index:x,id:q.toolCallId,type:"function",function:{name:q.toolName,arguments:JSON.stringify(q.input)}}]},finish_reason:null}]})})}else if(q.type==="finish")await A(),await w.writeSSE({data:JSON.stringify({id:D,object:"chat.completion.chunk",created:O,model:J.model,choices:[{index:0,delta:{},finish_reason:OU8(q.finishReason)}],usage:q.totalUsage?{prompt_tokens:q.totalUsage.inputTokens??0,completion_tokens:q.totalUsage.outputTokens??0,total_tokens:q.totalUsage.totalTokens??0}:void 0})})}await A(),await w.writeSSE({data:"[DONE]"})}catch(E){let P=E;console.error("[openai-compat:stream] Error:",P.message),await w.writeSSE({data:JSON.stringify({error:{message:P.message,type:"server_error"}})})}});else{let w=LU8(F,U,N,J,B,$.req.raw.signal),j=await vL(w),E={role:"assistant",content:j.text||null};if(j.toolCalls&&j.toolCalls.length>0)E.tool_calls=j.toolCalls.map((P)=>({id:P.toolCallId,type:"function",function:{name:P.toolName,arguments:JSON.stringify("input"in P?P.input:{})}})),E.content=null;return $.json({id:D,object:"chat.completion",created:O,model:J.model,choices:[{index:0,message:E,finish_reason:OU8(j.finishReason)}],usage:{prompt_tokens:j.usage?.inputTokens??0,completion_tokens:j.usage?.outputTokens??0,total_tokens:j.usage?.totalTokens??0}})}}catch(Y){let X=Y;if(X.name==="AbortError")return $.json(zB("Request aborted","invalid_request_error"),400);if(X.name==="MessageConversionError")return $.json(zB(X.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",X.message,X.stack),$.json(zB(X.message,"server_error"),500)}});EU8=jU8});function GZ5($){if(typeof $!=="object"||$===null)return!1;let Q=$.repository?.url;return typeof Q==="string"&&Q.length>0}function zU8(){let $=new Q1;return $.use("*",async(Z,Q)=>{await Q(),Z.header("Cache-Control","private, no-store"),Z.header("Vary","Cookie")}),$.get("/",async(Z)=>{let Q=Z.get("studioContext"),Y=C0(Q);if(!Y)return Z.json({error:"Authentication required"},401);let J=(Z.req.query("site")??"").trim().toLowerCase();if(!G9(J))return Z.json({error:"Invalid site slug"},400);let G=await Q.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.id as id","organization.slug as slug","organization.name as name","organization.metadata as metadata"]).where("member.userId","=",Y).execute(),W=[];for(let H of G){if(!H.slug||y9(H))continue;let F=await Q.storage.virtualMcps.list(H.id);for(let U of F){if(n2(U)!==J)continue;if(!GZ5(U.metadata))continue;W.push({orgSlug:H.slug,orgName:H.name??H.slug,project:{id:U.id,title:U.title,icon:U.icon??null}})}}let K={matches:W};return Z.json(K)}),$}var AU8=L(()=>{W8();tX()});var vx0;var RP1=L(()=>{vx0={name:"decocms",version:"4.500.4",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run dev:server","dev:server":"NODE_ENV=development bun --env-file=.env --watch run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js","db:migrate:dbos":"bun run ./dist/server/migrate-dbos.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts","migrate:dbos":"bun run src/database/migrate-dbos.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^4.0.58","@ai-sdk/google":"^4.0.76","@ai-sdk/openai":"^4.0.71","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^3.1.0","@opentelemetry/core":"^2.6.0",kysely:"^0.28.12","posthog-node":"^5.0.0"},devDependencies:{"@ai-sdk/provider":"^4.0.17","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^7.0.107","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});function HZ5(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??KZ5}}var TU8,KZ5="https://ph.studio.decocms.com",RU8;var qU8=L(()=>{W8();be();Ag();j9();r1();Cw1();RP1();TU8=new Q1;TU8.get("/",($)=>{let Z={version:vx0.version,theme:iY$(),...mH().logo&&{logo:mH().logo},...mL()&&{internalUrl:Na1()},...L0().enableDecoImport&&{enableDecoImport:!0},hostingEnabled:!!L0().controlplaneRestUrl&&!!L0().controlplaneServiceToken,hostingControlPlaneGa:L0().hostingControlPlaneGa,monitorEnabled:!!L0().clickhouseAnalyticsUrl&&!!L0().clickhouseAnalyticsPassword,monitorGa:L0().monitorGa,plansEnabled:L0().plansEnabled,auth:GJ8(),posthog:HZ5(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:tF()}};return $.header("Cache-Control","no-store"),$.json({success:!0,config:Z})});RU8=TU8});import{z as q$}from"zod";var FZ5,MU8;var VU8=L(()=>{FZ5=q$.object({check_id:q$.string(),title:q$.string(),description:q$.string().optional(),impact:q$.string().optional(),why:q$.string().optional(),category:q$.string(),severity:q$.string(),value_band:q$.string().optional(),value_driver:q$.string().optional(),controllability:q$.string().optional(),pages:q$.array(q$.string()),tasks:q$.array(q$.string()),evidence:q$.string(),sample_scope:q$.string().optional(),sources:q$.array(q$.string())}),MU8=q$.object({domain:q$.string(),brand:q$.string(),favicon:q$.string().optional(),scanned_at:q$.string().nullable(),lang:q$.string(),score:q$.number().nullable(),band:q$.string().nullable(),totals:q$.object({measured:q$.number(),registry_total:q$.number(),passed:q$.number(),failed:q$.number(),blocked:q$.number()}),buckets:q$.array(q$.object({id:q$.enum(["critical","important","worth"]),label:q$.string(),items:q$.array(FZ5)})),passing:q$.object({count:q$.number(),items:q$.array(q$.object({check_id:q$.string(),title:q$.string()}))}),not_measured:q$.object({count:q$.number(),groups:q$.array(q$.object({reason:q$.string(),label:q$.string(),count:q$.number(),checks:q$.array(q$.string())}))}),categories:q$.array(q$.object({key:q$.string(),label:q$.string(),score:q$.number().nullable(),band:q$.string().nullable(),pass:q$.number(),fail:q$.number()})),screenshots:q$.array(q$.object({url:q$.string(),page_type:q$.string().optional(),viewport:q$.enum(["desktop","mobile"]),image_url:q$.string()}))})});function IU8($,Z,Q){let Y=Q?`?${new URLSearchParams({lang:Q}).toString()}`:"";return`${HK({})}/api/v2/public/diagnostics/${encodeURIComponent($)}/onepager${Z}${Y}`}async function bx0($,Z={}){let Q=await fetch(IU8($,"",Z.lang),{headers:{Accept:"application/json"},signal:Z.signal});if(Q.status===404)return null;if(!Q.ok)throw Error(`onepager read HTTP ${Q.status}`);return MU8.parse(await Q.json())}async function kU8($,Z={}){let Q=await fetch(IU8($,".md",Z.lang),{headers:{Accept:"text/markdown"},signal:Z.signal});if(Q.status===404)return null;if(!Q.ok)throw Error(`onepager markdown HTTP ${Q.status}`);return Q.text()}var qP1=L(()=>{VU8();eD()});import{join as SU8}from"path";async function NZ5($){try{let Z=await bx0($,{signal:AbortSignal.timeout(UZ5)});if(!Z?.scanned_at)return null;return{brand:Z.brand.trim()||ML1($),...Z.score!==null?{score:Z.score}:{}}}catch{return null}}function mG($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function BZ5($,Z){let Q=Eh($),Y=Z?.brand?.trim()||ML1(Q),X=J78(Q,128),G=`${(L0().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(Q)}`,{title:W,description:K}=G78({brand:Y,domain:Q,score:Z?.score}),H=`${G}/og.png`,F=`${Y} Deco Score by decocms`;return[`<title>${mG(W)}</title>`,`<meta name="description" content="${mG(K)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${mG(W)}" />`,`<meta property="og:description" content="${mG(K)}" />`,`<meta property="og:url" content="${mG(G)}" />`,`<meta property="og:image" content="${mG(H)}" />`,'<meta property="og:image:width" content="1200" />','<meta property="og:image:height" content="630" />',`<meta property="og:image:alt" content="${mG(F)}" />`,'<meta name="twitter:card" content="summary_large_image" />',`<meta name="twitter:title" content="${mG(W)}" />`,`<meta name="twitter:description" content="${mG(K)}" />`,`<meta name="twitter:image" content="${mG(H)}" />`,`<meta name="twitter:image:alt" content="${mG(F)}" />`,`<link rel="canonical" href="${mG(G)}" />`,`<link rel="alternate" type="text/markdown" href="${mG(G)}.md" />`,`<link rel="icon" href="${mG(X)}" sizes="any" />`].join(`
     `)}function DZ5($,Z){return $.replace(/<title>[\s\S]*?<\/title>\s*/i,"").replace(/<meta\s+name="(?:description|twitter:[^"]*)"[^>]*>\s*/gi,"").replace(/<meta\s+property="og:[^"]*"[^>]*>\s*/gi,"").replace(/<link\s+rel="icon"[^>]*>\s*/gi,"").replace("</head>",`    ${Z}
   </head>`)}function CU8($){let Z=new Q1;return Z.get("/:domain/og.png",async(Q)=>{let Y=Eh(Q.req.param("domain")),X=async()=>{let J=$?Bun.file(SU8($,"report-og-fallback.png")):null;if(!J||!await J.exists())return Q.notFound();return Q.body(new Uint8Array(await J.arrayBuffer()),200,{"Content-Type":"image/png","Cache-Control":"public, max-age=0, s-maxage=3600"})};try{let J=await fetch(`${HK({})}/api/v2/public/diagnostics/${encodeURIComponent(Y)}/og.png`,{signal:AbortSignal.timeout(LZ5)}),G=J.headers.get("content-type")??"";if(!J.ok||!G.startsWith("image/")||!J.body)return X();return Q.body(J.body,200,{"Content-Type":G,"Cache-Control":"public, max-age=0, s-maxage=604800"})}catch{return X()}}),Z.get("/:file{.+\\.md}",async(Q)=>{let Y=Eh(Q.req.param("file").replace(/\.md$/,""));try{let X=await kU8(Y,{lang:Q.req.query("lang")?.trim()||void 0,signal:AbortSignal.timeout(OZ5)});if(X===null)return Q.text("Deco Score not found",404);return Q.body(X,200,{"Content-Type":"text/markdown; charset=utf-8","Cache-Control":"public, max-age=600, stale-while-revalidate=3600","Access-Control-Allow-Origin":"*"})}catch{return Q.text("Deco Score unavailable",502)}}),Z.get("/:domain",async(Q)=>{let Y=Q.req.param("domain"),X=$?SU8($,"index.html"):null,J=X?Bun.file(X):null;if(!J||!await J.exists())return Q.notFound();let G=await J.text();try{let W=await NZ5(Eh(Y)),K=BZ5(Y,W);return Q.html(DZ5(G,K),200,{"Cache-Control":"public, max-age=0, s-maxage=300"})}catch{return Q.html(G)}}),Z}var UZ5=2500,LZ5=1e4,OZ5=1e4;var _U8=L(()=>{W8();eD();qP1();r1()});function xx0($,Z){return fetch(`${HK({})}${$}`,Z)}async function wZ5($,Z){let Q=await bx0($,{lang:Z});if(!Q)return{status:"not_found",report:null};return Q.scanned_at?{status:"ready",report:Q}:{status:"empty",report:null}}function EZ5($){let Z=typeof $==="object"&&$!==null?$:{},Q=typeof Z.domain==="string"?Z.domain.trim():"",Y=typeof Z.distinctId==="string"&&Z.distinctId.trim()&&Z.distinctId.length<=200?Z.distinctId.trim():void 0;return{domain:Q,distinctId:Y}}var jZ5,MO,vU8=async($,Z)=>{if(!$.get("reportUser"))return $.json({error:"Authentication required"},401);await Z();return},bU8;var xU8=L(()=>{W8();OK();eD();qP1();jZ5=new Set(["complete","errored","terminated","unknown"]);MO=new Q1;MO.use("*",async($,Z)=>{let Q=await B4.api.getSession({headers:$.req.raw.headers});$.set("reportUser",Q?.user?.id?{email:Q.user.email}:void 0),await Z(),$.header("Cache-Control","private, no-store"),$.header("Vary","Cookie");return});MO.use("/link-token/*",vU8);MO.use("/suggest",vU8);MO.get("/site/:domain",async($)=>{let Z=$.req.param("domain").trim();if(!Z)return $.json({error:"domain is required"},400);let Q=$.req.query("lang")?.trim()||void 0;try{return $.json(await wZ5(Z,Q))}catch{return $.json({error:"report read failed"},502)}});MO.post("/run",async($)=>{let Z=$.get("reportUser"),Q;try{Q=await $.req.json()}catch{return $.json({error:"invalid JSON"},400)}let{domain:Y,distinctId:X}=EZ5(Q);if(!Y)return $.json({error:"domain is required"},400);let J=Z?.email;try{let G=await xx0("/api/v2/diagnostics/run",{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${jE({})}`},body:JSON.stringify({url:Y,...J?{email:J}:{},distinct_id:X})});if(!G.ok)return $.json({error:`run HTTP ${G.status}`},502);let W=await G.json(),K=W.blocked?{state:"blocked"}:W.status==="fresh"?{state:"fresh"}:W.mode==="sync"?{state:"sync"}:{state:"running",id:W.id??null};return $.json(K)}catch{return $.json({error:"run failed"},502)}});MO.get("/status",async($)=>{let Z=$.req.query("id");if(!Z)return $.json({error:"id is required"},400);try{let Q=await xx0(`/api/v2/diagnostics/status?id=${encodeURIComponent(Z)}`,{headers:{Authorization:`Bearer ${jE({})}`}});if(!Q.ok)return $.json({error:`status HTTP ${Q.status}`},502);let X=(await Q.json()).status??"unknown",J={done:jZ5.has(X),status:X};return $.json(J)}catch{return $.json({error:"status failed"},502)}});MO.get("/link-token/:id",async($)=>{let Z=$.req.param("id");try{let Q=await xx0(`/api/v2/public/link-tokens/${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(Q.status===404)return $.json(null);if(!Q.ok)return $.json({error:`link token HTTP ${Q.status}`},502);return $.json(await Q.json())}catch{return $.json({error:"link token resolve failed"},502)}});MO.get("/suggest",async($)=>{let Z=($.req.query("q")??"").trim().slice(0,64);if(Z.length<2)return $.json({suggestions:[]});try{let Q=await xx0(`/api/v2/public/suggest?q=${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(!Q.ok)return $.json({suggestions:[]});let Y=await Q.json();return $.json({suggestions:Array.isArray(Y.suggestions)?Y.suggestions:[]})}catch{return $.json({suggestions:[]})}});bU8=MO});var PZ5=1048576,MP1;var fU8=L(()=>{W8();eK();r1();Ow1();MP1=new Q1;MP1.post("/webhook",h5({maxSize:PZ5,onError:($)=>$.json({error:"payload too large"},413)}),async($)=>{let Z=L0().stripeWebhookSecret;if(!Z)return $.json({error:"stripe billing not configured"},503);let Q=await $.req.text();if(!EX8(Q,$.req.header("stripe-signature"),Z))return $.json({error:"invalid signature"},400);let X=PX8(Q);if(!X)return $.json({error:"invalid payload"},400);let J=await zX8(X);return console.log("stripe webhook",{eventId:X.id,type:X.type,livemode:X.livemode,...J}),$.json({received:!0})})});import{timingSafeEqual as zZ5}from"crypto";function RZ5($,Z,Q){if(!Z?.startsWith("sha256="))return!1;let Y=new Bun.CryptoHasher("sha256",Q).update($).digest("hex"),X=Z.slice(7);if(X.length!==Y.length)return!1;return zZ5(Buffer.from(X),Buffer.from(Y))}function qZ5($,Z){let Q=Z,Y=Q?.repository?.name,X=Q?.repository?.owner?.login;if(typeof Y!=="string"||typeof X!=="string")return[];let J=[];if($==="check_suite"){if(Q.action!=="completed")return[];let G=Q.check_suite?.pull_requests;for(let W of Array.isArray(G)?G:[]){let K=W?.number;if(typeof K==="number")J.push(K)}}else if($==="issue_comment"&&Q.issue?.pull_request){let G=Q.issue.number;if(typeof G==="number")J.push(G)}return[...new Set(J)].map((G)=>({repoOwner:X,repoName:Y,number:G}))}function yU8($){let Z=new Q1;return Z.post("/webhook",h5({maxSize:AZ5,onError:(Q)=>Q.json({error:"payload too large"},413)}),async(Q)=>{let Y=process.env.GITHUB_WEBHOOK_SECRET;if(!Y)return Q.json({error:"github webhook not configured"},503);let X=await Q.req.text();if(!RZ5(X,Q.req.header("x-hub-signature-256"),Y))return Q.json({error:"invalid signature"},400);let J=Q.req.header("x-github-event");if(J!=="push"&&!TZ5.has(J??""))return Q.json({ok:!0,ignored:"event"});let G;try{G=JSON.parse(X)}catch{return Q.json({error:"invalid payload"},400)}if(J==="push"){let H=G.ref,F=G.repository?.full_name;if(!H||!F)return Q.json({ok:!0,ignored:"shape"});return p80().then((U)=>U?.markTenantPoolsDirty(`https://github.com/${F}`,H)).catch((U)=>console.warn(`[github-webhook] tenant pool refresh for ${F}@${H} failed: ${U instanceof Error?U.message:String(U)}`)),Q.json({ok:!0})}let W=qZ5(J??"",G);if(W.length===0)return Q.json({ok:!0,ignored:"no-pr"});let K=await MZ5($,W);return Q.json({ok:!0,refreshed:K})}),Z}async function MZ5($,Z){let Q=0;for(let Y of Z){let X=$.taskBoard(),J;try{J=await X.findPrLinks(Y)}catch(G){console.error("[github-webhook] pr link lookup failed:",G);continue}for(let G of J)try{let W=await X.getById(G.taskBoardItemId,G.organizationId),K=W?await $.contextFactory()(G.organizationId,W.assignedBy??W.createdBy):null;if(!K)continue;if(await su$(K,G.organizationId,G.taskBoardItemId)!==null)Q++}catch(W){console.error(`[github-webhook] pr card refresh failed for ${G.taskBoardItemId}:`,W)}}return Q}var AZ5=5242880,TZ5;var gU8=L(()=>{W8();eK();OX();kQ();TZ5=new Set(["check_suite","issue_comment"])});import{DBOS as IP1,SchedulerMode as VZ5}from"@dbos-inc/dbos-sdk";async function kZ5(){try{return await SZ5()}catch($){return console.warn(`[sandbox-credential-push] push failed: ${$ instanceof Error?$.message:String($)}`),null}}async function SZ5(){if(!i80())return null;let[{RemoteSandboxProvider:$},{SandboxProviderRouter:Z}]=await Promise.all([Promise.resolve().then(() => (vY1(),_Y1)),Promise.resolve().then(() => (CY1(),SY1))]),Q=await p80(),Y=Q instanceof Z?Q.providers.kubernetes:Q;if(!(Y instanceof $))return null;let{db:X}=z8(),{sandboxes:J,pools:G}=await Y.list(),W=Date.now(),K=Gk$({sandboxes:J,pools:G,records:await Wk$(X,J,G),legacyPools:cq0(process.env.STUDIO_SANDBOX_TENANT_POOLS),now:W}),{batches:H,failed:F}=await Kk$(K,FN0(X,new nX(L0().encryptionKey)),{now:W,orgFsLifetimeMs:iq0}),U=0,N=0,B=0;for(let D of H)try{let O=await Y.pushCredentials(D);U+=O.stored,N+=O.kept}catch(O){B++,console.warn(`[sandbox-credential-push] a push batch failed: ${O instanceof Error?O.message:String(O)}`)}return{sandboxes:J.length,pushed:U,kept:N,refused:K.refused,failed:F+B}}async function CZ5($,Z){let Q=await IP1.runStep(kZ5,{name:"pushSandboxCredentials"});if(Q&&(Q.refused>0||Q.failed>0))console.warn(`[sandbox-credential-push] ${Q.sandboxes} sandboxes: pushed ${Q.pushed}, kept ${Q.kept}, refused ${Q.refused}, failed ${Q.failed}`)}function hU8(){if(VP1)return;if(!L0().agentSandboxEnabled||!i80())return;VP1=IP1.registerWorkflow(CZ5,{name:"sandboxCredentialPushWorkflow"}),IP1.registerScheduled(VP1,{name:"sandboxCredentialPushWorkflow",crontab:IZ5,mode:VZ5.ExactlyOncePerIntervalWhenActive})}var IZ5="1-59/10 * * * *",VP1=null;var uU8=L(()=>{D3();Rw();wZ1();pq0();mq0();OX();r1()});function lU8($){let Z=new NO($.db,new nX($.encryptionKey)),Q=new Q1;return Q.get("/attachments/:token",async(Y)=>{let X=Qh$(Y.req.param("token"));if(!X)return Y.json({error:"Invalid or expired link"},404);let J=await Z.getByOrg(X.organizationId);if(!J)return Y.json({error:"Jira is not connected"},404);let W=await new r7(J.siteUrl,J.email,J.apiToken).downloadAttachment(X.attachmentId);if(!W.ok||!W.body)return Y.json({error:"Jira refused the download"},502);let K=new Headers;for(let H of["content-type","content-length","content-disposition"]){let F=W.headers.get(H);if(F)K.set(H,F)}return K.set("cache-control","no-store"),new Response(W.body,{status:200,headers:K})}),Q}var cU8=L(()=>{W8();Rw();GG1();bL()});function fx0(){try{return L0().jiraSettleSeconds*1000}catch{return fP}}function mU8($,Z){let Q=Z.windowMs??fP,Y=$.at(-1);if(!Y)return null;if(Z.changeId!==void 0&&Y.id!==Z.changeId)return{kind:"superseded"};if(Z.now!==void 0&&Z.now-Y.at<Q)return{kind:"moving"};let X=_Z5($,Q);if((X.id&&Y.toId?X.id===Y.toId:!1)||!X.id&&X.name===Y.to)return{kind:"returned",change:Y};return{kind:"moved",change:Y,from:X}}function _Z5($,Z){for(let Y=$.length-2;Y>=0;Y--){let X=$[Y],J=$[Y+1];if(X&&J&&J.at-X.at>=Z)return{id:X.toId,name:X.to}}let Q=$[0];return{id:Q?.fromId??null,name:Q?.from??null}}var kP1=L(()=>{iL();r1()});function dU8($){if(typeof $!=="object"||$===null)return null;let Z=$;if(Z.webhookEvent!=="jira:issue_updated")return null;let Q=Z.issue?.id,Y=Z.issue?.key,X=Z.changelog?.id;if(typeof Q!=="string"&&typeof Q!=="number"||typeof Y!=="string"||typeof X!=="string"&&typeof X!=="number")return null;let J=Z.changelog?.items?.find((G)=>G.field==="status");if(!J||typeof J.toString!=="string")return null;return{issueId:String(Q),issueKey:Y,toStatus:J.toString,changelogId:String(X)}}async function SP1($,Z,Q){if(!Z.enabled)return"disabled";let Y=Z.organizationId,X=new r7(Z.siteUrl,Z.email,Z.apiToken),J=mU8(await X.listStatusChanges(Q.issueId),{changeId:Q.changelogId,now:Q.now,windowMs:fx0()});if(!J)return"no_rule";if(J.kind!=="moved")return J.kind;let{change:G,from:W}=J,K=(await $.storage.automations.listJiraTransitionTriggers(Y,{jiraStatus:G.to,activeOnly:!0})).map((N)=>({...N,from:xP(N)})),H=md$(K)&&Z.boardId?cd$(await X.getBoardColumnStatusIds(Z.boardId),W.id,G.toId):null,F=ld$(K,W.name,H);if(!F)return"no_rule";if(!await $.storage.jiraIntegrations.claimTrigger(Y,Q.issueId,G.id))return"duplicate";return await SK({automationId:F.automation_id,organizationId:Y,triggerId:F.id,target:{kind:"jira",issues:[Q.issueId],move:{toStatus:G.to,fromStatus:W.name,movedBy:G.by,movedAt:new Date(G.at).toISOString()},eventKey:G.id}},{idempotencyKey:`jira:${F.id}:${G.id}`}),"fired"}var CP1=L(()=>{VF();bL();ip();kP1()});import{DBOS as Vz,SchedulerMode as vZ5}from"@dbos-inc/dbos-sdk";function iU8($){vP1=$}function xP1(){if(!vP1)throw Error("[jira-trigger] runtime not initialized \u2014 setJiraTriggerSweepRuntime() must run before the workflow fires");return vP1}function fP1(){let $=xP1();return new NO($.db,new nX($.encryptionKey))}async function gZ5($){try{let Z=await fP1().getById($);if(!Z?.enabled||!Z.boardId)return{integrationId:$,fired:0};let Q=await o3(xP1().db,Z.organizationId);if(!Q)return{integrationId:$,fired:0};if((await Q.storage.automations.listJiraTransitionTriggers(Z.organizationId,{activeOnly:!0})).length===0)return{integrationId:$,fired:0};let X=new r7(Z.siteUrl,Z.email,Z.apiToken),G=`(${await X.getBoardScopeJql(Z.boardId)}) AND status CHANGED AFTER "-${xZ5}m"`,W=0,K;for(let H=0;H<fZ5;H++){let F=await X.searchIssues({jql:G,nextPageToken:K});for(let U of F.issues)if(await SP1(Q,Z,{issueId:U.id,now:Date.now()})==="fired")W++;if(K=F.nextPageToken??void 0,!K)break}return{integrationId:$,fired:W}}catch(Z){return{integrationId:$,fired:0,error:Z instanceof Error?Z.message:String(Z)}}}async function hZ5($,Z){let Q=await Vz.runStep(()=>fP1().listEnabledIds(),{name:"loadJiraIntegrations"});if(Q.length===0)return;let Y=await Promise.all(Q.map((X)=>Vz.runStep(()=>gZ5(X),{name:`sweepJira:${X}`})));for(let X of Y)if(X.error)console.warn(`[jira-trigger] integration ${X.integrationId} failed: ${X.error}`);else if(X.fired>0)console.log(`[jira-trigger] integration ${X.integrationId} fired ${X.fired} automation(s) the webhook missed`)}async function uZ5($,Z){try{let Q=await fP1().getById($);if(!Q?.enabled)return"disabled";let Y=await o3(xP1().db,Q.organizationId);if(!Y)return"disabled";let X=await SP1(Y,Q,{issueId:Z.issueId,changelogId:Z.changelogId});if(X==="fired")console.log(`[jira-trigger] fired an automation for ${Z.issueKey} after it settled`);else if(X==="returned")console.log(`[jira-trigger] ${Z.issueKey} went back where it was before settling in "${Z.toStatus}"; no fire`);return X}catch(Q){return console.error(`[jira-trigger] settling ${Z.issueKey} failed`,Q instanceof Error?Q.message:Q),"error"}}async function lZ5($,Z){await Vz.sleep(fx0()+yZ5),await Vz.runStep(()=>uZ5($,Z),{name:"settleJiraMove"})}async function pU8($,Z){if(!bP1)throw Error("[jira-trigger] settle workflow is not registered");await Vz.startWorkflow(bP1,{workflowID:`jira-settle:${$}:${Z.changelogId}`})($,Z)}function nU8(){if(_P1)return;bP1=Vz.registerWorkflow(lZ5,{name:"jiraSettleWorkflow"}),_P1=Vz.registerWorkflow(hZ5,{name:"jiraTriggerSweepWorkflow"}),Vz.registerScheduled(_P1,{name:"jiraTriggerSweepWorkflow",crontab:bZ5,mode:vZ5.ExactlyOncePerIntervalWhenActive})}var bZ5="*/5 * * * *",xZ5=20,fZ5=5,yZ5=5000,vP1=null,bP1=null,_P1=null;var yP1=L(()=>{Rw();jg();bL();kP1();CP1()});function tU8($){let Z=new NO($.db,new nX($.encryptionKey)),Q=Nj($.db);async function Y(J,G){let W=dU8(G);if(!W)return;let K=await Z.getByWebhookSecret(J);if(!K?.enabled)return;if((await Q.listJiraTransitionTriggers(K.organizationId,{activeOnly:!0})).length===0)return;await pU8(K.id,W)}let X=new Q1;return X.post("/webhook/:secret",h5({maxSize:cZ5}),async(J)=>{let G=J.req.param("secret");if(!await Z.getByWebhookSecret(G))return J.json({error:"Unknown webhook"},404);let K;try{K=await J.req.json()}catch{return J.json({error:"Body must be JSON"},400)}return Y(G,K).catch((H)=>{console.error("[jira-webhook] trigger failed",H)}),J.body(null,202)}),X}var cZ5=1048576;var oU8=L(()=>{W8();eK();Rw();yP1();CP1();fa()});function sU8($,Z){if(Z.startsWith("text/html")||Z.startsWith("image/svg"))$.set("Content-Security-Policy","sandbox allow-scripts allow-modals allow-same-origin")}var rU8,mZ5,dZ5,aU8;var eU8=L(()=>{W8();$G();_p();yd();rU8=new Q1,mZ5=["range","if-none-match","if-modified-since"],dZ5=["content-type","content-length","content-range","accept-ranges","etag","last-modified"];rU8.get("/:org/files/*",async($)=>{let Z=$.get("studioContext"),Q=Z.organization?.id;if(!Z.auth?.user?.id){if(Ht($))return $.redirect(`/login?next=${encodeURIComponent($.req.path)}`,302);throw new q1(401,{message:"Authentication required"})}if(!Q)throw new q1(401,{message:"Organization context required"});let Y=$.req.path.replace(/^.*\/files\//,"");if(!Y)throw new q1(400,{message:"Missing file key"});let X=await I60(Y,Z);if(!X)throw new q1(503,{message:"Object storage not configured"});if(X.startsWith("data:")&&NK()){let K=X.match(/^data:([^;]+);base64,(.+)$/s);if(!K)throw new q1(500,{message:"Invalid data URL from storage"});let[,H,F]=K,U=Buffer.from(F,"base64"),N=new Headers({"Content-Type":H,"Cache-Control":"private, max-age=86400"});return sU8(N,H),new Response(U,{status:200,headers:N})}let J=new Headers;for(let K of mZ5){let H=$.req.header(K);if(H)J.set(K,H)}let G=await fetch(X,{headers:J});if(G.status===403||G.status===404)throw new q1(404,{message:"File not found"});if(!G.ok&&G.status!==304&&G.status!==416)throw console.error(`[files] upstream storage error ${G.status} for key:`,Y),new q1(502,{message:"Upstream storage error"});let W=new Headers;for(let K of dZ5){let H=G.headers.get(K);if(H)W.set(K,H)}return W.set("Cache-Control","private, max-age=86400"),sU8(W,W.get("content-type")??""),new Response(G.body,{status:G.status,headers:W})});aU8=rU8});var VZ0=b((hh)=>{var iZ5=hh&&hh.__createBinding||(Object.create?function($,Z,Q,Y){if(Y===void 0)Y=Q;var X=Object.getOwnPropertyDescriptor(Z,Q);if(!X||("get"in X?!Z.__esModule:X.writable||X.configurable))X={enumerable:!0,get:function(){return Z[Q]}};Object.defineProperty($,Y,X)}:function($,Z,Q,Y){if(Y===void 0)Y=Q;$[Y]=Z[Q]}),pZ5=hh&&hh.__exportStar||function($,Z){for(var Q in $)if(Q!=="default"&&!Object.prototype.hasOwnProperty.call(Z,Q))iZ5(Z,$,Q)};Object.defineProperty(hh,"__esModule",{value:!0});pZ5(rG(),hh)});var QN8=b(($N8)=>{Object.defineProperty($N8,"__esModule",{value:!0});$N8.version=void 0;$N8.version="3.4.0"});var JN8=b((AB)=>{var nZ5=AB&&AB.__importDefault||function($){return $&&$.__esModule?$:{default:$}};Object.defineProperty(AB,"__esModule",{value:!0});AB.NodeTransport=AB.VERSION=void 0;AB.nodeResolveHost=eZ5;var Q9=VZ0(),tZ5=V0("net"),gP1=V0("tls"),oZ5=V0("path"),YN8=V0("fs"),sZ5=nZ5(V0("dns")),rZ5=QN8();AB.VERSION=rZ5.version;var aZ5="nats.js";class XN8{socket;version;lang;yields=[];signal=(0,Q9.deferred)();closedNotification=(0,Q9.deferred)();options;connected=!1;tlsName="";done=!1;closeError;constructor(){this.lang=aZ5,this.version=AB.VERSION}async connect($,Z){this.tlsName=$.tlsName,this.options=Z;let{tls:Q}=this.options,{handshakeFirst:Y}=Q||{};try{if(Y===!0)this.socket=await this.tlsFirst($);else this.socket=await this.dial($);if(this.done)this.socket?.destroy();let X=await this.peekInfo();(0,Q9.checkOptions)(X,Z);let{tls_required:J,tls_available:G}=X,W=G===!0&&Z.tls!==null;if(!Y&&(J||W))this.socket=await this.startTLS();if(this.done)this.socket?.destroy();if(J&&this.socket.encrypted!==!0)throw Q9.errors.InvalidArgumentError.format("tls","is not available on this server");return this.connected=!0,this.setupHandlers(),this.signal.resolve(),Promise.resolve()}catch(X){let J=X;if(!J)J=new Q9.errors.ConnectionError("error connecting - node provided an undefined error");let{code:G}=J,W=G==="ECONNREFUSED"?new Q9.errors.ConnectionError("connection refused",{cause:J}):J;throw this.socket?.destroy(),W}}dial($){let Z=(0,Q9.deferred)(),Q,Y=(0,tZ5.createConnection)($.port,$.hostname,()=>{Z.resolve(Y),Y.removeAllListeners()});return Y.on("error",(X)=>{Q=X}),Y.on("close",()=>{Y.removeAllListeners(),Z.reject(Q)}),Y.setNoDelay(!0),Z}get isClosed(){return this.done}close($){return this._closed($,!1)}peekInfo(){let $=(0,Q9.deferred)(),Z;return this.socket.on("data",(Q)=>{this.yields.push(Q);let Y=Q9.DataBuffer.concat(...this.yields),X=(0,Q9.extractProtocolMessage)(Y);if(X!=="")try{let J=Q9.INFO.exec(X);if(!J)throw Error("unexpected response from server");let G=JSON.parse(J[1]);$.resolve(G)}catch(J){$.reject(J)}finally{this.socket.removeAllListeners()}}),this.socket.on("error",(Q)=>{Z=Q}),this.socket.on("close",()=>{this.socket.removeAllListeners(),$.reject(Z)}),$}loadFile($){if(!$)return Promise.resolve();let Z=(0,Q9.deferred)();try{if($=(0,oZ5.resolve)($),!(0,YN8.existsSync)($))Z.reject(Error(`${$} doesn't exist`));(0,YN8.readFile)($,(Q,Y)=>{if(Q)return Z.reject(Q);Z.resolve(Y)})}catch(Q){Z.reject(Q)}return Z}async loadClientCerts(){let $={},{certFile:Z,cert:Q,caFile:Y,ca:X,keyFile:J,key:G}=this.options.tls;try{if(Z){let W=await this.loadFile(Z);if(W)$.cert=W}else if(Q)$.cert=Q;if(J){let W=await this.loadFile(J);if(W)$.key=W}else if(G)$.key=G;if(Y){let W=await this.loadFile(Y);if(W)$.ca=[W]}else if(X)$.ca=X;return Promise.resolve($)}catch(W){return Promise.reject(W)}}async tlsFirst($){let Z,Q={servername:this.tlsName,rejectUnauthorized:!0};if(this.socket)Q.socket=this.socket;if(typeof this.options.tls==="object")try{let X=await this.loadClientCerts()||{};Q=(0,Q9.extend)(Q,this.options.tls,X)}catch(X){return Promise.reject(new Q9.errors.ConnectionError(X.message,{cause:X}))}let Y=(0,Q9.deferred)();try{let X=(0,gP1.connect)($.port,$.hostname,Q,()=>{X.removeAllListeners(),Y.resolve(X)});X.on("error",(J)=>{Z=J}),X.on("secureConnect",()=>{if(Q.rejectUnauthorized===!1)return;if(!X.authorized)throw X.authorizationError}),X.on("close",()=>{Y.reject(Z),X.removeAllListeners()}),X.setNoDelay(!0)}catch(X){Y.reject(new Q9.errors.ConnectionError(X.message,{cause:X}))}return Y}async startTLS(){let $,Z={socket:this.socket,servername:this.tlsName,rejectUnauthorized:!0};if(typeof this.options.tls==="object")try{let Y=await this.loadClientCerts()||{};Z=(0,Q9.extend)(Z,this.options.tls,Y)}catch(Y){return Promise.reject(new Q9.errors.ConnectionError(Y.message,{cause:Y}))}let Q=(0,Q9.deferred)();try{let Y=(0,gP1.connect)(Z,()=>{Y.removeAllListeners(),Q.resolve(Y)});Y.on("error",(X)=>{$=X}),Y.on("secureConnect",()=>{if(Z.rejectUnauthorized===!1)return;if(!Y.authorized)throw Y.authorizationError}),Y.on("close",()=>{Q.reject($),Y.removeAllListeners()})}catch(Y){Q.reject(new Q9.errors.ConnectionError(Y.message,{cause:Y}))}return Q}setupHandlers(){let $;this.socket.on("data",(Z)=>{return this.yields.push(Z),this.signal.resolve()}),this.socket.on("error",(Z)=>{$=Z}),this.socket.on("end",()=>{if(this.socket?.destroyed)return;this.socket?.write(new Uint8Array(0),()=>{this.socket?.end()})}),this.socket.on("close",()=>{this._closed($,!1)})}[Symbol.asyncIterator](){return this.iterate()}async*iterate(){while(!0){if(this.yields.length===0)await this.signal;let $=this.yields;this.yields=[];for(let Z=0;Z<$.length;Z++){if(this.options.debug)console.info(`> ${(0,Q9.render)($[Z])}`);yield $[Z]}if(this.done)break;else if(this.yields.length===0)$.length=0,this.yields=$,this.signal=(0,Q9.deferred)()}}discard(){if(this.done=!0,this.socket)try{this.socket.removeAllListeners(),this.socket.destroy()}catch{}}disconnect(){this._closed(void 0,!0).then().catch()}isEncrypted(){return this.socket instanceof gP1.TLSSocket}_send($){if(this.isClosed||this.socket===void 0)return Promise.resolve();if(this.options.debug)console.info(`< ${(0,Q9.render)($)}`);let Z=(0,Q9.deferred)();try{this.socket.write($,(Q)=>{if(Q){if(this.options.debug)console.error(`!!! ${(0,Q9.render)($)}: ${Q}`);return Z.reject(Q)}return Z.resolve()})}catch(Q){if(this.options.debug)console.error(`!!! ${(0,Q9.render)($)}: ${Q}`);Z.reject(Q)}return Z}send($){this._send($).catch((Q)=>{})}async _closed($,Z=!0){if(!this.connected)return;if(this.done){this.socket?.destroy();return}if(this.closeError=$,!$&&this.socket&&Z)try{await this._send(new TextEncoder().encode(""))}catch(Q){if(this.options.debug)console.log("transport close terminated with an error",Q)}try{if(this.socket)this.socket.removeAllListeners(),this.socket?.destroy(),this.socket=void 0}catch(Q){console.log(Q)}this.done=!0,this.closedNotification.resolve(this.closeError)}closed(){return this.closedNotification}}AB.NodeTransport=XN8;function eZ5($){let Z=(0,Q9.deferred)();return sZ5.default.lookup($,{all:!0},(Q,Y)=>{if(Q){Z.reject(Q);return}let X=[];for(let J of Y)X.push(J.address);if(X.length===0)X.push($);Z.resolve(X)}),Z}});var FN8=b((HN8)=>{Object.defineProperty(HN8,"__esModule",{value:!0});HN8.connect=$75;var GN8=JN8(),WN8=VZ0(),KN8=VZ0();function $75($={}){if((0,KN8.hasWsProtocol)($))return Promise.reject(KN8.errors.InvalidArgumentError.format("servers","node client doesn't support websockets, use the 'wsconnect' function instead"));return(0,WN8.setTransportFactory)({factory:()=>{return new GN8.NodeTransport},dnsResolveFn:GN8.nodeResolveHost}),WN8.NatsConnectionImpl.connect($)}});var UN8=b((VO)=>{var Q75=VO&&VO.__createBinding||(Object.create?function($,Z,Q,Y){if(Y===void 0)Y=Q;var X=Object.getOwnPropertyDescriptor(Z,Q);if(!X||("get"in X?!Z.__esModule:X.writable||X.configurable))X={enumerable:!0,get:function(){return Z[Q]}};Object.defineProperty($,Y,X)}:function($,Z,Q,Y){if(Y===void 0)Y=Q;$[Y]=Z[Q]}),Y75=VO&&VO.__exportStar||function($,Z){for(var Q in $)if(Q!=="default"&&!Object.prototype.hasOwnProperty.call(Z,Q))Q75(Z,$,Q)};Object.defineProperty(VO,"__esModule",{value:!0});VO.connect=void 0;var X75=FN8();Object.defineProperty(VO,"connect",{enumerable:!0,get:function(){return X75.connect}});Y75(VZ0(),VO)});function DN8($){let Z=$?.connectFn??K75,Q=null,Y=null,X=!1,J=!1,G=!1,W=[];function K(){return Q!==null&&!Q.isClosed()&&!Q.isDraining()&&!G}function H(){console.log(`[NatsProvider] fireReady: ${W.length} callbacks`);for(let N of W)try{N()}catch{}}function F(N){(async()=>{for await(let B of N.status())if(B.type==="disconnect")console.log("[NatsProvider] Disconnected"),G=!0;else if(B.type==="reconnect")console.log("[NatsProvider] Reconnected, re-firing ready callbacks"),G=!1,Y=null,H()})().catch(()=>{})}async function U(N,B){let D=0;while(!J)try{Q=await Z({servers:N,timeout:W75,reconnect:!0,maxReconnectAttempts:-1,...B?{authenticator:B}:{}}),console.log(`[NatsProvider] Connected to ${Q.getServer()} after ${D} attempt(s)`),Y=null,G=!1,F(Q),H();return}catch{D++;let O=V7(G75,J75,D-1,2,0.5);await F$(O)}}return{init(N,B){if(X)return;X=!0,J=!1;let D=B?.creds?yx0.credsAuthenticator(new TextEncoder().encode(B.creds)):B?.user?yx0.usernamePasswordAuthenticator(B.user,B.password):void 0;U(N,D).catch(()=>{})},isConnected(){return K()},getConnection(){return K()?Q:null},getJetStream(){if(!K())return null;if(!Y)Y=BN8.jetstream(Q);return Y},onReady(N){if(W.push(N),K())try{N()}catch{}},async drain(){if(J=!0,X=!1,Y=null,G=!1,Q){let N=Q;Q=null,await N.drain().catch(()=>{})}}}}function K75($){return NN8.connect($)}var yx0,NN8,BN8,J75=100,G75=3000,W75=3000;var LN8=L(()=>{r$();yx0=_(tz(),1),NN8=_(UN8(),1),BN8=_(NH(),1)});function gx0($){let Z=$?.ttlMs??60000,Q=$?.maxSize??1e4,Y=$?.updateRecencyOnGet??!1,X=new Map;function J(){if(X.size<=Q)return;let G=Date.now();for(let[W,K]of X)if(K.expiresAt<=G)X.delete(W);while(X.size>Q){let W=X.keys().next().value;if(W===void 0)break;X.delete(W)}}return{get(G){let W=X.get(G);if(!W)return;if(W.expiresAt<=Date.now()){X.delete(G);return}if(Y)X.delete(G),X.set(G,W);return W.value},set(G,W){X.delete(G),X.set(G,{value:W,expiresAt:Date.now()+Z}),J()},delete(G){X.delete(G)},clear(){X.clear()},size(){return X.size}}}function hx0($,Z){return`${$}.${Z}`}class hP1{cache;constructor($){this.cache=gx0({ttlMs:$?.ttlMs??H75,maxSize:$?.maxSize??F75})}async get($,Z){return this.cache.get(hx0($,Z))??null}async set($,Z,Q){this.cache.set(hx0($,Z),Q)}async invalidate($,Z){this.cache.delete(hx0($,Z)),this.cache.delete(hx0($,`${Z}:decisions`))}teardown(){this.cache.clear()}}var H75=600000,F75=5000;var ON8=()=>{};function ux0($,Z){return`${$}:${Z}`}function uP1($){let Z=gx0({ttlMs:$?.ttlMs??U75,maxSize:$?.maxSize??N75}),Q=$?.getConnection,Y=crypto.randomUUID(),X=new TextEncoder,J=new TextDecoder,G=null;function W(K,H){let F=Q?.();if(!F)return;try{F.publish(wN8,X.encode(JSON.stringify({organizationId:K,keyId:H,originId:Y})))}catch(U){console.warn("[ProviderKeyCache] Publish failed (non-critical):",U)}}return{get(K,H){return Z.get(ux0(K,H))},set(K,H,F){Z.set(ux0(K,H),F)},invalidate(K,H){Z.delete(ux0(K,H)),W(K,H)},start(){if(G)return;let K=Q?.();if(!K)return;G=K.subscribe(wN8),(async()=>{for await(let H of G)try{let F=JSON.parse(J.decode(H.data));if(F.originId===Y)continue;Z.delete(ux0(F.organizationId,F.keyId))}catch{}})().catch(console.error)},teardown(){G?.unsubscribe(),G=null,Z.clear()}}}var wN8="studio.ai-provider-keys.invalidate",U75=30000,N75=5000;var jN8=()=>{};class lP1{options;subscription=null;onCancel=null;encoder=new TextEncoder;originId=crypto.randomUUID();constructor($){this.options=$}async start($){if($)this.onCancel=$;if(this.subscription)return;if(!this.onCancel)return;let Z=this.options.getConnection();if(!Z)return;let Q=new TextDecoder,Y=Z.subscribe("studio.decopilot.cancel");this.subscription=Y,(async()=>{for await(let X of Y)try{let J=JSON.parse(Q.decode(X.data));if(J.originId===this.originId)continue;this.onCancel?.(J.taskId)}catch{}})().catch(console.error)}broadcast($){if(/[.*>\s]/.test($)){console.warn("[NatsCancelBroadcast] Invalid threadId, skipping broadcast");return}this.onCancel?.($);try{let Z=this.options.getConnection();if(!Z)return;let Q=this.encoder.encode(JSON.stringify({taskId:$,originId:this.originId}));Z.publish("studio.decopilot.cancel",Q)}catch(Z){console.warn("[NatsCancelBroadcast] Publish failed (non-critical):",Z)}}async stop(){this.subscription?.unsubscribe(),this.subscription=null,this.onCancel=null}}var EN8=($)=>{let Z;return()=>Z??=$()},cP1,mP1;var PN8=L(()=>{v6();cP1=EN8(()=>J$.createHistogram("decopilot.stream.encode_ms",{description:"Per-chunk JSON.stringify+encode time for decopilot stream",unit:"ms"})),mP1=EN8(()=>J$.createCounter("decopilot.stream.published_chunks",{description:"Logical decopilot stream chunks published to JetStream",unit:"{chunks}"}))});function E75($=TN8){return{name:sN,subjects:[`${oW1}.>`],storage:iF.StorageType.File,max_age:L75,max_bytes:w75,max_msgs_per_subject:j75,discard:iF.DiscardPolicy.Old,retention:iF.RetentionPolicy.Limits,duplicate_window:O75,num_replicas:$}}class RN8{chunks=0;encodeMs=0;maxMs=0;bytes=0;windowStart=performance.now();constructor(){setInterval(()=>this.flush(),1e4).unref?.()}record($,Z){if(this.chunks++,this.encodeMs+=$,$>this.maxMs)this.maxMs=$;this.bytes+=Z}flush(){let $=performance.now(),Z=$-this.windowStart;if(this.chunks>0&&Z>0)console.warn(JSON.stringify({msg:"stream-encode-trace",windowMs:Math.round(Z),chunks:this.chunks,encodeMs:Math.round(this.encodeMs),pctOfLoop:+(this.encodeMs/Z*100).toFixed(1),maxChunkMs:+this.maxMs.toFixed(2),mbEncoded:+(this.bytes/1048576).toFixed(2)}));this.chunks=0,this.encodeMs=0,this.maxMs=0,this.bytes=0,this.windowStart=$}}function zN8($){let Z=AN8.headers();for(let[Q,Y]of Object.entries($))Z.set(Q,Y);return Z}function T75($,Z){let Q=0;return{publish(Y,X,J,G){Y.publish(X,J,G?{headers:G}:void 0).catch((W)=>{if(Q++,D75().add(1,{"org.id":Z??"unknown"}),Q===1||Q%100===0)console.warn(`[Decopilot] JetStream publish failed for thread ${$} (${Q} total):`,W)})},get errorCount(){return Q}}}function R75($,Z){return $.info?.cluster?Z:1}function q75($){if(!($ instanceof Error))return!1;if(/non-clustered/i.test($.message))return!0;return/replicas?\b/i.test($.message)&&/not supported|can ?not|exceed|insufficient|greater than/i.test($.message)}class dP1{options;js=null;jsm=null;constructor($){this.options=$}async init(){let $=this.options.getConnection();if(!$){console.log("[Decopilot] StreamBuffer.init skipped: NATS not connected yet");return}let Z=async(Y,X)=>{let J=E75(X);try{await Y.streams.info(sN),await Y.streams.update(sN,J)}catch(G){if(G instanceof Error&&G.message.includes("stream not found"))await Y.streams.add(J),await Y.streams.update(sN,J);else if(G instanceof Error&&/can ?not change.*storage|storage type/i.test(G.message))await Y.streams.delete(sN),await Y.streams.add(J);else throw G}},Q=await D8(async()=>{let Y=this.options.getJetStreamManager?await this.options.getJetStreamManager():await iF.jetstreamManager($),X=R75($,TN8);try{await Z(Y,X)}catch(J){if(X<=1||!q75(J))throw J;console.warn(`[Decopilot] StreamBuffer: NATS rejected num_replicas=${X} (${J.message}); falling back to an unreplicated stream`),await Z(Y,1)}return Y},{maxAttempts:5,minTimeout:250,maxTimeout:4000,jitter:0.5,isRetriable:dp});this.js=this.options.getJetStream(),this.jsm=Q,console.log(`[Decopilot] StreamBuffer.init ${this.js?"ready":"degraded (js=null)"}`)}pump($,Z,Q,Y){let X=this.js;if(!X)return console.warn(`[Decopilot] pump: JetStream client unavailable for thread ${Z}; chunks NOT published to NATS`),Promise.resolve();let J=T75(Z,Y),G=!1,W=()=>{if(G)return;G=!0;let H=Od$(Z);X.publish(H.subject,H.data).catch(()=>{})};Q.addEventListener("abort",W,{once:!0});let K=(H)=>{let F=performance.now(),U=rW1(H,{runId:Z}),N=performance.now()-F;cP1().record(N),mP1().add(1,{"org.id":Y??"unknown"}),A75?.record(N,U.reduce((B,D)=>B+D.data.length,0));for(let B of U)J.publish(X,B.subject,B.data,B.headers?zN8(B.headers):void 0)};return(async()=>{let H=$.getReader(),F=0,U=0,N;try{while(!0){let{done:B,value:D}=await H.read();if(B)break;if(K(D),U++,++F>=64)F=0,await new Promise((O)=>setImmediate(O))}}catch(B){N=B,console.warn(`[Decopilot] stream pump error for thread ${Z}:`,B?.message??B)}finally{if(H.releaseLock(),W(),z75)console.warn(JSON.stringify({msg:"decopilot-stream-diag",event:"pump-done",taskId:Z,publishedChunks:U,publishErrors:J.errorCount}))}if(N!==void 0)throw N})()}async publishSerialized($,Z){try{return await D8(()=>$.publish(Z.subject,Z.data,{...Z.headers?{headers:zN8(Z.headers)}:{},...Z.msgId?{msgID:Z.msgId}:{}}),{maxAttempts:6,minTimeout:250,maxTimeout:5000,jitter:0.5,isRetriable:dp}),!0}catch(Q){return console.error(`[Decopilot] publish failed after retries subject=${Z.subject}`,Q),!1}}async publishRawChunk($,Z,Q){let Y=this.js;if(!Y)return!1;let X=performance.now(),J=rW1(Z,{runId:$,dedup:Q});cP1().record(performance.now()-X),mP1().add(1);for(let G of J)if(!await this.publishSerialized(Y,G))return!1;return!0}async publishDone($,Z,Q){let Y=this.js;if(!Y)return!1;let X=Ld$({runId:$,fenceToken:Z,finalSeq:Q});return await this.publishSerialized(Y,X)}async createTailStream($,Z,Q){let Y=this.js;if(!Y)return console.warn(`[Decopilot] createTailStream: JetStream client unavailable for thread ${$}; no live tail`),null;let X=Q?.deliverPolicy==="new"?iF.DeliverPolicy.New:iF.DeliverPolicy.All,J=Q?.closeOnDone??!1,G=bP($),W;try{W=await D8(async()=>{return(await Y.consumers.get(sN,{filter_subjects:G,deliver_policy:X})).consume()},{maxAttempts:6,minTimeout:250,maxTimeout:5000,jitter:0.5,isRetriable:dp})}catch(O){return console.warn("[Decopilot] JetStream tail unavailable (non-critical):",O?.message??O),null}let F=Dk0({messages:async function*(){try{for await(let O of W)yield{subject:O.subject,data:O.data,headers:O.headers}}finally{W.stop()}}(),onCancel:()=>W.stop()}).pipeThrough(Fk0()).pipeThrough(Uk0()).getReader(),U=!1,N=()=>{if(U)return;U=!0;try{F.releaseLock()}catch{}},B=!1,D=()=>{if(B)return;B=!0,W.stop(),F.cancel().catch(()=>{}),N()};return Z?.addEventListener("abort",D,{once:!0}),new ReadableStream({async pull(O){for(;;){let{done:w,value:j}=await F.read();if(w){D(),O.close();return}let E=j;if(E.kind==="done"){if(J){D(),O.close();return}continue}O.enqueue(E.chunk);return}},cancel(){D()}})}purge($){if(!this.jsm)return;this.jsm.streams.purge(sN,{filter:bP($)}).catch(()=>{})}teardown(){this.js=null,this.jsm=null}}var iF,AN8,B75=($)=>{let Z;return()=>Z??=$()},D75,L75=86400000000000,O75=120000000000,w75=4294967296,TN8,j75=500000,P75,z75,A75;var qN8=L(()=>{r$();aW1();Lk0();Nk0();v6();PN8();iF=_(NH(),1),AN8=_(tz(),1),D75=B75(()=>J$.createCounter("decopilot.stream.publish_errors",{description:"Number of JetStream publish failures for decopilot stream chunks",unit:"{errors}"})),TN8=Math.max(1,Number(process.env.DECOPILOT_STREAM_REPLICAS??3)||3);P75=process.env.STREAM_ENCODE_TRACE==="1",z75=process.env.DECOPILOT_STREAM_TRACE==="1";A75=P75?new RN8:null});function lx0($,Z,Q,Y){if(!Y)return!1;return $.emit(Z,BU(Q,Y.status,{title:Y.title??void 0,virtualMcpId:Y.virtual_mcp_id??void 0,createdBy:Y.created_by??void 0,triggerId:Y.trigger_id??null,branch:Y.branch??null,harnessId:Y.harness_id??void 0,createdAt:Y.created_at,updatedAt:Y.updated_at})),!0}var MN8=L(()=>{R8()});class iP1{storage;options;timer=null;constructor($,Z={}){this.storage=$;this.options=Z}start(){if(this.timer)return;let $=this.options.intervalMs??300000;this.timer=setInterval(()=>{this.runOnce()},$)}async runOnce(){let $=this.options.staleAfterMs??3600000;try{let Z=await this.storage.sweepAbandoned($);if(Z>0)console.log(`[async-research-sweeper] marked ${Z} stale jobs as abandoned`);return Z}catch(Z){return console.error("[async-research-sweeper] sweep failed",Z),0}}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}function M75($,Z,Q={}){let Y=$.startsWith("thread:")?jF($,Q):$;return[...new Set([Z,Y].filter((X)=>!!X))]}async function pP1($,Z){let Q=Z.organizationId;try{let Y=await $.storage.taskBoard.linkedThreadIds(Z.id,Q);for(let X of Y){let J=await gN($,X);if(!J?.owner||!J?.name)continue;let G=await $.storage.threads.get(X),W=await hN($,{threadId:X,runBranch:G?.branch}),K=await $80($,Q,NZ1(J)).catch(()=>null);if(!K){console.warn(`[task-board] no credential for ${J.owner}/${J.name} \u2014 `+`cannot look up ${Z.id}'s change request by branch`);continue}let H=M75(W,await OM0($,X),{flat:ny(K.repo.provider)});for(let F of H){let U=await K.readForBranch(F).catch(()=>null);if(!U)continue;return await $.storage.taskBoard.linkPr({taskBoardItemId:Z.id,organizationId:Q,url:U.url,prNumber:U.number,repo:K.repo}),await $.storage.taskBoard.openReviewCycleIfInProgress(Z.id,Q),await s3(Q).catch(()=>{}),console.log(`[task-board] ${Z.id}: linked ${U.url} found on branch ${F}`),!0}}}catch(Y){console.error("[task-board] PR lookup by branch failed",Y)}return!1}var VN8=L(()=>{O7();IQ();kQ()});async function IN8($,Z,Q){let Y=Z.organizationId;if(!VJ(Z))return!1;if(!Eg(Q))return!1;if(!await Sm($,Y,Z00))return!1;if(await $.storage.taskBoard.hasHumanRejectedDone(Z.id,Y))return!1;let X=F1.shipped,J=await $.storage.taskBoard.update(Z.id,Y,{status:X},Z.updatedBy);return await r5($,{taskBoardItemId:Z.id,action:"status_changed",actorId:null,data:{from:Z.status,to:X,reason:"pr_merged"}}),w8(Y,J),console.log(`[task-board-review-sweeper] ${Z.id}: linked PR already merged \u2014 moved to ${X}`),!0}var kN8=L(()=>{XG();m8();zX();Rp();qF();a5()});function v75($){return $ instanceof KX}function SN8($,Z){return Z-$>=C75}class nP1{taskBoard;contextFactory;billing;options;timer=null;running=!1;cursor=null;constructor($,Z,Q,Y={}){this.taskBoard=$;this.contextFactory=Z;this.billing=Q;this.options=Y}start(){if(this.timer)return;let $=this.options.intervalMs??V75;this.timer=setInterval(()=>{this.runOnce()},$),this.timer.unref()}async runOnce(){if(this.running)return 0;this.running=!0;let $=0;try{let Z=this.options.batchSize??k75,Q=this.options.itemIntervalMs??I75,Y=new Date(Date.now()-Q),X=await this.taskBoard.listItemsPendingReview(Z,this.cursor,Y),J=X.at(-1);this.cursor=X.length===Z&&J?{updatedAt:J.updatedAt,id:J.id}:null;for(let{id:G,organizationId:W}of X)try{if(await this.reconcileItem(G,W,Y))$++}catch(K){console.error(`[task-board-review-sweeper] ${G} failed`,K)}await this.reapNeverStartedThreads(Z),$+=await this.dispatchDueRetries(Z),await this.reactToUnhandledFailures(Z),$+=await this.settleFinishedRunsWithoutPr(Z,Y)}catch(Z){console.error("[task-board-review-sweeper] sweep failed",Z)}finally{this.running=!1}return $}async reapNeverStartedThreads($){try{let Z=await this.taskBoard.failNeverStartedLinkedThreads($,new Date(Date.now()-eJ1),q31);for(let Q of Z)console.warn(`[task-board-review-sweeper] failed never-started thread ${Q.threadId} on ${Q.itemId}`)}catch(Z){console.error("[task-board-review-sweeper] reaping failed",Z)}}async reactToUnhandledFailures($){let Z=await this.taskBoard.listItemsStuckAfterFailure($,new Date(Date.now()-_75));for(let{id:Q,organizationId:Y,threadId:X}of Z)try{console.warn(`[task-board-review-sweeper] reacting to an unhandled failure on ${Q}`),await T31(this.taskBoard,X,Y),await R31(this.taskBoard,this.billing,X,Y)}catch(J){console.error(`[task-board-review-sweeper] unhandled-failure reaction for ${Q} failed`,J)}}async settleFinishedRunsWithoutPr($,Z){let Q=0,Y=await this.taskBoard.listItemsFinishedWithoutPr($,Z);for(let{id:X,organizationId:J,finishedAt:G}of Y)try{if(!await this.taskBoard.claimSweep(X,J,Z))continue;let W=await this.taskBoard.getById(X,J);if(!W||W.status!==F1.progress||VJ(W)||W.assigneeId!==F8)continue;let K=await this.contextFactory(J,W.assignedBy??W.createdBy);if(!K)continue;if(await pP1(K,W)){if(await this.taskBoard.clearSweepBudget(X,J),await this.reconcileItem(X,J,Z))Q++;continue}if(!SN8(G.getTime(),Date.now()))continue;let H="the run finished without opening a pull request \u2014 there is "+"nothing for a reviewer to review",F=await this.taskBoard.advanceFromProgress(X,J,F1.review,W.updatedBy);if(!F)continue;await this.taskBoard.recordActivity({taskBoardItemId:X,action:"status_changed",actorId:null,data:{from:F1.progress,to:F1.review,reason:H}}).catch(()=>{}),w8(J,F),await MF(K,F,H)}catch(W){console.error(`[task-board-review-sweeper] settling finished run on ${X} failed`,W)}return Q}async dispatchDueRetries($){let Z=0,Q=await this.taskBoard.listItemsDueForRetry($,new Date);for(let{id:Y,organizationId:X,attempts:J}of Q)try{if(!await this.taskBoard.claimDueRetry(Y,X,new Date))continue;let G=await this.taskBoard.getById(Y,X);if(!G||G.status!==F1.progress||G.assigneeId!==F8)continue;let W=await this.contextFactory(X,G.assignedBy??G.createdBy);if(!W)continue;await hL(W,G,{runClass:"retry"}),Z++,console.warn(`[task-board-review-sweeper] re-dispatched ${Y} after a failure (attempt ${J})`)}catch(G){if(console.error(`[task-board-review-sweeper] retry dispatch for ${Y} failed`,G),v75(G)){await this.returnToBacklog(Y,X,G instanceof Error?G.message:String(G));continue}await this.taskBoard.scheduleRunRetry(Y,X,J,new Date(Date.now()+S75)).catch((W)=>console.error(`[task-board-review-sweeper] re-arming ${Y} failed`,W))}return Z}async returnToBacklog($,Z,Q){try{let Y=await this.taskBoard.getById($,Z);if(!Y||Y.status!==F1.progress)return;let X=await this.taskBoard.returnToBacklogAfterFailure($,Z,Y.updatedBy);if(!X)return;await this.taskBoard.recordActivity({taskBoardItemId:$,action:"status_changed",actorId:null,data:{from:F1.progress,to:F1.intake,reason:Q,retriesSpent:Y.retryAttempts}}).catch(()=>{}),w8(Z,X)}catch(Y){console.error(`[task-board-review-sweeper] returning ${$} to backlog failed`,Y)}}async handOffReviewWithoutPr($,Z){let Q=await this.taskBoard.listActivity(Z.id,Z.organizationId);if(!SN8(_D(Q,Z.reviewCycleStartedAt),Date.now()))return;await MF($,Z,"no pull request is linked to this task \u2014 there is nothing for a "+"reviewer to review")}async reconcileItem($,Z,Q){if(!await this.taskBoard.claimSweep($,Z,Q))return!1;let Y=await this.taskBoard.getById($,Z);if(!Y)return!1;if(!VJ(Y))return!1;let X=Y.assigneeId===F8,J=await this.taskBoard.listPrs($,Z),G=await this.contextFactory(Z,Y.assignedBy??Y.createdBy);if(!G)return!1;if(J.length===0){if(await pP1(G,Y))J=await this.taskBoard.listPrs($,Z);if(J.length===0){if(X)await this.handOffReviewWithoutPr(G,Y);return!1}}let W=await Promise.all(J.map(async(K)=>({...K,...await Vp(Z,K)})));if(W.every((K)=>K.state===null))console.warn(`[task-board-review-sweeper] ${$}: no live PR state from GitHub (${W.length} PR(s)) \u2014 proceeding on unknown`);if(await IN8(G,Y,W))return!0;if(!X)return!1;if(await Nl$(G,Y))return!0;if(!E31(W))return!1;return await Mp(G,Y,{previewMatchesHead:P31(W)}),!0}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}var V75=60000,I75=300000,k75=50,S75=60000,C75=900000,_75=120000;var CN8=L(()=>{m8();HI0();VN8();uL();Cp();qF();kN8();a5();x3();M31();kQ();e40()});async function _N8($,Z,Q=fP){return await bN8($,Z,Q,{})}async function vN8($,Z,Q,Y=fP){return await bN8($,Q,Y,{activityId:Z})}async function bN8($,Z,Q,Y){let X=await $.automations.findActiveBoardColumnTriggers();if(X.length===0)return 0;let J=new Map;for(let K of X){let H=K.automation.organization_id;J.set(H,[...J.get(H)??[],K])}let G=await $.taskBoard.listSettledTransitions({organizationIds:[...J.keys()],since:new Date(Z-b75),settledBefore:new Date(Z-Q),limit:x75,...Y}),W=0;for(let K of G)try{let H=(J.get(K.organizationId)??[]).filter((U)=>U.column_key===K.to&&Date.parse(U.created_at)<Date.parse(K.occurredAt));if(H.length===0)continue;let F=await f75($.taskBoard,K,Q);for(let U of H){if(!id$(U,{from:F,to:K.to}))continue;if(!await $.automations.claimTriggerFire(U.id,K.activityId))continue;await $.fire({automationId:U.automation_id,organizationId:K.organizationId,triggerId:U.id,target:{kind:"card",itemId:K.itemId,columnKey:K.to,eventKey:K.activityId,movedBy:K.actorId}},{idempotencyKey:`board:${U.id}:${K.activityId}`}),W++}}catch(H){console.error(`[automations] board transition ${K.activityId} failed`,H)}return W}async function f75($,Z,Q){let X=(await $.listActivity(Z.itemId,Z.organizationId)).flatMap((J)=>{let G=J.data;if(J.action!=="status_changed"||typeof G?.to!=="string")return[];let W=typeof G.from==="string"?G.from:null;return W===G.to?[]:[{from:W,to:G.to,occurredAt:J.occurredAt}]});return X.length>0?pd$(X,Q):Z.from}var b75=1800000,x75=200;var xN8=L(()=>{iL()});import{DBOS as Iz,DBOSClient as y75,SchedulerMode as g75}from"@dbos-inc/dbos-sdk";function fN8($){IO=$}async function l75($){if(!IO)return 0;try{return await vN8(IO,$,Date.now(),IO.settleMs)}catch(Z){return console.error(`[automations] settling board move ${$} failed`,Z),0}}async function c75(){if(!IO)return 0;try{return await _N8(IO,Date.now(),IO.settleMs)}catch($){return console.error("[automations] board transition sweep failed",$),0}}async function m75($){await Iz.sleep((IO?.settleMs??fP)+u75),await Iz.runStep(()=>l75($),{name:"settleBoardMove"})}async function d75($,Z){let Q=await Iz.runStep(()=>c75(),{name:"sweepBoardMoves"});if(Q>0)console.log(`[automations] board transition sweep fired ${Q} trigger(s) the settle wait missed`)}async function gN8($){let Z=IO;if(!Z||!oP1)return;if(!await Z.automations.hasActiveBoardColumnTrigger($.taskBoardItemId,$.to))return;let Q=`board-settle:${$.activityId}`;if(!Iz.isWithinWorkflow()){await Iz.startWorkflow(oP1,{workflowID:Q,queueName:xz})($.activityId);return}let Y=await y75.create({systemDatabaseUrl:Z.systemDatabaseUrl,systemDatabaseSchemaName:"dbos",systemDatabasePoolSize:1});try{await Y.enqueue({workflowName:yN8,queueName:xz,workflowID:Q},$.activityId)}finally{await Y.destroy()}}function hN8(){if(tP1)return;oP1=Iz.registerWorkflow(m75,{name:yN8}),tP1=Iz.registerWorkflow(d75,{name:"boardTransitionSweepWorkflow"}),Iz.registerScheduled(tP1,{name:"boardTransitionSweepWorkflow",crontab:h75,mode:g75.ExactlyOncePerIntervalWhenActive})}var h75="*/5 * * * *",u75=2000,IO=null,yN8="boardTransitionSettleWorkflow",oP1=null,tP1=null;var uN8=L(()=>{iL();xN8()});import{readdir as i75,rm as cx0}from"fs/promises";import{join as mx0}from"path";async function dx0($){let Z=new Date;Z.setUTCDate(Z.getUTCDate()-p75),Z.setUTCHours(0,0,0,0);let Q=0;try{let Y=await uh($);for(let X of Y)if(/^\d{4}$/.test(X))Q+=await lN8($,X,Z);else if(!X.startsWith(".")){let J=mx0($,X),G=await uh(J);for(let K of G){if(!/^\d{4}$/.test(K))continue;Q+=await lN8(J,K,Z)}if((await uh(J)).length===0)await cx0(J,{recursive:!0,force:!0})}}catch(Y){console.warn("monitoring retention cleanup failed:",Y)}return Q}async function lN8($,Z,Q){let Y=0,X=mx0($,Z),J=await uh(X);for(let W of J){if(!/^\d{2}$/.test(W))continue;let K=mx0(X,W),H=await uh(K);for(let U of H){if(!/^\d{2}$/.test(U))continue;let N=new Date(`${Z}-${W}-${U}T00:00:00Z`);if(isNaN(N.getTime()))continue;if(N<Q){let B=mx0(K,U);await cx0(B,{recursive:!0,force:!0}),Y++}}if((await uh(K)).length===0)await cx0(K,{recursive:!0,force:!0})}if((await uh(X)).length===0)await cx0(X,{recursive:!0,force:!0});return Y}async function uh($){try{return(await i75($)).filter((Q)=>!Q.startsWith("."))}catch{return[]}}var p75=30;var sP1=()=>{};import{DBOS as rP1,SchedulerMode as n75}from"@dbos-inc/dbos-sdk";async function o75(){let $=[XH(),oh(),SB()],Z=0;for(let Q of $)try{Z+=await dx0(Q)}catch(Y){console.error("[monitoring-retention] cleanup failed:",Y)}return console.log(`[monitoring-retention] deleted ${Z} day-dir(s) across ${$.length} signal dir(s)`),{deleted:Z,dirs:$.length}}async function s75($,Z){await rP1.runStep(()=>o75(),{name:"monitoringRetention"})}function mN8(){if(cN8)return;cN8=!0;let $=rP1.registerWorkflow(s75,{name:"monitoringRetentionWorkflow"});rP1.registerScheduled($,{name:"monitoringRetentionWorkflow",crontab:t75,mode:n75.ExactlyOncePerIntervalWhenActive})}var t75="23 4 * * *",cN8=!1;var dN8=L(()=>{zW();sP1()});function iN8($){return async(Z,Q)=>{let Y=await $.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.role","organization.id as orgId","organization.slug as orgSlug","organization.name as orgName"]).where("member.userId","=",Q).where("member.organizationId","=",Z).executeTakeFirst();if(!Y)return console.warn(`[automationContextFactory] User ${Q} not found in org ${Z} \u2014 returning null`),null;let X=await OY.create();X.auth.user={id:Q,role:Y.role},X.organization={id:Y.orgId,slug:Y.orgSlug,name:Y.orgName};let J=await VE($.db,Z,Y.role);return X.boundAuth=Kw1({auth:X.authInstance,headers:new Headers,role:Y.role,permissions:J,userId:Q}),X.access=new RA(Q,void 0,X.boundAuth,Y.role,"self"),SP(X,{id:Y.orgId,slug:Y.orgSlug}),X}}var pN8=L(()=>{sX();PN()});function nN8(){return async($,Z)=>{let Q=Date.now(),Y=$.req.method,X=$.req.path;if(X==="/api/auth/get-session"||X.includes("favicon")){await Z();return}let J="",G=!1;if(X.startsWith("/mcp")&&Y==="POST"){G=!0;try{if($.req.header("Content-Type")?.includes("application/json")){let N=await $.req.raw.clone().json();if(N.method==="tools/call"&&N.params?.name){let B=IZ0(N.params.name),D=N.params.arguments||{},O=Object.keys(D).map((j)=>IZ0(j)),w=O.length>0?O.slice(0,3).join(",")+(O.length>3?"\u2026":""):"";J=`${B9.tool}${B}${B9.dim}(${w})${B9.reset}`}else if(N.method)J=`${B9.dim}${IZ0(N.method)}${B9.reset}`}}catch{}}let W=IZ0(X);if(X.startsWith("/mcp/conn_")){let F=X.split("/")[2]??"";W=`/mcp/${B9.mcp}${IZ0(F.slice(0,12))}\u2026${B9.reset}`}else if(X==="/mcp")W=`${B9.mcp}/mcp${B9.reset}`;else if(X==="/mcp/registry")W=`${B9.mcp}/mcp/registry${B9.reset}`;let K=a75(Y),H=G?"\u25C0":"\u2190";console.log(`${B9.dim}${H}${B9.reset} ${K}${Y}${B9.reset} ${W}${J?` ${J}`:""}`);try{await Z()}finally{let F=Date.now()-Q,U=$.res.status,N=r75(U),B=F<1000?`${F}ms`:`${(F/1000).toFixed(1)}s`,D=G?"\u25B6":"\u2192";console.log(`${B9.dim}${D}${B9.reset} ${K}${Y}${B9.reset} ${W}${J?` ${J}`:""} ${N}${U}${B9.reset} ${B9.duration}${B}${B9.reset}`)}}}var B9,r75=($)=>{if($>=500)return B9.serverError;if($>=400)return B9.clientError;if($>=300)return B9.redirect;return B9.ok},a75=($)=>{return B9[$]||B9.reset},IZ0=($)=>{return $.replace(/\r/g,"").replace(/\n/g,"").replace(/\x1b\[[0-9;]*m/g,"").replace(/[\x00-\x1f\x7f-\x9f]/g,"")};var tN8=L(()=>{B9={reset:"\x1B[0m",dim:"\x1B[2m",bold:"\x1B[1m",GET:"\x1B[36m",POST:"\x1B[33m",PUT:"\x1B[35m",DELETE:"\x1B[31m",ok:"\x1B[32m",redirect:"\x1B[36m",clientError:"\x1B[33m",serverError:"\x1B[31m",mcp:"\x1B[35m",tool:"\x1B[96m",duration:"\x1B[90m"}});import{createHmac as aN8}from"crypto";import{mkdir as e75,readdir as $Q5,rm as oN8,stat as eN8}from"fs/promises";import{join as eP1,relative as ZQ5}from"path";import{z as Y8}from"zod";function ZB8($){let Z=$.replace(/[^a-zA-Z0-9_-]/g,"_");return eP1(QQ5,Z)}function QB8($){return $.replace(/^\/+/,"").replace(/\.\./g,"")}function aP1($,Z){let Q=ZB8($),Y=QB8(Z);return eP1(Q,Y)}function YQ5($,Z,Q,Y){let X=L0().encryptionKey||"dev-secret",J=`${$}:${Z}:${Q}:${Y}`;return aN8("sha256",X).update(J).digest("hex")}function rN8($,Z,Q,Y,X){let J=Math.floor(Date.now()/1000)+Y,G=YQ5(Z,Q,J,X),W=new URL(`/api/dev-assets/${Z}/${QB8(Q)}`,$);return W.searchParams.set("expires",J.toString()),W.searchParams.set("signature",G),W.searchParams.set("method",X),W.toString()}function YB8($,Z,Q){let Y=`${$}:${Z.getTime()}:${Q}`;return`"${aN8("md5","etag").update(Y).digest("hex")}"`}async function XB8($,Z,Q,Y,X){try{let J=await $Q5($,{withFileTypes:!0});for(let G of J){let W=eP1($,G.name),H=ZQ5(Z,W).replace(/\\/g,"/");if(Q&&!H.startsWith(Q))continue;if(G.isDirectory())if(Y){let F=H+"/";if(!Q||F.startsWith(Q)){if(!(Q?H.slice(Q.length):H).includes("/"))X.commonPrefixes.add(F)}}else await XB8(W,Z,Q,Y,X);else if(G.isFile()){if(Y&&Q){let F=H.slice(Q.length);if(F.includes(Y)){let U=F.indexOf(Y),N=Q+F.slice(0,U+1);X.commonPrefixes.add(N);continue}}try{let F=await eN8(W);X.objects.push({key:H,size:F.size,lastModified:F.mtime.toISOString(),etag:YB8(W,F.mtime,F.size)})}catch{}}}}catch{}}function JB8($,Z){let Y=Q0($).id;return[{name:"LIST_OBJECTS",description:"List objects in the local assets directory with pagination support",inputSchema:Y8.object({prefix:Y8.string().optional(),maxKeys:Y8.number().optional().default(1000),continuationToken:Y8.string().optional(),delimiter:Y8.string().optional()}),outputSchema:Y8.object({objects:Y8.array(Y8.object({key:Y8.string(),size:Y8.number(),lastModified:Y8.string(),etag:Y8.string()})),nextContinuationToken:Y8.string().optional(),isTruncated:Y8.boolean(),commonPrefixes:Y8.array(Y8.string()).optional()}),handler:async(X)=>{let J=X,G=J.prefix||"",W=J.maxKeys??1000,K=J.delimiter,H=J.continuationToken,F=ZB8(Y);await e75(F,{recursive:!0});let U={objects:[],commonPrefixes:new Set};await XB8(F,F,G,K,U),U.objects.sort((w,j)=>w.key.localeCompare(j.key));let N=0;if(H){if(N=U.objects.findIndex((w)=>w.key>H),N===-1)N=U.objects.length}let B=U.objects.slice(N,N+W),D=N+W<U.objects.length,O=D?B[B.length-1]?.key:void 0;return{objects:B,isTruncated:D,nextContinuationToken:O,commonPrefixes:Array.from(U.commonPrefixes).sort()}}},{name:"GET_OBJECT_METADATA",description:"Get metadata for a file in the local assets directory",inputSchema:Y8.object({key:Y8.string()}),outputSchema:Y8.object({contentType:Y8.string().optional(),contentLength:Y8.number(),lastModified:Y8.string(),etag:Y8.string(),metadata:Y8.record(Y8.string(),Y8.string()).optional()}),handler:async(X)=>{let J=X,G=aP1(Y,J.key),W=await eN8(G);return{contentType:Kj1(J.key),contentLength:W.size,lastModified:W.mtime.toISOString(),etag:YB8(G,W.mtime,W.size)}}},{name:"GET_PRESIGNED_URL",description:"Generate a presigned URL for downloading a file from local storage",inputSchema:Y8.object({key:Y8.string(),expiresIn:Y8.number().optional()}),outputSchema:Y8.object({url:Y8.string(),expiresIn:Y8.number()}),handler:async(X)=>{let J=X,G=JO(J.expiresIn,sN8);return{url:rN8(Z,Y,J.key,G,"GET"),expiresIn:G}}},{name:"PUT_PRESIGNED_URL",description:"Generate a presigned URL for uploading a file to local storage",inputSchema:Y8.object({key:Y8.string(),expiresIn:Y8.number().optional(),contentType:Y8.string().optional()}),outputSchema:Y8.object({url:Y8.string(),expiresIn:Y8.number()}),handler:async(X)=>{let J=X,G=JO(J.expiresIn,sN8);return{url:rN8(Z,Y,J.key,G,"PUT"),expiresIn:G}}},{name:"DELETE_OBJECT",description:"Delete a single file from local storage",inputSchema:Y8.object({key:Y8.string()}),outputSchema:Y8.object({success:Y8.boolean(),key:Y8.string()}),handler:async(X)=>{let J=X,G=aP1(Y,J.key);try{return await oN8(G),{success:!0,key:J.key}}catch{return{success:!1,key:J.key}}}},{name:"DELETE_OBJECTS",description:"Delete multiple files from local storage",inputSchema:Y8.object({keys:Y8.array(Y8.string()).max(1000)}),outputSchema:Y8.object({deleted:Y8.array(Y8.string()),errors:Y8.array(Y8.object({key:Y8.string(),message:Y8.string()}))}),handler:async(X)=>{let J=X,G=[],W=[];return await Promise.all(J.keys.map(async(K)=>{let H=aP1(Y,K);try{await oN8(H),G.push(K)}catch(F){W.push({key:K,message:F instanceof Error?F.message:"Unknown error"})}})),{deleted:G,errors:W}}}]}async function $z1($,Z,Q){let Y=JB8(Z,Q),X=new qj({name:"dev-assets-mcp",version:"1.0.0"},{capabilities:{tools:{}},jsonSchemaValidator:o9});for(let G of Y){let W="shape"in G.inputSchema?G.inputSchema.shape:Y8.object({}).shape,K=G.outputSchema&&"shape"in G.outputSchema?G.outputSchema.shape:Y8.object({}).shape;X.registerTool(G.name,{description:G.description??"",inputSchema:W,outputSchema:K,annotations:G.annotations,_meta:G._meta},async(H)=>{try{let F=await G.handler(H);return{content:[{type:"text",text:JSON.stringify(F)}],structuredContent:F}}catch(F){return{content:[{type:"text",text:`Error: ${F.message}`}],isError:!0}}})}let J=new QW({enableJsonResponse:$.headers.get("Accept")?.includes("application/json")??!1});return await X.connect(J),hK(X,J,$,"mcp:dev-assets")}async function GB8($,Z,Q,Y){let J=JB8(Q,Y).find((G)=>G.name===$);if(!J)return{content:[{type:"text",text:`Tool not found: ${$}`}],isError:!0};try{let G=await J.handler(Z);return{content:[{type:"text",text:JSON.stringify(G)}]}}catch(G){return{content:[{type:"text",text:G instanceof Error?G.message:String(G)}],isError:!0}}}var QQ5="./data/assets",sN8=3600,$B8,WB8;var KB8=L(()=>{r1();Zn();W8();OW0();$n();ZJ();GO();Vb0();$B8=new Q1;$B8.all("/",async($)=>{let Z=$.get("studioContext"),Q=new URL($.req.url),Y=`${Q.protocol}//${Q.host}`;return $z1($.req.raw,Z,Y)});WB8=$B8});var HB8={};O6(HB8,{mountDevRoutes:()=>XQ5});function XQ5($,Z){$.all("/mcp/:connectionId{.*_dev-assets$}",Z,async(Y)=>{let X=Y.get("studioContext"),J=new URL(Y.req.url),G=`${J.protocol}//${J.host}`;return $z1(Y.req.raw,X,G)}),$.all("/mcp/:connectionId{.*_dev-assets$}/call-tool/:toolName",Z,async(Y)=>{let X=Y.get("studioContext"),J=new URL(Y.req.url),G=`${J.protocol}//${J.host}`,W=Y.req.param("toolName");if(!W)return Y.json({error:"Missing tool name"},400);let K=await Y.req.json(),H=await GB8(W,K,X,G);if(H.isError)return Y.json(H.content,500);return Y.json(H.content)}),$.use("/mcp/dev-assets",Z),$.route("/mcp/dev-assets",WB8);let Q=new Q1;Q.use("*",mF({mountPath:"/api/dev-assets"})),Q.route("/",Mb0({orgFromPath:!1})),$.route("/api/dev-assets",Q)}var FB8=L(()=>{W8();Zj1();Vb0();KB8()});var PB8={};O6(PB8,{watchHandler:()=>EB8,resolveVoiceSigningSecret:()=>OB8,resolveCorsOrigin:()=>wB8,isSsoExemptPath:()=>LB8,isAllowedOAuthRedirectUri:()=>jB8,createApp:()=>LQ5});import{readFileSync as JQ5}from"fs";import{randomBytes as GQ5}from"crypto";import{PrometheusSerializer as WQ5}from"@opentelemetry/exporter-prometheus";import{DBOS as TB}from"@dbos-inc/dbos-sdk";import{oAuthDiscoveryMetadata as FQ5,oAuthProtectedResourceMetadata as UQ5}from"better-auth/plugins";async function KQ5($){let Z=$.connect(),Q;try{Q=await Promise.race([Z,NB8(UB8)])}catch{return Z.then((Y)=>Y.release(!0)).catch(()=>{}),!1}try{return await Promise.race([Q.query("SELECT 1"),NB8(UB8)]),Q.release(),!0}catch{return Q.release(!0),!1}}function NB8($){return new Promise((Z,Q)=>setTimeout(()=>Q(Error("pg health-check timeout")),$))}function LB8($){return $.startsWith("/api/org-sso/")||/^\/api\/[^/]+\/sso\//.test($)||$.startsWith("/api/auth/")||$.startsWith("/api/tools/management")||$.startsWith("/oauth-proxy/")||/^\/api\/[^/]+\/oauth-proxy\//.test($)||$.startsWith(`${Ub0}/`)||$.startsWith(`${Jb0}/`)}function OB8($){let Z=$.studioJwtSecret||$.betterAuthSecret;if(Z)return Z;return console.warn("STUDIO_JWT_SECRET/BETTER_AUTH_SECRET not set - generating a random secret for voice sessions (not persistent across restarts)"),GQ5(32).toString("base64")}function wB8($,{baseUrl:Z,requestOrigin:Q}){let Y;try{Y=new URL($).hostname}catch{return null}if(Y==="localhost"||Y==="127.0.0.1")return $;let X=Z??Q;try{if(new URL(X).origin===$)return $}catch{}return null}function jB8($,Z){return $.origin===new URL(Z).origin||$.hostname==="localhost"}async function LQ5($={}){let Z=$.database??z8(),Q=!1;g6.stop().catch((H0)=>{console.error("[SSEHub] Error stopping previous broadcast (HMR cleanup):",H0)});let Y,X,J,G,W=new hP1,K,H,F,U=null;if($.disableNats)K=uP1(),Y={get:async()=>null,set:async()=>{},invalidate:async()=>{},teardown:()=>{}},X=null,J=null,G=new e60,H={start:async()=>{},broadcast:()=>{},stop:async()=>{}},F={init:async()=>{},pump:(H0)=>{return(async()=>{let J0=H0.getReader();try{while(!0){let{done:P0}=await J0.read();if(P0)break}}catch{}finally{J0.releaseLock()}})()},publishRawChunk:async()=>!1,publishDone:async()=>!1,createTailStream:async()=>null,purge:()=>{},teardown:()=>{}};else{U=DN8();let H0=L0().natsCredsPath,J0;if(H0)try{J0=JQ5(H0,"utf8")}catch(U8){console.error(`[app] failed to read NATS_CREDS at ${H0}; connecting anonymously`,U8)}U.init(L0().natsUrls,{creds:J0,user:L0().natsUser,password:L0().natsPassword});let P0=s61()?new b61({getJetStream:()=>U.getJetStream(),selfListVersion:vx0.version}):null;P0?.init().catch(()=>{}),Y=P0;let z0=new P51({getJetStream:()=>U.getJetStream()});z0.init().catch(()=>{}),X=z0;let w1=new Pg(B31,{getJetStream:()=>U.getJetStream()}),b$=new Pg($60,{getJetStream:()=>U.getJetStream()});w1.init().catch(()=>{}),b$.init().catch(()=>{}),J={reads:w1,cards:b$};let o$=new xH1({getJetStream:()=>U.getJetStream()});o$.init().catch(()=>{}),G=o$,K=uP1({getConnection:()=>U.getConnection()}),H=new lP1({getConnection:()=>U.getConnection()}),F=new dP1({getConnection:()=>U.getConnection(),getJetStream:()=>U.getJetStream()}),lX8(U),U.onReady(()=>{P0?.init().catch((U8)=>{console.error("[McpListCache] Deferred init failed:",U8)}),z0.init().catch((U8)=>{console.error("[SkillCatalogCache] Deferred init failed:",U8)}),w1.init().catch((U8)=>{console.error("[PrReadCache] Deferred init failed:",U8)}),b$.init().catch((U8)=>{console.error("[PrCardCache] Deferred init failed:",U8)}),o$.init().catch((U8)=>{console.error("[ConnectionCircuitStore] Deferred init failed:",U8)}),K.start(),_j$(()=>U.getConnection()),F.init().catch((U8)=>{console.warn("[Decopilot] StreamBuffer init failed (late-join disabled):",U8)})})}if(kz)await kz();x61(Y),A51(X),R51(()=>U?.getConnection()??null),D31(J),fH1(G);let B={storage:new gl(Z.db),sseHub:g6,onThreadFinished:async(H0,J0)=>kp(new t3(Z.db),H0,J0,new B3(Z.db))},D=new wW1(B),O=new V90(Z.db),w=new iP1(O);w.start(),ed$(H),H.start((H0)=>{eI0(H0),D.execute({type:"CANCEL",taskId:H0}).catch((J0)=>{console.error("[Decopilot] CancelBroadcast execute failed:",J0)})}).catch((H0)=>{console.error("[Decopilot] CancelBroadcast start failed:",H0)}),U?.onReady(()=>{H.start().catch((H0)=>{console.error("[CancelBroadcast] Deferred start failed:",H0)})});let j=()=>U?.getConnection()??null;ow1(j),U?.onReady(()=>ow1(j)),OF1(j),U?.onReady(()=>OF1(j)),F.init().catch((H0)=>{console.warn("[Decopilot] StreamBuffer init failed, attach/late-join disabled:",H0)}),kz=async()=>{await D.stopAll(),D.dispose(),w.dispose(),H.stop().catch(()=>{}),XG8(),F.teardown(),Y?.teardown(),X?.teardown(),J?.reads.teardown(),J?.cards.teardown(),W.teardown(),K.teardown(),vj$(),G.teardown(),x61(null),A51(null),R51(null),D31(null),fH1(null)};let E=new Q1;if(E.use("*",_H1({enabled:(H0)=>Kt(H0,"debug")==="1"})),E.use("*",Nf0),E.use("/*",fX8({origin:(H0,J0)=>wB8(H0,{baseUrl:L0().baseUrl,requestOrigin:new URL(J0.req.url).origin}),credentials:!0,allowMethods:["GET","POST","PUT","DELETE","OPTIONS"],allowHeaders:["Content-Type","Authorization","mcp-protocol-version"],exposeHeaders:["WWW-Authenticate"]})),E.use("*",async(H0,J0)=>{if(await J0(),H0.req.path.includes("/files/"))return;if(H0.req.path.includes("/fs/")&&H0.req.path.endsWith("/read"))return;H0.header("X-Frame-Options","DENY"),H0.header("Content-Security-Policy","frame-ancestors 'none'")}),L0().nodeEnv==="development")E.use("*",nN8());E.use("*",async(H0,J0)=>{if(await J0(),$o(H0.req.path))return;if(H0.res.status>=500){let z0=await H0.res.clone().text();console.error(`[5xx Response] ${H0.req.method} ${H0.req.path} - ${H0.res.status}:`,z0)}}),E.get(bX.HEALTH,(H0)=>{if(Q)return H0.json({status:"shutting_down"},503);return H0.json({status:"ok"})}),E.get(bX.HEALTH_LIVE,(H0)=>{return H0.json({status:"ok"})}),E.get(bX.HEALTH_READY,async(H0)=>{if(Q)return H0.json({status:"shutting_down"},503);let J0={};if(J0.postgres={status:await KQ5(Z.pool)?"up":"down"},U)J0.nats=U.isConnected()?{status:"up"}:{status:"down"};else J0.nats={status:"down"};let P0=J0.postgres.status==="up",z0=P0?200:503;return H0.json({status:P0?"ready":"not_ready",services:J0},z0)}),E.get(bX.METRICS,async(H0)=>{try{let J0=await Of0.collect(),P0=HQ5.serialize(J0.resourceMetrics);return H0.text(P0,200,{"Content-Type":"text/plain; version=0.0.4; charset=utf-8"})}catch(J0){return console.error("Failed to collect metrics:",J0),H0.text("# Error collecting metrics",500)}});let P=1800000;E.get(`${bX.DBOS_QUEUE_DEPTH_PREFIX}:queueName`,async(H0)=>{let J0=H0.req.param("queueName");if(!NQ5.has(J0))return H0.json({error:`Unknown queue: ${J0}`},404);let[P0,z0]=await Promise.all([TB.listQueuedWorkflows({queueName:J0,status:"ENQUEUED",loadInput:!1,loadOutput:!1}),TB.listQueuedWorkflows({queueName:J0,status:"PENDING",loadInput:!1,loadOutput:!1,dequeuedAfter:new Date(Date.now()-P).toISOString()})]);return H0.json({queue_length:P0.length,in_flight:z0.length})}),E.route("/api/config",RU8),E.route("/api/_reports",bU8),E.route("/api/_stripe",MP1),E.route("/api/_github",yU8({taskBoard:()=>i,contextFactory:()=>y})),E.route("/api/_git",Ot);let T={db:Z.db,encryptionKey:L0().encryptionKey};E.route("/api/_jira",tU8(T)),E.route("/api/_jira",lU8(T)),E.route("/report",CU8($.clientDir)),E.route("/api/auth/custom",WJ8),E.all("/api/auth/admin/*",iJ8),E.all("/api/auth/*",async(H0)=>{return await B4.handler(H0.req.raw)});let z=FY8();z.use("/.well-known/oauth-protected-resource/mcp/:connectionId",g90),z.use("/mcp/:connectionId/.well-known/oauth-protected-resource",g90),E.route("/",z),E.get("/.well-known/oauth-protected-resource/api/:org/mcp/:connectionId",R90),E.route("/",LY8()),E.use("/oauth-proxy/:connectionId/*",g90),E.all("/oauth-proxy/:connectionId/*",BB8);let A=async(H0)=>{let P0=await BQ5()(H0.req.raw),z0=await P0.json();return Response.json(z0,P0)};E.use("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",g90),E.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",A);let q=async(H0)=>{let P0=await DQ5()(H0.req.raw),z0=await P0.json();return Response.json(z0,P0)};E.get("/.well-known/oauth-authorization-server/*/:gateway?/:connectionId?",q);let x=gX8({ttlMs:120000}),C=await HX8({db:Z.db,auth:B4,encryption:{key:L0().encryptionKey},observability:{tracer:fO,meter:J$},modelListCache:W,providerKeyCache:K,memberRoleCache:x});OY.set(C),er1({db:Z.db,baseUrl:N5()}),FX8({db:Z.db}),DX8({db:Z.db}),AX8({db:Z.db}),iU8({db:Z.db,encryptionKey:L0().encryptionKey}),Ju$({db:Z.db}),IX8({db:Z.db}),fu$({db:Z.db});let I=Nj(Z.db),g=new ya(Z.db),y=iN8({db:Z.db});VK1({storage:I,studioContextFactory:y,orgContextFactory:(H0)=>o3(Z.db,H0),systemDatabaseUrl:ne(L0().databaseUrl,L0().databasePgSsl)}),FK1({systemDatabaseUrl:ne(L0().databaseUrl,L0().databasePgSsl),studioContextFactory:y,deps:{runRegistry:D,cancelBroadcast:H,streamBuffer:F,sseHub:g6}}),XK1({dispatchRunFn:Kd$,studioContextFactory:y,deps:{runRegistry:D,cancelBroadcast:H,streamBuffer:F,sseHub:g6}});let h=new gl(Z.db),i=new t3(Z.db),n=new B3(Z.db),U0=new nP1(i,y,n);if(L0().taskBoardReviewSweeperEnabled){U0.start();let H0=kz;kz=async()=>{await H0?.(),U0.dispose()}}fN8({automations:I,taskBoard:i,fire:SK,systemDatabaseUrl:ne(L0().databaseUrl,L0().databasePgSsl),settleMs:L0().boardTransitionSettleSeconds*1000}),Du$(gN8),kd$({getJetStream:()=>U?.getJetStream()??null,getJetStreamManager:async()=>{let H0=U?.getConnection();return H0?await DB8.jetstreamManager(H0):null},messageParts:h.messageParts(),resolveRun:async(H0)=>{let J0=await Z.db.selectFrom("threads").select(["organization_id","created_by","message_storage_version","status","run_fence_token","title"]).where("id","=",H0).executeTakeFirst();return J0?{orgId:J0.organization_id,createdBy:J0.created_by,version:J0.message_storage_version??1,status:J0.status,runFenceToken:J0.run_fence_token,title:J0.title??null}:null},completeRunIfNotCompleted:async(H0,J0)=>{let P0=await h.completeRunIfNotCompleted(H0,J0);if(lx0(g6,J0,H0,P0),P0)await kp(i,H0,J0,n);return P0},markRunRequiresAction:async(H0,J0)=>{let P0=await h.requiresActionIfInProgress(H0,J0);return lx0(g6,J0,H0,P0),P0},markRunFailed:async(H0,J0,P0,z0)=>{let w1=await h.markRunFailed(H0,J0,P0,z0);if(lx0(g6,J0,H0,w1),w1)await kp(i,H0,J0,n);return w1},clearSynthesizedError:async(H0,J0)=>{await h.messageParts().replaceMessageParts(H0,vP(H0,J0),[])},persistTitle:(H0,J0,P0)=>h.update(H0,J0,{title:P0}),onTitleUpdated:async({runId:H0,orgId:J0,title:P0})=>{let z0=await h.get(H0,J0).catch(()=>null);g6.emit(J0,BU(H0,z0?.status??"in_progress",{title:P0,virtualMcpId:z0?.virtual_mcp_id??void 0,createdBy:z0?.created_by,triggerId:z0?.trigger_id,branch:z0?.branch??null,harnessId:z0?.harness_id??void 0,createdAt:z0?.created_at,updatedAt:z0?.updated_at}))},bumpProgress:async({runId:H0,orgId:J0})=>{await h.bumpProgress(H0,J0)},recordCompleted:async({runId:H0,orgId:J0,distinctId:P0,usage:z0})=>{l1.capture({distinctId:P0,event:"chat_message_completed",groups:{organization:J0},properties:{organization_id:J0,thread_id:H0,transport:"projector",input_tokens:z0.inputTokens,output_tokens:z0.outputTokens,total_tokens:z0.totalTokens}})},recordFailed:async({runId:H0,orgId:J0,distinctId:P0,reason:z0,kind:w1})=>{l1.capture({distinctId:P0,event:"chat_message_failed",groups:{organization:J0},properties:{organization_id:J0,thread_id:H0,transport:"projector",error_category:w1,error_message:z0}})},purgeRun:async(H0)=>{F.purge(H0)}}),Cm$({studioContextFactory:y,systemDatabaseUrl:ne(L0().databaseUrl,L0().databasePgSsl),streamBuffer:F}),mN8(),$a1(),NX8(),OX8(),RX8(),nU8(),hN8(),Fu$(),SX8(),yu$(),hU8();let b0=async(H0,J0,P0)=>{let z0=await I.findById(H0,J0);if(!z0)throw Error("Automation not found");return _K1({automationId:z0.id,organizationId:z0.organization_id,triggerId:null})},G0=new Dt(I,({automation:H0,trigger:J0,contextMessages:P0,idempotencyKey:z0})=>SK({automationId:H0.id,organizationId:H0.organization_id,triggerId:J0.id,contextMessages:P0},{idempotencyKey:z0})),N0=[XH(),oh(),SB()];for(let H0 of N0)dx0(H0).then(()=>{}).catch((J0)=>console.error("[monitoring] Retention cleanup failed:",J0));let o=()=>B4.api.deleteAllExpiredApiKeys().catch((H0)=>console.error("[auth] Expired API key cleanup failed:",H0));o(),setInterval(o,86400000).unref(),E.use("*",async(H0,J0)=>{if(Ff0(H0.req.path))return J0();let P0={measure:async(w1,b$)=>{gK(H0,w1);try{return await b$()}finally{YW(H0,w1)}}},z0=await OY.create(H0.req.raw,{timings:P0});z0.automationRunner=b0,H0.set("studioContext",z0);try{await J0()}finally{let w1=z0.pendingRevalidations;if(w1.length>0)Promise.race([Promise.allSettled(w1),F$(30000)]).catch((o$)=>console.error("[studio] revalidation cleanup error:",o$))}}),E.use("/api/:org/decopilot/*",Ft),E.use("/api/:org/v1/*",Ft),E.use("/api/:org/files/*",Ft),E.use("*",async(H0,J0)=>{if(LB8(H0.req.path))return J0();let P0=H0.get("studioContext");if(!P0?.organization?.id||!P0?.auth?.user?.id)return J0();if(!(await P0.storage.orgSsoConfig.getByOrgId(P0.organization.id))?.enforced)return J0();if(!await P0.storage.orgSsoSessions.isValid(P0.auth.user.id,P0.organization.id))return H0.json({error:"SSO authentication required for this organization"},403);return J0()});let e=new Q1;e.use("*",mF({mountPath:"/api/org-sso"})),e.route("/",Db0()),E.route("/api/org-sso",e),E.get("/api/tools/management",(H0)=>{return H0.json({tools:ca,grouped:AA()})}),E.use("/mcp/*",async(H0,J0)=>{gK(H0,"mcp");try{return await J0()}finally{YW(H0,"mcp")}});let Y0=async(H0,J0)=>{let P0=H0.var.studioContext;if(!P0.auth.user?.id&&!P0.auth.apiKey?.id){let z0=new URL(H0.req.url),w1=H0.req.header("x-forwarded-proto")?.split(",")[0]?.trim(),b$=w1?`${w1}://${z0.host}`:z0.origin;return H0.res=new Response(null,{status:401,headers:{"WWW-Authenticate":`Bearer realm="mcp",resource_metadata="${b$}${z0.pathname}/.well-known/oauth-protected-resource"`}})}return await J0()};if(E.use("/mcp/:connectionId?",Y0),E.use("/mcp/gateway/:virtualMcpId?",Y0),E.use("/mcp/virtual-mcp/:virtualMcpId?",Y0),E.use("/mcp/self",Y0),NK()){let{mountDevRoutes:H0}=(FB8(),ax0(HB8));H0(E,Y0)}let $0=new Q1;$0.use("*",mF({mountPath:"/mcp"})),$0.route("/",sk0()),E.route("/mcp",$0);let X0=new Q1;X0.use("*",mF({mountPath:"/mcp/self"})),X0.route("/",Xx0()),E.route("/mcp/self",X0);let h0=new Q1;h0.use("*",mF({mountPath:"/mcp"})),h0.route("/",ek0()),E.route("/mcp",h0),E.use("/api/:org/models/*",async(H0,J0)=>{gK(H0,"llm_models");try{return await J0()}finally{YW(H0,"llm_models")}});let k0=FG8({cancelBroadcast:H,streamBuffer:F,runRegistry:D});E.route("/api",k0),E.route("/api",aU8);let K1=new Q1;K1.use("*",mF({mountPath:"/api"})),K1.route("/",Kx0()),E.route("/api",K1),E.route("/api",EU8);let c0=new Q1;c0.use("*",mF({mountPath:"/api"})),c0.route("/",Hx0({tokenStorage:g,automationEventDispatcher:G0})),E.route("/api",c0);let w0=new ga(Z.db),E0=new Q1;E0.use("*",mF({mountPath:"/api"})),E0.route("/",Pb0()),E.route("/api",E0),E.route("/api/deco-sites",qG8()),E.route("/api/deco-apps",BU8());let n0=new Q1;n0.use("*",mF({mountPath:"/api/deco-sites"})),n0.route("/",Ab0()),E.route("/api/deco-sites",n0),E.route(Ub0,pJ8()),E.route(ZH8,XH8()),E.route("/api/_editor-resolve",zU8()),E.route(FJ8,UJ8()),E.route(Jb0,MJ8());let O1=L0(),o0=O1.elevenlabsApiKey?new Sx0({apiKey:O1.elevenlabsApiKey,model:O1.elevenlabsVoiceModel,conversationModel:O1.elevenlabsConversationModel,voiceId:O1.elevenlabsVoiceId}):null,v0={openai:O1.openaiLiveApiKey?new jP1({apiKey:O1.openaiLiveApiKey,voice:O1.openaiLiveVoice}):null,elevenlabs:o0?new wP1(o0,()=>U?.getConnection()??null):null},d0=new TP1({adapter:o0,conversationAdapters:v0,defaults:O1,secret:OB8(O1),getConnection:()=>U?.getConnection()??null}),i0=iF8({voiceSessions:d0,kvStorage:w0,runRegistry:D,streamBuffer:F,sseHub:g6,cancelBroadcast:H,tokenStorage:g,automationEventDispatcher:G0,mountDevAssets:NK(),mcpAuth:Y0,oauthProxyHandler:BB8,watchHandler:EB8,betterAuthProtectedResourceHandler:A,getNatsConnection:()=>U?.getConnection()??null});return E.route("/api/:org",i0),E.notFound((H0)=>{return H0.json({error:"Not Found",path:H0.req.path},404)}),E.onError(NG8),Object.assign(E,{markShuttingDown:()=>{Q=!0},shutdown:async()=>{if(console.log("[shutdown] Stopping workers..."),await Promise.allSettled([g6.stop(),kz?Promise.resolve(kz()).finally(()=>{kz=null}):Promise.resolve()]),U)await U.drain().catch((H0)=>console.error("[shutdown] NATS drain error:",H0));console.log("[shutdown] Flushing telemetry..."),await xJ().catch((H0)=>console.error("[shutdown] Telemetry flush error:",H0)),console.log("[shutdown] Closing database..."),await WG$(Z).catch((H0)=>console.error("[shutdown] Database close error:",H0)),console.log("[shutdown] Cleanup complete.")},initDbos:async()=>{await TB.registerQueue(nG,{partitionQueue:!0,concurrency:RK1,minPollingIntervalMs:qK1}),await TB.registerQueue(EW,{partitionQueue:!0,concurrency:KK1,priorityEnabled:!0}),await TB.registerQueue(IB,{workerConcurrency:L0().decopilotMaxConcurrentHostedRuns,priorityEnabled:!0}),await TB.registerQueue(kB,{workerConcurrency:L0().sandboxMaxConcurrentHostedRuns,priorityEnabled:!0}),await TB.registerQueue(xO,{partitionQueue:!0,concurrency:Sm$}),await TB.registerQueue(bz,xu$),await TB.registerQueue(xz),await Qj1(I),await Promise.allSettled(["automations-gate","automations-global","jira-push"].map((H0)=>TB.deleteQueue(H0))),await MK1(Z.pool),lK$().catch((H0)=>{console.error("[studio-pack-backfill] failed:",H0)}),km(Z.db).catch((H0)=>{console.error("[automations] built-in seed failed:",H0)}),Za1().catch((H0)=>{console.error("[org-fs] public-sets boot sync kick failed:",H0)})}})}var DB8,UB8=5000,kz=null,BB8=async($)=>{let Z=$.req.param("connectionId");if(!Z)return $.json({error:"Missing connectionId"},400);let Q=$.req.path.split("/").filter(Boolean),Y=Q[Q.length-1],X=$.get("studioContext");if(!X)X=await OY.create($.req.raw),$.set("studioContext",X);let J=$.req.param("org")?X.organization?.id:void 0,G=await X.storage.connections.findById(Z,J);if(!G?.connection_url)return $.json({error:"Connection not found"},404);if(Y==="register"&&G.oauth_config?.clientId){let g=await $.req.json().catch(()=>({}));return $.json({...typeof g==="object"&&g!==null?g:{},client_id:G.oauth_config.clientId,...G.oauth_config.clientSecret?{client_secret:G.oauth_config.clientSecret}:{},client_secret_expires_at:0})}let W=await Jt(G.connection_url),K,H=new URL(G.connection_url),U=(typeof G.metadata?.oauthResource==="string"&&G.metadata.oauthResource.length>0?G.metadata.oauthResource:void 0)??G.connection_url;if(W.ok)K=CO1(await W.json());if(!K)K=H.origin;let N=await q90(K);if(!N.ok)return $.json({error:"Failed to get auth server metadata"},502);let B=await N.json(),D;if(Y==="authorize")D=B.authorization_endpoint;else if(Y==="token")D=B.token_endpoint;else if(Y==="register")D=B.registration_endpoint;if(!D)return $.json({error:`Unknown OAuth endpoint: ${Y}`},404);let O=DY8(D);if(O)return O;let w=new URL(D),j=new URL($.req.url);if(w.search=j.search,Y==="authorize"){let g=w.searchParams.get("redirect_uri");if(g){let y=L0().baseUrl??j.origin;try{if(!jB8(new URL(g),y))return $.json({error:"invalid_request",error_description:"redirect_uri is not allowed"},400)}catch{return $.json({error:"invalid_request",error_description:"redirect_uri is malformed"},400)}w.searchParams.set("redirect_uri",g)}if(w.searchParams.has("resource"))w.searchParams.set("resource",U);if(_X8(G.connection_url))w.searchParams.set("auto_personal","true"),w.searchParams.set("force_new","true");return $.redirect(w.toString(),302)}let E={Accept:$.req.header("Accept")||"application/json"},P=$.req.header("Content-Type");if(P)E["Content-Type"]=P;let T=$.req.header("Authorization");if(T)E.Authorization=T;let z,A=null,q=null;if($.req.method!=="GET"&&$.req.method!=="HEAD")if(Y==="token"&&P?.includes("application/x-www-form-urlencoded")){if(T?.toLowerCase().startsWith("basic "))try{let n=atob(T.slice(6).trim()),U0=n.indexOf(":");if(U0!==-1){let b0=decodeURIComponent(n.slice(0,U0)),G0=decodeURIComponent(n.slice(U0+1));A=b0||null,q=G0||null}}catch{}let g=await $.req.formData();if(g.has("resource"))g.set("resource",U);let y=g.get("client_id"),h=g.get("client_secret");if(typeof y==="string"&&y)A=y;if(typeof h==="string"&&h)q=h;let i=new URLSearchParams;for(let[n,U0]of g.entries())i.append(n,U0.toString());z=i.toString()}else if(Y==="register"&&P?.toLowerCase().includes("application/json")){let g=await X.db.selectFrom("organization").select(["id","slug","name"]).where("id","=",G.organization_id).executeTakeFirst(),y=await $.req.text(),h={};try{h=y?JSON.parse(y):{}}catch{z=y}let i=typeof h==="object"&&h!==null&&!Array.isArray(h);if(z===void 0&&!i)z=y;if(z===void 0){let n=h,U0=n.metadata&&typeof n.metadata==="object"?n.metadata:{};n.metadata={...U0,organization_id:G.organization_id,...g?.slug?{organization_slug:g.slug}:{},...g?.name?{organization_name:g.name}:{}},z=JSON.stringify(n),E["Content-Type"]="application/json"}}else z=$.req.raw.body??void 0;let x=await fetch(w.toString(),{method:$.req.method,headers:E,body:z,duplex:"half",redirect:"manual"}),C=new Headers,I=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];for(let[g,y]of x.headers.entries())if(!I.includes(g.toLowerCase()))C.set(g,y);if(Y==="token"&&x.ok){let g=await x.text();try{let y=JSON.parse(g);if(typeof y.access_token==="string"&&y.access_token){let h=typeof y.expires_in==="number"?new Date(Date.now()+y.expires_in*1000):null,i=null;try{i=await Oz(G.connection_url)??D}catch{i=D}let n={connectionId:Z,accessToken:y.access_token,refreshToken:typeof y.refresh_token==="string"?y.refresh_token:null,scope:typeof y.scope==="string"?y.scope:null,expiresAt:h,clientId:A,clientSecret:q,tokenEndpoint:i};await new s5(X.db,X.vault).upsert(n)}}catch(y){console.error("[oauth-proxy] failed to persist downstream token:",y)}return new Response(g,{status:x.status,statusText:x.statusText,headers:C})}return new Response(x.body,{status:x.status,statusText:x.statusText,headers:C})},EB8=async($)=>{let Z=$.var.studioContext,Q=Z.auth.user?.id??Z.auth.apiKey?.userId;if(!Q)return $.json({error:"Unauthorized"},401);let Y=Z.organization?.id;if(!Y)return $.json({error:"organization id missing"},400);let X=$.req.query("types"),J=X?X.split(",").map((H)=>H.trim()).filter(Boolean):null,G=$.req.query("scope")==="all";if(G&&(!pN(Y)||!await nN(Z)))return $.json({error:"forbidden"},403);let W=G?oV0:Y;if(G)gL({action:"watch_all_orgs",actorUserId:Q,actorOrgId:Y,targetOrgId:"all"});let K=crypto.randomUUID();return TO($,async(H)=>{if(await H.writeSSE({event:"connected",data:JSON.stringify({listenerId:K,organizationId:Y,typePatterns:J,connectedAt:new Date().toISOString()})}),!g6.add({id:K,organizationId:W,typePatterns:J?.length?J:null,push:(N,B)=>{H.writeSSE({id:N.id,event:N.type,data:JSON.stringify(G?{...N,organizationId:B}:N)}).catch(()=>{g6.remove(W,K)})}})){await H.writeSSE({event:"error",data:JSON.stringify({error:"Too many connections",message:"SSE connection limit reached. Try again later."})});return}let U=setInterval(()=>{H.writeSSE({event:"keepalive",data:""}).catch(()=>{clearInterval(U),g6.remove(W,K)})},30000);await new Promise((N)=>{H.onAbort(()=>{clearInterval(U),g6.remove(W,K),N()})})})},HQ5,NQ5,BQ5=()=>UQ5(B4),DQ5=()=>FQ5(B4);var zB8=L(()=>{r$();r1();Qa1();BX8();wX8();qX8();G50();nG1();CX8();e40();j9();yd();R8();W8();Zb0();yX8();vH1();OK();PN();Rw1();D3();v6();Q6();Cw1();NJ8();VJ8();fw1();nJ8();iw1();ew1();$j1();BK();M90();Zj1();BG8();Yb0();pF8();rF8();aF8();QU8();NU8();Jj1();DU8();rk0();$50();PU8();$S0();fE1();AU8();bE1();qU8();_U8();xU8();fU8();gU8();uU8();cU8();oU8();yP1();Fj1();eU8();xE1();SE1();mZ0();LN8();RP1();BJ();AU0();z$0();O31();L$0();w$0();gH1();ON8();jN8();sw1();qN8();cI0();MN8();jr();la();yL();a5();pO1();CN8();uN8();XG();jg();dN8();mK0();sP1();zW();Yj1();fL();QK1();mK0();Hk0();fa();jr0();pN8();Bj();tN8();vt();Rw1();Ap();lp();$k0();DB8=_(NH(),1);HQ5=new WQ5,NQ5=new Set([nG,EW,IB,kB,xO,bz])});var qB8={};O6(qB8,{resolveClientDir:()=>AQ5,resolveAssetPathWithTraversalCheck:()=>RB8,isPathWithinDirectory:()=>TB8,createAssetHandler:()=>TQ5});import{resolve as kZ0,dirname as OQ5,join as wQ5,extname as jQ5,basename as EQ5,sep as AB8}from"path";function PQ5($,Z){if($===Z||EQ5($)==="index.html")return{"Cache-Control":"no-cache"};if($.includes(`${AB8}assets${AB8}`))return{"Cache-Control":"public, max-age=31536000, immutable"};return{}}function TB8($,Z){let Q=kZ0(Z),Y=kZ0($);return Y===Q||Y.startsWith(Q+"/")}function RB8({requestPath:$,clientDir:Z}){let Q=$.startsWith("/")?$.slice(1):$,Y=kZ0(Z,Q);if(!TB8(Y,Z))return null;return Y}function AQ5($,Z="../client"){let Q=new URL($),Y=OQ5(Q.pathname);return kZ0(Y,Z)}function TQ5($={}){let{env:Z="production",clientDir:Q=zQ5,isServerPath:Y=()=>!1}=$;if(Z==="development")return async function(J){return null};return async function(J){if(J.method!=="GET")return null;let G=new URL(J.url),W;try{W=decodeURIComponent(G.pathname)}catch{return null}if(Y(W))return null;let K=RB8({requestPath:W,clientDir:Q});if(!K)return null;let H=wQ5(K,"index.html"),F=kZ0(Q,"index.html"),U=J.headers.get("accept"),B=U?.includes("text/html")||U?.includes("*/*")&&["",".html"].includes(jQ5(K))?[H,F]:[];for(let D of[K,...B])try{let O=Bun.file(D);if(await O.exists())return new Response(O,{headers:PQ5(D,F)})}catch{}if(W.includes("/assets/"))return new Response("Not Found",{status:404,headers:{"Cache-Control":"no-store"}});return null}}var zQ5="./dist/client";var MB8=()=>{};var VB8={};O6(VB8,{tryUpgradePreviewWs:()=>SQ5,tryHandlePreviewHttp:()=>kQ5,previewWebSocketHandler:()=>CQ5,parsePreviewBaseDomain:()=>IQ5,isPreviewWsData:()=>ix0,extractHandleFromHost:()=>Zz1});function MQ5($){if($.method!=="GET")return!1;return($.headers.get("accept")??"").includes("text/html")}function VQ5(){return new Response(qQ5,{status:503,headers:{"content-type":"text/html; charset=utf-8","cache-control":"no-store","retry-after":"1","access-control-allow-origin":"*"}})}function IQ5($){if(!$||$.trim()==="")return null;let Z=$.includes("{handle}")?$.replace("{handle}","__handle__"):$,Q;try{Q=new URL(Z)}catch{return null}let Y=Q.hostname;if($.includes("{handle}")){let X=Y.indexOf(".");if(X<=0||X===Y.length-1)return null;return Y.slice(X+1)}return Y}function Zz1($,Z){if(!$||!Z)return null;let Q=$.indexOf(":"),Y=(Q>=0?$.slice(0,Q):$).toLowerCase(),J=`.${Z.toLowerCase().replace(/^\.+|\.+$/g,"")}`;if(!Y.endsWith(J))return null;let G=Y.slice(0,Y.length-J.length);if(!G||G.includes("."))return null;return G}async function kQ5($,Z){let Q=Zz1($.headers.get("host"),Z.baseDomain);if(!Q)return null;let Y=await Z.getRunner();if(!Y)return CZ0(503,"preview proxy not configured");let X=await Y.proxyPreviewRequest(Q,$);if(X.headers.get(Si)&&MQ5($))return VQ5();return X.headers.delete(Si),X}function CZ0($,Z){return new Response(JSON.stringify({error:Z}),{status:$,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function ix0($){return typeof $==="object"&&$!==null&&$.kind==="preview"}async function SQ5($,Z,Q){if(($.headers.get("upgrade")??"").toLowerCase()!=="websocket")return null;let Y=Zz1($.headers.get("host"),Q.baseDomain);if(!Y)return null;let X=await Q.getRunner();if(!X)return CZ0(503,"preview proxy not configured");let J=await X.resolvePreviewUpstreamUrl(Y);if(!J)return CZ0(404,"sandbox not found");let G=new URL($.url);if(G.pathname.startsWith("/_sandbox"))return CZ0(404,"not found");let W=`${J.replace(/^http/,"ws")}${G.pathname}${G.search}`,K=$.headers.get("sec-websocket-protocol"),H=K?K.split(",").map((N)=>N.trim()).filter(Boolean):[],F={kind:"preview",upstreamUrl:W,upstreamProtocols:H,pending:[],upstream:null,closed:!1};if(!Z.upgrade($,{data:F}))return CZ0(426,"upgrade failed");return}function SZ0($,Z,Q,Y){if(Z.closed)return;Z.closed=!0;try{$.close(Q,Y)}catch{}try{Z.upstream?.close()}catch{}}var RQ5=256,qQ5='<!DOCTYPE html><html><head><meta charset="utf-8"><title>Connecting\u2026</title><style>body{font-family:system-ui,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0;background:#fafafa;color:#555}div{text-align:center;max-width:420px;padding:24px}h3{margin:0 0 8px}p{margin:0;font-size:14px;color:#999;line-height:1.5}</style></head><body><div><h3>Connecting to sandbox\u2026</h3><p>Waiting for the sandbox to come online. This page refreshes automatically.</p></div><script>setTimeout(function(){window.location.reload()},1500)</script></body></html>',CQ5;var IB8=L(()=>{g80();CQ5={open($){let Z=$.data;if(!ix0(Z))return;let Q;try{Q=Z.upstreamProtocols.length>0?new WebSocket(Z.upstreamUrl,Z.upstreamProtocols):new WebSocket(Z.upstreamUrl)}catch(Y){console.warn(`[preview-ws] failed to dial upstream ${Z.upstreamUrl}: ${Y instanceof Error?Y.message:String(Y)}`),SZ0($,Z,1011,"upstream connect failed");return}Q.binaryType="arraybuffer",Z.upstream=Q,Q.addEventListener("open",()=>{while(Z.pending.length>0){let Y=Z.pending.shift();if(Y!==void 0)Q.send(Y)}}),Q.addEventListener("message",(Y)=>{if(Z.closed)return;$.send(Y.data)}),Q.addEventListener("close",(Y)=>{SZ0($,Z,Y.code||1000,Y.reason||"")}),Q.addEventListener("error",()=>{SZ0($,Z,1011,"upstream error")})},message($,Z){let Q=$.data;if(!ix0(Q))return;let Y=Q.upstream;if(Y&&Y.readyState===WebSocket.OPEN){Y.send(Z);return}if(Q.pending.length>=RQ5){SZ0($,Q,1011,"preview ws backlog overflow");return}Q.pending.push(Z)},close($){let Z=$.data;if(!ix0(Z))return;SZ0($,Z,1000,"")}}});r$();var Dz1="13";function Lz1($){return{name:"decocms",systemDatabaseUrl:$.systemDatabaseUrl,systemDatabaseSchemaName:"dbos",systemDatabasePoolSize:$.poolSize,runAdminServer:!1,executorID:$.executorID,applicationVersion:Dz1,...$.listenQueues!==void 0?{listenQueues:$.listenQueues}:{}}}r$();import pB8 from"pg";var Oz1=8314027461559302n,nB8=600000,tB8=500;async function wz1($,Z){let{databaseUrl:Q,lockTimeoutMs:Y=nB8}=$,X=$.log??((K)=>console.log(K)),J=new pB8.Client({connectionString:Q});await J.connect();let G=Date.now(),W=!1;try{while(!W){if(W=(await J.query("SELECT pg_try_advisory_lock($1) AS locked",[Oz1.toString()])).rows[0]?.locked===!0,W)break;if(Date.now()-G>=Y)throw Error(`Timed out after ${Y}ms waiting for the DBOS migration lock. Another process is still migrating the dbos schema; this pod will restart and retry.`);await F$(tB8)}let K=Date.now()-G;if(K>1000)X(`[dbos] waited ${K}ms for the migration lock; another process migrated first`);return await Z()}finally{if(W)try{await J.query("SELECT pg_advisory_unlock($1)",[Oz1.toString()])}catch{}await J.end().catch(()=>{})}}r1();Qf0();v6();function pD8(){let $=(process.env.BUN_OPTIONS??"").split(/\s+/).filter(Boolean);return[...process.argv.slice(1),...$]}function Ef0($,Z){for(let Q=0;Q<$.length;Q++){let Y=$[Q];if(Y===void 0)continue;if(Y===Z)return $[Q+1];if(Y.startsWith(`${Z}=`))return Y.slice(Z.length+1)}return}function ez1(){let $=pD8();if($.includes("--cpu-prof")){console.log(JSON.stringify({msg:"cpu-profiling-active",dir:Ef0($,"--cpu-prof-dir")??process.cwd(),name:Ef0($,"--cpu-prof-name"),markdown:$.includes("--cpu-prof-md"),intervalUs:Number(Ef0($,"--cpu-prof-interval")??1000),note:"profile is written on process exit"}));return}if(process.env.CPU_PROFILE)console.warn(JSON.stringify({msg:"cpu-profiling-requested-but-inactive",hint:'CPU profiling is a Bun launch flag. Set BUN_OPTIONS="--cpu-prof --cpu-prof-md --cpu-prof-dir=/tmp" before starting the process.'}))}Af0();var pZ0;function K21(){if(process.env.HEAP_WATCH!=="1")return()=>{};let $=Number(process.env.HEAP_WATCH_INTERVAL_MS??60000),Z=async()=>{let Q=gz();if(!Q)return;let Y={};try{let{heapStats:X}=await import("bun:jsc"),J=X(),G=Object.entries(J.objectTypeCounts).sort((W,K)=>K[1]-W[1]).slice(0,20);Y={objectCount:J.objectCount,heapSize:J.heapSize,top:Object.fromEntries(G)}}catch{}console.log(JSON.stringify({msg:"heap-watch",ts:new Date().toISOString(),uptimeS:Math.round(process.uptime()),rss:Q.rss,heapUsed:Q.heapUsed,heapTotal:Q.heapTotal,external:Q.external,arrayBuffers:Q.arrayBuffers,...Y}))};return Z().catch(()=>{}),pZ0=setInterval(()=>void Z().catch(()=>{}),$),pZ0.unref?.(),process.on("SIGUSR2",()=>{try{let Q=Bun.generateHeapSnapshot("v8"),Y=typeof Q==="string"?Q:JSON.stringify(Q),X=`/tmp/heap-${process.pid}-${Date.now()}.heapsnapshot`;Bun.write(X,Y),console.log(JSON.stringify({msg:"heap-snapshot-written",path:X}))}catch(Q){console.error("[heap-watch] snapshot failed:",Q)}}),()=>{if(pZ0)clearInterval(pZ0)}}import*as oD8 from"bun:jsc";var{startSamplingProfiler:sD8,samplingProfilerStackTraces:rD8}=oD8;function H21(){if(process.env.STALL_WATCHDOG!=="1")return()=>{};let $=Number(process.env.STALL_WATCHDOG_MS??100),Z=Number(process.env.STALL_WATCHDOG_TICK_MS??50);try{sD8()}catch(J){return console.error("[stall-watchdog] failed to start sampling profiler:",J),()=>{}}let Q,Y=performance.now()+Z,X=()=>{let J=performance.now(),G=J-Y;Y=J+Z;let W=[];try{W=rD8()?.traces??[]}catch{}if(G>$&&W.length>0){let K=new Map;for(let F of W){let U=F.frames.find((D)=>D.sourceURL&&!/Unknown Executable/.test(D.category??""))??F.frames[0];if(!U)continue;let N=(U.sourceURL??"?").replace(/^.*\/node_modules\//,"node_modules/"),B=`${U.name??"?"} @ ${N}:${U.line??"?"}`;K.set(B,(K.get(B)??0)+1)}let H=[...K.entries()].sort((F,U)=>U[1]-F[1]).slice(0,8).map(([F,U])=>({frame:F,count:U}));console.warn(JSON.stringify({msg:"stall-stack",ts:new Date().toISOString(),lagMs:Math.round(G),samplesInWindow:W.length,top:H}))}Q=setTimeout(X,Z),Q.unref?.()};return Q=setTimeout(X,Z),Q.unref?.(),()=>{if(Q)clearTimeout(Q)}}function F21(){ez1();let $=[K21(),W21(),H21()];return()=>{for(let Z of $)Z()}}import{existsSync as hQ5}from"fs";var wW=L0();sz1();var{DBOS:_Z0,DBOSClient:_Q5}=await import("@dbos-inc/dbos-sdk");function Wz1($,Z){if(!Z)return $;let Q=new URL($);if(!Q.searchParams.has("sslmode"))Q.searchParams.set("sslmode","verify-full");return Q.toString()}var vQ5=[nG,EW,IB,kB,xO,bz,xz],bQ5=wW.dispatchRole==="worker"?vQ5:wW.dispatchRole==="api"?[]:void 0;_Z0.setConfig(Lz1({systemDatabaseUrl:Wz1(wW.databaseUrl,wW.databasePgSsl),poolSize:wW.dbosPoolSize,executorID:wW.podName,listenQueues:bQ5}));var{createApp:xQ5}=await Promise.resolve().then(() => (zB8(),PB8)),{isServerPath:fQ5}=await Promise.resolve().then(() => (mZ0(),vz1)),{createAssetHandler:yQ5,resolveClientDir:vB8}=await Promise.resolve().then(() => (MB8(),qB8)),gQ5=wW.port,kB8=vB8(import.meta.url,"../client"),bB8=hQ5(kB8)?kB8:vB8(import.meta.url,"../dist/client"),uQ5=yQ5({clientDir:bB8,isServerPath:fQ5}),lQ5={"X-Frame-Options":"DENY","Content-Security-Policy":"frame-ancestors 'none'"};function cQ5($){let Z=new Headers($.headers);for(let[Q,Y]of Object.entries(lQ5))Z.set(Q,Y);return new Response($.body,{status:$.status,statusText:$.statusText,headers:Z})}var{parsePreviewBaseDomain:mQ5,tryHandlePreviewHttp:dQ5,tryUpgradePreviewWs:iQ5,previewWebSocketHandler:Qz1,isPreviewWsData:Yz1}=await Promise.resolve().then(() => (IB8(),VB8)),{getOrInitSharedRunner:xB8}=await Promise.resolve().then(() => (OX(),AS$)),fB8=mQ5(process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN),SB8={baseDomain:fB8??"",getRunner:xB8};if(process.env.STUDIO_SANDBOX_TENANT_POOLS?.trim())xB8().catch(($)=>{console.warn("[lifecycle] eager sandbox provider init for tenant pools failed:",$ instanceof Error?$.message:String($))});var px0=await xQ5({clientDir:bB8}),Xz1=process.env.DBOS_CONDUCTOR_KEY?.trim(),CB8=process.env.DBOS_CONDUCTOR_URL?.trim();await wz1({databaseUrl:Wz1(wW.databaseUrl,wW.databasePgSsl)},()=>_Z0.launch({...Xz1?{conductorKey:Xz1}:{},...Xz1&&CB8?{conductorURL:CB8}:{}}));console.log(`[dbos] application version: ${_Z0.applicationVersion}`);var Jz1=5,Gz1=0;await D8(async()=>{Gz1++;try{return await px0.initDbos()}catch($){let Z=Gz1>=Jz1?"giving up":"retrying";throw console.warn(`[dbos] initDbos attempt ${Gz1}/${Jz1} failed, ${Z}`,$),$}},{maxAttempts:Jz1,minTimeout:1000,maxTimeout:1e4,jitter:0.5});var pQ5=Bun.serve({idleTimeout:0,port:gQ5,hostname:"0.0.0.0",fetch:async($,Z)=>{if(fB8){let Y=await iQ5($,Z,SB8);if(Y===void 0)return;if(Y)return Y;let X=await dQ5($,SB8);if(X)return X}let Q=await uQ5($);if(Q)return cQ5(Q);return px0.fetch($,{server:Z})},websocket:{open($){if(Yz1($.data))Qz1.open($)},message($,Z){if(Yz1($.data))Qz1.message($,Z)},close($){if(Yz1($.data))Qz1.close($)}},development:!1}),nQ5=F21();if(wW.localMode)Promise.resolve().then(() => (Ag(),xI0)).then(async({seedLocalMode:$,markSeedComplete:Z,healLocalJwks:Q})=>{try{let Y=await Q();if(Y>0)console.log(`[local-mode] cleared ${Y} undecryptable JWKS key(s); Better Auth will generate a fresh one`);let X=await $()}catch(Y){console.error("Failed to seed local mode:",Y)}finally{Z()}}).catch(async($)=>{console.error("Failed to load local-mode module:",$);try{let{markSeedComplete:Z}=await Promise.resolve().then(() => (Ag(),xI0));Z()}catch{}});var _B8=!1;async function tQ5($){let Z;try{Z=await _Q5.create({systemDatabaseUrl:Wz1(wW.databaseUrl,wW.databasePgSsl),systemDatabaseSchemaName:"dbos"});let Q=await Z.listWorkflows({status:"PENDING",queueName:EW,executorId:$,loadInput:!1,loadOutput:!1});if(Q.length===0){console.log(`[shutdown] no in-flight thread-gate gates to hand off (executor ${$})`);return}let Y=Q.map((X)=>X.workflowID);await Z.resumeWorkflows(Y,{queueName:EW}),console.log(`[shutdown] re-enqueued ${Y.length} in-flight thread-gate gate(s) for re-adoption by a live executor (from ${$}):`,Y)}catch(Q){console.error("[shutdown] thread-gate handoff failed:",Q)}finally{await Z?.destroy().catch(()=>{})}}async function nx0($){if(_B8)return;_B8=!0,console.log(`
 [shutdown] Received ${$}, shutting down gracefully...`);let Z=Number(process.env.SHUTDOWN_GRACE_SECONDS??60)*1000,Q=Math.max(Z-5000,1e4),Y=setTimeout(()=>{console.error(`[shutdown] Timed out after ${Q}ms, forcing exit.`),process.exit(1)},Q);Y.unref?.();let X=0;try{nQ5(),px0.markShuttingDown();let J=jz1(wW.dispatchRole,Q,process.env.SHUTDOWN_DRAIN_MS);await F$(J),await pQ5.stop(!0);let G=_Z0.executorID;await _Z0.shutdown(),await tQ5(G),await px0.shutdown()}catch(J){console.error("[shutdown] Error during shutdown:",J),X=1}clearTimeout(Y),process.exit(X)}process.on("SIGTERM",()=>nx0("SIGTERM"));process.on("SIGINT",()=>nx0("SIGINT"));process.on("SIGHUP",()=>nx0("SIGHUP"));process.on("unhandledRejection",($)=>{console.error("[process] Unhandled rejection:",$)});process.on("uncaughtException",($)=>{console.error("[process] Uncaught exception:",$),nx0("uncaughtException")});