decocms 4.505.0 → 4.505.2

package/dist/server/server.js

@@ -1215,7 +1215,7 @@ Caused by: ${Z.stack}`}};Gn=class Gn extends qX{constructor($,Z){super($,Z);this
 `).some((Q)=>Q.indexOf("(https.js:")!==-1||Q.indexOf("node:https:")!==-1)}incrementSockets($){if(this.maxSockets===1/0&&this.maxTotalSockets===1/0)return null;if(!this.sockets[$])this.sockets[$]=[];let Z=new V26.Socket({writable:!1});return this.sockets[$].push(Z),this.totalSocketCount++,Z}decrementSockets($,Z){if(!this.sockets[$]||Z===null)return;let Q=this.sockets[$],Y=Q.indexOf(Z);if(Y!==-1){if(Q.splice(Y,1),this.totalSocketCount--,Q.length===0)delete this.sockets[$]}}getName($){if(this.isSecureEndpoint($))return I26.Agent.prototype.getName.call(this,$);return super.getName($)}createSocket($,Z,Q){let Y={...Z,secureEndpoint:this.isSecureEndpoint(Z)},X=this.getName(Y),J=this.incrementSockets(X);Promise.resolve().then(()=>this.connect($,Y)).then((G)=>{if(this.decrementSockets(X,J),G instanceof Gm$.Agent)try{return G.addRequest($,Y)}catch(W){return Q(W)}this[OB].currentSocket=G,super.createSocket($,Z,Q)},(G)=>{this.decrementSockets(X,J),Q(G)})}createConnection(){let $=this[OB].currentSocket;if(this[OB].currentSocket=void 0,!$)throw Error("No socket was returned in the `connect()` function");return $}get defaultPort(){return this[OB].defaultPort??(this.protocol==="https:"?443:80)}set defaultPort($){if(this[OB])this[OB].defaultPort=$}get protocol(){return this[OB].protocol??(this.isSecureEndpoint()?"https:":"http:")}set protocol($){if(this[OB])this[OB].protocol=$}}KW.Agent=Hm$});var Um$=y((pK)=>{var k26=pK&&pK.__createBinding||(Object.create?function($,Z,Q,Y){if(Y===void 0)Y=Q;var X=Object.getOwnPropertyDescriptor(Z,Q);if(!X||("get"in X?!Z.__esModule:X.writable||X.configurable))X={enumerable:!0,get:function(){return Z[Q]}};Object.defineProperty($,Y,X)}:function($,Z,Q,Y){if(Y===void 0)Y=Q;$[Y]=Z[Q]}),C26=pK&&pK.__setModuleDefault||(Object.create?function($,Z){Object.defineProperty($,"default",{enumerable:!0,value:Z})}:function($,Z){$.default=Z}),eW1=pK&&pK.__importStar||function($){if($&&$.__esModule)return $;var Z={};if($!=null){for(var Q in $)if(Q!=="default"&&Object.prototype.hasOwnProperty.call($,Q))k26(Z,$,Q)}return C26(Z,$),Z},S26=pK&&pK.__importDefault||function($){return $&&$.__esModule?$:{default:$}};Object.defineProperty(pK,"__esModule",{value:!0});pK.SocksProxyAgent=void 0;var _26=Qm$(),v26=Fm$(),b26=S26(V0("debug")),x26=eW1(V0("dns")),f26=eW1(V0("net")),y26=eW1(V0("tls")),g26=V0("url"),KC0=(0,b26.default)("socks-proxy-agent"),h26=($)=>{if($.servername===void 0&&$.host&&!f26.isIP($.host))return{...$,servername:$.host};return $};function u26($){let Z=!1,Q=5,Y=$.hostname,X=parseInt($.port,10)||1080;switch($.protocol.replace(":","")){case"socks4":Z=!0,Q=4;break;case"socks4a":Q=4;break;case"socks5":Z=!0,Q=5;break;case"socks":Q=5;break;case"socks5h":Q=5;break;default:throw TypeError(`A "socks" protocol must be specified! Got: ${String($.protocol)}`)}let J={host:Y,port:X,type:Q};if($.username)Object.defineProperty(J,"userId",{value:decodeURIComponent($.username),enumerable:!1});if($.password!=null)Object.defineProperty(J,"password",{value:decodeURIComponent($.password),enumerable:!1});return{lookup:Z,proxy:J}}class $K1 extends v26.Agent{constructor($,Z){super(Z);let Q=typeof $==="string"?new g26.URL($):$,{proxy:Y,lookup:X}=u26(Q);this.shouldLookup=X,this.proxy=Y,this.timeout=Z?.timeout??null,this.socketOptions=Z?.socketOptions??null}async connect($,Z){let{shouldLookup:Q,proxy:Y,timeout:X}=this;if(!Z.host)throw Error("No `host` defined!");let{host:J}=Z,{port:G,lookup:W=x26.lookup}=Z;if(Q)J=await new Promise((U,N)=>{W(J,{},(B,D)=>{if(B)N(B);else U(D)})});let K={proxy:Y,destination:{host:J,port:typeof G==="number"?G:parseInt(G,10)},command:"connect",timeout:X??void 0,socket_options:this.socketOptions??void 0},H=(U)=>{if($.destroy(),F.destroy(),U)U.destroy()};KC0("Creating socks proxy connection: %o",K);let{socket:F}=await _26.SocksClient.createConnection(K);if(KC0("Successfully created socks proxy connection"),X!==null)F.setTimeout(X),F.on("timeout",()=>H());if(Z.secureEndpoint){KC0("Upgrading socket connection to TLS");let U=y26.connect({...l26(h26(Z),"host","path","port"),socket:F});return U.once("error",(N)=>{KC0("Socket TLS error",N.message),H(U)}),U}return F}}$K1.protocols=["socks","socks4","socks4a","socks5","socks5h"];pK.SocksProxyAgent=$K1;function l26($,...Z){let Q={},Y;for(Y in $)if(!Z.includes(Y))Q[Y]=$[Y];return Q}});var Om$=y((KhZ,Lm$)=>{var ZK1=V0("https"),QK1=V0("http"),{URL:Nm$}=V0("url");class Bm$ extends QK1.Agent{constructor($){let{proxy:Z,proxyRequestOptions:Q,...Y}=$;super(Y);this.proxy=typeof Z==="string"?new Nm$(Z):Z,this.proxyRequestOptions=Q||{}}createConnection($,Z){let Q={...this.proxyRequestOptions,method:"CONNECT",host:this.proxy.hostname,port:this.proxy.port,path:`${$.host}:${$.port}`,setHost:!1,headers:{...this.proxyRequestOptions.headers,connection:this.keepAlive?"keep-alive":"close",host:`${$.host}:${$.port}`},agent:!1,timeout:$.timeout||0};if(this.proxy.username||this.proxy.password){let X=Buffer.from(`${decodeURIComponent(this.proxy.username||"")}:${decodeURIComponent(this.proxy.password||"")}`).toString("base64");Q.headers["proxy-authorization"]=`Basic ${X}`}if(this.proxy.protocol==="https:")Q.servername=this.proxy.hostname;let Y=(this.proxy.protocol==="http:"?QK1:ZK1).request(Q);Y.once("connect",(X,J,G)=>{if(Y.removeAllListeners(),J.removeAllListeners(),X.statusCode===200)Z(null,J);else J.destroy(),Z(Error(`Bad response: ${X.statusCode}`),null)}),Y.once("timeout",()=>{Y.destroy(Error("Proxy timeout"))}),Y.once("error",(X)=>{Y.removeAllListeners(),Z(X,null)}),Y.end()}}class Dm$ extends ZK1.Agent{constructor($){let{proxy:Z,proxyRequestOptions:Q,...Y}=$;super(Y);this.proxy=typeof Z==="string"?new Nm$(Z):Z,this.proxyRequestOptions=Q||{}}createConnection($,Z){let Q={...this.proxyRequestOptions,method:"CONNECT",host:this.proxy.hostname,port:this.proxy.port,path:`${$.host}:${$.port}`,setHost:!1,headers:{...this.proxyRequestOptions.headers,connection:this.keepAlive?"keep-alive":"close",host:`${$.host}:${$.port}`},agent:!1,timeout:$.timeout||0};if(this.proxy.username||this.proxy.password){let X=Buffer.from(`${decodeURIComponent(this.proxy.username||"")}:${decodeURIComponent(this.proxy.password||"")}`).toString("base64");Q.headers["proxy-authorization"]=`Basic ${X}`}if(this.proxy.protocol==="https:")Q.servername=this.proxy.hostname;let Y=(this.proxy.protocol==="http:"?QK1:ZK1).request(Q);Y.once("connect",(X,J,G)=>{if(Y.removeAllListeners(),J.removeAllListeners(),X.statusCode===200){let W=super.createConnection({...$,socket:J});Z(null,W)}else J.destroy(),Z(Error(`Bad response: ${X.statusCode}`),null)}),Y.once("timeout",()=>{Y.destroy(Error("Proxy timeout"))}),Y.once("error",(X)=>{Y.removeAllListeners(),Z(X,null)}),Y.end()}}Lm$.exports={HttpProxyAgent:Bm$,HttpsProxyAgent:Dm$}});var YK1,jm$,wm$;var Em$=L(()=>{YK1=_(Om$(),1),jm$=YK1.default.HttpProxyAgent,wm$=YK1.default.HttpsProxyAgent});import KO from"fs";import c26 from"https";import m26 from"http";import d26 from"net";import Kh from"path";import{Headers as i26}from"node-fetch";import HC0 from"child_process";function XK1($){try{return KO.accessSync($),!0}catch{return!1}}class FC0{addAuthenticator($){this.custom_authenticators.push($)}constructor(){this.authenticators=[new XW1,new KW1,new GW1,new WW1,new O50],this.custom_authenticators=[],this.contexts=[],this.clusters=[],this.users=[]}getContexts(){return this.contexts}getClusters(){return this.clusters}getUsers(){return this.users}getCurrentContext(){return this.currentContext}setCurrentContext($){this.currentContext=$}getContextObject($){if(!this.contexts)return null;return WK1(this.contexts,$,"context")}getCurrentCluster(){let $=this.getCurrentContextObject();if(!$)return null;return this.getCluster($.cluster)}getCluster($){return WK1(this.clusters,$,"cluster")}getCurrentUser(){let $=this.getCurrentContextObject();if(!$)return null;return this.getUser($.user)}getUser($){return WK1(this.users,$,"user")}loadFromFile($,Z){let Q=Kh.dirname($);this.loadFromString(KO.readFileSync($).toString("utf-8"),Z),this.makePathsAbsolute(Q)}async applyToFetchOptions($){await this.applyToHTTPSOptions($);let Z=new i26;for(let[Q,Y]of Object.entries($.headers||{}))if(Array.isArray(Y))Y.forEach((X)=>{Z.append(Q,X)});else if(typeof Y==="number"||typeof Y==="string")Z.set(Q,Y.toString());if($.auth)Z.set("Authorization","Basic "+Buffer.from($.auth).toString("base64"));return{agent:$.agent,headers:Z,method:$.method,timeout:$.timeout}}async applyToHTTPSOptions($){let Z=this.getCurrentUser(),Q=this.getCurrentCluster();if(await this.applyOptions($),Z&&Z.username)$.auth=`${Z.username}:${Z.password}`;let Y={};if(Y.ca=$.ca,Y.cert=$.cert,Y.key=$.key,Y.pfx=$.pfx,Y.passphrase=$.passphrase,$.rejectUnauthorized!==void 0)Y.rejectUnauthorized=$.rejectUnauthorized;Y.timeout=$.timeout,Y.servername=$.servername,Y.ciphers=$.ciphers,Y.honorCipherOrder=$.honorCipherOrder,Y.ecdhCurve=$.ecdhCurve,Y.clientCertEngine=$.clientCertEngine,Y.crl=$.crl,Y.dhparam=$.dhparam,Y.secureOptions=$.secureOptions,Y.secureProtocol=$.secureProtocol,Y.sessionIdContext=$.sessionIdContext,$.agent=this.createAgent(Q,Y)}async applySecurityAuthentication($){let Z=this.getCurrentCluster(),Q=this.getCurrentUser(),Y={},X={};if(await this.applyOptions(X),Z&&Z.skipTLSVerify)Y.rejectUnauthorized=!1;if(Z&&Z.tlsServerName)Y.servername=Z.tlsServerName;if(Q&&Q.username){let G=Buffer.from(`${Q.username}:${Q.password}`).toString("base64");$.setHeaderParam("Authorization",`Basic ${G}`)}let J=X.headers||{};if(Object.entries(J).forEach(([G,W])=>{$.setHeaderParam(G,`${W}`)}),Y.ca=X.ca,Y.cert=X.cert,Y.key=X.key,Y.pfx=X.pfx,Y.passphrase=X.passphrase,X.rejectUnauthorized!==void 0)Y.rejectUnauthorized=X.rejectUnauthorized;$.setAgent(this.createAgent(Z,Y))}getName(){return"kubeconfig authentication"}loadFromString($,Z){let Q=e31.load($);this.clusters=ph$(Q.clusters,Z),this.contexts=sh$(Q.contexts,Z),this.users=th$(Q.users,Z),this.currentContext=Q["current-context"]}loadFromOptions($){this.clusters=$.clusters,this.contexts=$.contexts,this.users=$.users,this.currentContext=$.currentContext}loadFromClusterAndUser($,Z){this.clusters=[$],this.users=[Z],this.currentContext="loaded-context",this.contexts=[{cluster:$.name,user:Z.name,name:this.currentContext}]}loadFromCluster($=""){let Z=process.env.KUBERNETES_SERVICE_HOST,Q=process.env.KUBERNETES_SERVICE_PORT,Y="inCluster",X="inClusterUser",J="inClusterContext",G="https";if(Q==="80"||Q==="8080"||Q==="8001")G="http";let W=Z;if(Z&&d26.isIPv6(Z))W=`[${Z}]`;this.clusters=[{name:"inCluster",caFile:`${$}${p26}`,server:`${G}://${W}:${Q}`,skipTLSVerify:!1}],this.users=[{name:"inClusterUser",authProvider:{name:"tokenFile",config:{tokenFile:`${$}${Pm$}`}}}];let K=`${$}${n26}`,H;if(XK1(K))H=KO.readFileSync(K).toString("utf-8");this.contexts=[{cluster:"inCluster",name:"inClusterContext",user:"inClusterUser",namespace:H}],this.currentContext="inClusterContext"}mergeConfig($,Z=!1){if(!Z&&$.currentContext)this.currentContext=$.currentContext;$.clusters.forEach((Q)=>{this.addCluster(Q)}),$.users.forEach((Q)=>{this.addUser(Q)}),$.contexts.forEach((Q)=>{this.addContext(Q)})}addCluster($){if(!this.clusters)this.clusters=[];this.clusters.forEach((Z,Q)=>{if(Z.name===$.name)throw Error(`Duplicate cluster: ${Z.name}`)}),this.clusters.push($)}addUser($){if(!this.users)this.users=[];this.users.forEach((Z,Q)=>{if(Z.name===$.name)throw Error(`Duplicate user: ${Z.name}`)}),this.users.push($)}addContext($){if(!this.contexts)this.contexts=[];this.contexts.forEach((Z,Q)=>{if(Z.name===$.name)throw Error(`Duplicate context: ${Z.name}`)}),this.contexts.push($)}loadFromDefault($,Z=!1,Q=process.platform){if(process.env.KUBECONFIG&&process.env.KUBECONFIG.length>0){let X=process.env.KUBECONFIG.split(Kh.delimiter).filter((J)=>J);this.loadFromFile(X[0],$);for(let J=1;J<X.length;J++){let G=new FC0;G.loadFromFile(X[J],$),this.mergeConfig(G,Z)}return}let Y=t26(Q);if(Y){let X=Kh.join(Y,".kube","config");if(XK1(X)){this.loadFromFile(X,$);return}}if(Q==="win32"){try{let X=HC0.spawnSync("wsl.exe",["bash","-c","printenv KUBECONFIG"]);if(X.status===0&&X.stdout.length>0){let J=HC0.spawnSync("wsl.exe",["cat",X.stdout.toString("utf8")]);if(J.status===0){this.loadFromString(J.stdout.toString("utf8"),$);return}}}catch{}try{let X=HC0.spawnSync("wsl.exe",["cat","~/.kube/config"]);if(X.status===0){this.loadFromString(X.stdout.toString("utf8"),$);let J=HC0.spawnSync("wsl.exe",["wslpath","-w","~/.kube"]);if(J.status===0)this.makePathsAbsolute(J.stdout.toString("utf8"));return}}catch{}}if(XK1(Pm$)){this.loadFromCluster();return}this.loadFromClusterAndUser({name:"cluster",server:"http://localhost:8080"},{name:"user"})}makeApiClient($){let Z=this.getCurrentCluster();if(!Z)throw Error("No active cluster!");let Q={default:this},Y=new vk0(Z.server,{}),X=LW1({baseServer:Y,authMethods:Q});return new $(X)}makePathsAbsolute($){this.clusters.forEach((Z)=>{if(Z.caFile)Z.caFile=JK1($,Z.caFile)}),this.users.forEach((Z)=>{if(Z.certFile)Z.certFile=JK1($,Z.certFile);if(Z.keyFile)Z.keyFile=JK1($,Z.keyFile)})}exportConfig(){let $={apiVersion:"v1",kind:"Config",clusters:this.clusters.map(nh$),users:this.users.map(oh$),contexts:this.contexts.map(rh$),preferences:{},"current-context":this.getCurrentContext()};return JSON.stringify($)}getCurrentContextObject(){return this.getContextObject(this.currentContext)}createAgent($,Z){var Q,Y;let X;if($&&$.proxyUrl)if($.proxyUrl.startsWith("socks"))X=new Am$.SocksProxyAgent($.proxyUrl,Z);else if($.server.startsWith("https")){let J=Z;J.proxy=$.proxyUrl,X=new wm$(J)}else if($.server.startsWith("http")){let J=Z;J.proxy=$.proxyUrl,X=new jm$(J)}else throw Error("Unsupported proxy type");else if(((Q=$===null||$===void 0?void 0:$.server)===null||Q===void 0?void 0:Q.startsWith("http:"))&&$.skipTLSVerify)X=new m26.Agent(Z);else if(((Y=$===null||$===void 0?void 0:$.server)===null||Y===void 0?void 0:Y.startsWith("http:"))&&!$.skipTLSVerify)throw Error("HTTP protocol is not allowed when skipTLSVerify is not set or false");else X=new c26.Agent(Z);return X}applyHTTPSOptions($){var Z;let Q=this.getCurrentCluster(),Y=this.getCurrentUser();if(!Y)return;if(Q!=null&&Q.skipTLSVerify)$.rejectUnauthorized=!1;if(Q!=null&&Q.tlsServerName)$.servername=Q.tlsServerName;let X=Q!=null?GK1(Q.caFile,Q.caData):null;if(X)$.ca=X;let J=GK1(Y.certFile,Y.certData);if(J)$.cert=J;let G=GK1(Y.keyFile,Y.keyData);if(G)$.key=G;if(Y.impersonateUser!=null)(Z=$.headers)!==null&&Z!==void 0||($.headers={}),$.headers["Impersonate-User"]=Y.impersonateUser}async applyAuthorizationHeader($){let Z=this.getCurrentUser();if(!Z)return;let Q=this.authenticators.find((Y)=>{return Y.isAuthProvider(Z)});if(!Q)Q=this.custom_authenticators.find((Y)=>{return Y.isAuthProvider(Z)});if(!$.headers)$.headers={};if(Q)await Q.applyAuthentication(Z,$);if(Z.token)$.headers.Authorization=`Bearer ${Z.token}`}async applyOptions($){this.applyHTTPSOptions($),await this.applyAuthorizationHeader($)}}function JK1($,Z){if(!$||Kh.isAbsolute(Z))return Z;return Kh.join($,Z)}function GK1($,Z){if($)return KO.readFileSync($);if(Z)return Buffer.from(Z,"base64");return null}function zm$($){return $.reduce((Z,Q)=>{if(Q&&!Z.includes(Q))return Z.concat(Q);else return Z},[])}function t26($=process.platform){if($!=="win32"){if(process.env.HOME)try{return KO.accessSync(process.env.HOME),process.env.HOME}catch{}return null}let Z=process.env.HOMEDRIVE&&process.env.HOMEPATH?Kh.join(process.env.HOMEDRIVE,process.env.HOMEPATH):"",Q=process.env.HOME||"",Y=process.env.USERPROFILE||"",X=zm$([Q,Z,Y]),J=zm$([Q,Y,Z]);for(let G of X)try{return KO.accessSync(Kh.join(G,".kube","config")),G}catch{}for(let G of J)try{return KO.accessSync(G,KO.constants.W_OK),G}catch{}for(let G of J)try{return KO.accessSync(G),G}catch{}return J[0]||null}function WK1($,Z,Q){if(!$)return null;for(let Y of $)if(Y.name===Z){if(Y[Q])return Y[Q].name=Z,Y[Q];return Y}return null}var Am$,KK1="/var/run/secrets/kubernetes.io/serviceaccount",p26,Pm$,n26;var Tm$=L(()=>{$W1();ih$();ah$();eh$();$u$();Zu$();hk0();Jc$();Em$();Am$=_(Um$(),1),p26=KK1+"/ca.crt",Pm$=KK1+"/token",n26=KK1+"/namespace"});import{STATUS_CODES as o26}from"http";import{createInterface as s26}from"readline";import r26 from"node-fetch";class HK1{constructor($){this.config=$}async watch($,Z,Q,Y){let X=this.config.getCurrentCluster();if(!X)throw Error("No currently active cluster");let J=new URL(X.server+$);J.searchParams.set("watch","true");for(let[U,N]of Object.entries(Z||{}))if(N!==void 0)J.searchParams.set(U,N.toString());let G=await this.config.applyToFetchOptions({}),W=new AbortController,K=AbortSignal.timeout(30000);G.signal=AbortSignal.any([W.signal,K]),G.signal=W.signal,G.method="GET";let H=!1,F=(U)=>{if(!H)H=!0,W.abort(),Y(U)};try{let U=await r26(J,G);if(G.agent&&typeof G.agent==="object")for(let N of Object.values(G.agent.sockets).flat())N===null||N===void 0||N.setKeepAlive(!0,30000);if(U.status===200){let N=U.body;N.on("error",F),N.on("close",()=>F(null)),N.on("finish",()=>F(null));let B=s26(N);B.on("error",F),B.on("close",()=>F(null)),B.on("finish",()=>F(null)),B.on("line",(D)=>{try{let O=JSON.parse(D.toString());Q(O.type,O.object,O)}catch{}})}else{let N=U.statusText||o26[U.status]||"Internal Server Error",B=Error(N);throw B.statusCode=U.status,B}}catch(U){F(U)}return W}}var FK1=L(()=>{HK1.SERVER_SIDE_CLOSE={error:"Connection closed on server"}});var UK1=L(()=>{NK1();FK1()});class iF{serialize(){let $={};for(let Z of iF.attributeTypeMap)if(this[Z.baseName]!==void 0)$[Z.name]=g1.serialize(this[Z.baseName],Z.type,Z.format);for(let[Z,Q]of Object.entries(this)){if(iF.attributeTypeMap.find((Y)=>Y.name===Z))continue;$[Z]=Q}return $}static fromUnknown($){if(!UC0($))throw Error(`Unable to deseriliaze non-Kubernetes object ${$}.`);let Z=new iF;for(let Q of iF.attributeTypeMap)if($[Q.baseName]!==void 0)Z[Q.name]=g1.deserialize($[Q.baseName],Q.type,Q.format);for(let[Q,Y]of Object.entries($)){if(iF.attributeTypeMap.find((X)=>X.name===Q))continue;Z[Q]=Y}return Z}}var UC0=($)=>!!$&&typeof $==="object"&&("apiVersion"in $)&&("kind"in $),qm$=({group:$,version:Z})=>[$,Z].join("/"),a26=($)=>{let[Z,Q]=$.apiVersion.split("/");return{kind:$.kind,group:Q?Z:"",version:Q?Q:Z}},Lz;var NC0=L(()=>{T$();iF.attributeTypeMap=[{name:"apiVersion",baseName:"apiVersion",type:"string",format:""},{name:"kind",baseName:"kind",type:"string",format:""},{name:"metadata",baseName:"metadata",type:"V1ObjectMeta",format:""}];Lz=class Lz extends g1{static registerModel($,Z){var Q,Y;let X=qm$($),J=(Q=(Y=this.modelRegistry)[X])!==null&&Q!==void 0?Q:Y[X]={};if(J[$.kind])throw Error(`Kind ${$.kind} of ${X} is already defined`);J[$.kind]=Z}static clearModelRegistry(){this.modelRegistry={}}static getSerializerForObject($){var Z;if(!UC0($))return;let Q=a26($);return(Z=Lz.modelRegistry[qm$(Q)])===null||Z===void 0?void 0:Z[Q.kind]}static serialize($,Z,Q=""){let Y=Lz.getSerializerForObject($);if(Y)return Y.serialize($,Z,Q);if($ instanceof iF)return $.serialize();let X=g1.serialize($,Z,Q);if(X!==$)return X;if(!UC0($))return X;let J={};for(let G of iF.attributeTypeMap)if($[G.baseName]!==void 0)J[G.name]=g1.serialize($[G.baseName],G.type,G.format);for(let[G,W]of Object.entries($)){if(iF.attributeTypeMap.find((K)=>K.name===G))continue;J[G]=W}return J}static deserialize($,Z,Q=""){let Y=Lz.getSerializerForObject($);if(Y)return Y.deserialize($,Z,Q);let X=g1.deserialize($,Z,Q);if(X!==$)return X;if(!UC0($))return X;return iF.fromUnknown($)}};Lz.modelRegistry={}});var NK1=L(()=>{UK1();NC0()});var BC0=L(()=>{hk0()});var BK1=()=>{};import Rm$ from"ws"with{type:"jsx"};class I9{static supportsClose($){return $==="v5.channel.k8s.io"}static closeStream($,Z){switch($){case I9.StdinStream:Z.stdin.pause();break;case I9.StdoutStream:Z.stdout.end();break;case I9.StderrStream:Z.stderr.end();break}}static handleStandardStreams($,Z,Q,Y){if(Z.length<1)return null;if(Q&&$===I9.StdoutStream)Q.write(Z);else if(Y&&$===I9.StderrStream)Y.write(Z);else if($===I9.StatusStream){if(Q&&Q!==process.stdout)Q.end();if(Y&&Y!==process.stderr)Y.end();return JSON.parse(Z.toString("utf8"))}else throw Error("Unknown stream: "+$);return null}static handleStandardInput($,Z,Q=0){return Z.on("data",(Y)=>{$.send(Vm$(Q,Y,Z.readableEncoding))}),Z.on("end",()=>{if(I9.supportsClose($.protocol)){let Y=Buffer.alloc(2);Y.writeUint8(this.CloseStream,0),Y.writeUint8(this.StdinStream,1),$.send(Y);return}$.close()}),!0}static async processData($,Z,Q,Y=0,X=3,J){let G=Vm$(Y,$,J),W=0;for(;W<X;++W)if(Z!==null&&Z.readyState===Rm$.OPEN){Z.send(G);break}else Z=await Q();if(W>=X)throw Error("can't send data to ws");return Z}static restartableHandleStandardInput($,Z,Q=0,Y=3,X=!1){if(Y<0)throw Error("retryCount can't be lower than 0.");let J=Promise.resolve(),G=null;if(Z.on("data",(W)=>{J=J.then(async()=>{G=await I9.processData(W,G,$,Q,Y,Z.readableEncoding)})}),X)Z.on("flush",async()=>{await J});return Z.on("end",()=>{if(G!==null)G.close()}),()=>G}constructor($,Z,Q={stdin:process.stdin,stdout:process.stdout,stderr:process.stderr}){this.config=$,this.socketFactory=Z,this.streams=Q}async connect($,Z,Q){let Y=this.config.getCurrentCluster();if(!Y)throw Error("No cluster is defined.");let X=Y.server,J=X.startsWith("https://"),G=J?X.substr(8):X.substr(7),K=`${J?"wss":"ws"}://${G}${$}`,H={};return await this.config.applyToHTTPSOptions(H),await new Promise((F,U)=>{let N=this.socketFactory?this.socketFactory(K,Mm$,H):new Rm$(K,Mm$,H),B=!1;N.onopen=()=>{B=!0,F(N)},N.onerror=(D)=>{if(!B)U(D)},N.onmessage=({data:D})=>{if(typeof D==="string"){if(D.charCodeAt(0)===I9.CloseStream)I9.closeStream(D.charCodeAt(1),this.streams);if(Z&&!Z(D))N.close()}else if(D instanceof Buffer){let O=D.readUint8(0);if(O===I9.CloseStream)I9.closeStream(D.readInt8(1),this.streams);if(Q&&!Q(O,D.slice(1)))N.close()}}})}}function Vm$($,Z,Q){let Y;if(Z instanceof Buffer)Y=Buffer.alloc(Z.length+1),Z.copy(Y,1);else{Q!==null&&Q!==void 0||(Q="utf-8");let X=Buffer.byteLength(Z,Q);Y=Buffer.alloc(X+1),Y.write(Z,1,X,Q)}return Y.writeInt8($,0),Y}var Mm$;var DC0=L(()=>{Mm$=["v5.channel.k8s.io","v4.channel.k8s.io","v3.channel.k8s.io","v2.channel.k8s.io","channel.k8s.io"];I9.StdinStream=0;I9.StdoutStream=1;I9.StderrStream=2;I9.StatusStream=3;I9.ResizeStream=4;I9.CloseStream=255});var Im$=L(()=>{BK1();DC0()});var DK1=L(()=>{BK1();DC0()});import ZA6 from"querystring";class LK1{constructor($,Z,Q){this.handler=Q||new I9($),this.disconnectOnErr=Z===void 0?!0:Z}async portForward($,Z,Q,Y,X,J,G=0){if(Q.length===0)throw Error("You must provide at least one port to forward to.");if(Q.length>1)throw Error("Only one port is currently supported for port-forward");let W={ports:Q[0]},K=ZA6.stringify(W),H=[];Q.forEach((N,B)=>{H[B*2]=!0,H[B*2+1]=!0});let F=`/api/v1/namespaces/${$}/pods/${Z}/portforward?${K}`,U=()=>{return this.handler.connect(F,null,(N,B)=>{if(N>=Q.length*2)return!this.disconnectOnErr;if(H[N])B=B.slice(2),H[N]=!1;if(N%2===1){if(X)X.write(B)}else Y.write(B);return!0})};if(G<1){let N=await U();return I9.handleStandardInput(N,J,0),N}return I9.restartableHandleStandardInput(U,J,0,G)}}var km$=L(()=>{DC0()});var Cm$=()=>{};var Sm$=L(()=>{$W1();NC0()});var _m$=L(()=>{BC0()});var vm$=()=>{};var LC0=y((quZ,bm$)=>{bm$.exports={DEFAULT_INITIAL_SIZE:8192,DEFAULT_INCREMENT_AMOUNT:8192,DEFAULT_FREQUENCY:1,DEFAULT_CHUNK_SIZE:1024}});var ym$=y((RuZ,fm$)=>{var xm$=V0("stream"),OC0=LC0(),XA6=V0("util"),JA6=fm$.exports=function($){var Z=this;$=$||{},xm$.Readable.call(this,$),this.stopped=!1;var Q=$.hasOwnProperty("frequency")?$.frequency:OC0.DEFAULT_FREQUENCY,Y=$.chunkSize||OC0.DEFAULT_CHUNK_SIZE,X=$.initialSize||OC0.DEFAULT_INITIAL_SIZE,J=$.incrementAmount||OC0.DEFAULT_INCREMENT_AMOUNT,G=0,W=new Buffer(X),K=!1,H=function(){var N=Math.min(Y,G),B=!1;if(N>0){var D=null;D=new Buffer(N),W.copy(D,0,0,N),B=Z.push(D)!==!1,K=B,W.copy(W,0,N,G),G-=N}if(G===0&&Z.stopped)Z.push(null);if(B)H.timeout=setTimeout(H,Q);else H.timeout=null};this.stop=function(){if(this.stopped)throw Error("stop() called on already stopped ReadableStreamBuffer");if(this.stopped=!0,G===0)this.push(null)},this.size=function(){return G},this.maxSize=function(){return W.length};var F=function(N){if(W.length-G<N){var B=Math.ceil((N-(W.length-G))/J),D=new Buffer(W.length+J*B);W.copy(D,0,0,G),W=D}},U=function(){if(!H.timeout&&K)H.timeout=setTimeout(H,Q)};this.put=function(N,B){if(Z.stopped)throw Error("Tried to write data to a stopped ReadableStreamBuffer");if(Buffer.isBuffer(N))F(N.length),N.copy(W,G,0),G+=N.length;else{N=N+"";var D=Buffer.byteLength(N);F(D),W.write(N,G,B||"utf8"),G+=D}U()},this._read=function(){K=!0,U()}};XA6.inherits(JA6,xm$.Readable)});var lm$=y((MuZ,um$)=>{var GA6=V0("util"),hm$=V0("stream"),gm$=LC0(),WA6=um$.exports=function($){$=$||{},$.decodeStrings=!0,hm$.Writable.call(this,$);var Z=$.initialSize||gm$.DEFAULT_INITIAL_SIZE,Q=$.incrementAmount||gm$.DEFAULT_INCREMENT_AMOUNT,Y=new Buffer(Z),X=0;this.size=function(){return X},this.maxSize=function(){return Y.length},this.getContents=function(G){if(!X)return!1;var W=new Buffer(Math.min(G||X,X));if(Y.copy(W,0,0,W.length),W.length<X)Y.copy(Y,0,W.length);return X-=W.length,W},this.getContentsAsString=function(G,W){if(!X)return!1;var K=Y.toString(G||"utf8",0,Math.min(W||X,X)),H=Buffer.byteLength(K);if(H<X)Y.copy(Y,0,H);return X-=H,K};var J=function(G){if(Y.length-X<G){var W=Math.ceil((G-(Y.length-X))/Q),K=new Buffer(Y.length+Q*W);Y.copy(K,0,0,X),Y=K}};this._write=function(G,W,K){J(G.length),G.copy(Y,X,0),X+=G.length,K()}};GA6.inherits(WA6,hm$.Writable)});var cm$=y((VuZ,jC0)=>{jC0.exports=LC0();jC0.exports.ReadableStreamBuffer=ym$();jC0.exports.WritableStreamBuffer=lm$()});var dm$=y((IuZ,mm$)=>{mm$.exports=class{constructor(Z){if(!(Z>0)||(Z-1&Z)!==0)throw Error("Max size for a FixedFIFO should be a power of two");this.buffer=Array(Z),this.mask=Z-1,this.top=0,this.btm=0,this.next=null}clear(){this.top=this.btm=0,this.next=null,this.buffer.fill(void 0)}push(Z){if(this.buffer[this.top]!==void 0)return!1;return this.buffer[this.top]=Z,this.top=this.top+1&this.mask,!0}shift(){let Z=this.buffer[this.btm];if(Z===void 0)return;return this.buffer[this.btm]=void 0,this.btm=this.btm+1&this.mask,Z}peek(){return this.buffer[this.btm]}isEmpty(){return this.buffer[this.btm]===void 0}}});var OK1=y((kuZ,pm$)=>{var im$=dm$();pm$.exports=class{constructor(Z){this.hwm=Z||16,this.head=new im$(this.hwm),this.tail=this.head,this.length=0}clear(){this.head=this.tail,this.head.clear(),this.length=0}push(Z){if(this.length++,!this.head.push(Z)){let Q=this.head;this.head=Q.next=new im$(2*this.head.buffer.length),this.head.push(Z)}}shift(){if(this.length!==0)this.length--;let Z=this.tail.shift();if(Z===void 0&&this.tail.next){let Q=this.tail.next;return this.tail.next=null,this.tail=Q,this.tail.shift()}return Z}peek(){let Z=this.tail.peek();if(Z===void 0&&this.tail.next)return this.tail.next.peek();return Z}isEmpty(){return this.length===0}}});var jn=y((CuZ,nm$)=>{function KA6($){return Buffer.isBuffer($)||$ instanceof Uint8Array}function HA6($){return Buffer.isEncoding($)}function FA6($,Z,Q){return Buffer.alloc($,Z,Q)}function UA6($){return Buffer.allocUnsafe($)}function NA6($){return Buffer.allocUnsafeSlow($)}function BA6($,Z){return Buffer.byteLength($,Z)}function DA6($,Z){return Buffer.compare($,Z)}function LA6($,Z){return Buffer.concat($,Z)}function OA6($,Z,Q,Y,X){return g5($).copy(Z,Q,Y,X)}function jA6($,Z){return g5($).equals(Z)}function wA6($,Z,Q,Y,X){return g5($).fill(Z,Q,Y,X)}function EA6($,Z,Q){return Buffer.from($,Z,Q)}function PA6($,Z,Q,Y){return g5($).includes(Z,Q,Y)}function zA6($,Z,Q,Y){return g5($).indexOf(Z,Q,Y)}function AA6($,Z,Q,Y){return g5($).lastIndexOf(Z,Q,Y)}function TA6($){return g5($).swap16()}function qA6($){return g5($).swap32()}function RA6($){return g5($).swap64()}function g5($){if(Buffer.isBuffer($))return $;return Buffer.from($.buffer,$.byteOffset,$.byteLength)}function MA6($,Z,Q,Y){return g5($).toString(Z,Q,Y)}function VA6($,Z,Q,Y,X){return g5($).write(Z,Q,Y,X)}function IA6($,Z){return g5($).readDoubleBE(Z)}function kA6($,Z){return g5($).readDoubleLE(Z)}function CA6($,Z){return g5($).readFloatBE(Z)}function SA6($,Z){return g5($).readFloatLE(Z)}function _A6($,Z){return g5($).readInt32BE(Z)}function vA6($,Z){return g5($).readInt32LE(Z)}function bA6($,Z){return g5($).readUInt32BE(Z)}function xA6($,Z){return g5($).readUInt32LE(Z)}function fA6($,Z,Q){return g5($).writeDoubleBE(Z,Q)}function yA6($,Z,Q){return g5($).writeDoubleLE(Z,Q)}function gA6($,Z,Q){return g5($).writeFloatBE(Z,Q)}function hA6($,Z,Q){return g5($).writeFloatLE(Z,Q)}function uA6($,Z,Q){return g5($).writeInt32BE(Z,Q)}function lA6($,Z,Q){return g5($).writeInt32LE(Z,Q)}function cA6($,Z,Q){return g5($).writeUInt32BE(Z,Q)}function mA6($,Z,Q){return g5($).writeUInt32LE(Z,Q)}nm$.exports={isBuffer:KA6,isEncoding:HA6,alloc:FA6,allocUnsafe:UA6,allocUnsafeSlow:NA6,byteLength:BA6,compare:DA6,concat:LA6,copy:OA6,equals:jA6,fill:wA6,from:EA6,includes:PA6,indexOf:zA6,lastIndexOf:AA6,swap16:TA6,swap32:qA6,swap64:RA6,toBuffer:g5,toString:MA6,write:VA6,readDoubleBE:IA6,readDoubleLE:kA6,readFloatBE:CA6,readFloatLE:SA6,readInt32BE:_A6,readInt32LE:vA6,readUInt32BE:bA6,readUInt32LE:xA6,writeDoubleBE:fA6,writeDoubleLE:yA6,writeFloatBE:gA6,writeFloatLE:hA6,writeInt32BE:uA6,writeInt32LE:lA6,writeUInt32BE:cA6,writeUInt32LE:mA6}});var om$=y((SuZ,tm$)=>{var dA6=jn();tm$.exports=class{constructor(Z){this.encoding=Z}get remaining(){return 0}decode(Z){return dA6.toString(Z,this.encoding)}flush(){return""}}});var em$=y((_uZ,am$)=>{var sm$=jn();am$.exports=class{constructor(){this._reset()}get remaining(){return this.bytesSeen}decode(Z){if(Z.byteLength===0)return"";if(this.bytesNeeded===0&&rm$(Z,0)===0)return this.bytesSeen=iA6(Z),sm$.toString(Z,"utf8");let Q="",Y=0;if(this.bytesNeeded>0){while(Y<Z.byteLength){let G=Z[Y];if(G<this.lowerBoundary||G>this.upperBoundary){Q+="\uFFFD",this._reset();break}if(this.lowerBoundary=128,this.upperBoundary=191,this.codePoint=this.codePoint<<6|G&63,this.bytesSeen++,Y++,this.bytesSeen===this.bytesNeeded){Q+=String.fromCodePoint(this.codePoint),this._reset();break}}if(this.bytesNeeded>0)return Q}let X=rm$(Z,Y),J=Z.byteLength-X;if(J>Y)Q+=sm$.toString(Z,"utf8",Y,J);for(let G=J;G<Z.byteLength;G++){let W=Z[G];if(this.bytesNeeded===0){if(W<=127)this.bytesSeen=0,Q+=String.fromCharCode(W);else if(W>=194&&W<=223)this.bytesNeeded=2,this.bytesSeen=1,this.codePoint=W&31;else if(W>=224&&W<=239){if(W===224)this.lowerBoundary=160;else if(W===237)this.upperBoundary=159;this.bytesNeeded=3,this.bytesSeen=1,this.codePoint=W&15}else if(W>=240&&W<=244){if(W===240)this.lowerBoundary=144;else if(W===244)this.upperBoundary=143;this.bytesNeeded=4,this.bytesSeen=1,this.codePoint=W&7}else this.bytesSeen=1,Q+="\uFFFD";continue}if(W<this.lowerBoundary||W>this.upperBoundary){Q+="\uFFFD",G--,this._reset();continue}if(this.lowerBoundary=128,this.upperBoundary=191,this.codePoint=this.codePoint<<6|W&63,this.bytesSeen++,this.bytesSeen===this.bytesNeeded)Q+=String.fromCodePoint(this.codePoint),this._reset()}return Q}flush(){let Z=this.bytesNeeded>0?"\uFFFD":"";return this._reset(),Z}_reset(){this.codePoint=0,this.bytesNeeded=0,this.bytesSeen=0,this.lowerBoundary=128,this.upperBoundary=191}};function rm$($,Z){let Q=$.byteLength;if(Q<=Z)return 0;let Y=Math.max(Z,Q-4),X=Q-1;while(X>Y&&($[X]&192)===128)X--;if(X<Z)return 0;let J=$[X],G;if(J<=127)return 0;if(J>=194&&J<=223)G=2;else if(J>=224&&J<=239)G=3;else if(J>=240&&J<=244)G=4;else return 0;let W=Q-X;return W<G?W:0}function iA6($){let Z=$.byteLength;if(Z===0)return 0;let Q=$[Z-1];if(Q<=127)return 0;if((Q&192)!==128)return 1;let Y=Math.max(0,Z-4),X=Z-2;while(X>=Y&&($[X]&192)===128)X--;if(X<0)return 1;let J=$[X],G;if(J>=194&&J<=223)G=2;else if(J>=224&&J<=239)G=3;else if(J>=240&&J<=244)G=4;else return 1;if(Z-X!==G)return 1;if(G>=3){let W=$[X+1];if(J===224&&W<160)return 1;if(J===237&&W>159)return 1;if(J===240&&W<144)return 1;if(J===244&&W>143)return 1}return 0}});var Zd$=y((vuZ,$d$)=>{var pA6=om$(),nA6=em$();$d$.exports=class{constructor(Z="utf8"){switch(this.encoding=tA6(Z),this.encoding){case"utf8":this.decoder=new nA6;break;case"utf16le":case"base64":throw Error("Unsupported encoding: "+this.encoding);default:this.decoder=new pA6(this.encoding)}}get remaining(){return this.decoder.remaining}push(Z){if(typeof Z==="string")return Z;return this.decoder.decode(Z)}write(Z){return this.push(Z)}end(Z){let Q="";if(Z)Q=this.push(Z);return Q+=this.decoder.flush(),Q}};function tA6($){switch($=$.toLowerCase(),$){case"utf8":case"utf-8":return"utf8";case"ucs2":case"ucs-2":case"utf16le":case"utf-16le":return"utf16le";case"latin1":case"binary":return"latin1";case"base64":case"ascii":case"hex":return $;default:throw Error("Unknown encoding: "+$)}}});var AK1=y((buZ,Bd$)=>{var{EventEmitter:oA6}=V0("events"),EC0=Error("Stream was destroyed"),jK1=Error("Premature close"),Yd$=OK1(),sA6=Zd$(),wK1=typeof queueMicrotask>"u"?($)=>global.process.nextTick($):queueMicrotask,wC0=Symbol.asyncIterator||Symbol("asyncIterator");class EK1{constructor($,{highWaterMark:Z=16384,map:Q=null,mapWritable:Y,byteLength:X,byteLengthWritable:J}={}){this.stream=$,this.queue=new Yd$,this.highWaterMark=Z,this.buffered=0,this.error=null,this.pipeline=null,this.drains=null,this.byteLength=J||X||Nd$,this.map=Y||Q,this.afterWrite=eA6.bind(this),this.afterUpdateNextTick=QT6.bind(this)}get ending(){return(this.stream._duplexState&134217728)!==0}get ended(){return(this.stream._duplexState&8388608)!==0}push($){if((this.stream._duplexState&142606350)!==0)return!1;if(this.map!==null)$=this.map($);if(this.buffered+=this.byteLength($),this.queue.push($),this.buffered<this.highWaterMark)return this.stream._duplexState|=2097152,!0;return this.stream._duplexState|=6291456,!1}shift(){let $=this.queue.shift();if(this.buffered-=this.byteLength($),this.buffered===0)this.stream._duplexState&=534773759;return $}end($){if(typeof $==="function")this.stream.once("finish",$);else if($!==void 0&&$!==null)this.push($);this.stream._duplexState=(this.stream._duplexState|134217728)&535822335}autoBatch($,Z){let Q=[],Y=this.stream;Q.push($);while((Y._duplexState&270794767)===2359296)Q.push(Y._writableState.shift());if((Y._duplexState&15)!==0)return Z(null);Y._writev(Q,Z)}update(){let $=this.stream;$._duplexState|=524288;do{while(($._duplexState&270794767)===2097152){let Z=this.shift();$._duplexState|=67371008,$._write(Z,this.afterWrite)}if(($._duplexState&1310720)===0)this.updateNonPrimary()}while(this.continueUpdate()===!0);$._duplexState&=536346623}updateNonPrimary(){let $=this.stream;if(($._duplexState&144965647)===134217728){$._duplexState=$._duplexState|262144,$._final(aA6.bind(this));return}if(($._duplexState&14)===4){if(($._duplexState&33587200)===0)$._duplexState|=262160,$._destroy(Wd$.bind(this));return}if(($._duplexState&33587215)===1)$._duplexState=($._duplexState|262160)&536870910,$._open(Kd$.bind(this))}continueUpdate(){if((this.stream._duplexState&33554432)===0)return!1;return this.stream._duplexState&=503316479,!0}updateCallback(){if((this.stream._duplexState&35127311)===1048576)this.update();else this.updateNextTick()}updateNextTick(){if((this.stream._duplexState&33554432)!==0)return;if(this.stream._duplexState|=33554432,(this.stream._duplexState&524288)===0)wK1(this.afterUpdateNextTick)}}class Xd${constructor($,{highWaterMark:Z=16384,map:Q=null,mapReadable:Y,byteLength:X,byteLengthReadable:J}={}){this.stream=$,this.queue=new Yd$,this.highWaterMark=Z===0?1:Z,this.buffered=0,this.readAhead=Z>0,this.error=null,this.pipeline=null,this.byteLength=J||X||Nd$,this.map=Y||Q,this.pipeTo=null,this.afterRead=$T6.bind(this),this.afterUpdateNextTick=ZT6.bind(this)}get ending(){return(this.stream._duplexState&1024)!==0}get ended(){return(this.stream._duplexState&16384)!==0}pipe($,Z){if(this.pipeTo!==null)throw Error("Can only pipe to one destination");if(typeof Z!=="function")Z=null;if(this.stream._duplexState|=512,this.pipeTo=$,this.pipeline=new Gd$(this.stream,$,Z),Z)this.stream.on("error",Qd$);if(E50($)){if($._writableState.pipeline=this.pipeline,Z)$.on("error",Qd$);$.on("finish",this.pipeline.finished.bind(this.pipeline))}else{let Q=this.pipeline.done.bind(this.pipeline,$),Y=this.pipeline.done.bind(this.pipeline,$,null);$.on("error",Q),$.on("close",Y),$.on("finish",this.pipeline.finished.bind(this.pipeline))}$.on("drain",rA6.bind(this)),this.stream.emit("piping",$),$.emit("pipe",this.stream)}push($){let Z=this.stream;if($===null)return this.highWaterMark=0,Z._duplexState=(Z._duplexState|1024)&536805311,!1;if(this.map!==null){if($=this.map($),$===null)return Z._duplexState&=536805375,this.buffered<this.highWaterMark}return this.buffered+=this.byteLength($),this.queue.push($),Z._duplexState=(Z._duplexState|128)&536805375,this.buffered<this.highWaterMark}shift(){let $=this.queue.shift();if(this.buffered-=this.byteLength($),this.buffered===0)this.stream._duplexState&=536862591;return $}unshift($){let Z=[this.map!==null?this.map($):$];while(this.buffered>0)Z.push(this.shift());for(let Q=0;Q<Z.length-1;Q++){let Y=Z[Q];this.buffered+=this.byteLength(Y),this.queue.push(Y)}this.push(Z[Z.length-1])}read(){let $=this.stream;if(($._duplexState&16527)===128){let Z=this.shift();if(this.pipeTo!==null&&this.pipeTo.write(Z)===!1)$._duplexState&=536870143;if(($._duplexState&2048)!==0)$.emit("data",Z);return Z}if(this.readAhead===!1)$._duplexState|=131072,this.updateNextTick();return null}drain(){let $=this.stream;while(($._duplexState&16527)===128&&($._duplexState&768)!==0){let Z=this.shift();if(this.pipeTo!==null&&this.pipeTo.write(Z)===!1)$._duplexState&=536870143;if(($._duplexState&2048)!==0)$.emit("data",Z)}}update(){let $=this.stream;$._duplexState|=32;do{this.drain();while(this.buffered<this.highWaterMark&&($._duplexState&214047)===131072)$._duplexState|=65552,$._read(this.afterRead),this.drain();if(($._duplexState&12431)===4224)$._duplexState|=8192,$.emit("readable");if(($._duplexState&80)===0)this.updateNonPrimary()}while(this.continueUpdate()===!0);$._duplexState&=536870879}updateNonPrimary(){let $=this.stream;if(($._duplexState&1167)===1024){if($._duplexState=($._duplexState|16384)&536869887,$.emit("end"),($._duplexState&8405006)===8404992)$._duplexState|=4;if(this.pipeTo!==null)this.pipeTo.end()}if(($._duplexState&14)===4){if(($._duplexState&33587200)===0)$._duplexState|=262160,$._destroy(Wd$.bind(this));return}if(($._duplexState&33587215)===1)$._duplexState=($._duplexState|262160)&536870910,$._open(Kd$.bind(this))}continueUpdate(){if((this.stream._duplexState&32768)===0)return!1;return this.stream._duplexState&=536838143,!0}updateCallback(){if((this.stream._duplexState&32879)===64)this.update();else this.updateNextTick()}updateNextTickIfOpen(){if((this.stream._duplexState&32769)!==0)return;if(this.stream._duplexState|=32768,(this.stream._duplexState&32)===0)wK1(this.afterUpdateNextTick)}updateNextTick(){if((this.stream._duplexState&32768)!==0)return;if(this.stream._duplexState|=32768,(this.stream._duplexState&32)===0)wK1(this.afterUpdateNextTick)}}class Jd${constructor($){this.data=null,this.afterTransform=XT6.bind($),this.afterFinal=null}}class Gd${constructor($,Z,Q){this.from=$,this.to=Z,this.afterPipe=Q,this.error=null,this.pipeToFinished=!1}finished(){this.pipeToFinished=!0}done($,Z){if(Z)this.error=Z;if($===this.to){if(this.to=null,this.from!==null){if((this.from._duplexState&16384)===0||!this.pipeToFinished)this.from.destroy(this.error||Error("Writable stream closed prematurely"));return}}if($===this.from){if(this.from=null,this.to!==null){if(($._duplexState&16384)===0)this.to.destroy(this.error||Error("Readable stream closed before ending"));return}}if(this.afterPipe!==null)this.afterPipe(this.error);this.to=this.from=this.afterPipe=null}}function rA6(){this.stream._duplexState|=512,this.updateCallback()}function aA6($){let Z=this.stream;if($)Z.destroy($);if((Z._duplexState&14)===0)Z._duplexState|=8388608,Z.emit("finish");if((Z._duplexState&8405006)===8404992)Z._duplexState|=4;if(Z._duplexState&=402391039,(Z._duplexState&524288)===0)this.update();else this.updateNextTick()}function Wd$($){let Z=this.stream;if(!$&&this.error!==EC0)$=this.error;if($)Z.emit("error",$);Z._duplexState|=8,Z.emit("close");let{_readableState:Q,_writableState:Y}=Z;if(Q!==null&&Q.pipeline!==null)Q.pipeline.done(Z,$);if(Y!==null){while(Y.drains!==null&&Y.drains.length>0)Y.drains.shift().resolve(!1);if(Y.pipeline!==null)Y.pipeline.done(Z,$)}}function eA6($){let Z=this.stream;if($)Z.destroy($);if(Z._duplexState&=469499903,this.drains!==null)YT6(this.drains);if((Z._duplexState&6553615)===4194304){if(Z._duplexState&=532676607,(Z._duplexState&16777216)===16777216)Z.emit("drain")}this.updateCallback()}function $T6($){if($)this.stream.destroy($);if(this.stream._duplexState&=536870895,this.readAhead===!1&&(this.stream._duplexState&256)===0)this.stream._duplexState&=536739839;this.updateCallback()}function ZT6(){if((this.stream._duplexState&32)===0)this.stream._duplexState&=536838143,this.update()}function QT6(){if((this.stream._duplexState&524288)===0)this.stream._duplexState&=503316479,this.update()}function YT6($){for(let Z=0;Z<$.length;Z++)if(--$[Z].writes===0)$.shift().resolve(!0),Z--}function Kd$($){let Z=this.stream;if($)Z.destroy($);if((Z._duplexState&4)===0){if((Z._duplexState&17423)===0)Z._duplexState|=64;if((Z._duplexState&142606351)===0)Z._duplexState|=1048576;Z.emit("open")}if(Z._duplexState&=536608751,Z._writableState!==null)Z._writableState.updateCallback();if(Z._readableState!==null)Z._readableState.updateCallback()}function XT6($,Z){if(Z!==void 0&&Z!==null)this.push(Z);this._writableState.afterWrite($)}function JT6($){if(this._readableState!==null){if($==="data")this._duplexState|=133376,this._readableState.updateNextTick();if($==="readable")this._duplexState|=4096,this._readableState.updateNextTick()}if(this._writableState!==null){if($==="drain")this._duplexState|=16777216,this._writableState.updateNextTick()}}class PC0 extends oA6{constructor($){super();if(this._duplexState=0,this._readableState=null,this._writableState=null,$){if($.open)this._open=$.open;if($.destroy)this._destroy=$.destroy;if($.predestroy)this._predestroy=$.predestroy;if($.signal)$.signal.addEventListener("abort",jT6.bind(this))}this.on("newListener",JT6)}_open($){$(null)}_destroy($){$(null)}_predestroy(){}get readable(){return this._readableState!==null?!0:void 0}get writable(){return this._writableState!==null?!0:void 0}get destroyed(){return(this._duplexState&8)!==0}get destroying(){return(this._duplexState&14)!==0}destroy($){if((this._duplexState&14)===0){if(!$)$=EC0;if(this._duplexState=(this._duplexState|4)&535822271,this._readableState!==null)this._readableState.highWaterMark=0,this._readableState.error=$;if(this._writableState!==null)this._writableState.highWaterMark=0,this._writableState.error=$;if(this._duplexState|=2,this._predestroy(),this._duplexState&=536870909,this._readableState!==null)this._readableState.updateNextTick();if(this._writableState!==null)this._writableState.updateNextTick()}}}class w50 extends PC0{constructor($){super($);if(this._duplexState|=8519681,this._readableState=new Xd$(this,$),$){if(this._readableState.readAhead===!1)this._duplexState&=536739839;if($.read)this._read=$.read;if($.eagerOpen)this._readableState.updateNextTick();if($.encoding)this.setEncoding($.encoding)}}setEncoding($){let Z=new sA6($),Q=this._readableState.map||KT6;return this._readableState.map=Y,this;function Y(X){let J=Z.push(X);return J===""&&(X.byteLength!==0||Z.remaining>0)?null:Q(J)}}_read($){$(null)}pipe($,Z){return this._readableState.updateNextTick(),this._readableState.pipe($,Z),$}read(){return this._readableState.updateNextTick(),this._readableState.read()}push($){return this._readableState.updateNextTickIfOpen(),this._readableState.push($)}unshift($){return this._readableState.updateNextTickIfOpen(),this._readableState.unshift($)}resume(){return this._duplexState|=131328,this._readableState.updateNextTick(),this}pause(){return this._duplexState&=this._readableState.readAhead===!1?536739583:536870655,this}static _fromAsyncIterator($,Z){let Q,Y=new w50({...Z,read(J){$.next().then(X).then(J.bind(null,null)).catch(J)},predestroy(){Q=$.return()},destroy(J){if(!Q)return J(null);Q.then(J.bind(null,null)).catch(J)}});return Y;function X(J){if(J.done)Y.push(null);else Y.push(J.value)}}static from($,Z){if(DT6($))return $;if($[wC0])return this._fromAsyncIterator($[wC0](),Z);if(!Array.isArray($))$=$===void 0?[]:[$];let Q=0;return new w50({...Z,read(Y){this.push(Q===$.length?null:$[Q++]),Y(null)}})}static isBackpressured($){return($._duplexState&17422)!==0||$._readableState.buffered>=$._readableState.highWaterMark}static isPaused($){return($._duplexState&256)===0}[wC0](){let $=this,Z=null,Q=null,Y=null;return this.on("error",(K)=>{Z=K}),this.on("readable",X),this.on("close",J),{[wC0](){return this},next(){return new Promise(function(K,H){Q=K,Y=H;let F=$.read();if(F!==null)G(F);else if(($._duplexState&8)!==0)G(null)})},return(){return W(null)},throw(K){return W(K)}};function X(){if(Q!==null)G($.read())}function J(){if(Q!==null)G(null)}function G(K){if(Y===null)return;if(Z)Y(Z);else if(K===null&&($._duplexState&16384)===0)Y(EC0);else Q({value:K,done:K===null});Y=Q=null}function W(K){return $.destroy(K),new Promise((H,F)=>{if($._duplexState&8)return H({value:void 0,done:!0});$.once("close",function(){if(K)F(K);else H({value:void 0,done:!0})})})}}}class PK1 extends PC0{constructor($){super($);if(this._duplexState|=16385,this._writableState=new EK1(this,$),$){if($.writev)this._writev=$.writev;if($.write)this._write=$.write;if($.final)this._final=$.final;if($.eagerOpen)this._writableState.updateNextTick()}}cork(){this._duplexState|=268435456}uncork(){this._duplexState&=268435455,this._writableState.updateNextTick()}_writev($,Z){Z(null)}_write($,Z){this._writableState.autoBatch($,Z)}_final($){$(null)}static isBackpressured($){return($._duplexState&146800654)!==0}static drained($){if($.destroyed)return Promise.resolve(!1);let Z=$._writableState,Y=(wT6($)?Math.min(1,Z.queue.length):Z.queue.length)+($._duplexState&67108864?1:0);if(Y===0)return Promise.resolve(!0);if(Z.drains===null)Z.drains=[];return new Promise((X)=>{Z.drains.push({writes:Y,resolve:X})})}write($){return this._writableState.updateNextTick(),this._writableState.push($)}end($){return this._writableState.updateNextTick(),this._writableState.end($),this}}class zC0 extends w50{constructor($){super($);if(this._duplexState=1|this._duplexState&131072,this._writableState=new EK1(this,$),$){if($.writev)this._writev=$.writev;if($.write)this._write=$.write;if($.final)this._final=$.final}}cork(){this._duplexState|=268435456}uncork(){this._duplexState&=268435455,this._writableState.updateNextTick()}_writev($,Z){Z(null)}_write($,Z){this._writableState.autoBatch($,Z)}_final($){$(null)}write($){return this._writableState.updateNextTick(),this._writableState.push($)}end($){return this._writableState.updateNextTick(),this._writableState.end($),this}}class zK1 extends zC0{constructor($){super($);if(this._transformState=new Jd$(this),$){if($.transform)this._transform=$.transform;if($.flush)this._flush=$.flush}}_write($,Z){if(this._readableState.buffered>=this._readableState.highWaterMark)this._transformState.data=$;else this._transform($,this._transformState.afterTransform)}_read($){if(this._transformState.data!==null){let Z=this._transformState.data;this._transformState.data=null,$(null),this._transform(Z,this._transformState.afterTransform)}else $(null)}destroy($){if(super.destroy($),this._transformState.data!==null)this._transformState.data=null,this._transformState.afterTransform()}_transform($,Z){Z(null,$)}_flush($){$(null)}_final($){this._transformState.afterFinal=$,this._flush(GT6.bind(this))}}class Hd$ extends zK1{}function GT6($,Z){let Q=this._transformState.afterFinal;if($)return Q($);if(Z!==null&&Z!==void 0)this.push(Z);this.push(null),Q(null)}function WT6(...$){return new Promise((Z,Q)=>{return Fd$(...$,(Y)=>{if(Y)return Q(Y);Z()})})}function Fd$($,...Z){let Q=Array.isArray($)?[...$,...Z]:[$,...Z],Y=Q.length&&typeof Q[Q.length-1]==="function"?Q.pop():null;if(Q.length<2)throw Error("Pipeline requires at least 2 streams");let X=Q[0],J=null,G=null;for(let H=1;H<Q.length;H++){if(J=Q[H],E50(X))X.pipe(J,K);else W(X,!0,H>1,K),X.pipe(J);X=J}if(Y){let H=!1,F=E50(J)||!!(J._writableState&&J._writableState.autoDestroy);if(J.on("error",(U)=>{if(G===null)G=U}),J.on("finish",()=>{if(H=!0,!F)Y(G)}),F)J.on("close",()=>Y(G||(H?null:jK1)))}return J;function W(H,F,U,N){H.on("error",N),H.on("close",B);function B(){if(F&&H._readableState&&!H._readableState.ended)return N(jK1);if(U&&H._writableState&&!H._writableState.ended)return N(jK1)}}function K(H){if(!H||G)return;G=H;for(let F of Q)F.destroy(H)}}function KT6($){return $}function Ud$($){return!!$._readableState||!!$._writableState}function E50($){return typeof $._duplexState==="number"&&Ud$($)}function HT6($){return!!$._readableState&&$._readableState.ending}function FT6($){return!!$._readableState&&$._readableState.ended}function UT6($){return!!$._writableState&&$._writableState.ending}function NT6($){return!!$._writableState&&$._writableState.ended}function BT6($,Z={}){let Q=$._readableState&&$._readableState.error||$._writableState&&$._writableState.error;return!Z.all&&Q===EC0?null:Q}function DT6($){return E50($)&&$.readable}function LT6($){return($._duplexState&1)!==1||($._duplexState&4)===4||($._duplexState&33587200)!==0}function OT6($){return typeof $==="object"&&$!==null&&typeof $.byteLength==="number"}function Nd$($){return OT6($)?$.byteLength:1024}function Qd$(){}function jT6(){this.destroy(Error("Stream aborted."))}function wT6($){return $._writev!==PK1.prototype._writev&&$._writev!==zC0.prototype._writev}Bd$.exports={pipeline:Fd$,pipelinePromise:WT6,isStream:Ud$,isStreamx:E50,isEnding:HT6,isEnded:FT6,isFinishing:UT6,isFinished:NT6,isDisturbed:LT6,getStreamError:BT6,Stream:PC0,Writable:PK1,Readable:w50,Duplex:zC0,Transform:zK1,PassThrough:Hd$}});var qK1=y((CT6)=>{var R6=jn(),Dd$=R6.from([117,115,116,97,114,0]),ET6=R6.from([48,48]),PT6=R6.from([117,115,116,97,114,32]),zT6=R6.from([32,0]);CT6.decodeLongPath=function(Z,Q){return wn(Z,0,Z.length,Q)};CT6.encodePax=function(Z){let Q="";if(Z.name)Q+=TK1(" path="+Z.name+`
 `);if(Z.linkname)Q+=TK1(" linkpath="+Z.linkname+`
 `);let Y=Z.pax;if(Y)for(let X in Y)Q+=TK1(" "+X+"="+Y[X]+`
-`);return R6.from(Q)};CT6.decodePax=function(Z){let Q={};while(Z.length){let Y=0;while(Y<Z.length&&Z[Y]!==32)Y++;let X=parseInt(R6.toString(Z.subarray(0,Y)),10);if(!X)return Q;let J=R6.toString(Z.subarray(Y+1,X-1)),G=J.indexOf("=");if(G===-1)return Q;Q[J.slice(0,G)]=J.slice(G+1),Z=Z.subarray(X)}return Q};CT6.encode=function(Z){let Q=R6.alloc(512),Y=Z.name,X="";if(Z.typeflag===5&&Y[Y.length-1]!=="/")Y+="/";if(R6.byteLength(Y)!==Y.length)return null;while(R6.byteLength(Y)>100){let J=Y.indexOf("/");if(J===-1)return null;X+=X?"/"+Y.slice(0,J):Y.slice(0,J),Y=Y.slice(J+1)}if(R6.byteLength(Y)>100||R6.byteLength(X)>155)return null;if(Z.linkname&&R6.byteLength(Z.linkname)>100)return null;if(R6.write(Q,Y),R6.write(Q,jz(Z.mode&4095,6),100),R6.write(Q,jz(Z.uid,6),108),R6.write(Q,jz(Z.gid,6),116),IT6(Z.size,Q,124),R6.write(Q,jz(Z.mtime.getTime()/1000|0,11),136),Q[156]=48+MT6(Z.type),Z.linkname)R6.write(Q,Z.linkname,157);if(R6.copy(Dd$,Q,257),R6.copy(ET6,Q,263),Z.uname)R6.write(Q,Z.uname,265);if(Z.gname)R6.write(Q,Z.gname,297);if(R6.write(Q,jz(Z.devmajor||0,6),329),R6.write(Q,jz(Z.devminor||0,6),337),X)R6.write(Q,X,345);return R6.write(Q,jz(Od$(Q),6),148),Q};CT6.decode=function(Z,Q,Y){let X=Z[156]===0?0:Z[156]-48,J=wn(Z,0,100,Q),G=Oz(Z,100,8),W=Oz(Z,108,8),K=Oz(Z,116,8),H=Oz(Z,124,12),F=Oz(Z,136,12),U=RT6(X),N=Z[157]===0?null:wn(Z,157,100,Q),B=wn(Z,265,32),D=wn(Z,297,32),O=Oz(Z,329,8),j=Oz(Z,337,8),w=Od$(Z);if(w===256)return null;if(w!==Oz(Z,148,8))throw Error("Invalid tar header. Maybe the tar is corrupted or it needs to be gunzipped?");if(AT6(Z)){if(Z[345])J=wn(Z,345,155,Q)+"/"+J}else if(TT6(Z));else if(!Y)throw Error("Invalid tar header: unknown format.");if(X===0&&J&&J[J.length-1]==="/")X=5;return{name:J,mode:G,uid:W,gid:K,size:H,mtime:new Date(1000*F),type:U,linkname:N,uname:B,gname:D,devmajor:O,devminor:j,pax:null}};function AT6($){return R6.equals(Dd$,$.subarray(257,263))}function TT6($){return R6.equals(PT6,$.subarray(257,263))&&R6.equals(zT6,$.subarray(263,265))}function qT6($,Z,Q){if(typeof $!=="number")return Q;if($=~~$,$>=Z)return Z;if($>=0)return $;if($+=Z,$>=0)return $;return 0}function RT6($){switch($){case 0:return"file";case 1:return"link";case 2:return"symlink";case 3:return"character-device";case 4:return"block-device";case 5:return"directory";case 6:return"fifo";case 7:return"contiguous-file";case 72:return"pax-header";case 55:return"pax-global-header";case 27:return"gnu-long-link-path";case 28:case 30:return"gnu-long-path"}return null}function MT6($){switch($){case"file":return 0;case"link":return 1;case"symlink":return 2;case"character-device":return 3;case"block-device":return 4;case"directory":return 5;case"fifo":return 6;case"contiguous-file":return 7;case"pax-header":return 72}return 0}function Ld$($,Z,Q,Y){for(;Q<Y;Q++)if($[Q]===Z)return Q;return Y}function Od$($){let Z=256;for(let Q=0;Q<148;Q++)Z+=$[Q];for(let Q=156;Q<512;Q++)Z+=$[Q];return Z}function jz($,Z){if($=$.toString(8),$.length>Z)return"7777777777777777777".slice(0,Z)+" ";return"0000000000000000000".slice(0,Z-$.length)+$+" "}function VT6($,Z,Q){Z[Q]=128;for(let Y=11;Y>0;Y--)Z[Q+Y]=$&255,$=Math.floor($/256)}function IT6($,Z,Q){if($.toString(8).length>11)VT6($,Z,Q);else R6.write(Z,jz($,11),Q)}function kT6($){let Z;if($[0]===128)Z=!0;else if($[0]===255)Z=!1;else return null;let Q=[],Y;for(Y=$.length-1;Y>0;Y--){let G=$[Y];if(Z)Q.push(G);else Q.push(255-G)}let X=0,J=Q.length;for(Y=0;Y<J;Y++)X+=Q[Y]*Math.pow(256,Y);return Z?X:-1*X}function Oz($,Z,Q){if($=$.subarray(Z,Z+Q),Z=0,$[Z]&128)return kT6($);else{while(Z<$.length&&$[Z]===32)Z++;let Y=qT6(Ld$($,32,Z,$.length),$.length,$.length);while(Z<Y&&$[Z]===0)Z++;if(Y===Z)return 0;return parseInt(R6.toString($.subarray(Z,Y)),8)}}function wn($,Z,Q,Y){return R6.toString($.subarray(Z,Ld$($,0,Z,Z+Q)),Y)}function TK1($){let Z=R6.byteLength($),Q=Math.floor(Math.log(Z)/Math.log(10))+1;if(Z+Q>=Math.pow(10,Q))Q++;return Z+Q+$}});var qd$=y((fuZ,Td$)=>{var{Writable:fT6,Readable:yT6,getStreamError:jd$}=AK1(),gT6=OK1(),wd$=jn(),En=qK1(),hT6=wd$.alloc(0);class Ed${constructor(){this.buffered=0,this.shifted=0,this.queue=new gT6,this._offset=0}push($){this.buffered+=$.byteLength,this.queue.push($)}shiftFirst($){return this._buffered===0?null:this._next($)}shift($){if($>this.buffered)return null;if($===0)return hT6;let Z=this._next($);if($===Z.byteLength)return Z;let Q=[Z];while(($-=Z.byteLength)>0)Z=this._next($),Q.push(Z);return wd$.concat(Q)}_next($){let Z=this.queue.peek(),Q=Z.byteLength-this._offset;if($>=Q){let Y=this._offset?Z.subarray(this._offset,Z.byteLength):Z;return this.queue.shift(),this._offset=0,this.buffered-=Q,this.shifted+=Q,Y}return this.buffered-=$,this.shifted+=$,Z.subarray(this._offset,this._offset+=$)}}class Pd$ extends yT6{constructor($,Z,Q){super();this.header=Z,this.offset=Q,this._parent=$}_read($){if(this.header.size===0)this.push(null);if(this._parent._stream===this)this._parent._update();$(null)}_predestroy(){this._parent.destroy(jd$(this))}_detach(){if(this._parent._stream===this)this._parent._stream=null,this._parent._missing=Ad$(this.header.size),this._parent._update()}_destroy($){this._detach(),$(null)}}class zd$ extends fT6{constructor($){super($);if(!$)$={};this._buffer=new Ed$,this._offset=0,this._header=null,this._stream=null,this._missing=0,this._longHeader=!1,this._callback=RK1,this._locked=!1,this._finished=!1,this._pax=null,this._paxGlobal=null,this._gnuLongPath=null,this._gnuLongLinkPath=null,this._filenameEncoding=$.filenameEncoding||"utf-8",this._allowUnknownFormat=!!$.allowUnknownFormat,this._unlockBound=this._unlock.bind(this)}_unlock($){if(this._locked=!1,$){this.destroy($),this._continueWrite($);return}this._update()}_consumeHeader(){if(this._locked)return!1;this._offset=this._buffer.shifted;try{this._header=En.decode(this._buffer.shift(512),this._filenameEncoding,this._allowUnknownFormat)}catch($){return this._continueWrite($),!1}if(!this._header)return!0;switch(this._header.type){case"gnu-long-path":case"gnu-long-link-path":case"pax-global-header":case"pax-header":return this._longHeader=!0,this._missing=this._header.size,!0}if(this._locked=!0,this._applyLongHeaders(),this._header.size===0||this._header.type==="directory")return this.emit("entry",this._header,this._createStream(),this._unlockBound),!0;return this._stream=this._createStream(),this._missing=this._header.size,this.emit("entry",this._header,this._stream,this._unlockBound),!0}_applyLongHeaders(){if(this._gnuLongPath)this._header.name=this._gnuLongPath,this._gnuLongPath=null;if(this._gnuLongLinkPath)this._header.linkname=this._gnuLongLinkPath,this._gnuLongLinkPath=null;if(this._pax){if(this._pax.path)this._header.name=this._pax.path;if(this._pax.linkpath)this._header.linkname=this._pax.linkpath;if(this._pax.size)this._header.size=parseInt(this._pax.size,10);this._header.pax=this._pax,this._pax=null}}_decodeLongHeader($){switch(this._header.type){case"gnu-long-path":this._gnuLongPath=En.decodeLongPath($,this._filenameEncoding);break;case"gnu-long-link-path":this._gnuLongLinkPath=En.decodeLongPath($,this._filenameEncoding);break;case"pax-global-header":this._paxGlobal=En.decodePax($);break;case"pax-header":this._pax=this._paxGlobal===null?En.decodePax($):Object.assign({},this._paxGlobal,En.decodePax($));break}}_consumeLongHeader(){this._longHeader=!1,this._missing=Ad$(this._header.size);let $=this._buffer.shift(this._header.size);try{this._decodeLongHeader($)}catch(Z){return this._continueWrite(Z),!1}return!0}_consumeStream(){let $=this._buffer.shiftFirst(this._missing);if($===null)return!1;this._missing-=$.byteLength;let Z=this._stream.push($);if(this._missing===0){if(this._stream.push(null),Z)this._stream._detach();return Z&&this._locked===!1}return Z}_createStream(){return new Pd$(this,this._header,this._offset)}_update(){while(this._buffer.buffered>0&&!this.destroying){if(this._missing>0){if(this._stream!==null){if(this._consumeStream()===!1)return;continue}if(this._longHeader===!0){if(this._missing>this._buffer.buffered)break;if(this._consumeLongHeader()===!1)return!1;continue}let $=this._buffer.shiftFirst(this._missing);if($!==null)this._missing-=$.byteLength;continue}if(this._buffer.buffered<512)break;if(this._stream!==null||this._consumeHeader()===!1)return}this._continueWrite(null)}_continueWrite($){let Z=this._callback;this._callback=RK1,Z($)}_write($,Z){this._callback=Z,this._buffer.push($),this._update()}_final($){this._finished=this._missing===0&&this._buffer.buffered===0,$(this._finished?null:Error("Unexpected end of data"))}_predestroy(){this._continueWrite(null)}_destroy($){if(this._stream)this._stream.destroy(jd$(this));$(null)}[Symbol.asyncIterator](){let $=null,Z=null,Q=null,Y=null,X=null,J=this;return this.on("entry",K),this.on("error",(U)=>{$=U}),this.on("close",H),{[Symbol.asyncIterator](){return this},next(){return new Promise(W)},return(){return F(null)},throw(U){return F(U)}};function G(U){if(!X)return;let N=X;X=null,N(U)}function W(U,N){if($)return N($);if(Y){U({value:Y,done:!1}),Y=null;return}if(Z=U,Q=N,G(null),J._finished&&Z)Z({value:void 0,done:!0}),Z=Q=null}function K(U,N,B){if(X=B,N.on("error",RK1),Z)Z({value:N,done:!1}),Z=Q=null;else Y=N}function H(){if(G($),!Z)return;if($)Q($);else Z({value:void 0,done:!0});Z=Q=null}function F(U){return J.destroy(U),G(U),new Promise((N,B)=>{if(J.destroyed)return N({value:void 0,done:!0});J.once("close",function(){if(U)B(U);else N({value:void 0,done:!0})})})}}}Td$.exports=function(Z){return new zd$(Z)};function RK1(){}function Ad$($){return $&=511,$&&512-$}});var Md$=y((yuZ,MK1)=>{var Rd$={S_IFMT:61440,S_IFDIR:16384,S_IFCHR:8192,S_IFBLK:24576,S_IFIFO:4096,S_IFLNK:40960};try{MK1.exports=V0("fs").constants||Rd$}catch{MK1.exports=Rd$}});var vd$=y((guZ,_d$)=>{var{Readable:uT6,Writable:lT6,getStreamError:Vd$}=AK1(),Hh=jn(),Pn=Md$(),AC0=qK1(),Id$=Hh.alloc(1024);class kd$ extends lT6{constructor($,Z,Q){super({mapWritable:mT6,eagerOpen:!0});if(this.written=0,this.header=Z,this._callback=Q,this._linkname=null,this._isLinkname=Z.type==="symlink"&&!Z.linkname,this._isVoid=Z.type!=="file"&&Z.type!=="contiguous-file",this._finished=!1,this._pack=$,this._openCallback=null,this._pack._stream===null)this._pack._stream=this;else this._pack._pending.push(this)}_open($){if(this._openCallback=$,this._pack._stream===this)this._continueOpen()}_continuePack($){if(this._callback===null)return;let Z=this._callback;this._callback=null,Z($)}_continueOpen(){if(this._pack._stream===null)this._pack._stream=this;let $=this._openCallback;if(this._openCallback=null,$===null)return;if(this._pack.destroying)return $(Error("pack stream destroyed"));if(this._pack._finalized)return $(Error("pack stream is already finalized"));if(this._pack._stream=this,!this._isLinkname)this._pack._encode(this.header);if(this._isVoid)this._finish(),this._continuePack(null);$(null)}_write($,Z){if(this._isLinkname)return this._linkname=this._linkname?Hh.concat([this._linkname,$]):$,Z(null);if(this._isVoid){if($.byteLength>0)return Z(Error("No body allowed for this entry"));return Z()}if(this.written+=$.byteLength,this._pack.push($))return Z();this._pack._drain=Z}_finish(){if(this._finished)return;if(this._finished=!0,this._isLinkname)this.header.linkname=this._linkname?Hh.toString(this._linkname,"utf-8"):"",this._pack._encode(this.header);Sd$(this._pack,this.header.size),this._pack._done(this)}_final($){if(this.written!==this.header.size)return $(Error("Size mismatch"));this._finish(),$(null)}_getError(){return Vd$(this)||Error("tar entry destroyed")}_predestroy(){this._pack.destroy(this._getError())}_destroy($){this._pack._done(this),this._continuePack(this._finished?null:this._getError()),$()}}class Cd$ extends uT6{constructor($){super($);this._drain=VK1,this._finalized=!1,this._finalizing=!1,this._pending=[],this._stream=null}entry($,Z,Q){if(this._finalized||this.destroying)throw Error("already finalized or destroyed");if(typeof Z==="function")Q=Z,Z=null;if(!Q)Q=VK1;if(!$.size||$.type==="symlink")$.size=0;if(!$.type)$.type=cT6($.mode);if(!$.mode)$.mode=$.type==="directory"?493:420;if(!$.uid)$.uid=0;if(!$.gid)$.gid=0;if(!$.mtime)$.mtime=new Date;if(typeof Z==="string")Z=Hh.from(Z);let Y=new kd$(this,$,Q);if(Hh.isBuffer(Z))return $.size=Z.byteLength,Y.write(Z),Y.end(),Y;if(Y._isVoid)return Y;return Y}finalize(){if(this._stream||this._pending.length>0){this._finalizing=!0;return}if(this._finalized)return;this._finalized=!0,this.push(Id$),this.push(null)}_done($){if($!==this._stream)return;if(this._stream=null,this._finalizing)this.finalize();if(this._pending.length)this._pending.shift()._continueOpen()}_encode($){if(!$.pax){let Z=AC0.encode($);if(Z){this.push(Z);return}}this._encodePax($)}_encodePax($){let Z=AC0.encodePax({name:$.name,linkname:$.linkname,pax:$.pax}),Q={name:"PaxHeader",mode:$.mode,uid:$.uid,gid:$.gid,size:Z.byteLength,mtime:$.mtime,type:"pax-header",linkname:$.linkname&&"PaxHeader",uname:$.uname,gname:$.gname,devmajor:$.devmajor,devminor:$.devminor};this.push(AC0.encode(Q)),this.push(Z),Sd$(this,Z.byteLength),Q.size=$.size,Q.type=$.type,this.push(AC0.encode(Q))}_doDrain(){let $=this._drain;this._drain=VK1,$()}_predestroy(){let $=Vd$(this);if(this._stream)this._stream.destroy($);while(this._pending.length){let Z=this._pending.shift();Z.destroy($),Z._continueOpen()}this._doDrain()}_read($){this._doDrain(),$()}}_d$.exports=function(Z){return new Cd$(Z)};function cT6($){switch($&Pn.S_IFMT){case Pn.S_IFBLK:return"block-device";case Pn.S_IFCHR:return"character-device";case Pn.S_IFDIR:return"directory";case Pn.S_IFIFO:return"fifo";case Pn.S_IFLNK:return"symlink"}return"file"}function VK1(){}function Sd$($,Z){if(Z&=511,Z)$.push(Id$.subarray(0,512-Z))}function mT6($){return Hh.isBuffer($)?$:Hh.from($)}});var bd$=y((dT6)=>{dT6.extract=qd$();dT6.pack=vd$()});var yd$=y((uuZ,fd$)=>{fd$.exports=xd$;function xd$($,Z){if($&&Z)return xd$($)(Z);if(typeof $!=="function")throw TypeError("need wrapper function");return Object.keys($).forEach(function(Y){Q[Y]=$[Y]}),Q;function Q(){var Y=Array(arguments.length);for(var X=0;X<Y.length;X++)Y[X]=arguments[X];var J=$.apply(this,Y),G=Y[Y.length-1];if(typeof J==="function"&&J!==G)Object.keys(G).forEach(function(W){J[W]=G[W]});return J}}});var kK1=y((luZ,IK1)=>{var gd$=yd$();IK1.exports=gd$(TC0);IK1.exports.strict=gd$(hd$);TC0.proto=TC0(function(){Object.defineProperty(Function.prototype,"once",{value:function(){return TC0(this)},configurable:!0}),Object.defineProperty(Function.prototype,"onceStrict",{value:function(){return hd$(this)},configurable:!0})});function TC0($){var Z=function(){if(Z.called)return Z.value;return Z.called=!0,Z.value=$.apply(this,arguments)};return Z.called=!1,Z}function hd$($){var Z=function(){if(Z.called)throw Error(Z.onceError);return Z.called=!0,Z.value=$.apply(this,arguments)},Q=$.name||"Function wrapped with `once`";return Z.onceError=Q+" shouldn't be called more than once",Z.called=!1,Z}});var cd$=y((cuZ,ld$)=>{var nT6=kK1(),tT6=function(){},oT6=global.Bare?queueMicrotask:process.nextTick.bind(process),sT6=function($){return $.setHeader&&typeof $.abort==="function"},rT6=function($){return $.stdio&&Array.isArray($.stdio)&&$.stdio.length===3},ud$=function($,Z,Q){if(typeof Z==="function")return ud$($,null,Z);if(!Z)Z={};Q=nT6(Q||tT6);var{_writableState:Y,_readableState:X}=$,J=Z.readable||Z.readable!==!1&&$.readable,G=Z.writable||Z.writable!==!1&&$.writable,W=!1,K=function(){if(!$.writable)H()},H=function(){if(G=!1,!J)Q.call($)},F=function(){if(J=!1,!G)Q.call($)},U=function(j){Q.call($,j?Error("exited with error code: "+j):null)},N=function(j){Q.call($,j)},B=function(){oT6(D)},D=function(){if(W)return;if(J&&!(X&&(X.ended&&!X.destroyed)))return Q.call($,Error("premature close"));if(G&&!(Y&&(Y.ended&&!Y.destroyed)))return Q.call($,Error("premature close"))},O=function(){$.req.on("finish",H)};if(sT6($))if($.on("complete",H),$.on("abort",B),$.req)O();else $.on("request",O);else if(G&&!Y)$.on("end",K),$.on("close",K);if(rT6($))$.on("exit",U);if($.on("end",F),$.on("finish",H),Z.error!==!1)$.on("error",N);return $.on("close",B),function(){if(W=!0,$.removeListener("complete",H),$.removeListener("abort",B),$.removeListener("request",O),$.req)$.req.removeListener("finish",H);$.removeListener("end",K),$.removeListener("close",K),$.removeListener("finish",H),$.removeListener("exit",U),$.removeListener("end",F),$.removeListener("error",N),$.removeListener("close",B)}};ld$.exports=ud$});var id$=y((muZ,dd$)=>{var aT6=kK1(),eT6=cd$(),qC0;try{qC0=V0("fs")}catch($){}var P50=function(){},$q6=typeof process>"u"?!1:/^v?\.0/.test(process.version),RC0=function($){return typeof $==="function"},Zq6=function($){if(!$q6)return!1;if(!qC0)return!1;return($ instanceof(qC0.ReadStream||P50)||$ instanceof(qC0.WriteStream||P50))&&RC0($.close)},Qq6=function($){return $.setHeader&&RC0($.abort)},Yq6=function($,Z,Q,Y){Y=aT6(Y);var X=!1;$.on("close",function(){X=!0}),eT6($,{readable:Z,writable:Q},function(G){if(G)return Y(G);X=!0,Y()});var J=!1;return function(G){if(X)return;if(J)return;if(J=!0,Zq6($))return $.close(P50);if(Qq6($))return $.abort();if(RC0($.destroy))return $.destroy();Y(G||Error("stream was destroyed"))}},md$=function($){$()},Xq6=function($,Z){return $.pipe(Z)},Jq6=function(){var $=Array.prototype.slice.call(arguments),Z=RC0($[$.length-1]||P50)&&$.pop()||P50;if(Array.isArray($[0]))$=$[0];if($.length<2)throw Error("pump requires two streams per minimum");var Q,Y=$.map(function(X,J){var G=J<$.length-1,W=J>0;return Yq6(X,G,W,function(K){if(!Q)Q=K;if(K)Y.forEach(md$);if(G)return;Y.forEach(md$),Z(Q)})});return $.reduce(Xq6)};dd$.exports=Jq6});var $i$=y((Hq6)=>{var pd$=bd$(),nd$=id$(),td$=V0("fs"),gZ=V0("path"),z50=(global.Bare?global.Bare.platform:process.platform)==="win32";Hq6.pack=function(Z,Q){if(!Z)Z=".";if(!Q)Q={};let Y=Q.fs||td$,X=Q.ignore||Q.filter||A50,J=Q.mapStream||ad$,G=Kq6(Y,Q.dereference?Y.stat:Y.lstat,Z,X,Q.entries,Q.sort),W=Q.strict!==!1,K=typeof Q.umask==="number"?~Q.umask:~od$(),H=Q.pack||pd$.pack(),F=Q.finish||A50,U=Q.map||A50,N=typeof Q.dmode==="number"?Q.dmode:0,B=typeof Q.fmode==="number"?Q.fmode:0;if(Q.strip)U=ed$(U,Q.strip);if(Q.readable)N|=parseInt(555,8),B|=parseInt(444,8);if(Q.writable)N|=parseInt(333,8),B|=parseInt(222,8);j();function D(w,E){Y.readlink(gZ.join(Z,w),function(P,T){if(P)return H.destroy(P);E.linkname=CK1(T),H.entry(E,j)})}function O(w,E,P){if(H.destroyed)return;if(w)return H.destroy(w);if(!E){if(Q.finalize!==!1)H.finalize();return F(H)}if(P.isSocket())return j();let T={name:CK1(E),mode:(P.mode|(P.isDirectory()?N:B))&K,mtime:P.mtime,size:P.size,type:"file",uid:P.uid,gid:P.gid};if(P.isDirectory())return T.size=0,T.type="directory",T=U(T)||T,H.entry(T,j);if(P.isSymbolicLink())return T.size=0,T.type="symlink",T=U(T)||T,D(E,T);if(T=U(T)||T,!P.isFile()){if(W)return H.destroy(Error("unsupported type for "+E));return j()}let z=H.entry(T,j),A=J(Y.createReadStream(gZ.join(Z,E),{start:0,end:T.size>0?T.size-1:T.size}),T);A.on("error",function(R){z.destroy(R)}),nd$(A,z)}function j(w){if(w)return H.destroy(w);G(O)}return H};function Gq6($){return $.length?$[$.length-1]:null}function Wq6(){return!global.Bare&&process.getuid?process.getuid():-1}function od$(){return!global.Bare&&process.umask?process.umask():0}Hq6.extract=function(Z,Q){if(!Z)Z=".";if(!Q)Q={};Z=gZ.resolve(Z);let Y=Q.fs||td$,X=Q.ignore||Q.filter||A50,J=Q.mapStream||ad$,G=Q.chown!==!1&&!z50&&Wq6()===0,W=Q.extract||pd$.extract(),K=[],H=new Date,F=typeof Q.umask==="number"?~Q.umask:~od$(),U=Q.strict!==!1,N=Q.validateSymlinks!==!1,B=Q.map||A50,D=typeof Q.dmode==="number"?Q.dmode:0,O=typeof Q.fmode==="number"?Q.fmode:0;if(Q.strip)B=ed$(B,Q.strip);if(Q.readable)D|=parseInt(555,8),O|=parseInt(444,8);if(Q.writable)D|=parseInt(333,8),O|=parseInt(222,8);if(W.on("entry",j),Q.finish)W.on("finish",Q.finish);return W;function j(z,A,R){z=B(z)||z,z.name=CK1(z.name);let f=gZ.join(Z,gZ.join("/",z.name));if(X(f,z))return A.resume(),R();let S=gZ.join(f,".")===gZ.join(Z,".")?Z:gZ.dirname(f);rd$(Y,S,gZ.join(Z,"."),function(d,W0){if(d)return R(d);if(!W0)return R(Error(S+" is not a valid path"));if(z.type==="directory")return K.push([f,z.mtime]),T(f,{fs:Y,own:G,uid:z.uid,gid:z.gid,mode:z.mode},V);T(S,{fs:Y,own:G,uid:z.uid,gid:z.gid,mode:493},function(I0){if(I0)return R(I0);switch(z.type){case"file":return l();case"link":return b();case"symlink":return v()}if(U)return R(Error("unsupported type for "+f+" ("+z.type+")"));A.resume(),R()})});function V(d){if(d)return R(d);E(f,z,function(W0){if(W0)return R(W0);if(z50)return R();P(f,z,R)})}function v(){if(z50)return R();Y.unlink(f,function(){let d=gZ.resolve(gZ.dirname(f),z.linkname);if(!h(d)&&N)return R(Error(f+" is not a valid symlink"));sd$(Y,d,gZ.join(Z,"."),function(W0,I0){if(W0)return R(W0);if(!I0&&N)return R(Error(f+" is not a valid symlink"));Y.symlink(z.linkname,f,V)})})}function b(){if(z50)return R();Y.unlink(f,function(){let d=gZ.join(Z,gZ.join("/",z.linkname));Y.realpath(d,function(W0,I0){if(W0||!h(I0))return R(Error(f+" is not a valid hardlink"));Y.link(I0,f,function(J0){if(J0&&J0.code==="EPERM"&&Q.hardlinkAsFilesFallback)return A=Y.createReadStream(I0),l();V(J0)})})})}function h(d){return d===Z||d.startsWith(Z+gZ.sep)}function l(){let d=Y.createWriteStream(f),W0=J(A,z);d.on("error",function(I0){W0.destroy(I0)}),nd$(W0,d,function(I0){if(I0)return R(I0);d.on("close",V)})}}function w(z,A){let R;while((R=Gq6(K))&&z.slice(0,R[0].length)!==R[0])K.pop();if(!R)return A();Y.utimes(R[0],H,R[1],A)}function E(z,A,R){if(Q.utimes===!1)return R();if(A.type==="directory")return Y.utimes(z,H,A.mtime,R);if(A.type==="symlink")return w(z,R);Y.utimes(z,H,A.mtime,function(f){if(f)return R(f);w(z,R)})}function P(z,A,R){let f=A.type==="symlink",S=f?Y.lchmod:Y.chmod,V=f?Y.lchown:Y.chown;if(!S)return R();let v=(A.mode|(A.type==="directory"?D:O))&F;if(V&&G)V.call(Y,z,A.uid,A.gid,b);else b(null);function b(h){if(h)return R(h);if(!S)return R();S.call(Y,z,v,R)}}function T(z,A,R){Y.stat(z,function(f){if(!f)return R(null);if(f.code!=="ENOENT")return R(f);Y.mkdir(z,{mode:A.mode,recursive:!0},function(S,V){if(S)return R(S);P(z,A,R)})})}};function sd$($,Z,Q,Y){if(Z===Q)return Y(null,!0);if(!Z.startsWith(Q+gZ.sep))return Y(null,!1);$.lstat(Z,function(X,J){if(X&&X.code!=="ENOENT"&&X.code!=="EPERM")return Y(X);if(X||!J.isSymbolicLink())return sd$($,gZ.join(Z,".."),Q,Y);Y(null,!1)})}function rd$($,Z,Q,Y){if(Z===Q)return Y(null,!0);$.lstat(Z,function(X,J){if(X&&X.code!=="ENOENT"&&X.code!=="EPERM")return Y(X);if(X||J.isDirectory())return rd$($,gZ.join(Z,".."),Q,Y);Y(null,!1)})}function A50(){}function ad$($){return $}function CK1($){return z50?$.replace(/\\/g,"/").replace(/[:?<>|]/g,"_"):$}function Kq6($,Z,Q,Y,X,J){if(!X)X=["."];let G=X.slice(0);return function(K){if(!G.length)return K(null);let H=G.shift(),F=gZ.join(Q,H);Z.call($,F,function(U,N){if(U)return K(X.indexOf(H)===-1&&U.code==="ENOENT"?null:U);if(!N.isDirectory())return K(null,H,N);$.readdir(F,function(B,D){if(B)return K(B);if(J)D.sort();for(let O=0;O<D.length;O++)if(!Y(gZ.join(Q,H,D[O])))G.push(gZ.join(H,D[O]));K(null,H,N)})})}}function ed$($,Z){return function(Q){Q.name=Q.name.split("/").slice(Z).join("/");let Y=Q.linkname;if(Y&&(Q.type==="link"||gZ.isAbsolute(Y)))Q.linkname=Y.split("/").slice(Z).join("/");return $(Q)}}});var Nq6,Bq6;var Zi$=L(()=>{DK1();Nq6=_(cm$(),1),Bq6=_($i$(),1)});var MC0=()=>{};var Qi$=L(()=>{hk0()});var Yi$=L(()=>{BC0();NC0();MC0()});var Xi$=()=>{};var Ji$=()=>{};var Gi$=L(()=>{Tm$();NK1();BC0();Im$();FK1();DK1();km$();Cm$();Sm$();_m$();UK1();vm$();Zi$();MC0();Qi$();Yi$();Xi$();Ji$();MC0()});function Dq6($){if($ instanceof TypeError)return!0;if($ instanceof Error&&!($ instanceof DOMException)&&typeof $.code==="string")return!0;if($ instanceof DOMException&&$.name==="AbortError")return!0;return!1}async function SK1($,Z,Q,Y){try{return await F8(async()=>{let J=await fetch($,{...Z,signal:AbortSignal.timeout(Y)});return{status:J.status,ok:J.ok,body:await J.text()}},{maxAttempts:3,minTimeout:50,maxTimeout:500,multiplier:2,jitter:0.5,isRetriable:Dq6})}catch(X){let J=X instanceof Error?X.message:String(X);throw Error(`[SANDBOX_UNREACHABLE] sandbox daemon ${Q} request failed: ${J}`,{cause:X})}}async function VC0($){try{let Z=await fetch(`${$}/health`,{signal:AbortSignal.timeout(Lq6)});if(!Z.ok){try{await Z.text()}catch{}return null}let Q=await Z.json();if(typeof Q==="object"&&Q!==null&&typeof Q.bootId==="string"&&typeof Q.ready==="boolean"&&Q.setup&&typeof Q.setup.running==="boolean"&&typeof Q.setup.done==="boolean")return Q;return null}catch{return null}}async function vK1($){for(let Z=0;Z<Wi$;Z++){if(await VC0($)!==null)return;let Q=(Math.random()*2-1)*Oq6;await J$(Ki$+Q)}throw Error(`sandbox daemon at ${$} did not respond on /health within ${Wi$*Ki$/1000}s`)}async function nK($,Z,Q,Y,X){return jq6($,Z,"POST",Q,Y,X)}async function jq6($,Z,Q,Y,X,J){let G={...Y};if(X&&X.rotateToken!==void 0)G.auth=X;let W=await SK1(`${$}/_sandbox/config`,{method:Q,headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:JSON.stringify(G)},"/_sandbox/config",J?.timeoutMs??_K1);if(!W.ok)throw new IY(W.status,W.body);return Fi$(W.body,"/_sandbox/config")}async function Hi$($,Z,Q){let Y=await SK1(`${$}/_sandbox/setup/${Q}`,{method:"POST",headers:{Authorization:`Bearer ${Z}`}},`/_sandbox/setup/${Q}`,_K1);if(!Y.ok)throw Error(`sandbox daemon /_sandbox/setup/${Q} returned ${Y.status}: ${Y.body}`)}async function IC0($,Z,Q){let Y=await SK1(`${$}/_sandbox/orgfs-config`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:Q},"/_sandbox/orgfs-config",_K1);if(!Y.ok)throw new IY(Y.status,Y.body,"/_sandbox/orgfs-config");return Fi$(Y.body,"/_sandbox/orgfs-config")}function Fi$($,Z){try{return JSON.parse($)}catch(Q){throw Error(`sandbox daemon ${Z} returned a malformed JSON body: ${$.slice(0,200)}`,{cause:Q})}}async function kC0($,Z,Q,Y){let X=new Headers(Y.headers);for(let W of wq6)X.delete(W);X.set("authorization",`Bearer ${Z}`);let J=Y.method!=="GET"&&Y.method!=="HEAD",G=`${$}${Q.startsWith("/")?Q:`/${Q}`}`;return fetch(G,{method:Y.method,headers:X,body:J?Y.body:void 0,redirect:"manual",signal:Y.signal,duplex:J?"half":void 0})}var IY,Lq6=500,_K1=30000,Wi$=25,Ki$=200,Oq6=50,wq6;var Fh=L(()=>{$n();n$();IY=class IY extends Error{status;constructor($,Z,Q="/_sandbox/config"){super(`sandbox daemon ${Q} returned ${$}: ${Z}`);this.status=$;this.name="ConfigRequestError"}};wq6=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length"]});class CC0{counted=new Set;markCounted($){this.counted.add($)}consume($){return this.counted.delete($)}}class Uh{map=new Map;async run($,Z){let Q=this.map.get($);if(Q)return Q;let Y=Z();this.map.set($,Y);try{return await Y}finally{this.map.delete($)}}}function SC0($,Z,Q){if(!$)return Q(null);if(!$.withLock)return Q($);return $.withLock(Z,Q)}function T50($){if(!$.orgId||!$.virtualMcpId||!$.branch)throw Error("composeSandboxRef: orgId, virtualMcpId and branch are all required for agent refs");return`agent:${$.orgId}:${$.virtualMcpId}:${$.branch}`}function Ui$($){if(!$.startsWith("agent:"))return"";let Z=$.split(":");return Z.length>=4?Z.slice(3).join(":"):""}import{hash as Eq6}from"crypto";function Pq6($,Z=16){return Eq6("sha256",$g$($),"hex").slice(0,Z)}function HW($){let Z=Pq6($),Q=zq6(Ui$($.projectRef));return Q?`${Q}-${Z}`:`s-${Z}`}function zq6($){if(!$)return"";let Z=$.split("/").pop()??"",Q="",Y=!1;for(let X of Z.toLowerCase()){let J=X.charCodeAt(0),G=J>=97&&J<=122,W=J>=48&&J<=57;if(!G&&!W){Y||=Q.length>0;continue}if(Y){if(Q.length+1>=Ni$)break;Q+="-",Y=!1}if(Q+=X,Q.length===Ni$)break}return Q}var Ni$=24;var Bi$=L(()=>{S31()});function _C0($,Z){let Q=$.replace(/\/+$/,"");if(Q.includes("{handle}"))return`${Q.replace("{handle}",Z)}/`;try{let Y=new URL(Q);return Y.hostname=`${Z}.${Y.hostname}`,`${Y.toString()}/`}catch{return`${Q}/${Z}/`}}function zn($){let Z=$.repo,Q=Z?{repository:{cloneUrl:Z.cloneUrl,repoName:Z.displayName??Aq6(Z.cloneUrl),...Z.branch?{branch:Z.branch}:{},submoduleCredentials:Z.submoduleCredentials??[]},repositories:($.extraRepos??[]).filter((K)=>!!K.directoryName).map((K)=>({cloneUrl:K.cloneUrl,repoName:K.directoryName,...K.branch?{branch:K.branch}:{},submoduleCredentials:K.submoduleCredentials??[]})),...Z.userName.trim()||Z.userEmail.trim()?{identity:{userName:Z.userName,userEmail:Z.userEmail}}:{}}:void 0,Y=$.tenant,X=ep({userName:Y?.userName,userEmail:Y?.userEmail})??void 0,J=$.packageManager?{name:$.packageManager.name,...$.packageManager.path?{path:$.packageManager.path}:{}}:void 0,G=J?{packageManager:J,runtime:$.runtime,...$.port!==void 0?{port:$.port}:{}}:void 0,W=Y?.orgId;if(!Q&&!G&&!X&&$.cloneOnly===void 0&&!W)return null;return{...Q?{git:Q}:{},...X?{operator:X}:{},...W?{orgId:W}:{},...$.cloneOnly!==void 0?{cloneOnly:$.cloneOnly}:{},...G?{application:G}:{}}}function Aq6($){try{let Z=new URL($);return Z.pathname.replace(/^\/+/,"").replace(/\.git$/,"")||Z.hostname}catch{return $}}var Di$=L(()=>{kG1()});function Tq6($){try{return new URL($).username.length>0}catch{return!1}}function q50($){let Z=$.repo?.cloneUrl;if(!Z||!Tq6(Z))return null;return{git:{repository:{cloneUrl:Z}}}}var An=L(()=>{Bi$();Di$()});async function*ji$($){let Z=$.now??(()=>Date.now()),Q=Z(),Y=$.schedulingTimeoutMs??Rq6,X={pod:{},sandbox:{},events:{hasPulling:!1,hasPulled:!1},startedAt:Q},J=[],G=null,W=!1,K=(E)=>{if(W)return;if(G){let P=G;G=null,P(E)}else J.push(E)},H=()=>{if(J.length>0)return Promise.resolve(J.shift());if(W)return Promise.resolve(null);return new Promise((E)=>{G=E})},F=()=>{if(W)return;if(W=!0,G){let E=G;G=null,E(null)}},U=new AbortController,N=()=>{U.abort(),F()};if($.signal)if($.signal.aborted)U.abort(),F();else $.signal.addEventListener("abort",N,{once:!0});let B=Math.max(0,Y-(Z()-Q)),D=setTimeout(()=>K("tick"),B+100),O,j=new Promise((E)=>{O=E}),w=Promise.allSettled([Vq6($.kc,$.namespace,$.claimName,U.signal,X,K,Z,O),kq6($.kc,$.namespace,$.claimName,U.signal,X,K),Cq6($.kc,$.namespace,$.claimName,j,U.signal,X,K,Z)]);try{let E=null,P=-1,T=Li$(X,Y,Z);if(E=xK1(T),!bK1(T))P=Oi$(T);if(yield T,bK1(T))return;while(!W){if(await H()===null)break;let A=Li$(X,Y,Z);if(bK1(A)){let S=xK1(A);if(S!==E)E=S,yield A;return}let R=Oi$(A);if(R<P)continue;let f=xK1(A);if(f!==E)E=f,P=R,yield A}}finally{if(clearTimeout(D),U.abort(),$.signal)$.signal.removeEventListener("abort",N);F(),await w.catch(()=>{})}}async function wi$($,Z=Mq6){let Q=new AbortController,Y="claiming",X,J=()=>{clearTimeout(X),X=setTimeout(()=>Q.abort(),Z)};try{J();for await(let G of $(Q.signal)){if(G.kind==="ready")return;if(G.kind==="failed")throw new qX(G.message);Y=G.kind,J()}}finally{clearTimeout(X),Q.abort()}throw new Gn(`Sandbox did not become ready: no progress for ${Math.round(Z/1000)}s while ${Y}`)}function Li$($,Z,Q){let{pod:Y,sandbox:X,events:J,startedAt:G}=$;if(X.ready)return{kind:"ready"};let W=Y.containerWaitingReason;if(W==="ImagePullBackOff"||W==="ErrImagePull")return{kind:"failed",reason:"image-pull-backoff",message:"Sandbox image failed to download. The cluster may be missing pull credentials or the image tag may not exist."};if(W==="CrashLoopBackOff")return{kind:"failed",reason:"crash-loop-backoff",message:"Sandbox crashed during startup and is now in CrashLoopBackOff. Check pod logs."};if(!Y.scheduled&&J.lastFailedSchedulingAt!==void 0&&Q()-G>Z)return{kind:"failed",reason:"scheduling-timeout",message:J.failedSchedulingMessage??`Pod could not be scheduled within ${Math.round(Z/1000)}s.`};if(Y.containerRunning&&!Y.containerReady)return{kind:"warming-daemon",since:G};if(J.hasPulling&&!J.hasPulled)return{kind:"pulling-image",since:G};if(W==="ContainerCreating"||W==="PodInitializing"||Y.scheduled&&!Y.containerRunning)return{kind:"starting-container",since:G};if(Y.scheduledFalseReason==="Unschedulable"||J.lastFailedSchedulingAt!==void 0&&!Y.scheduled)return{kind:"waiting-for-capacity",since:G,message:J.failedSchedulingMessage??Y.scheduledFalseMessage,nodeClaim:J.nominatedNodeClaim};return{kind:"claiming",since:G}}function bK1($){return $.kind==="ready"||$.kind==="failed"}function Oi$($){switch($.kind){case"claiming":return 0;case"waiting-for-capacity":return 1;case"pulling-image":return 2;case"starting-container":return 3;case"warming-daemon":return 4;case"ready":case"failed":return 99}}function xK1($){switch($.kind){case"claiming":case"pulling-image":case"starting-container":case"warming-daemon":return $.kind;case"waiting-for-capacity":return`waiting-for-capacity:${$.message??""}:${$.nodeClaim??""}`;case"ready":return"ready";case"failed":return`failed:${$.reason}:${$.message}`}}async function Vq6($,Z,Q,Y,X,J,G,W){let K=`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?watch=true&labelSelector=${encodeURIComponent(`${qq6}=${Q}`)}`;return vC0({kc:$,path:K,signal:Y,label:`pod/${Q}`,onEvent:(H)=>{if(H.type!=="ADDED"&&H.type!=="MODIFIED")return;let F=H.object;if(F.metadata?.name)W(F.metadata.name);Iq6(F,X,G),J("pod")}})}function Iq6($,Z,Q){let X=($.status?.conditions??[]).find((G)=>G.type==="PodScheduled");if(X?.status==="True")Z.pod.scheduled=!0,Z.pod.scheduledFalseReason=void 0,Z.pod.scheduledFalseMessage=void 0;else if(X?.status==="False")Z.pod.scheduled=!1,Z.pod.scheduledFalseReason=X.reason,Z.pod.scheduledFalseMessage=X.message;let J=($.status?.containerStatuses??[]).find((G)=>G.name===G7.MAIN_CONTAINER_NAME);if(J)Z.pod.containerWaitingReason=J.state?.waiting?.reason,Z.pod.containerRunning=!!J.state?.running,Z.pod.containerReady=J.ready===!0}async function kq6($,Z,Q,Y,X,J){let G=`/apis/${G7.CLAIM_API_GROUP}/${G7.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(Z)}/${G7.CLAIM_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${Q}`)}`;return vC0({kc:$,path:G,signal:Y,label:`sandboxclaim/${Q}`,onEvent:(W)=>{if(W.type!=="ADDED"&&W.type!=="MODIFIED")return;let H=W.object.status?.conditions?.find((F)=>F.type==="Ready");if(!H)return;if(H.status==="True")X.sandbox.ready=!0,X.sandbox.notReadyReason=void 0,X.sandbox.notReadyMessage=void 0;else X.sandbox.ready=!1,X.sandbox.notReadyReason=H.reason,X.sandbox.notReadyMessage=H.message;J("sandbox")}})}async function Cq6($,Z,Q,Y,X,J,G,W){let K=await Promise.race([Y,new Promise((F)=>{if(X.aborted){F(Q);return}X.addEventListener("abort",()=>F(Q),{once:!0})})]);if(X.aborted)return;let H=`/api/v1/namespaces/${encodeURIComponent(Z)}/events?watch=true&fieldSelector=${encodeURIComponent(`involvedObject.name=${K},involvedObject.kind=Pod`)}`;return vC0({kc:$,path:H,signal:X,label:`events/${Q}`,onEvent:(F)=>{if(F.type!=="ADDED"&&F.type!=="MODIFIED")return;let U=F.object,N=U.reason;if(!N)return;switch(N){case"Pulling":J.events.hasPulling=!0;break;case"Pulled":J.events.hasPulling=!0,J.events.hasPulled=!0;break;case"FailedScheduling":J.events.lastFailedSchedulingAt=W(),J.events.failedSchedulingMessage=U.message;break;case"Nominated":{let B=U.message?.match(/nodeclaim\/([\w-]+)/);if(B)J.events.nominatedNodeClaim=B[1];break}default:return}G("event")}})}async function Ei$($){let{kc:Z,namespace:Q,labelSelector:Y,signal:X,onDelete:J}=$,G=`/apis/${G7.CLAIM_API_GROUP}/${G7.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(Q)}/${G7.CLAIM_PLURAL}?watch=true&labelSelector=${encodeURIComponent(Y)}`;return vC0({kc:Z,path:G,signal:X,label:"sandboxclaim-reaper",onEvent:(W)=>{if(W.type!=="DELETED")return;let K=W.object.metadata?.name;if(K)J(K)}})}async function vC0($){let{kc:Z,path:Q,signal:Y,label:X,onEvent:J}=$,G=0;while(!Y.aborted){try{let K=await iK(Z,{method:"GET",path:Q,signal:Y,headers:{accept:"application/json"},stream:!0});if(!K.ok||!K.body){try{await K.body?.cancel()}catch{}if(K.status===401||K.status===403){console.warn(`[lifecycle-watcher] ${X} stopped: watch denied (${K.status} ${K.statusText}). `+"The kubeconfig in use cannot watch SandboxClaims \u2014 if you are running locally, "+"this provider should not be active (check STUDIO_AGENT_SANDBOX_ENABLED).");return}throw Error(`watch handshake failed: ${K.status} ${K.statusText}`)}G=0;for await(let H of _g$(K.body)){if(Y.aborted)return;try{J(H)}catch(F){console.warn(`[lifecycle-watcher] ${X} onEvent threw: ${F instanceof Error?F.message:String(F)}`)}}}catch(K){if(Y.aborted)return;let H=K instanceof Error?K.message:String(K);console.warn(`[lifecycle-watcher] ${X} watch ended: ${H}`)}if(Y.aborted)return;let W=k7(5000,250,G,2,0);G+=1,await J$(W,{signal:Y}).catch(()=>{})}}var qq6="studio.decocms.com/sandbox-handle",Rq6=300000,Mq6=600000;var Pi$=L(()=>{n$();Z50();Fj0()});import{createHash as Sq6}from"crypto";import{z as vJ}from"zod";function tK($){let Z;try{Z=new URL($.trim())}catch{return null}if(Z.protocol!=="https:"||Z.search||Z.hash)return null;let Q=Z.pathname.replace(/\/+$/,"").replace(/\.git$/,"").replace(/\/+$/,"");return Q?`https://${Z.host.toLowerCase()}${Q}`:null}function R50($){return tK($)?.toLowerCase()??null}function fq6($){let Z=new Set;for(let Q of $){let Y=`${R50(Q.repoUrl)??Q.repoUrl}#${Q.branch}`;if(Z.has(Y))return Q;Z.add(Y)}return null}function zi$($){return $.reduce((Z,Q)=>Z+Q.replicas,0)}function Ti$($,Z){if(Z.warmPoolName)return Z.warmPoolName;let Q=Sq6("sha256").update(`${Z.repoUrl}#${Z.branch}`).digest("hex").slice(0,8);return`${$}-${Q}`}function qi$($){return Math.max(0,$.size-zi$($.repos))}function Tn($){return $.flatMap((Z)=>Z.repos.map((Q)=>({pool:Z,repo:Q,warmPoolName:Ti$(Z.name,Q)})))}function yq6($,Z){return Ii$(void 0,$,!0,Z)}function Ri$($,{templateName:Z}){let Q=yq6(Z,$.image),Y=(X,J)=>({apiVersion:`${G7.CLAIM_API_GROUP}/${G7.CLAIM_API_VERSION}`,kind:"SandboxWarmPool",metadata:{name:X,labels:{[gq6]:$.name}},spec:{replicas:J,updateStrategy:{type:"OnReplenish"},sandboxTemplateRef:{name:Q}}});return[...$.repos.map((X)=>Y(Ti$($.name,X),X.replicas)),Y($.name,qi$($))]}function Mi$($){return $.tenant?.orgId}function yK1($,Z){if(!Z.tenant)return null;let Q=$.filter((J)=>J.tenant===Z.tenant&&J.image===Z.image),Y=Z.cloneUrl?R50(Z.cloneUrl):null;if(Y){let J=Tn(Q).filter((W)=>R50(W.repo.repoUrl)===Y),G=J.find((W)=>W.repo.branch===Z.branch)??J[0];if(G)return G}let X=Q.find((J)=>qi$(J)>0);return X?{pool:X,repo:null,warmPoolName:X.name}:null}function Vi$($,Z,Q){return $?.warmPoolName??(Z?Q:"none")}function Ii$($,Z,Q=!1,Y){let X=Y&&Y!=="default"?`-${Y}`:"";return`${Z}${X}${$==="harness-run"||Q?"-medium":""}`}async function gK1($){let Z=Ii$($.purpose,$.templateName,$.tenantPool,$.sandboxImage);if(Z===$.templateName)return{name:Z,probes:$.probes};let Q=$.probes[Z]??null,Y=Q!==null&&$.now-Q.checkedAt<$.ttlMs?Q:{checkedAt:$.now,present:await $.exists(Z)},X={...$.probes,[Z]:Y};if(Y.present)return{name:Z,probes:X};if(Q?.present!==!1)$.onAbsent?.(Z);if($.sandboxImage&&$.sandboxImage!=="default")return gK1({...$,sandboxImage:void 0,probes:X});return{name:$.templateName,probes:X}}function hK1($,Z,Q){let Y=R50(Z);if(!Y)return[];let X=Q.replace(/^refs\/heads\//,"");return Tn($).filter(({repo:J})=>R50(J.repoUrl)===Y&&J.branch===X)}class uK1{source;dirty=new Set;pods=new Map;known=new Map;constructor($){this.source=$}pools(){return this.source()}resolve($){return yK1(this.pools(),$)}markDirty($,Z){let Q=hK1(this.pools(),$,Z).map((Y)=>Y.warmPoolName);for(let Y of Q)this.dirty.add(Y);return Q}takeDirty($){return this.dirty.delete($)}pod($){return this.pods.get($)}setPod($,Z){this.pods.set($,Z)}retainPods($,Z){for(let[Q,Y]of this.pods)if(Y.pool===$&&!Z.has(Q))this.pods.delete(Q)}retain($){let Z=new Map($.map((Y)=>[Y.warmPoolName,Y])),Q=[...this.known.values()].filter((Y)=>!Z.has(Y.warmPoolName));for(let Y of this.dirty)if(!Z.has(Y))this.dirty.delete(Y);for(let[Y,X]of this.pods)if(!Z.has(X.pool))this.pods.delete(Y);return this.known=Z,Q}}var _q6=54,vq6,bq6=2048,xq6,M50,bC0,fK1,Ai$,gq6="studio.decocms.com/tenant-pool";var V50=L(()=>{t4();Z50();vq6=/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/;xq6=vJ.object({runtime:vJ.enum(["node","bun","deno"]).default("node"),packageManager:vJ.enum(["npm","pnpm","yarn","bun","deno"]).optional(),packageManagerPath:vJ.string().optional(),devPort:vJ.number().int().positive().optional()}).default({runtime:"node"}),M50=vJ.object({repoUrl:vJ.string().max(bq6).transform(($,Z)=>{let Q=tK($);if(Q)return Q;return Z.addIssue({code:"custom",message:"repoUrl must be an https clone URL"}),vJ.NEVER}),branch:vJ.string().min(1).default("main"),workload:xq6,replicas:vJ.number().int().min(1)});bC0=class bC0 extends Error{poolName;size;allocated;constructor($,Z,Q){super(`pool ${$}: repos take ${Q} replicas, more than its size ${Z}`);this.poolName=$;this.size=Z;this.allocated=Q;this.name="TenantPoolCapacityError"}};fK1=vJ.object({name:vJ.string().max(_q6).regex(vq6,"pool name must be a DNS label (lowercase alphanumeric and '-')"),tenant:vJ.string().min(1).max(512),size:vJ.number().int().min(1),image:yN.default("default")}),Ai$=fK1.extend({repos:vJ.array(M50).default([])}).superRefine(($,Z)=>{let Q=fq6($.repos);if(Q)Z.addIssue({code:"custom",path:["repos"],message:`duplicate repo allocation ${Q.repoUrl}#${Q.branch}`});let Y=zi$($.repos);if(Y>$.size)Z.addIssue({code:"custom",path:["repos"],message:new bC0($.name,$.size,Y).message})})});async function ki$($,Z,Q){let Y=new Map;for(let X of $){let J=Z(X);if(!J)continue;let G=Y.get(J);if(G)G.push(X);else Y.set(J,[X])}await Promise.allSettled([...Y.values()].map(async(X)=>{for(let J of X)await Q(J).catch(()=>{})}))}function hq6($){try{let Z=new URL($);if(Z.hostname.toLowerCase()!=="github.com")return null;let[Q,Y]=Z.pathname.replace(/^\/+/,"").split("/"),X=Y?.replace(/\.git$/,"");return Q&&X?`${Q}/${X}`.toLowerCase():null}catch{return null}}function Ci$($){if($.repositoryId)return{repositoryId:$.repositoryId};let Z=$.connectionId?hq6($.cloneUrl):null;return $.connectionId&&Z?{connectionId:$.connectionId,repo:Z}:null}var Si$=L(()=>{V50()});async function qn($,Z,Q,Y){let X=(G)=>kC0(G.url,G.token,Z,Q),J=!(Q.body instanceof ReadableStream);try{let G=await X($);if(G.status!==401||!J)return G;let W=await Y.unauthorized();if(!W)return G;return await G.body?.cancel().catch(()=>{}),await X(W)}catch(G){if(!J)throw G;let W=await Y.unreachable();if(!W)throw G;return X(W)}}var xC0=L(()=>{Fh()});function bi$($,Z){return new Response(JSON.stringify(Z),{status:$,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function _i$($){let Z=new Headers;for(let[Q,Y]of $.headers.entries())if(!lq6.includes(Q.toLowerCase()))Z.set(Q,Y);return new Response($.body,{status:$.status,statusText:$.statusText,headers:Z})}function vi$($,Z){let Q=bi$($,{error:Z});return Q.headers.set("x-sandbox-preview-not-ready","1"),Q}async function Mn($,Z,Q){let Y=await Z.base();if(!Y)return vi$(404,"sandbox not found");let X=new URL($.url);if((X.pathname==="/_sandbox"||X.pathname.startsWith("/_sandbox/"))&&$.method!=="GET")return bi$(404,{error:"not found"});let G=(F)=>`${F}${X.pathname}${X.search}`,W=new Headers($.headers);for(let F of uq6)W.delete(F);let K=$.method!=="GET"&&$.method!=="HEAD",H={method:$.method,headers:W,body:K?$.body:void 0,redirect:"manual",signal:$.signal,duplex:K?"half":void 0};try{return _i$(await fetch(G(Y),H))}catch(F){let U=`${Y}${X.pathname}`;if(console.warn(`[${Q}] preview fetch to ${U} failed: ${F instanceof Error?F.message:String(F)}`),Z.invalidate(),$.method==="GET"||$.method==="HEAD"){let N=await Z.retryBase();if(N)try{return _i$(await fetch(G(N),H))}catch(B){console.warn(`[${Q}] preview fetch retry to ${U} failed: ${B instanceof Error?B.message:String(B)}`)}}return vi$(502,"sandbox daemon unreachable")}}var Rn="x-sandbox-preview-not-ready",uq6,lq6;var fC0=L(()=>{uq6=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length","upgrade"],lq6=["connection","keep-alive","transfer-encoding","content-encoding","content-length"]});import{createHash as cq6,randomBytes as mq6,randomUUID as xi$}from"crypto";import*as ci$ from"net";import{PassThrough as dq6}from"stream";function fi$($){if($ instanceof Error)return $.message;if($&&typeof $==="object"){let Z=$;if(Z.error instanceof Error)return Z.error.message;if(typeof Z.message==="string"&&Z.message)return Z.message}return String($)}function hi$($){return{pool:$.warmPoolName,org:$.pool.tenant}}class nK1{records=new Map;inflight=new Uh;activeGauge=new CC0;stateStore;previewUrlPattern;kubeConfig;capacityProbe;portForward;namespace;sandboxTemplateName;envName;tokenGenerator;idleTtlMs;metrics;previewGateway;sentinelToken;mintCloneUrl;mintPoolCloneUrl;mintOrgFsConfig;forwardPort;daemonAddress;persistCredentials;tenantPools;tenantPoolRefreshMs;templateProbes={};closed=!1;claimWatchAbort=new AbortController;constructor($={}){this.stateStore=$.stateStore??null,this.previewUrlPattern=$.previewUrlPattern??null,this.kubeConfig=$.kubeConfig??YR6(),this.portForward=new LK1(this.kubeConfig),this.namespace=$.namespace??iq6,this.sandboxTemplateName=$.sandboxTemplateName??pq6,this.envName=KR6($.envName),this.tokenGenerator=$.tokenGenerator??(()=>mq6(tq6).toString("hex")),this.idleTtlMs=$.idleTtlMs??sq6,this.metrics=$.meter?QR6($.meter):null,this.previewGateway=$.previewGateway&&$.previewUrlPattern?{...$.previewGateway}:null;let Z=$.sentinelToken?.trim()??"";this.sentinelToken=Z.length>0?Z:null,this.mintCloneUrl=$.mintCloneUrl,this.mintPoolCloneUrl=$.mintPoolCloneUrl,this.mintOrgFsConfig=$.mintOrgFsConfig,this.forwardPort=$.forwardPort,this.daemonAddress=$.daemonAddress??"forward",this.persistCredentials=$.persistCredentials??!0;let Q=$.tenantPools;if(this.tenantPools=this.sentinelToken===null?null:new uK1(typeof Q==="function"?Q:()=>Q??[]),this.sentinelToken===null&&(typeof Q==="function"||(Q?.length??0)>0))console.warn(`[${M6}] tenant pools configured without a sentinel token \u2014 ignoring them (warm-pool mode is off)`);this.tenantPoolRefreshMs=$.tenantPoolRefreshMs??aq6,this.startClaimReaper(),this.startCredentialRefresher(),this.startTenantPoolReconciler()}startClaimReaper(){let $=["app.kubernetes.io/managed-by=studio","app.kubernetes.io/name=studio-sandbox",...this.envName?[`${bJ.env}=${this.envName}`]:[]].join(",");Ei$({kc:this.kubeConfig,namespace:this.namespace,labelSelector:$,signal:this.claimWatchAbort.signal,onDelete:(Z)=>this.invalidateRecord(Z)})}async ensure($,Z={}){let Q=HW($);if(Q.startsWith("s-"))throw Error(`ensure: projectRef has no slug source: ${$.projectRef}`);return this.inflight.run(Q,()=>SC0(this.stateStore,$,(Y)=>this.ensureLocked($,Q,Z,Y)))}async delete($){let Z=await this.getRecord($);if(this.records.delete($),Z)this.dropRecord(Z);if(await this.deleteHttpRouteIfManaged($).catch((Q)=>{console.warn(`[${M6}] HTTPRoute delete failed for ${$}: ${Q instanceof Error?Q.message:String(Q)}`)}),await fR(this.kubeConfig,this.namespace,$),this.stateStore)if(Z)await this.stateStore.delete(Z.id);else await this.stateStore.deleteByHandle($)}lastTermination($){return Tg$(this.kubeConfig,this.namespace,bJ.sandboxHandle,$,G7.MAIN_CONTAINER_NAME)}async alive($){return await QO(this.kubeConfig,this.namespace,$)!==void 0}watchClaimLifecycle($,Z){return ji$({kc:this.kubeConfig,namespace:this.namespace,claimName:$,signal:Z})}hasSchedulableCapacity(){return this.capacityProbe??=bg$(this.kubeConfig,this.namespace),this.capacityProbe()}async getPreviewUrl($){let Z=await this.getRecord($);if(!Z)return null;return this.composePreviewUrl(Z)}async proxyDaemonRequest($,Z,Q){let Y=await this.getRecord($);if(!Y&&this.previewUrlPattern&&this.stateStore){let K=await this.stateStore.getByHandle($),H=K?.state,F=H?.token;if(K&&F){let N=`http://${H?.adoptedSandboxName??$}.${this.namespace}.svc.cluster.local:${jB}`;try{let B=await kC0(N,F,Z,Q);if(B.status!==404)return B;try{await B.body?.cancel()}catch{}}catch{}}}if(!Y)Y=await this.resurrectByHandle($);if(!Y)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let X=Y,J=performance.now(),G=0,W=(K)=>{return X=K,{url:K.daemonUrl,token:K.token}};try{let K=await qn(W(Y),Z,Q,{unauthorized:async()=>{this.invalidateRecord($);let H=await this.getRecord($).catch(()=>null)??await this.resurrectByHandle($).catch(()=>null);return H?W(H):null},unreachable:async()=>{this.invalidateRecord($);let H=await this.resurrectByHandle($)??await this.getRecord($).catch(()=>null);return H?W(H):null}});return G=K.status,K}finally{this.recordProxyDuration("daemon",G,X,performance.now()-J)}}async adoptLiveClaim($,Z){if(this.records.has(Z))return!0;let Q=await QO(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!Q||Q.metadata?.deletionTimestamp)return!1;return await this.inflight.run(Z,async()=>{let X=this.records.get(Z);if(X)return this.toSandbox(X);let J=await this.adopt($,Z,Q);if(!J)throw Error(`cannot adopt live claim ${Z}`);return SC0(this.stateStore,$,(G)=>this.finish(J,G,!0,!0,"adopt"))}).catch(()=>null)!=null}async resolvePreviewUpstreamUrl($){if(this.previewUrlPattern)return`http://${await this.resolveServiceNameForHandle($)}.${this.namespace}.svc.cluster.local:${jB}`;let Z=await this.getRecord($);if(Z)return Z.daemonUrl;let Q=await this.resurrectByHandle($);return Q?Q.daemonUrl:null}async daemonEndpoint($){let Z=await this.getRecord($)??await this.resurrectByHandle($);if(!Z)return null;return{url:this.daemonAddress==="service"?`http://${Z.adoptedSandboxName}.${this.namespace}.svc.cluster.local:${jB}`:Z.daemonUrl,token:Z.token}}listSandboxes(){return[...this.records.values()].map(($)=>{let Z=$.ensureOpts,Q=Z?.tenant;return{handle:$.handle,tenant:Q?{orgId:Q.orgId,userId:Q.userId}:null,repos:[Z?.repo,...Z?.extraRepos??[]].filter((Y)=>Y!==void 0).map(Ci$).filter((Y)=>Y!==null),orgFs:Boolean(Z?.orgFsConfigJson)||$.orgFsRedacted===!0}})}async resolveServiceNameForHandle($){let Z=this.records.get($);if(Z)return Z.adoptedSandboxName;if(this.stateStore){let Y=(await this.stateStore.getByHandle($).catch(()=>null))?.state?.adoptedSandboxName;if(Y)return Y}return $}async proxyPreviewRequest($,Z){let Q=performance.now(),Y=this.records.get($)??null,X=0;try{let J=await Mn(Z,{base:()=>this.resolvePreviewUpstreamUrl($),invalidate:()=>this.invalidateRecord($),retryBase:async()=>{return await this.resurrectByHandle($).catch(()=>null)?this.resolvePreviewUpstreamUrl($):null}},M6);return X=J.status,J}finally{this.recordProxyDuration("preview",X,Y,performance.now()-Q,$)}}async ensureLocked($,Z,Q,Y){if(Q.image)console.warn(`[${M6}] opts.image ignored (template ${this.sandboxTemplateName} pins image): got ${Q.image}`);if(Y){let G=await Y.get($);if(G){let W=await this.rehydrate($,Z,G);if(W)return await this.refreshDaemonGitCredential(W,Q),await this.relayOrgFsConfig(W.daemonUrl,W.token,Q.orgFsConfigJson),this.finish(W,Y,!1,!0,"resume");await Y.delete($)}}let X=await QO(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(X)if(X.metadata?.deletionTimestamp)await X50(this.kubeConfig,this.namespace,Z).catch((G)=>{console.warn(`[${M6}] wait for terminating claim ${Z} failed: ${G instanceof Error?G.message:String(G)}`)});else if(!lK1(X)){let G=await this.join($,Z,Q,X).catch((W)=>{return console.warn(`[${M6}] join of starting claim ${Z} failed, recreating: ${W instanceof Error?W.message:String(W)}`),null});if(G)return this.finish(G,Y,!0,!0,"adopt");await fR(this.kubeConfig,this.namespace,Z).catch(()=>{}),await X50(this.kubeConfig,this.namespace,Z).catch((W)=>{console.warn(`[${M6}] wait for deleted claim ${Z} failed: ${W instanceof Error?W.message:String(W)}`)})}else{let G=await this.adopt($,Z,X).catch((W)=>{return console.warn(`[${M6}] adopt ${Z} failed, recreating: ${W instanceof Error?W.message:String(W)}`),null});if(G)return await this.refreshDaemonGitCredential(G,Q),await this.relayOrgFsConfig(G.daemonUrl,G.token,Q.orgFsConfigJson),this.finish(G,Y,!0,!0,"adopt");await fR(this.kubeConfig,this.namespace,Z).catch(()=>{}),await X50(this.kubeConfig,this.namespace,Z).catch((W)=>{console.warn(`[${M6}] wait for deleted claim ${Z} failed: ${W instanceof Error?W.message:String(W)}`)})}let J=await this.provision($,Z,Q);return this.finish(J,Y,!0,!1,"fresh")}async finish($,Z,Q,Y,X){let J=this.records.get($.handle),G=J!==void 0;if(J&&J.daemonForward!==$.daemonForward)this.closeForwarder(J.daemonForward);if(this.records.set($.handle,$),Q)await this.persist(Z,$);if(Y)await Hj0(this.kubeConfig,this.namespace,$.handle,this.computeShutdownTime()).catch((W)=>console.warn(`[${M6}] TTL refresh failed for ${$.handle}: ${W instanceof Error?W.message:String(W)}`));if(this.metrics){let W=dK1($.tenant);if(this.metrics.ensureOutcome.add(1,{...W,outcome:X}),!G)this.metrics.active.add(1,W),this.activeGauge.markCounted($.handle)}return this.toSandbox($)}buildEnvMap($,Z){let Q={},Y=[];for(let[X,J]of Object.entries($.env??{}))if(oq6.has(X))Y.push(X);else Q[X]=J;if(Y.length>0)console.warn(`[${M6}] opts.env keys overlap reserved bootstrap names and were dropped: ${Y.join(",")}`);return{...Q,DAEMON_TOKEN:Z.token,DAEMON_BOOT_ID:Z.daemonBootId,APP_ROOT:Z.workdir,PROXY_PORT:String(jB)}}async resolveTemplateName($,Z,Q){let{name:Y,probes:X}=await gK1({purpose:$,tenantPool:Z,...Q?{sandboxImage:Q}:{},templateName:this.sandboxTemplateName,probes:this.templateProbes,now:Date.now(),ttlMs:nq6,exists:(J)=>Eg$(this.kubeConfig,this.namespace,J),onAbsent:(J)=>console.warn(`[${M6}] SandboxTemplate ${J} not found (or not readable) \u2014 this claim falls back to a template without that suffix. Upgrade the sandbox-env chart to the version that renders it.`)});return this.templateProbes=X,Y}buildClaim($,Z,Q,Y,X){let J=this.sentinelToken!==null,G=J?[]:Object.entries(this.buildEnvMap(Z,Q)).sort(([H],[F])=>H<F?-1:H>F?1:0).map(([H,F])=>({name:H,value:F})),W=UR6(Z),K=Object.keys(W).length>0;return{apiVersion:`${G7.CLAIM_API_GROUP}/${G7.CLAIM_API_VERSION}`,kind:"SandboxClaim",metadata:{name:$,namespace:this.namespace,labels:{"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[bJ.env]:this.envName}:{},...mK1(Z.tenant)},...K?{annotations:W}:{}},spec:{sandboxTemplateRef:{name:X},additionalPodMetadata:{labels:mK1(Z.tenant,{[bJ.role]:"claimed",[bJ.sandboxHandle]:$,...this.envName?{[bJ.env]:this.envName}:{}}),...K?{annotations:W}:{}},env:G,warmpool:Vi$(Y,J,X),lifecycle:{shutdownPolicy:"Delete",shutdownTime:this.computeShutdownTime()}}}}async provision($,Z,Q){let Y=this.tokenGenerator(),X=xi$(),J=yC0,G=this.claimTenantPoolBinding(Q),W=this.buildClaim(Z,Q,{token:Y,daemonBootId:X,workdir:J},G,await this.resolveTemplateName(Q.purpose,G!==null,Q.sandboxImage));try{await f31(this.kubeConfig,this.namespace,W)}catch(K){if(K instanceof $50)await X50(this.kubeConfig,this.namespace,Z),await f31(this.kubeConfig,this.namespace,W);else throw K}return this.bind($,Z,Q,G,{token:Y,daemonBootId:X,workdir:J})}claimTenantPoolBinding($){return this.tenantPools?.resolve({tenant:Mi$($),image:$.sandboxImage??"default",cloneUrl:$.repo?.cloneUrl,branch:$.repo?.branch})??null}async bind($,Z,Q,Y,{token:X,daemonBootId:J,workdir:G}){let W;try{W=await Pg$(this.kubeConfig,this.namespace,Z),await wi$((B)=>this.watchClaimLifecycle(Z,B))}catch(B){throw await fR(this.kubeConfig,this.namespace,Z).catch(()=>{}),B}try{await this.ensureServicePortForAdoptedSandbox(W),await this.ensureHttpRouteForHandle(Z,W,Q.tenant??null)}catch(B){throw await fR(this.kubeConfig,this.namespace,Z).catch(()=>{}),B}let K=await this.openForwarder(W,jB,Z),H=`http://127.0.0.1:${K.localPort}`,F=Y?.repo!=null&&W!==Z,U=this.workloadConfigPayload(Q,F),N=J;try{if(await vK1(H),this.sentinelToken!==null){let B=await VC0(H);if(B)N=B.bootId;try{await nK(H,this.sentinelToken,U??{},{rotateToken:X})}catch(D){if(D instanceof IY&&D.status===401)console.warn(`[${M6}] sentinel rejected by adopted pod (handle=${Z}, sandbox=${W}): pod belongs to another claim; tearing down and reprovisioning`);throw D}}else if(U)await nK(H,X,U);await this.relayOrgFsConfig(H,X,Q.orgFsConfigJson)}catch(B){throw this.closeForwarder(K),await this.deleteHttpRouteIfManaged(Z).catch(()=>{}),await fR(this.kubeConfig,this.namespace,Z).catch(()=>{}),B}return{id:$,handle:Z,adoptedSandboxName:W,token:X,workdir:G,daemonUrl:H,daemonForward:K,workload:Q.workload??null,daemonBootId:N,tenant:Q.tenant??null,tenantPoolPodBound:F,ensureOpts:jR6(Q)}}workloadConfigPayload($,Z){return zn({runtime:$?.workload?.runtime??"node",packageManager:$?.workload?.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:$?.repo??null,extraRepos:$?.extraRepos??[],port:$?.workload?.devPort??yi$,tenant:$?.tenant??void 0,...$?{cloneOnly:$.cloneOnly===!0&&!Z}:{}})}async relayOrgFsConfig($,Z,Q){if(!Q)return;await IC0($,Z,Q).catch((Y)=>console.warn("[org-fs] sidecar config relay failed",Y))}async refreshDaemonGitCredential($,Z){let Q=q50(Z);if(!Q)return;try{await nK($.daemonUrl,$.token,Q)}catch(Y){console.warn(`[${M6}] git credential refresh failed for ${$.handle}: ${Y instanceof Error?Y.message:String(Y)}`)}}async withFreshCloneUrl($,Z={}){if(!this.mintCloneUrl)return $;try{let Q=await this.mintCloneUrl($,Z);if(!Q)return $;let{credentialExpiresAt:Y,...X}=$;return{...X,cloneUrl:Q}}catch(Q){return console.warn(`[${M6}] clone credential re-mint failed: ${Q instanceof Error?Q.message:String(Q)}`),$}}async withFreshCredentials($,Z=!1){return{...$,...$.repo?{repo:await this.withFreshCloneUrl($.repo,{tenant:$.tenant})}:{},...$.orgFsConfigJson||Z?{orgFsConfigJson:await LR6($,this.mintOrgFsConfig)}:{}}}startCredentialRefresher(){if(!this.mintCloneUrl)return;let{signal:$}=this.claimWatchAbort;(async()=>{while(!$.aborted){if(await J$(eq6,{signal:$}).catch(()=>{}),$.aborted)break;try{await this.refreshAllGitCredentials()}catch(Z){console.warn(`[${M6}] periodic credential refresh failed: ${Z instanceof Error?Z.message:String(Z)}`)}}})()}startTenantPoolReconciler(){let $=this.tenantPools;if(!$)return;let{signal:Z}=this.claimWatchAbort;(async()=>{while(!Z.aborted){try{await this.reconcileTenantPools($)}catch(Q){console.warn(`[${M6}] tenant pool reconcile failed: ${Q instanceof Error?Q.message:String(Q)}`)}await J$(rq6,{signal:Z}).catch(()=>{})}})()}listTenantPools(){return this.tenantPools?.pools()??[]}markTenantPoolsDirty($,Z){return Promise.resolve(this.tenantPools?.markDirty($,Z)??[])}async reconcileTenantPools($){let Z=Tn($.pools());for(let Q of $.retain(Z))this.recordPoolGone(Q);for(let Q of Z){let Y=Q.warmPoolName,X=await zg$(this.kubeConfig,this.namespace,Y);if(X===null){console.warn(`[${M6}] tenant pool ${Y}: no SandboxWarmPool (or no selector yet) in ${this.namespace}`);continue}let J=$.takeDirty(Y),G=X.filter((W)=>!W.labels[bJ.sandboxHandle]);$.retainPods(Y,new Set(X.map((W)=>W.uid)));for(let W of G){if(this.claimWatchAbort.signal.aborted)return;await this.warmPoolPod($,Q,W,J)}this.recordPoolDepth($,Q,X,G)}}recordPoolGone($){let Z=hi$($);for(let Q of["ready","bound","pending","failed"])this.metrics?.poolPods.record(0,{...Z,state:Q})}recordPoolDepth($,Z,Q,Y){let X=this.metrics?.poolPods;if(!X)return;let J=0,G=0;for(let K of Y){let H=$.pod(K.uid);if(!H)continue;if(H.failures>=gC0)G++;else if(H.lastConfigAt>0)J++}let W=hi$(Z);X.record(J,{...W,state:"ready"}),X.record(Q.length-Y.length,{...W,state:"bound"}),X.record(Y.length-J-G,{...W,state:"pending"}),X.record(G,{...W,state:"failed"})}async warmPoolPod($,Z,Q,Y){let X=Z.warmPoolName,{workload:J}=Z.repo,G=$.pod(Q.uid);if(G&&G.failures>=gC0){if(Date.now()-G.lastFailureAt<gi$)return;$.setPod(Q.uid,{...G,failures:0})}let W=Y||G!==void 0&&Date.now()-G.lastConfigAt>=this.tenantPoolRefreshMs;if(G&&!W)return;let K=await this.allocationCloneUrl(Z);if(!K){this.recordPoolFailure($,Q,X,"clone credential mint failed");return}let H={cloneUrl:K,branch:Z.repo.branch,userName:"",userEmail:""},F=await this.openForwarder(Q.name,jB,Q.name).catch(()=>null);if(!F){this.recordPoolFailure($,Q,X,"port-forward failed");return}let U=`http://127.0.0.1:${F.localPort}`;try{await vK1(U);let N=this.sentinelToken;if(!N)return;if(!await this.isPoolPodUnbound(Q))return;let B=zn({runtime:J.runtime,packageManager:J.packageManager?{name:J.packageManager,...J.packageManagerPath?{path:J.packageManagerPath}:{}}:null,repo:H,port:J.devPort??yi$})??{},{transition:D}=await nK(U,N,B);if(W&&D!=="bootstrap"&&await this.isPoolPodUnbound(Q))await Hi$(U,N,"clone");$.setPod(Q.uid,{pool:X,lastConfigAt:Date.now(),lastFailureAt:0,failures:0}),console.log(`[${M6}] tenant pool ${X}: warmed ${Q.name} (${D})`)}catch(N){this.recordPoolFailure($,Q,X,N instanceof Error?N.message:String(N))}finally{this.closeForwarder(F)}}async allocationCloneUrl({pool:$,repo:Z}){if(!this.mintPoolCloneUrl)return`${Z.repoUrl}.git`;try{return await this.mintPoolCloneUrl({tenant:$.tenant,repoUrl:Z.repoUrl,branch:Z.branch})}catch(Q){return console.warn(`[${M6}] tenant pool clone credential mint failed: ${Q instanceof Error?Q.message:String(Q)}`),null}}isPoolPodUnbound($){return Ag$(this.kubeConfig,this.namespace,$.name,bJ.sandboxHandle)}recordPoolFailure($,Z,Q,Y){let X=$.pod(Z.uid),J=(X?.failures??0)+1;$.setPod(Z.uid,{pool:Q,lastConfigAt:X?.lastConfigAt??0,lastFailureAt:Date.now(),failures:J});let G=J>=gC0?` \u2014 backing off ${gi$/60000}min`:"";console.warn(`[${M6}] tenant pool ${Q}: warming ${Z.name} failed (${J}/${gC0})${G}: ${Y}`)}async refreshAllGitCredentials(){await ki$(this.records.values(),($)=>$.ensureOpts?.repo?.connectionId,async($)=>{if(this.claimWatchAbort.signal.aborted)return;let Z=$.ensureOpts?.repo;if(!Z)return;try{let Q=await this.withFreshCloneUrl(Z,{bufferMs:$R6,tenant:$.ensureOpts?.tenant});await this.refreshDaemonGitCredential($,{...$.ensureOpts,repo:Q}),$.ensureOpts={...$.ensureOpts,repo:Q}}catch(Q){throw console.warn(`[${M6}] git credential refresh failed for ${$.handle}: ${Q instanceof Error?Q.message:String(Q)}`),Q}})}async rebootstrapDaemon($,Z,Q){if(this.sentinelToken===null)return!1;let Y=this.workloadConfigPayload(Q,!1)??{};try{return await nK($,this.sentinelToken,Y,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,Q?.orgFsConfigJson),!0}catch(X){if(X instanceof IY&&X.status===401)try{return await nK($,Z,Y,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,Q?.orgFsConfigJson),!0}catch(J){return console.warn(`[${M6}] re-bootstrap retry with claim token failed: ${J instanceof Error?J.message:String(J)}`),!1}return console.warn(`[${M6}] re-bootstrap failed: ${X instanceof Error?X.message:String(X)}`),!1}}async ensureServicePortForAdoptedSandbox($){if(!this.previewGateway||!this.previewUrlPattern)return;await Sg$(this.kubeConfig,this.namespace,$,{name:"daemon",port:jB,targetPort:jB})}async ensureHttpRouteForHandle($,Z,Q){if(!this.previewGateway||!this.previewUrlPattern)return;let Y=wR6(this.previewUrlPattern,$);if(!Y)throw new qX(`Unable to derive preview hostname for ${$} from pattern: ${this.previewUrlPattern}`);let X={apiVersion:`${g31.API_GROUP}/${g31.API_VERSION}`,kind:"HTTPRoute",metadata:{name:$,namespace:this.namespace,labels:mK1(Q??void 0,{[bJ.role]:"claimed",[bJ.sandboxHandle]:$,"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[bJ.env]:this.envName}:{}})},spec:{parentRefs:[{kind:"Gateway",group:"gateway.networking.k8s.io",name:this.previewGateway.name,namespace:this.previewGateway.namespace}],hostnames:[Y],rules:[{backendRefs:[{group:"",kind:"Service",name:Z,port:jB}]}]}};await Ig$(this.kubeConfig,this.namespace,X)}async deleteHttpRouteIfManaged($){if(!this.previewGateway)return;await kg$(this.kubeConfig,this.namespace,$)}async rehydrate($,Z,Q){let Y=Q.state;if(!Y.adoptedSandboxName&&!Y.podName||!Y.token)return null;let X=await QO(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!X||!lK1(X))return null;let J=X.status?.sandbox?.name??Y.adoptedSandboxName??Y.podName??Z,G=await this.openAndProbeDaemon(J,Z);if(!G)return null;if(Y.daemonBootId&&Y.daemonBootId!==G.bootId){if(this.sentinelToken!==null){let W=Y.ensureOpts?await this.withFreshCredentials(Y.ensureOpts,Y.orgFsRedacted===!0):null;if(!await this.rebootstrapDaemon(G.daemonUrl,Y.token,W))return this.closeForwarder(G.daemonForward),null}else console.warn(`[${M6}] daemon restart detected (handle=${Z}): stored bootId=${Y.daemonBootId} live bootId=${G.bootId}`);await this.stateStore?.put($,{handle:Z,state:{...Y,daemonBootId:G.bootId}}).catch((W)=>console.warn(`[${M6}] bootId persist failed for ${Z}: ${W instanceof Error?W.message:String(W)}`))}return{id:$,handle:Z,adoptedSandboxName:J,tenantPoolPodBound:!1,token:Y.token,workdir:Y.workdir??yC0,daemonUrl:G.daemonUrl,daemonForward:G.daemonForward,workload:Y.workload??null,daemonBootId:G.bootId,tenant:Y.tenant??null,ensureOpts:Y.ensureOpts??null,orgFsRedacted:Y.orgFsRedacted===!0}}join($,Z,Q,Y){let X=this.sentinelToken!==null,J=X?this.tokenGenerator():cK1(Y,"DAEMON_TOKEN"),G=X?xi$():cK1(Y,"DAEMON_BOOT_ID");if(!J||!G)throw new qX(`claim ${Z} carries no daemon token`);return this.bind($,Z,Q,this.claimTenantPoolBinding(Q),{token:J,daemonBootId:G,workdir:yC0})}async adopt($,Z,Q){if(!lK1(Q))return null;let Y=Q.status?.sandbox?.name??Z;if(this.sentinelToken!==null)return null;let X=cK1(Q,"DAEMON_TOKEN");if(!X)return null;let J=await this.openAndProbeDaemon(Y,Z);if(!J)return null;let G=NR6(Q);if(this.previewGateway)await this.ensureServicePortForAdoptedSandbox(Y).catch((W)=>{console.warn(`[${M6}] Service port backfill failed for ${Z}: ${W instanceof Error?W.message:String(W)}`)}),await this.ensureHttpRouteForHandle(Z,Y,G).catch((W)=>{console.warn(`[${M6}] HTTPRoute backfill failed for ${Z}: ${W instanceof Error?W.message:String(W)}`)});return{id:$,handle:Z,adoptedSandboxName:Y,tenantPoolPodBound:!1,token:X,workdir:yC0,daemonUrl:J.daemonUrl,daemonForward:J.daemonForward,workload:null,daemonBootId:J.bootId,tenant:G,ensureOpts:null}}async openAndProbeDaemon($,Z){let Q=await this.openForwarder($,jB,Z).catch(()=>null);if(!Q)return null;let Y=`http://127.0.0.1:${Q.localPort}`,X=await VC0(Y);if(!X)return this.closeForwarder(Q),null;return{daemonForward:Q,daemonUrl:Y,bootId:X.bootId}}async getRecord($){let Z=this.records.get($);if(Z)return Z;if(!this.stateStore)return null;let Q=await this.stateStore.getByHandle($);if(!Q)return null;let Y=await this.rehydrate(Q.id,$,Q);if(Y)this.records.set($,Y);return Y}async resurrectByHandle($){if(!this.stateStore)return null;let Z=await this.stateStore.getByHandle($);if(!Z)return null;let Q=Z.state,Y=Q.ensureOpts;if(!Y)return null;let X=await this.withFreshCredentials(Y,Q.orgFsRedacted===!0);if(HW(Z.id)!==$)return null;return await this.ensure(Z.id,X),this.records.get($)??null}invalidateRecord($){let Z=this.records.get($);if(!Z)return;this.records.delete($),this.dropRecord(Z)}dropRecord($){if(this.closeForwarder($.daemonForward),this.metrics&&this.activeGauge.consume($.handle))this.metrics.active.add(-1,dK1($.tenant))}recordProxyDuration($,Z,Q,Y,X){if(!this.metrics)return;this.metrics.proxyDurationMs.record(Y,{...dK1(Q?.tenant??null),source:$,sandbox_handle:Q?.handle??X??"",status_code:Z||0})}composePreviewUrl($){if(this.previewUrlPattern)return _C0(this.previewUrlPattern,$.handle);return`http://127.0.0.1:${$.daemonForward.localPort}/`}toSandbox($){return{handle:$.handle,workdir:$.workdir,previewUrl:this.composePreviewUrl($),warmPoolAdopted:$.tenantPoolPodBound===!0,provider:"kubernetes"}}async persist($,Z){if(!$)return;let Q={adoptedSandboxName:Z.adoptedSandboxName,token:Z.token,workdir:Z.workdir,workload:Z.workload,daemonBootId:Z.daemonBootId,tenant:Z.tenant,...Z.ensureOpts?this.persistCredentials?{ensureOpts:Z.ensureOpts}:OR6(Z.ensureOpts,Z.orgFsRedacted===!0):{}};await $.put(Z.id,{handle:Z.handle,state:Q})}computeShutdownTime(){return new Date(Date.now()+this.idleTtlMs).toISOString()}async releaseAfter($,Z){let Q=await QO(this.kubeConfig,this.namespace,$);if(!Q)return;let Y=BR6(Q.spec?.lifecycle?.shutdownTime,new Date(Date.now()+Z));if(!Y)return;await Hj0(this.kubeConfig,this.namespace,$,Y).catch((X)=>console.warn(`[${M6}] release failed for ${$}: ${X instanceof Error?X.message:String(X)}`))}async renewTtl($){let Z=await QO(this.kubeConfig,this.namespace,$);if(!Z)return;let Q=DR6(Z.spec?.lifecycle?.shutdownTime,new Date(Date.now()+this.idleTtlMs));if(!Q)return;await Hj0(this.kubeConfig,this.namespace,$,Q).catch((Y)=>console.warn(`[${M6}] TTL renew failed for ${$}: ${Y instanceof Error?Y.message:String(Y)}`))}openForwarder($,Z,Q=$){if(this.forwardPort)return this.forwardPort($,Z,Q);let Y=XR6(Q,Z);return new Promise((X,J)=>{let G=(W,K)=>{let H=ci$.createServer((F)=>this.handleForwardedConnection(F,$,Z,Q));H.once("error",(F)=>{if(F.code==="EADDRINUSE"&&K<ZR6){try{H.close()}catch{}let U=iK1+(W-iK1+1)%mi$;G(U,K+1);return}J(F)}),H.listen(W,"127.0.0.1",()=>{let F=H.address();if(!F||typeof F==="string"){H.close(),J(Error("port-forward listener failed to bind"));return}let U=F.port;X({localPort:U,close:()=>H.close((N)=>{if(N)console.warn(`[${M6}] port-forward close on :${U} errored: ${N.message}`)})})})};G(Y,0)})}handleForwardedConnection($,Z,Q,Y){let X=new dq6,J=null,G=!1,W=()=>{if(G)return;if(G=!0,X.destroy(),J)try{J.close()}catch{}if(!$.destroyed)$.destroy()};$.pipe(X),$.on("error",W),$.on("close",W),this.portForward.portForward(this.namespace,Z,[Q],$,null,X).then((K)=>{let H=typeof K==="function"?K():K;if(!H){W();return}if(J=H,J.on("close",W),J.on("error",(F)=>{console.warn(`[${M6}] port-forward to ${Z}:${Q} dropped mid-connection: ${fi$(F)}`,JSON.stringify(pK1(F))),this.invalidateRecord(Y),W()}),G)try{J.close()}catch{}}).catch((K)=>{console.warn(`[${M6}] port-forward to ${Z}:${Q} failed: ${fi$(K)}`,JSON.stringify(pK1(K))),this.invalidateRecord(Y),W()})}closeForwarder($){$.close()}close(){if(this.closed)return;this.closed=!0,this.claimWatchAbort.abort();for(let $ of this.records.values())this.dropRecord($);this.records.clear()}}function QR6($){return{active:$.createUpDownCounter("studio.sandbox.active",{description:"Active sandbox count, by runner kind, owning org, and daemon impl. Cross-checks the cAdvisor-derived count from the cluster \u2014 divergence between the two indicates orphaned claims (studio deleted but K8s didn't reap) or unattributed pods.",unit:"{sandbox}"}),ensureOutcome:$.createCounter("studio.sandbox.ensure.outcome",{description:"Outcome of each ensure() call: fresh provision, resume from state-store after restart, or adopt of a cluster-side claim studio didn't know about. Cold-start ratio is the primary input for warm-pool sizing.",unit:"{call}"}),proxyDurationMs:$.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of studio-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"}),poolPods:$.createGauge("studio.sandbox.pool.pods",{description:"Tenant warm pool depth by pool and state: ready (warmed and unbound \u2014 what a claim can actually bind instantly), bound (serving a user), pending (unbound, not yet warmed), failed (gave up after repeated bootstrap failures). Alert on sustained ready=0: a pool that is always empty is doing nothing while costing N pods.",unit:"{pod}"})}}function pK1($){let Z=[],Q=$;for(let Y=0;Y<5&&Q instanceof Error;Y++){let X=Q;if(Z.push({name:X.name,message:X.message,...X.code!==void 0?{code:X.code}:{},...X.errno!==void 0?{errno:X.errno}:{}}),X.cause===Q)break;Q=X.cause}if(Q!==void 0&&!(Q instanceof Error)&&Q!==null){let Y=Q,X=Y.error instanceof Error?pK1(Y.error).chain:void 0;Z.push({nonError:String(Q),...typeof Y.type==="string"?{type:Y.type}:{},...typeof Y.message==="string"?{message:Y.message}:{},...Y.code!==void 0?{code:Y.code}:{},...typeof Y.reason==="string"?{reason:Y.reason}:{},...X?{error:X}:{},...X===void 0&&Y.error!==void 0?{rawError:String(Y.error)}:{},keys:Object.keys(Y)})}return{chain:Z}}function YR6(){let $=new FC0;return $.loadFromDefault(),$}function lK1($){return Boolean($.status?.conditions?.some((Z)=>Z.type==="Ready"&&Z.status==="True"))}function cK1($,Z){let Q=$.spec?.env;if(!Q)return null;for(let Y of Q)if(Y.name===Z&&Y.value)return Y.value;return null}function XR6($,Z){let Q=cq6("sha256").update(`${$}:${Z}`).digest();return iK1+Q.readUInt32BE(0)%mi$}function ui$($){let Z=$.slice(0,GR6);return JR6.test(Z)?Z:""}function KR6($){if($===void 0)return null;let Z=$.trim();if(Z==="")return null;if(!WR6.test(Z))throw Error(`AgentSandboxProvider: envName=${JSON.stringify(Z)} is not a valid DNS-label-safe environment name (lowercase alphanumeric or '-', starts with a letter, ends alphanumeric, \u226432 chars). Studio sets this from STUDIO_ENV; check the studio chart's configMap.`);return Z}function mK1($,Z={}){let Q={...Z};if($){let Y=ui$($.orgId),X=ui$($.userId);if(Y)Q[bJ.orgId]=Y;if(X)Q[bJ.userId]=X}return Q}function Nh($){let Z="";for(let Q of $){let Y=Q.codePointAt(0)??0;Z+=Y<32||Y===127?" ":Q}return Z.slice(0,HR6)}function FR6($){try{let Z=new URL($);return Z.username="",Z.password="",Z.toString()}catch{return""}}function UR6($){let Z={},Q=$.tenant;if(Q?.orgSlug)Z[pF.orgSlug]=Nh(Q.orgSlug);if(Q?.orgName)Z[pF.orgName]=Nh(Q.orgName);if(Q?.userEmail)Z[pF.userEmail]=Nh(Q.userEmail);if(Q?.userName)Z[pF.userName]=Nh(Q.userName);let Y=$.repo;if(Y){if(Y.displayName)Z[pF.gitRepo]=Nh(Y.displayName);let X=FR6(Y.cloneUrl);if(X)Z[pF.gitRepoUrl]=Nh(X);let J=$.branch??Y.branch;if(J)Z[pF.gitBranch]=Nh(J)}return Z}function NR6($){let Z=$.metadata?.labels;if(!Z)return null;let Q=Z[bJ.orgId],Y=Z[bJ.userId];if(!Q||!Y)return null;let X=$.metadata?.annotations??{};return{orgId:Q,userId:Y,orgSlug:X[pF.orgSlug],orgName:X[pF.orgName],userEmail:X[pF.userEmail],userName:X[pF.userName]}}function BR6($,Z){if($){let Q=new Date($).getTime();if(Number.isFinite(Q)&&Q<=Z.getTime())return null}return Z.toISOString()}function DR6($,Z){if($){let Q=new Date($).getTime();if(Number.isFinite(Q)&&Q>=Z.getTime())return null}return Z.toISOString()}function dK1($){return{org_id:$?.orgId??"",user_id:$?.userId??"",runner_kind:"agent-sandbox"}}async function LR6($,Z){if(!Z||!$.tenant)return $.orgFsConfigJson;try{return await Z($.tenant)??$.orgFsConfigJson}catch(Q){return console.warn(`[${M6}] org-fs credential re-mint failed: ${Q instanceof Error?Q.message:String(Q)}`),$.orgFsConfigJson}}function li$($){try{let Z=new URL($.cloneUrl);Z.username="",Z.password="";let{submoduleCredentials:Q,credentialExpiresAt:Y,...X}=$;return{...X,cloneUrl:Z.toString()}}catch{return null}}function OR6($,Z){let{orgFsConfigJson:Q,repo:Y,extraRepos:X,...J}=$,G=J,W=Y&&li$(Y);if(W)G.repo=W;if(X)G.extraRepos=X.map(li$).filter((K)=>K!==null);return Q||Z?{ensureOpts:G,orgFsRedacted:!0}:{ensureOpts:G}}function jR6($){let Z={};if($.branch)Z.branch=$.branch;if($.repo)Z.repo=$.repo;if($.workload)Z.workload=$.workload;if($.env&&Object.keys($.env).length>0)Z.env=$.env;if($.tenant)Z.tenant=$.tenant;if($.cloneOnly)Z.cloneOnly=!0;if($.purpose)Z.purpose=$.purpose;if($.sandboxImage)Z.sandboxImage=$.sandboxImage;if($.orgFsConfigJson)Z.orgFsConfigJson=$.orgFsConfigJson;return Object.keys(Z).length>0?Z:null}function wR6($,Z){try{return new URL(_C0($,Z)).hostname||null}catch{return null}}var M6="AgentSandboxProvider",iq6="agent-sandbox-system",pq6="studio-sandbox",nq6=300000,jB=9000,yi$=3000,yC0="/app",tq6=32,oq6,sq6=900000,rq6=60000,aq6=1800000,gC0=3,gi$=1800000,eq6=900000,$R6=1800000,iK1=40000,mi$=1e4,ZR6=256,bJ,pF,JR6,GR6=63,WR6,HR6=253;var di$=L(()=>{n$();xg$();Gi$();Fh();An();Fj0();Z50();Pi$();V50();Si$();xC0();fC0();oq6=new Set(["DAEMON_TOKEN","DAEMON_BOOT_ID","APP_ROOT","PROXY_PORT"]);bJ={role:"studio.decocms.com/role",sandboxHandle:"studio.decocms.com/sandbox-handle",orgId:"studio.decocms.com/org-id",userId:"studio.decocms.com/user-id",env:"studio.decocms.com/env"},pF={orgSlug:"studio.decocms.com/org-slug",orgName:"studio.decocms.com/org-name",userEmail:"studio.decocms.com/user-email",userName:"studio.decocms.com/user-name",gitRepo:"studio.decocms.com/git-repo",gitRepoUrl:"studio.decocms.com/git-repo-url",gitBranch:"studio.decocms.com/git-branch"},JR6=/^([A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?)?$/;WR6=/^[a-z]([a-z0-9-]{0,30}[a-z0-9])?$/});var ii$={};O6(ii$,{tenantPoolSchema:()=>Ai$,tenantPoolRepoSchema:()=>M50,tenantPoolFieldsSchema:()=>fK1,tenantPoolAllocations:()=>Tn,resolveTenantPoolBinding:()=>yK1,renderTenantPoolWarmPools:()=>Ri$,normalizeRepoUrl:()=>tK,allocationsMatchingPush:()=>hK1,TenantPoolCapacityError:()=>bC0,PREVIEW_NOT_READY_HEADER:()=>Rn,AgentSandboxProvider:()=>nK1});var I50=L(()=>{di$();V50()});import{z as Bh}from"zod";function hC0($){if(!$||$.trim()==="")return[];let Z=Bh.array(ER6).parse(JSON.parse($)),Q=new Set;for(let Y of Z){if(Q.has(Y.name))throw Error(`tenant pools: duplicate pool name ${Y.name}`);Q.add(Y.name)}return Z}function pi$($){let Z=tK(`https://github.com/${$.repo}`);if(!Z)throw Error(`tenant pools: bad repo ${$.repo}`);return Z}function ni$($){return $.map((Z)=>({name:Z.name,tenant:Z.orgId,size:1,image:"default",repos:[{repoUrl:pi$(Z),branch:Z.branch,workload:Z.workload,replicas:1,warmPoolName:Z.name}]}))}function tK1($,Z){let Q=tK(Z.repoUrl)?.toLowerCase(),Y=$.find((J)=>J.orgId===Z.tenant&&J.branch===Z.branch&&pi$(J).toLowerCase()===Q);if(!Y)return null;let X=`https://github.com/${Y.repo}.git`;return Y.connectionId?{cloneUrl:X,connectionId:Y.connectionId}:{cloneUrl:X}}function ti$($,Z){return async(Q)=>{let Y=tK1($,Q);if(!Y)return null;return Y.connectionId?Z(Y):Y.cloneUrl}}var ER6;var uC0=L(()=>{I50();ER6=Bh.object({name:Bh.string().max(63).regex(/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/,"pool name must be a DNS label (lowercase alphanumeric and '-')"),orgId:Bh.string().min(1),repo:Bh.string().regex(/^[^/\s]+\/[^/\s]+$/,"repo must be `owner/name`"),connectionId:Bh.string().min(1).optional(),branch:Bh.string().min(1).default("main"),workload:M50.shape.workload})});function eK1($,Z=Date.now()){if($===void 0)return;return $===null?Z+PR6:$.getTime()}function aK1($){return JSON.stringify([$.orgId,$.userId])}function oi$($,Z){let Q=tK(Z);return Q?JSON.stringify([$,Q.toLowerCase()]):null}function AR6($,Z){return"repositoryId"in Z?$.repositoryOrgs.get(Z.repositoryId):$.connectionOrgs.get(Z.connectionId)}function si$($){let{records:Z,now:Q}=$,Y=new Map,X=new Map,J=new Map,G=0;for(let W of $.pools)for(let{repoUrl:K,branch:H}of W.repos){let F=oi$(W.tenant,K),U=tK1($.legacyPools??[],{tenant:W.tenant,repoUrl:K,branch:H});if(F&&U){if(U.connectionId)X.set(F,{tenant:W.tenant,repoUrl:K,connectionId:U.connectionId,cloneUrl:U.cloneUrl});continue}let N=F?Z.orgRepositories.get(F):void 0;if(!F||!N){G++;continue}X.set(F,{tenant:W.tenant,repoUrl:K,repositoryId:N})}for(let W of $.sandboxes){let K=W.tenant;if(!K)continue;let H=Z.members.get(aK1(K));if(H===void 0){G++;continue}for(let U of W.repos){if(AR6(Z,U)!==K.orgId){G++;continue}let N="repositoryId"in U?{repositoryId:U.repositoryId}:{connectionId:U.connectionId,repo:U.repo.toLowerCase()},B={orgId:K.orgId,userId:K.userId};Y.set(JSON.stringify([B,N]),{tenant:B,repo:N})}let F=W.orgFsConfigExpiresAt;if(W.orgFs&&(F===null||F-Q<zR6))J.set(aK1(K),{orgId:K.orgId,userId:K.userId,orgSlug:H})}return{clones:[...Y.values()],poolClones:[...X.values()],orgFs:[...J.values()],refused:G}}async function ri$($,Z,Q){let Y=new Set,X=new Set,J=new Set,G=new Set,W=new Set(Q.map((D)=>D.tenant)),K=new Set;for(let D of Q)for(let{repoUrl:O}of D.repos){let j=DX(O);if(j)K.add(j.path.toLowerCase())}for(let D of Z){if(D.tenant)Y.add(D.tenant.orgId),X.add(D.tenant.userId);for(let O of D.repos)if("repositoryId"in O)G.add(O.repositoryId);else J.add(O.connectionId)}let[H,F,U,N]=await Promise.all([Y.size===0?[]:$.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.organizationId as orgId","member.userId as userId","organization.slug as slug"]).where("member.organizationId","in",[...Y]).where("member.userId","in",[...X]).execute(),J.size===0?[]:$.selectFrom("connections").select(["id","organization_id"]).where("id","in",[...J]).execute(),G.size===0?[]:$.selectFrom("repositories").select(["id","organization_id"]).where("id","in",[...G]).execute(),K.size===0?[]:$.selectFrom("repositories").select(["id","organization_id","provider","host","path"]).where("organization_id","in",[...W]).where((D)=>D(D.fn("lower",["path"]),"in",[...K])).execute()]),B=new Map;for(let D of N){let O=oi$(D.organization_id,I80({provider:D.provider,host:D.host,path:D.path}));if(O&&!B.has(O))B.set(O,D.id)}return{members:new Map(H.map((D)=>[aK1(D),D.slug])),connectionOrgs:new Map(F.map((D)=>[D.id,D.organization_id])),repositoryOrgs:new Map(U.map((D)=>[D.id,D.organization_id])),orgRepositories:B}}function rK1($){return $ instanceof Error?$.message:String($)}async function ai$($,Z,Q){let Y=0;if($.clones.length>Vn||$.poolClones.length>Vn||$.orgFs.length>sK1)console.warn(`[sandbox-credential-push] ${$.clones.length} clone, ${$.poolClones.length} pool clone and ${$.orgFs.length} org-fs mints planned; minting the first ${Vn}, ${Vn} and ${sK1}`);let X=await I5($.clones.slice(0,Vn),oK1,async(U)=>{let N="repositoryId"in U.repo?{cloneUrl:"",repositoryId:U.repo.repositoryId}:{cloneUrl:`https://github.com/${U.repo.repo}.git`,connectionId:U.repo.connectionId};try{let B=await Z.mintCloneUrl(N,{bufferMs:lC0});return B?{tenant:U.tenant,repo:U.repo,cloneUrl:B,expiresAt:Q.now+lC0}:null}catch(B){return Y++,console.warn(`[sandbox-credential-push] clone mint failed: ${rK1(B)}`),null}}),J=await I5($.poolClones.slice(0,Vn),oK1,async(U)=>{try{let N=await Z.mintCloneUrl("repositoryId"in U?{cloneUrl:"",repositoryId:U.repositoryId}:{cloneUrl:U.cloneUrl,connectionId:U.connectionId},{bufferMs:lC0});return N?{tenant:U.tenant,repoUrl:U.repoUrl,cloneUrl:N,expiresAt:Q.now+lC0}:null}catch(N){return Y++,console.warn(`[sandbox-credential-push] pool clone mint failed: ${rK1(N)}`),null}}),G=await I5($.orgFs.slice(0,sK1),oK1,async(U)=>{try{let N=await Z.mintOrgFsConfig(U);return N?{tenant:{orgId:U.orgId,userId:U.userId},orgFsConfigJson:N,expiresAt:Q.now+Q.orgFsLifetimeMs}:null}catch(N){return Y++,console.warn(`[sandbox-credential-push] org-fs mint failed: ${rK1(N)}`),null}}),W=X.filter((U)=>U!==null),K=J.filter((U)=>U!==null),H=G.filter((U)=>U!==null),F=[];for(let U=0;U<Math.max(W.length,K.length,H.length);U+=Wz)F.push({cloneUrls:W.slice(U,U+Wz),poolCloneUrls:K.slice(U,U+Wz),orgFsConfigs:H.slice(U,U+Wz)});return{batches:F,failed:Y}}var lC0=2700000,cC0,PR6=86400000,zR6=86400000,oK1=8,Vn=2000,sK1=200;var mC0=L(()=>{b31();I50();t4();n$();UB();uC0();cC0=ry$-3600000});var xJ;var k50=L(()=>{xJ=class xJ extends Error{code;status;path;constructor($,Z,Q){super(Z.message||`Freestyle API error: ${Z.code}`);this.name="FreestyleApiError",this.code=Z.code,this.status=$,this.path=Q,Object.setPrototypeOf(this,xJ.prototype)}}});function ei$(){return typeof process<"u"&&Boolean(process.versions?.node)}var dC0=($,Z)=>globalThis.fetch($,Z);async function TR6(){if(!ei$())return null;try{return await import("undici")}catch{return null}}async function RR6(){let $=await TR6();if(!$)return null;let Z=new $.Agent({allowH2:!0,connections:qR6});return(Q,Y)=>$.fetch(Q,{...Y,dispatcher:Z})}function MR6($){return(typeof $==="string"?$:$ instanceof URL?$.href:$.url).startsWith("https:")}function $p$(){let $,Z=()=>{return $??=RR6().then((Q)=>Q??dC0).catch(()=>dC0),$};return(Q,Y)=>MR6(Q)?Z().then((X)=>X(Q,Y)):dC0(Q,Y)}var qR6=4;var Zp$=()=>{};function _R6($){return new Promise((Z)=>setTimeout(Z,$))}function vR6($){if(!$)return"";let Z=new URLSearchParams;for(let[Y,X]of Object.entries($)){if(X===void 0||X===null)continue;Z.set(Y,String(X))}let Q=Z.toString();return Q?`?${Q}`:""}function t6($){return encodeURIComponent($)}class $H1{baseUrl;authenticationHeaders;fetchImpl;backgroundEligible;constructor($={}){if(this.baseUrl=($.baseUrl??SR6).replace(/\/+$/,""),!$.fetch&&!globalThis.fetch)throw Error("No fetch implementation available. Pass `fetch` in FreestyleOptions when running on a runtime without a global fetch.");if(this.fetchImpl=$.fetch??$p$(),"identityAccessToken"in $&&$.identityAccessToken){this.authenticationHeaders={[VR6]:$.identityAccessToken},this.backgroundEligible=!1;return}if(this.backgroundEligible=!0,"stackAccessToken"in $&&$.stackAccessToken){this.authenticationHeaders={Authorization:`Bearer ${$.stackAccessToken}`,"X-Freestyle-Team-Id":$.teamId};return}let Z=$.apiKey??globalThis.process?.env?.FREESTYLE_API_KEY;if(!Z)throw Error("No Freestyle API key provided. Pass `apiKey` in FreestyleOptions or set FREESTYLE_API_KEY.");this.authenticationHeaders={Authorization:`Bearer ${Z}`}}authHeaders(){return{...this.authenticationHeaders}}url($,Z){return`${this.baseUrl}${$}${vR6(Z)}`}async fetch($,Z={}){let Q=new Headers(Z.headers);for(let[Y,X]of Object.entries(this.authHeaders()))if(!Q.has(Y))Q.set(Y,X);return this.fetchImpl(this.absoluteUrl($),{...Z,headers:Q})}absoluteUrl($){return/^https?:\/\//i.test($)?$:`${this.baseUrl}${$}`}async request($,Z,{query:Q,body:Y,rawBody:X,signal:J}={}){let G={...this.authHeaders()};if(this.backgroundEligible)G[Qp$]=String(kR6);let W;if(X!==void 0)G["Content-Type"]="application/octet-stream",W=X;else if(Y!==void 0)G["Content-Type"]="application/json",W=JSON.stringify(Y);let K=this.url(Z,Q),H=await this.fetchImpl(K,{method:$,headers:G,body:W,signal:J});if(this.backgroundEligible&&H.status===202)try{return await this.pollBackgroundRequest(H,Z)}catch(F){if($==="GET"&&F instanceof xJ&&F.code==="BACKGROUND_RESULT_UNSTORABLE"){delete G[Qp$];let U=await this.fetchImpl(K,{method:$,headers:G,body:W});return this.finalize(U,Z)}throw F}return this.finalize(H,Z)}async pollBackgroundRequest($,Z){let Q=await $.json().catch(()=>({})),Y=$.headers.get(IR6)??Q.requestId,X=Q.resultUrl??(Y?`/v5/background-requests/${t6(Y)}`:void 0);if(!X)throw new xJ($.status,{code:"BACKGROUND_PROTOCOL_ERROR",message:"202 Accepted carried no background request id"},Z);let J=0;for(;;){await _R6(CR6);let G;try{G=await this.fetch(X,{method:"GET"}),J=0}catch(W){if(++J>=5)throw W;continue}if(G.status===202)continue;return this.finalize(G,Z)}}async finalize($,Z){if(!$.ok){let Y;try{Y=await $.json()}catch{Y={code:"UNKNOWN_ERROR",message:await $.text().catch(()=>$.statusText)}}throw new xJ($.status,Y,Z)}if($.status===204)return;let Q=await $.text();if(!Q)return;return JSON.parse(Q)}get($,Z){return this.request("GET",$,{query:Z})}post($,Z){return this.request("POST",$,{body:Z??{}})}patch($,Z){return this.request("PATCH",$,{body:Z??{}})}put($,Z){return this.request("PUT",$,{body:Z??{}})}putEmpty($){return this.request("PUT",$,{})}putBytes($,Z,Q,Y){return this.request("PUT",$,{query:Q,rawBody:Z,signal:Y})}async getBytes($,Z,Q={}){let Y={...this.authHeaders()};if(Q.range)Y.Range=Q.range;let X=await this.fetchImpl(this.url($,Z),{method:"GET",headers:Y,signal:Q.signal});if(!X.ok){let J;try{J=await X.json()}catch{J={code:"UNKNOWN_ERROR",message:await X.text().catch(()=>X.statusText)}}throw new xJ(X.status,J,$)}return X}delete($,Z){return this.request("DELETE",$,{query:Z})}}var VR6="x-freestyle-identity-access-token",Qp$="x-freestyle-background-after-secs",IR6="x-freestyle-background-request-id",kR6=5,CR6=2000,SR6="https://api.freestyle.sh";var oK=L(()=>{k50();Zp$()});class ZH1{client;verifications;certificates;placeholder;constructor($){this.client=$,this.verifications=new Yp$($),this.certificates=new Xp$($),this.placeholder=new Jp$($)}async list(){let{domains:$}=await this.client.get("/v5/domains");return $}}class Yp${client;constructor($){this.client=$}create($){return this.client.post("/v5/verifications",{domain:$})}async list($={}){let{verifications:Z}=await this.client.get("/v5/verifications",$);return Z}get($){return this.client.get(`/v5/verifications/${t6($)}`)}complete($){return this.client.putEmpty(`/v5/verifications/${t6($)}`)}delete($){return this.client.delete(`/v5/verifications/${t6($)}`)}}class Xp${client;constructor($){this.client=$}async list(){let{certificates:$}=await this.client.get("/v5/certificates");return $}createWildcard($){return this.client.post("/v5/certificates/wildcard",{domain:$})}}class Jp${client;constructor($){this.client=$}async get(){try{return await this.client.get("/v5/domains/placeholder")}catch($){if($ instanceof xJ&&$.status===404)return null;throw $}}set($){return this.client.put("/v5/domains/placeholder",$)}delete(){return this.client.delete("/v5/domains/placeholder")}}var QH1=L(()=>{oK();k50()});function Q5($,Z){throw new XH1($,Z)}function YH1($){return bR6.some((Z)=>$[Z]!==void 0)}function JH1($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function fR6($,Z){let Q=Z.lastIndexOf("/");if(Q<0)Q5($,`${$} \`${Z}\` is not a CIDR: expected address/prefix, e.g. 203.0.113.0/24 or 2001:db8::/32`);let Y=Z.slice(0,Q),X=Z.slice(Q+1);if(!/^\d+$/.test(X))Q5($,`${$} \`${Z}\`: prefix length must be a number`);let J=Number(X),G=Y.includes(":"),W=G?128:32;if(J>W)Q5($,`${$} \`${Z}\`: prefix length must be 0\u2013${W}`);if(!G&&!/^\d{1,3}(\.\d{1,3}){3}$/.test(Y))Q5($,`${$} \`${Z}\`: \`${Y}\` is not an IP address`)}function Hp$($,Z){if(!JH1($))Q5(Z,`${Z} must be an object`);for(let Y of Object.keys($))if(!Gp$.includes(Y))Q5(`${Z}.${Y}`,`${Z} has unknown field \`${Y}\`. Expected one of: ${Gp$.join(", ")}`);let Q=$;for(let Y of["vmId","vpcId","tunnelId","cidr"]){let X=Q[Y];if(X!==void 0&&(typeof X!=="string"||X.length===0))Q5(`${Z}.${Y}`,`${Z}.${Y} must be a non-empty string`)}if(Q.public!==void 0&&Q.public!==!0)Q5(`${Z}.public`,`${Z}.public must be true when present: it declares the public Internet. Omit the field to match something else`);if(Q.public===!0){if(Q.vmId!==void 0)Q5(`${Z}.public`,`${Z} cannot combine \`public: true\` with \`vmId\`: that would mean the VM only when reached over its public address, a distinction this API does not make yet. Use \`vmId\` alone to match the VM on any path, or \`public: true\` alone to match public addresses`);if(Q.vpcId!==void 0)Q5(`${Z}.public`,`${Z} cannot combine \`public: true\` with \`vpcId\`: that would mean the network's members only when reached over their public addresses, a distinction this API does not make yet. Use \`vpcId\` alone or \`public: true\` alone`);if(Q.tunnelId!==void 0)Q5(`${Z}.public`,`${Z} cannot combine \`public: true\` with \`tunnelId\`: traffic through a tunnel arrives over the tunnel, not over the public Internet. Use \`tunnelId\` alone`)}if(Q.cidr!==void 0)fR6(`${Z}.cidr`,Q.cidr);if(Q.protocol!==void 0&&!Wp$.includes(Q.protocol))Q5(`${Z}.protocol`,`${Z}.protocol must be one of: ${Wp$.join(", ")} (got \`${String(Q.protocol)}\`)`);if(Q.port!==void 0){if(!Number.isInteger(Q.port)||Q.port<1||Q.port>65535)Q5(`${Z}.port`,`${Z}.port must be an integer between 1 and 65535`);if(Q.protocol===void 0)Q5(`${Z}.protocol`,`${Z}.port ${Q.port} requires ${Z}.protocol: set it to "tcp" or "udp" so the rule opens one transport rather than both`);if(!xR6.includes(Q.protocol))Q5(`${Z}.port`,`${Z}.protocol "${Q.protocol}" has no ports; remove ${Z}.port ${Q.port}`)}}function Np$($,Z){if(!JH1($))Q5(Z||"rule",`${Z||"rule"} must be an object`);for(let Y of Object.keys($))if(!Fp$.includes(Y))Q5(`${Z}${Y}`,`Unknown field \`${Y}\`. Expected one of: ${Fp$.join(", ")}`);let Q=$;if(Q.action===void 0)Q5(`${Z}action`,`${Z}action is required. Write \`action: "allow"\` \u2014 every rule states what it does rather than defaulting to it`);if(Q.action!=="allow")Q5(`${Z}action`,`${Z}action must be "allow" (got \`${String(Q.action)}\`). Only allow rules exist today`);if(Q.description!==void 0){if(typeof Q.description!=="string")Q5(`${Z}description`,"description must be a string");if(Q.description.length>Kp$)Q5(`${Z}description`,`description is too long (${Q.description.length} characters, maximum ${Kp$})`)}if(Q.source===void 0)Q5(`${Z}source`,`${Z}source is required`);if(Q.destination===void 0)Q5(`${Z}destination`,`${Z}destination is required`);return Hp$(Q.source,`${Z}source`),Hp$(Q.destination,`${Z}destination`),Q}function yR6($){let Z=Np$($,"");for(let Q of["source","destination"]){let Y=Z[Q];if(YH1(Y))continue;let X=[Y.port!==void 0?`port ${Y.port}`:void 0,Y.protocol!==void 0?`protocol ${Y.protocol}`:void 0].filter(Boolean).join(", ");Q5(Q,X?`${Q} only narrows traffic (${X}) without saying what it is. Add \`vmId\`, \`vpcId\`, \`tunnelId\`, \`cidr\`, or \`public: true\`. Leaving it out to mean "this VM" only works inside vms.create`:`${Q} is empty. A matcher must say what the traffic is: \`vmId\`, \`vpcId\`, \`tunnelId\`, \`cidr\`, or \`public: true\` for the public Internet`)}return Z}function iC0($,Z="VM"){if($===void 0||$===null)Q5("firewall",`firewall is required on a ${Z} create. A ${Z} gets nothing implicitly, so state what it may reach \u2014 \`{ rules: [] }\` if the answer is nothing`);if(!JH1($))Q5("firewall","firewall must be an object with a `rules` array");for(let Y of Object.keys($))if(Y!=="rules")Q5(`firewall.${Y}`,`firewall has unknown field \`${Y}\`. Expected: rules`);let Q=$.rules;if(!Array.isArray(Q))Q5("firewall.rules","firewall.rules must be an array");return Q.forEach((Y,X)=>{let J=`firewall.rules[${X}].`,G=Np$(Y,J),W=YH1(G.source),K=YH1(G.destination);if(!W&&!K&&Z!=="network")Q5(`firewall.rules[${X}]`,`firewall.rules[${X}]: both source and destination refer to the ${Z} being created, which allows nothing. Give one of them a \`vmId\`, \`vpcId\`, \`tunnelId\`, \`cidr\`, or \`public: true\``);if(W&&K)Q5(`firewall.rules[${X}]`,`firewall.rules[${X}]: neither end refers to the ${Z} being created. Leave one endpoint's identity unset so it means this ${Z}, or create the rule with firewall.rules.create instead`)}),$}function Up$($){return`/v5/firewall/rules/${t6($)}`}class Bp${client;constructor($){this.client=$}async create($){let Z=yR6($);return this.client.post("/v5/firewall/rules",Z)}list($={}){return this.client.get("/v5/firewall/rules",$)}get($){return this.client.get(Up$($))}delete($){return this.client.delete(Up$($))}}class GH1{client;rules;constructor($){this.client=$,this.rules=new Bp$($)}evaluate($){return this.client.post("/v5/firewall/evaluate",$)}}var XH1,Gp$,bR6,Wp$,xR6,Kp$=1024,Fp$;var C50=L(()=>{oK();XH1=class XH1 extends Error{path;constructor($,Z){super(Z);this.name="FirewallRuleValidationError",this.path=$,Object.setPrototypeOf(this,XH1.prototype)}};Gp$=["vmId","vpcId","tunnelId","cidr","public","port","protocol"],bR6=["vmId","vpcId","tunnelId","cidr","public"],Wp$=["tcp","udp","icmp"],xR6=["tcp","udp"];Fp$=["action","source","destination","description"]});function WH1($){return`/v5/identities/${t6($)}`}class Dp${client;basePath;constructor($,Z){this.client=$,this.basePath=Z}create(){return this.client.post(`${this.basePath}/tokens`)}list(){return this.client.get(`${this.basePath}/tokens`)}revoke($){return this.client.delete(`${this.basePath}/tokens/${t6($)}`)}}class Lp${client;basePath;constructor($,Z){this.client=$,this.basePath=Z}list(){return this.client.get(`${this.basePath}/permissions/vm`)}grant($){return this.client.post(`${this.basePath}/permissions/vm`,$)}get($){return this.client.get(`${this.basePath}/permissions/vm/${t6($)}`)}update($,Z){return this.client.patch(`${this.basePath}/permissions/vm/${t6($)}`,{allowedLinuxUsers:Z})}revoke($){return this.client.delete(`${this.basePath}/permissions/vm/${t6($)}`)}}class KH1{id;tokens;permissions;client;basePath;constructor($,Z){this.client=$,this.id=Z,this.basePath=WH1(Z),this.tokens=new Dp$($,this.basePath),this.permissions={vm:new Lp$($,this.basePath)}}data(){return this.client.get(this.basePath)}delete(){return this.client.delete(this.basePath)}}class HH1{client;constructor($){this.client=$}async create($={}){let Z=await this.client.post("/v5/identities",$);return{identity:new KH1(this.client,Z.id),identityId:Z.id,data:Z}}list($={}){return this.client.get("/v5/identities",$)}get($){return this.client.get(WH1($))}ref($){return new KH1(this.client,$)}delete($){return this.client.delete(WH1($))}}var FH1=L(()=>{oK()});function h1($,Z){throw new DH1($,Z)}function q7($,Z){throw new LH1($,Z)}function S50($){return gR6.some((Z)=>$[Z]!==void 0)}function pR6($){return!S50($)&&$.port===void 0}function VX($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function kp$($,Z,Q){if(typeof $!=="string"||!cR6.test($))q7(Z,`${Z} must be a valid HTTP header name`);let Y=$.toLowerCase();if(iR6.has(Y)||Y.startsWith("x-forwarded-")||Y.startsWith("x-freestyle-")||Q&&(Y==="cookie"||Y==="set-cookie"))q7(Z,`${Z} may not use reserved header \`${$}\``)}function nR6($,Z){if(!Array.isArray($))q7(Z,`${Z} must be an array of header names`);if($.length>Ap$)q7(Z,`${Z} may contain at most ${Ap$} names`);let Q=new Set;$.forEach((Y,X)=>{kp$(Y,`${Z}[${X}]`,!0);let J=Y.toLowerCase();if(Q.has(J))q7(`${Z}[${X}]`,`${Z} contains duplicate header \`${Y}\``);Q.add(J)})}function qp$($){if(!VX($))q7("forwardAuth","forwardAuth must be an object");for(let Y of Object.keys($))if(!wp$.includes(Y))q7(Y,`Unknown field \`${Y}\`. Expected one of: ${wp$.join(", ")}`);let Z=$;if(typeof Z.url!=="string"||Z.url.length===0||Z.url.length>mR6)q7("url","url is required and must be an absolute HTTPS URL");let Q;try{Q=new URL(Z.url)}catch{q7("url","url must be an absolute HTTPS URL")}if(Q.protocol!=="https:"||Q.hostname.length===0||Q.username.length>0||Q.password.length>0||Q.hash.length>0||Q.port==="0")q7("url","url must be an absolute HTTPS URL");if(Z.headers!==void 0){if(!VX(Z.headers))q7("headers","headers must be an object of header name to value");let Y=Object.entries(Z.headers);if(Y.length>Pp$)q7("headers",`headers may contain at most ${Pp$} entries`);let X=0,J=new Set;for(let[G,W]of Y){kp$(G,`headers.${G}`,!1);let K=G.toLowerCase();if(J.has(K))q7(`headers.${G}`,`headers contains duplicate header \`${G}\``);if(J.add(K),typeof W!=="string"||/[\0\r\n]/.test(W))q7(`headers.${G}`,`headers.${G} must be a string`);X+=G.length+W.length}if(X>zp$)q7("headers",`headers may contain at most ${zp$} bytes`)}if(Z.timeoutMs!==void 0&&(!Number.isInteger(Z.timeoutMs)||Z.timeoutMs<100||Z.timeoutMs>5000))q7("timeoutMs","timeoutMs must be an integer between 100 and 5000");if(Z.protectedCookies!==void 0){if(!Array.isArray(Z.protectedCookies))q7("protectedCookies","protectedCookies must be an array of cookie names");if(Z.protectedCookies.length>Tp$)q7("protectedCookies",`protectedCookies may contain at most ${Tp$} names`);let Y=new Set;Z.protectedCookies.forEach((X,J)=>{if(typeof X!=="string"||X.length>dR6||!lR6.test(X))q7(`protectedCookies[${J}]`,`protectedCookies[${J}] must be a valid HTTP cookie name`);if(Y.has(X))q7(`protectedCookies[${J}]`,`protectedCookies contains duplicate cookie \`${X}\``);Y.add(X)})}if(Z.authResponseHeaders!==void 0)nR6(Z.authResponseHeaders,"authResponseHeaders");return Z}function tR6($,Z){if(!VX($))h1(Z,`${Z} must be an object with an \`id\``);for(let Y of Object.keys($))if(!Ep$.includes(Y))h1(`${Z}.${Y}`,`${Z} has unknown field \`${Y}\`. Expected: ${Ep$.join(", ")}`);let Q=$.id;if(typeof Q!=="string"||Q.length===0)h1(`${Z}.id`,`${Z}.id is required and must be a non-empty string`)}function BH1($){if(typeof $!=="string")h1("domain","domain is required and must be a string");if($==="*")return;let Z=$.startsWith("*.")?$.slice(2):$;if(Z.length===0||Z.length>hR6)h1("domain",`domain \`${$}\` is not a hostname`);let Q=Z.split(".");if(Q.length<2)h1("domain",`domain \`${$}\` must have at least two labels, e.g. acme.com`);for(let Y of Q){if(Y.length===0||Y.length>uR6)h1("domain",`domain \`${$}\` has an empty or over-long label`);if(!/^[a-z0-9-]+$/.test(Y))h1("domain",`domain \`${$}\`: labels are lowercase letters, digits, and hyphens (a \`*.\` prefix is the only wildcard)`);if(Y.startsWith("-")||Y.endsWith("-"))h1("domain",`domain \`${$}\`: a label cannot start or end with a hyphen`)}}function oR6($){if(typeof $!=="string")h1("domain","domain is required and must be a string");let Z=$.lastIndexOf("@");if(Z===-1){BH1($);return}let Q=$.slice(0,Z),Y=$.slice(Z+1);if(Q.length===0||Q.length>64)h1("domain",`mail route \`${$}\`: the part before \`@\` must be 1-64 characters`);if(Q.startsWith(".")||Q.endsWith(".")||Q.includes(".."))h1("domain",`mail route \`${$}\`: the part before \`@\` cannot start or end with a dot, or contain \`..\``);for(let X of Q)if(!/[a-zA-Z0-9]/.test(X)&&!Rp$.includes(X))h1("domain",`mail route \`${$}\`: the part before \`@\` may use letters, digits, dots, and \`${Rp$.slice(0,-1)}\` (quoted mailboxes are not supported)`);if(Y==="*")h1("domain",`mail route \`${$}\`: \`*\` is not a mail domain \u2014 name the domain the mailbox lives at`);BH1(Y)}function Mp$($,Z){if(!VX($))h1(Z,`${Z} must be an object`);for(let Y of Object.keys($))if(!Op$.includes(Y))h1(`${Z}.${Y}`,`${Z} has unknown field \`${Y}\`. Expected one of: ${Op$.join(", ")}`);let Q=$;for(let Y of["vmId","vpcId","host"]){let X=Q[Y];if(X!==void 0&&(typeof X!=="string"||X.length===0))h1(`${Z}.${Y}`,`${Z}.${Y} must be a non-empty string`)}if(Q.public!==void 0&&Q.public!==!0)h1(`${Z}.public`,`${Z}.public must be true when present. Omit the field to match something else`);if(Z==="source"){if(Q.host!==void 0)h1("source.host","source.host is not allowed: a source is who opens the session, not where it lands. Put `host` on the destination");if(Q.port!==void 0)h1("source.port","source.port is not allowed: a source is who opens the session, not where it lands. Put `port` on the destination");if(Q.public===!0&&(Q.vmId!==void 0||Q.vpcId!==void 0))h1("source.public","source cannot combine `public: true` with `vmId` or `vpcId`: use one alone. `public` is every client on the Internet; `vmId`/`vpcId` is a specific dialer")}else{if(Q.vpcId!==void 0)h1("destination.vpcId","destination.vpcId is not allowed: a session lands in one place, not on a whole network. Name a `vmId`, a `host`, or `public: true` for the domain's own origin. A whole network may be a source");if([Q.vmId!==void 0,Q.host!==void 0,Q.public===!0].filter(Boolean).length>1)h1("destination","destination names more than one landing: give exactly one of `vmId`, `host`, or `public: true`");if((Q.vmId!==void 0||Q.host!==void 0)&&Q.port===void 0)h1("destination.port",`destination.port is required with ${Q.vmId!==void 0?"`vmId`":"`host`"}: say which port the session lands on`)}if(Q.port!==void 0){if(!Number.isInteger(Q.port)||Q.port<1||Q.port>65535)h1(`${Z}.port`,`${Z}.port must be an integer between 1 and 65535`)}}function sR6($){if("postgres"in $)return"postgres";if("smtp"in $)return"smtp";if("socks5"in $)return"socks5";return"http"}function rR6($,Z){function Q(W,K,H){if(!VX(W)||Object.keys(W).some((F)=>!K.includes(F)))h1(H,`${H} must contain only ${K.join(", ")}`)}if(Q($,["region","credentials","scope"],Z),typeof $.region!=="string"||!/^[a-z0-9-]{1,63}$/.test($.region))h1(`${Z}.region`,"invalid s3.region");Q($.credentials,["accessKeyId","secretAccessKey","sessionToken"],`${Z}.credentials`);for(let W of["accessKeyId","secretAccessKey","sessionToken"]){let K=$.credentials[W];if(W==="sessionToken"&&K===void 0)continue;if(typeof K!=="string"||!/^[\x21-\x7e]{1,16384}$/.test(K))h1(`${Z}.credentials.${W}`,"invalid s3 credentials")}if(!/^[a-zA-Z0-9]+$/.test($.credentials.accessKeyId))h1(`${Z}.credentials.accessKeyId`,"invalid s3 access key id");Q($.scope,["bucket","prefix","operations"],`${Z}.scope`);let{bucket:Y,prefix:X,operations:J}=$.scope;if(typeof Y!=="string"||!/^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/.test(Y)||Y.includes(".."))h1(`${Z}.scope.bucket`,"invalid s3.scope.bucket");if(typeof X!=="string"||Buffer.byteLength(X,"utf8")>1024||/[\x00-\x1f\x7f-\x9f]/u.test(X))h1(`${Z}.scope.prefix`,"invalid s3.scope.prefix");let G=["GetObject","HeadObject","PutObject","DeleteObject","ListObjectsV2","CreateMultipartUpload","UploadPart","ListParts","CompleteMultipartUpload","AbortMultipartUpload","ListMultipartUploads"];if(!Array.isArray(J)||J.length===0||J.length>G.length||J.some((W)=>!G.includes(W))||new Set(J).size!==J.length)h1(`${Z}.scope.operations`,"s3.scope.operations must be a nonempty list of distinct supported operations")}function aR6($,Z){if(!VX($))h1(Z,`${Z} must be an object: \`{ headers: { \u2026 } }\`, \`{ postgres: { \u2026 } }\`, \`{ smtp: { \u2026 } }\` or \`{ socks5: { \u2026 } }\``);let Q=Object.keys($);if(Q.length!==1||!["headers","jsonPatch","postgres","smtp","socks5","s3"].includes(Q[0]??""))h1(Z,`${Z} must have exactly one of \`headers\`, \`jsonPatch\`, \`postgres\`, \`smtp\`, \`socks5\` or \`s3\` (got: ${Q.length===0?"nothing":Q.join(", ")})`);if(Q[0]==="s3"){rR6($.s3,`${Z}.s3`);return}if(Q[0]==="jsonPatch"){let Y=$.jsonPatch;if(!Array.isArray(Y)||Y.length>128)h1(Z,`${Z}.jsonPatch must be an array of at most 128 operations`);let X=(W)=>typeof W==="string"&&(W===""||W.startsWith("/"))&&!/~(?:[^01]|$)/u.test(W),J=(W,K=new Set,H=0)=>{if(H>64)return!1;if(W===null||typeof W==="string"||typeof W==="boolean")return!0;if(typeof W==="number")return Number.isFinite(W);if(typeof W!=="object"||K.has(W))return!1;K.add(W);let F=(Array.isArray(W)?Array.from(W):VX(W)?Object.values(W):[void 0]).every((U)=>J(U,K,H+1));return K.delete(W),F};for(let[W,K]of Y.entries()){if(!VX(K)||!["add","remove","replace","move","copy","test"].includes(String(K.op))||!X(K.path))h1(Z,`${Z}.jsonPatch[${W}] requires a standard op and valid JSON Pointer path`);if(["move","copy"].includes(K.op)&&!X(K.from))h1(Z,`${Z}.jsonPatch[${W}].from must be a JSON Pointer`);if(["add","replace","test"].includes(K.op)&&(!Object.hasOwn(K,"value")||!J(K.value)))h1(Z,`${Z}.jsonPatch[${W}].value must be a JSON value (null is allowed)`)}let G;try{G=JSON.stringify(Y)}catch{h1(Z,"jsonPatch must be JSON serializable")}if(Buffer.byteLength(G,"utf8")>65536)h1(Z,"jsonPatch exceeds 64 KiB");return}if(Q[0]==="socks5"){let Y=$.socks5;if(!VX(Y))h1(`${Z}.socks5`,`${Z}.socks5 must be an object with \`username\` and \`password\``);for(let X of Object.keys(Y))if(!["username","password"].includes(X))h1(`${Z}.socks5.${X}`,`${Z}.socks5 has unknown field \`${X}\`. Expected: username, password`);for(let X of["username","password"])if(typeof Y[X]!=="string"||Y[X].length===0)h1(`${Z}.socks5.${X}`,`${Z}.socks5.${X} is required and must be a non-empty string`);return}if(Q[0]==="smtp"){let Y=$.smtp;if(!VX(Y))h1(`${Z}.smtp`,`${Z}.smtp must be an object with \`username\` and \`password\``);for(let X of Object.keys(Y))if(!["username","password"].includes(X))h1(`${Z}.smtp.${X}`,`${Z}.smtp has unknown field \`${X}\`. Expected: username, password`);for(let X of["username","password"])if(typeof Y[X]!=="string"||Y[X].length===0)h1(`${Z}.smtp.${X}`,`${Z}.smtp.${X} is required and must be a non-empty string`);return}if(Q[0]==="headers"){let Y=$.headers;if(!VX(Y))h1(`${Z}.headers`,`${Z}.headers must be an object of header name to value`);for(let[X,J]of Object.entries(Y))if(typeof J!=="string")h1(`${Z}.headers.${X}`,`${Z}.headers.${X} must be a string`)}else{let Y=$.postgres;if(!VX(Y))h1(`${Z}.postgres`,`${Z}.postgres must be an object with \`username\` and \`password\``);for(let J of Object.keys(Y))if(!["username","password","database"].includes(J))h1(`${Z}.postgres.${J}`,`${Z}.postgres has unknown field \`${J}\`. Expected: username, password, database`);let X=Y;for(let J of["username","password"])if(typeof X[J]!=="string"||X[J].length===0)h1(`${Z}.postgres.${J}`,`${Z}.postgres.${J} is required and must be a non-empty string`);if(X.database!==void 0&&typeof X.database!=="string")h1(`${Z}.postgres.database`,`${Z}.postgres.database must be a string`)}}function eR6($,Z){let Q=$;return Z.forEach((Y,X)=>{let J=sR6(Y);if(Q===void 0)Q=J;else if(Q!==J)h1(`transform[${X}]`,`transform requires protocol \`${J}\` but the rule is \`${Q}\`; a rule terminates one protocol`)}),Q??"http"}function $M6($,Z){if(!VX($)||Object.keys($).some((Q)=>Q!=="method"&&Q!=="path"))h1(Z,`${Z} must be an object containing only method and path`);if($.method!==void 0&&(!Array.isArray($.method)||$.method.some((Q)=>typeof Q!=="string"||Q.length===0||/[^!#$%&'*+.^_`|~0-9A-Za-z-]/.test(Q))))h1(`${Z}.method`,`${Z}.method must be an array of HTTP method tokens`);if($.path!==void 0){let Q=$.path;if(!VX(Q)||Object.keys(Q).length!==1||typeof Q.exact!=="string"||!Q.exact.startsWith("/")||/[\s?#]/.test(Q.exact))h1(`${Z}.path`,`${Z}.path must contain exact: an absolute path without a query or fragment`)}}function Cp$($,Z){if(!VX($))h1(Z||"rule",`${Z||"rule"} must be an object`);for(let H of Object.keys($))if(!Vp$.includes(H))h1(`${Z}${H}`,`Unknown field \`${H}\`. Expected one of: ${Vp$.join(", ")}`);let Q=$;if(Q.action===void 0)h1(`${Z}action`,`${Z}action is required. Write \`action: "allow"\` \u2014 every rule states what it does rather than defaulting to it`);if(Q.action!=="allow")h1(`${Z}action`,`${Z}action must be "allow" (got \`${String(Q.action)}\`). Only allow rules exist today`);if(Q.protocol!==void 0&&!jp$.includes(Q.protocol))h1(`${Z}protocol`,`${Z}protocol must be one of: ${jp$.join(", ")} (got \`${String(Q.protocol)}\`)`);let Y=Q.source??{},X=Q.destination??{};Mp$(Y,"source"),Mp$(X,"destination");let J=Q.transform??[];if(!Array.isArray(J))h1(`${Z}transform`,`${Z}transform must be an array`);J.forEach((H,F)=>aR6(H,`${Z}transform[${F}]`));let G=eR6(Q.protocol,J);if(Q.match!==void 0){if($M6(Q.match,`${Z}match`),G!=="http"||Y.public===!0||!(X.public===!0||X.host!==void 0))h1(`${Z}match`,"match requires HTTP egress from a VM or VPC to a public origin or host")}if(J.some((H)=>("s3"in H))){if(J.length!==1||Q.match!==void 0||Y.public===!0||!(X.public===!0||X.host!==void 0)||Q.domain.includes("*"))h1(`${Z}transform`,"s3 requires a sole transform on HTTP egress to a concrete origin, without match")}let W=J.filter((H)=>("jsonPatch"in H));if(W.length>1)h1(`${Z}transform`,"a rule may carry only one jsonPatch transform");if(W.length&&(Y.public===!0||!(X.public===!0||X.host!==void 0)))h1(`${Z}transform`,"jsonPatch requires HTTP egress from a VM or VPC to a public origin or host");if(Q.forwardAuth!==void 0){tR6(Q.forwardAuth,`${Z}forwardAuth`);let H=X.vmId!==void 0||!S50(X)&&X.port!==void 0;if(G!=="http"||Y.public!==!0||!H||Q.domain==="*")h1(`${Z}forwardAuth`,`${Z}forwardAuth is only supported on HTTP public ingress: \`{ public: true } -> { vmId, port }\``)}if(G==="smtp")oR6(Q.domain);else BH1(Q.domain);if((Y.vmId!==void 0||Y.vpcId!==void 0)&&X.vmId!==void 0&&J.length>0)h1(`${Z}transform`,"a VM-to-VM rule cannot carry a transform yet \u2014 remove it (only public ingress/egress rules run transforms)");if(G==="tcp"){let H=X.public===!0||X.host!==void 0,F=Y.vmId!==void 0||Y.vpcId!==void 0;if(H||F)h1(`${Z}protocol`,"a `tcp` rule is public ingress only \u2014 `{ public: true } -> { vmId, port }`. The edge splices the session without terminating it, so outbound there is nothing to broker (an outbound allow is a firewall rule, and injecting into one needs `http` or `postgres`) and inward there is no certificate to answer the source with. Give the source `public: true`, or drop `protocol` to be served as HTTPS")}else if(G==="imap"||G==="imaps"){let H=X.public===!0||X.host!==void 0,F=Y.vmId!==void 0||Y.vpcId!==void 0;if(H||F)h1(`${Z}protocol`,`an \`${G}\` rule is public ingress only \u2014 \`{ public: true } -> { vmId, port }\`. The 993 front serves mail clients reaching a VM's IMAP server; outbound there is nothing to broker (an outbound allow is a firewall rule) and inward there is no certificate to answer the source with`)}else if(G==="socks5"){let H=X.public===!0||X.host!==void 0;if(Y.public===!0||!H)h1(`${Z}protocol`,'a `socks5` rule is egress only \u2014 `{ vmId } -> { host: "gate.provider.com", port: 1080 }`. The front exists so a guest can open sessions through a proxy whose credentials it never holds; inbound there is nothing to serve, and publishing one would be an open proxy on a platform address');if(X.host===void 0)h1(`${Z}destination`,"a `socks5` rule has to name the proxy it goes through: give the destination a `host` and the `port` the provider listens on. `{ public: true }` on its own asks the edge to be the proxy, which would let the guest out on our address rather than through yours")}else if(G==="postgres"){let H=J.some((U)=>U!==null&&typeof U==="object"&&("postgres"in U)),F=X.public===!0||X.host!==void 0;if(H&&!F)h1(`${Z}transform`,"a `postgres` transform belongs on an egress rule: the edge spends a credential the guest never holds, so pointing it at your own VM would hand every client a logged-in session. Give the destination `public: true` or a `host`, or drop the transform")}else if(G==="smtp"){let H=J.some((U)=>U!==null&&typeof U==="object"&&("smtp"in U)),F=X.public===!0||X.host!==void 0;if(H&&!F)h1(`${Z}transform`,"an `smtp` transform belongs on an egress rule: the edge spends a credential the guest never holds, so pointing it at your own VM would turn it into an open relay. Give the destination `public: true` or a `host`, or drop the transform");if(typeof Q.domain==="string"&&Q.domain.includes("@")&&Y.public!==!0)h1(`${Z}domain`,`\`${Q.domain}\` names a mailbox, which only makes sense on a rule that receives mail. An egress or VM-to-VM rule names the host the guest submits through \u2014 drop the part before \`@\``)}return{...Q,source:Y,destination:X}}function ZM6($,Z){if($==="source")return pR6(Z)?"source is empty. Say who opens the session: `vmId`, `vpcId`, or `public: true`":"source only narrows the session without saying who opens it. Add `vmId`, `vpcId`, or `public: true`";return"destination is empty. Say where the session lands: `vmId` + `port`, `host` + `port`, or `public: true` for the domain's own origin"}function Ip$($){let Z=Cp$($,"");for(let Q of["source","destination"]){let Y=Z[Q];if(!S50(Y))h1(Q,ZM6(Q,Y))}if(Z.source.public===!0&&Z.destination.public===!0)h1("destination","a rule from the public Internet to the domain's own origin allows nothing the world cannot already do. Did you mean a `vmId` destination (ingress) or a `vmId` source (egress)?");return Z}function Sp$($){if(!VX($))h1("tls","tls must be an object with a `rules` array");for(let Q of Object.keys($))if(Q!=="rules")h1(`tls.${Q}`,`tls has unknown field \`${Q}\`. Expected: rules`);let Z=$.rules;if(!Array.isArray(Z))h1("tls.rules","tls.rules must be an array");return Z.forEach((Q,Y)=>{let X=`tls.rules[${Y}].`,J=Cp$(Q,X),G=S50(J.source),W=S50(J.destination);if(!G&&!W)h1(`tls.rules[${Y}]`,`tls.rules[${Y}]: both source and destination refer to the VM being created, which allows nothing. Give one of them a \`vmId\`, \`vpcId\`, or \`public: true\``);if(G&&W)h1(`tls.rules[${Y}]`,`tls.rules[${Y}]: neither end refers to the VM being created. Leave one endpoint's identity unset so it means this VM, or create the rule with tls.rules.create instead`);if(!W&&J.destination.port===void 0)h1(`tls.rules[${Y}].destination.port`,`tls.rules[${Y}]: destination.port is required: say which port on this VM the session lands on`)}),$}function UH1($){return`/v5/tls/${t6($)}`}function NH1($){return`/v5/tls/forward-auth/${t6($)}`}class _p${client;constructor($){this.client=$}list(){return this.client.get("/v5/tls/forward-auth")}async create($){let Z=qp$($);return this.client.post("/v5/tls/forward-auth",Z)}get($){return this.client.get(NH1($))}async update($,Z){let Q=qp$(Z);return this.client.put(NH1($),Q)}delete($){return this.client.delete(NH1($))}}class vp${client;constructor($){this.client=$}async create($){let Z=Ip$($);return this.client.post("/v5/tls",Z)}list($={}){return this.client.get("/v5/tls",$)}get($){return this.client.get(UH1($))}async update($,Z){let Q=Ip$(Z);return this.client.put(UH1($),Q)}delete($){return this.client.delete(UH1($))}}class OH1{client;rules;forwardAuth;constructor($){this.client=$,this.rules=new vp$($),this.forwardAuth=new _p$($)}}var DH1,LH1,Op$,gR6,jp$,hR6=253,uR6=63,wp$,Ep$,lR6,cR6,mR6=2048,Pp$=32,zp$=16384,Ap$=32,Tp$=32,dR6=128,iR6,Rp$="!#$%&'*+-/=?^_`{|}~.",Vp$;var pC0=L(()=>{oK();DH1=class DH1 extends Error{path;constructor($,Z){super(Z);this.name="TlsRuleValidationError",this.path=$,Object.setPrototypeOf(this,DH1.prototype)}};LH1=class LH1 extends Error{path;constructor($,Z){super(Z);this.name="TlsForwardAuthValidationError",this.path=$,Object.setPrototypeOf(this,LH1.prototype)}};Op$=["vmId","vpcId","public","host","port"],gR6=["vmId","vpcId","public","host"],jp$=["tcp","http","postgres","minecraft","smtp","imap","imaps","socks5"],wp$=["url","headers","timeoutMs","protectedCookies","authResponseHeaders"],Ep$=["id"],lR6=/^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/,cR6=/^[0-9A-Za-z-]+$/,iR6=new Set(["host","content-length","connection","keep-alive","proxy-authenticate","proxy-authorization","proxy-connection","te","trailer","transfer-encoding","upgrade"]);Vp$=["action","domain","protocol","source","destination","transform","match","forwardAuth"]});function In($){return`/v5/tunnels/${t6($)}`}function Dh($){return $.tunnelId??=$.id,$}class jH1{client;constructor($){this.client=$}list(){return this.client.get("/v5/tunnels").then(($)=>{return $.tunnels.forEach(Dh),$})}create($={}){return this.client.post("/v5/tunnels",$).then(Dh)}get($){return this.client.get(In($)).then(Dh)}update($,Z){return this.client.patch(In($),Z).then(Dh)}rotateKey($,Z={}){return this.client.post(`${In($)}/rotate-key`,Z).then(Dh)}delete($){return this.client.delete(In($))}attachVpc($,Z,Q={}){return this.client.post(`${In($)}/vpcs/${t6(Z)}`,Q).then(Dh)}detachVpc($,Z){return this.client.delete(`${In($)}/vpcs/${t6(Z)}`).then(Dh)}}var wH1=L(()=>{oK()});class EH1{client;basePath;constructor($,Z){this.client=$,this.basePath=Z}async readFile($,Z={}){let Q=await this.openRead($,Z);return new Uint8Array(await Q.arrayBuffer())}async readTextFile($,Z={}){return await(await this.openRead($,Z)).text()}async readFileStream($,Z={}){let Q=await this.openRead($,Z);if(!Q.body)throw Error(`no response body reading ${$}`);return Q.body}async writeFile($,Z,Q={}){let Y=typeof Z==="string"?new TextEncoder().encode(Z):Z,X=Y instanceof Uint8Array?Y.byteLength:Y.size;if(X>QM6)return this.uploadInChunks($,Y,X,Q);let J=Y instanceof Uint8Array?Y:new Uint8Array(await Y.arrayBuffer());await this.client.putBytes(`${this.basePath}/fs/write`,J,{path:$,mode:Q.mode,sha256:await bp$(J)},Q.signal),Q.onProgress?.({completedBytes:X,totalBytes:X})}writeTextFile($,Z,Q={}){return this.writeFile($,Z,Q)}async readDir($){let{entries:Z}=await this.client.get(`${this.basePath}/fs/dir`,{path:$});return Z}async mkdir($){await this.client.post(`${this.basePath}/fs/mkdir`,{path:$})}async remove($){await this.client.delete(`${this.basePath}/fs/remove`,{path:$})}async exists($){let{exists:Z}=await this.client.get(`${this.basePath}/fs/exists`,{path:$});return Z}stat($){return this.client.get(`${this.basePath}/fs/stat`,{path:$})}openRead($,Z){let{offset:Q,length:Y}=Z,X;if(Q!==void 0||Y!==void 0){let J=Q??0;X=Y===void 0?`bytes=${J}-`:`bytes=${J}-${J+Y-1}`}return this.client.getBytes(`${this.basePath}/fs/read`,{path:$},{range:X,signal:Z.signal})}async uploadInChunks($,Z,Q,Y){let X=Y.chunkSize??YM6,J=Y.maxAttempts??XM6,G=Z instanceof Uint8Array?await bp$(Z):void 0,W=await this.client.post(`${this.basePath}/fs/uploads`,{path:$,size:Q,sha256:G,mode:Y.mode}),K=`${this.basePath}/fs/uploads/${W.uploadId}`;try{let H=W.receivedBytes;while(H<Q){let F=Math.min(H+X,Q),U=Z instanceof Uint8Array?Z.subarray(H,F):Z.slice(H,F);H=(await this.putChunkWithRetry(K,U,H,J,Y.signal)).receivedBytes,Y.onProgress?.({completedBytes:Math.min(H,Q),totalBytes:Q})}await this.client.post(`${K}/commit`)}catch(H){throw await this.client.delete(K).catch(()=>{}),H}}async putChunkWithRetry($,Z,Q,Y,X){let J;for(let G=1;G<=Y;G++){X?.throwIfAborted?.();try{return await this.client.putBytes($,Z,{offset:Q},X)}catch(W){if(J=W,!(!(W instanceof xJ)||W.status>=500||W.status===408||W.status===409||W.status===429)||X?.aborted||G===Y)throw W;await JM6(Math.min(500*2**(G-1),8000));let H=await this.client.get($).catch(()=>{return});if(H&&H.receivedBytes>Q)return H}}throw J}}async function bp$($){let Z=globalThis.crypto?.subtle;if(!Z)return;let Q=await Z.digest("SHA-256",$);return Array.from(new Uint8Array(Q),(Y)=>Y.toString(16).padStart(2,"0")).join("")}function JM6($){return new Promise((Z)=>setTimeout(Z,$))}var QM6=8388608,YM6=16777216,XM6=5;var PH1=L(()=>{k50()});function GM6(){return typeof process<"u"&&Boolean(process.versions?.node)}async function xp$($,Z){if(GM6()){let Y;try{Y=await import("ws")}catch{throw Error("PTY sessions need the `ws` package in Node. Install it with `npm install ws`.")}return new Y.default($,{headers:Z})}let Q=globalThis.WebSocket;if(!Q)throw Error("PTY sessions need a WebSocket client; no global WebSocket is available in this environment.");return new Q($)}function _50($,Z,Q){if($.on){$.on(Z,Q);return}$.addEventListener?.(Z,Q)}function KM6($,Z){if($&&typeof $==="object"&&"data"in $){let Q=$.data;if(typeof Q==="string")return{text:Q};if(Q instanceof ArrayBuffer)return{binary:new Uint8Array(Q)};return{}}if($ instanceof Uint8Array)return Z?{binary:$}:{text:WM6.decode($)};if(typeof $==="string")return{text:$};return{}}class zH1{_sessionId;_slug;_created=!1;socket;constructor($,Z,Q={}){this.socket=$,this._sessionId=Z,_50($,"message",(Y,X)=>{let{text:J,binary:G}=KM6(Y,X);if(G){Q.onData?.(G);return}if(!J)return;let W;try{W=JSON.parse(J)}catch{return}if(W.type==="exited")Q.onExit?.(W.exitCode);else if(W.type==="error")Q.onError?.(Error(W.message));else if(W.type==="sessionInfo")this._sessionId=W.sessionId,this._slug=W.slug,this._created=W.created??!0,Q.onSessionInfo?.(W.sessionId)}),_50($,"close",(Y)=>{let X=Y;Q.onClose?.({wasClean:X?.wasClean??!0,code:X?.code??1000,reason:X?.reason??""})}),_50($,"error",(Y)=>Q.onError?.(Y))}write($){this.socket.send(typeof $==="string"?new TextEncoder().encode($):$)}resize($){this.sendControl({type:"resize",cols:$.cols,rows:$.rows})}signal($){this.sendControl({type:"signal",signal:$})}sendControl($){this.socket.send(JSON.stringify($))}detach(){this.socket.close()}get sessionId(){return this._sessionId}get slug(){return this._slug}get created(){return this._created}get readyState(){return this.socket.readyState}}function HM6($){return new Promise((Z,Q)=>{if($.readyState===1){Z();return}_50($,"open",()=>Z()),_50($,"error",(Y)=>Q(Y))})}class AH1{client;basePath;constructor($,Z){this.client=$,this.basePath=Z}async open($={}){let{exec:Z,cols:Q,rows:Y,linuxUser:X,slug:J,replaceOnExit:G,onData:W,onExit:K,onClose:H,onError:F}=$,U={};if(Z!==void 0)U.exec=Z;if(Q!==void 0)U.cols=Q;if(Y!==void 0)U.rows=Y;if(X!==void 0)U.linuxUser=X;if(J!==void 0)U.slug=J;if(G!==void 0)U.replaceOnExit=String(G);let N=fp$(this.client,`${this.basePath}/pty`,U),B=this.client.authHeaders(),D=await xp$(N,B);return new Promise((O,j)=>{let w=!1,E=new zH1(D,-1,{onData:W,onExit:K,onClose:(P)=>{if(!w)w=!0,j(Error("connection closed before sessionInfo"));H?.(P)},onError:(P)=>{if(!w)w=!0,j(P);F?.(P)},onSessionInfo:()=>{w=!0,O(E)}})})}async attach($){let{session:Z,linuxUser:Q,onData:Y,onExit:X,onClose:J,onError:G}=$,W=fp$(this.client,`${this.basePath}/pty/sessions/${t6(String(Z))}`,{...Q!==void 0?{linuxUser:Q}:{}}),K=this.client.authHeaders(),H=await xp$(W,K),F=new zH1(H,typeof Z==="number"?Z:-1,{onData:Y,onExit:X,onClose:J,onError:G});return await HM6(H),F}list($={}){return this.client.get(`${this.basePath}/pty/sessions`,$)}close($,Z={}){return this.client.delete(`${this.basePath}/pty/sessions/${t6(String($))}`,Z)}}class TH1{pty;linuxUser;constructor($,Z){this.pty=$,this.linuxUser=Z}open($={}){return this.pty.open({...$,linuxUser:this.linuxUser})}attach($){return this.pty.attach({...$,linuxUser:this.linuxUser})}list(){return this.pty.list({linuxUser:this.linuxUser})}close($){return this.pty.close($,{linuxUser:this.linuxUser})}}function fp$($,Z,Q){return $.url(Z,Q).replace(/^http/,"ws")}var WM6;var qH1=L(()=>{oK();WM6=new TextDecoder});class RH1{client;constructor($){this.client=$}list($={}){return this.client.get("/v5/snapshots",$)}get($){return this.client.get(`/v5/snapshots/${t6($)}`)}update($,Z){return this.client.patch(`/v5/snapshots/${t6($)}`,Z)}delete($){return this.client.delete(`/v5/snapshots/${t6($)}`)}}var MH1=L(()=>{oK()});var yp$=()=>{};function VH1($){return`/v5/vms/${t6($)}`}class IH1{id;fs;pty;client;basePath;constructor($,Z){this.client=$,this.id=Z,this.basePath=VH1(Z),this.fs=new EH1($,this.basePath),this.pty=new AH1($,this.basePath)}data(){return this.client.get(this.basePath)}firewallRules(){return this.client.get("/v5/firewall/rules",{vmId:this.id})}update($){return this.client.patch(this.basePath,$)}start(){return this.client.post(`${this.basePath}/start`)}pause(){return this.client.post(`${this.basePath}/pause`)}resize($){return this.client.post(`${this.basePath}/resize`,$)}delete(){return this.client.delete(this.basePath)}exec($){let Z=typeof $==="string"?{command:$}:$;return this.client.post(`${this.basePath}/exec-await`,Z)}linuxUser($){return new gp$(this,$)}snapshot($={}){return this.client.post(`${this.basePath}/snapshot`,$)}}class gp${vm;linuxUser;pty;constructor($,Z){this.vm=$,this.linuxUser=Z,this.pty=new TH1($.pty,Z)}exec($){let Z=typeof $==="string"?{command:$}:$;return this.vm.exec({...Z,linuxUser:this.linuxUser})}}class kH1{client;snapshots;constructor($){this.client=$,this.snapshots=new RH1($)}async create($){if(iC0($.firewall,"VM"),$.tls!==void 0)Sp$($.tls);let Z=await this.client.post("/v5/vms",$);return{vm:new IH1(this.client,Z.id),vmId:Z.id,data:Z,firewallRules:Z.firewallRules??[],tlsRules:Z.tlsRules??[]}}list($={}){return this.client.get("/v5/vms",$)}get($){return this.client.get(VH1($))}ref($){return new IH1(this.client,$)}delete($){return this.client.delete(VH1($))}}var CH1=L(()=>{C50();pC0();oK();PH1();qH1();MH1();yp$();PH1();qH1();MH1()});function SH1($){return`/v5/vpcs/${t6($)}`}class hp${client;basePath;constructor($,Z){this.client=$,this.basePath=Z}list(){return this.client.get(`${this.basePath}/tunnels`)}}class _H1{id;tunnels;client;basePath;constructor($,Z){this.client=$,this.id=Z,this.basePath=SH1(Z),this.tunnels=new hp$($,this.basePath)}data(){return this.client.get(this.basePath)}update($){return this.client.patch(this.basePath,$)}delete(){return this.client.delete(this.basePath)}}class vH1{client;constructor($){this.client=$}list(){return this.client.get("/v5/vpcs")}async create($={}){if($.firewall!==void 0)iC0($.firewall,"network");let Z=await this.client.post("/v5/vpcs",$);return{vpc:new _H1(this.client,Z.id),vpcId:Z.id,data:Z,firewallRules:Z.firewallRules??[]}}get($){return this.client.get(SH1($))}ref($){return new _H1(this.client,$)}delete($){return this.client.delete(SH1($))}}var bH1=L(()=>{C50();oK()});class nC0{client;vms;vpc;tunnels;firewall;tls;domains;identities;constructor($={}){this.client=new $H1($),this.vms=new kH1(this.client),this.vpc=new vH1(this.client),this.tunnels=new jH1(this.client),this.firewall=new GH1(this.client),this.tls=new OH1(this.client),this.domains=new ZH1(this.client),this.identities=new HH1(this.client)}fetch($,Z){return this.client.fetch($,Z)}}var up$=L(()=>{oK();QH1();C50();FH1();pC0();wH1();CH1();bH1();oK();k50();CH1();bH1();wH1();QH1();C50();pC0();FH1()});var cp$;var lp$=L(()=>{cp$={name:"@decocms/sandbox",version:"1.93.3",private:!0,type:"module",description:"Sandbox runtime for isolated Studio tool execution",scripts:{check:"tsc --noEmit",test:"bun test",build:"bun run build:typegen && bun run build:harness-runner","build:typegen":"mkdir -p dist && bun run --cwd=../typegen build && bun --cwd=../typegen pm pack --filename $PWD/dist/typegen.tgz --quiet","build:harness-runner":"mkdir -p dist && bun --cwd=../harness-runner pm pack --filename $PWD/dist/harness-runner.tgz --quiet"},exports:{"./shared":"./shared.ts","./provider":"./server/provider/index.ts","./provider/agent-sandbox":"./server/provider/agent-sandbox/index.ts","./provider/postgres-state-store":"./server/provider/postgres-state-store.ts","./provider/freestyle":"./server/provider/freestyle.ts","./provider/remote":"./server/provider/remote.ts","./provider/router":"./server/provider/router.ts","./provider/sandbox-api":"./server/provider/sandbox-api.ts","./provider/sandbox-server":"./server/provider/sandbox-server.ts","./daemon-client":"./server/daemon-client.ts","./org-fs":"./org-fs.ts","./dispatch":"./dispatch/index.ts","./dispatch/*":"./dispatch/*.ts","./proxy/http":"./proxy/http.ts","./proxy/websocket":"./proxy/websocket.ts"},dependencies:{"@decocms/shared":"workspace:*","@kubernetes/client-node":"^1.4.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0",freestyle:"0.2.16",zod:"4.3.6"},devDependencies:{"@types/bun":"latest",postgres:"^3.4.5",typescript:"^7.0.2"}}});function tC0($){let Z=$?.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of studio-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"});return async(Q,Y)=>{if(!Z)return Y();let X=performance.now(),J=(G)=>Z.record(performance.now()-X,{runner_kind:Q,source:"daemon",status_code:G});try{let G=await Y();return J(G.status),G}catch(G){throw J(0),G}}}var HO;var oC0=L(()=>{HO={kubernetes:"agent-sandbox",freestyle:"freestyle"}});var ap$={};O6(ap$,{FreestyleSandboxProvider:()=>sp$});import{createHash as mp$,createHmac as UM6,randomBytes as NM6}from"crypto";class sp${apiKey;freestyle;lookupClient;image;sidecarImage;allowUserNamespaces;idleTimeoutSeconds;idlePauseMs;autoDeleteSeconds;domainSuffix;timeDaemonRequest;inflight=new Uh;snapshotInflight=new Uh;knownSnapshots=new Set;lookups=new Map;releaseTimers=new Map;idleSweep=null;sweeping=!1;repoSnapshots=new Map;repoSnapshotBuilds=new Set;repoSnapshotFailures=new Map;constructor($){if(this.apiKey=$.apiKey,this.freestyle=$.client??new nC0({apiKey:$.apiKey}),this.lookupClient=$.client??new nC0({apiKey:$.apiKey,fetch:Object.assign((Z,Q)=>fetch(Z,{...Q,signal:Q?.signal?AbortSignal.any([Q.signal,AbortSignal.timeout(hH1)]):AbortSignal.timeout(hH1)}),{preconnect:fetch.preconnect})}),this.image=$.image??`ghcr.io/decocms/studio/studio-sandbox-go:${cp$.version}`,this.sidecarImage=$.orgFsSidecarImage??DM6,this.allowUserNamespaces=$.allowUserNamespaces??!1,this.idleTimeoutSeconds=$.idleTimeoutSeconds??300,this.idlePauseMs=$.idlePauseMs??600000,this.autoDeleteSeconds=$.autoDeleteSeconds??86400,this.domainSuffix=$.domainSuffix??"style.dev",this.timeDaemonRequest=tC0($.meter),this.idlePauseMs>0)this.idleSweep=setInterval(()=>void this.pauseIdle(),qM6),this.idleSweep.unref?.()}async owns($){return await this.find($)!==null}daemonUrl($){return`https://${$}.${this.domainSuffix}`}async find($,Z={}){let Q=this.lookups.get($);if(!Z.refresh&&Q&&Date.now()-Q.at<(Q.found?PM6:zM6))return Q.found;let Y=null;try{let X=await this.lookupClient.vms.get($),J=X.metadata[xH1];if(J)Y={vm:this.freestyle.vms.ref(X.id),daemon:{url:this.daemonUrl($),token:J}}}catch(X){if(!(X instanceof xJ&&X.status===404))throw X}return this.remember($,Y),Y}remember($,Z){if(this.lookups.delete($),this.lookups.size>=AM6){let Q=this.lookups.keys().next();if(!Q.done)this.lookups.delete(Q.value)}this.lookups.set($,{found:Z,at:Date.now()})}async warm(){await this.baseSnapshot().catch(($)=>console.warn(`[${vQ}] base snapshot warm failed: ${Oh($)}`))}baseSnapshot(){let{image:$,sidecarImage:Z}=this,Q=this.allowUserNamespaces?`
+`);return R6.from(Q)};CT6.decodePax=function(Z){let Q={};while(Z.length){let Y=0;while(Y<Z.length&&Z[Y]!==32)Y++;let X=parseInt(R6.toString(Z.subarray(0,Y)),10);if(!X)return Q;let J=R6.toString(Z.subarray(Y+1,X-1)),G=J.indexOf("=");if(G===-1)return Q;Q[J.slice(0,G)]=J.slice(G+1),Z=Z.subarray(X)}return Q};CT6.encode=function(Z){let Q=R6.alloc(512),Y=Z.name,X="";if(Z.typeflag===5&&Y[Y.length-1]!=="/")Y+="/";if(R6.byteLength(Y)!==Y.length)return null;while(R6.byteLength(Y)>100){let J=Y.indexOf("/");if(J===-1)return null;X+=X?"/"+Y.slice(0,J):Y.slice(0,J),Y=Y.slice(J+1)}if(R6.byteLength(Y)>100||R6.byteLength(X)>155)return null;if(Z.linkname&&R6.byteLength(Z.linkname)>100)return null;if(R6.write(Q,Y),R6.write(Q,jz(Z.mode&4095,6),100),R6.write(Q,jz(Z.uid,6),108),R6.write(Q,jz(Z.gid,6),116),IT6(Z.size,Q,124),R6.write(Q,jz(Z.mtime.getTime()/1000|0,11),136),Q[156]=48+MT6(Z.type),Z.linkname)R6.write(Q,Z.linkname,157);if(R6.copy(Dd$,Q,257),R6.copy(ET6,Q,263),Z.uname)R6.write(Q,Z.uname,265);if(Z.gname)R6.write(Q,Z.gname,297);if(R6.write(Q,jz(Z.devmajor||0,6),329),R6.write(Q,jz(Z.devminor||0,6),337),X)R6.write(Q,X,345);return R6.write(Q,jz(Od$(Q),6),148),Q};CT6.decode=function(Z,Q,Y){let X=Z[156]===0?0:Z[156]-48,J=wn(Z,0,100,Q),G=Oz(Z,100,8),W=Oz(Z,108,8),K=Oz(Z,116,8),H=Oz(Z,124,12),F=Oz(Z,136,12),U=RT6(X),N=Z[157]===0?null:wn(Z,157,100,Q),B=wn(Z,265,32),D=wn(Z,297,32),O=Oz(Z,329,8),j=Oz(Z,337,8),w=Od$(Z);if(w===256)return null;if(w!==Oz(Z,148,8))throw Error("Invalid tar header. Maybe the tar is corrupted or it needs to be gunzipped?");if(AT6(Z)){if(Z[345])J=wn(Z,345,155,Q)+"/"+J}else if(TT6(Z));else if(!Y)throw Error("Invalid tar header: unknown format.");if(X===0&&J&&J[J.length-1]==="/")X=5;return{name:J,mode:G,uid:W,gid:K,size:H,mtime:new Date(1000*F),type:U,linkname:N,uname:B,gname:D,devmajor:O,devminor:j,pax:null}};function AT6($){return R6.equals(Dd$,$.subarray(257,263))}function TT6($){return R6.equals(PT6,$.subarray(257,263))&&R6.equals(zT6,$.subarray(263,265))}function qT6($,Z,Q){if(typeof $!=="number")return Q;if($=~~$,$>=Z)return Z;if($>=0)return $;if($+=Z,$>=0)return $;return 0}function RT6($){switch($){case 0:return"file";case 1:return"link";case 2:return"symlink";case 3:return"character-device";case 4:return"block-device";case 5:return"directory";case 6:return"fifo";case 7:return"contiguous-file";case 72:return"pax-header";case 55:return"pax-global-header";case 27:return"gnu-long-link-path";case 28:case 30:return"gnu-long-path"}return null}function MT6($){switch($){case"file":return 0;case"link":return 1;case"symlink":return 2;case"character-device":return 3;case"block-device":return 4;case"directory":return 5;case"fifo":return 6;case"contiguous-file":return 7;case"pax-header":return 72}return 0}function Ld$($,Z,Q,Y){for(;Q<Y;Q++)if($[Q]===Z)return Q;return Y}function Od$($){let Z=256;for(let Q=0;Q<148;Q++)Z+=$[Q];for(let Q=156;Q<512;Q++)Z+=$[Q];return Z}function jz($,Z){if($=$.toString(8),$.length>Z)return"7777777777777777777".slice(0,Z)+" ";return"0000000000000000000".slice(0,Z-$.length)+$+" "}function VT6($,Z,Q){Z[Q]=128;for(let Y=11;Y>0;Y--)Z[Q+Y]=$&255,$=Math.floor($/256)}function IT6($,Z,Q){if($.toString(8).length>11)VT6($,Z,Q);else R6.write(Z,jz($,11),Q)}function kT6($){let Z;if($[0]===128)Z=!0;else if($[0]===255)Z=!1;else return null;let Q=[],Y;for(Y=$.length-1;Y>0;Y--){let G=$[Y];if(Z)Q.push(G);else Q.push(255-G)}let X=0,J=Q.length;for(Y=0;Y<J;Y++)X+=Q[Y]*Math.pow(256,Y);return Z?X:-1*X}function Oz($,Z,Q){if($=$.subarray(Z,Z+Q),Z=0,$[Z]&128)return kT6($);else{while(Z<$.length&&$[Z]===32)Z++;let Y=qT6(Ld$($,32,Z,$.length),$.length,$.length);while(Z<Y&&$[Z]===0)Z++;if(Y===Z)return 0;return parseInt(R6.toString($.subarray(Z,Y)),8)}}function wn($,Z,Q,Y){return R6.toString($.subarray(Z,Ld$($,0,Z,Z+Q)),Y)}function TK1($){let Z=R6.byteLength($),Q=Math.floor(Math.log(Z)/Math.log(10))+1;if(Z+Q>=Math.pow(10,Q))Q++;return Z+Q+$}});var qd$=y((fuZ,Td$)=>{var{Writable:fT6,Readable:yT6,getStreamError:jd$}=AK1(),gT6=OK1(),wd$=jn(),En=qK1(),hT6=wd$.alloc(0);class Ed${constructor(){this.buffered=0,this.shifted=0,this.queue=new gT6,this._offset=0}push($){this.buffered+=$.byteLength,this.queue.push($)}shiftFirst($){return this._buffered===0?null:this._next($)}shift($){if($>this.buffered)return null;if($===0)return hT6;let Z=this._next($);if($===Z.byteLength)return Z;let Q=[Z];while(($-=Z.byteLength)>0)Z=this._next($),Q.push(Z);return wd$.concat(Q)}_next($){let Z=this.queue.peek(),Q=Z.byteLength-this._offset;if($>=Q){let Y=this._offset?Z.subarray(this._offset,Z.byteLength):Z;return this.queue.shift(),this._offset=0,this.buffered-=Q,this.shifted+=Q,Y}return this.buffered-=$,this.shifted+=$,Z.subarray(this._offset,this._offset+=$)}}class Pd$ extends yT6{constructor($,Z,Q){super();this.header=Z,this.offset=Q,this._parent=$}_read($){if(this.header.size===0)this.push(null);if(this._parent._stream===this)this._parent._update();$(null)}_predestroy(){this._parent.destroy(jd$(this))}_detach(){if(this._parent._stream===this)this._parent._stream=null,this._parent._missing=Ad$(this.header.size),this._parent._update()}_destroy($){this._detach(),$(null)}}class zd$ extends fT6{constructor($){super($);if(!$)$={};this._buffer=new Ed$,this._offset=0,this._header=null,this._stream=null,this._missing=0,this._longHeader=!1,this._callback=RK1,this._locked=!1,this._finished=!1,this._pax=null,this._paxGlobal=null,this._gnuLongPath=null,this._gnuLongLinkPath=null,this._filenameEncoding=$.filenameEncoding||"utf-8",this._allowUnknownFormat=!!$.allowUnknownFormat,this._unlockBound=this._unlock.bind(this)}_unlock($){if(this._locked=!1,$){this.destroy($),this._continueWrite($);return}this._update()}_consumeHeader(){if(this._locked)return!1;this._offset=this._buffer.shifted;try{this._header=En.decode(this._buffer.shift(512),this._filenameEncoding,this._allowUnknownFormat)}catch($){return this._continueWrite($),!1}if(!this._header)return!0;switch(this._header.type){case"gnu-long-path":case"gnu-long-link-path":case"pax-global-header":case"pax-header":return this._longHeader=!0,this._missing=this._header.size,!0}if(this._locked=!0,this._applyLongHeaders(),this._header.size===0||this._header.type==="directory")return this.emit("entry",this._header,this._createStream(),this._unlockBound),!0;return this._stream=this._createStream(),this._missing=this._header.size,this.emit("entry",this._header,this._stream,this._unlockBound),!0}_applyLongHeaders(){if(this._gnuLongPath)this._header.name=this._gnuLongPath,this._gnuLongPath=null;if(this._gnuLongLinkPath)this._header.linkname=this._gnuLongLinkPath,this._gnuLongLinkPath=null;if(this._pax){if(this._pax.path)this._header.name=this._pax.path;if(this._pax.linkpath)this._header.linkname=this._pax.linkpath;if(this._pax.size)this._header.size=parseInt(this._pax.size,10);this._header.pax=this._pax,this._pax=null}}_decodeLongHeader($){switch(this._header.type){case"gnu-long-path":this._gnuLongPath=En.decodeLongPath($,this._filenameEncoding);break;case"gnu-long-link-path":this._gnuLongLinkPath=En.decodeLongPath($,this._filenameEncoding);break;case"pax-global-header":this._paxGlobal=En.decodePax($);break;case"pax-header":this._pax=this._paxGlobal===null?En.decodePax($):Object.assign({},this._paxGlobal,En.decodePax($));break}}_consumeLongHeader(){this._longHeader=!1,this._missing=Ad$(this._header.size);let $=this._buffer.shift(this._header.size);try{this._decodeLongHeader($)}catch(Z){return this._continueWrite(Z),!1}return!0}_consumeStream(){let $=this._buffer.shiftFirst(this._missing);if($===null)return!1;this._missing-=$.byteLength;let Z=this._stream.push($);if(this._missing===0){if(this._stream.push(null),Z)this._stream._detach();return Z&&this._locked===!1}return Z}_createStream(){return new Pd$(this,this._header,this._offset)}_update(){while(this._buffer.buffered>0&&!this.destroying){if(this._missing>0){if(this._stream!==null){if(this._consumeStream()===!1)return;continue}if(this._longHeader===!0){if(this._missing>this._buffer.buffered)break;if(this._consumeLongHeader()===!1)return!1;continue}let $=this._buffer.shiftFirst(this._missing);if($!==null)this._missing-=$.byteLength;continue}if(this._buffer.buffered<512)break;if(this._stream!==null||this._consumeHeader()===!1)return}this._continueWrite(null)}_continueWrite($){let Z=this._callback;this._callback=RK1,Z($)}_write($,Z){this._callback=Z,this._buffer.push($),this._update()}_final($){this._finished=this._missing===0&&this._buffer.buffered===0,$(this._finished?null:Error("Unexpected end of data"))}_predestroy(){this._continueWrite(null)}_destroy($){if(this._stream)this._stream.destroy(jd$(this));$(null)}[Symbol.asyncIterator](){let $=null,Z=null,Q=null,Y=null,X=null,J=this;return this.on("entry",K),this.on("error",(U)=>{$=U}),this.on("close",H),{[Symbol.asyncIterator](){return this},next(){return new Promise(W)},return(){return F(null)},throw(U){return F(U)}};function G(U){if(!X)return;let N=X;X=null,N(U)}function W(U,N){if($)return N($);if(Y){U({value:Y,done:!1}),Y=null;return}if(Z=U,Q=N,G(null),J._finished&&Z)Z({value:void 0,done:!0}),Z=Q=null}function K(U,N,B){if(X=B,N.on("error",RK1),Z)Z({value:N,done:!1}),Z=Q=null;else Y=N}function H(){if(G($),!Z)return;if($)Q($);else Z({value:void 0,done:!0});Z=Q=null}function F(U){return J.destroy(U),G(U),new Promise((N,B)=>{if(J.destroyed)return N({value:void 0,done:!0});J.once("close",function(){if(U)B(U);else N({value:void 0,done:!0})})})}}}Td$.exports=function(Z){return new zd$(Z)};function RK1(){}function Ad$($){return $&=511,$&&512-$}});var Md$=y((yuZ,MK1)=>{var Rd$={S_IFMT:61440,S_IFDIR:16384,S_IFCHR:8192,S_IFBLK:24576,S_IFIFO:4096,S_IFLNK:40960};try{MK1.exports=V0("fs").constants||Rd$}catch{MK1.exports=Rd$}});var vd$=y((guZ,_d$)=>{var{Readable:uT6,Writable:lT6,getStreamError:Vd$}=AK1(),Hh=jn(),Pn=Md$(),AC0=qK1(),Id$=Hh.alloc(1024);class kd$ extends lT6{constructor($,Z,Q){super({mapWritable:mT6,eagerOpen:!0});if(this.written=0,this.header=Z,this._callback=Q,this._linkname=null,this._isLinkname=Z.type==="symlink"&&!Z.linkname,this._isVoid=Z.type!=="file"&&Z.type!=="contiguous-file",this._finished=!1,this._pack=$,this._openCallback=null,this._pack._stream===null)this._pack._stream=this;else this._pack._pending.push(this)}_open($){if(this._openCallback=$,this._pack._stream===this)this._continueOpen()}_continuePack($){if(this._callback===null)return;let Z=this._callback;this._callback=null,Z($)}_continueOpen(){if(this._pack._stream===null)this._pack._stream=this;let $=this._openCallback;if(this._openCallback=null,$===null)return;if(this._pack.destroying)return $(Error("pack stream destroyed"));if(this._pack._finalized)return $(Error("pack stream is already finalized"));if(this._pack._stream=this,!this._isLinkname)this._pack._encode(this.header);if(this._isVoid)this._finish(),this._continuePack(null);$(null)}_write($,Z){if(this._isLinkname)return this._linkname=this._linkname?Hh.concat([this._linkname,$]):$,Z(null);if(this._isVoid){if($.byteLength>0)return Z(Error("No body allowed for this entry"));return Z()}if(this.written+=$.byteLength,this._pack.push($))return Z();this._pack._drain=Z}_finish(){if(this._finished)return;if(this._finished=!0,this._isLinkname)this.header.linkname=this._linkname?Hh.toString(this._linkname,"utf-8"):"",this._pack._encode(this.header);Sd$(this._pack,this.header.size),this._pack._done(this)}_final($){if(this.written!==this.header.size)return $(Error("Size mismatch"));this._finish(),$(null)}_getError(){return Vd$(this)||Error("tar entry destroyed")}_predestroy(){this._pack.destroy(this._getError())}_destroy($){this._pack._done(this),this._continuePack(this._finished?null:this._getError()),$()}}class Cd$ extends uT6{constructor($){super($);this._drain=VK1,this._finalized=!1,this._finalizing=!1,this._pending=[],this._stream=null}entry($,Z,Q){if(this._finalized||this.destroying)throw Error("already finalized or destroyed");if(typeof Z==="function")Q=Z,Z=null;if(!Q)Q=VK1;if(!$.size||$.type==="symlink")$.size=0;if(!$.type)$.type=cT6($.mode);if(!$.mode)$.mode=$.type==="directory"?493:420;if(!$.uid)$.uid=0;if(!$.gid)$.gid=0;if(!$.mtime)$.mtime=new Date;if(typeof Z==="string")Z=Hh.from(Z);let Y=new kd$(this,$,Q);if(Hh.isBuffer(Z))return $.size=Z.byteLength,Y.write(Z),Y.end(),Y;if(Y._isVoid)return Y;return Y}finalize(){if(this._stream||this._pending.length>0){this._finalizing=!0;return}if(this._finalized)return;this._finalized=!0,this.push(Id$),this.push(null)}_done($){if($!==this._stream)return;if(this._stream=null,this._finalizing)this.finalize();if(this._pending.length)this._pending.shift()._continueOpen()}_encode($){if(!$.pax){let Z=AC0.encode($);if(Z){this.push(Z);return}}this._encodePax($)}_encodePax($){let Z=AC0.encodePax({name:$.name,linkname:$.linkname,pax:$.pax}),Q={name:"PaxHeader",mode:$.mode,uid:$.uid,gid:$.gid,size:Z.byteLength,mtime:$.mtime,type:"pax-header",linkname:$.linkname&&"PaxHeader",uname:$.uname,gname:$.gname,devmajor:$.devmajor,devminor:$.devminor};this.push(AC0.encode(Q)),this.push(Z),Sd$(this,Z.byteLength),Q.size=$.size,Q.type=$.type,this.push(AC0.encode(Q))}_doDrain(){let $=this._drain;this._drain=VK1,$()}_predestroy(){let $=Vd$(this);if(this._stream)this._stream.destroy($);while(this._pending.length){let Z=this._pending.shift();Z.destroy($),Z._continueOpen()}this._doDrain()}_read($){this._doDrain(),$()}}_d$.exports=function(Z){return new Cd$(Z)};function cT6($){switch($&Pn.S_IFMT){case Pn.S_IFBLK:return"block-device";case Pn.S_IFCHR:return"character-device";case Pn.S_IFDIR:return"directory";case Pn.S_IFIFO:return"fifo";case Pn.S_IFLNK:return"symlink"}return"file"}function VK1(){}function Sd$($,Z){if(Z&=511,Z)$.push(Id$.subarray(0,512-Z))}function mT6($){return Hh.isBuffer($)?$:Hh.from($)}});var bd$=y((dT6)=>{dT6.extract=qd$();dT6.pack=vd$()});var yd$=y((uuZ,fd$)=>{fd$.exports=xd$;function xd$($,Z){if($&&Z)return xd$($)(Z);if(typeof $!=="function")throw TypeError("need wrapper function");return Object.keys($).forEach(function(Y){Q[Y]=$[Y]}),Q;function Q(){var Y=Array(arguments.length);for(var X=0;X<Y.length;X++)Y[X]=arguments[X];var J=$.apply(this,Y),G=Y[Y.length-1];if(typeof J==="function"&&J!==G)Object.keys(G).forEach(function(W){J[W]=G[W]});return J}}});var kK1=y((luZ,IK1)=>{var gd$=yd$();IK1.exports=gd$(TC0);IK1.exports.strict=gd$(hd$);TC0.proto=TC0(function(){Object.defineProperty(Function.prototype,"once",{value:function(){return TC0(this)},configurable:!0}),Object.defineProperty(Function.prototype,"onceStrict",{value:function(){return hd$(this)},configurable:!0})});function TC0($){var Z=function(){if(Z.called)return Z.value;return Z.called=!0,Z.value=$.apply(this,arguments)};return Z.called=!1,Z}function hd$($){var Z=function(){if(Z.called)throw Error(Z.onceError);return Z.called=!0,Z.value=$.apply(this,arguments)},Q=$.name||"Function wrapped with `once`";return Z.onceError=Q+" shouldn't be called more than once",Z.called=!1,Z}});var cd$=y((cuZ,ld$)=>{var nT6=kK1(),tT6=function(){},oT6=global.Bare?queueMicrotask:process.nextTick.bind(process),sT6=function($){return $.setHeader&&typeof $.abort==="function"},rT6=function($){return $.stdio&&Array.isArray($.stdio)&&$.stdio.length===3},ud$=function($,Z,Q){if(typeof Z==="function")return ud$($,null,Z);if(!Z)Z={};Q=nT6(Q||tT6);var{_writableState:Y,_readableState:X}=$,J=Z.readable||Z.readable!==!1&&$.readable,G=Z.writable||Z.writable!==!1&&$.writable,W=!1,K=function(){if(!$.writable)H()},H=function(){if(G=!1,!J)Q.call($)},F=function(){if(J=!1,!G)Q.call($)},U=function(j){Q.call($,j?Error("exited with error code: "+j):null)},N=function(j){Q.call($,j)},B=function(){oT6(D)},D=function(){if(W)return;if(J&&!(X&&(X.ended&&!X.destroyed)))return Q.call($,Error("premature close"));if(G&&!(Y&&(Y.ended&&!Y.destroyed)))return Q.call($,Error("premature close"))},O=function(){$.req.on("finish",H)};if(sT6($))if($.on("complete",H),$.on("abort",B),$.req)O();else $.on("request",O);else if(G&&!Y)$.on("end",K),$.on("close",K);if(rT6($))$.on("exit",U);if($.on("end",F),$.on("finish",H),Z.error!==!1)$.on("error",N);return $.on("close",B),function(){if(W=!0,$.removeListener("complete",H),$.removeListener("abort",B),$.removeListener("request",O),$.req)$.req.removeListener("finish",H);$.removeListener("end",K),$.removeListener("close",K),$.removeListener("finish",H),$.removeListener("exit",U),$.removeListener("end",F),$.removeListener("error",N),$.removeListener("close",B)}};ld$.exports=ud$});var id$=y((muZ,dd$)=>{var aT6=kK1(),eT6=cd$(),qC0;try{qC0=V0("fs")}catch($){}var P50=function(){},$q6=typeof process>"u"?!1:/^v?\.0/.test(process.version),RC0=function($){return typeof $==="function"},Zq6=function($){if(!$q6)return!1;if(!qC0)return!1;return($ instanceof(qC0.ReadStream||P50)||$ instanceof(qC0.WriteStream||P50))&&RC0($.close)},Qq6=function($){return $.setHeader&&RC0($.abort)},Yq6=function($,Z,Q,Y){Y=aT6(Y);var X=!1;$.on("close",function(){X=!0}),eT6($,{readable:Z,writable:Q},function(G){if(G)return Y(G);X=!0,Y()});var J=!1;return function(G){if(X)return;if(J)return;if(J=!0,Zq6($))return $.close(P50);if(Qq6($))return $.abort();if(RC0($.destroy))return $.destroy();Y(G||Error("stream was destroyed"))}},md$=function($){$()},Xq6=function($,Z){return $.pipe(Z)},Jq6=function(){var $=Array.prototype.slice.call(arguments),Z=RC0($[$.length-1]||P50)&&$.pop()||P50;if(Array.isArray($[0]))$=$[0];if($.length<2)throw Error("pump requires two streams per minimum");var Q,Y=$.map(function(X,J){var G=J<$.length-1,W=J>0;return Yq6(X,G,W,function(K){if(!Q)Q=K;if(K)Y.forEach(md$);if(G)return;Y.forEach(md$),Z(Q)})});return $.reduce(Xq6)};dd$.exports=Jq6});var $i$=y((Hq6)=>{var pd$=bd$(),nd$=id$(),td$=V0("fs"),gZ=V0("path"),z50=(global.Bare?global.Bare.platform:process.platform)==="win32";Hq6.pack=function(Z,Q){if(!Z)Z=".";if(!Q)Q={};let Y=Q.fs||td$,X=Q.ignore||Q.filter||A50,J=Q.mapStream||ad$,G=Kq6(Y,Q.dereference?Y.stat:Y.lstat,Z,X,Q.entries,Q.sort),W=Q.strict!==!1,K=typeof Q.umask==="number"?~Q.umask:~od$(),H=Q.pack||pd$.pack(),F=Q.finish||A50,U=Q.map||A50,N=typeof Q.dmode==="number"?Q.dmode:0,B=typeof Q.fmode==="number"?Q.fmode:0;if(Q.strip)U=ed$(U,Q.strip);if(Q.readable)N|=parseInt(555,8),B|=parseInt(444,8);if(Q.writable)N|=parseInt(333,8),B|=parseInt(222,8);j();function D(w,E){Y.readlink(gZ.join(Z,w),function(P,T){if(P)return H.destroy(P);E.linkname=CK1(T),H.entry(E,j)})}function O(w,E,P){if(H.destroyed)return;if(w)return H.destroy(w);if(!E){if(Q.finalize!==!1)H.finalize();return F(H)}if(P.isSocket())return j();let T={name:CK1(E),mode:(P.mode|(P.isDirectory()?N:B))&K,mtime:P.mtime,size:P.size,type:"file",uid:P.uid,gid:P.gid};if(P.isDirectory())return T.size=0,T.type="directory",T=U(T)||T,H.entry(T,j);if(P.isSymbolicLink())return T.size=0,T.type="symlink",T=U(T)||T,D(E,T);if(T=U(T)||T,!P.isFile()){if(W)return H.destroy(Error("unsupported type for "+E));return j()}let z=H.entry(T,j),A=J(Y.createReadStream(gZ.join(Z,E),{start:0,end:T.size>0?T.size-1:T.size}),T);A.on("error",function(R){z.destroy(R)}),nd$(A,z)}function j(w){if(w)return H.destroy(w);G(O)}return H};function Gq6($){return $.length?$[$.length-1]:null}function Wq6(){return!global.Bare&&process.getuid?process.getuid():-1}function od$(){return!global.Bare&&process.umask?process.umask():0}Hq6.extract=function(Z,Q){if(!Z)Z=".";if(!Q)Q={};Z=gZ.resolve(Z);let Y=Q.fs||td$,X=Q.ignore||Q.filter||A50,J=Q.mapStream||ad$,G=Q.chown!==!1&&!z50&&Wq6()===0,W=Q.extract||pd$.extract(),K=[],H=new Date,F=typeof Q.umask==="number"?~Q.umask:~od$(),U=Q.strict!==!1,N=Q.validateSymlinks!==!1,B=Q.map||A50,D=typeof Q.dmode==="number"?Q.dmode:0,O=typeof Q.fmode==="number"?Q.fmode:0;if(Q.strip)B=ed$(B,Q.strip);if(Q.readable)D|=parseInt(555,8),O|=parseInt(444,8);if(Q.writable)D|=parseInt(333,8),O|=parseInt(222,8);if(W.on("entry",j),Q.finish)W.on("finish",Q.finish);return W;function j(z,A,R){z=B(z)||z,z.name=CK1(z.name);let f=gZ.join(Z,gZ.join("/",z.name));if(X(f,z))return A.resume(),R();let S=gZ.join(f,".")===gZ.join(Z,".")?Z:gZ.dirname(f);rd$(Y,S,gZ.join(Z,"."),function(d,W0){if(d)return R(d);if(!W0)return R(Error(S+" is not a valid path"));if(z.type==="directory")return K.push([f,z.mtime]),T(f,{fs:Y,own:G,uid:z.uid,gid:z.gid,mode:z.mode},V);T(S,{fs:Y,own:G,uid:z.uid,gid:z.gid,mode:493},function(I0){if(I0)return R(I0);switch(z.type){case"file":return l();case"link":return b();case"symlink":return v()}if(U)return R(Error("unsupported type for "+f+" ("+z.type+")"));A.resume(),R()})});function V(d){if(d)return R(d);E(f,z,function(W0){if(W0)return R(W0);if(z50)return R();P(f,z,R)})}function v(){if(z50)return R();Y.unlink(f,function(){let d=gZ.resolve(gZ.dirname(f),z.linkname);if(!h(d)&&N)return R(Error(f+" is not a valid symlink"));sd$(Y,d,gZ.join(Z,"."),function(W0,I0){if(W0)return R(W0);if(!I0&&N)return R(Error(f+" is not a valid symlink"));Y.symlink(z.linkname,f,V)})})}function b(){if(z50)return R();Y.unlink(f,function(){let d=gZ.join(Z,gZ.join("/",z.linkname));Y.realpath(d,function(W0,I0){if(W0||!h(I0))return R(Error(f+" is not a valid hardlink"));Y.link(I0,f,function(J0){if(J0&&J0.code==="EPERM"&&Q.hardlinkAsFilesFallback)return A=Y.createReadStream(I0),l();V(J0)})})})}function h(d){return d===Z||d.startsWith(Z+gZ.sep)}function l(){let d=Y.createWriteStream(f),W0=J(A,z);d.on("error",function(I0){W0.destroy(I0)}),nd$(W0,d,function(I0){if(I0)return R(I0);d.on("close",V)})}}function w(z,A){let R;while((R=Gq6(K))&&z.slice(0,R[0].length)!==R[0])K.pop();if(!R)return A();Y.utimes(R[0],H,R[1],A)}function E(z,A,R){if(Q.utimes===!1)return R();if(A.type==="directory")return Y.utimes(z,H,A.mtime,R);if(A.type==="symlink")return w(z,R);Y.utimes(z,H,A.mtime,function(f){if(f)return R(f);w(z,R)})}function P(z,A,R){let f=A.type==="symlink",S=f?Y.lchmod:Y.chmod,V=f?Y.lchown:Y.chown;if(!S)return R();let v=(A.mode|(A.type==="directory"?D:O))&F;if(V&&G)V.call(Y,z,A.uid,A.gid,b);else b(null);function b(h){if(h)return R(h);if(!S)return R();S.call(Y,z,v,R)}}function T(z,A,R){Y.stat(z,function(f){if(!f)return R(null);if(f.code!=="ENOENT")return R(f);Y.mkdir(z,{mode:A.mode,recursive:!0},function(S,V){if(S)return R(S);P(z,A,R)})})}};function sd$($,Z,Q,Y){if(Z===Q)return Y(null,!0);if(!Z.startsWith(Q+gZ.sep))return Y(null,!1);$.lstat(Z,function(X,J){if(X&&X.code!=="ENOENT"&&X.code!=="EPERM")return Y(X);if(X||!J.isSymbolicLink())return sd$($,gZ.join(Z,".."),Q,Y);Y(null,!1)})}function rd$($,Z,Q,Y){if(Z===Q)return Y(null,!0);$.lstat(Z,function(X,J){if(X&&X.code!=="ENOENT"&&X.code!=="EPERM")return Y(X);if(X||J.isDirectory())return rd$($,gZ.join(Z,".."),Q,Y);Y(null,!1)})}function A50(){}function ad$($){return $}function CK1($){return z50?$.replace(/\\/g,"/").replace(/[:?<>|]/g,"_"):$}function Kq6($,Z,Q,Y,X,J){if(!X)X=["."];let G=X.slice(0);return function(K){if(!G.length)return K(null);let H=G.shift(),F=gZ.join(Q,H);Z.call($,F,function(U,N){if(U)return K(X.indexOf(H)===-1&&U.code==="ENOENT"?null:U);if(!N.isDirectory())return K(null,H,N);$.readdir(F,function(B,D){if(B)return K(B);if(J)D.sort();for(let O=0;O<D.length;O++)if(!Y(gZ.join(Q,H,D[O])))G.push(gZ.join(H,D[O]));K(null,H,N)})})}}function ed$($,Z){return function(Q){Q.name=Q.name.split("/").slice(Z).join("/");let Y=Q.linkname;if(Y&&(Q.type==="link"||gZ.isAbsolute(Y)))Q.linkname=Y.split("/").slice(Z).join("/");return $(Q)}}});var Nq6,Bq6;var Zi$=L(()=>{DK1();Nq6=_(cm$(),1),Bq6=_($i$(),1)});var MC0=()=>{};var Qi$=L(()=>{hk0()});var Yi$=L(()=>{BC0();NC0();MC0()});var Xi$=()=>{};var Ji$=()=>{};var Gi$=L(()=>{Tm$();NK1();BC0();Im$();FK1();DK1();km$();Cm$();Sm$();_m$();UK1();vm$();Zi$();MC0();Qi$();Yi$();Xi$();Ji$();MC0()});function Dq6($){if($ instanceof TypeError)return!0;if($ instanceof Error&&!($ instanceof DOMException)&&typeof $.code==="string")return!0;if($ instanceof DOMException&&$.name==="AbortError")return!0;return!1}async function SK1($,Z,Q,Y){try{return await F8(async()=>{let J=await fetch($,{...Z,signal:AbortSignal.timeout(Y)});return{status:J.status,ok:J.ok,body:await J.text()}},{maxAttempts:3,minTimeout:50,maxTimeout:500,multiplier:2,jitter:0.5,isRetriable:Dq6})}catch(X){let J=X instanceof Error?X.message:String(X);throw Error(`[SANDBOX_UNREACHABLE] sandbox daemon ${Q} request failed: ${J}`,{cause:X})}}async function VC0($){try{let Z=await fetch(`${$}/health`,{signal:AbortSignal.timeout(Lq6)});if(!Z.ok){try{await Z.text()}catch{}return null}let Q=await Z.json();if(typeof Q==="object"&&Q!==null&&typeof Q.bootId==="string"&&typeof Q.ready==="boolean"&&Q.setup&&typeof Q.setup.running==="boolean"&&typeof Q.setup.done==="boolean")return Q;return null}catch{return null}}async function vK1($){for(let Z=0;Z<Wi$;Z++){if(await VC0($)!==null)return;let Q=(Math.random()*2-1)*Oq6;await J$(Ki$+Q)}throw Error(`sandbox daemon at ${$} did not respond on /health within ${Wi$*Ki$/1000}s`)}async function nK($,Z,Q,Y,X){return jq6($,Z,"POST",Q,Y,X)}async function jq6($,Z,Q,Y,X,J){let G={...Y};if(X&&X.rotateToken!==void 0)G.auth=X;let W=await SK1(`${$}/_sandbox/config`,{method:Q,headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:JSON.stringify(G)},"/_sandbox/config",J?.timeoutMs??_K1);if(!W.ok)throw new IY(W.status,W.body);return Fi$(W.body,"/_sandbox/config")}async function Hi$($,Z,Q){let Y=await SK1(`${$}/_sandbox/setup/${Q}`,{method:"POST",headers:{Authorization:`Bearer ${Z}`}},`/_sandbox/setup/${Q}`,_K1);if(!Y.ok)throw Error(`sandbox daemon /_sandbox/setup/${Q} returned ${Y.status}: ${Y.body}`)}async function IC0($,Z,Q){let Y=await SK1(`${$}/_sandbox/orgfs-config`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:Q},"/_sandbox/orgfs-config",_K1);if(!Y.ok)throw new IY(Y.status,Y.body,"/_sandbox/orgfs-config");return Fi$(Y.body,"/_sandbox/orgfs-config")}function Fi$($,Z){try{return JSON.parse($)}catch(Q){throw Error(`sandbox daemon ${Z} returned a malformed JSON body: ${$.slice(0,200)}`,{cause:Q})}}async function kC0($,Z,Q,Y){let X=new Headers(Y.headers);for(let W of wq6)X.delete(W);X.set("authorization",`Bearer ${Z}`);let J=Y.method!=="GET"&&Y.method!=="HEAD",G=`${$}${Q.startsWith("/")?Q:`/${Q}`}`;return fetch(G,{method:Y.method,headers:X,body:J?Y.body:void 0,redirect:"manual",signal:Y.signal,duplex:J?"half":void 0})}var IY,Lq6=500,_K1=30000,Wi$=25,Ki$=200,Oq6=50,wq6;var Fh=L(()=>{$n();n$();IY=class IY extends Error{status;constructor($,Z,Q="/_sandbox/config"){super(`sandbox daemon ${Q} returned ${$}: ${Z}`);this.status=$;this.name="ConfigRequestError"}};wq6=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length"]});class CC0{counted=new Set;markCounted($){this.counted.add($)}consume($){return this.counted.delete($)}}class Uh{map=new Map;async run($,Z){let Q=this.map.get($);if(Q)return Q;let Y=Z();this.map.set($,Y);try{return await Y}finally{this.map.delete($)}}}function SC0($,Z,Q){if(!$)return Q(null);if(!$.withLock)return Q($);return $.withLock(Z,Q)}function T50($){if(!$.orgId||!$.virtualMcpId||!$.branch)throw Error("composeSandboxRef: orgId, virtualMcpId and branch are all required for agent refs");return`agent:${$.orgId}:${$.virtualMcpId}:${$.branch}`}function Ui$($){if(!$.startsWith("agent:"))return"";let Z=$.split(":");return Z.length>=4?Z.slice(3).join(":"):""}import{hash as Eq6}from"crypto";function Pq6($,Z=16){return Eq6("sha256",$g$($),"hex").slice(0,Z)}function HW($){let Z=Pq6($),Q=zq6(Ui$($.projectRef));return Q?`${Q}-${Z}`:`s-${Z}`}function zq6($){if(!$)return"";let Z=$.split("/").pop()??"",Q="",Y=!1;for(let X of Z.toLowerCase()){let J=X.charCodeAt(0),G=J>=97&&J<=122,W=J>=48&&J<=57;if(!G&&!W){Y||=Q.length>0;continue}if(Y){if(Q.length+1>=Ni$)break;Q+="-",Y=!1}if(Q+=X,Q.length===Ni$)break}return Q}var Ni$=24;var Bi$=L(()=>{S31()});function _C0($,Z){let Q=$.replace(/\/+$/,"");if(Q.includes("{handle}"))return`${Q.replace("{handle}",Z)}/`;try{let Y=new URL(Q);return Y.hostname=`${Z}.${Y.hostname}`,`${Y.toString()}/`}catch{return`${Q}/${Z}/`}}function zn($){let Z=$.repo,Q=Z?{repository:{cloneUrl:Z.cloneUrl,repoName:Z.displayName??Aq6(Z.cloneUrl),...Z.branch?{branch:Z.branch}:{},submoduleCredentials:Z.submoduleCredentials??[]},repositories:($.extraRepos??[]).filter((K)=>!!K.directoryName).map((K)=>({cloneUrl:K.cloneUrl,repoName:K.directoryName,...K.branch?{branch:K.branch}:{},submoduleCredentials:K.submoduleCredentials??[]})),...Z.userName.trim()||Z.userEmail.trim()?{identity:{userName:Z.userName,userEmail:Z.userEmail}}:{}}:void 0,Y=$.tenant,X=ep({userName:Y?.userName,userEmail:Y?.userEmail})??void 0,J=$.packageManager?{name:$.packageManager.name,...$.packageManager.path?{path:$.packageManager.path}:{}}:void 0,G=J?{packageManager:J,runtime:$.runtime,...$.port!==void 0?{port:$.port}:{}}:void 0,W=Y?.orgId;if(!Q&&!G&&!X&&$.cloneOnly===void 0&&!W)return null;return{...Q?{git:Q}:{},...X?{operator:X}:{},...W?{orgId:W}:{},...$.cloneOnly!==void 0?{cloneOnly:$.cloneOnly}:{},...G?{application:G}:{}}}function Aq6($){try{let Z=new URL($);return Z.pathname.replace(/^\/+/,"").replace(/\.git$/,"")||Z.hostname}catch{return $}}var Di$=L(()=>{kG1()});function Tq6($){try{return new URL($).username.length>0}catch{return!1}}function q50($){let Z=$.repo?.cloneUrl;if(!Z||!Tq6(Z))return null;return{git:{repository:{cloneUrl:Z}}}}var An=L(()=>{Bi$();Di$()});async function*ji$($){let Z=$.now??(()=>Date.now()),Q=Z(),Y=$.schedulingTimeoutMs??Rq6,X={pod:{},sandbox:{},events:{hasPulling:!1,hasPulled:!1},startedAt:Q},J=[],G=null,W=!1,K=(E)=>{if(W)return;if(G){let P=G;G=null,P(E)}else J.push(E)},H=()=>{if(J.length>0)return Promise.resolve(J.shift());if(W)return Promise.resolve(null);return new Promise((E)=>{G=E})},F=()=>{if(W)return;if(W=!0,G){let E=G;G=null,E(null)}},U=new AbortController,N=()=>{U.abort(),F()};if($.signal)if($.signal.aborted)U.abort(),F();else $.signal.addEventListener("abort",N,{once:!0});let B=Math.max(0,Y-(Z()-Q)),D=setTimeout(()=>K("tick"),B+100),O,j=new Promise((E)=>{O=E}),w=Promise.allSettled([Vq6($.kc,$.namespace,$.claimName,U.signal,X,K,Z,O),kq6($.kc,$.namespace,$.claimName,U.signal,X,K),Cq6($.kc,$.namespace,$.claimName,j,U.signal,X,K,Z)]);try{let E=null,P=-1,T=Li$(X,Y,Z);if(E=xK1(T),!bK1(T))P=Oi$(T);if(yield T,bK1(T))return;while(!W){if(await H()===null)break;let A=Li$(X,Y,Z);if(bK1(A)){let S=xK1(A);if(S!==E)E=S,yield A;return}let R=Oi$(A);if(R<P)continue;let f=xK1(A);if(f!==E)E=f,P=R,yield A}}finally{if(clearTimeout(D),U.abort(),$.signal)$.signal.removeEventListener("abort",N);F(),await w.catch(()=>{})}}async function wi$($,Z=Mq6){let Q=new AbortController,Y="claiming",X,J=()=>{clearTimeout(X),X=setTimeout(()=>Q.abort(),Z)};try{J();for await(let G of $(Q.signal)){if(G.kind==="ready")return;if(G.kind==="failed")throw new qX(G.message);Y=G.kind,J()}}finally{clearTimeout(X),Q.abort()}throw new Gn(`Sandbox did not become ready: no progress for ${Math.round(Z/1000)}s while ${Y}`)}function Li$($,Z,Q){let{pod:Y,sandbox:X,events:J,startedAt:G}=$;if(X.ready)return{kind:"ready"};let W=Y.containerWaitingReason;if(W==="ImagePullBackOff"||W==="ErrImagePull")return{kind:"failed",reason:"image-pull-backoff",message:"Sandbox image failed to download. The cluster may be missing pull credentials or the image tag may not exist."};if(W==="CrashLoopBackOff")return{kind:"failed",reason:"crash-loop-backoff",message:"Sandbox crashed during startup and is now in CrashLoopBackOff. Check pod logs."};if(!Y.scheduled&&J.lastFailedSchedulingAt!==void 0&&Q()-G>Z)return{kind:"failed",reason:"scheduling-timeout",message:J.failedSchedulingMessage??`Pod could not be scheduled within ${Math.round(Z/1000)}s.`};if(Y.containerRunning&&!Y.containerReady)return{kind:"warming-daemon",since:G};if(J.hasPulling&&!J.hasPulled)return{kind:"pulling-image",since:G};if(W==="ContainerCreating"||W==="PodInitializing"||Y.scheduled&&!Y.containerRunning)return{kind:"starting-container",since:G};if(Y.scheduledFalseReason==="Unschedulable"||J.lastFailedSchedulingAt!==void 0&&!Y.scheduled)return{kind:"waiting-for-capacity",since:G,message:J.failedSchedulingMessage??Y.scheduledFalseMessage,nodeClaim:J.nominatedNodeClaim};return{kind:"claiming",since:G}}function bK1($){return $.kind==="ready"||$.kind==="failed"}function Oi$($){switch($.kind){case"claiming":return 0;case"waiting-for-capacity":return 1;case"pulling-image":return 2;case"starting-container":return 3;case"warming-daemon":return 4;case"ready":case"failed":return 99}}function xK1($){switch($.kind){case"claiming":case"pulling-image":case"starting-container":case"warming-daemon":return $.kind;case"waiting-for-capacity":return`waiting-for-capacity:${$.message??""}:${$.nodeClaim??""}`;case"ready":return"ready";case"failed":return`failed:${$.reason}:${$.message}`}}async function Vq6($,Z,Q,Y,X,J,G,W){let K=`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?watch=true&labelSelector=${encodeURIComponent(`${qq6}=${Q}`)}`;return vC0({kc:$,path:K,signal:Y,label:`pod/${Q}`,onEvent:(H)=>{if(H.type!=="ADDED"&&H.type!=="MODIFIED")return;let F=H.object;if(F.metadata?.name)W(F.metadata.name);Iq6(F,X,G),J("pod")}})}function Iq6($,Z,Q){let X=($.status?.conditions??[]).find((G)=>G.type==="PodScheduled");if(X?.status==="True")Z.pod.scheduled=!0,Z.pod.scheduledFalseReason=void 0,Z.pod.scheduledFalseMessage=void 0;else if(X?.status==="False")Z.pod.scheduled=!1,Z.pod.scheduledFalseReason=X.reason,Z.pod.scheduledFalseMessage=X.message;let J=($.status?.containerStatuses??[]).find((G)=>G.name===G7.MAIN_CONTAINER_NAME);if(J)Z.pod.containerWaitingReason=J.state?.waiting?.reason,Z.pod.containerRunning=!!J.state?.running,Z.pod.containerReady=J.ready===!0}async function kq6($,Z,Q,Y,X,J){let G=`/apis/${G7.CLAIM_API_GROUP}/${G7.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(Z)}/${G7.CLAIM_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${Q}`)}`;return vC0({kc:$,path:G,signal:Y,label:`sandboxclaim/${Q}`,onEvent:(W)=>{if(W.type!=="ADDED"&&W.type!=="MODIFIED")return;let H=W.object.status?.conditions?.find((F)=>F.type==="Ready");if(!H)return;if(H.status==="True")X.sandbox.ready=!0,X.sandbox.notReadyReason=void 0,X.sandbox.notReadyMessage=void 0;else X.sandbox.ready=!1,X.sandbox.notReadyReason=H.reason,X.sandbox.notReadyMessage=H.message;J("sandbox")}})}async function Cq6($,Z,Q,Y,X,J,G,W){let K=await Promise.race([Y,new Promise((F)=>{if(X.aborted){F(Q);return}X.addEventListener("abort",()=>F(Q),{once:!0})})]);if(X.aborted)return;let H=`/api/v1/namespaces/${encodeURIComponent(Z)}/events?watch=true&fieldSelector=${encodeURIComponent(`involvedObject.name=${K},involvedObject.kind=Pod`)}`;return vC0({kc:$,path:H,signal:X,label:`events/${Q}`,onEvent:(F)=>{if(F.type!=="ADDED"&&F.type!=="MODIFIED")return;let U=F.object,N=U.reason;if(!N)return;switch(N){case"Pulling":J.events.hasPulling=!0;break;case"Pulled":J.events.hasPulling=!0,J.events.hasPulled=!0;break;case"FailedScheduling":J.events.lastFailedSchedulingAt=W(),J.events.failedSchedulingMessage=U.message;break;case"Nominated":{let B=U.message?.match(/nodeclaim\/([\w-]+)/);if(B)J.events.nominatedNodeClaim=B[1];break}default:return}G("event")}})}async function Ei$($){let{kc:Z,namespace:Q,labelSelector:Y,signal:X,onDelete:J}=$,G=`/apis/${G7.CLAIM_API_GROUP}/${G7.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(Q)}/${G7.CLAIM_PLURAL}?watch=true&labelSelector=${encodeURIComponent(Y)}`;return vC0({kc:Z,path:G,signal:X,label:"sandboxclaim-reaper",onEvent:(W)=>{if(W.type!=="DELETED")return;let K=W.object.metadata?.name;if(K)J(K)}})}async function vC0($){let{kc:Z,path:Q,signal:Y,label:X,onEvent:J}=$,G=0;while(!Y.aborted){try{let K=await iK(Z,{method:"GET",path:Q,signal:Y,headers:{accept:"application/json"},stream:!0});if(!K.ok||!K.body){try{await K.body?.cancel()}catch{}if(K.status===401||K.status===403){console.warn(`[lifecycle-watcher] ${X} stopped: watch denied (${K.status} ${K.statusText}). `+"The kubeconfig in use cannot watch SandboxClaims \u2014 if you are running locally, "+"this provider should not be active (check STUDIO_AGENT_SANDBOX_ENABLED).");return}throw Error(`watch handshake failed: ${K.status} ${K.statusText}`)}G=0;for await(let H of _g$(K.body)){if(Y.aborted)return;try{J(H)}catch(F){console.warn(`[lifecycle-watcher] ${X} onEvent threw: ${F instanceof Error?F.message:String(F)}`)}}}catch(K){if(Y.aborted)return;let H=K instanceof Error?K.message:String(K);console.warn(`[lifecycle-watcher] ${X} watch ended: ${H}`)}if(Y.aborted)return;let W=k7(5000,250,G,2,0);G+=1,await J$(W,{signal:Y}).catch(()=>{})}}var qq6="studio.decocms.com/sandbox-handle",Rq6=300000,Mq6=600000;var Pi$=L(()=>{n$();Z50();Fj0()});import{createHash as Sq6}from"crypto";import{z as vJ}from"zod";function tK($){let Z;try{Z=new URL($.trim())}catch{return null}if(Z.protocol!=="https:"||Z.search||Z.hash)return null;let Q=Z.pathname.replace(/\/+$/,"").replace(/\.git$/,"").replace(/\/+$/,"");return Q?`https://${Z.host.toLowerCase()}${Q}`:null}function R50($){return tK($)?.toLowerCase()??null}function fq6($){let Z=new Set;for(let Q of $){let Y=`${R50(Q.repoUrl)??Q.repoUrl}#${Q.branch}`;if(Z.has(Y))return Q;Z.add(Y)}return null}function zi$($){return $.reduce((Z,Q)=>Z+Q.replicas,0)}function Ti$($,Z){if(Z.warmPoolName)return Z.warmPoolName;let Q=Sq6("sha256").update(`${Z.repoUrl}#${Z.branch}`).digest("hex").slice(0,8);return`${$}-${Q}`}function qi$($){return Math.max(0,$.size-zi$($.repos))}function Tn($){return $.flatMap((Z)=>Z.repos.map((Q)=>({pool:Z,repo:Q,warmPoolName:Ti$(Z.name,Q)})))}function yq6($,Z){return Ii$(void 0,$,!0,Z)}function Ri$($,{templateName:Z}){let Q=yq6(Z,$.image),Y=(X,J)=>({apiVersion:`${G7.CLAIM_API_GROUP}/${G7.CLAIM_API_VERSION}`,kind:"SandboxWarmPool",metadata:{name:X,labels:{[gq6]:$.name}},spec:{replicas:J,updateStrategy:{type:"OnReplenish"},sandboxTemplateRef:{name:Q}}});return[...$.repos.map((X)=>Y(Ti$($.name,X),X.replicas)),Y($.name,qi$($))]}function Mi$($){return $.tenant?.orgId}function yK1($,Z){if(!Z.tenant)return null;let Q=$.filter((J)=>J.tenant===Z.tenant&&J.image===Z.image),Y=Z.cloneUrl?R50(Z.cloneUrl):null;if(Y){let J=Tn(Q).filter((W)=>R50(W.repo.repoUrl)===Y),G=J.find((W)=>W.repo.branch===Z.branch)??J[0];if(G)return G}let X=Q.find((J)=>qi$(J)>0);return X?{pool:X,repo:null,warmPoolName:X.name}:null}function Vi$($,Z,Q){return $?.warmPoolName??(Z?Q:"none")}function Ii$($,Z,Q=!1,Y){let X=Y&&Y!=="default"?`-${Y}`:"";return`${Z}${X}${$==="harness-run"||Q?"-medium":""}`}async function gK1($){let Z=Ii$($.purpose,$.templateName,$.tenantPool,$.sandboxImage);if(Z===$.templateName)return{name:Z,probes:$.probes};let Q=$.probes[Z]??null,Y=Q!==null&&$.now-Q.checkedAt<$.ttlMs?Q:{checkedAt:$.now,present:await $.exists(Z)},X={...$.probes,[Z]:Y};if(Y.present)return{name:Z,probes:X};if(Q?.present!==!1)$.onAbsent?.(Z);if($.sandboxImage&&$.sandboxImage!=="default")return gK1({...$,sandboxImage:void 0,probes:X});return{name:$.templateName,probes:X}}function hK1($,Z,Q){let Y=R50(Z);if(!Y)return[];let X=Q.replace(/^refs\/heads\//,"");return Tn($).filter(({repo:J})=>R50(J.repoUrl)===Y&&J.branch===X)}class uK1{source;dirty=new Set;pods=new Map;known=new Map;constructor($){this.source=$}pools(){return this.source()}resolve($){return yK1(this.pools(),$)}markDirty($,Z){let Q=hK1(this.pools(),$,Z).map((Y)=>Y.warmPoolName);for(let Y of Q)this.dirty.add(Y);return Q}takeDirty($){return this.dirty.delete($)}pod($){return this.pods.get($)}setPod($,Z){this.pods.set($,Z)}retainPods($,Z){for(let[Q,Y]of this.pods)if(Y.pool===$&&!Z.has(Q))this.pods.delete(Q)}retain($){let Z=new Map($.map((Y)=>[Y.warmPoolName,Y])),Q=[...this.known.values()].filter((Y)=>!Z.has(Y.warmPoolName));for(let Y of this.dirty)if(!Z.has(Y))this.dirty.delete(Y);for(let[Y,X]of this.pods)if(!Z.has(X.pool))this.pods.delete(Y);return this.known=Z,Q}}var _q6=54,vq6,bq6=2048,xq6,M50,bC0,fK1,Ai$,gq6="studio.decocms.com/tenant-pool";var V50=L(()=>{t4();Z50();vq6=/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/;xq6=vJ.object({runtime:vJ.enum(["node","bun","deno"]).default("node"),packageManager:vJ.enum(["npm","pnpm","yarn","bun","deno"]).optional(),packageManagerPath:vJ.string().optional(),devPort:vJ.number().int().positive().optional()}).default({runtime:"node"}),M50=vJ.object({repoUrl:vJ.string().max(bq6).transform(($,Z)=>{let Q=tK($);if(Q)return Q;return Z.addIssue({code:"custom",message:"repoUrl must be an https clone URL"}),vJ.NEVER}),branch:vJ.string().min(1).default("main"),workload:xq6,replicas:vJ.number().int().min(1)});bC0=class bC0 extends Error{poolName;size;allocated;constructor($,Z,Q){super(`pool ${$}: repos take ${Q} replicas, more than its size ${Z}`);this.poolName=$;this.size=Z;this.allocated=Q;this.name="TenantPoolCapacityError"}};fK1=vJ.object({name:vJ.string().max(_q6).regex(vq6,"pool name must be a DNS label (lowercase alphanumeric and '-')"),tenant:vJ.string().min(1).max(512),size:vJ.number().int().min(1),image:yN.default("default")}),Ai$=fK1.extend({repos:vJ.array(M50).default([])}).superRefine(($,Z)=>{let Q=fq6($.repos);if(Q)Z.addIssue({code:"custom",path:["repos"],message:`duplicate repo allocation ${Q.repoUrl}#${Q.branch}`});let Y=zi$($.repos);if(Y>$.size)Z.addIssue({code:"custom",path:["repos"],message:new bC0($.name,$.size,Y).message})})});async function ki$($,Z,Q){let Y=new Map;for(let X of $){let J=Z(X);if(!J)continue;let G=Y.get(J);if(G)G.push(X);else Y.set(J,[X])}await Promise.allSettled([...Y.values()].map(async(X)=>{for(let J of X)await Q(J).catch(()=>{})}))}function hq6($){try{let Z=new URL($);if(Z.hostname.toLowerCase()!=="github.com")return null;let[Q,Y]=Z.pathname.replace(/^\/+/,"").split("/"),X=Y?.replace(/\.git$/,"");return Q&&X?`${Q}/${X}`.toLowerCase():null}catch{return null}}function Ci$($){if($.repositoryId)return{repositoryId:$.repositoryId};let Z=$.connectionId?hq6($.cloneUrl):null;return $.connectionId&&Z?{connectionId:$.connectionId,repo:Z}:null}var Si$=L(()=>{V50()});async function qn($,Z,Q,Y){let X=(G)=>kC0(G.url,G.token,Z,Q),J=!(Q.body instanceof ReadableStream);try{let G=await X($);if(G.status!==401||!J)return G;let W=await Y.unauthorized();if(!W)return G;return await G.body?.cancel().catch(()=>{}),await X(W)}catch(G){if(!J)throw G;let W=await Y.unreachable();if(!W)throw G;return X(W)}}var xC0=L(()=>{Fh()});function bi$($,Z){return new Response(JSON.stringify(Z),{status:$,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function _i$($){let Z=new Headers;for(let[Q,Y]of $.headers.entries())if(!lq6.includes(Q.toLowerCase()))Z.set(Q,Y);return new Response($.body,{status:$.status,statusText:$.statusText,headers:Z})}function vi$($,Z){let Q=bi$($,{error:Z});return Q.headers.set("x-sandbox-preview-not-ready","1"),Q}async function Mn($,Z,Q){let Y=await Z.base();if(!Y)return vi$(404,"sandbox not found");let X=new URL($.url);if((X.pathname==="/_sandbox"||X.pathname.startsWith("/_sandbox/"))&&$.method!=="GET")return bi$(404,{error:"not found"});let G=(F)=>`${F}${X.pathname}${X.search}`,W=new Headers($.headers);for(let F of uq6)W.delete(F);let K=$.method!=="GET"&&$.method!=="HEAD",H={method:$.method,headers:W,body:K?$.body:void 0,redirect:"manual",signal:$.signal,duplex:K?"half":void 0};try{return _i$(await fetch(G(Y),H))}catch(F){let U=`${Y}${X.pathname}`;if(console.warn(`[${Q}] preview fetch to ${U} failed: ${F instanceof Error?F.message:String(F)}`),Z.invalidate(),$.method==="GET"||$.method==="HEAD"){let N=await Z.retryBase();if(N)try{return _i$(await fetch(G(N),H))}catch(B){console.warn(`[${Q}] preview fetch retry to ${U} failed: ${B instanceof Error?B.message:String(B)}`)}}return vi$(502,"sandbox daemon unreachable")}}var Rn="x-sandbox-preview-not-ready",uq6,lq6;var fC0=L(()=>{uq6=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length","upgrade"],lq6=["connection","keep-alive","transfer-encoding","content-encoding","content-length"]});import{createHash as cq6,randomBytes as mq6,randomUUID as xi$}from"crypto";import*as ci$ from"net";import{PassThrough as dq6}from"stream";function fi$($){if($ instanceof Error)return $.message;if($&&typeof $==="object"){let Z=$;if(Z.error instanceof Error)return Z.error.message;if(typeof Z.message==="string"&&Z.message)return Z.message}return String($)}function hi$($){return{pool:$.warmPoolName,org:$.pool.tenant}}class nK1{records=new Map;inflight=new Uh;activeGauge=new CC0;stateStore;previewUrlPattern;kubeConfig;capacityProbe;portForward;namespace;sandboxTemplateName;envName;tokenGenerator;idleTtlMs;metrics;previewGateway;sentinelToken;mintCloneUrl;mintPoolCloneUrl;mintOrgFsConfig;forwardPort;daemonAddress;persistCredentials;tenantPools;tenantPoolRefreshMs;templateProbes={};closed=!1;claimWatchAbort=new AbortController;constructor($={}){this.stateStore=$.stateStore??null,this.previewUrlPattern=$.previewUrlPattern??null,this.kubeConfig=$.kubeConfig??YR6(),this.portForward=new LK1(this.kubeConfig),this.namespace=$.namespace??iq6,this.sandboxTemplateName=$.sandboxTemplateName??pq6,this.envName=KR6($.envName),this.tokenGenerator=$.tokenGenerator??(()=>mq6(tq6).toString("hex")),this.idleTtlMs=$.idleTtlMs??sq6,this.metrics=$.meter?QR6($.meter):null,this.previewGateway=$.previewGateway&&$.previewUrlPattern?{...$.previewGateway}:null;let Z=$.sentinelToken?.trim()??"";this.sentinelToken=Z.length>0?Z:null,this.mintCloneUrl=$.mintCloneUrl,this.mintPoolCloneUrl=$.mintPoolCloneUrl,this.mintOrgFsConfig=$.mintOrgFsConfig,this.forwardPort=$.forwardPort,this.daemonAddress=$.daemonAddress??"forward",this.persistCredentials=$.persistCredentials??!0;let Q=$.tenantPools;if(this.tenantPools=this.sentinelToken===null?null:new uK1(typeof Q==="function"?Q:()=>Q??[]),this.sentinelToken===null&&(typeof Q==="function"||(Q?.length??0)>0))console.warn(`[${M6}] tenant pools configured without a sentinel token \u2014 ignoring them (warm-pool mode is off)`);this.tenantPoolRefreshMs=$.tenantPoolRefreshMs??aq6,this.startClaimReaper(),this.startCredentialRefresher(),this.startTenantPoolReconciler()}startClaimReaper(){let $=["app.kubernetes.io/managed-by=studio","app.kubernetes.io/name=studio-sandbox",...this.envName?[`${bJ.env}=${this.envName}`]:[]].join(",");Ei$({kc:this.kubeConfig,namespace:this.namespace,labelSelector:$,signal:this.claimWatchAbort.signal,onDelete:(Z)=>this.invalidateRecord(Z)})}async ensure($,Z={}){let Q=HW($);if(Q.startsWith("s-"))throw Error(`ensure: projectRef has no slug source: ${$.projectRef}`);return this.inflight.run(Q,()=>SC0(this.stateStore,$,(Y)=>this.ensureLocked($,Q,Z,Y)))}async delete($){let Z=await this.getRecord($);if(this.records.delete($),Z)this.dropRecord(Z);if(await this.deleteHttpRouteIfManaged($).catch((Q)=>{console.warn(`[${M6}] HTTPRoute delete failed for ${$}: ${Q instanceof Error?Q.message:String(Q)}`)}),await fR(this.kubeConfig,this.namespace,$),this.stateStore)if(Z)await this.stateStore.delete(Z.id);else await this.stateStore.deleteByHandle($)}lastTermination($){return Tg$(this.kubeConfig,this.namespace,bJ.sandboxHandle,$,G7.MAIN_CONTAINER_NAME)}async alive($){return await QO(this.kubeConfig,this.namespace,$)!==void 0}watchClaimLifecycle($,Z){return ji$({kc:this.kubeConfig,namespace:this.namespace,claimName:$,signal:Z})}hasSchedulableCapacity(){return this.capacityProbe??=bg$(this.kubeConfig,this.namespace),this.capacityProbe()}async getPreviewUrl($){let Z=await this.getRecord($);if(!Z)return null;return this.composePreviewUrl(Z)}async proxyDaemonRequest($,Z,Q){let Y=await this.getRecord($);if(!Y&&this.previewUrlPattern&&this.stateStore){let K=await this.stateStore.getByHandle($),H=K?.state,F=H?.token;if(K&&F){let N=`http://${H?.adoptedSandboxName??$}.${this.namespace}.svc.cluster.local:${jB}`;try{let B=await kC0(N,F,Z,Q);if(B.status!==404)return B;try{await B.body?.cancel()}catch{}}catch{}}}if(!Y)Y=await this.resurrectByHandle($);if(!Y)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let X=Y,J=performance.now(),G=0,W=(K)=>{return X=K,{url:K.daemonUrl,token:K.token}};try{let K=await qn(W(Y),Z,Q,{unauthorized:async()=>{this.invalidateRecord($);let H=await this.getRecord($).catch(()=>null)??await this.resurrectByHandle($).catch(()=>null);return H?W(H):null},unreachable:async()=>{this.invalidateRecord($);let H=await this.resurrectByHandle($)??await this.getRecord($).catch(()=>null);return H?W(H):null}});return G=K.status,K}finally{this.recordProxyDuration("daemon",G,X,performance.now()-J)}}async adoptLiveClaim($,Z){if(this.records.has(Z))return!0;let Q=await QO(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!Q||Q.metadata?.deletionTimestamp)return!1;return await this.inflight.run(Z,async()=>{let X=this.records.get(Z);if(X)return this.toSandbox(X);let J=await this.adopt($,Z,Q);if(!J)throw Error(`cannot adopt live claim ${Z}`);return SC0(this.stateStore,$,(G)=>this.finish(J,G,!0,!0,"adopt"))}).catch(()=>null)!=null}async resolvePreviewUpstreamUrl($){if(this.previewUrlPattern)return`http://${await this.resolveServiceNameForHandle($)}.${this.namespace}.svc.cluster.local:${jB}`;let Z=await this.getRecord($);if(Z)return Z.daemonUrl;let Q=await this.resurrectByHandle($);return Q?Q.daemonUrl:null}async daemonEndpoint($){let Z=await this.getRecord($)??await this.resurrectByHandle($);if(!Z)return null;return{url:this.daemonAddress==="service"?`http://${Z.adoptedSandboxName}.${this.namespace}.svc.cluster.local:${jB}`:Z.daemonUrl,token:Z.token}}listSandboxes(){return[...this.records.values()].map(($)=>{let Z=$.ensureOpts,Q=Z?.tenant;return{handle:$.handle,tenant:Q?{orgId:Q.orgId,userId:Q.userId}:null,repos:[Z?.repo,...Z?.extraRepos??[]].filter((Y)=>Y!==void 0).map(Ci$).filter((Y)=>Y!==null),orgFs:Boolean(Z?.orgFsConfigJson)||$.orgFsRedacted===!0}})}async resolveServiceNameForHandle($){let Z=this.records.get($);if(Z)return Z.adoptedSandboxName;if(this.stateStore){let Y=(await this.stateStore.getByHandle($).catch(()=>null))?.state?.adoptedSandboxName;if(Y)return Y}return $}async proxyPreviewRequest($,Z){let Q=performance.now(),Y=this.records.get($)??null,X=0;try{let J=await Mn(Z,{base:()=>this.resolvePreviewUpstreamUrl($),invalidate:()=>this.invalidateRecord($),retryBase:async()=>{return await this.resurrectByHandle($).catch(()=>null)?this.resolvePreviewUpstreamUrl($):null}},M6);return X=J.status,J}finally{this.recordProxyDuration("preview",X,Y,performance.now()-Q,$)}}async ensureLocked($,Z,Q,Y){if(Q.image)console.warn(`[${M6}] opts.image ignored (template ${this.sandboxTemplateName} pins image): got ${Q.image}`);if(Y){let G=await Y.get($);if(G){let W=await this.rehydrate($,Z,G);if(W)return await this.refreshDaemonGitCredential(W,Q),await this.relayOrgFsConfig(W.daemonUrl,W.token,Q.orgFsConfigJson),this.finish(W,Y,!1,!0,"resume");await Y.delete($)}}let X=await QO(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(X)if(X.metadata?.deletionTimestamp)await X50(this.kubeConfig,this.namespace,Z).catch((G)=>{console.warn(`[${M6}] wait for terminating claim ${Z} failed: ${G instanceof Error?G.message:String(G)}`)});else if(!lK1(X)){let G=await this.join($,Z,Q,X).catch((W)=>{return console.warn(`[${M6}] join of starting claim ${Z} failed, recreating: ${W instanceof Error?W.message:String(W)}`),null});if(G)return this.finish(G,Y,!0,!0,"adopt");await fR(this.kubeConfig,this.namespace,Z).catch(()=>{}),await X50(this.kubeConfig,this.namespace,Z).catch((W)=>{console.warn(`[${M6}] wait for deleted claim ${Z} failed: ${W instanceof Error?W.message:String(W)}`)})}else{let G=await this.adopt($,Z,X).catch((W)=>{return console.warn(`[${M6}] adopt ${Z} failed, recreating: ${W instanceof Error?W.message:String(W)}`),null});if(G)return await this.refreshDaemonGitCredential(G,Q),await this.relayOrgFsConfig(G.daemonUrl,G.token,Q.orgFsConfigJson),this.finish(G,Y,!0,!0,"adopt");await fR(this.kubeConfig,this.namespace,Z).catch(()=>{}),await X50(this.kubeConfig,this.namespace,Z).catch((W)=>{console.warn(`[${M6}] wait for deleted claim ${Z} failed: ${W instanceof Error?W.message:String(W)}`)})}let J=await this.provision($,Z,Q);return this.finish(J,Y,!0,!1,"fresh")}async finish($,Z,Q,Y,X){let J=this.records.get($.handle),G=J!==void 0;if(J&&J.daemonForward!==$.daemonForward)this.closeForwarder(J.daemonForward);if(this.records.set($.handle,$),Q)await this.persist(Z,$);if(Y)await Hj0(this.kubeConfig,this.namespace,$.handle,this.computeShutdownTime()).catch((W)=>console.warn(`[${M6}] TTL refresh failed for ${$.handle}: ${W instanceof Error?W.message:String(W)}`));if(this.metrics){let W=dK1($.tenant);if(this.metrics.ensureOutcome.add(1,{...W,outcome:X}),!G)this.metrics.active.add(1,W),this.activeGauge.markCounted($.handle)}return this.toSandbox($)}buildEnvMap($,Z){let Q={},Y=[];for(let[X,J]of Object.entries($.env??{}))if(oq6.has(X))Y.push(X);else Q[X]=J;if(Y.length>0)console.warn(`[${M6}] opts.env keys overlap reserved bootstrap names and were dropped: ${Y.join(",")}`);return{...Q,DAEMON_TOKEN:Z.token,DAEMON_BOOT_ID:Z.daemonBootId,APP_ROOT:Z.workdir,PROXY_PORT:String(jB)}}async resolveTemplateName($,Z,Q){let{name:Y,probes:X}=await gK1({purpose:$,tenantPool:Z,...Q?{sandboxImage:Q}:{},templateName:this.sandboxTemplateName,probes:this.templateProbes,now:Date.now(),ttlMs:nq6,exists:(J)=>Eg$(this.kubeConfig,this.namespace,J),onAbsent:(J)=>console.warn(`[${M6}] SandboxTemplate ${J} not found (or not readable) \u2014 this claim falls back to a template without that suffix. Upgrade the sandbox-env chart to the version that renders it.`)});return this.templateProbes=X,Y}buildClaim($,Z,Q,Y,X){let J=this.sentinelToken!==null,G=J?[]:Object.entries(this.buildEnvMap(Z,Q)).sort(([H],[F])=>H<F?-1:H>F?1:0).map(([H,F])=>({name:H,value:F})),W=UR6(Z),K=Object.keys(W).length>0;return{apiVersion:`${G7.CLAIM_API_GROUP}/${G7.CLAIM_API_VERSION}`,kind:"SandboxClaim",metadata:{name:$,namespace:this.namespace,labels:{"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[bJ.env]:this.envName}:{},...mK1(Z.tenant)},...K?{annotations:W}:{}},spec:{sandboxTemplateRef:{name:X},additionalPodMetadata:{labels:mK1(Z.tenant,{[bJ.role]:"claimed",[bJ.sandboxHandle]:$,...this.envName?{[bJ.env]:this.envName}:{}}),...K?{annotations:W}:{}},env:G,warmpool:Vi$(Y,J,X),lifecycle:{shutdownPolicy:"Delete",shutdownTime:this.computeShutdownTime()}}}}async provision($,Z,Q){let Y=this.tokenGenerator(),X=xi$(),J=yC0,G=this.claimTenantPoolBinding(Q),W=this.buildClaim(Z,Q,{token:Y,daemonBootId:X,workdir:J},G,await this.resolveTemplateName(Q.purpose,G!==null,Q.sandboxImage));try{await f31(this.kubeConfig,this.namespace,W)}catch(K){if(K instanceof $50)await X50(this.kubeConfig,this.namespace,Z),await f31(this.kubeConfig,this.namespace,W);else throw K}return this.bind($,Z,Q,G,{token:Y,daemonBootId:X,workdir:J})}claimTenantPoolBinding($){return this.tenantPools?.resolve({tenant:Mi$($),image:$.sandboxImage??"default",cloneUrl:$.repo?.cloneUrl,branch:$.repo?.branch})??null}async bind($,Z,Q,Y,{token:X,daemonBootId:J,workdir:G}){let W;try{W=await Pg$(this.kubeConfig,this.namespace,Z),await wi$((B)=>this.watchClaimLifecycle(Z,B))}catch(B){throw await fR(this.kubeConfig,this.namespace,Z).catch(()=>{}),B}try{await this.ensureServicePortForAdoptedSandbox(W),await this.ensureHttpRouteForHandle(Z,W,Q.tenant??null)}catch(B){throw await fR(this.kubeConfig,this.namespace,Z).catch(()=>{}),B}let K=await this.openForwarder(W,jB,Z),H=`http://127.0.0.1:${K.localPort}`,F=Y?.repo!=null&&W!==Z,U=this.workloadConfigPayload(Q,F),N=J;try{if(await vK1(H),this.sentinelToken!==null){let B=await VC0(H);if(B)N=B.bootId;try{await nK(H,this.sentinelToken,U??{},{rotateToken:X})}catch(D){if(D instanceof IY&&D.status===401)console.warn(`[${M6}] sentinel rejected by adopted pod (handle=${Z}, sandbox=${W}): pod belongs to another claim; tearing down and reprovisioning`);throw D}}else if(U)await nK(H,X,U);await this.relayOrgFsConfig(H,X,Q.orgFsConfigJson)}catch(B){throw this.closeForwarder(K),await this.deleteHttpRouteIfManaged(Z).catch(()=>{}),await fR(this.kubeConfig,this.namespace,Z).catch(()=>{}),B}return{id:$,handle:Z,adoptedSandboxName:W,token:X,workdir:G,daemonUrl:H,daemonForward:K,workload:Q.workload??null,daemonBootId:N,tenant:Q.tenant??null,tenantPoolPodBound:F,ensureOpts:jR6(Q)}}workloadConfigPayload($,Z){return zn({runtime:$?.workload?.runtime??"node",packageManager:$?.workload?.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:$?.repo??null,extraRepos:$?.extraRepos??[],port:$?.workload?.devPort??yi$,tenant:$?.tenant??void 0,...$?{cloneOnly:$.cloneOnly===!0&&!Z}:{}})}async relayOrgFsConfig($,Z,Q){if(!Q)return;await IC0($,Z,Q).catch((Y)=>console.warn("[org-fs] sidecar config relay failed",Y))}async refreshDaemonGitCredential($,Z){let Q=q50(Z);if(!Q)return;try{await nK($.daemonUrl,$.token,Q)}catch(Y){console.warn(`[${M6}] git credential refresh failed for ${$.handle}: ${Y instanceof Error?Y.message:String(Y)}`)}}async withFreshCloneUrl($,Z={}){if(!this.mintCloneUrl)return $;try{let Q=await this.mintCloneUrl($,Z);if(!Q)return $;let{credentialExpiresAt:Y,...X}=$;return{...X,cloneUrl:Q}}catch(Q){return console.warn(`[${M6}] clone credential re-mint failed: ${Q instanceof Error?Q.message:String(Q)}`),$}}async withFreshCredentials($,Z=!1){return{...$,...$.repo?{repo:await this.withFreshCloneUrl($.repo,{tenant:$.tenant})}:{},...$.orgFsConfigJson||Z?{orgFsConfigJson:await LR6($,this.mintOrgFsConfig)}:{}}}startCredentialRefresher(){if(!this.mintCloneUrl)return;let{signal:$}=this.claimWatchAbort;(async()=>{while(!$.aborted){if(await J$(eq6,{signal:$}).catch(()=>{}),$.aborted)break;try{await this.refreshAllGitCredentials()}catch(Z){console.warn(`[${M6}] periodic credential refresh failed: ${Z instanceof Error?Z.message:String(Z)}`)}}})()}startTenantPoolReconciler(){let $=this.tenantPools;if(!$)return;let{signal:Z}=this.claimWatchAbort;(async()=>{while(!Z.aborted){try{await this.reconcileTenantPools($)}catch(Q){console.warn(`[${M6}] tenant pool reconcile failed: ${Q instanceof Error?Q.message:String(Q)}`)}await J$(rq6,{signal:Z}).catch(()=>{})}})()}listTenantPools(){return this.tenantPools?.pools()??[]}markTenantPoolsDirty($,Z){return Promise.resolve(this.tenantPools?.markDirty($,Z)??[])}async reconcileTenantPools($){let Z=Tn($.pools());for(let Q of $.retain(Z))this.recordPoolGone(Q);for(let Q of Z){let Y=Q.warmPoolName,X=await zg$(this.kubeConfig,this.namespace,Y);if(X===null){console.warn(`[${M6}] tenant pool ${Y}: no SandboxWarmPool (or no selector yet) in ${this.namespace}`);continue}let J=$.takeDirty(Y),G=X.filter((W)=>!W.labels[bJ.sandboxHandle]);$.retainPods(Y,new Set(X.map((W)=>W.uid)));for(let W of G){if(this.claimWatchAbort.signal.aborted)return;await this.warmPoolPod($,Q,W,J)}this.recordPoolDepth($,Q,X,G)}}recordPoolGone($){let Z=hi$($);for(let Q of["ready","bound","pending","failed"])this.metrics?.poolPods.record(0,{...Z,state:Q})}recordPoolDepth($,Z,Q,Y){let X=this.metrics?.poolPods;if(!X)return;let J=0,G=0;for(let K of Y){let H=$.pod(K.uid);if(!H)continue;if(H.failures>=gC0)G++;else if(H.lastConfigAt>0)J++}let W=hi$(Z);X.record(J,{...W,state:"ready"}),X.record(Q.length-Y.length,{...W,state:"bound"}),X.record(Y.length-J-G,{...W,state:"pending"}),X.record(G,{...W,state:"failed"})}async warmPoolPod($,Z,Q,Y){let X=Z.warmPoolName,{workload:J}=Z.repo,G=$.pod(Q.uid);if(G&&G.failures>=gC0){if(Date.now()-G.lastFailureAt<gi$)return;$.setPod(Q.uid,{...G,failures:0})}let W=Y||G!==void 0&&Date.now()-G.lastConfigAt>=this.tenantPoolRefreshMs;if(G&&!W)return;let K=await this.allocationCloneUrl(Z);if(!K){this.recordPoolFailure($,Q,X,"clone credential mint failed");return}let H={cloneUrl:K,branch:Z.repo.branch,userName:"",userEmail:""},F=await this.openForwarder(Q.name,jB,Q.name).catch(()=>null);if(!F){this.recordPoolFailure($,Q,X,"port-forward failed");return}let U=`http://127.0.0.1:${F.localPort}`;try{await vK1(U);let N=this.sentinelToken;if(!N)return;if(!await this.isPoolPodUnbound(Q))return;let B=zn({runtime:J.runtime,packageManager:J.packageManager?{name:J.packageManager,...J.packageManagerPath?{path:J.packageManagerPath}:{}}:null,repo:H,port:J.devPort??yi$})??{},{transition:D}=await nK(U,N,B);if(W&&D!=="bootstrap"&&await this.isPoolPodUnbound(Q))await Hi$(U,N,"clone");$.setPod(Q.uid,{pool:X,lastConfigAt:Date.now(),lastFailureAt:0,failures:0}),console.log(`[${M6}] tenant pool ${X}: warmed ${Q.name} (${D})`)}catch(N){this.recordPoolFailure($,Q,X,N instanceof Error?N.message:String(N))}finally{this.closeForwarder(F)}}async allocationCloneUrl({pool:$,repo:Z}){if(!this.mintPoolCloneUrl)return`${Z.repoUrl}.git`;try{return await this.mintPoolCloneUrl({tenant:$.tenant,repoUrl:Z.repoUrl,branch:Z.branch})}catch(Q){return console.warn(`[${M6}] tenant pool clone credential mint failed: ${Q instanceof Error?Q.message:String(Q)}`),null}}isPoolPodUnbound($){return Ag$(this.kubeConfig,this.namespace,$.name,bJ.sandboxHandle)}recordPoolFailure($,Z,Q,Y){let X=$.pod(Z.uid),J=(X?.failures??0)+1;$.setPod(Z.uid,{pool:Q,lastConfigAt:X?.lastConfigAt??0,lastFailureAt:Date.now(),failures:J});let G=J>=gC0?` \u2014 backing off ${gi$/60000}min`:"";console.warn(`[${M6}] tenant pool ${Q}: warming ${Z.name} failed (${J}/${gC0})${G}: ${Y}`)}async refreshAllGitCredentials(){await ki$(this.records.values(),($)=>$.ensureOpts?.repo?.connectionId,async($)=>{if(this.claimWatchAbort.signal.aborted)return;let Z=$.ensureOpts?.repo;if(!Z)return;try{let Q=await this.withFreshCloneUrl(Z,{bufferMs:$R6,tenant:$.ensureOpts?.tenant});await this.refreshDaemonGitCredential($,{...$.ensureOpts,repo:Q}),$.ensureOpts={...$.ensureOpts,repo:Q}}catch(Q){throw console.warn(`[${M6}] git credential refresh failed for ${$.handle}: ${Q instanceof Error?Q.message:String(Q)}`),Q}})}async rebootstrapDaemon($,Z,Q){if(this.sentinelToken===null)return!1;let Y=this.workloadConfigPayload(Q,!1)??{};try{return await nK($,this.sentinelToken,Y,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,Q?.orgFsConfigJson),!0}catch(X){if(X instanceof IY&&X.status===401)try{return await nK($,Z,Y,{rotateToken:Z}),await this.relayOrgFsConfig($,Z,Q?.orgFsConfigJson),!0}catch(J){return console.warn(`[${M6}] re-bootstrap retry with claim token failed: ${J instanceof Error?J.message:String(J)}`),!1}return console.warn(`[${M6}] re-bootstrap failed: ${X instanceof Error?X.message:String(X)}`),!1}}async ensureServicePortForAdoptedSandbox($){if(!this.previewGateway||!this.previewUrlPattern)return;await Sg$(this.kubeConfig,this.namespace,$,{name:"daemon",port:jB,targetPort:jB})}async ensureHttpRouteForHandle($,Z,Q){if(!this.previewGateway||!this.previewUrlPattern)return;let Y=wR6(this.previewUrlPattern,$);if(!Y)throw new qX(`Unable to derive preview hostname for ${$} from pattern: ${this.previewUrlPattern}`);let X={apiVersion:`${g31.API_GROUP}/${g31.API_VERSION}`,kind:"HTTPRoute",metadata:{name:$,namespace:this.namespace,labels:mK1(Q??void 0,{[bJ.role]:"claimed",[bJ.sandboxHandle]:$,"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[bJ.env]:this.envName}:{}})},spec:{parentRefs:[{kind:"Gateway",group:"gateway.networking.k8s.io",name:this.previewGateway.name,namespace:this.previewGateway.namespace}],hostnames:[Y],rules:[{backendRefs:[{group:"",kind:"Service",name:Z,port:jB}]}]}};await Ig$(this.kubeConfig,this.namespace,X)}async deleteHttpRouteIfManaged($){if(!this.previewGateway)return;await kg$(this.kubeConfig,this.namespace,$)}async rehydrate($,Z,Q){let Y=Q.state;if(!Y.adoptedSandboxName&&!Y.podName||!Y.token)return null;let X=await QO(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!X||!lK1(X))return null;let J=X.status?.sandbox?.name??Y.adoptedSandboxName??Y.podName??Z,G=await this.openAndProbeDaemon(J,Z);if(!G)return null;if(Y.daemonBootId&&Y.daemonBootId!==G.bootId){if(this.sentinelToken!==null){let W=Y.ensureOpts?await this.withFreshCredentials(Y.ensureOpts,Y.orgFsRedacted===!0):null;if(!await this.rebootstrapDaemon(G.daemonUrl,Y.token,W))return this.closeForwarder(G.daemonForward),null}else console.warn(`[${M6}] daemon restart detected (handle=${Z}): stored bootId=${Y.daemonBootId} live bootId=${G.bootId}`);await this.stateStore?.put($,{handle:Z,state:{...Y,daemonBootId:G.bootId}}).catch((W)=>console.warn(`[${M6}] bootId persist failed for ${Z}: ${W instanceof Error?W.message:String(W)}`))}return{id:$,handle:Z,adoptedSandboxName:J,tenantPoolPodBound:!1,token:Y.token,workdir:Y.workdir??yC0,daemonUrl:G.daemonUrl,daemonForward:G.daemonForward,workload:Y.workload??null,daemonBootId:G.bootId,tenant:Y.tenant??null,ensureOpts:Y.ensureOpts??null,orgFsRedacted:Y.orgFsRedacted===!0}}join($,Z,Q,Y){let X=this.sentinelToken!==null,J=X?this.tokenGenerator():cK1(Y,"DAEMON_TOKEN"),G=X?xi$():cK1(Y,"DAEMON_BOOT_ID");if(!J||!G)throw new qX(`claim ${Z} carries no daemon token`);return this.bind($,Z,Q,this.claimTenantPoolBinding(Q),{token:J,daemonBootId:G,workdir:yC0})}async adopt($,Z,Q){if(!lK1(Q))return null;let Y=Q.status?.sandbox?.name??Z;if(this.sentinelToken!==null)return null;let X=cK1(Q,"DAEMON_TOKEN");if(!X)return null;let J=await this.openAndProbeDaemon(Y,Z);if(!J)return null;let G=NR6(Q);if(this.previewGateway)await this.ensureServicePortForAdoptedSandbox(Y).catch((W)=>{console.warn(`[${M6}] Service port backfill failed for ${Z}: ${W instanceof Error?W.message:String(W)}`)}),await this.ensureHttpRouteForHandle(Z,Y,G).catch((W)=>{console.warn(`[${M6}] HTTPRoute backfill failed for ${Z}: ${W instanceof Error?W.message:String(W)}`)});return{id:$,handle:Z,adoptedSandboxName:Y,tenantPoolPodBound:!1,token:X,workdir:yC0,daemonUrl:J.daemonUrl,daemonForward:J.daemonForward,workload:null,daemonBootId:J.bootId,tenant:G,ensureOpts:null}}async openAndProbeDaemon($,Z){let Q=await this.openForwarder($,jB,Z).catch(()=>null);if(!Q)return null;let Y=`http://127.0.0.1:${Q.localPort}`,X=await VC0(Y);if(!X)return this.closeForwarder(Q),null;return{daemonForward:Q,daemonUrl:Y,bootId:X.bootId}}async getRecord($){let Z=this.records.get($);if(Z)return Z;if(!this.stateStore)return null;let Q=await this.stateStore.getByHandle($);if(!Q)return null;let Y=await this.rehydrate(Q.id,$,Q);if(Y)this.records.set($,Y);return Y}async resurrectByHandle($){if(!this.stateStore)return null;let Z=await this.stateStore.getByHandle($);if(!Z)return null;let Q=Z.state,Y=Q.ensureOpts;if(!Y)return null;let X=await this.withFreshCredentials(Y,Q.orgFsRedacted===!0);if(HW(Z.id)!==$)return null;return await this.ensure(Z.id,X),this.records.get($)??null}invalidateRecord($){let Z=this.records.get($);if(!Z)return;this.records.delete($),this.dropRecord(Z)}dropRecord($){if(this.closeForwarder($.daemonForward),this.metrics&&this.activeGauge.consume($.handle))this.metrics.active.add(-1,dK1($.tenant))}recordProxyDuration($,Z,Q,Y,X){if(!this.metrics)return;this.metrics.proxyDurationMs.record(Y,{...dK1(Q?.tenant??null),source:$,sandbox_handle:Q?.handle??X??"",status_code:Z||0})}composePreviewUrl($){if(this.previewUrlPattern)return _C0(this.previewUrlPattern,$.handle);return`http://127.0.0.1:${$.daemonForward.localPort}/`}toSandbox($){return{handle:$.handle,workdir:$.workdir,previewUrl:this.composePreviewUrl($),warmPoolAdopted:$.tenantPoolPodBound===!0,provider:"kubernetes"}}async persist($,Z){if(!$)return;let Q={adoptedSandboxName:Z.adoptedSandboxName,token:Z.token,workdir:Z.workdir,workload:Z.workload,daemonBootId:Z.daemonBootId,tenant:Z.tenant,...Z.ensureOpts?this.persistCredentials?{ensureOpts:Z.ensureOpts}:OR6(Z.ensureOpts,Z.orgFsRedacted===!0):{}};await $.put(Z.id,{handle:Z.handle,state:Q})}computeShutdownTime(){return new Date(Date.now()+this.idleTtlMs).toISOString()}async releaseAfter($,Z){let Q=await QO(this.kubeConfig,this.namespace,$);if(!Q)return;let Y=BR6(Q.spec?.lifecycle?.shutdownTime,new Date(Date.now()+Z));if(!Y)return;await Hj0(this.kubeConfig,this.namespace,$,Y).catch((X)=>console.warn(`[${M6}] release failed for ${$}: ${X instanceof Error?X.message:String(X)}`))}async renewTtl($){let Z=await QO(this.kubeConfig,this.namespace,$);if(!Z)return;let Q=DR6(Z.spec?.lifecycle?.shutdownTime,new Date(Date.now()+this.idleTtlMs));if(!Q)return;await Hj0(this.kubeConfig,this.namespace,$,Q).catch((Y)=>console.warn(`[${M6}] TTL renew failed for ${$}: ${Y instanceof Error?Y.message:String(Y)}`))}openForwarder($,Z,Q=$){if(this.forwardPort)return this.forwardPort($,Z,Q);let Y=XR6(Q,Z);return new Promise((X,J)=>{let G=(W,K)=>{let H=ci$.createServer((F)=>this.handleForwardedConnection(F,$,Z,Q));H.once("error",(F)=>{if(F.code==="EADDRINUSE"&&K<ZR6){try{H.close()}catch{}let U=iK1+(W-iK1+1)%mi$;G(U,K+1);return}J(F)}),H.listen(W,"127.0.0.1",()=>{let F=H.address();if(!F||typeof F==="string"){H.close(),J(Error("port-forward listener failed to bind"));return}let U=F.port;X({localPort:U,close:()=>H.close((N)=>{if(N)console.warn(`[${M6}] port-forward close on :${U} errored: ${N.message}`)})})})};G(Y,0)})}handleForwardedConnection($,Z,Q,Y){let X=new dq6,J=null,G=!1,W=()=>{if(G)return;if(G=!0,X.destroy(),J)try{J.close()}catch{}if(!$.destroyed)$.destroy()};$.pipe(X),$.on("error",W),$.on("close",W),this.portForward.portForward(this.namespace,Z,[Q],$,null,X).then((K)=>{let H=typeof K==="function"?K():K;if(!H){W();return}if(J=H,J.on("close",W),J.on("error",(F)=>{console.warn(`[${M6}] port-forward to ${Z}:${Q} dropped mid-connection: ${fi$(F)}`,JSON.stringify(pK1(F))),this.invalidateRecord(Y),W()}),G)try{J.close()}catch{}}).catch((K)=>{console.warn(`[${M6}] port-forward to ${Z}:${Q} failed: ${fi$(K)}`,JSON.stringify(pK1(K))),this.invalidateRecord(Y),W()})}closeForwarder($){$.close()}close(){if(this.closed)return;this.closed=!0,this.claimWatchAbort.abort();for(let $ of this.records.values())this.dropRecord($);this.records.clear()}}function QR6($){return{active:$.createUpDownCounter("studio.sandbox.active",{description:"Active sandbox count, by runner kind, owning org, and daemon impl. Cross-checks the cAdvisor-derived count from the cluster \u2014 divergence between the two indicates orphaned claims (studio deleted but K8s didn't reap) or unattributed pods.",unit:"{sandbox}"}),ensureOutcome:$.createCounter("studio.sandbox.ensure.outcome",{description:"Outcome of each ensure() call: fresh provision, resume from state-store after restart, or adopt of a cluster-side claim studio didn't know about. Cold-start ratio is the primary input for warm-pool sizing.",unit:"{call}"}),proxyDurationMs:$.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of studio-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"}),poolPods:$.createGauge("studio.sandbox.pool.pods",{description:"Tenant warm pool depth by pool and state: ready (warmed and unbound \u2014 what a claim can actually bind instantly), bound (serving a user), pending (unbound, not yet warmed), failed (gave up after repeated bootstrap failures). Alert on sustained ready=0: a pool that is always empty is doing nothing while costing N pods.",unit:"{pod}"})}}function pK1($){let Z=[],Q=$;for(let Y=0;Y<5&&Q instanceof Error;Y++){let X=Q;if(Z.push({name:X.name,message:X.message,...X.code!==void 0?{code:X.code}:{},...X.errno!==void 0?{errno:X.errno}:{}}),X.cause===Q)break;Q=X.cause}if(Q!==void 0&&!(Q instanceof Error)&&Q!==null){let Y=Q,X=Y.error instanceof Error?pK1(Y.error).chain:void 0;Z.push({nonError:String(Q),...typeof Y.type==="string"?{type:Y.type}:{},...typeof Y.message==="string"?{message:Y.message}:{},...Y.code!==void 0?{code:Y.code}:{},...typeof Y.reason==="string"?{reason:Y.reason}:{},...X?{error:X}:{},...X===void 0&&Y.error!==void 0?{rawError:String(Y.error)}:{},keys:Object.keys(Y)})}return{chain:Z}}function YR6(){let $=new FC0;return $.loadFromDefault(),$}function lK1($){return Boolean($.status?.conditions?.some((Z)=>Z.type==="Ready"&&Z.status==="True"))}function cK1($,Z){let Q=$.spec?.env;if(!Q)return null;for(let Y of Q)if(Y.name===Z&&Y.value)return Y.value;return null}function XR6($,Z){let Q=cq6("sha256").update(`${$}:${Z}`).digest();return iK1+Q.readUInt32BE(0)%mi$}function ui$($){let Z=$.slice(0,GR6);return JR6.test(Z)?Z:""}function KR6($){if($===void 0)return null;let Z=$.trim();if(Z==="")return null;if(!WR6.test(Z))throw Error(`AgentSandboxProvider: envName=${JSON.stringify(Z)} is not a valid DNS-label-safe environment name (lowercase alphanumeric or '-', starts with a letter, ends alphanumeric, \u226432 chars). Studio sets this from STUDIO_ENV; check the studio chart's configMap.`);return Z}function mK1($,Z={}){let Q={...Z};if($){let Y=ui$($.orgId),X=ui$($.userId);if(Y)Q[bJ.orgId]=Y;if(X)Q[bJ.userId]=X}return Q}function Nh($){let Z="";for(let Q of $){let Y=Q.codePointAt(0)??0;Z+=Y<32||Y===127?" ":Q}return Z.slice(0,HR6)}function FR6($){try{let Z=new URL($);return Z.username="",Z.password="",Z.toString()}catch{return""}}function UR6($){let Z={},Q=$.tenant;if(Q?.orgSlug)Z[pF.orgSlug]=Nh(Q.orgSlug);if(Q?.orgName)Z[pF.orgName]=Nh(Q.orgName);if(Q?.userEmail)Z[pF.userEmail]=Nh(Q.userEmail);if(Q?.userName)Z[pF.userName]=Nh(Q.userName);let Y=$.repo;if(Y){if(Y.displayName)Z[pF.gitRepo]=Nh(Y.displayName);let X=FR6(Y.cloneUrl);if(X)Z[pF.gitRepoUrl]=Nh(X);let J=$.branch??Y.branch;if(J)Z[pF.gitBranch]=Nh(J)}return Z}function NR6($){let Z=$.metadata?.labels;if(!Z)return null;let Q=Z[bJ.orgId],Y=Z[bJ.userId];if(!Q||!Y)return null;let X=$.metadata?.annotations??{};return{orgId:Q,userId:Y,orgSlug:X[pF.orgSlug],orgName:X[pF.orgName],userEmail:X[pF.userEmail],userName:X[pF.userName]}}function BR6($,Z){if($){let Q=new Date($).getTime();if(Number.isFinite(Q)&&Q<=Z.getTime())return null}return Z.toISOString()}function DR6($,Z){if($){let Q=new Date($).getTime();if(Number.isFinite(Q)&&Q>=Z.getTime())return null}return Z.toISOString()}function dK1($){return{org_id:$?.orgId??"",user_id:$?.userId??"",runner_kind:"agent-sandbox"}}async function LR6($,Z){if(!Z||!$.tenant)return $.orgFsConfigJson;try{return await Z($.tenant)??$.orgFsConfigJson}catch(Q){return console.warn(`[${M6}] org-fs credential re-mint failed: ${Q instanceof Error?Q.message:String(Q)}`),$.orgFsConfigJson}}function li$($){try{let Z=new URL($.cloneUrl);Z.username="",Z.password="";let{submoduleCredentials:Q,credentialExpiresAt:Y,...X}=$;return{...X,cloneUrl:Z.toString()}}catch{return null}}function OR6($,Z){let{orgFsConfigJson:Q,repo:Y,extraRepos:X,...J}=$,G=J,W=Y&&li$(Y);if(W)G.repo=W;if(X)G.extraRepos=X.map(li$).filter((K)=>K!==null);return Q||Z?{ensureOpts:G,orgFsRedacted:!0}:{ensureOpts:G}}function jR6($){let Z={};if($.branch)Z.branch=$.branch;if($.repo)Z.repo=$.repo;if($.workload)Z.workload=$.workload;if($.env&&Object.keys($.env).length>0)Z.env=$.env;if($.tenant)Z.tenant=$.tenant;if($.cloneOnly)Z.cloneOnly=!0;if($.purpose)Z.purpose=$.purpose;if($.sandboxImage)Z.sandboxImage=$.sandboxImage;if($.orgFsConfigJson)Z.orgFsConfigJson=$.orgFsConfigJson;return Object.keys(Z).length>0?Z:null}function wR6($,Z){try{return new URL(_C0($,Z)).hostname||null}catch{return null}}var M6="AgentSandboxProvider",iq6="agent-sandbox-system",pq6="studio-sandbox",nq6=300000,jB=9000,yi$=3000,yC0="/app",tq6=32,oq6,sq6=900000,rq6=60000,aq6=1800000,gC0=3,gi$=1800000,eq6=900000,$R6=1800000,iK1=40000,mi$=1e4,ZR6=256,bJ,pF,JR6,GR6=63,WR6,HR6=253;var di$=L(()=>{n$();xg$();Gi$();Fh();An();Fj0();Z50();Pi$();V50();Si$();xC0();fC0();oq6=new Set(["DAEMON_TOKEN","DAEMON_BOOT_ID","APP_ROOT","PROXY_PORT"]);bJ={role:"studio.decocms.com/role",sandboxHandle:"studio.decocms.com/sandbox-handle",orgId:"studio.decocms.com/org-id",userId:"studio.decocms.com/user-id",env:"studio.decocms.com/env"},pF={orgSlug:"studio.decocms.com/org-slug",orgName:"studio.decocms.com/org-name",userEmail:"studio.decocms.com/user-email",userName:"studio.decocms.com/user-name",gitRepo:"studio.decocms.com/git-repo",gitRepoUrl:"studio.decocms.com/git-repo-url",gitBranch:"studio.decocms.com/git-branch"},JR6=/^([A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?)?$/;WR6=/^[a-z]([a-z0-9-]{0,30}[a-z0-9])?$/});var ii$={};O6(ii$,{tenantPoolSchema:()=>Ai$,tenantPoolRepoSchema:()=>M50,tenantPoolFieldsSchema:()=>fK1,tenantPoolAllocations:()=>Tn,resolveTenantPoolBinding:()=>yK1,renderTenantPoolWarmPools:()=>Ri$,normalizeRepoUrl:()=>tK,allocationsMatchingPush:()=>hK1,TenantPoolCapacityError:()=>bC0,PREVIEW_NOT_READY_HEADER:()=>Rn,AgentSandboxProvider:()=>nK1});var I50=L(()=>{di$();V50()});import{z as Bh}from"zod";function hC0($){if(!$||$.trim()==="")return[];let Z=Bh.array(ER6).parse(JSON.parse($)),Q=new Set;for(let Y of Z){if(Q.has(Y.name))throw Error(`tenant pools: duplicate pool name ${Y.name}`);Q.add(Y.name)}return Z}function pi$($){let Z=tK(`https://github.com/${$.repo}`);if(!Z)throw Error(`tenant pools: bad repo ${$.repo}`);return Z}function ni$($){return $.map((Z)=>({name:Z.name,tenant:Z.orgId,size:1,image:"default",repos:[{repoUrl:pi$(Z),branch:Z.branch,workload:Z.workload,replicas:1,warmPoolName:Z.name}]}))}function tK1($,Z){let Q=tK(Z.repoUrl)?.toLowerCase(),Y=$.find((J)=>J.orgId===Z.tenant&&J.branch===Z.branch&&pi$(J).toLowerCase()===Q);if(!Y)return null;let X=`https://github.com/${Y.repo}.git`;return Y.connectionId?{cloneUrl:X,connectionId:Y.connectionId}:{cloneUrl:X}}function ti$($,Z){return async(Q)=>{let Y=tK1($,Q);if(!Y)return null;return Y.connectionId?Z(Y):Y.cloneUrl}}var ER6;var uC0=L(()=>{I50();ER6=Bh.object({name:Bh.string().max(63).regex(/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/,"pool name must be a DNS label (lowercase alphanumeric and '-')"),orgId:Bh.string().min(1),repo:Bh.string().regex(/^[^/\s]+\/[^/\s]+$/,"repo must be `owner/name`"),connectionId:Bh.string().min(1).optional(),branch:Bh.string().min(1).default("main"),workload:M50.shape.workload})});function eK1($,Z=Date.now()){if($===void 0)return;return $===null?Z+PR6:$.getTime()}function aK1($){return JSON.stringify([$.orgId,$.userId])}function oi$($,Z){let Q=tK(Z);return Q?JSON.stringify([$,Q.toLowerCase()]):null}function AR6($,Z){return"repositoryId"in Z?$.repositoryOrgs.get(Z.repositoryId):$.connectionOrgs.get(Z.connectionId)}function si$($){let{records:Z,now:Q}=$,Y=new Map,X=new Map,J=new Map,G=0;for(let W of $.pools)for(let{repoUrl:K,branch:H}of W.repos){let F=oi$(W.tenant,K),U=tK1($.legacyPools??[],{tenant:W.tenant,repoUrl:K,branch:H});if(F&&U){if(U.connectionId)X.set(F,{tenant:W.tenant,repoUrl:K,connectionId:U.connectionId,cloneUrl:U.cloneUrl});continue}let N=F?Z.orgRepositories.get(F):void 0;if(!F||!N){G++;continue}X.set(F,{tenant:W.tenant,repoUrl:K,repositoryId:N})}for(let W of $.sandboxes){let K=W.tenant;if(!K)continue;let H=Z.members.get(aK1(K));if(H===void 0){G++;continue}for(let U of W.repos){if(AR6(Z,U)!==K.orgId){G++;continue}let N="repositoryId"in U?{repositoryId:U.repositoryId}:{connectionId:U.connectionId,repo:U.repo.toLowerCase()},B={orgId:K.orgId,userId:K.userId};Y.set(JSON.stringify([B,N]),{tenant:B,repo:N})}let F=W.orgFsConfigExpiresAt;if(W.orgFs&&(F===null||F-Q<zR6))J.set(aK1(K),{orgId:K.orgId,userId:K.userId,orgSlug:H})}return{clones:[...Y.values()],poolClones:[...X.values()],orgFs:[...J.values()],refused:G}}async function ri$($,Z,Q){let Y=new Set,X=new Set,J=new Set,G=new Set,W=new Set(Q.map((D)=>D.tenant)),K=new Set;for(let D of Q)for(let{repoUrl:O}of D.repos){let j=DX(O);if(j)K.add(j.path.toLowerCase())}for(let D of Z){if(D.tenant)Y.add(D.tenant.orgId),X.add(D.tenant.userId);for(let O of D.repos)if("repositoryId"in O)G.add(O.repositoryId);else J.add(O.connectionId)}let[H,F,U,N]=await Promise.all([Y.size===0?[]:$.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.organizationId as orgId","member.userId as userId","organization.slug as slug"]).where("member.organizationId","in",[...Y]).where("member.userId","in",[...X]).execute(),J.size===0?[]:$.selectFrom("connections").select(["id","organization_id"]).where("id","in",[...J]).execute(),G.size===0?[]:$.selectFrom("repositories").select(["id","organization_id"]).where("id","in",[...G]).execute(),K.size===0?[]:$.selectFrom("repositories").select(["id","organization_id","provider","host","path"]).where("organization_id","in",[...W]).where((D)=>D(D.fn("lower",["path"]),"in",[...K])).execute()]),B=new Map;for(let D of N){let O=oi$(D.organization_id,I80({provider:D.provider,host:D.host,path:D.path}));if(O&&!B.has(O))B.set(O,D.id)}return{members:new Map(H.map((D)=>[aK1(D),D.slug])),connectionOrgs:new Map(F.map((D)=>[D.id,D.organization_id])),repositoryOrgs:new Map(U.map((D)=>[D.id,D.organization_id])),orgRepositories:B}}function rK1($){return $ instanceof Error?$.message:String($)}async function ai$($,Z,Q){let Y=0;if($.clones.length>Vn||$.poolClones.length>Vn||$.orgFs.length>sK1)console.warn(`[sandbox-credential-push] ${$.clones.length} clone, ${$.poolClones.length} pool clone and ${$.orgFs.length} org-fs mints planned; minting the first ${Vn}, ${Vn} and ${sK1}`);let X=await I5($.clones.slice(0,Vn),oK1,async(U)=>{let N="repositoryId"in U.repo?{cloneUrl:"",repositoryId:U.repo.repositoryId}:{cloneUrl:`https://github.com/${U.repo.repo}.git`,connectionId:U.repo.connectionId};try{let B=await Z.mintCloneUrl(N,{bufferMs:lC0});return B?{tenant:U.tenant,repo:U.repo,cloneUrl:B,expiresAt:Q.now+lC0}:null}catch(B){return Y++,console.warn(`[sandbox-credential-push] clone mint failed: ${rK1(B)}`),null}}),J=await I5($.poolClones.slice(0,Vn),oK1,async(U)=>{try{let N=await Z.mintCloneUrl("repositoryId"in U?{cloneUrl:"",repositoryId:U.repositoryId}:{cloneUrl:U.cloneUrl,connectionId:U.connectionId},{bufferMs:lC0});return N?{tenant:U.tenant,repoUrl:U.repoUrl,cloneUrl:N,expiresAt:Q.now+lC0}:null}catch(N){return Y++,console.warn(`[sandbox-credential-push] pool clone mint failed: ${rK1(N)}`),null}}),G=await I5($.orgFs.slice(0,sK1),oK1,async(U)=>{try{let N=await Z.mintOrgFsConfig(U);return N?{tenant:{orgId:U.orgId,userId:U.userId},orgFsConfigJson:N,expiresAt:Q.now+Q.orgFsLifetimeMs}:null}catch(N){return Y++,console.warn(`[sandbox-credential-push] org-fs mint failed: ${rK1(N)}`),null}}),W=X.filter((U)=>U!==null),K=J.filter((U)=>U!==null),H=G.filter((U)=>U!==null),F=[];for(let U=0;U<Math.max(W.length,K.length,H.length);U+=Wz)F.push({cloneUrls:W.slice(U,U+Wz),poolCloneUrls:K.slice(U,U+Wz),orgFsConfigs:H.slice(U,U+Wz)});return{batches:F,failed:Y}}var lC0=2700000,cC0,PR6=86400000,zR6=86400000,oK1=8,Vn=2000,sK1=200;var mC0=L(()=>{b31();I50();t4();n$();UB();uC0();cC0=ry$-3600000});var xJ;var k50=L(()=>{xJ=class xJ extends Error{code;status;path;constructor($,Z,Q){super(Z.message||`Freestyle API error: ${Z.code}`);this.name="FreestyleApiError",this.code=Z.code,this.status=$,this.path=Q,Object.setPrototypeOf(this,xJ.prototype)}}});function ei$(){return typeof process<"u"&&Boolean(process.versions?.node)}var dC0=($,Z)=>globalThis.fetch($,Z);async function TR6(){if(!ei$())return null;try{return await import("undici")}catch{return null}}async function RR6(){let $=await TR6();if(!$)return null;let Z=new $.Agent({allowH2:!0,connections:qR6});return(Q,Y)=>$.fetch(Q,{...Y,dispatcher:Z})}function MR6($){return(typeof $==="string"?$:$ instanceof URL?$.href:$.url).startsWith("https:")}function $p$(){let $,Z=()=>{return $??=RR6().then((Q)=>Q??dC0).catch(()=>dC0),$};return(Q,Y)=>MR6(Q)?Z().then((X)=>X(Q,Y)):dC0(Q,Y)}var qR6=4;var Zp$=()=>{};function _R6($){return new Promise((Z)=>setTimeout(Z,$))}function vR6($){if(!$)return"";let Z=new URLSearchParams;for(let[Y,X]of Object.entries($)){if(X===void 0||X===null)continue;Z.set(Y,String(X))}let Q=Z.toString();return Q?`?${Q}`:""}function t6($){return encodeURIComponent($)}class $H1{baseUrl;authenticationHeaders;fetchImpl;backgroundEligible;constructor($={}){if(this.baseUrl=($.baseUrl??SR6).replace(/\/+$/,""),!$.fetch&&!globalThis.fetch)throw Error("No fetch implementation available. Pass `fetch` in FreestyleOptions when running on a runtime without a global fetch.");if(this.fetchImpl=$.fetch??$p$(),"identityAccessToken"in $&&$.identityAccessToken){this.authenticationHeaders={[VR6]:$.identityAccessToken},this.backgroundEligible=!1;return}if(this.backgroundEligible=!0,"stackAccessToken"in $&&$.stackAccessToken){this.authenticationHeaders={Authorization:`Bearer ${$.stackAccessToken}`,"X-Freestyle-Team-Id":$.teamId};return}let Z=$.apiKey??globalThis.process?.env?.FREESTYLE_API_KEY;if(!Z)throw Error("No Freestyle API key provided. Pass `apiKey` in FreestyleOptions or set FREESTYLE_API_KEY.");this.authenticationHeaders={Authorization:`Bearer ${Z}`}}authHeaders(){return{...this.authenticationHeaders}}url($,Z){return`${this.baseUrl}${$}${vR6(Z)}`}async fetch($,Z={}){let Q=new Headers(Z.headers);for(let[Y,X]of Object.entries(this.authHeaders()))if(!Q.has(Y))Q.set(Y,X);return this.fetchImpl(this.absoluteUrl($),{...Z,headers:Q})}absoluteUrl($){return/^https?:\/\//i.test($)?$:`${this.baseUrl}${$}`}async request($,Z,{query:Q,body:Y,rawBody:X,signal:J}={}){let G={...this.authHeaders()};if(this.backgroundEligible)G[Qp$]=String(kR6);let W;if(X!==void 0)G["Content-Type"]="application/octet-stream",W=X;else if(Y!==void 0)G["Content-Type"]="application/json",W=JSON.stringify(Y);let K=this.url(Z,Q),H=await this.fetchImpl(K,{method:$,headers:G,body:W,signal:J});if(this.backgroundEligible&&H.status===202)try{return await this.pollBackgroundRequest(H,Z)}catch(F){if($==="GET"&&F instanceof xJ&&F.code==="BACKGROUND_RESULT_UNSTORABLE"){delete G[Qp$];let U=await this.fetchImpl(K,{method:$,headers:G,body:W});return this.finalize(U,Z)}throw F}return this.finalize(H,Z)}async pollBackgroundRequest($,Z){let Q=await $.json().catch(()=>({})),Y=$.headers.get(IR6)??Q.requestId,X=Q.resultUrl??(Y?`/v5/background-requests/${t6(Y)}`:void 0);if(!X)throw new xJ($.status,{code:"BACKGROUND_PROTOCOL_ERROR",message:"202 Accepted carried no background request id"},Z);let J=0;for(;;){await _R6(CR6);let G;try{G=await this.fetch(X,{method:"GET"}),J=0}catch(W){if(++J>=5)throw W;continue}if(G.status===202)continue;return this.finalize(G,Z)}}async finalize($,Z){if(!$.ok){let Y;try{Y=await $.json()}catch{Y={code:"UNKNOWN_ERROR",message:await $.text().catch(()=>$.statusText)}}throw new xJ($.status,Y,Z)}if($.status===204)return;let Q=await $.text();if(!Q)return;return JSON.parse(Q)}get($,Z){return this.request("GET",$,{query:Z})}post($,Z){return this.request("POST",$,{body:Z??{}})}patch($,Z){return this.request("PATCH",$,{body:Z??{}})}put($,Z){return this.request("PUT",$,{body:Z??{}})}putEmpty($){return this.request("PUT",$,{})}putBytes($,Z,Q,Y){return this.request("PUT",$,{query:Q,rawBody:Z,signal:Y})}async getBytes($,Z,Q={}){let Y={...this.authHeaders()};if(Q.range)Y.Range=Q.range;let X=await this.fetchImpl(this.url($,Z),{method:"GET",headers:Y,signal:Q.signal});if(!X.ok){let J;try{J=await X.json()}catch{J={code:"UNKNOWN_ERROR",message:await X.text().catch(()=>X.statusText)}}throw new xJ(X.status,J,$)}return X}delete($,Z){return this.request("DELETE",$,{query:Z})}}var VR6="x-freestyle-identity-access-token",Qp$="x-freestyle-background-after-secs",IR6="x-freestyle-background-request-id",kR6=5,CR6=2000,SR6="https://api.freestyle.sh";var oK=L(()=>{k50();Zp$()});class ZH1{client;verifications;certificates;placeholder;constructor($){this.client=$,this.verifications=new Yp$($),this.certificates=new Xp$($),this.placeholder=new Jp$($)}async list(){let{domains:$}=await this.client.get("/v5/domains");return $}}class Yp${client;constructor($){this.client=$}create($){return this.client.post("/v5/verifications",{domain:$})}async list($={}){let{verifications:Z}=await this.client.get("/v5/verifications",$);return Z}get($){return this.client.get(`/v5/verifications/${t6($)}`)}complete($){return this.client.putEmpty(`/v5/verifications/${t6($)}`)}delete($){return this.client.delete(`/v5/verifications/${t6($)}`)}}class Xp${client;constructor($){this.client=$}async list(){let{certificates:$}=await this.client.get("/v5/certificates");return $}createWildcard($){return this.client.post("/v5/certificates/wildcard",{domain:$})}}class Jp${client;constructor($){this.client=$}async get(){try{return await this.client.get("/v5/domains/placeholder")}catch($){if($ instanceof xJ&&$.status===404)return null;throw $}}set($){return this.client.put("/v5/domains/placeholder",$)}delete(){return this.client.delete("/v5/domains/placeholder")}}var QH1=L(()=>{oK();k50()});function Q5($,Z){throw new XH1($,Z)}function YH1($){return bR6.some((Z)=>$[Z]!==void 0)}function JH1($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function fR6($,Z){let Q=Z.lastIndexOf("/");if(Q<0)Q5($,`${$} \`${Z}\` is not a CIDR: expected address/prefix, e.g. 203.0.113.0/24 or 2001:db8::/32`);let Y=Z.slice(0,Q),X=Z.slice(Q+1);if(!/^\d+$/.test(X))Q5($,`${$} \`${Z}\`: prefix length must be a number`);let J=Number(X),G=Y.includes(":"),W=G?128:32;if(J>W)Q5($,`${$} \`${Z}\`: prefix length must be 0\u2013${W}`);if(!G&&!/^\d{1,3}(\.\d{1,3}){3}$/.test(Y))Q5($,`${$} \`${Z}\`: \`${Y}\` is not an IP address`)}function Hp$($,Z){if(!JH1($))Q5(Z,`${Z} must be an object`);for(let Y of Object.keys($))if(!Gp$.includes(Y))Q5(`${Z}.${Y}`,`${Z} has unknown field \`${Y}\`. Expected one of: ${Gp$.join(", ")}`);let Q=$;for(let Y of["vmId","vpcId","tunnelId","cidr"]){let X=Q[Y];if(X!==void 0&&(typeof X!=="string"||X.length===0))Q5(`${Z}.${Y}`,`${Z}.${Y} must be a non-empty string`)}if(Q.public!==void 0&&Q.public!==!0)Q5(`${Z}.public`,`${Z}.public must be true when present: it declares the public Internet. Omit the field to match something else`);if(Q.public===!0){if(Q.vmId!==void 0)Q5(`${Z}.public`,`${Z} cannot combine \`public: true\` with \`vmId\`: that would mean the VM only when reached over its public address, a distinction this API does not make yet. Use \`vmId\` alone to match the VM on any path, or \`public: true\` alone to match public addresses`);if(Q.vpcId!==void 0)Q5(`${Z}.public`,`${Z} cannot combine \`public: true\` with \`vpcId\`: that would mean the network's members only when reached over their public addresses, a distinction this API does not make yet. Use \`vpcId\` alone or \`public: true\` alone`);if(Q.tunnelId!==void 0)Q5(`${Z}.public`,`${Z} cannot combine \`public: true\` with \`tunnelId\`: traffic through a tunnel arrives over the tunnel, not over the public Internet. Use \`tunnelId\` alone`)}if(Q.cidr!==void 0)fR6(`${Z}.cidr`,Q.cidr);if(Q.protocol!==void 0&&!Wp$.includes(Q.protocol))Q5(`${Z}.protocol`,`${Z}.protocol must be one of: ${Wp$.join(", ")} (got \`${String(Q.protocol)}\`)`);if(Q.port!==void 0){if(!Number.isInteger(Q.port)||Q.port<1||Q.port>65535)Q5(`${Z}.port`,`${Z}.port must be an integer between 1 and 65535`);if(Q.protocol===void 0)Q5(`${Z}.protocol`,`${Z}.port ${Q.port} requires ${Z}.protocol: set it to "tcp" or "udp" so the rule opens one transport rather than both`);if(!xR6.includes(Q.protocol))Q5(`${Z}.port`,`${Z}.protocol "${Q.protocol}" has no ports; remove ${Z}.port ${Q.port}`)}}function Np$($,Z){if(!JH1($))Q5(Z||"rule",`${Z||"rule"} must be an object`);for(let Y of Object.keys($))if(!Fp$.includes(Y))Q5(`${Z}${Y}`,`Unknown field \`${Y}\`. Expected one of: ${Fp$.join(", ")}`);let Q=$;if(Q.action===void 0)Q5(`${Z}action`,`${Z}action is required. Write \`action: "allow"\` \u2014 every rule states what it does rather than defaulting to it`);if(Q.action!=="allow")Q5(`${Z}action`,`${Z}action must be "allow" (got \`${String(Q.action)}\`). Only allow rules exist today`);if(Q.description!==void 0){if(typeof Q.description!=="string")Q5(`${Z}description`,"description must be a string");if(Q.description.length>Kp$)Q5(`${Z}description`,`description is too long (${Q.description.length} characters, maximum ${Kp$})`)}if(Q.source===void 0)Q5(`${Z}source`,`${Z}source is required`);if(Q.destination===void 0)Q5(`${Z}destination`,`${Z}destination is required`);return Hp$(Q.source,`${Z}source`),Hp$(Q.destination,`${Z}destination`),Q}function yR6($){let Z=Np$($,"");for(let Q of["source","destination"]){let Y=Z[Q];if(YH1(Y))continue;let X=[Y.port!==void 0?`port ${Y.port}`:void 0,Y.protocol!==void 0?`protocol ${Y.protocol}`:void 0].filter(Boolean).join(", ");Q5(Q,X?`${Q} only narrows traffic (${X}) without saying what it is. Add \`vmId\`, \`vpcId\`, \`tunnelId\`, \`cidr\`, or \`public: true\`. Leaving it out to mean "this VM" only works inside vms.create`:`${Q} is empty. A matcher must say what the traffic is: \`vmId\`, \`vpcId\`, \`tunnelId\`, \`cidr\`, or \`public: true\` for the public Internet`)}return Z}function iC0($,Z="VM"){if($===void 0||$===null)Q5("firewall",`firewall is required on a ${Z} create. A ${Z} gets nothing implicitly, so state what it may reach \u2014 \`{ rules: [] }\` if the answer is nothing`);if(!JH1($))Q5("firewall","firewall must be an object with a `rules` array");for(let Y of Object.keys($))if(Y!=="rules")Q5(`firewall.${Y}`,`firewall has unknown field \`${Y}\`. Expected: rules`);let Q=$.rules;if(!Array.isArray(Q))Q5("firewall.rules","firewall.rules must be an array");return Q.forEach((Y,X)=>{let J=`firewall.rules[${X}].`,G=Np$(Y,J),W=YH1(G.source),K=YH1(G.destination);if(!W&&!K&&Z!=="network")Q5(`firewall.rules[${X}]`,`firewall.rules[${X}]: both source and destination refer to the ${Z} being created, which allows nothing. Give one of them a \`vmId\`, \`vpcId\`, \`tunnelId\`, \`cidr\`, or \`public: true\``);if(W&&K)Q5(`firewall.rules[${X}]`,`firewall.rules[${X}]: neither end refers to the ${Z} being created. Leave one endpoint's identity unset so it means this ${Z}, or create the rule with firewall.rules.create instead`)}),$}function Up$($){return`/v5/firewall/rules/${t6($)}`}class Bp${client;constructor($){this.client=$}async create($){let Z=yR6($);return this.client.post("/v5/firewall/rules",Z)}list($={}){return this.client.get("/v5/firewall/rules",$)}get($){return this.client.get(Up$($))}delete($){return this.client.delete(Up$($))}}class GH1{client;rules;constructor($){this.client=$,this.rules=new Bp$($)}evaluate($){return this.client.post("/v5/firewall/evaluate",$)}}var XH1,Gp$,bR6,Wp$,xR6,Kp$=1024,Fp$;var C50=L(()=>{oK();XH1=class XH1 extends Error{path;constructor($,Z){super(Z);this.name="FirewallRuleValidationError",this.path=$,Object.setPrototypeOf(this,XH1.prototype)}};Gp$=["vmId","vpcId","tunnelId","cidr","public","port","protocol"],bR6=["vmId","vpcId","tunnelId","cidr","public"],Wp$=["tcp","udp","icmp"],xR6=["tcp","udp"];Fp$=["action","source","destination","description"]});function WH1($){return`/v5/identities/${t6($)}`}class Dp${client;basePath;constructor($,Z){this.client=$,this.basePath=Z}create(){return this.client.post(`${this.basePath}/tokens`)}list(){return this.client.get(`${this.basePath}/tokens`)}revoke($){return this.client.delete(`${this.basePath}/tokens/${t6($)}`)}}class Lp${client;basePath;constructor($,Z){this.client=$,this.basePath=Z}list(){return this.client.get(`${this.basePath}/permissions/vm`)}grant($){return this.client.post(`${this.basePath}/permissions/vm`,$)}get($){return this.client.get(`${this.basePath}/permissions/vm/${t6($)}`)}update($,Z){return this.client.patch(`${this.basePath}/permissions/vm/${t6($)}`,{allowedLinuxUsers:Z})}revoke($){return this.client.delete(`${this.basePath}/permissions/vm/${t6($)}`)}}class KH1{id;tokens;permissions;client;basePath;constructor($,Z){this.client=$,this.id=Z,this.basePath=WH1(Z),this.tokens=new Dp$($,this.basePath),this.permissions={vm:new Lp$($,this.basePath)}}data(){return this.client.get(this.basePath)}delete(){return this.client.delete(this.basePath)}}class HH1{client;constructor($){this.client=$}async create($={}){let Z=await this.client.post("/v5/identities",$);return{identity:new KH1(this.client,Z.id),identityId:Z.id,data:Z}}list($={}){return this.client.get("/v5/identities",$)}get($){return this.client.get(WH1($))}ref($){return new KH1(this.client,$)}delete($){return this.client.delete(WH1($))}}var FH1=L(()=>{oK()});function h1($,Z){throw new DH1($,Z)}function q7($,Z){throw new LH1($,Z)}function S50($){return gR6.some((Z)=>$[Z]!==void 0)}function pR6($){return!S50($)&&$.port===void 0}function VX($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function kp$($,Z,Q){if(typeof $!=="string"||!cR6.test($))q7(Z,`${Z} must be a valid HTTP header name`);let Y=$.toLowerCase();if(iR6.has(Y)||Y.startsWith("x-forwarded-")||Y.startsWith("x-freestyle-")||Q&&(Y==="cookie"||Y==="set-cookie"))q7(Z,`${Z} may not use reserved header \`${$}\``)}function nR6($,Z){if(!Array.isArray($))q7(Z,`${Z} must be an array of header names`);if($.length>Ap$)q7(Z,`${Z} may contain at most ${Ap$} names`);let Q=new Set;$.forEach((Y,X)=>{kp$(Y,`${Z}[${X}]`,!0);let J=Y.toLowerCase();if(Q.has(J))q7(`${Z}[${X}]`,`${Z} contains duplicate header \`${Y}\``);Q.add(J)})}function qp$($){if(!VX($))q7("forwardAuth","forwardAuth must be an object");for(let Y of Object.keys($))if(!wp$.includes(Y))q7(Y,`Unknown field \`${Y}\`. Expected one of: ${wp$.join(", ")}`);let Z=$;if(typeof Z.url!=="string"||Z.url.length===0||Z.url.length>mR6)q7("url","url is required and must be an absolute HTTPS URL");let Q;try{Q=new URL(Z.url)}catch{q7("url","url must be an absolute HTTPS URL")}if(Q.protocol!=="https:"||Q.hostname.length===0||Q.username.length>0||Q.password.length>0||Q.hash.length>0||Q.port==="0")q7("url","url must be an absolute HTTPS URL");if(Z.headers!==void 0){if(!VX(Z.headers))q7("headers","headers must be an object of header name to value");let Y=Object.entries(Z.headers);if(Y.length>Pp$)q7("headers",`headers may contain at most ${Pp$} entries`);let X=0,J=new Set;for(let[G,W]of Y){kp$(G,`headers.${G}`,!1);let K=G.toLowerCase();if(J.has(K))q7(`headers.${G}`,`headers contains duplicate header \`${G}\``);if(J.add(K),typeof W!=="string"||/[\0\r\n]/.test(W))q7(`headers.${G}`,`headers.${G} must be a string`);X+=G.length+W.length}if(X>zp$)q7("headers",`headers may contain at most ${zp$} bytes`)}if(Z.timeoutMs!==void 0&&(!Number.isInteger(Z.timeoutMs)||Z.timeoutMs<100||Z.timeoutMs>5000))q7("timeoutMs","timeoutMs must be an integer between 100 and 5000");if(Z.protectedCookies!==void 0){if(!Array.isArray(Z.protectedCookies))q7("protectedCookies","protectedCookies must be an array of cookie names");if(Z.protectedCookies.length>Tp$)q7("protectedCookies",`protectedCookies may contain at most ${Tp$} names`);let Y=new Set;Z.protectedCookies.forEach((X,J)=>{if(typeof X!=="string"||X.length>dR6||!lR6.test(X))q7(`protectedCookies[${J}]`,`protectedCookies[${J}] must be a valid HTTP cookie name`);if(Y.has(X))q7(`protectedCookies[${J}]`,`protectedCookies contains duplicate cookie \`${X}\``);Y.add(X)})}if(Z.authResponseHeaders!==void 0)nR6(Z.authResponseHeaders,"authResponseHeaders");return Z}function tR6($,Z){if(!VX($))h1(Z,`${Z} must be an object with an \`id\``);for(let Y of Object.keys($))if(!Ep$.includes(Y))h1(`${Z}.${Y}`,`${Z} has unknown field \`${Y}\`. Expected: ${Ep$.join(", ")}`);let Q=$.id;if(typeof Q!=="string"||Q.length===0)h1(`${Z}.id`,`${Z}.id is required and must be a non-empty string`)}function BH1($){if(typeof $!=="string")h1("domain","domain is required and must be a string");if($==="*")return;let Z=$.startsWith("*.")?$.slice(2):$;if(Z.length===0||Z.length>hR6)h1("domain",`domain \`${$}\` is not a hostname`);let Q=Z.split(".");if(Q.length<2)h1("domain",`domain \`${$}\` must have at least two labels, e.g. acme.com`);for(let Y of Q){if(Y.length===0||Y.length>uR6)h1("domain",`domain \`${$}\` has an empty or over-long label`);if(!/^[a-z0-9-]+$/.test(Y))h1("domain",`domain \`${$}\`: labels are lowercase letters, digits, and hyphens (a \`*.\` prefix is the only wildcard)`);if(Y.startsWith("-")||Y.endsWith("-"))h1("domain",`domain \`${$}\`: a label cannot start or end with a hyphen`)}}function oR6($){if(typeof $!=="string")h1("domain","domain is required and must be a string");let Z=$.lastIndexOf("@");if(Z===-1){BH1($);return}let Q=$.slice(0,Z),Y=$.slice(Z+1);if(Q.length===0||Q.length>64)h1("domain",`mail route \`${$}\`: the part before \`@\` must be 1-64 characters`);if(Q.startsWith(".")||Q.endsWith(".")||Q.includes(".."))h1("domain",`mail route \`${$}\`: the part before \`@\` cannot start or end with a dot, or contain \`..\``);for(let X of Q)if(!/[a-zA-Z0-9]/.test(X)&&!Rp$.includes(X))h1("domain",`mail route \`${$}\`: the part before \`@\` may use letters, digits, dots, and \`${Rp$.slice(0,-1)}\` (quoted mailboxes are not supported)`);if(Y==="*")h1("domain",`mail route \`${$}\`: \`*\` is not a mail domain \u2014 name the domain the mailbox lives at`);BH1(Y)}function Mp$($,Z){if(!VX($))h1(Z,`${Z} must be an object`);for(let Y of Object.keys($))if(!Op$.includes(Y))h1(`${Z}.${Y}`,`${Z} has unknown field \`${Y}\`. Expected one of: ${Op$.join(", ")}`);let Q=$;for(let Y of["vmId","vpcId","host"]){let X=Q[Y];if(X!==void 0&&(typeof X!=="string"||X.length===0))h1(`${Z}.${Y}`,`${Z}.${Y} must be a non-empty string`)}if(Q.public!==void 0&&Q.public!==!0)h1(`${Z}.public`,`${Z}.public must be true when present. Omit the field to match something else`);if(Z==="source"){if(Q.host!==void 0)h1("source.host","source.host is not allowed: a source is who opens the session, not where it lands. Put `host` on the destination");if(Q.port!==void 0)h1("source.port","source.port is not allowed: a source is who opens the session, not where it lands. Put `port` on the destination");if(Q.public===!0&&(Q.vmId!==void 0||Q.vpcId!==void 0))h1("source.public","source cannot combine `public: true` with `vmId` or `vpcId`: use one alone. `public` is every client on the Internet; `vmId`/`vpcId` is a specific dialer")}else{if(Q.vpcId!==void 0)h1("destination.vpcId","destination.vpcId is not allowed: a session lands in one place, not on a whole network. Name a `vmId`, a `host`, or `public: true` for the domain's own origin. A whole network may be a source");if([Q.vmId!==void 0,Q.host!==void 0,Q.public===!0].filter(Boolean).length>1)h1("destination","destination names more than one landing: give exactly one of `vmId`, `host`, or `public: true`");if((Q.vmId!==void 0||Q.host!==void 0)&&Q.port===void 0)h1("destination.port",`destination.port is required with ${Q.vmId!==void 0?"`vmId`":"`host`"}: say which port the session lands on`)}if(Q.port!==void 0){if(!Number.isInteger(Q.port)||Q.port<1||Q.port>65535)h1(`${Z}.port`,`${Z}.port must be an integer between 1 and 65535`)}}function sR6($){if("postgres"in $)return"postgres";if("smtp"in $)return"smtp";if("socks5"in $)return"socks5";return"http"}function rR6($,Z){function Q(W,K,H){if(!VX(W)||Object.keys(W).some((F)=>!K.includes(F)))h1(H,`${H} must contain only ${K.join(", ")}`)}if(Q($,["region","credentials","scope"],Z),typeof $.region!=="string"||!/^[a-z0-9-]{1,63}$/.test($.region))h1(`${Z}.region`,"invalid s3.region");Q($.credentials,["accessKeyId","secretAccessKey","sessionToken"],`${Z}.credentials`);for(let W of["accessKeyId","secretAccessKey","sessionToken"]){let K=$.credentials[W];if(W==="sessionToken"&&K===void 0)continue;if(typeof K!=="string"||!/^[\x21-\x7e]{1,16384}$/.test(K))h1(`${Z}.credentials.${W}`,"invalid s3 credentials")}if(!/^[a-zA-Z0-9]+$/.test($.credentials.accessKeyId))h1(`${Z}.credentials.accessKeyId`,"invalid s3 access key id");Q($.scope,["bucket","prefix","operations"],`${Z}.scope`);let{bucket:Y,prefix:X,operations:J}=$.scope;if(typeof Y!=="string"||!/^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/.test(Y)||Y.includes(".."))h1(`${Z}.scope.bucket`,"invalid s3.scope.bucket");if(typeof X!=="string"||Buffer.byteLength(X,"utf8")>1024||/[\x00-\x1f\x7f-\x9f]/u.test(X))h1(`${Z}.scope.prefix`,"invalid s3.scope.prefix");let G=["GetObject","HeadObject","PutObject","DeleteObject","ListObjectsV2","CreateMultipartUpload","UploadPart","ListParts","CompleteMultipartUpload","AbortMultipartUpload","ListMultipartUploads"];if(!Array.isArray(J)||J.length===0||J.length>G.length||J.some((W)=>!G.includes(W))||new Set(J).size!==J.length)h1(`${Z}.scope.operations`,"s3.scope.operations must be a nonempty list of distinct supported operations")}function aR6($,Z){if(!VX($))h1(Z,`${Z} must be an object: \`{ headers: { \u2026 } }\`, \`{ postgres: { \u2026 } }\`, \`{ smtp: { \u2026 } }\` or \`{ socks5: { \u2026 } }\``);let Q=Object.keys($);if(Q.length!==1||!["headers","jsonPatch","postgres","smtp","socks5","s3"].includes(Q[0]??""))h1(Z,`${Z} must have exactly one of \`headers\`, \`jsonPatch\`, \`postgres\`, \`smtp\`, \`socks5\` or \`s3\` (got: ${Q.length===0?"nothing":Q.join(", ")})`);if(Q[0]==="s3"){rR6($.s3,`${Z}.s3`);return}if(Q[0]==="jsonPatch"){let Y=$.jsonPatch;if(!Array.isArray(Y)||Y.length>128)h1(Z,`${Z}.jsonPatch must be an array of at most 128 operations`);let X=(W)=>typeof W==="string"&&(W===""||W.startsWith("/"))&&!/~(?:[^01]|$)/u.test(W),J=(W,K=new Set,H=0)=>{if(H>64)return!1;if(W===null||typeof W==="string"||typeof W==="boolean")return!0;if(typeof W==="number")return Number.isFinite(W);if(typeof W!=="object"||K.has(W))return!1;K.add(W);let F=(Array.isArray(W)?Array.from(W):VX(W)?Object.values(W):[void 0]).every((U)=>J(U,K,H+1));return K.delete(W),F};for(let[W,K]of Y.entries()){if(!VX(K)||!["add","remove","replace","move","copy","test"].includes(String(K.op))||!X(K.path))h1(Z,`${Z}.jsonPatch[${W}] requires a standard op and valid JSON Pointer path`);if(["move","copy"].includes(K.op)&&!X(K.from))h1(Z,`${Z}.jsonPatch[${W}].from must be a JSON Pointer`);if(["add","replace","test"].includes(K.op)&&(!Object.hasOwn(K,"value")||!J(K.value)))h1(Z,`${Z}.jsonPatch[${W}].value must be a JSON value (null is allowed)`)}let G;try{G=JSON.stringify(Y)}catch{h1(Z,"jsonPatch must be JSON serializable")}if(Buffer.byteLength(G,"utf8")>65536)h1(Z,"jsonPatch exceeds 64 KiB");return}if(Q[0]==="socks5"){let Y=$.socks5;if(!VX(Y))h1(`${Z}.socks5`,`${Z}.socks5 must be an object with \`username\` and \`password\``);for(let X of Object.keys(Y))if(!["username","password"].includes(X))h1(`${Z}.socks5.${X}`,`${Z}.socks5 has unknown field \`${X}\`. Expected: username, password`);for(let X of["username","password"])if(typeof Y[X]!=="string"||Y[X].length===0)h1(`${Z}.socks5.${X}`,`${Z}.socks5.${X} is required and must be a non-empty string`);return}if(Q[0]==="smtp"){let Y=$.smtp;if(!VX(Y))h1(`${Z}.smtp`,`${Z}.smtp must be an object with \`username\` and \`password\``);for(let X of Object.keys(Y))if(!["username","password"].includes(X))h1(`${Z}.smtp.${X}`,`${Z}.smtp has unknown field \`${X}\`. Expected: username, password`);for(let X of["username","password"])if(typeof Y[X]!=="string"||Y[X].length===0)h1(`${Z}.smtp.${X}`,`${Z}.smtp.${X} is required and must be a non-empty string`);return}if(Q[0]==="headers"){let Y=$.headers;if(!VX(Y))h1(`${Z}.headers`,`${Z}.headers must be an object of header name to value`);for(let[X,J]of Object.entries(Y))if(typeof J!=="string")h1(`${Z}.headers.${X}`,`${Z}.headers.${X} must be a string`)}else{let Y=$.postgres;if(!VX(Y))h1(`${Z}.postgres`,`${Z}.postgres must be an object with \`username\` and \`password\``);for(let J of Object.keys(Y))if(!["username","password","database"].includes(J))h1(`${Z}.postgres.${J}`,`${Z}.postgres has unknown field \`${J}\`. Expected: username, password, database`);let X=Y;for(let J of["username","password"])if(typeof X[J]!=="string"||X[J].length===0)h1(`${Z}.postgres.${J}`,`${Z}.postgres.${J} is required and must be a non-empty string`);if(X.database!==void 0&&typeof X.database!=="string")h1(`${Z}.postgres.database`,`${Z}.postgres.database must be a string`)}}function eR6($,Z){let Q=$;return Z.forEach((Y,X)=>{let J=sR6(Y);if(Q===void 0)Q=J;else if(Q!==J)h1(`transform[${X}]`,`transform requires protocol \`${J}\` but the rule is \`${Q}\`; a rule terminates one protocol`)}),Q??"http"}function $M6($,Z){if(!VX($)||Object.keys($).some((Q)=>Q!=="method"&&Q!=="path"))h1(Z,`${Z} must be an object containing only method and path`);if($.method!==void 0&&(!Array.isArray($.method)||$.method.some((Q)=>typeof Q!=="string"||Q.length===0||/[^!#$%&'*+.^_`|~0-9A-Za-z-]/.test(Q))))h1(`${Z}.method`,`${Z}.method must be an array of HTTP method tokens`);if($.path!==void 0){let Q=$.path;if(!VX(Q)||Object.keys(Q).length!==1||typeof Q.exact!=="string"||!Q.exact.startsWith("/")||/[\s?#]/.test(Q.exact))h1(`${Z}.path`,`${Z}.path must contain exact: an absolute path without a query or fragment`)}}function Cp$($,Z){if(!VX($))h1(Z||"rule",`${Z||"rule"} must be an object`);for(let H of Object.keys($))if(!Vp$.includes(H))h1(`${Z}${H}`,`Unknown field \`${H}\`. Expected one of: ${Vp$.join(", ")}`);let Q=$;if(Q.action===void 0)h1(`${Z}action`,`${Z}action is required. Write \`action: "allow"\` \u2014 every rule states what it does rather than defaulting to it`);if(Q.action!=="allow")h1(`${Z}action`,`${Z}action must be "allow" (got \`${String(Q.action)}\`). Only allow rules exist today`);if(Q.protocol!==void 0&&!jp$.includes(Q.protocol))h1(`${Z}protocol`,`${Z}protocol must be one of: ${jp$.join(", ")} (got \`${String(Q.protocol)}\`)`);let Y=Q.source??{},X=Q.destination??{};Mp$(Y,"source"),Mp$(X,"destination");let J=Q.transform??[];if(!Array.isArray(J))h1(`${Z}transform`,`${Z}transform must be an array`);J.forEach((H,F)=>aR6(H,`${Z}transform[${F}]`));let G=eR6(Q.protocol,J);if(Q.match!==void 0){if($M6(Q.match,`${Z}match`),G!=="http"||Y.public===!0||!(X.public===!0||X.host!==void 0))h1(`${Z}match`,"match requires HTTP egress from a VM or VPC to a public origin or host")}if(J.some((H)=>("s3"in H))){if(J.length!==1||Q.match!==void 0||Y.public===!0||!(X.public===!0||X.host!==void 0)||Q.domain.includes("*"))h1(`${Z}transform`,"s3 requires a sole transform on HTTP egress to a concrete origin, without match")}let W=J.filter((H)=>("jsonPatch"in H));if(W.length>1)h1(`${Z}transform`,"a rule may carry only one jsonPatch transform");if(W.length&&(Y.public===!0||!(X.public===!0||X.host!==void 0)))h1(`${Z}transform`,"jsonPatch requires HTTP egress from a VM or VPC to a public origin or host");if(Q.forwardAuth!==void 0){tR6(Q.forwardAuth,`${Z}forwardAuth`);let H=X.vmId!==void 0||!S50(X)&&X.port!==void 0;if(G!=="http"||Y.public!==!0||!H||Q.domain==="*")h1(`${Z}forwardAuth`,`${Z}forwardAuth is only supported on HTTP public ingress: \`{ public: true } -> { vmId, port }\``)}if(G==="smtp")oR6(Q.domain);else BH1(Q.domain);if((Y.vmId!==void 0||Y.vpcId!==void 0)&&X.vmId!==void 0&&J.length>0)h1(`${Z}transform`,"a VM-to-VM rule cannot carry a transform yet \u2014 remove it (only public ingress/egress rules run transforms)");if(G==="tcp"){let H=X.public===!0||X.host!==void 0,F=Y.vmId!==void 0||Y.vpcId!==void 0;if(H||F)h1(`${Z}protocol`,"a `tcp` rule is public ingress only \u2014 `{ public: true } -> { vmId, port }`. The edge splices the session without terminating it, so outbound there is nothing to broker (an outbound allow is a firewall rule, and injecting into one needs `http` or `postgres`) and inward there is no certificate to answer the source with. Give the source `public: true`, or drop `protocol` to be served as HTTPS")}else if(G==="imap"||G==="imaps"){let H=X.public===!0||X.host!==void 0,F=Y.vmId!==void 0||Y.vpcId!==void 0;if(H||F)h1(`${Z}protocol`,`an \`${G}\` rule is public ingress only \u2014 \`{ public: true } -> { vmId, port }\`. The 993 front serves mail clients reaching a VM's IMAP server; outbound there is nothing to broker (an outbound allow is a firewall rule) and inward there is no certificate to answer the source with`)}else if(G==="socks5"){let H=X.public===!0||X.host!==void 0;if(Y.public===!0||!H)h1(`${Z}protocol`,'a `socks5` rule is egress only \u2014 `{ vmId } -> { host: "gate.provider.com", port: 1080 }`. The front exists so a guest can open sessions through a proxy whose credentials it never holds; inbound there is nothing to serve, and publishing one would be an open proxy on a platform address');if(X.host===void 0)h1(`${Z}destination`,"a `socks5` rule has to name the proxy it goes through: give the destination a `host` and the `port` the provider listens on. `{ public: true }` on its own asks the edge to be the proxy, which would let the guest out on our address rather than through yours")}else if(G==="postgres"){let H=J.some((U)=>U!==null&&typeof U==="object"&&("postgres"in U)),F=X.public===!0||X.host!==void 0;if(H&&!F)h1(`${Z}transform`,"a `postgres` transform belongs on an egress rule: the edge spends a credential the guest never holds, so pointing it at your own VM would hand every client a logged-in session. Give the destination `public: true` or a `host`, or drop the transform")}else if(G==="smtp"){let H=J.some((U)=>U!==null&&typeof U==="object"&&("smtp"in U)),F=X.public===!0||X.host!==void 0;if(H&&!F)h1(`${Z}transform`,"an `smtp` transform belongs on an egress rule: the edge spends a credential the guest never holds, so pointing it at your own VM would turn it into an open relay. Give the destination `public: true` or a `host`, or drop the transform");if(typeof Q.domain==="string"&&Q.domain.includes("@")&&Y.public!==!0)h1(`${Z}domain`,`\`${Q.domain}\` names a mailbox, which only makes sense on a rule that receives mail. An egress or VM-to-VM rule names the host the guest submits through \u2014 drop the part before \`@\``)}return{...Q,source:Y,destination:X}}function ZM6($,Z){if($==="source")return pR6(Z)?"source is empty. Say who opens the session: `vmId`, `vpcId`, or `public: true`":"source only narrows the session without saying who opens it. Add `vmId`, `vpcId`, or `public: true`";return"destination is empty. Say where the session lands: `vmId` + `port`, `host` + `port`, or `public: true` for the domain's own origin"}function Ip$($){let Z=Cp$($,"");for(let Q of["source","destination"]){let Y=Z[Q];if(!S50(Y))h1(Q,ZM6(Q,Y))}if(Z.source.public===!0&&Z.destination.public===!0)h1("destination","a rule from the public Internet to the domain's own origin allows nothing the world cannot already do. Did you mean a `vmId` destination (ingress) or a `vmId` source (egress)?");return Z}function Sp$($){if(!VX($))h1("tls","tls must be an object with a `rules` array");for(let Q of Object.keys($))if(Q!=="rules")h1(`tls.${Q}`,`tls has unknown field \`${Q}\`. Expected: rules`);let Z=$.rules;if(!Array.isArray(Z))h1("tls.rules","tls.rules must be an array");return Z.forEach((Q,Y)=>{let X=`tls.rules[${Y}].`,J=Cp$(Q,X),G=S50(J.source),W=S50(J.destination);if(!G&&!W)h1(`tls.rules[${Y}]`,`tls.rules[${Y}]: both source and destination refer to the VM being created, which allows nothing. Give one of them a \`vmId\`, \`vpcId\`, or \`public: true\``);if(G&&W)h1(`tls.rules[${Y}]`,`tls.rules[${Y}]: neither end refers to the VM being created. Leave one endpoint's identity unset so it means this VM, or create the rule with tls.rules.create instead`);if(!W&&J.destination.port===void 0)h1(`tls.rules[${Y}].destination.port`,`tls.rules[${Y}]: destination.port is required: say which port on this VM the session lands on`)}),$}function UH1($){return`/v5/tls/${t6($)}`}function NH1($){return`/v5/tls/forward-auth/${t6($)}`}class _p${client;constructor($){this.client=$}list(){return this.client.get("/v5/tls/forward-auth")}async create($){let Z=qp$($);return this.client.post("/v5/tls/forward-auth",Z)}get($){return this.client.get(NH1($))}async update($,Z){let Q=qp$(Z);return this.client.put(NH1($),Q)}delete($){return this.client.delete(NH1($))}}class vp${client;constructor($){this.client=$}async create($){let Z=Ip$($);return this.client.post("/v5/tls",Z)}list($={}){return this.client.get("/v5/tls",$)}get($){return this.client.get(UH1($))}async update($,Z){let Q=Ip$(Z);return this.client.put(UH1($),Q)}delete($){return this.client.delete(UH1($))}}class OH1{client;rules;forwardAuth;constructor($){this.client=$,this.rules=new vp$($),this.forwardAuth=new _p$($)}}var DH1,LH1,Op$,gR6,jp$,hR6=253,uR6=63,wp$,Ep$,lR6,cR6,mR6=2048,Pp$=32,zp$=16384,Ap$=32,Tp$=32,dR6=128,iR6,Rp$="!#$%&'*+-/=?^_`{|}~.",Vp$;var pC0=L(()=>{oK();DH1=class DH1 extends Error{path;constructor($,Z){super(Z);this.name="TlsRuleValidationError",this.path=$,Object.setPrototypeOf(this,DH1.prototype)}};LH1=class LH1 extends Error{path;constructor($,Z){super(Z);this.name="TlsForwardAuthValidationError",this.path=$,Object.setPrototypeOf(this,LH1.prototype)}};Op$=["vmId","vpcId","public","host","port"],gR6=["vmId","vpcId","public","host"],jp$=["tcp","http","postgres","minecraft","smtp","imap","imaps","socks5"],wp$=["url","headers","timeoutMs","protectedCookies","authResponseHeaders"],Ep$=["id"],lR6=/^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/,cR6=/^[0-9A-Za-z-]+$/,iR6=new Set(["host","content-length","connection","keep-alive","proxy-authenticate","proxy-authorization","proxy-connection","te","trailer","transfer-encoding","upgrade"]);Vp$=["action","domain","protocol","source","destination","transform","match","forwardAuth"]});function In($){return`/v5/tunnels/${t6($)}`}function Dh($){return $.tunnelId??=$.id,$}class jH1{client;constructor($){this.client=$}list(){return this.client.get("/v5/tunnels").then(($)=>{return $.tunnels.forEach(Dh),$})}create($={}){return this.client.post("/v5/tunnels",$).then(Dh)}get($){return this.client.get(In($)).then(Dh)}update($,Z){return this.client.patch(In($),Z).then(Dh)}rotateKey($,Z={}){return this.client.post(`${In($)}/rotate-key`,Z).then(Dh)}delete($){return this.client.delete(In($))}attachVpc($,Z,Q={}){return this.client.post(`${In($)}/vpcs/${t6(Z)}`,Q).then(Dh)}detachVpc($,Z){return this.client.delete(`${In($)}/vpcs/${t6(Z)}`).then(Dh)}}var wH1=L(()=>{oK()});class EH1{client;basePath;constructor($,Z){this.client=$,this.basePath=Z}async readFile($,Z={}){let Q=await this.openRead($,Z);return new Uint8Array(await Q.arrayBuffer())}async readTextFile($,Z={}){return await(await this.openRead($,Z)).text()}async readFileStream($,Z={}){let Q=await this.openRead($,Z);if(!Q.body)throw Error(`no response body reading ${$}`);return Q.body}async writeFile($,Z,Q={}){let Y=typeof Z==="string"?new TextEncoder().encode(Z):Z,X=Y instanceof Uint8Array?Y.byteLength:Y.size;if(X>QM6)return this.uploadInChunks($,Y,X,Q);let J=Y instanceof Uint8Array?Y:new Uint8Array(await Y.arrayBuffer());await this.client.putBytes(`${this.basePath}/fs/write`,J,{path:$,mode:Q.mode,sha256:await bp$(J)},Q.signal),Q.onProgress?.({completedBytes:X,totalBytes:X})}writeTextFile($,Z,Q={}){return this.writeFile($,Z,Q)}async readDir($){let{entries:Z}=await this.client.get(`${this.basePath}/fs/dir`,{path:$});return Z}async mkdir($){await this.client.post(`${this.basePath}/fs/mkdir`,{path:$})}async remove($){await this.client.delete(`${this.basePath}/fs/remove`,{path:$})}async exists($){let{exists:Z}=await this.client.get(`${this.basePath}/fs/exists`,{path:$});return Z}stat($){return this.client.get(`${this.basePath}/fs/stat`,{path:$})}openRead($,Z){let{offset:Q,length:Y}=Z,X;if(Q!==void 0||Y!==void 0){let J=Q??0;X=Y===void 0?`bytes=${J}-`:`bytes=${J}-${J+Y-1}`}return this.client.getBytes(`${this.basePath}/fs/read`,{path:$},{range:X,signal:Z.signal})}async uploadInChunks($,Z,Q,Y){let X=Y.chunkSize??YM6,J=Y.maxAttempts??XM6,G=Z instanceof Uint8Array?await bp$(Z):void 0,W=await this.client.post(`${this.basePath}/fs/uploads`,{path:$,size:Q,sha256:G,mode:Y.mode}),K=`${this.basePath}/fs/uploads/${W.uploadId}`;try{let H=W.receivedBytes;while(H<Q){let F=Math.min(H+X,Q),U=Z instanceof Uint8Array?Z.subarray(H,F):Z.slice(H,F);H=(await this.putChunkWithRetry(K,U,H,J,Y.signal)).receivedBytes,Y.onProgress?.({completedBytes:Math.min(H,Q),totalBytes:Q})}await this.client.post(`${K}/commit`)}catch(H){throw await this.client.delete(K).catch(()=>{}),H}}async putChunkWithRetry($,Z,Q,Y,X){let J;for(let G=1;G<=Y;G++){X?.throwIfAborted?.();try{return await this.client.putBytes($,Z,{offset:Q},X)}catch(W){if(J=W,!(!(W instanceof xJ)||W.status>=500||W.status===408||W.status===409||W.status===429)||X?.aborted||G===Y)throw W;await JM6(Math.min(500*2**(G-1),8000));let H=await this.client.get($).catch(()=>{return});if(H&&H.receivedBytes>Q)return H}}throw J}}async function bp$($){let Z=globalThis.crypto?.subtle;if(!Z)return;let Q=await Z.digest("SHA-256",$);return Array.from(new Uint8Array(Q),(Y)=>Y.toString(16).padStart(2,"0")).join("")}function JM6($){return new Promise((Z)=>setTimeout(Z,$))}var QM6=8388608,YM6=16777216,XM6=5;var PH1=L(()=>{k50()});function GM6(){return typeof process<"u"&&Boolean(process.versions?.node)}async function xp$($,Z){if(GM6()){let Y;try{Y=await import("ws")}catch{throw Error("PTY sessions need the `ws` package in Node. Install it with `npm install ws`.")}return new Y.default($,{headers:Z})}let Q=globalThis.WebSocket;if(!Q)throw Error("PTY sessions need a WebSocket client; no global WebSocket is available in this environment.");return new Q($)}function _50($,Z,Q){if($.on){$.on(Z,Q);return}$.addEventListener?.(Z,Q)}function KM6($,Z){if($&&typeof $==="object"&&"data"in $){let Q=$.data;if(typeof Q==="string")return{text:Q};if(Q instanceof ArrayBuffer)return{binary:new Uint8Array(Q)};return{}}if($ instanceof Uint8Array)return Z?{binary:$}:{text:WM6.decode($)};if(typeof $==="string")return{text:$};return{}}class zH1{_sessionId;_slug;_created=!1;socket;constructor($,Z,Q={}){this.socket=$,this._sessionId=Z,_50($,"message",(Y,X)=>{let{text:J,binary:G}=KM6(Y,X);if(G){Q.onData?.(G);return}if(!J)return;let W;try{W=JSON.parse(J)}catch{return}if(W.type==="exited")Q.onExit?.(W.exitCode);else if(W.type==="error")Q.onError?.(Error(W.message));else if(W.type==="sessionInfo")this._sessionId=W.sessionId,this._slug=W.slug,this._created=W.created??!0,Q.onSessionInfo?.(W.sessionId)}),_50($,"close",(Y)=>{let X=Y;Q.onClose?.({wasClean:X?.wasClean??!0,code:X?.code??1000,reason:X?.reason??""})}),_50($,"error",(Y)=>Q.onError?.(Y))}write($){this.socket.send(typeof $==="string"?new TextEncoder().encode($):$)}resize($){this.sendControl({type:"resize",cols:$.cols,rows:$.rows})}signal($){this.sendControl({type:"signal",signal:$})}sendControl($){this.socket.send(JSON.stringify($))}detach(){this.socket.close()}get sessionId(){return this._sessionId}get slug(){return this._slug}get created(){return this._created}get readyState(){return this.socket.readyState}}function HM6($){return new Promise((Z,Q)=>{if($.readyState===1){Z();return}_50($,"open",()=>Z()),_50($,"error",(Y)=>Q(Y))})}class AH1{client;basePath;constructor($,Z){this.client=$,this.basePath=Z}async open($={}){let{exec:Z,cols:Q,rows:Y,linuxUser:X,slug:J,replaceOnExit:G,onData:W,onExit:K,onClose:H,onError:F}=$,U={};if(Z!==void 0)U.exec=Z;if(Q!==void 0)U.cols=Q;if(Y!==void 0)U.rows=Y;if(X!==void 0)U.linuxUser=X;if(J!==void 0)U.slug=J;if(G!==void 0)U.replaceOnExit=String(G);let N=fp$(this.client,`${this.basePath}/pty`,U),B=this.client.authHeaders(),D=await xp$(N,B);return new Promise((O,j)=>{let w=!1,E=new zH1(D,-1,{onData:W,onExit:K,onClose:(P)=>{if(!w)w=!0,j(Error("connection closed before sessionInfo"));H?.(P)},onError:(P)=>{if(!w)w=!0,j(P);F?.(P)},onSessionInfo:()=>{w=!0,O(E)}})})}async attach($){let{session:Z,linuxUser:Q,onData:Y,onExit:X,onClose:J,onError:G}=$,W=fp$(this.client,`${this.basePath}/pty/sessions/${t6(String(Z))}`,{...Q!==void 0?{linuxUser:Q}:{}}),K=this.client.authHeaders(),H=await xp$(W,K),F=new zH1(H,typeof Z==="number"?Z:-1,{onData:Y,onExit:X,onClose:J,onError:G});return await HM6(H),F}list($={}){return this.client.get(`${this.basePath}/pty/sessions`,$)}close($,Z={}){return this.client.delete(`${this.basePath}/pty/sessions/${t6(String($))}`,Z)}}class TH1{pty;linuxUser;constructor($,Z){this.pty=$,this.linuxUser=Z}open($={}){return this.pty.open({...$,linuxUser:this.linuxUser})}attach($){return this.pty.attach({...$,linuxUser:this.linuxUser})}list(){return this.pty.list({linuxUser:this.linuxUser})}close($){return this.pty.close($,{linuxUser:this.linuxUser})}}function fp$($,Z,Q){return $.url(Z,Q).replace(/^http/,"ws")}var WM6;var qH1=L(()=>{oK();WM6=new TextDecoder});class RH1{client;constructor($){this.client=$}list($={}){return this.client.get("/v5/snapshots",$)}get($){return this.client.get(`/v5/snapshots/${t6($)}`)}update($,Z){return this.client.patch(`/v5/snapshots/${t6($)}`,Z)}delete($){return this.client.delete(`/v5/snapshots/${t6($)}`)}}var MH1=L(()=>{oK()});var yp$=()=>{};function VH1($){return`/v5/vms/${t6($)}`}class IH1{id;fs;pty;client;basePath;constructor($,Z){this.client=$,this.id=Z,this.basePath=VH1(Z),this.fs=new EH1($,this.basePath),this.pty=new AH1($,this.basePath)}data(){return this.client.get(this.basePath)}firewallRules(){return this.client.get("/v5/firewall/rules",{vmId:this.id})}update($){return this.client.patch(this.basePath,$)}start(){return this.client.post(`${this.basePath}/start`)}pause(){return this.client.post(`${this.basePath}/pause`)}resize($){return this.client.post(`${this.basePath}/resize`,$)}delete(){return this.client.delete(this.basePath)}exec($){let Z=typeof $==="string"?{command:$}:$;return this.client.post(`${this.basePath}/exec-await`,Z)}linuxUser($){return new gp$(this,$)}snapshot($={}){return this.client.post(`${this.basePath}/snapshot`,$)}}class gp${vm;linuxUser;pty;constructor($,Z){this.vm=$,this.linuxUser=Z,this.pty=new TH1($.pty,Z)}exec($){let Z=typeof $==="string"?{command:$}:$;return this.vm.exec({...Z,linuxUser:this.linuxUser})}}class kH1{client;snapshots;constructor($){this.client=$,this.snapshots=new RH1($)}async create($){if(iC0($.firewall,"VM"),$.tls!==void 0)Sp$($.tls);let Z=await this.client.post("/v5/vms",$);return{vm:new IH1(this.client,Z.id),vmId:Z.id,data:Z,firewallRules:Z.firewallRules??[],tlsRules:Z.tlsRules??[]}}list($={}){return this.client.get("/v5/vms",$)}get($){return this.client.get(VH1($))}ref($){return new IH1(this.client,$)}delete($){return this.client.delete(VH1($))}}var CH1=L(()=>{C50();pC0();oK();PH1();qH1();MH1();yp$();PH1();qH1();MH1()});function SH1($){return`/v5/vpcs/${t6($)}`}class hp${client;basePath;constructor($,Z){this.client=$,this.basePath=Z}list(){return this.client.get(`${this.basePath}/tunnels`)}}class _H1{id;tunnels;client;basePath;constructor($,Z){this.client=$,this.id=Z,this.basePath=SH1(Z),this.tunnels=new hp$($,this.basePath)}data(){return this.client.get(this.basePath)}update($){return this.client.patch(this.basePath,$)}delete(){return this.client.delete(this.basePath)}}class vH1{client;constructor($){this.client=$}list(){return this.client.get("/v5/vpcs")}async create($={}){if($.firewall!==void 0)iC0($.firewall,"network");let Z=await this.client.post("/v5/vpcs",$);return{vpc:new _H1(this.client,Z.id),vpcId:Z.id,data:Z,firewallRules:Z.firewallRules??[]}}get($){return this.client.get(SH1($))}ref($){return new _H1(this.client,$)}delete($){return this.client.delete(SH1($))}}var bH1=L(()=>{C50();oK()});class nC0{client;vms;vpc;tunnels;firewall;tls;domains;identities;constructor($={}){this.client=new $H1($),this.vms=new kH1(this.client),this.vpc=new vH1(this.client),this.tunnels=new jH1(this.client),this.firewall=new GH1(this.client),this.tls=new OH1(this.client),this.domains=new ZH1(this.client),this.identities=new HH1(this.client)}fetch($,Z){return this.client.fetch($,Z)}}var up$=L(()=>{oK();QH1();C50();FH1();pC0();wH1();CH1();bH1();oK();k50();CH1();bH1();wH1();QH1();C50();pC0();FH1()});var cp$;var lp$=L(()=>{cp$={name:"@decocms/sandbox",version:"1.93.4",private:!0,type:"module",description:"Sandbox runtime for isolated Studio tool execution",scripts:{check:"tsc --noEmit",test:"bun test",build:"bun run build:typegen && bun run build:harness-runner","build:typegen":"mkdir -p dist && bun run --cwd=../typegen build && bun --cwd=../typegen pm pack --filename $PWD/dist/typegen.tgz --quiet","build:harness-runner":"mkdir -p dist && bun --cwd=../harness-runner pm pack --filename $PWD/dist/harness-runner.tgz --quiet"},exports:{"./shared":"./shared.ts","./provider":"./server/provider/index.ts","./provider/agent-sandbox":"./server/provider/agent-sandbox/index.ts","./provider/postgres-state-store":"./server/provider/postgres-state-store.ts","./provider/freestyle":"./server/provider/freestyle.ts","./provider/remote":"./server/provider/remote.ts","./provider/router":"./server/provider/router.ts","./provider/sandbox-api":"./server/provider/sandbox-api.ts","./provider/sandbox-server":"./server/provider/sandbox-server.ts","./daemon-client":"./server/daemon-client.ts","./org-fs":"./org-fs.ts","./dispatch":"./dispatch/index.ts","./dispatch/*":"./dispatch/*.ts","./proxy/http":"./proxy/http.ts","./proxy/websocket":"./proxy/websocket.ts"},dependencies:{"@decocms/shared":"workspace:*","@kubernetes/client-node":"^1.4.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0",freestyle:"0.2.16",zod:"4.3.6"},devDependencies:{"@types/bun":"latest",postgres:"^3.4.5",typescript:"^7.0.2"}}});function tC0($){let Z=$?.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of studio-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"});return async(Q,Y)=>{if(!Z)return Y();let X=performance.now(),J=(G)=>Z.record(performance.now()-X,{runner_kind:Q,source:"daemon",status_code:G});try{let G=await Y();return J(G.status),G}catch(G){throw J(0),G}}}var HO;var oC0=L(()=>{HO={kubernetes:"agent-sandbox",freestyle:"freestyle"}});var ap$={};O6(ap$,{FreestyleSandboxProvider:()=>sp$});import{createHash as mp$,createHmac as UM6,randomBytes as NM6}from"crypto";class sp${apiKey;freestyle;lookupClient;image;sidecarImage;allowUserNamespaces;idleTimeoutSeconds;idlePauseMs;autoDeleteSeconds;domainSuffix;timeDaemonRequest;inflight=new Uh;snapshotInflight=new Uh;knownSnapshots=new Set;lookups=new Map;releaseTimers=new Map;idleSweep=null;sweeping=!1;repoSnapshots=new Map;repoSnapshotBuilds=new Set;repoSnapshotFailures=new Map;constructor($){if(this.apiKey=$.apiKey,this.freestyle=$.client??new nC0({apiKey:$.apiKey}),this.lookupClient=$.client??new nC0({apiKey:$.apiKey,fetch:Object.assign((Z,Q)=>fetch(Z,{...Q,signal:Q?.signal?AbortSignal.any([Q.signal,AbortSignal.timeout(hH1)]):AbortSignal.timeout(hH1)}),{preconnect:fetch.preconnect})}),this.image=$.image??`ghcr.io/decocms/studio/studio-sandbox-go:${cp$.version}`,this.sidecarImage=$.orgFsSidecarImage??DM6,this.allowUserNamespaces=$.allowUserNamespaces??!1,this.idleTimeoutSeconds=$.idleTimeoutSeconds??300,this.idlePauseMs=$.idlePauseMs??600000,this.autoDeleteSeconds=$.autoDeleteSeconds??86400,this.domainSuffix=$.domainSuffix??"style.dev",this.timeDaemonRequest=tC0($.meter),this.idlePauseMs>0)this.idleSweep=setInterval(()=>void this.pauseIdle(),qM6),this.idleSweep.unref?.()}async owns($){return await this.find($)!==null}daemonUrl($){return`https://${$}.${this.domainSuffix}`}async find($,Z={}){let Q=this.lookups.get($);if(!Z.refresh&&Q&&Date.now()-Q.at<(Q.found?PM6:zM6))return Q.found;let Y=null;try{let X=await this.lookupClient.vms.get($),J=X.metadata[xH1];if(J)Y={vm:this.freestyle.vms.ref(X.id),daemon:{url:this.daemonUrl($),token:J}}}catch(X){if(!(X instanceof xJ&&X.status===404))throw X}return this.remember($,Y),Y}remember($,Z){if(this.lookups.delete($),this.lookups.size>=AM6){let Q=this.lookups.keys().next();if(!Q.done)this.lookups.delete(Q.value)}this.lookups.set($,{found:Z,at:Date.now()})}async warm(){await this.baseSnapshot().catch(($)=>console.warn(`[${vQ}] base snapshot warm failed: ${Oh($)}`))}baseSnapshot(){let{image:$,sidecarImage:Z}=this,Q=this.allowUserNamespaces?`
 user-namespaces`:"",Y=`studio-sandbox-${mp$("sha256").update(`${$}
 ${Z}
 running${Q}`).digest("hex").slice(0,16)}`;if(this.knownSnapshots.has(Y))return Promise.resolve(Y);return this.snapshotInflight.run(Y,async()=>{if(await this.snapshotExists(Y))return this.knownSnapshots.add(Y),Y;console.log(`[${vQ}] building base snapshot ${Y} for ${$}`);let{vm:X}=await this.freestyle.vms.create({ttlSeconds:1800,firewall:{rules:[{action:"allow",source:{},destination:{public:!0}}]}});try{await this.run(X,`docker pull -q ${Cn($)} && docker pull -q ${Cn(Z)}`,{timeoutMs:fH1}),await this.startContainers(X,this.sentinelToken(Y)),await this.run(X,`for i in $(seq 1 240); do curl -sf -o /dev/null http://127.0.0.1:${Lh}/health && exit 0; sleep 0.5; done; exit 1`,{timeoutMs:rC0+1e4}),await X.snapshot({slug:Y}),this.knownSnapshots.add(Y)}catch(J){if(!await this.snapshotExists(Y))throw J}finally{await X.delete().catch(()=>{})}return Y})}sentinelToken($){return UM6("sha256",this.apiKey).update(`daemon-sentinel:${$}`).digest("hex").slice(0,48)}async startContainers($,Z){let Q={DAEMON_TOKEN:Z,APP_ROOT:wz,PROXY_PORT:String(Lh),ORGFS_SIDECAR_CONFIG_PATH:`${sC0}/config.json`,ORGFS_SIDECAR_STATUS_PATH:`${sC0}/status.json`},Y=Object.keys(Q).map((X)=>`-e ${Cn(X)}`).join(" ");await this.run($,`sudo sh -c ${Cn(LM6)} && docker run -d --name ${dp$} --restart=always --privileged --device /dev/fuse -e APP_ROOT=${wz} -e ORGFS_FEED_IDLE_MS=60000 -v ${Ez}:${wz}/org:rshared -v ${Sn}:${sC0} ${Cn(this.sidecarImage)}`,{timeoutMs:fH1}),await this.run($,`docker run -d --name ${kn} --restart=always${this.allowUserNamespaces?" --security-opt seccomp=unconfined --security-opt apparmor=unconfined":""} -p ${Lh}:${Lh} -v ${Ez}:${wz}/org:rslave -v ${Sn}:${sC0} ${Y} ${Cn(this.image)}`,{env:Q,timeoutMs:fH1})}async repoSnapshotFor($,Z){let Q=$.repo;if(!$.repoSnapshot||!Q||!$.tenant)return null;if(($.sandboxImage??"default")!=="default")return null;let Y=tK(Q.cloneUrl)?.toLowerCase();if(!Y)return null;let X=`${Z}
@@ -1228,7 +1228,7 @@ ${G}`).digest("hex").slice(0,16)}`;if(await this.snapshotExists(W).catch(()=>!1)
 
 `);let B=N.split(`
 `).filter((D)=>D.startsWith("data:")).map((D)=>D.slice(5).trimStart()).join(`
-`);yield B?Kn$(B):"alive"}}}catch(W){if(Y.signal.aborted&&!Z?.aborted)throw Y.signal.reason;throw W}finally{clearTimeout(X)}}async hostStall($,Z){let Q=Date.now(),Y=0;while(!Z.aborted){let X=!1,J="";try{for await(let G of this.watchOnce($,Z))if(Q=Date.now(),Y=0,G!=="alive"&&Yn$(G))break;X=!0}catch(G){if(Z.aborted)return null;if(G instanceof eC0)return console.warn(`[${_n}] ${G.message} for ${$}: its progress is unbounded`),null;J=vn(G)}if(Date.now()-Q>=this.stallMs)return new jh(`the host showed no progress for ${$} in ${this.stallMs/1000}s${J?`: ${J}`:""}`);await J$(X?this.stallMs/4:Xn$(Y++),{signal:Z}).catch(()=>{})}return null}async*watchClaimLifecycle($,Z){let Q=aC0(Z,this.closed.signal),Y=Date.now(),X=0,J="";while(!Q?.aborted){let G="watch ended before ready";try{for await(let W of this.watchOnce($,Q)){if(Y=Date.now(),X=0,W==="alive")continue;let K=JSON.stringify(W);if(K!==J)J=K,yield W;if(Yn$(W))return}}catch(W){if(Q?.aborted)return;if(W instanceof eC0){yield $S0(W.message);return}G=`watch failed: ${vn(W)}`}if(Date.now()-Y>=this.stallMs){yield $S0(G);return}await J$(Xn$(X++),{signal:Q}).catch(()=>{})}}}function Kn$($){let Z;try{Z=JSON.parse($)}catch{return $S0("host sent a non-JSON phase")}let Q=Ng$.safeParse(Z);return Q.success?Q.data:$S0(`host sent a malformed phase: ${Q.error.message}`)}var _n="RemoteSandboxProvider",Qn$=30000,fM6=2147483647,Jn$=500,yM6=10,gM6=0.5,Gn$=5000,hM6=3000,uM6=300000,lM6=5000,jh,eC0;var dH1=L(()=>{QN();zd();n$();Fh();b31();An();xC0();fC0();oC0();jh=class jh extends Error{constructor($){super($);this.name="SandboxHostError"}};eC0=class eC0 extends Error{}});var Nn$={};O6(Nn$,{subscribeLifecycle:()=>tH1,readControlPlaneSandboxConfig:()=>x50,getOrInitSharedRunner:()=>f50,getAgentSandboxProviderForTeardown:()=>ZS0,getAgentSandboxProvider:()=>LZ,__resetSharedLifecyclesForTesting:()=>ZV6});function pH1($){let Z=b50[Hn$];if(Z)return Promise.resolve(Z);let Q=b50[iH1];if(Q)return Q;let Y=$().then((X)=>{return b50[Hn$]=X,X}).finally(()=>{delete b50[iH1]});return b50[iH1]=Y,Y}function iM6(){let $=process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN;return $&&$.trim()!==""?$:void 0}function pM6(){let $=process.env.STUDIO_SANDBOX_TEMPLATE_NAME;return $&&$.trim()!==""?$:void 0}function nM6(){let $=process.env.STUDIO_ENV;return $&&$.trim()!==""?$:void 0}function tM6(){let $=process.env.STUDIO_SANDBOX_SENTINEL_TOKEN;return $&&$.trim()!==""?$:void 0}function oM6(){let $=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME?.trim(),Z=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE?.trim();if(!$&&!Z)return;if(!$||!Z)throw Error("STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME and STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE must both be set, or both unset. Half-configured per-claim HTTPRoute routing would silently fail to attach.");return{name:$,namespace:Z}}function x50(){let $=process.env.STUDIO_SANDBOX_CONTROL_PLANE_URL?.trim(),Z=process.env.STUDIO_SANDBOX_CONTROL_PLANE_TOKEN?.trim();if(!$&&!Z)return;if(!$||!Z)throw Error("STUDIO_SANDBOX_CONTROL_PLANE_URL and STUDIO_SANDBOX_CONTROL_PLANE_TOKEN must both be set, or both unset.");return{url:$,token:Z}}async function nH1($){let Z=process.env.FREESTYLE_API_KEY?.trim();if(!Z)return Fn$($);let Q=await Fn$($).catch((J)=>{console.warn("[lifecycle] kubernetes sandbox provider unavailable, using Freestyle only:",J instanceof Error?J.message:String(J));return}),[{FreestyleSandboxProvider:Y},{SandboxProviderRouter:X}]=await Promise.all([Promise.resolve().then(() => (ep$(),ap$)),Promise.resolve().then(() => (cH1(),lH1))]);return new X({kubernetes:Q,freestyle:new Y({apiKey:Z,image:process.env.STUDIO_SANDBOX_FREESTYLE_IMAGE?.trim()||void 0,allowUserNamespaces:process.env.STUDIO_SANDBOX_FREESTYLE_USER_NAMESPACES==="true",meter:G$})},{freestyleShare:sM6()})}function sM6(){let $=Number(process.env.STUDIO_SANDBOX_FREESTYLE_SHARE??0);if(Number.isFinite($)&&$>=0&&$<=1)return $;return console.warn("[lifecycle] STUDIO_SANDBOX_FREESTYLE_SHARE must be a number from 0 to 1; using 0"),0}async function Fn$($){let Z=x50();if(Z){let{RemoteSandboxProvider:K}=await Promise.resolve().then(() => (dH1(),mH1));return new K({baseUrl:Z.url,token:Z.token,credentialLifetimeMs:{orgFsConfig:cC0},meter:G$})}let Q=new o60($),Y=iM6(),{AgentSandboxProvider:X}=await Promise.resolve().then(() => (I50(),ii$)),J=new XJ(B0().encryptionKey),G=Wj0($,J),W=hC0(process.env.STUDIO_SANDBOX_TENANT_POOLS);return new X({stateStore:Q,previewUrlPattern:Y,sandboxTemplateName:pM6(),envName:nM6(),previewGateway:oM6(),sentinelToken:tM6(),tenantPools:ni$(W),mintPoolCloneUrl:ti$(W,G.mintCloneUrl),meter:G$,...G})}function LZ($){if(!B0().agentSandboxEnabled)throw Error("Agent sandbox is disabled. Set STUDIO_AGENT_SANDBOX_ENABLED=true to enable it.");return pH1(()=>nH1($.db))}function ZS0($){return pH1(()=>nH1($.db))}async function f50(){if(!B0().agentSandboxEnabled)return null;return pH1(()=>nH1(E8().db))}function tH1($,Z,Q){let Y=Pz.get(Z);if(Y){if(Y.terminated){if(Y.lastPhase)try{Q(Y.lastPhase)}catch{}return{unsubscribe:eM6}}if(Y.listeners.add(Q),Y.lastPhase)try{Q(Y.lastPhase)}catch{}return Un$(Z,Y,Q)}let X=new AbortController,J={lastPhase:null,terminated:!1,listeners:new Set([Q]),abort:X};return Pz.set(Z,J),$V6($,Z,J),Un$(Z,J,Q)}function eM6(){}function Un$($,Z,Q){return{unsubscribe(){if(Pz.get($)!==Z)return;if(Z.listeners.delete(Q),Z.listeners.size===0)Pz.delete($),Z.abort.abort()}}}async function $V6($,Z,Q){let Y=null;try{for await(let X of $.watchClaimLifecycle(Z,Q.abort.signal)){if(Q.abort.signal.aborted)break;Q.lastPhase=X;let J=X.kind==="ready"||X.kind==="failed";if(J)Q.terminated=!0;let G=Array.from(Q.listeners);for(let W of G)try{W(X)}catch{}if(J)break}}catch(X){Y=X}finally{if(!Q.terminated&&!Q.abort.signal.aborted&&Q.listeners.size>0){let X={kind:"failed",reason:"unknown",message:Y instanceof Error?Y.message:"Lifecycle watcher ended unexpectedly"};Q.lastPhase=X,Q.terminated=!0;for(let J of Array.from(Q.listeners))try{J(X)}catch{}}if(Pz.get(Z)===Q)Pz.delete(Z)}}function ZV6(){for(let $ of Pz.values())$.abort.abort();Pz.clear()}var Hn$,iH1,b50,rM6,aM6,Pz;var IX=L(()=>{I3();v6();V31();Xw();l1();C31();mC0();uC0();Hn$=Symbol.for("decocms.sandbox.lifecycle.agent-sandbox-runner"),iH1=Symbol.for("decocms.sandbox.lifecycle.agent-sandbox-inflight"),b50=globalThis;rM6=Symbol.for("decocms.sandbox.lifecycle.shared-lifecycles"),aM6=globalThis,Pz=aM6[rM6]??=new Map});import{sql as QV6}from"kysely";function Bn$($){return $ instanceof Date?$.toISOString():String($)}class oH1{db;vault;constructor($,Z){this.db=$;this.vault=Z}rowToInfo($){return{id:$.id,organizationId:$.organization_id,scope:$.scope,userId:$.user_id,name:$.name,description:$.description,createdBy:$.created_by,createdAt:Bn$($.created_at),updatedBy:$.updated_by,updatedAt:Bn$($.updated_at)}}assertVisible($,Z){if($.scope==="user"&&$.user_id!==Z)throw new zz($.id)}async create($){let Z=c8("sec"),Q=await this.vault.encrypt($.value),Y=new Date,X=await this.db.insertInto("secrets").values({id:Z,organization_id:$.organizationId,scope:$.scope.kind,user_id:$.scope.kind==="user"?$.scope.userId:null,name:$.name,encrypted_value:Q,description:$.description??null,created_by:$.createdBy,created_at:Y,updated_by:$.createdBy,updated_at:Y}).returning(QS0).executeTakeFirstOrThrow();return this.rowToInfo(X)}async update($){let Z=await this.db.selectFrom("secrets").where("id","=",$.id).where("organization_id","=",$.organizationId).select(["id","scope","user_id"]).executeTakeFirst();if(!Z)throw new sK($.id);this.assertVisible(Z,$.callerUserId);let Q={updated_by:$.updatedBy,updated_at:new Date};if($.value!==void 0)Q.encrypted_value=await this.vault.encrypt($.value);if($.description!==void 0)Q.description=$.description;let Y=await this.db.updateTable("secrets").set(Q).where("id","=",$.id).where("organization_id","=",$.organizationId).returning(QS0).executeTakeFirstOrThrow();return this.rowToInfo(Y)}async delete($,Z,Q){let Y=await this.db.selectFrom("secrets").where("id","=",$).where("organization_id","=",Z).select(["id","scope","user_id"]).executeTakeFirst();if(!Y)throw new sK($);this.assertVisible(Y,Q),await this.db.deleteFrom("secrets").where("id","=",$).where("organization_id","=",Z).execute()}async list($){let Z=this.db.selectFrom("secrets").where("organization_id","=",$.organizationId).select(QS0);if($.scope?.kind==="user")Z=Z.where("scope","=","user").where("user_id","=",$.scope.userId);else if($.scope?.kind==="organization")Z=Z.where("scope","=","organization");else Z=Z.where((Y)=>Y.or([Y("scope","=","organization"),Y.and([Y("scope","=","user"),Y("user_id","=",$.callerUserId)])]));return(await Z.orderBy("created_at","desc").execute()).map((Y)=>this.rowToInfo(Y))}async findById($,Z,Q){let Y=await this.db.selectFrom("secrets").where("id","=",$).where("organization_id","=",Z).select(QS0).executeTakeFirst();if(!Y)throw new sK($);return this.assertVisible(Y,Q),this.rowToInfo(Y)}async resolveById($,Z,Q){let Y=await this.db.selectFrom("secrets").where("id","=",$).where("organization_id","=",Z).selectAll().executeTakeFirst();if(!Y)throw new sK($);this.assertVisible(Y,Q);let X=await this.vault.decrypt(Y.encrypted_value);return{info:this.rowToInfo(Y),value:X}}async resolveByName($){let Z=this.db.selectFrom("secrets").where("organization_id","=",$.organizationId).where("scope","=",$.scope.kind).where(QV6`lower(name) = lower(${$.name})`).selectAll();if($.scope.kind==="user")Z=Z.where("user_id","=",$.scope.userId);let Q=await Z.executeTakeFirst();if(!Q)throw new sK(`${$.scope.kind}:${$.name}`);let Y=await this.vault.decrypt(Q.encrypted_value);return{info:this.rowToInfo(Q),value:Y}}}var QS0,sK,zz;var y50=L(()=>{XY();QS0=["id","organization_id","scope","user_id","name","description","created_by","created_at","updated_by","updated_at"];sK=class sK extends Error{constructor($){super(`Secret ${$} not found`);this.name="SecretNotFoundError"}};zz=class zz extends Error{constructor($){super(`Access denied for secret ${$}`);this.name="SecretAccessDeniedError"}}});async function YS0({ctx:$,orgId:Z,userId:Q,entries:Y}){if(!Y||Y.length===0)return[];let X=[];for(let J of Y)try{let{value:G}=await $.storage.secrets.resolveById(J.secretId,Z,Q);X.push({host:J.host,token:G})}catch(G){if(G instanceof sK||G instanceof zz){console.warn(`[SANDBOX_START] skipping submodule credential for ${J.host}: ${G.message}. Re-link or recreate the secret to restore.`);continue}throw G}return X}var sH1=L(()=>{y50()});function h5($){if(!$||typeof $!=="object")return{};let Z=$.sandboxMap;if(!Z||typeof Z!=="object")return{};return Z}function CY($,Z,Q){let Y=$[Z]?.[Q];if(!Y)return null;return yD(Y)[kY]??null}function g50($,Z,Q,Y){let J={...yD($[Z]?.[Q]),[kY]:Y};return{...$,[Z]:{...$[Z]??{},[Q]:J}}}async function Dn$($,Z,Q,Y,X,J){let G=await $.findById(Z);if(!G)return;let W=G.metadata??{},K=g50(h5(W),Y,X,J);await $.update(Z,Q,{metadata:{...W,sandboxMap:K}})}function rH1($,Z,Q){let Y=yD($[Z]?.[Q]);if(!Y[kY])return null;let X={...Y};delete X[kY];let J={...$[Z]??{}};if(Object.keys(X).length===0)delete J[Q];else J[Q]=X;let G={...$};if(Object.keys(J).length===0)delete G[Z];else G[Z]=J;return G}async function FO($,Z,Q,Y,X){let J=await $.findById(Z);if(!J)return;let G=J.metadata??{},W=rH1(h5(G),Y,X);if(!W)return;await $.update(Z,Q,{metadata:{...G,sandboxMap:W}})}var kY="agent-sandbox";var kX=L(()=>{q8()});function wh($){return["openai-compatible","openrouter","deco"].includes($)}function Ln$($,Z){return wh($)&&h50(Z)!==null}function h50($){let Z=$.replace(/^openai\//,"");return/^(gpt-\d|o[134](?:-|$))/.test(Z)?Z:null}var UO="codex-subscription",XS0="gpt-6.1-sol";function On$($,Z){return YV6[$]?.test(Z)??!1}var YV6;var jn$=L(()=>{YV6={anthropic:/^claude-/,openrouter:/^anthropic\/claude-/,deco:/^anthropic\/claude-/}});function JS0($){return $===UO||$===bn||$===nF}function wn$($=bn){let Z=aH1.anthropic.chat;return{credentialId:$,thinking:{id:Z,title:Z,provider:"anthropic"}}}function WV6($){let Z=$.replace(/^anthropic\//,"");if(!Z.startsWith("claude-"))return null;return Z.replace(/-(\d+)-(\d+)$/,"-$1.$2")}function En$($){if($==="reviewer")return"reviewer";if($==="conflict")return"conflict";return"default"}function eH1($,Z="default",Q){let{providerId:Y,apiKey:X,baseUrl:J}=$,G=(H)=>Z==="chat"&&Q&&On$(H==="anthropic"?H:Y,Q)?Q:aH1[H][Z],W=HV6[Z],K={CLAUDE_CODE_MAX_OUTPUT_TOKENS:`${KV6}`,CLAUDE_CODE_MAX_TURNS:W===null?null:`${W}`,ENABLE_TOOL_SEARCH:FV6,FORCE_PROMPT_CACHING_5M:UV6,ANTHROPIC_CUSTOM_HEADERS:null};if(Y==="anthropic")return{...K,CLAUDE_CODE_MODEL:G("anthropic"),ANTHROPIC_API_KEY:X,ANTHROPIC_AUTH_TOKEN:null,CLAUDE_CODE_OAUTH_TOKEN:null,ANTHROPIC_BASE_URL:J??null};if(Y===bn)return{...K,CLAUDE_CODE_MODEL:G("anthropic"),CLAUDE_CODE_OAUTH_TOKEN:X,ANTHROPIC_API_KEY:null,ANTHROPIC_AUTH_TOKEN:null,ANTHROPIC_BASE_URL:null};if(Y==="openrouter"||Y==="deco")return{...K,CLAUDE_CODE_MODEL:G("openrouter"),ANTHROPIC_API_KEY:"",ANTHROPIC_AUTH_TOKEN:X,CLAUDE_CODE_OAUTH_TOKEN:null,ANTHROPIC_BASE_URL:J??XV6};if(Y===nF){let H=Z==="chat"&&Q?WV6(Q):null;return{...K,CLAUDE_CODE_MODEL:H??aH1.copilot[Z],ANTHROPIC_API_KEY:"",ANTHROPIC_AUTH_TOKEN:X,CLAUDE_CODE_OAUTH_TOKEN:null,ANTHROPIC_BASE_URL:JV6,ANTHROPIC_CUSTOM_HEADERS:GV6}}throw new Pn$(Y)}var bn="claude-subscription",nF="github-copilot",XV6="https://openrouter.ai/api",JV6="https://api.githubcopilot.com",GV6="Copilot-Integration-Id: copilot-developer-cli",aH1,GS0="claudeCodeModelClass",xn="taskRunInstructions",KV6=32000,HV6,FV6="1",UV6="1",Pn$;var wB=L(()=>{jn$();aH1={anthropic:{default:"claude-opus-5-5",chat:"claude-sonnet-5-5",reviewer:"claude-sonnet-5",conflict:"claude-sonnet-5"},openrouter:{default:"anthropic/claude-opus-5.5",chat:"anthropic/claude-sonnet-5.5",reviewer:"anthropic/claude-sonnet-5",conflict:"anthropic/claude-sonnet-5"},copilot:{default:"claude-sonnet-5.5",chat:"claude-sonnet-5.5",reviewer:"claude-sonnet-5",conflict:"claude-sonnet-5"}};HV6={default:null,chat:null,reviewer:60,conflict:60};Pn$=class Pn$ extends Error{constructor($){super(`the claude-code harness needs an Anthropic, OpenRouter, Deco or GitHub Copilot model credential; this run's model resolves to "${$}". Point the agent's thinking model at one of those, or run it with Decopilot.`);this.name="UnsupportedClaudeCodeProviderError"}}});async function WS0($,Z,Q,Y="claude-code"){if(Y==="codex"){let G=await $.storage.codexSubscriptions.findLiveToken(Q).catch(()=>null);return G?{providerId:UO,apiKey:G}:null}let J=[...(await $.storage.orgSharedPlans.list(Z)).map(({providerId:G,userId:W})=>({providerId:G,userId:W})),...NV6.map((G)=>({providerId:G,userId:Q}))];for(let G of J){let W=await BV6($,G.providerId).findLiveToken(G.userId).catch((K)=>{return console.warn(`[plan] ${G.providerId} lookup failed`,K),null});if(W)return{providerId:G.providerId,apiKey:W}}return null}var NV6,BV6=($,Z)=>Z===bn?$.storage.claudeSubscriptions:$.storage.githubCopilotSubscriptions;var $F1=L(()=>{wB();NV6=[bn,nF]});function An$($){if(NO.size>=500){let Q=NO.keys().next().value;if(Q!==void 0)NO.delete(Q)}let Z=Date.now();NO.delete($),NO.set($,{t0:Z,last:Z,stages:[]}),console.log(`[turn-latency] thread=${$} stage=post-received +0ms`)}function bQ($,Z,Q){let Y=zn$($),X=Date.now(),J=NO.get(Y),G=!J;if(!J)J={t0:X,last:X,stages:[]},NO.set(Y,J);let W=X-J.t0,K=X-J.last;J.last=X,J.stages.push(`${Z}=${K}`),console.log(`[turn-latency] thread=${Y} stage=${Z} +${W}ms (\u0394${K}ms)`+(G?" t0=local":"")+(Q?` ${JSON.stringify(Q)}`:""))}function Tn$($,Z){let Q=zn$($);bQ(Q,"first-token",Z);let Y=NO.get(Q);if(!Y)return;NO.delete(Q),console.log(`[turn-latency] thread=${Q} SUMMARY ttft=${Y.last-Y.t0}ms ${Y.stages.join(" ")}`)}var NO,zn$=($)=>$.split(":")[0]??$;var fn=L(()=>{NO=globalThis.__turnLatency??=new Map});function DV6($){return(typeof $.timeout==="number"&&$.timeout>0?Math.min($.timeout,120000):30000)+15000}function LV6($,Z){if($.aborted)return Z.catch(()=>{}),Promise.reject($.reason??Error("aborted"));return new Promise((Q,Y)=>{let X=()=>{Z.catch(()=>{}),Y($.reason??Error("aborted"))};$.addEventListener("abort",X,{once:!0}),Z.then(Q,Y).finally(()=>{$.removeEventListener("abort",X)})})}async function OV6($,Z,Q,Y,X){let J=X?.timeoutMs??DV6(Y),G=AbortSignal.timeout(J),W=X?.signal?AbortSignal.any([X.signal,G]):G,K,H;try{let U=new Headers({"content-type":"application/json"});if(X?.threadId)U.set("x-thread-id",X.threadId);let N={method:"POST",headers:U,body:JSON.stringify(Y),signal:W};({res:K,rawText:H}=await LV6(W,(async()=>{let B=await $.proxyDaemonRequest(Z,Q,N);return{res:B,rawText:await B.text()}})()))}catch(U){if(X?.signal?.aborted)throw U;if(G.aborted)throw Error(`Sandbox POST ${Q} timed out after ${Math.round(J/1000)}s \u2014 the sandbox may be overloaded or its filesystem stalled. Retry, or use a smaller operation.`);throw new u50(U)}let F;try{F=JSON.parse(H)}catch{console.error("[sandbox-fs-hooks] Failed to parse JSON response provider=agent-sandbox path=%s status=%d rawText=%s",Q,K.status,H.slice(0,2000));let U=K.status>=500?" (server error)":K.status===0?" (no response)":"";throw Error(`Daemon ${Q} returned invalid JSON (HTTP ${K.status}${U}): ${H.slice(0,800)}`)}if(!K.ok){console.error("[sandbox-fs-hooks] Non-OK response provider=agent-sandbox path=%s status=%d body=%s",Q,K.status,H.slice(0,2000));let U=F.error??`Daemon ${Q} failed (${K.status})`;if(K.status===404&&U==="sandbox not found")throw new u50(Error(U),!0);throw Error(U)}return F}function ZF1($,Z){let{ensureHandle:Q,invalidateHandle:Y,canAutoRestart:X}=Z,J=0,G=(H)=>{let F=Date.now();if(F-J<300000)return;J=F,$.renewTtl(H).catch((U)=>{console.warn(`[sandbox-fs-hooks] TTL renew failed for ${H}: ${U instanceof Error?U.message:String(U)}`)})},W=(H)=>{let F=H instanceof Error?H.message:String(H);return X?`Sandbox is unreachable and auto-restart did not recover it: ${F}`:"The sandbox is not running. Ask the user to start it by clicking the server button (left side of the header bar)."},K=async(H,F,U)=>{let N=async(D)=>OV6($,D,H,F,{signal:U,timeoutMs:Z.opTimeoutMs,threadId:Z.threadId}),B=await Q();G(B);try{return await N(B)}catch(D){if(!(D instanceof u50))throw D;if(!X&&!D.gone)throw Error(W(D.cause??D));console.warn(`[sandbox-fs-hooks] daemon ${H} unreachable \u2014 reaping sandbox and retrying once`,D.cause??D);try{await Y({force:D.gone})}catch(j){console.warn("[sandbox-fs-hooks] invalidateHandle failed",j)}let O;try{O=await Q()}catch(j){throw Error(`Failed to restart sandbox: ${j instanceof Error?j.message:String(j)}`)}try{return await N(O)}catch(j){if(j instanceof u50)throw Error(W(j.cause??j));throw j}}};return{onProxy:(H,F,U)=>K(H,F,U),onBash:async(H,F)=>{return await K("/_sandbox/bash",{command:H,...F?.cwd!==void 0?{cwd:F.cwd}:{},...F?.timeoutMs!==void 0?{timeout:F.timeoutMs}:{}})}}}var u50;var qn$=L(()=>{u50=class u50 extends Error{code="DAEMON_UNREACHABLE";gone;constructor($,Z=!1){super($ instanceof Error?$.message:"Daemon proxy failed");if(this.gone=Z,$ instanceof Error)this.cause=$}}});var yn=L(()=>{An();oC0();qn$()});function l50($){let Z=new Set($.map((F)=>F.name.toLowerCase()).filter((F,U,N)=>N.indexOf(F)!==U)),Q=$.map((F)=>Z.has(F.name.toLowerCase())),Y=(F)=>{let U=$[F];return QF1(Q[F]?`${U.owner}-${U.name}`:U.name).toLowerCase()};for(let F=0;F<$.length;F++){let U=new Map,N=!1;for(let B=0;B<$.length;B++){let D=Y(B),O=U.get(D);if(O!==void 0){if(!Q[B])Q[B]=!0,N=!0;if(!Q[O])Q[O]=!0,N=!0}U.set(D,B)}if(!N)break}let X=$.map((F,U)=>QF1(Q[U]?`${F.owner}-${F.name}`:F.name)),J=new Map;for(let F of X)J.set(F.toLowerCase(),(J.get(F.toLowerCase())??0)+1);let G=X.map((F,U)=>{if(J.get(F.toLowerCase())===1)return F;let N=new URL($[U].url).host;return QF1(`${N}-${F}`)}),W=new Map;for(let F of G)W.set(F.toLowerCase(),(W.get(F.toLowerCase())??0)+1);let K=new Set(G.filter((F)=>W.get(F.toLowerCase())===1).map((F)=>F.toLowerCase())),H=G.map((F,U)=>U).filter((F)=>W.get(G[F].toLowerCase())!==1).sort((F,U)=>(ra($[F])??"").localeCompare(ra($[U])??""));for(let F of H){let U=G[F],N=1,B=`${U}-${N}`;while(K.has(B.toLowerCase()))B=`${U}-${++N}`;K.add(B.toLowerCase()),G[F]=B}return G}function Rn$($,Z){let Q=$.findIndex((Y)=>mD(Y,Z));return Q===-1?null:l50($)[Q]??null}function QF1($){return $.replace(/[^A-Za-z0-9._-]/g,"-").replace(/^[^A-Za-z0-9]+/,"")||"repo"}var YF1=()=>{};var c50;var XF1=L(()=>{c50={npm:{install:"npm install",run:($)=>`npm run ${$}`,runtime:"node"},pnpm:{install:"pnpm install",run:($)=>`pnpm run ${$}`,runtime:"node"},yarn:{install:"yarn install",run:($)=>`yarn run ${$}`,runtime:"node"},bun:{install:"bun install",run:($)=>`bun run ${$}`,runtime:"bun"},deno:{install:"deno install",run:($)=>`deno task ${$}`,runtime:"deno"}}});function gn($){if(!$)return null;let Z=$.runtime;if(!Z||typeof Z!=="object")return null;let Q=Z.env;if(!Array.isArray(Q))return null;let Y=[];for(let X of Q){if(!X||typeof X!=="object")continue;let J=X;if(typeof J.key!=="string"||!P30.test(J.key))continue;if(J.kind==="literal"&&typeof J.value==="string"){Y.push({key:J.key,kind:"literal",value:J.value});continue}if(J.kind==="secret"&&typeof J.secretId==="string"&&J.secretId.length>0)Y.push({key:J.key,kind:"secret",secretId:J.secretId})}return Y.length===0?null:Y}async function Mn$($,Z){n(Z);let Q=Q0(Z);await Z.access.check();let Y=_0(Z);if(!Y)throw Error("User ID required");let X=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!X||X.organization_id!==Q.id)throw Error("Virtual MCP not found");let J=X.metadata??{},G=h5(J),W=await Az(Z,$.branch,Y),K=CY(G,W,$.branch);return{virtualMcp:X,metadata:J,userId:Y,sandboxUserId:W,entry:K,organization:Q}}function jV6($){if($===null||!/^\d+$/.test($))return null;let Z=Number($);return Z>=1&&Z<=65535?$:null}function Vn$($){let Z=$.runtime??null,Y=Z?.selected??null,X=jV6(Z?.port??null),J=Z?.path??null;if(!Y||!(Y in c50))return{packageManager:null,runtime:null,port:X,packageManagerPath:J,runtimeBinPath:null};let G=c50[Y].runtime;return{packageManager:Y,runtime:G,port:X,packageManagerPath:J,runtimeBinPath:G==="deno"?"/opt/deno/bin":G==="bun"?"/opt/bun/bin":null}}var m50=L(()=>{q8();XF1();kX();xQ()});async function KS0({ctx:$,runner:Z,handle:Q,orgId:Y,userId:X,entries:J}){if(!J||J.length===0)return;let G={};for(let K of J){if(K.kind==="literal"){G[K.key]=K.value;continue}try{let{value:H}=await $.storage.secrets.resolveById(K.secretId,Y,X);G[K.key]=H}catch(H){if(H instanceof sK||H instanceof zz){console.warn(`[SANDBOX_START] skipping env ${K.key}: ${H.message}. Re-link or recreate the secret to restore.`);continue}throw H}}if(Object.keys(G).length===0)return;let W=await Z.proxyDaemonRequest(Q,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({env:G})});if(!W.ok){let K=await aP(W,wV6).catch(()=>W.statusText);console.warn(`[SANDBOX_START] daemon rejected env patch (${W.status}): ${K}`)}}var wV6=10485760;var JF1=L(()=>{y50();u60()});async function Cn$($,Z,Q,Y,X){let J=await qJ({connectionId:$,tokenStorage:new a5(Y,X)});if(!J.accessToken)return null;return _n$(Z,Q,J.accessToken)}function Sn$($,Z){return _n$($,Z,null)}async function _n$($,Z,Q){let Y=new Map,X=new Set(In$.map((K)=>K.path));for(let K of Object.values(kn$))for(let H of K??[])X.add(H);await Promise.all(Array.from(X).map(async(K)=>{Y.set(K,await PV6($,Z,K,Q))}));let J=In$.find(({path:K})=>Y.get(K)!==null);if(!J)return null;let G=kn$[J.pm]??[],W=null;for(let K of G)if(W=zV6(Y.get(K)??null),W)break;return{packageManager:J.pm,devPort:W}}async function PV6($,Z,Q,Y){let X=`https://api.github.com/repos/${$}/${Z}/contents/${encodeURIComponent(Q)}`;try{let J={Accept:"application/vnd.github+json","User-Agent":"studio-runtime-detect"};if(Y)J.Authorization=`token ${Y}`;let G=await fetch(X,{headers:J,signal:AbortSignal.timeout(5000)});if(!G.ok)return null;let W=await G.json();if(!W.content||W.encoding!=="base64")return null;return Buffer.from(W.content,"base64").toString("utf8")}catch{return null}}function zV6($){if(!$)return null;try{let Z=JSON.parse($),Q=Z.tasks??Z.scripts??{},X=(Q.dev??Q.start??"").match(EV6)?.[1]??null;if(!X)return null;let J=Number(X);return J>=1&&J<=65535?X:null}catch{return null}}var In$,kn$,EV6;var vn$=L(()=>{n3();vK();In$=[{path:"deno.json",pm:"deno"},{path:"deno.jsonc",pm:"deno"},{path:"bun.lock",pm:"bun"},{path:"bunfig.toml",pm:"bun"},{path:"pnpm-lock.yaml",pm:"pnpm"},{path:"yarn.lock",pm:"yarn"},{path:"package-lock.json",pm:"npm"},{path:"package.json",pm:"bun"}],kn$={deno:["deno.json","deno.jsonc"],bun:["package.json"],pnpm:["package.json"],yarn:["package.json"],npm:["package.json"]},EV6=/(?:--port|PORT=|:)(\d{4,5})/});function AV6($){return($??"").normalize("NFKD").replace(/[\u0300-\u036F]/g,"").toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")||"user"}function HS0($){return $?.name||$?.email?.split("@")[0]||void 0}function FS0($){let Z=AV6($),Q=Date.now().toString(36).split("").reverse().join("");return`${Z}-${Q}`}async function fn$($,Z){bn$??=G$.createHistogram("studio.sandbox.provision.duration_ms",{description:"Wall-clock time of one sandbox ensure, by provider (runner_kind), outcome, the provider a fallback left (fallback_from), whether a warm-pool pod was claimed (warm_pool), and whether a sandbox was already recorded (start=resume) or not (start=fresh).",unit:"ms",advice:{explicitBucketBoundaries:[500,1000,2000,5000,1e4,20000,30000,60000,120000,300000,600000]}}),xn$??=G$.createCounter("studio.sandbox.placement",{description:"Sandbox ensures by the provider that served them (runner_kind) and why it was chosen (reason)."});let Q=performance.now(),Y=(X,J,G={})=>bn$?.record(performance.now()-Q,{...$,runner_kind:X?HO[X]:"unknown",outcome:J,...G});try{let X=await Z(),J=X.placement?.fallbackFrom;if(Y(X.provider,"ok",{warm_pool:String(X.warmPoolAdopted),...J&&{fallback_from:HO[J]}}),X.placement)xn$.add(1,{runner_kind:HO[X.provider],reason:X.placement.reason});return X}catch(X){throw Y(uH1(X),"error"),X}}var bn$,xn$;var yn$=L(()=>{yn();v6()});async function d50($,Z,Q){try{await $.storage.threads.stampRuntimeIfAbsent(Z,Q)}catch(Y){console.warn(`[stampRuntimeIfAbsent] ${Z}: ${Y instanceof Error?Y.message:String(Y)}`)}}function Eh($){return $==="cms"||$==="sandbox"?$:null}function TV6($){return!!BP($)&&(NP($)||$?.fastPreview===!0)}function US0($){return TV6($)?"cms":"sandbox"}var GF1;var hn=L(()=>{oi();GF1=["cms","sandbox"]});async function WF1($,Z){n(Z);let Q=Q0(Z),Y=_0(Z);if(!Y)throw Error("User ID required");let X=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!X||X.organization_id!==Q.id)throw Error("Virtual MCP not found");let J=X.metadata??{},G=await Az(Z,$.branch,Y),W=SY($.branch)??Z.metadata?.threadId,K=CY(h5(J),G,$.branch),H=K??(W?CY(await un(Z,W),G,$.branch):null);return{organization:Q,userId:Y,metadata:J,sandboxUserId:G,recordThreadId:W,agentEntry:K,existing:H}}async function gn$($,Z){return(await WF1($,Z)).existing}var KF1=L(()=>{kX();xQ()});import{z as EB}from"zod";async function PB($,Z){let{organization:Q,userId:Y,metadata:X,sandboxUserId:J,recordThreadId:G,agentEntry:W,existing:K}=await WF1($,Z),H=await LZ(Z);if(K&&!$.revalidate){if(await H.alive(K.sandboxHandle).catch(()=>!0))return K;if(W)await FO(Z.storage.virtualMcps,$.virtualMcpId,Y,J,$.branch).catch((j)=>{console.warn("[ensureSandbox] failed to reap stale entry",j)});else if(G)await BS0(Z,G,J,$.branch)}let F=SY($.branch)??Z.metadata?.threadId;if(F)d50(Z,F,"sandbox");let N=await zB(Z,F)??X.repository??null;await $.onColdStart?.().catch((O)=>{console.warn("[ensureSandbox] onColdStart callback failed",O instanceof Error?O.message:String(O))});let{entry:B,warmPoolAdopted:D}=await ln$({ctx:Z,userId:Y,sandboxUserId:J,orgId:Q.id,virtualMcpId:$.virtualMcpId,branch:$.branch,metadata:X,repository:N,threadRepos:await FF1(Z,F),existing:$.revalidate?K:null,runner:H,...$.purpose?{purpose:$.purpose}:{}});return $.onBound?.({warmPoolAdopted:D}),B}async function un$($,Z,Q){if(!Z)return null;if(Z.accountId===null&&!Q&&!Z.legacyConnectionId)return Z;return await uL($.storage,Z)?Z:null}async function qV6($){let Z=$.repos.filter((X)=>!$.primary||!mD(X,$.primary)),Q=l50(Z),Y=[];for(let[X,J]of Z.entries())try{let G=await nN($.ctx.storage,$.orgId,J),W=await un$($.ctx,G,J.connectionId),K=J.connectionId??G?.legacyConnectionId;if(!W&&!K)continue;let{cloneUrl:H,expiresAt:F}=W?await pN($.ctx,W,{forceRefresh:!0}):await KB(K,J.owner,J.name,$.ctx.db,$.ctx.vault);Y.push({cloneUrl:H,credentialExpiresAt:eK1(F),...W?{repositoryId:W.id}:{connectionId:K},userName:$.gitUserName,userEmail:$.gitUserEmail,displayName:W?W.path:`${J.owner}/${J.name}`,directoryName:Q[X],submoduleCredentials:$.submoduleCredentials})}catch(G){console.warn(`[provisionSandbox] skipping secondary ${J.owner}/${J.name}:`,G instanceof Error?G.message:G)}return Y}async function ln$($){let{ctx:Z,userId:Q,sandboxUserId:Y,orgId:X,virtualMcpId:J,branch:G,metadata:W,threadRepos:K,existing:H,runner:F,purpose:U,provider:N}=$,B=SY(G)??Z.metadata?.threadId,D=(X0)=>B&&bQ(B,`provision:${X0}`),O=U==="harness-run",j="default",w=$.repository?await RV6({ctx:Z,orgId:X,virtualMcpId:J,userId:Q,repository:$.repository}):null,{runtime:E,packageManager:P,port:T,packageManagerPath:z}=Vn$(W),A=await Z.storage.organizationSettings.get(X),R=await YS0({ctx:Z,orgId:X,userId:Q,entries:A?.submodule_credentials}),f;if(w){let X0=await nN(Z.storage,X,w);j=X0?.sandboxImage??"default";let h0=await un$(Z,X0,w.connectionId),C0=w.connectionId??X0?.legacyConnectionId??void 0;if(!h0&&C0)await Zn({ctx:Z,connectionId:C0,organizationId:X,forceRefresh:!0,onLegacyMintError:(o0)=>{console.error("[provisionSandbox] repo-scoped legacy token mint failed",{connectionId:C0,error:o0.message})}});let{cloneUrl:H1,gitUserName:c0,gitUserEmail:j0,expiresAt:E0}=h0?await CV6(Z,h0):C0?await KB(C0,w.owner,w.name,Z.db,Z.vault):Sf$(w.owner,w.name);if(!P&&!h0){let o0=C0?await Cn$(C0,w.owner,w.name,Z.db,Z.vault):await Sn$(w.owner,w.name);if(o0)P=o0.packageManager,E=c50[o0.packageManager].runtime,T=o0.devPort??T,await MV6(Z,J,Q,o0.packageManager,o0.devPort)}let n0=B0().sandboxStickyHeadRefEnabled,O1=$j0({branch:G,derivedRef:tF(G,{flat:zh(X0?.provider)}),recordedHeadRef:n0?await NS0(Z,SY(G)):null,sticky:n0});f={cloneUrl:H1,credentialExpiresAt:eK1(E0),...h0?{repositoryId:h0.id}:C0?{connectionId:C0}:{},userName:c0,userEmail:j0,branch:O1,displayName:h0?h0.path:`${w.owner}/${w.name}`,submoduleCredentials:R}}let S=await qV6({ctx:Z,orgId:X,repos:K??[],primary:w,gitUserName:f?.userName??"",gitUserEmail:f?.userEmail??"",submoduleCredentials:R}),V=E&&P&&!O?{runtime:E,packageManager:P,...T!==null?{devPort:Number(T)}:{},...z?{packageManagerPath:z}:{}}:void 0,v=T50({orgId:X,virtualMcpId:J,branch:G}),b=!B0().orgFsMountsDisabled,h;if(b){let X0=Z.organization?.slug??(await Z.db.selectFrom("organization").select(["slug"]).where("id","=",X).executeTakeFirst())?.slug;if(X0)h=await Gj0(Z,{orgSlug:X0,orgId:X,baseUrl:N5()})}let l=await fn$({start:H?"resume":"fresh",purpose:U??"interactive"},async()=>{return D("prep"),await kV6(F),D("capacity"),IV6(F,{userId:Y,projectRef:v},{branch:G,repo:f,extraRepos:S,workload:V,cloneOnly:O,...U9(A?.flags,"sandbox_repo_snapshots")?{repoSnapshot:!0}:{},...U?{purpose:U}:{},...N?{provider:N}:{},...j!=="default"?{sandboxImage:j}:{},tenant:{orgId:X,userId:Y,...Z.organization?.slug?{orgSlug:Z.organization.slug}:{},...Z.organization?.name?{orgName:Z.organization.name}:{},...Z.auth.user?.email?{userEmail:Z.auth.user.email}:{},...Z.auth.user?.name?{userName:Z.auth.user.name}:{}},...h?{orgFsConfigJson:h}:{}})});D("provider-ensure");let d=gn(W);await KS0({ctx:Z,runner:F,handle:l.handle,orgId:X,userId:Q,entries:d}),D("env");let I0=!!H&&H.sandboxHandle===l.handle&&H?.createdAt?H.createdAt:Date.now(),J0=W.runtime?.selected??null,U0=W.runtime?.port??null,o=W.runtime?.path??null,t={sandboxHandle:l.handle,previewUrl:l.previewUrl,createdAt:I0,startedWith:{packageManager:J0,port:U0,path:o}};await Dn$(Z.storage.virtualMcps,J,Q,Y,G,t);let r=SY(G)??Z.metadata?.threadId;if(r)await cn$(Z,r,Y,G,t);D("map-writes");let $0=!H||H.sandboxHandle!==l.handle;return{entry:t,isNewVm:$0,warmPoolAdopted:l.warmPoolAdopted}}async function RV6($){let{ctx:Z,orgId:Q,virtualMcpId:Y,userId:X,repository:J}=$;if(!J.connectionId)return J;if(await Z.storage.connections.findById(J.connectionId,Q))return J;let{items:W}=await Z.storage.connections.list(Q),K=SB0(W,J.owner,J.name);if(!K)return console.warn("[provisionSandbox] recorded repo connection no longer exists and no live connection covers the repo",{virtualMcpId:Y,connectionId:J.connectionId}),J;console.warn("[provisionSandbox] healed dangling repo connection",{virtualMcpId:Y,staleConnectionId:J.connectionId,connectionId:K.id});try{let F=(await Z.storage.virtualMcps.findById(Y))?.metadata??{},U=F.repository;if(U?.connectionId===J.connectionId){let N=FZ(K);await Z.storage.virtualMcps.update(Y,X,{metadata:{...F,repository:{...U,connectionId:K.id,...N?{installationId:N.installationId}:{}}}})}}catch(H){console.warn("[provisionSandbox] failed to persist healed repo connection",{virtualMcpId:Y,error:H.message})}return{...J,connectionId:K.id}}async function MV6($,Z,Q,Y,X){let J=await $.storage.virtualMcps.findById(Z);if(!J)return;let G=J.metadata??{};await $.storage.virtualMcps.update(Z,Q,{metadata:{...G,runtime:{selected:Y,port:X}}})}async function IV6($,...Z){try{return await $.ensure(...Z)}catch(Q){if(!(Q instanceof IY))throw Q;throw Error(`sandbox provisioning failed: the sandbox pod rejected the bootstrap handshake (HTTP ${Q.status}). The claim was released; retrying gets a different pod.`,{cause:Q})}}async function kV6($){let Z=Date.now()+hn$,Q=!1;while(!await $.hasSchedulableCapacity()){if(Date.now()>=Z)throw Error(`sandbox provisioning failed: the cluster has had no room to schedule another sandbox for ${Math.round(hn$/1000)}s`);if(!Q)Q=!0,console.warn("[ensureSandbox] waiting for cluster capacity \u2014 a sandbox pod cannot be scheduled right now");await J$(VV6)}}async function CV6($,Z){try{return await pN($,Z,{forceRefresh:!0})}catch(Q){if(Q instanceof y0){let Y=Q.status===404?VR.githubConnectionMissing:VR.githubNotAuthenticated;throw Error(l60(Y,Q.message))}throw Q}}var HF1,hn$=150000,VV6=5000;var Ph=L(()=>{fn();kZ();yn();Fh();YF1();n$();R0();m50();JF1();sH1();kX();SG();c60();vn$();XF1();IX();yn$();hn();xQ();Zj0();l1();K9();UB();kX();KF1();A5();C5();mC0();dO0();HF1=u({name:"SANDBOX_START",description:"Start a sandbox with the connected repository and dev server.",annotations:{title:"Start VM Preview",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:EB.object({virtualMcpId:EB.string().describe("Virtual MCP ID"),branch:EB.string().min(1).optional().describe("Git branch to check out. Pass the thread's branch whenever the caller has one: when omitted the handler mints a fresh `<user-slug>-<timestamp>` name, which becomes a SEPARATE sandbox from the one the thread's own branch resolves to. The resolved branch is returned in the response so callers can persist it."),threadId:EB.string().optional().describe("The session asking for a sandbox. A thread stamped `cms` is refused \u2014 that session reads and writes over the decofile API and a pod would be invisible to it. Optional: an unstamped (legacy) thread is always allowed, and so is a caller with no thread."),provider:EB.enum(["kubernetes","freestyle"]).optional().describe("Where to run a NEW sandbox, when that provider is configured and can run it; otherwise the other one is used. An existing sandbox stays where it is. Omitted: Kubernetes while it has room, else Freestyle.")}),outputSchema:EB.object({previewUrl:EB.string().nullable(),sandboxHandle:EB.string(),branch:EB.string(),isNewVm:EB.boolean()}),handler:async($,Z)=>{n(Z);let Q=Q0(Z);await Z.access.check();let Y=$.branch??FS0(HS0(Z.auth.user)),X=SY(Y)??$.threadId??Z.metadata?.threadId;if(X){let O=await Z.storage.threads.get(X).catch(()=>null);if(Eh(O?.metadata?.runtime)==="cms")throw Error("This chat is a CMS session and does not use a sandbox. Start a coding session to get one.")}let J=_0(Z);if(!J)throw Error("User ID required");let G=await Az(Z,Y,J),W=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!W||W.organization_id!==Q.id)throw Error("Virtual MCP not found");let K=W.metadata??{},H=await LZ(Z),F=CY(h5(K),G,Y),N=await zB(Z,X)??K.repository??null,{entry:B,isNewVm:D}=await ln$({ctx:Z,userId:J,sandboxUserId:G,orgId:Q.id,virtualMcpId:$.virtualMcpId,branch:Y,metadata:K,repository:N,threadRepos:await FF1(Z,X),existing:F,runner:H,...$.provider?{provider:$.provider}:{}});if(X)d50(Z,X,"sandbox");return{...B,branch:Y,isNewVm:D}}})});async function rK($,Z){if(!PU())return!1;try{let Q=await $.storage.organizationSettings.get(Z);return U9(Q?.flags,"chat_harness_sandbox_only")}catch(Q){return console.warn("[sandbox-only-chats] flag read failed",Q),!1}}async function mn$($,Z,Q){if((await $.storage.aiProviderKeys.list({organizationId:Z})).some((X)=>u$$(X.providerId)))return!0;return await i50($,Z,Q)!==null}async function i50($,Z,Q,Y="claude-code"){return(await WS0($,Z,Q,Y))?.providerId??null}async function dn$($,Z){let Q=$.organization?.id;if(!Q)return;let Y=await $.storage.virtualMcps.findById(Z.virtual_mcp_id);if(!Y)return;let X=ME(Y),J=X.metadata?.repository,G=await AB($,{threadId:Z.id,agentRepo:J,runBranch:Z.branch??fJ(Z.id)}),{sandboxHandle:W}=await PB({virtualMcpId:X.id,branch:G,purpose:J?.url?"interactive":"harness-run"},$);await(await LZ($)).proxyDaemonRequest(W,"/_sandbox/prepare",{method:"POST",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({harness:await UF1($,Q),threadId:Z.id})}).then((H)=>{if(!H.ok)console.warn("[sandbox-prewarm] prepare refused",H.status)}).catch((H)=>console.warn("[sandbox-prewarm] prepare failed",H))}async function UF1($,Z){let Q=await $.storage.organizationSettings.get(Z);return U9(Q?.flags,"chat_harness_codex")?"codex":"claude-code"}async function in$($,Z,Q){if(await i50($,Z,Q,"codex"))return!0;return(await $.storage.aiProviderKeys.list({organizationId:Z})).some((X)=>wh(X.providerId))}var DS0;var Ah=L(()=>{$F1();l1();IX();Ph();xQ();VE();kZ();hr0();DS0=class DS0 extends Error{code="claude_code_provider_required";constructor(){super("Chats need an Anthropic, OpenRouter or deco AI Gateway provider, or your own linked Claude or GitHub Copilot plan. Connect one in Settings \u2192 AI Providers.");this.name="ClaudeCodeProviderRequiredError"}}});async function p50($,Z,Q){let Y=$.storage.threads.getOrganizationId();if(!Y||!Z)return null;let X=await(Q??$.storage.virtualMcps.findById(Z,Y));return X?.organization_id===Y?X.metadata??null:null}function fJ($,Z){return Z?`thread:${$}/${Z}`:`thread:${$}`}function tF($,Z={}){let Q=$.replace(/^thread:/,"").replace(/\//g,"-");return Z.flat?`sandbox-thread-${Q}`:`sandbox/thread-${Q}`}function zh($){return $==="gitlab"}async function NF1($,Z,Q){if(!Q)return tF(Z);return tF(Z,{flat:zh(await SV6($,Q))})}async function SV6($,Z){let Q=typeof Z.url==="string"?DX(Z.url)?.provider:void 0;if(Q)return Q;let Y=$.storage.threads.getOrganizationId();if(!Z.repositoryId||!Y)return null;return(await $.storage.repositories.get(Z.repositoryId,Y).catch(()=>null))?.provider??null}function SY($){if(!$||!$.startsWith("thread:"))return null;return $.slice(7).split("/")[0]||null}async function Az($,Z,Q){return DF1(await BF1($,Z),Q)}async function BF1($,Z){let Q=SY(Z);if(!Q)return null;return await $.storage.threads.get(Q).catch(()=>null)}function DF1($,Z){return $?.created_by??Z}async function Tz($,Z){if(!Z)return null;let Q=await $.storage.threads.get(Z).catch(()=>null);if(!Q)return null;return Q.metadata??{}}async function NS0($,Z){let Y=(await Tz($,Z))?.headRef;return typeof Y==="string"&&Y.length>0?Y:null}async function pn$($,Z,Q){let Y=await Tz($,Z);if(!Y)return;if(Y.headRef===Q)return;await $.storage.threads.update(Z,{metadata:{...Y,headRef:Q}}).catch((X)=>console.warn("[thread-repo] setThreadHeadRef failed",X))}function _V6($,Z){let Q=SB0(Z,$.owner,$.name);if(!Q||Q.id===$.connectionId)return null;let Y=FZ(Q);return{...$,connectionId:Q.id,...Y?.installationId?{installationId:Y.installationId}:{}}}async function FF1($,Z){let Y=(await Tz($,Z))?.additionalRepositories;return Array.isArray(Y)?Y.filter((X)=>X?.owner&&X?.name):[]}async function zB($,Z){let Q=await Tz($,Z),Y=Q?.repository??null;if(!Z||!Q||!Y?.connectionId||Y.repositoryId)return Y;try{let X=$.storage.threads.getOrganizationId();if(!X)return Y;if(await $.storage.connections.findById(Y.connectionId,X))return Y;let{items:J}=await $.storage.connections.list(X),G=_V6(Y,J);if(!G)return Y;return await $.storage.threads.update(Z,{metadata:{...Q,repository:G}}),console.warn("[thread-repo] re-pointed thread at a live repo connection",{threadId:Z,from:Y.connectionId,to:G.connectionId}),G}catch(X){return console.warn("[thread-repo] repoint check failed",X),Y}}function LF1($){if($.pinnedRef)return $.pinnedRef;if($.runBranch&&$.runBranch===fJ($.threadId))return $.runBranch;if($.threadRepo)return fJ($.threadId,$.threadRepo.connectionId);if(!$.agentRepo)return $.sandboxOnlyChats?fJ($.threadId):"ephemeral";return $.runBranch??`thread:${$.threadId}`}async function OF1($,Z){let Y=(await Tz($,Z))?.pinnedRef;return typeof Y==="string"&&Y.length>0?Y:null}async function AB($,Z){let Q=$.storage.threads.getOrganizationId(),[Y,X,J]=await Promise.all([zB($,Z.threadId),OF1($,Z.threadId),Q?rK($,Q):Promise.resolve(!1)]);return LF1({...Z,threadRepo:Y,pinnedRef:X,sandboxOnlyChats:J})}async function cn$($,Z,Q,Y,X){let J=await Tz($,Z);if(!J)return;let G=g50(h5(J),Q,Y,X);await $.storage.threads.update(Z,{metadata:{...J,sandboxMap:G}}).catch((W)=>console.warn("[thread-repo] setThreadSandboxMapEntry failed",W))}async function un($,Z){return h5(await Tz($,Z))}async function BS0($,Z,Q,Y){let X=await Tz($,Z);if(!X)return;let J=rH1(h5(X),Q,Y);if(!J)return;await $.storage.threads.update(Z,{metadata:{...X,sandboxMap:J}}).catch((G)=>console.warn("[thread-repo] removeThreadSandboxMapEntry failed",G))}var xQ=L(()=>{t4();SG();Ah();kX()});import{AsyncLocalStorage as vV6}from"async_hooks";function LS0($){let Z=$?.metadata?.[xn];return typeof Z==="string"&&Z.length>0}function ln(){let $=W7.getStore();if(!$)throw Error("This tool is only available on a thread's MCP endpoint (/api/<org>/mcp/thread/<threadId>).");return $}function OS0($){let Z=n50($);return new Set(Z===tn$?nn$:Z)}function n50($){if($?.metadata?.source==="jira")return xV6;return BG.some((Q)=>LK($?.title,Q))?bV6:tn$}var W7,nn$,bV6,xV6,fV6,tn$;var FW=L(()=>{wB();nw();u8();W7=new vV6;nn$=["TASK_ADD_REPO","TASK_BOARD_ITEM_LIST","TASK_BOARD_ITEM_UPDATE","TASK_BOARD_ACTIVITY_LIST","TASK_BOARD_COMMENT_LIST","TASK_BOARD_COMMENT_CREATE","TASK_BOARD_COMMENT_UPDATE"],bV6=[...nn$,"TASK_BOARD_ITEM_PRS_GET","TASK_BOARD_REVIEW_DECISION"],xV6=["TASK_ADD_REPO","JIRA_ISSUE_GET","JIRA_COMMENT_ADD","JIRA_ISSUE_TRANSITION","JIRA_ATTACHMENT_DOWNLOAD","JIRA_REMOTE_LINK_ADD","JIRA_ISSUE_CREATE","JIRA_ISSUE_SEARCH"],fV6=new Set(["TASK_BOARD_REVIEW_DECISION","TASK_BOARD_PROMOTE_TO_PRODUCTION","TASK_BOARD_PROMPT_UPSERT","TASK_BOARD_PROMPT_DELETE"]),tn$=A00.map(($)=>$.name).filter(($)=>!fV6.has($))});import{z as UW}from"zod";async function uV6($,Z,Q,Y,X){return F8(async()=>{let G=CY(await un($,Z),Q,Y)??(X?CY(h5(await p50($,X)),Q,Y):null);if(!G)throw Error("sandbox record not written yet");return G},{maxAttempts:yV6,minTimeout:gV6,maxTimeout:hV6,jitter:0}).catch(()=>null)}function cV6($,Z,Q=sn$){if($.some((Y)=>mD(Y,Z)))return!1;return $.length>=Q}async function wF1($,Z,Q,Y){let X=await $.proxyDaemonRequest(Z,"/_sandbox/bash",{method:"POST",headers:new Headers({"content-type":"application/json","x-thread-id":Q}),body:JSON.stringify({command:Y})});if(!X.ok)throw Error(`sandbox bash failed (${X.status} ${X.statusText})`);let J=await X.json();return{stdout:J.stdout??"",exitCode:J.exitCode??0}}function rn$($){return`cd ${$} 2>/dev/null || exit 1; if [ -n "$(git ls-files 2>/dev/null | head -1)" ]; then echo __CLONED__; fi; ls -A 2>/dev/null`}async function mV6($,Z,Q,Y){let X=()=>wF1($,Z,Q,rn$(Y)).then((W)=>an$(W.stdout)).catch(()=>null),J=await X();if(!J?.cloned)return!1;await J$(jF1);let G=await X();return!!G?.cloned&&G.listing===J.listing}function an$($){let Z=$.split(`
+`);yield B?Kn$(B):"alive"}}}catch(W){if(Y.signal.aborted&&!Z?.aborted)throw Y.signal.reason;throw W}finally{clearTimeout(X)}}async hostStall($,Z){let Q=Date.now(),Y=0;while(!Z.aborted){let X=!1,J="";try{for await(let G of this.watchOnce($,Z))if(Q=Date.now(),Y=0,G!=="alive"&&Yn$(G))break;X=!0}catch(G){if(Z.aborted)return null;if(G instanceof eC0)return console.warn(`[${_n}] ${G.message} for ${$}: its progress is unbounded`),null;J=vn(G)}if(Date.now()-Q>=this.stallMs)return new jh(`the host showed no progress for ${$} in ${this.stallMs/1000}s${J?`: ${J}`:""}`);await J$(X?this.stallMs/4:Xn$(Y++),{signal:Z}).catch(()=>{})}return null}async*watchClaimLifecycle($,Z){let Q=aC0(Z,this.closed.signal),Y=Date.now(),X=0,J="";while(!Q?.aborted){let G="watch ended before ready";try{for await(let W of this.watchOnce($,Q)){if(Y=Date.now(),X=0,W==="alive")continue;let K=JSON.stringify(W);if(K!==J)J=K,yield W;if(Yn$(W))return}}catch(W){if(Q?.aborted)return;if(W instanceof eC0){yield $S0(W.message);return}G=`watch failed: ${vn(W)}`}if(Date.now()-Y>=this.stallMs){yield $S0(G);return}await J$(Xn$(X++),{signal:Q}).catch(()=>{})}}}function Kn$($){let Z;try{Z=JSON.parse($)}catch{return $S0("host sent a non-JSON phase")}let Q=Ng$.safeParse(Z);return Q.success?Q.data:$S0(`host sent a malformed phase: ${Q.error.message}`)}var _n="RemoteSandboxProvider",Qn$=30000,fM6=2147483647,Jn$=500,yM6=10,gM6=0.5,Gn$=5000,hM6=3000,uM6=300000,lM6=5000,jh,eC0;var dH1=L(()=>{QN();zd();n$();Fh();b31();An();xC0();fC0();oC0();jh=class jh extends Error{constructor($){super($);this.name="SandboxHostError"}};eC0=class eC0 extends Error{}});var Nn$={};O6(Nn$,{subscribeLifecycle:()=>tH1,readControlPlaneSandboxConfig:()=>x50,getOrInitSharedRunner:()=>f50,getAgentSandboxProviderForTeardown:()=>ZS0,getAgentSandboxProvider:()=>LZ,__resetSharedLifecyclesForTesting:()=>ZV6});function pH1($){let Z=b50[Hn$];if(Z)return Promise.resolve(Z);let Q=b50[iH1];if(Q)return Q;let Y=$().then((X)=>{return b50[Hn$]=X,X}).finally(()=>{delete b50[iH1]});return b50[iH1]=Y,Y}function iM6(){let $=process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN;return $&&$.trim()!==""?$:void 0}function pM6(){let $=process.env.STUDIO_SANDBOX_TEMPLATE_NAME;return $&&$.trim()!==""?$:void 0}function nM6(){let $=process.env.STUDIO_ENV;return $&&$.trim()!==""?$:void 0}function tM6(){let $=process.env.STUDIO_SANDBOX_SENTINEL_TOKEN;return $&&$.trim()!==""?$:void 0}function oM6(){let $=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME?.trim(),Z=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE?.trim();if(!$&&!Z)return;if(!$||!Z)throw Error("STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME and STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE must both be set, or both unset. Half-configured per-claim HTTPRoute routing would silently fail to attach.");return{name:$,namespace:Z}}function x50(){let $=process.env.STUDIO_SANDBOX_CONTROL_PLANE_URL?.trim(),Z=process.env.STUDIO_SANDBOX_CONTROL_PLANE_TOKEN?.trim();if(!$&&!Z)return;if(!$||!Z)throw Error("STUDIO_SANDBOX_CONTROL_PLANE_URL and STUDIO_SANDBOX_CONTROL_PLANE_TOKEN must both be set, or both unset.");return{url:$,token:Z}}async function nH1($){let Z=process.env.FREESTYLE_API_KEY?.trim();if(!Z)return Fn$($);let Q=await Fn$($).catch((J)=>{console.warn("[lifecycle] kubernetes sandbox provider unavailable, using Freestyle only:",J instanceof Error?J.message:String(J));return}),[{FreestyleSandboxProvider:Y},{SandboxProviderRouter:X}]=await Promise.all([Promise.resolve().then(() => (ep$(),ap$)),Promise.resolve().then(() => (cH1(),lH1))]);return new X({kubernetes:Q,freestyle:new Y({apiKey:Z,image:process.env.STUDIO_SANDBOX_FREESTYLE_IMAGE?.trim()||void 0,allowUserNamespaces:process.env.STUDIO_SANDBOX_FREESTYLE_USER_NAMESPACES==="true",meter:G$})},{freestyleShare:sM6()})}function sM6(){let $=Number(process.env.STUDIO_SANDBOX_FREESTYLE_SHARE??0);if(Number.isFinite($)&&$>=0&&$<=1)return $;return console.warn("[lifecycle] STUDIO_SANDBOX_FREESTYLE_SHARE must be a number from 0 to 1; using 0"),0}async function Fn$($){let Z=x50();if(Z){let{RemoteSandboxProvider:K}=await Promise.resolve().then(() => (dH1(),mH1));return new K({baseUrl:Z.url,token:Z.token,credentialLifetimeMs:{orgFsConfig:cC0},meter:G$})}let Q=new o60($),Y=iM6(),{AgentSandboxProvider:X}=await Promise.resolve().then(() => (I50(),ii$)),J=new XJ(B0().encryptionKey),G=Wj0($,J),W=hC0(process.env.STUDIO_SANDBOX_TENANT_POOLS);return new X({stateStore:Q,previewUrlPattern:Y,sandboxTemplateName:pM6(),envName:nM6(),previewGateway:oM6(),sentinelToken:tM6(),tenantPools:ni$(W),mintPoolCloneUrl:ti$(W,G.mintCloneUrl),meter:G$,...G})}function LZ($){if(!B0().agentSandboxEnabled)throw Error("Agent sandbox is disabled. Set STUDIO_AGENT_SANDBOX_ENABLED=true to enable it.");return pH1(()=>nH1($.db))}function ZS0($){return pH1(()=>nH1($.db))}async function f50(){if(!B0().agentSandboxEnabled)return null;return pH1(()=>nH1(E8().db))}function tH1($,Z,Q){let Y=Pz.get(Z);if(Y){if(Y.terminated){if(Y.lastPhase)try{Q(Y.lastPhase)}catch{}return{unsubscribe:eM6}}if(Y.listeners.add(Q),Y.lastPhase)try{Q(Y.lastPhase)}catch{}return Un$(Z,Y,Q)}let X=new AbortController,J={lastPhase:null,terminated:!1,listeners:new Set([Q]),abort:X};return Pz.set(Z,J),$V6($,Z,J),Un$(Z,J,Q)}function eM6(){}function Un$($,Z,Q){return{unsubscribe(){if(Pz.get($)!==Z)return;if(Z.listeners.delete(Q),Z.listeners.size===0)Pz.delete($),Z.abort.abort()}}}async function $V6($,Z,Q){let Y=null;try{for await(let X of $.watchClaimLifecycle(Z,Q.abort.signal)){if(Q.abort.signal.aborted)break;Q.lastPhase=X;let J=X.kind==="ready"||X.kind==="failed";if(J)Q.terminated=!0;let G=Array.from(Q.listeners);for(let W of G)try{W(X)}catch{}if(J)break}}catch(X){Y=X}finally{if(!Q.terminated&&!Q.abort.signal.aborted&&Q.listeners.size>0){let X={kind:"failed",reason:"unknown",message:Y instanceof Error?Y.message:"Lifecycle watcher ended unexpectedly"};Q.lastPhase=X,Q.terminated=!0;for(let J of Array.from(Q.listeners))try{J(X)}catch{}}if(Pz.get(Z)===Q)Pz.delete(Z)}}function ZV6(){for(let $ of Pz.values())$.abort.abort();Pz.clear()}var Hn$,iH1,b50,rM6,aM6,Pz;var IX=L(()=>{I3();v6();V31();Xw();l1();C31();mC0();uC0();Hn$=Symbol.for("decocms.sandbox.lifecycle.agent-sandbox-runner"),iH1=Symbol.for("decocms.sandbox.lifecycle.agent-sandbox-inflight"),b50=globalThis;rM6=Symbol.for("decocms.sandbox.lifecycle.shared-lifecycles"),aM6=globalThis,Pz=aM6[rM6]??=new Map});import{sql as QV6}from"kysely";function Bn$($){return $ instanceof Date?$.toISOString():String($)}class oH1{db;vault;constructor($,Z){this.db=$;this.vault=Z}rowToInfo($){return{id:$.id,organizationId:$.organization_id,scope:$.scope,userId:$.user_id,name:$.name,description:$.description,createdBy:$.created_by,createdAt:Bn$($.created_at),updatedBy:$.updated_by,updatedAt:Bn$($.updated_at)}}assertVisible($,Z){if($.scope==="user"&&$.user_id!==Z)throw new zz($.id)}async create($){let Z=c8("sec"),Q=await this.vault.encrypt($.value),Y=new Date,X=await this.db.insertInto("secrets").values({id:Z,organization_id:$.organizationId,scope:$.scope.kind,user_id:$.scope.kind==="user"?$.scope.userId:null,name:$.name,encrypted_value:Q,description:$.description??null,created_by:$.createdBy,created_at:Y,updated_by:$.createdBy,updated_at:Y}).returning(QS0).executeTakeFirstOrThrow();return this.rowToInfo(X)}async update($){let Z=await this.db.selectFrom("secrets").where("id","=",$.id).where("organization_id","=",$.organizationId).select(["id","scope","user_id"]).executeTakeFirst();if(!Z)throw new sK($.id);this.assertVisible(Z,$.callerUserId);let Q={updated_by:$.updatedBy,updated_at:new Date};if($.value!==void 0)Q.encrypted_value=await this.vault.encrypt($.value);if($.description!==void 0)Q.description=$.description;let Y=await this.db.updateTable("secrets").set(Q).where("id","=",$.id).where("organization_id","=",$.organizationId).returning(QS0).executeTakeFirstOrThrow();return this.rowToInfo(Y)}async delete($,Z,Q){let Y=await this.db.selectFrom("secrets").where("id","=",$).where("organization_id","=",Z).select(["id","scope","user_id"]).executeTakeFirst();if(!Y)throw new sK($);this.assertVisible(Y,Q),await this.db.deleteFrom("secrets").where("id","=",$).where("organization_id","=",Z).execute()}async list($){let Z=this.db.selectFrom("secrets").where("organization_id","=",$.organizationId).select(QS0);if($.scope?.kind==="user")Z=Z.where("scope","=","user").where("user_id","=",$.scope.userId);else if($.scope?.kind==="organization")Z=Z.where("scope","=","organization");else Z=Z.where((Y)=>Y.or([Y("scope","=","organization"),Y.and([Y("scope","=","user"),Y("user_id","=",$.callerUserId)])]));return(await Z.orderBy("created_at","desc").execute()).map((Y)=>this.rowToInfo(Y))}async findById($,Z,Q){let Y=await this.db.selectFrom("secrets").where("id","=",$).where("organization_id","=",Z).select(QS0).executeTakeFirst();if(!Y)throw new sK($);return this.assertVisible(Y,Q),this.rowToInfo(Y)}async resolveById($,Z,Q){let Y=await this.db.selectFrom("secrets").where("id","=",$).where("organization_id","=",Z).selectAll().executeTakeFirst();if(!Y)throw new sK($);this.assertVisible(Y,Q);let X=await this.vault.decrypt(Y.encrypted_value);return{info:this.rowToInfo(Y),value:X}}async resolveByName($){let Z=this.db.selectFrom("secrets").where("organization_id","=",$.organizationId).where("scope","=",$.scope.kind).where(QV6`lower(name) = lower(${$.name})`).selectAll();if($.scope.kind==="user")Z=Z.where("user_id","=",$.scope.userId);let Q=await Z.executeTakeFirst();if(!Q)throw new sK(`${$.scope.kind}:${$.name}`);let Y=await this.vault.decrypt(Q.encrypted_value);return{info:this.rowToInfo(Q),value:Y}}}var QS0,sK,zz;var y50=L(()=>{XY();QS0=["id","organization_id","scope","user_id","name","description","created_by","created_at","updated_by","updated_at"];sK=class sK extends Error{constructor($){super(`Secret ${$} not found`);this.name="SecretNotFoundError"}};zz=class zz extends Error{constructor($){super(`Access denied for secret ${$}`);this.name="SecretAccessDeniedError"}}});async function YS0({ctx:$,orgId:Z,userId:Q,entries:Y}){if(!Y||Y.length===0)return[];let X=[];for(let J of Y)try{let{value:G}=await $.storage.secrets.resolveById(J.secretId,Z,Q);X.push({host:J.host,token:G})}catch(G){if(G instanceof sK||G instanceof zz){console.warn(`[SANDBOX_START] skipping submodule credential for ${J.host}: ${G.message}. Re-link or recreate the secret to restore.`);continue}throw G}return X}var sH1=L(()=>{y50()});function h5($){if(!$||typeof $!=="object")return{};let Z=$.sandboxMap;if(!Z||typeof Z!=="object")return{};return Z}function CY($,Z,Q){let Y=$[Z]?.[Q];if(!Y)return null;return yD(Y)[kY]??null}function g50($,Z,Q,Y){let J={...yD($[Z]?.[Q]),[kY]:Y};return{...$,[Z]:{...$[Z]??{},[Q]:J}}}async function Dn$($,Z,Q,Y,X,J){let G=await $.findById(Z);if(!G)return;let W=G.metadata??{},K=g50(h5(W),Y,X,J);await $.update(Z,Q,{metadata:{...W,sandboxMap:K}})}function rH1($,Z,Q){let Y=yD($[Z]?.[Q]);if(!Y[kY])return null;let X={...Y};delete X[kY];let J={...$[Z]??{}};if(Object.keys(X).length===0)delete J[Q];else J[Q]=X;let G={...$};if(Object.keys(J).length===0)delete G[Z];else G[Z]=J;return G}async function FO($,Z,Q,Y,X){let J=await $.findById(Z);if(!J)return;let G=J.metadata??{},W=rH1(h5(G),Y,X);if(!W)return;await $.update(Z,Q,{metadata:{...G,sandboxMap:W}})}var kY="agent-sandbox";var kX=L(()=>{q8()});function wh($){return["openai-compatible","openrouter","deco"].includes($)}function Ln$($,Z){return wh($)&&h50(Z)!==null}function h50($){let Z=$.replace(/^openai\//,"");return/^(gpt-\d|o[134](?:-|$))/.test(Z)?Z:null}var UO="codex-subscription",XS0="gpt-6.1-sol";function On$($,Z){return YV6[$]?.test(Z)??!1}var YV6;var jn$=L(()=>{YV6={anthropic:/^claude-/,openrouter:/^anthropic\/claude-/,deco:/^anthropic\/claude-/}});function JS0($){return $===UO||$===bn||$===nF}function wn$($=bn){let Z=aH1.anthropic.chat;return{credentialId:$,thinking:{id:Z,title:Z,provider:"anthropic"}}}function WV6($){let Z=$.replace(/^anthropic\//,"");if(!Z.startsWith("claude-"))return null;return Z.replace(/-(\d+)-(\d+)$/,"-$1.$2")}function En$($){if($==="reviewer")return"reviewer";if($==="conflict")return"conflict";return"default"}function eH1($,Z="default",Q){let{providerId:Y,apiKey:X,baseUrl:J}=$,G=(H)=>Z==="chat"&&Q&&On$(H==="anthropic"?H:Y,Q)?Q:aH1[H][Z],W=HV6[Z],K={CLAUDE_CODE_MAX_OUTPUT_TOKENS:`${KV6}`,CLAUDE_CODE_MAX_TURNS:W===null?null:`${W}`,ENABLE_TOOL_SEARCH:FV6,FORCE_PROMPT_CACHING_5M:UV6,ANTHROPIC_CUSTOM_HEADERS:null};if(Y==="anthropic")return{...K,CLAUDE_CODE_MODEL:G("anthropic"),ANTHROPIC_API_KEY:X,ANTHROPIC_AUTH_TOKEN:null,CLAUDE_CODE_OAUTH_TOKEN:null,ANTHROPIC_BASE_URL:J??null};if(Y===bn)return{...K,CLAUDE_CODE_MODEL:G("anthropic"),CLAUDE_CODE_OAUTH_TOKEN:X,ANTHROPIC_API_KEY:null,ANTHROPIC_AUTH_TOKEN:null,ANTHROPIC_BASE_URL:null};if(Y==="openrouter"||Y==="deco")return{...K,CLAUDE_CODE_MODEL:G("openrouter"),ANTHROPIC_API_KEY:"",ANTHROPIC_AUTH_TOKEN:X,CLAUDE_CODE_OAUTH_TOKEN:null,ANTHROPIC_BASE_URL:J??XV6};if(Y===nF){let H=Z==="chat"&&Q?WV6(Q):null;return{...K,CLAUDE_CODE_MODEL:H??aH1.copilot[Z],ANTHROPIC_API_KEY:"",ANTHROPIC_AUTH_TOKEN:X,CLAUDE_CODE_OAUTH_TOKEN:null,ANTHROPIC_BASE_URL:JV6,ANTHROPIC_CUSTOM_HEADERS:GV6}}throw new Pn$(Y)}var bn="claude-subscription",nF="github-copilot",XV6="https://openrouter.ai/api",JV6="https://api.githubcopilot.com",GV6="Copilot-Integration-Id: copilot-developer-cli",aH1,GS0="claudeCodeModelClass",xn="taskRunInstructions",KV6=32000,HV6,FV6="1",UV6="1",Pn$;var wB=L(()=>{jn$();aH1={anthropic:{default:"claude-opus-5-5",chat:"claude-sonnet-5-5",reviewer:"claude-sonnet-5-5",conflict:"claude-sonnet-5"},openrouter:{default:"anthropic/claude-opus-5.5",chat:"anthropic/claude-sonnet-5.5",reviewer:"anthropic/claude-sonnet-5.5",conflict:"anthropic/claude-sonnet-5"},copilot:{default:"claude-sonnet-5.5",chat:"claude-sonnet-5.5",reviewer:"claude-sonnet-5.5",conflict:"claude-sonnet-5"}};HV6={default:null,chat:null,reviewer:60,conflict:60};Pn$=class Pn$ extends Error{constructor($){super(`the claude-code harness needs an Anthropic, OpenRouter, Deco or GitHub Copilot model credential; this run's model resolves to "${$}". Point the agent's thinking model at one of those, or run it with Decopilot.`);this.name="UnsupportedClaudeCodeProviderError"}}});async function WS0($,Z,Q,Y="claude-code"){if(Y==="codex"){let G=await $.storage.codexSubscriptions.findLiveToken(Q).catch(()=>null);return G?{providerId:UO,apiKey:G}:null}let J=[...(await $.storage.orgSharedPlans.list(Z)).map(({providerId:G,userId:W})=>({providerId:G,userId:W})),...NV6.map((G)=>({providerId:G,userId:Q}))];for(let G of J){let W=await BV6($,G.providerId).findLiveToken(G.userId).catch((K)=>{return console.warn(`[plan] ${G.providerId} lookup failed`,K),null});if(W)return{providerId:G.providerId,apiKey:W}}return null}var NV6,BV6=($,Z)=>Z===bn?$.storage.claudeSubscriptions:$.storage.githubCopilotSubscriptions;var $F1=L(()=>{wB();NV6=[bn,nF]});function An$($){if(NO.size>=500){let Q=NO.keys().next().value;if(Q!==void 0)NO.delete(Q)}let Z=Date.now();NO.delete($),NO.set($,{t0:Z,last:Z,stages:[]}),console.log(`[turn-latency] thread=${$} stage=post-received +0ms`)}function bQ($,Z,Q){let Y=zn$($),X=Date.now(),J=NO.get(Y),G=!J;if(!J)J={t0:X,last:X,stages:[]},NO.set(Y,J);let W=X-J.t0,K=X-J.last;J.last=X,J.stages.push(`${Z}=${K}`),console.log(`[turn-latency] thread=${Y} stage=${Z} +${W}ms (\u0394${K}ms)`+(G?" t0=local":"")+(Q?` ${JSON.stringify(Q)}`:""))}function Tn$($,Z){let Q=zn$($);bQ(Q,"first-token",Z);let Y=NO.get(Q);if(!Y)return;NO.delete(Q),console.log(`[turn-latency] thread=${Q} SUMMARY ttft=${Y.last-Y.t0}ms ${Y.stages.join(" ")}`)}var NO,zn$=($)=>$.split(":")[0]??$;var fn=L(()=>{NO=globalThis.__turnLatency??=new Map});function DV6($){return(typeof $.timeout==="number"&&$.timeout>0?Math.min($.timeout,120000):30000)+15000}function LV6($,Z){if($.aborted)return Z.catch(()=>{}),Promise.reject($.reason??Error("aborted"));return new Promise((Q,Y)=>{let X=()=>{Z.catch(()=>{}),Y($.reason??Error("aborted"))};$.addEventListener("abort",X,{once:!0}),Z.then(Q,Y).finally(()=>{$.removeEventListener("abort",X)})})}async function OV6($,Z,Q,Y,X){let J=X?.timeoutMs??DV6(Y),G=AbortSignal.timeout(J),W=X?.signal?AbortSignal.any([X.signal,G]):G,K,H;try{let U=new Headers({"content-type":"application/json"});if(X?.threadId)U.set("x-thread-id",X.threadId);let N={method:"POST",headers:U,body:JSON.stringify(Y),signal:W};({res:K,rawText:H}=await LV6(W,(async()=>{let B=await $.proxyDaemonRequest(Z,Q,N);return{res:B,rawText:await B.text()}})()))}catch(U){if(X?.signal?.aborted)throw U;if(G.aborted)throw Error(`Sandbox POST ${Q} timed out after ${Math.round(J/1000)}s \u2014 the sandbox may be overloaded or its filesystem stalled. Retry, or use a smaller operation.`);throw new u50(U)}let F;try{F=JSON.parse(H)}catch{console.error("[sandbox-fs-hooks] Failed to parse JSON response provider=agent-sandbox path=%s status=%d rawText=%s",Q,K.status,H.slice(0,2000));let U=K.status>=500?" (server error)":K.status===0?" (no response)":"";throw Error(`Daemon ${Q} returned invalid JSON (HTTP ${K.status}${U}): ${H.slice(0,800)}`)}if(!K.ok){console.error("[sandbox-fs-hooks] Non-OK response provider=agent-sandbox path=%s status=%d body=%s",Q,K.status,H.slice(0,2000));let U=F.error??`Daemon ${Q} failed (${K.status})`;if(K.status===404&&U==="sandbox not found")throw new u50(Error(U),!0);throw Error(U)}return F}function ZF1($,Z){let{ensureHandle:Q,invalidateHandle:Y,canAutoRestart:X}=Z,J=0,G=(H)=>{let F=Date.now();if(F-J<300000)return;J=F,$.renewTtl(H).catch((U)=>{console.warn(`[sandbox-fs-hooks] TTL renew failed for ${H}: ${U instanceof Error?U.message:String(U)}`)})},W=(H)=>{let F=H instanceof Error?H.message:String(H);return X?`Sandbox is unreachable and auto-restart did not recover it: ${F}`:"The sandbox is not running. Ask the user to start it by clicking the server button (left side of the header bar)."},K=async(H,F,U)=>{let N=async(D)=>OV6($,D,H,F,{signal:U,timeoutMs:Z.opTimeoutMs,threadId:Z.threadId}),B=await Q();G(B);try{return await N(B)}catch(D){if(!(D instanceof u50))throw D;if(!X&&!D.gone)throw Error(W(D.cause??D));console.warn(`[sandbox-fs-hooks] daemon ${H} unreachable \u2014 reaping sandbox and retrying once`,D.cause??D);try{await Y({force:D.gone})}catch(j){console.warn("[sandbox-fs-hooks] invalidateHandle failed",j)}let O;try{O=await Q()}catch(j){throw Error(`Failed to restart sandbox: ${j instanceof Error?j.message:String(j)}`)}try{return await N(O)}catch(j){if(j instanceof u50)throw Error(W(j.cause??j));throw j}}};return{onProxy:(H,F,U)=>K(H,F,U),onBash:async(H,F)=>{return await K("/_sandbox/bash",{command:H,...F?.cwd!==void 0?{cwd:F.cwd}:{},...F?.timeoutMs!==void 0?{timeout:F.timeoutMs}:{}})}}}var u50;var qn$=L(()=>{u50=class u50 extends Error{code="DAEMON_UNREACHABLE";gone;constructor($,Z=!1){super($ instanceof Error?$.message:"Daemon proxy failed");if(this.gone=Z,$ instanceof Error)this.cause=$}}});var yn=L(()=>{An();oC0();qn$()});function l50($){let Z=new Set($.map((F)=>F.name.toLowerCase()).filter((F,U,N)=>N.indexOf(F)!==U)),Q=$.map((F)=>Z.has(F.name.toLowerCase())),Y=(F)=>{let U=$[F];return QF1(Q[F]?`${U.owner}-${U.name}`:U.name).toLowerCase()};for(let F=0;F<$.length;F++){let U=new Map,N=!1;for(let B=0;B<$.length;B++){let D=Y(B),O=U.get(D);if(O!==void 0){if(!Q[B])Q[B]=!0,N=!0;if(!Q[O])Q[O]=!0,N=!0}U.set(D,B)}if(!N)break}let X=$.map((F,U)=>QF1(Q[U]?`${F.owner}-${F.name}`:F.name)),J=new Map;for(let F of X)J.set(F.toLowerCase(),(J.get(F.toLowerCase())??0)+1);let G=X.map((F,U)=>{if(J.get(F.toLowerCase())===1)return F;let N=new URL($[U].url).host;return QF1(`${N}-${F}`)}),W=new Map;for(let F of G)W.set(F.toLowerCase(),(W.get(F.toLowerCase())??0)+1);let K=new Set(G.filter((F)=>W.get(F.toLowerCase())===1).map((F)=>F.toLowerCase())),H=G.map((F,U)=>U).filter((F)=>W.get(G[F].toLowerCase())!==1).sort((F,U)=>(ra($[F])??"").localeCompare(ra($[U])??""));for(let F of H){let U=G[F],N=1,B=`${U}-${N}`;while(K.has(B.toLowerCase()))B=`${U}-${++N}`;K.add(B.toLowerCase()),G[F]=B}return G}function Rn$($,Z){let Q=$.findIndex((Y)=>mD(Y,Z));return Q===-1?null:l50($)[Q]??null}function QF1($){return $.replace(/[^A-Za-z0-9._-]/g,"-").replace(/^[^A-Za-z0-9]+/,"")||"repo"}var YF1=()=>{};var c50;var XF1=L(()=>{c50={npm:{install:"npm install",run:($)=>`npm run ${$}`,runtime:"node"},pnpm:{install:"pnpm install",run:($)=>`pnpm run ${$}`,runtime:"node"},yarn:{install:"yarn install",run:($)=>`yarn run ${$}`,runtime:"node"},bun:{install:"bun install",run:($)=>`bun run ${$}`,runtime:"bun"},deno:{install:"deno install",run:($)=>`deno task ${$}`,runtime:"deno"}}});function gn($){if(!$)return null;let Z=$.runtime;if(!Z||typeof Z!=="object")return null;let Q=Z.env;if(!Array.isArray(Q))return null;let Y=[];for(let X of Q){if(!X||typeof X!=="object")continue;let J=X;if(typeof J.key!=="string"||!P30.test(J.key))continue;if(J.kind==="literal"&&typeof J.value==="string"){Y.push({key:J.key,kind:"literal",value:J.value});continue}if(J.kind==="secret"&&typeof J.secretId==="string"&&J.secretId.length>0)Y.push({key:J.key,kind:"secret",secretId:J.secretId})}return Y.length===0?null:Y}async function Mn$($,Z){n(Z);let Q=Q0(Z);await Z.access.check();let Y=_0(Z);if(!Y)throw Error("User ID required");let X=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!X||X.organization_id!==Q.id)throw Error("Virtual MCP not found");let J=X.metadata??{},G=h5(J),W=await Az(Z,$.branch,Y),K=CY(G,W,$.branch);return{virtualMcp:X,metadata:J,userId:Y,sandboxUserId:W,entry:K,organization:Q}}function jV6($){if($===null||!/^\d+$/.test($))return null;let Z=Number($);return Z>=1&&Z<=65535?$:null}function Vn$($){let Z=$.runtime??null,Y=Z?.selected??null,X=jV6(Z?.port??null),J=Z?.path??null;if(!Y||!(Y in c50))return{packageManager:null,runtime:null,port:X,packageManagerPath:J,runtimeBinPath:null};let G=c50[Y].runtime;return{packageManager:Y,runtime:G,port:X,packageManagerPath:J,runtimeBinPath:G==="deno"?"/opt/deno/bin":G==="bun"?"/opt/bun/bin":null}}var m50=L(()=>{q8();XF1();kX();xQ()});async function KS0({ctx:$,runner:Z,handle:Q,orgId:Y,userId:X,entries:J}){if(!J||J.length===0)return;let G={};for(let K of J){if(K.kind==="literal"){G[K.key]=K.value;continue}try{let{value:H}=await $.storage.secrets.resolveById(K.secretId,Y,X);G[K.key]=H}catch(H){if(H instanceof sK||H instanceof zz){console.warn(`[SANDBOX_START] skipping env ${K.key}: ${H.message}. Re-link or recreate the secret to restore.`);continue}throw H}}if(Object.keys(G).length===0)return;let W=await Z.proxyDaemonRequest(Q,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({env:G})});if(!W.ok){let K=await aP(W,wV6).catch(()=>W.statusText);console.warn(`[SANDBOX_START] daemon rejected env patch (${W.status}): ${K}`)}}var wV6=10485760;var JF1=L(()=>{y50();u60()});async function Cn$($,Z,Q,Y,X){let J=await qJ({connectionId:$,tokenStorage:new a5(Y,X)});if(!J.accessToken)return null;return _n$(Z,Q,J.accessToken)}function Sn$($,Z){return _n$($,Z,null)}async function _n$($,Z,Q){let Y=new Map,X=new Set(In$.map((K)=>K.path));for(let K of Object.values(kn$))for(let H of K??[])X.add(H);await Promise.all(Array.from(X).map(async(K)=>{Y.set(K,await PV6($,Z,K,Q))}));let J=In$.find(({path:K})=>Y.get(K)!==null);if(!J)return null;let G=kn$[J.pm]??[],W=null;for(let K of G)if(W=zV6(Y.get(K)??null),W)break;return{packageManager:J.pm,devPort:W}}async function PV6($,Z,Q,Y){let X=`https://api.github.com/repos/${$}/${Z}/contents/${encodeURIComponent(Q)}`;try{let J={Accept:"application/vnd.github+json","User-Agent":"studio-runtime-detect"};if(Y)J.Authorization=`token ${Y}`;let G=await fetch(X,{headers:J,signal:AbortSignal.timeout(5000)});if(!G.ok)return null;let W=await G.json();if(!W.content||W.encoding!=="base64")return null;return Buffer.from(W.content,"base64").toString("utf8")}catch{return null}}function zV6($){if(!$)return null;try{let Z=JSON.parse($),Q=Z.tasks??Z.scripts??{},X=(Q.dev??Q.start??"").match(EV6)?.[1]??null;if(!X)return null;let J=Number(X);return J>=1&&J<=65535?X:null}catch{return null}}var In$,kn$,EV6;var vn$=L(()=>{n3();vK();In$=[{path:"deno.json",pm:"deno"},{path:"deno.jsonc",pm:"deno"},{path:"bun.lock",pm:"bun"},{path:"bunfig.toml",pm:"bun"},{path:"pnpm-lock.yaml",pm:"pnpm"},{path:"yarn.lock",pm:"yarn"},{path:"package-lock.json",pm:"npm"},{path:"package.json",pm:"bun"}],kn$={deno:["deno.json","deno.jsonc"],bun:["package.json"],pnpm:["package.json"],yarn:["package.json"],npm:["package.json"]},EV6=/(?:--port|PORT=|:)(\d{4,5})/});function AV6($){return($??"").normalize("NFKD").replace(/[\u0300-\u036F]/g,"").toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")||"user"}function HS0($){return $?.name||$?.email?.split("@")[0]||void 0}function FS0($){let Z=AV6($),Q=Date.now().toString(36).split("").reverse().join("");return`${Z}-${Q}`}async function fn$($,Z){bn$??=G$.createHistogram("studio.sandbox.provision.duration_ms",{description:"Wall-clock time of one sandbox ensure, by provider (runner_kind), outcome, the provider a fallback left (fallback_from), whether a warm-pool pod was claimed (warm_pool), and whether a sandbox was already recorded (start=resume) or not (start=fresh).",unit:"ms",advice:{explicitBucketBoundaries:[500,1000,2000,5000,1e4,20000,30000,60000,120000,300000,600000]}}),xn$??=G$.createCounter("studio.sandbox.placement",{description:"Sandbox ensures by the provider that served them (runner_kind) and why it was chosen (reason)."});let Q=performance.now(),Y=(X,J,G={})=>bn$?.record(performance.now()-Q,{...$,runner_kind:X?HO[X]:"unknown",outcome:J,...G});try{let X=await Z(),J=X.placement?.fallbackFrom;if(Y(X.provider,"ok",{warm_pool:String(X.warmPoolAdopted),...J&&{fallback_from:HO[J]}}),X.placement)xn$.add(1,{runner_kind:HO[X.provider],reason:X.placement.reason});return X}catch(X){throw Y(uH1(X),"error"),X}}var bn$,xn$;var yn$=L(()=>{yn();v6()});async function d50($,Z,Q){try{await $.storage.threads.stampRuntimeIfAbsent(Z,Q)}catch(Y){console.warn(`[stampRuntimeIfAbsent] ${Z}: ${Y instanceof Error?Y.message:String(Y)}`)}}function Eh($){return $==="cms"||$==="sandbox"?$:null}function TV6($){return!!BP($)&&(NP($)||$?.fastPreview===!0)}function US0($){return TV6($)?"cms":"sandbox"}var GF1;var hn=L(()=>{oi();GF1=["cms","sandbox"]});async function WF1($,Z){n(Z);let Q=Q0(Z),Y=_0(Z);if(!Y)throw Error("User ID required");let X=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!X||X.organization_id!==Q.id)throw Error("Virtual MCP not found");let J=X.metadata??{},G=await Az(Z,$.branch,Y),W=SY($.branch)??Z.metadata?.threadId,K=CY(h5(J),G,$.branch),H=K??(W?CY(await un(Z,W),G,$.branch):null);return{organization:Q,userId:Y,metadata:J,sandboxUserId:G,recordThreadId:W,agentEntry:K,existing:H}}async function gn$($,Z){return(await WF1($,Z)).existing}var KF1=L(()=>{kX();xQ()});import{z as EB}from"zod";async function PB($,Z){let{organization:Q,userId:Y,metadata:X,sandboxUserId:J,recordThreadId:G,agentEntry:W,existing:K}=await WF1($,Z),H=await LZ(Z);if(K&&!$.revalidate){if(await H.alive(K.sandboxHandle).catch(()=>!0))return K;if(W)await FO(Z.storage.virtualMcps,$.virtualMcpId,Y,J,$.branch).catch((j)=>{console.warn("[ensureSandbox] failed to reap stale entry",j)});else if(G)await BS0(Z,G,J,$.branch)}let F=SY($.branch)??Z.metadata?.threadId;if(F)d50(Z,F,"sandbox");let N=await zB(Z,F)??X.repository??null;await $.onColdStart?.().catch((O)=>{console.warn("[ensureSandbox] onColdStart callback failed",O instanceof Error?O.message:String(O))});let{entry:B,warmPoolAdopted:D}=await ln$({ctx:Z,userId:Y,sandboxUserId:J,orgId:Q.id,virtualMcpId:$.virtualMcpId,branch:$.branch,metadata:X,repository:N,threadRepos:await FF1(Z,F),existing:$.revalidate?K:null,runner:H,...$.purpose?{purpose:$.purpose}:{}});return $.onBound?.({warmPoolAdopted:D}),B}async function un$($,Z,Q){if(!Z)return null;if(Z.accountId===null&&!Q&&!Z.legacyConnectionId)return Z;return await uL($.storage,Z)?Z:null}async function qV6($){let Z=$.repos.filter((X)=>!$.primary||!mD(X,$.primary)),Q=l50(Z),Y=[];for(let[X,J]of Z.entries())try{let G=await nN($.ctx.storage,$.orgId,J),W=await un$($.ctx,G,J.connectionId),K=J.connectionId??G?.legacyConnectionId;if(!W&&!K)continue;let{cloneUrl:H,expiresAt:F}=W?await pN($.ctx,W,{forceRefresh:!0}):await KB(K,J.owner,J.name,$.ctx.db,$.ctx.vault);Y.push({cloneUrl:H,credentialExpiresAt:eK1(F),...W?{repositoryId:W.id}:{connectionId:K},userName:$.gitUserName,userEmail:$.gitUserEmail,displayName:W?W.path:`${J.owner}/${J.name}`,directoryName:Q[X],submoduleCredentials:$.submoduleCredentials})}catch(G){console.warn(`[provisionSandbox] skipping secondary ${J.owner}/${J.name}:`,G instanceof Error?G.message:G)}return Y}async function ln$($){let{ctx:Z,userId:Q,sandboxUserId:Y,orgId:X,virtualMcpId:J,branch:G,metadata:W,threadRepos:K,existing:H,runner:F,purpose:U,provider:N}=$,B=SY(G)??Z.metadata?.threadId,D=(X0)=>B&&bQ(B,`provision:${X0}`),O=U==="harness-run",j="default",w=$.repository?await RV6({ctx:Z,orgId:X,virtualMcpId:J,userId:Q,repository:$.repository}):null,{runtime:E,packageManager:P,port:T,packageManagerPath:z}=Vn$(W),A=await Z.storage.organizationSettings.get(X),R=await YS0({ctx:Z,orgId:X,userId:Q,entries:A?.submodule_credentials}),f;if(w){let X0=await nN(Z.storage,X,w);j=X0?.sandboxImage??"default";let h0=await un$(Z,X0,w.connectionId),C0=w.connectionId??X0?.legacyConnectionId??void 0;if(!h0&&C0)await Zn({ctx:Z,connectionId:C0,organizationId:X,forceRefresh:!0,onLegacyMintError:(o0)=>{console.error("[provisionSandbox] repo-scoped legacy token mint failed",{connectionId:C0,error:o0.message})}});let{cloneUrl:H1,gitUserName:c0,gitUserEmail:j0,expiresAt:E0}=h0?await CV6(Z,h0):C0?await KB(C0,w.owner,w.name,Z.db,Z.vault):Sf$(w.owner,w.name);if(!P&&!h0){let o0=C0?await Cn$(C0,w.owner,w.name,Z.db,Z.vault):await Sn$(w.owner,w.name);if(o0)P=o0.packageManager,E=c50[o0.packageManager].runtime,T=o0.devPort??T,await MV6(Z,J,Q,o0.packageManager,o0.devPort)}let n0=B0().sandboxStickyHeadRefEnabled,O1=$j0({branch:G,derivedRef:tF(G,{flat:zh(X0?.provider)}),recordedHeadRef:n0?await NS0(Z,SY(G)):null,sticky:n0});f={cloneUrl:H1,credentialExpiresAt:eK1(E0),...h0?{repositoryId:h0.id}:C0?{connectionId:C0}:{},userName:c0,userEmail:j0,branch:O1,displayName:h0?h0.path:`${w.owner}/${w.name}`,submoduleCredentials:R}}let S=await qV6({ctx:Z,orgId:X,repos:K??[],primary:w,gitUserName:f?.userName??"",gitUserEmail:f?.userEmail??"",submoduleCredentials:R}),V=E&&P&&!O?{runtime:E,packageManager:P,...T!==null?{devPort:Number(T)}:{},...z?{packageManagerPath:z}:{}}:void 0,v=T50({orgId:X,virtualMcpId:J,branch:G}),b=!B0().orgFsMountsDisabled,h;if(b){let X0=Z.organization?.slug??(await Z.db.selectFrom("organization").select(["slug"]).where("id","=",X).executeTakeFirst())?.slug;if(X0)h=await Gj0(Z,{orgSlug:X0,orgId:X,baseUrl:N5()})}let l=await fn$({start:H?"resume":"fresh",purpose:U??"interactive"},async()=>{return D("prep"),await kV6(F),D("capacity"),IV6(F,{userId:Y,projectRef:v},{branch:G,repo:f,extraRepos:S,workload:V,cloneOnly:O,...U9(A?.flags,"sandbox_repo_snapshots")?{repoSnapshot:!0}:{},...U?{purpose:U}:{},...N?{provider:N}:{},...j!=="default"?{sandboxImage:j}:{},tenant:{orgId:X,userId:Y,...Z.organization?.slug?{orgSlug:Z.organization.slug}:{},...Z.organization?.name?{orgName:Z.organization.name}:{},...Z.auth.user?.email?{userEmail:Z.auth.user.email}:{},...Z.auth.user?.name?{userName:Z.auth.user.name}:{}},...h?{orgFsConfigJson:h}:{}})});D("provider-ensure");let d=gn(W);await KS0({ctx:Z,runner:F,handle:l.handle,orgId:X,userId:Q,entries:d}),D("env");let I0=!!H&&H.sandboxHandle===l.handle&&H?.createdAt?H.createdAt:Date.now(),J0=W.runtime?.selected??null,U0=W.runtime?.port??null,o=W.runtime?.path??null,t={sandboxHandle:l.handle,previewUrl:l.previewUrl,createdAt:I0,startedWith:{packageManager:J0,port:U0,path:o}};await Dn$(Z.storage.virtualMcps,J,Q,Y,G,t);let r=SY(G)??Z.metadata?.threadId;if(r)await cn$(Z,r,Y,G,t);D("map-writes");let $0=!H||H.sandboxHandle!==l.handle;return{entry:t,isNewVm:$0,warmPoolAdopted:l.warmPoolAdopted}}async function RV6($){let{ctx:Z,orgId:Q,virtualMcpId:Y,userId:X,repository:J}=$;if(!J.connectionId)return J;if(await Z.storage.connections.findById(J.connectionId,Q))return J;let{items:W}=await Z.storage.connections.list(Q),K=SB0(W,J.owner,J.name);if(!K)return console.warn("[provisionSandbox] recorded repo connection no longer exists and no live connection covers the repo",{virtualMcpId:Y,connectionId:J.connectionId}),J;console.warn("[provisionSandbox] healed dangling repo connection",{virtualMcpId:Y,staleConnectionId:J.connectionId,connectionId:K.id});try{let F=(await Z.storage.virtualMcps.findById(Y))?.metadata??{},U=F.repository;if(U?.connectionId===J.connectionId){let N=FZ(K);await Z.storage.virtualMcps.update(Y,X,{metadata:{...F,repository:{...U,connectionId:K.id,...N?{installationId:N.installationId}:{}}}})}}catch(H){console.warn("[provisionSandbox] failed to persist healed repo connection",{virtualMcpId:Y,error:H.message})}return{...J,connectionId:K.id}}async function MV6($,Z,Q,Y,X){let J=await $.storage.virtualMcps.findById(Z);if(!J)return;let G=J.metadata??{};await $.storage.virtualMcps.update(Z,Q,{metadata:{...G,runtime:{selected:Y,port:X}}})}async function IV6($,...Z){try{return await $.ensure(...Z)}catch(Q){if(!(Q instanceof IY))throw Q;throw Error(`sandbox provisioning failed: the sandbox pod rejected the bootstrap handshake (HTTP ${Q.status}). The claim was released; retrying gets a different pod.`,{cause:Q})}}async function kV6($){let Z=Date.now()+hn$,Q=!1;while(!await $.hasSchedulableCapacity()){if(Date.now()>=Z)throw Error(`sandbox provisioning failed: the cluster has had no room to schedule another sandbox for ${Math.round(hn$/1000)}s`);if(!Q)Q=!0,console.warn("[ensureSandbox] waiting for cluster capacity \u2014 a sandbox pod cannot be scheduled right now");await J$(VV6)}}async function CV6($,Z){try{return await pN($,Z,{forceRefresh:!0})}catch(Q){if(Q instanceof y0){let Y=Q.status===404?VR.githubConnectionMissing:VR.githubNotAuthenticated;throw Error(l60(Y,Q.message))}throw Q}}var HF1,hn$=150000,VV6=5000;var Ph=L(()=>{fn();kZ();yn();Fh();YF1();n$();R0();m50();JF1();sH1();kX();SG();c60();vn$();XF1();IX();yn$();hn();xQ();Zj0();l1();K9();UB();kX();KF1();A5();C5();mC0();dO0();HF1=u({name:"SANDBOX_START",description:"Start a sandbox with the connected repository and dev server.",annotations:{title:"Start VM Preview",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:EB.object({virtualMcpId:EB.string().describe("Virtual MCP ID"),branch:EB.string().min(1).optional().describe("Git branch to check out. Pass the thread's branch whenever the caller has one: when omitted the handler mints a fresh `<user-slug>-<timestamp>` name, which becomes a SEPARATE sandbox from the one the thread's own branch resolves to. The resolved branch is returned in the response so callers can persist it."),threadId:EB.string().optional().describe("The session asking for a sandbox. A thread stamped `cms` is refused \u2014 that session reads and writes over the decofile API and a pod would be invisible to it. Optional: an unstamped (legacy) thread is always allowed, and so is a caller with no thread."),provider:EB.enum(["kubernetes","freestyle"]).optional().describe("Where to run a NEW sandbox, when that provider is configured and can run it; otherwise the other one is used. An existing sandbox stays where it is. Omitted: Kubernetes while it has room, else Freestyle.")}),outputSchema:EB.object({previewUrl:EB.string().nullable(),sandboxHandle:EB.string(),branch:EB.string(),isNewVm:EB.boolean()}),handler:async($,Z)=>{n(Z);let Q=Q0(Z);await Z.access.check();let Y=$.branch??FS0(HS0(Z.auth.user)),X=SY(Y)??$.threadId??Z.metadata?.threadId;if(X){let O=await Z.storage.threads.get(X).catch(()=>null);if(Eh(O?.metadata?.runtime)==="cms")throw Error("This chat is a CMS session and does not use a sandbox. Start a coding session to get one.")}let J=_0(Z);if(!J)throw Error("User ID required");let G=await Az(Z,Y,J),W=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!W||W.organization_id!==Q.id)throw Error("Virtual MCP not found");let K=W.metadata??{},H=await LZ(Z),F=CY(h5(K),G,Y),N=await zB(Z,X)??K.repository??null,{entry:B,isNewVm:D}=await ln$({ctx:Z,userId:J,sandboxUserId:G,orgId:Q.id,virtualMcpId:$.virtualMcpId,branch:Y,metadata:K,repository:N,threadRepos:await FF1(Z,X),existing:F,runner:H,...$.provider?{provider:$.provider}:{}});if(X)d50(Z,X,"sandbox");return{...B,branch:Y,isNewVm:D}}})});async function rK($,Z){if(!PU())return!1;try{let Q=await $.storage.organizationSettings.get(Z);return U9(Q?.flags,"chat_harness_sandbox_only")}catch(Q){return console.warn("[sandbox-only-chats] flag read failed",Q),!1}}async function mn$($,Z,Q){if((await $.storage.aiProviderKeys.list({organizationId:Z})).some((X)=>u$$(X.providerId)))return!0;return await i50($,Z,Q)!==null}async function i50($,Z,Q,Y="claude-code"){return(await WS0($,Z,Q,Y))?.providerId??null}async function dn$($,Z){let Q=$.organization?.id;if(!Q)return;let Y=await $.storage.virtualMcps.findById(Z.virtual_mcp_id);if(!Y)return;let X=ME(Y),J=X.metadata?.repository,G=await AB($,{threadId:Z.id,agentRepo:J,runBranch:Z.branch??fJ(Z.id)}),{sandboxHandle:W}=await PB({virtualMcpId:X.id,branch:G,purpose:J?.url?"interactive":"harness-run"},$);await(await LZ($)).proxyDaemonRequest(W,"/_sandbox/prepare",{method:"POST",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({harness:await UF1($,Q),threadId:Z.id})}).then((H)=>{if(!H.ok)console.warn("[sandbox-prewarm] prepare refused",H.status)}).catch((H)=>console.warn("[sandbox-prewarm] prepare failed",H))}async function UF1($,Z){let Q=await $.storage.organizationSettings.get(Z);return U9(Q?.flags,"chat_harness_codex")?"codex":"claude-code"}async function in$($,Z,Q){if(await i50($,Z,Q,"codex"))return!0;return(await $.storage.aiProviderKeys.list({organizationId:Z})).some((X)=>wh(X.providerId))}var DS0;var Ah=L(()=>{$F1();l1();IX();Ph();xQ();VE();kZ();hr0();DS0=class DS0 extends Error{code="claude_code_provider_required";constructor(){super("Chats need an Anthropic, OpenRouter or deco AI Gateway provider, or your own linked Claude or GitHub Copilot plan. Connect one in Settings \u2192 AI Providers.");this.name="ClaudeCodeProviderRequiredError"}}});async function p50($,Z,Q){let Y=$.storage.threads.getOrganizationId();if(!Y||!Z)return null;let X=await(Q??$.storage.virtualMcps.findById(Z,Y));return X?.organization_id===Y?X.metadata??null:null}function fJ($,Z){return Z?`thread:${$}/${Z}`:`thread:${$}`}function tF($,Z={}){let Q=$.replace(/^thread:/,"").replace(/\//g,"-");return Z.flat?`sandbox-thread-${Q}`:`sandbox/thread-${Q}`}function zh($){return $==="gitlab"}async function NF1($,Z,Q){if(!Q)return tF(Z);return tF(Z,{flat:zh(await SV6($,Q))})}async function SV6($,Z){let Q=typeof Z.url==="string"?DX(Z.url)?.provider:void 0;if(Q)return Q;let Y=$.storage.threads.getOrganizationId();if(!Z.repositoryId||!Y)return null;return(await $.storage.repositories.get(Z.repositoryId,Y).catch(()=>null))?.provider??null}function SY($){if(!$||!$.startsWith("thread:"))return null;return $.slice(7).split("/")[0]||null}async function Az($,Z,Q){return DF1(await BF1($,Z),Q)}async function BF1($,Z){let Q=SY(Z);if(!Q)return null;return await $.storage.threads.get(Q).catch(()=>null)}function DF1($,Z){return $?.created_by??Z}async function Tz($,Z){if(!Z)return null;let Q=await $.storage.threads.get(Z).catch(()=>null);if(!Q)return null;return Q.metadata??{}}async function NS0($,Z){let Y=(await Tz($,Z))?.headRef;return typeof Y==="string"&&Y.length>0?Y:null}async function pn$($,Z,Q){let Y=await Tz($,Z);if(!Y)return;if(Y.headRef===Q)return;await $.storage.threads.update(Z,{metadata:{...Y,headRef:Q}}).catch((X)=>console.warn("[thread-repo] setThreadHeadRef failed",X))}function _V6($,Z){let Q=SB0(Z,$.owner,$.name);if(!Q||Q.id===$.connectionId)return null;let Y=FZ(Q);return{...$,connectionId:Q.id,...Y?.installationId?{installationId:Y.installationId}:{}}}async function FF1($,Z){let Y=(await Tz($,Z))?.additionalRepositories;return Array.isArray(Y)?Y.filter((X)=>X?.owner&&X?.name):[]}async function zB($,Z){let Q=await Tz($,Z),Y=Q?.repository??null;if(!Z||!Q||!Y?.connectionId||Y.repositoryId)return Y;try{let X=$.storage.threads.getOrganizationId();if(!X)return Y;if(await $.storage.connections.findById(Y.connectionId,X))return Y;let{items:J}=await $.storage.connections.list(X),G=_V6(Y,J);if(!G)return Y;return await $.storage.threads.update(Z,{metadata:{...Q,repository:G}}),console.warn("[thread-repo] re-pointed thread at a live repo connection",{threadId:Z,from:Y.connectionId,to:G.connectionId}),G}catch(X){return console.warn("[thread-repo] repoint check failed",X),Y}}function LF1($){if($.pinnedRef)return $.pinnedRef;if($.runBranch&&$.runBranch===fJ($.threadId))return $.runBranch;if($.threadRepo)return fJ($.threadId,$.threadRepo.connectionId);if(!$.agentRepo)return $.sandboxOnlyChats?fJ($.threadId):"ephemeral";return $.runBranch??`thread:${$.threadId}`}async function OF1($,Z){let Y=(await Tz($,Z))?.pinnedRef;return typeof Y==="string"&&Y.length>0?Y:null}async function AB($,Z){let Q=$.storage.threads.getOrganizationId(),[Y,X,J]=await Promise.all([zB($,Z.threadId),OF1($,Z.threadId),Q?rK($,Q):Promise.resolve(!1)]);return LF1({...Z,threadRepo:Y,pinnedRef:X,sandboxOnlyChats:J})}async function cn$($,Z,Q,Y,X){let J=await Tz($,Z);if(!J)return;let G=g50(h5(J),Q,Y,X);await $.storage.threads.update(Z,{metadata:{...J,sandboxMap:G}}).catch((W)=>console.warn("[thread-repo] setThreadSandboxMapEntry failed",W))}async function un($,Z){return h5(await Tz($,Z))}async function BS0($,Z,Q,Y){let X=await Tz($,Z);if(!X)return;let J=rH1(h5(X),Q,Y);if(!J)return;await $.storage.threads.update(Z,{metadata:{...X,sandboxMap:J}}).catch((G)=>console.warn("[thread-repo] removeThreadSandboxMapEntry failed",G))}var xQ=L(()=>{t4();SG();Ah();kX()});import{AsyncLocalStorage as vV6}from"async_hooks";function LS0($){let Z=$?.metadata?.[xn];return typeof Z==="string"&&Z.length>0}function ln(){let $=W7.getStore();if(!$)throw Error("This tool is only available on a thread's MCP endpoint (/api/<org>/mcp/thread/<threadId>).");return $}function OS0($){let Z=n50($);return new Set(Z===tn$?nn$:Z)}function n50($){if($?.metadata?.source==="jira")return xV6;return BG.some((Q)=>LK($?.title,Q))?bV6:tn$}var W7,nn$,bV6,xV6,fV6,tn$;var FW=L(()=>{wB();nw();u8();W7=new vV6;nn$=["TASK_ADD_REPO","TASK_BOARD_ITEM_LIST","TASK_BOARD_ITEM_UPDATE","TASK_BOARD_ACTIVITY_LIST","TASK_BOARD_COMMENT_LIST","TASK_BOARD_COMMENT_CREATE","TASK_BOARD_COMMENT_UPDATE"],bV6=[...nn$,"TASK_BOARD_ITEM_PRS_GET","TASK_BOARD_REVIEW_DECISION"],xV6=["TASK_ADD_REPO","JIRA_ISSUE_GET","JIRA_COMMENT_ADD","JIRA_ISSUE_TRANSITION","JIRA_ATTACHMENT_DOWNLOAD","JIRA_REMOTE_LINK_ADD","JIRA_ISSUE_CREATE","JIRA_ISSUE_SEARCH"],fV6=new Set(["TASK_BOARD_REVIEW_DECISION","TASK_BOARD_PROMOTE_TO_PRODUCTION","TASK_BOARD_PROMPT_UPSERT","TASK_BOARD_PROMPT_DELETE"]),tn$=A00.map(($)=>$.name).filter(($)=>!fV6.has($))});import{z as UW}from"zod";async function uV6($,Z,Q,Y,X){return F8(async()=>{let G=CY(await un($,Z),Q,Y)??(X?CY(h5(await p50($,X)),Q,Y):null);if(!G)throw Error("sandbox record not written yet");return G},{maxAttempts:yV6,minTimeout:gV6,maxTimeout:hV6,jitter:0}).catch(()=>null)}function cV6($,Z,Q=sn$){if($.some((Y)=>mD(Y,Z)))return!1;return $.length>=Q}async function wF1($,Z,Q,Y){let X=await $.proxyDaemonRequest(Z,"/_sandbox/bash",{method:"POST",headers:new Headers({"content-type":"application/json","x-thread-id":Q}),body:JSON.stringify({command:Y})});if(!X.ok)throw Error(`sandbox bash failed (${X.status} ${X.statusText})`);let J=await X.json();return{stdout:J.stdout??"",exitCode:J.exitCode??0}}function rn$($){return`cd ${$} 2>/dev/null || exit 1; if [ -n "$(git ls-files 2>/dev/null | head -1)" ]; then echo __CLONED__; fi; ls -A 2>/dev/null`}async function mV6($,Z,Q,Y){let X=()=>wF1($,Z,Q,rn$(Y)).then((W)=>an$(W.stdout)).catch(()=>null),J=await X();if(!J?.cloned)return!1;await J$(jF1);let G=await X();return!!G?.cloned&&G.listing===J.listing}function an$($){let Z=$.split(`
 `).map((X)=>X.trim()),Q=Z.includes("__CLONED__"),Y=Z.filter((X)=>X&&X!==".git"&&X!=="__CLONED__");return{cloned:Q,listing:Y.join(`
 `)}}function dV6($){return[...$?[`cd ${JSON.stringify($)} || exit 0`]:[],...iV6].join(`
 `)}async function pV6($,Z,Q){if(Q.repository)return pN($,Q.repository,{bufferMs:jS0});return await Zn({ctx:$,connectionId:Q.connectionId,organizationId:Z,forceRefresh:!0,onLegacyMintError:(Y)=>console.error("[TASK_ADD_REPO] legacy repo-scoped mint failed",{connectionId:Q.connectionId,error:Y.message})}),KB(Q.connectionId,Q.owner,Q.name,$.db,$.vault,{bufferMs:jS0})}async function nV6($,Z,Q){let Y=await $.storage.organizationSettings.get(Z);return YS0({ctx:$,orgId:Z,userId:Q,entries:Y?.submodule_credentials})}function tV6($){return{git:{...$.primary?{repository:{...$.primary,submoduleCredentials:$.submoduleCredentials}}:{repositories:$.secondaries??[]},identity:{userName:$.gitUserName,userEmail:$.gitUserEmail}}}}async function oV6($,Z,Q,Y){let X=l50(Q);return(await Promise.all(Q.map(async(G,W)=>{let K=await nN($.storage,Z,G),H=K&&await uL($.storage,K)?K:null;if(!H&&!G.connectionId)return null;try{let{cloneUrl:F}=H?await pN($,H,{bufferMs:jS0}):await KB(G.connectionId,G.owner,G.name,$.db,$.vault,{bufferMs:jS0});return{cloneUrl:F,repoName:X[W],submoduleCredentials:Y}}catch(F){return console.warn(`[TASK_ADD_REPO] skipping secondary ${G.owner}/${G.name}:`,F instanceof Error?F.message:F),null}}))).filter((G)=>G!==null)}var jS0=3300000,yV6=4,gV6=250,hV6=2000,on$=45000,jF1=1500,lV6=5,sn$=20,iV6,EF1;var en$=L(()=>{R0();A5();t60();Zj0();IX();c60();sH1();kX();xQ();n$();YF1();FW();iV6=["origin=$(git remote get-url origin)",'token=$(printf %s "$origin" | sed -n "s|.*://[^:]*:\\([^@]*\\)@.*|\\1|p")','[ -n "$token" ] || exit 0','user=$(printf %s "$origin" | sed -n "s|.*://\\([^:]*\\):.*|\\1|p")','host=$(printf %s "$origin" | sed -n "s|.*@\\([^/]*\\)/.*|\\1|p")','[ -n "$host" ] || exit 0',"umask 077",'if [ "$user" = "oauth2" ]; then','  mkdir -p "${HOME:-/root}/.config/glab-cli"','  printf "hosts:\\n  %s:\\n    token: %s\\n    api_host: %s\\n    api_protocol: https\\n    is_oauth2: true\\n" "$host" "$token" "$host" > "${HOME:-/root}/.config/glab-cli/config.yml"','  chmod 600 "${HOME:-/root}/.config/glab-cli/config.yml"','elif [ "$user" = "x-access-token" ]; then','  mkdir -p "${HOME:-/root}/.config/gh"','  printf "%s:\\n  oauth_token: %s\\n  git_protocol: https\\n" "$host" "$token" > "${HOME:-/root}/.config/gh/hosts.yml"',"fi"];EF1=u({name:"TASK_ADD_REPO",description:"Clone one of this organization's repositories into your working directory. If your workspace already names a repository, use that checkout directly. For a workspace without a repository, call this once with the repository the task is about; it waits for the checkout and returns the repository root listing, so you can start reading files immediately after. `git` and the repository's CLI (`gh` for GitHub, `glab` for GitLab; Bitbucket has "+"no CLI \u2014 its token is the password in `git remote get-url origin`, for `curl` "+"against api.bitbucket.org) are authenticated once it returns. Call TASK_ADD_REPO with no arguments to list the repositories available.",annotations:{title:"Add Repository",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!0,openWorldHint:!0},inputSchema:UW.object({id:UW.string().optional().describe("id of the repository to clone, as returned by the listing. Omit to list the available repositories."),connectionId:UW.string().optional().describe("Deprecated alias for `id`.")}),outputSchema:UW.object({success:UW.boolean(),repositories:UW.array(UW.object({id:UW.string(),repo:UW.string()})).optional(),repo:UW.string().optional(),cloned:UW.boolean().optional(),files:UW.string().optional(),message:UW.string()}),handler:async($,Z)=>{n(Z),await Z.access.check();let Q=Q0(Z),Y=_0(Z);if(!Y)throw Error("User ID required");let{threadId:X}=ln(),J=await Gz(Z,Q.id),G=$.id??$.connectionId,W=G?J.find((J0)=>J0.id===G):void 0;if(!W){let J0=J.map((U0)=>({id:U0.id,repo:U0.label}));return{success:!1,repositories:J0,message:G?`No repository for id "${G}". Pick one of the repositories listed.`:J0.length===0?"This organization has no repositories linked, so none can be cloned.":"Pick a repository and call TASK_ADD_REPO again with its id."}}let K=await Z.storage.threads.get(X);if(!K)throw Error(`Thread not found: ${X}`);let H=K.metadata?.repository?null:await p50(Z,K.virtual_mcp_id),F=await AB(Z,{threadId:X,runBranch:K.branch,agentRepo:H?.repository}),U=await Az(Z,F,Y),N=await uV6(Z,X,U,F,H?.repository?K.virtual_mcp_id:null);if(!N)throw Error(`No sandbox is registered for this run (thread ${X}), so there is nowhere to clone into.`);let B=K.metadata?.repository??H?.repository,D=K.metadata?.additionalRepositories??[],O={url:W.webUrl,repositoryId:W.repository?.id},j=B&&mD(B,O),w=await LZ(Z);if(j&&await mV6(w,N.sandboxHandle,X,"."))return{success:!1,repo:`${W.owner}/${W.name}`,cloned:!1,message:`${W.label} is already checked out at your working directory.`};if(B&&!j&&cV6(D,O))return{success:!1,repo:`${W.owner}/${W.name}`,cloned:!1,message:`This run already has ${sn$} additional repositories checked out, which is the limit. Work with what's already checked out instead of adding another.`};let{cloneUrl:E,gitUserName:P,gitUserEmail:T}=await pV6(Z,Q.id,W),z={url:W.webUrl,owner:W.owner,name:W.name,...W.installationId!==void 0?{installationId:W.installationId}:{},...W.connectionId?{connectionId:W.connectionId}:{},...W.repository?{repositoryId:W.repository.id}:{}},A=!B||!!j,R=A?[]:await Z.storage.threads.appendThreadRepository(X,z);if(!B)await Z.storage.threads.update(X,{metadata:{...K.metadata??{},repository:z},updated_by:Y});let f=$j0({branch:F,derivedRef:tF(F,{flat:zh(W.provider)}),recordedHeadRef:null,sticky:!1}),S=await nV6(Z,Q.id,Y),V=await w.proxyDaemonRequest(N.sandboxHandle,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify(tV6({...A?{primary:{cloneUrl:E,branch:f,repoName:`${W.owner}/${W.name}`}}:{secondaries:await oV6(Z,Q.id,R,S)},submoduleCredentials:S,gitUserName:P,gitUserEmail:T}))});if(!V.ok)throw Error(`the sandbox rejected the repository (${V.status} ${V.statusText})`);await w.proxyDaemonRequest(N.sandboxHandle,"/_sandbox/setup/clone",{method:"POST",headers:new Headers({"content-type":"application/json"}),body:"{}"}).catch((J0)=>{console.warn("[TASK_ADD_REPO] explicit clone kick failed",J0)});let v=A?null:Rn$(R,z),b=A||!v?".":`"$(dirname "$PWD")/repos/${v}"`,h=Date.now()+on$,l=!1,d="",W0=0,I0=null;while(Date.now()<h){let J0=await wF1(w,N.sandboxHandle,X,rn$(b)).catch(()=>null);if(!J0){if(++W0>=lV6)break;await J$(jF1);continue}W0=0;let U0=an$(J0.stdout);if(U0.cloned&&U0.listing===I0){l=!0,d=U0.listing;break}I0=U0.cloned?U0.listing:null,await J$(jF1)}if(l)await wF1(w,N.sandboxHandle,X,dV6(A?null:`../repos/${v}`)).catch((J0)=>console.warn("[TASK_ADD_REPO] CLI auth setup failed",J0));return{success:l,repo:`${W.owner}/${W.name}`,cloned:l,files:d,message:l?A?`${W.label} is checked out at your working directory on branch ${f}. \`git\` and its CLI are authenticated. Start working.`:`${W.label} is checked out at ../repos/${v}, beside your working directory, on its default branch. \`git\` and its CLI are authenticated there too. Your first checkout is untouched \u2014 commit and open a change request in each repository you change.`:`The clone of ${W.owner}/${W.name} did not finish within ${Math.round(on$/1000)}s. It may still be in progress \u2014 check your working directory before calling this again.`}}})});import{z as _1}from"zod";var cn=50000,mn=500,wS0=200,$t$=50000,BO,dn,t50,Th,sV6,rV6,aV6,Zt$,pn,eV6,$I6,Qt$;var NW=L(()=>{u8();WK0();u8();BO=_1.enum(DG),dn=_1.object({id:_1.string(),name:_1.string(),state:_1.enum(VZ$),startDate:_1.string().nullable(),endDate:_1.string().nullable()}),t50=_1.enum(["bug","feature","chore","spike","security"]),Th=_1.enum(["none","low","medium","high","urgent"]),sV6=_1.object({threadId:_1.string(),virtualMcpId:_1.string().nullable(),status:_1.enum(["in_progress","requires_action","failed","completed","expired"]).nullable(),title:_1.string().nullable(),lastMessage:_1.string().nullable(),hasPreview:_1.boolean(),failureKind:_1.string().nullable(),hasMessages:_1.boolean(),costUsd:_1.number().nullable(),costProvider:_1.string().nullable(),createdAt:_1.string(),lastActiveAt:_1.string()}),rV6=_1.object({reviewer:_1.enum(BG),verdict:_1.enum(["approved","changes_requested"]),verified:_1.boolean()}),aV6=_1.object({id:_1.string(),name:_1.string(),color:_1.string().nullable().describe('Hex color, e.g. "#3b82f6"'),createdBy:_1.string(),createdAt:_1.string().datetime()}),Zt$=_1.object({url:_1.string(),number:_1.number(),repoOwner:_1.string(),repoName:_1.string(),createdAt:_1.string(),updatedAt:_1.string().nullable(),title:_1.string().nullable(),body:_1.string().nullable(),state:_1.enum(["open","closed"]).nullable(),draft:_1.boolean().nullable(),merged:_1.boolean().nullable(),mergeable:_1.boolean().nullable(),checksStatus:_1.enum(["pending","passing","failing"]).nullable(),checks:_1.array(_1.object({name:_1.string(),status:_1.string(),conclusion:_1.string().nullable(),detailsUrl:_1.string().nullable(),summary:_1.string().nullable()})),previewUrl:_1.string().nullable()}),pn=_1.object({id:_1.string(),organizationId:_1.string(),title:_1.string(),description:_1.string().nullable(),status:BO,priority:Th,type:t50,assigneeId:_1.string().nullable(),assignedBy:_1.string().nullable(),repo:_1.string().nullable(),repositoryId:_1.string().nullable(),virtualMcpId:_1.string().nullable(),sprintId:_1.string().nullable(),dueDate:_1.string().datetime().nullable(),sortOrder:_1.number(),keySeq:_1.number().nullable(),externalUrl:_1.string().nullable(),previewRoutes:_1.array(_1.string()),source:_1.enum(["jira"]).nullable(),retryAttempts:_1.number(),reviewCycleStartedAt:_1.string().datetime().nullable(),threads:_1.array(sV6),tags:_1.array(aV6),reviewVerdicts:_1.array(rV6),statusSince:_1.string().datetime().nullable(),createdBy:_1.string(),createdAt:_1.string().datetime(),updatedBy:_1.string(),updatedAt:_1.string().datetime()}),eV6=["created","status_changed","assignee_changed","priority_changed","due_date_changed","title_changed","description_changed","tags_changed","review_requested","review_approved","review_changes_requested","review_verdict_requested","merge_conflict_resolution","merge_failed","type_changed","duplicate_reported","finding_resolved","sprint_changed"],$I6=_1.enum(eV6),Qt$=_1.object({id:_1.string(),taskBoardItemId:_1.string(),action:$I6,actorId:_1.string().nullable(),data:_1.record(_1.string(),_1.unknown()),occurredAt:_1.string().datetime()})});async function ES0($,Z,Q){if(Q===o$)return;if(!await $.db.selectFrom("member").select("id").where("organizationId","=",Z).where("userId","=",Q).executeTakeFirst())throw Error("assigneeId is not a member of the organization")}var PF1=L(()=>{NW()});async function PS0($,Z,Q){let Y=await $.storage.tags.listOrgTags(Z),X=new Set(Y.map((J)=>J.id));for(let J of Q)if(!X.has(J))throw Error(`Tag not found: ${J}`)}async function zS0($,Z,Q){let Y=await $.storage.virtualMcps.findById(Q,Z),X=Y?.organization_id===Z&&RQ(await s7($),Q);if(!Y||!X)throw Error(`Project not found: ${Q}`);return{id:Y.id,repository:Y.metadata?.repository??null}}function AS0($){let{project:Z,repo:Q,previousRepo:Y}=$,X=Z?.repository??null,J=X?`${X.owner}/${X.name}`:null;if(Z&&Q===void 0)return{repo:J,repositoryId:X?.repositoryId??null};if(Q===void 0)return{};if(J&&Yt$(Q,J))return{repo:Q,repositoryId:X?.repositoryId??null};if(Y!==void 0&&Yt$(Q,Y))return{repo:Q};return{repo:Q,repositoryId:null}}function Yt$($,Z){return($??"").trim().toLowerCase()===(Z??"").trim().toLowerCase()}var zF1=L(()=>{IF();kF()});function Gt$($){let Z={};for(let[Q,Y]of Object.entries($)){if(Q.startsWith(ZI6))continue;Z[Q]=Y}return Z}function TS0($){return{taskBoardItemId:$.id,...c7($)&&{[Xt$]:Jt$}}}function QI6($){return $?.[Xt$]===Jt$}function YI6($){if(/[:\s]/.test($))throw Error("organization id unsuitable for the subsidy key scheme");return`subsidy:${$}`}async function XI6($,Z){let Q=B0();try{let Y=await $.storage.subsidizedGatewayKeys.get(Z);if(Y)return Y;let X=$.auth?.user?.id;if(X&&Q.aiGatewayEnabled&&Q.studioProvisionSecretKey&&qE.provisionKey){let J=await UQ(X,$.auth?.user?.email),G=await qE.provisionKey(J,YI6(Z));return await $.storage.subsidizedGatewayKeys.put(Z,G),G}}catch(Y){console.error("[subsidized-runs] subsidy key unavailable \u2014 run stays on the org's key:",Y)}return}async function Wt$($,Z,Q){if(!B0().taskQuotaEnforced)return;if(!QI6(Q))return;let Y=Q?.taskBoardItemId;if(!Y)return;let X=await $.storage.taskBoard.getById(Y,Z);if(!X||!c7(X))return;if(!await yy$($,Y))return;return await XI6($,Z)}function Kt$($,Z){if(!Z)return $;if($.providerId!=="deco")return $;return{...$,apiKey:Z}}var ZI6="srv.",Xt$="srv.billing",Jt$="subscription";var o50=L(()=>{hd();iH();l1();XW()});function s50($){let Z=$?.runClass;return Z&&Z in AF1?AF1[Z]:AF1.interactive}var AF1,qz="runClass";var qh=L(()=>{AF1={interactive:10,reviewer:20,retry:30,new_task:40}});async function qS0($,Z,Q){let Y;try{return await Promise.race([$.aiProviders.listModels(Z,Q),new Promise((J,G)=>{Y=setTimeout(()=>G(Error("listModels timeout")),JI6)})])}finally{if(Y)clearTimeout(Y)}}function GI6($,Z){switch($){case"fast":return Z.chat.fast;case"smart":return Z.chat.smart;case"thinking":return Z.chat.thinking;case"image":return Z.image;case"web_search":return Z.webSearch;case"deep_research":return Z.deepResearch}}function RS0($,Z,Q){let Y=$.find((X)=>X.modelId===Z);return{title:Y?.title??Q??Z,providerId:Y?.providerId,capabilities:Y?.capabilities,limits:Y?.limits??null}}async function I8($,Z,Q){let Y=$.organization?.id;if(!Y)throw Error("resolveTier called without an organization");let J=(await $.storage.organizationSettings.get(Y))?.simple_mode?.tiers?.[Z]??null,G=$.auth?.user?.id,W=OE.safeParse(Z),K=Q?.applyUserPrefs&&W.success&&G?(await $.storage.userModelPreferences.get(G,Y))?.tiers?.[W.data]??null:null,H=(await $.storage.aiProviderKeys.list({organizationId:Y})).filter((j)=>xA(j.providerId)&&(Q?.acceptProvider?.(j.providerId)??!0)),F=await XP$($,Y,Z),U=F?H.find((j)=>j.providerId==="deco"):void 0;if(F&&U&&(Q?.acceptModel?.(U.providerId,F)??!0)){let j=await qS0($,U.id,Y).catch(()=>[]);return{credentialId:U.id,modelId:F,modelMeta:RS0(j,F)}}for(let j of[K,J]){let w=j?H.find((E)=>E.id===j.keyId):void 0;if(j&&w&&(Q?.acceptModel?.(w.providerId,j.modelId)??!0)){let E=await qS0($,j.keyId,Y).catch(()=>[]);return{credentialId:j.keyId,modelId:j.modelId,modelMeta:RS0(E,j.modelId,j.title)}}}if(H.length===0)throw new Rh(Z);let N={};await Promise.all(H.map(async(j)=>{let w=await qS0($,j.id,Y).catch(()=>[]);N[j.id]=w.filter((E)=>Q?.acceptModel?.(j.providerId,E.modelId)??!0)}));let B=H.map((j)=>({id:j.id,providerId:j.providerId,label:j.label,presetId:j.presetId,createdBy:j.createdBy,createdAt:j.createdAt})),D=G8$(B,N),O=GI6(Z,D);if(!O)throw new Rh(Z);return{credentialId:O.keyId,modelId:O.modelId,modelMeta:RS0(N[O.keyId]??[],O.modelId,O.title)}}async function Ht$($,Z,Q){let Y=$.organization?.id;if(!Y)throw Error("resolveSpecificModel called without an organization");let X=await $.storage.aiProviderKeys.findById(Z,Y).catch((G)=>{if(G instanceof Error&&G.message==="Provider key not found")throw new r50(`AI provider credential "${Z}" was not found`,{cause:G});throw G});if(!xA(X.providerId))throw new r50(`AI provider credential "${Z}" uses native-only provider "${X.providerId}" and cannot run a hosted model`);let J=await qS0($,Z,Y).catch(()=>[]);return{credentialId:Z,modelId:Q,modelMeta:RS0(J,Q)}}async function iG($,Z){try{return await I8($,Z)}catch(Q){if(Q instanceof Rh)return null;return console.warn(`[resolveTier] tier "${Z}" resolution failed:`,Q),null}}var Rh,r50,JI6=5000;var OZ=L(()=>{MG();kZ();q8();Rh=class Rh extends Error{tier;constructor($){super(`No model available for tier "${$}". Connect a provider or configure the tier in organization settings.`);this.tier=$;this.name="TierUnavailableError"}};r50=class r50 extends Error{constructor($,Z){super($,Z);this.name="SpecificModelCredentialUnavailableError"}}});import{z as Y5}from"zod";function Ot$($){let Z=["The user spoke this request to the voice companion. Transcripts may contain errors; ask if unclear. Changes or cancellations refer to existing work, not a duplicate task."];if($.length>0)Z.push("Earlier spoken conversation, as context only. Do not repeat earlier actions or treat the voice assistant's words as authorization:",JSON.stringify($));return Z.join(`
@@ -4483,7 +4483,7 @@ ${X}`:`${Y}
 
 ${X}
 ${J.slice(Y.length).trimStart()}`}function Gj8($){return $?.match(nW5)?.[1]?.toLowerCase()??null}async function rW5($,Z,Q){let[Y,X]=await Promise.all([$.client.listDecofileEntries(Z,$.packagePath),$.client.listDecofileEntries(Q,$.packagePath)]),J=new Map(fK(Y,$.packagePath).map((H)=>[H.path,H.sha])),G=fK(X,$.packagePath),W=new Set(G.map((H)=>H.path)),K=[];for(let H of G){if(J.get(H.path)===H.sha)continue;K.push({path:H.path,copyFromRef:Q})}for(let H of J.keys())if(!W.has(H))K.push({path:H,deleted:!0});return{changes:K,tree:Y,next:G.map((H)=>({stem:H.stem,sha:H.sha}))}}async function Jj8($,Z){try{return await qQ0($.client,$.packagePath,Z)}catch(Q){if(Q instanceof js)return null;throw Q}}async function Wj8($,Z,Q){let Y=UP($.packagePath),[X,J]=await Promise.all([$.client.getEntriesAtPaths(Z,[Y]),$.client.getEntriesAtPaths(Q,[Y])]);if(X.get(Y)?.sha===J.get(Y)?.sha)return!1;let[G,W]=await Promise.all([Jj8($,Z),Jj8($,Q)]);return G!==W}async function Kj8($,Z){if(!UD0(Z))throw new cu;if(!await aA1($.store,$.site,Z))throw new cu}async function Hj8($,Z){await Kj8($,Z);let Q=await e5($.client,$.mainBranch);return Wj8($,Q,Z)}async function Fj8($,Z,Q={},Y={}){await Kj8($,Z);let X=await $.client.readCommit(Z);if(!X)throw new cu;let J=await e5($.client,$.mainBranch),G=await rW5($,J,Z);if(G.changes.length===0)return{result:"up-to-date"};let W=await Wj8($,J,Z);if(W)console.info("hosted reapply: schema differs",{site:$.site,target:Z,head:J});let K=await eA1($,J,G,sW5(X,Z,Q.coAuthor));return{result:"merged",sha:K,release:await QT1($,K,Y),schemaChanged:W}}var cu,MQ0="Reapply: ",iW5,pW5="Reapplied-From",nW5;var GT1=L(()=>{$n();A5();_F();oN();RQ0();Kg0();cu=class cu extends Error{constructor(){super("This commit has no release");this.name="NotPublishedError"}};iW5=/^chore\(decofile\):/,nW5=/^Reapplied-From:\s*([0-9a-f]{40})\s*$/im});async function Uj8($,Z,Q){let[Y,X,J]=await Promise.all([iO8($.store,$.site),zq$($.store,$.site),Z.listCommits({ref:$.mainBranch,since:eW5,cursor:Q,limit:aW5})]),G=new Map(J.items.map((H)=>[H.sha,H.date])),W=J.items.map((H)=>Gj8(H.body));await Promise.all([...new Set(W)].filter((H)=>H!==null&&!G.has(H)).map(async(H)=>{let F=await $.client.readCommit(H).catch(()=>null);if(F)G.set(H,F.date)}));let K=J.items.map((H,F)=>{let U=W[F];return{sha:H.sha,date:H.date,message:H.message,author:H.author.name??H.author.login,hasRelease:X.has(H.sha),reapplyOf:U?{sha:U,date:G.get(U)??null}:null}});return{current:Y,commits:K,nextCursor:J.nextCursor}}async function Nj8($){let Z=await e5($.client,$.mainBranch),Q=await $T1($,Z),Y={revision:Z,schemaHash:Q,publishedAt:new Date().toISOString()};return await ZT1($,Y),Y}var aW5=50,eW5="1970-01-01T00:00:00Z";var Bj8=L(()=>{A5();oN();RQ0();GT1()});function Dj8($){return`site-tokens:${$}`}function $K5($){let Z=$?.tokens;if(!Array.isArray(Z))return[];return Z.filter((Q)=>typeof Q==="object"&&Q!==null&&typeof Q.kid==="string"&&typeof Q.iat==="number")}function Lj8($){return crypto.subtle.importKey("pkcs8",Buffer.from($,"base64"),{name:"Ed25519"},!1,["sign"])}async function ZK5($,Z){let Q=(J)=>WT1(new TextEncoder().encode(JSON.stringify(J))),Y=`${Q({alg:"EdDSA",typ:"JWT"})}.${Q({site:Z.site,kid:Z.kid,iat:Z.iat})}`,X=await crypto.subtle.sign({name:"Ed25519"},$,new TextEncoder().encode(Y));return`${Y}.${WT1(X)}`}function Oj8($){let Z=async(Q,Y)=>$K5(await $.kv.get(Q,Dj8(Y)));return{list:Z,async issue(Q,Y){let X=await Z(Q,Y),J={kid:WT1(crypto.getRandomValues(new Uint8Array(16))),iat:Math.floor(Date.now()/1000)},G=await ZK5(await $.signingKey(),{site:Y,...J});return await $.kv.set(Q,Dj8(Y),{tokens:[...X,J]}),{token:G,record:J}}}}var WT1=($)=>Buffer.from($ instanceof Uint8Array?$:new Uint8Array($)).toString("base64url");function YK5(){let $=Dp();return $?{store:$,purge:Jg0()}:null}async function Bg0($){let Z=$.var.delivery();if(!Z)return null;let Q=$.get("hostedProject"),Y=await $.var.repoClientFor($.var.studioContext,Q.organizationId,Q.repository);return{client:Y,packagePath:Q.packagePath,mainBranch:await Y.getDefaultBranch(),store:Z.store,purge:Z.purge,site:Q.site}}function jj8($){let Z=B0().siteTokenSigningKey;if(!Z)return null;return Oj8({kv:$.var.studioContext.storage.kv,signingKey:()=>Lj8(Z)})}function zs($,Z){let Q=Z instanceof Error?Z.message:String(Z);if(Z instanceof js)return $.json({error:Q},409);if(Z instanceof Hg0)return console.error("hosted: latest.json update failed",{error:Q}),$.json({error:"latest-update-failed"},502);let Y=CG(Z);if(Y!==null)return $.json({error:Q},Y===404?404:502);return console.error("hosted: request failed",{error:Q}),$.json({error:Q},500)}function wj8($={}){let Z=new Z1,Q=$.repoClientFor??_G,Y=$.insightsFor??fT$,X=$.delivery??YK5;return Z.use("*",async(J,G)=>{J.set("repoClientFor",Q),J.set("delivery",X),await G()}),Z.use("/:virtualMcpId/*",QK5),Z.get("/:virtualMcpId/releases",async(J)=>{try{let G=await Bg0(J);if(!G)return J.json(Ng0,503);let W=J.get("hostedProject"),K=await Y(J.var.studioContext,W.organizationId,W.repository);return J.json(await Uj8(G,K,J.req.query("cursor")??null),200,{"Cache-Control":"no-store"})}catch(G){return zs(J,G)}}),Z.post("/:virtualMcpId/releases/retry",async(J)=>{try{let G=await Bg0(J);if(!G)return J.json(Ng0,503);return J.json({current:await Nj8(G)})}catch(G){return zs(J,G)}}),Z.get("/:virtualMcpId/releases/:sha/reapply",async(J)=>{try{let G=await Bg0(J);if(!G)return J.json(Ng0,503);return J.json({schemaChanged:await Hj8(G,J.req.param("sha"))})}catch(G){if(G instanceof cu)return J.json({error:G.message},404);return zs(J,G)}}),Z.post("/:virtualMcpId/releases/:sha/reapply",async(J)=>{try{let G=await Bg0(J);if(!G)return J.json(Ng0,503);let W=await Fj8(G,J.req.param("sha"),{coAuthor:oL(J.var.studioContext)});return J.json(W)}catch(G){if(G instanceof cu)return J.json({error:G.message},404);if(G instanceof ws)return J.json({error:"main-moved"},409);return zs(J,G)}}),Z.get("/:virtualMcpId/site-tokens",async(J)=>{let G=J.get("hostedProject"),W=jj8(J);if(!W)return J.json({error:"site tokens not configured"},503);return J.json({site:G.site,tokens:await W.list(G.organizationId,G.site)})}),Z.post("/:virtualMcpId/site-tokens",async(J)=>{let G=J.get("hostedProject"),W=jj8(J);if(!W)return J.json({error:"site tokens not configured"},503);try{let K=await J.var.repoClientFor(J.var.studioContext,G.organizationId,G.repository),H=await sq(K,G.packagePath,await K.getDefaultBranch());if(await jp(J.var.studioContext.storage.virtualMcps,{id:G.virtualMcpId,organizationId:G.organizationId,metadata:G.metadata},H,J.var.studioContext.auth?.user?.id??"system"),!H)return J.json({error:"not a Blocks v8 site"},409);return J.json(await W.issue(G.organizationId,G.site))}catch(K){return zs(J,K)}}),Z}var QK5,Ng0;var Ej8=L(()=>{IF();W8();my0();MG();kF();A5();oN();rA1();RQ0();Kg0();Bj8();GT1();h60();rq();Op();l1();IR();QK5=Ys(async($,Z)=>{let Q=$.var.studioContext,Y=Q.organization;if(!Y)return $.json({error:"Organization scope required"},500);if(!Q.auth?.user?.id)return $.json({error:"Unauthorized"},401);if(!await AQ(Q,Y.id,"cms"))return $.json({error:"This organization's plan does not include the CMS",code:"feature_not_in_plan"},403);let X=$.req.param("virtualMcpId")??"",J=await Q.storage.virtualMcps.findById(X);if(!J||J.organization_id!==Y.id)return $.json({error:"Virtual MCP not found"},404);if(!RQ(await s7(Q),X))return $.json({error:"Virtual MCP not found"},404);let G=J.metadata??null,W=QW(G,J.connections?.map((H)=>H.connection_id)??[]);if(!W)return $.json({error:"Project has no repository"},404);try{let H=await $.var.repoClientFor(Q,Y.id,W);if(!await LD0({projects:Q.storage.virtualMcps,project:{id:X,organizationId:Y.id,metadata:G},by:Q.auth.user.id,client:H,mainBranch:await H.getDefaultBranch()}))return $.json({error:"Not found"},404)}catch(H){return zs($,H)}let K=await DD0(Q.storage.orgSites,X,Y.id);if(!K)return $.json(Lp,409);return $.set("hostedProject",{organizationId:Y.id,virtualMcpId:X,site:K,packagePath:sN(G),repository:W,metadata:G}),Z()}),Ng0={error:"hosted delivery not configured"}});var Pj8=($)=>{let Z=new Z1;if(Z.use("*",Io),Z.use("*",mF8),Z.route("/",lF8($.voiceSessions)),Z.route("/",of0()),Z.route("/",RU8()),Z.route("/",yU8()),Z.route("/",PU8()),Z.route("/",lD8()),Z.route("/",mD8()),Z.route("/",vD8()),Z.route("/",hD8()),Z.route("/",xD8()),Z.route("/",uy0()),Z.route("/tools",sD8()),Z.route("/",nD8()),Z.route("/",BD8({kvStorage:$.kvStorage})),Z.route("/",UD8()),Z.route("/fs",qD8({getConnection:$.getNatsConnection})),Z.route("/sandbox",RO8()),Z.route("/decofile",Yj8()),Z.route("/hosted",wj8()),Z.route("/",CD8()),Z.route("/",MD8()),Z.route("/deco-sites",rf0()),Z.route("/hosting",$U8()),Z.route("/monitor",NU8()),Z.route("/order-monitor",OU8()),Z.route("/sso",mf0()),Z.route("/",ly0({tokenStorage:$.tokenStorage,automationEventDispatcher:$.automationEventDispatcher})),Z.route("/webhooks",oF8()),$.mountDevAssets)Z.route("/dev-assets",Xy0({orgFromPath:!0}));Z.use("/mcp/:connectionId?",$.mcpAuth),Z.use("/mcp/:connectionId/ui-resource",$.mcpAuth),Z.use("/mcp/gateway/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/virtual-mcp/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/self",$.mcpAuth);for(let Q of XA1)Z.use(`${Q}/:threadId`,$.mcpAuth);Z.route("/",BW8()),Z.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",$.betterAuthProtectedResourceHandler),Z.get("/mcp/.well-known/oauth-protected-resource",$.betterAuthProtectedResourceHandler);for(let Q of XA1)Z.route(Q,ID8());return Z.route("/mcp",ib0()),Z.route("/mcp/self",fy0()),Z.route("/mcp",tb0()),Z.all("/oauth-proxy/:connectionId/*",$.oauthProxyHandler),Z.get("/watch",$.watchHandler),Z};var zj8=L(()=>{W8();cF8();dF8();_f0();sF8();Sz1();ZU8();BU8();jU8();Jy0();U2();Mz1();MU8();yz1();ND8();DD8();RD8();VD8();dZ0();jz1();ob0();YA1();kD8();SD8();bD8();fD8();WA1();cD8();dD8();tD8();KA1();rD8();HA1();pb0();MO8();Xj8();Ej8()});import{z as mu}from"zod";class KT1{adapter;getConnection;kvPromise;constructor($,Z){this.adapter=$;this.getConnection=Z}kv(){let $=this.getConnection();if(!$||$.isClosed())throw new R1(503,{message:"Voice transport is unavailable"});return this.kvPromise??=new qj8.Kvm(Dg0.jetstream($)).create("STUDIO_VOICE_SESSIONS",{storage:Dg0.StorageType.Memory,ttl:Rj8.nanos(DO),max_bytes:10485760}).catch((Z)=>{throw this.kvPromise=void 0,Z}),this.kvPromise}async conversationAgent($){let Z=await this.kv(),Q=`agent.${$.conversationKey}`,Y=Date.now()+45000;while(Date.now()<Y){let X=await Z.get(Q),J=X?.operation==="PUT"?Tj8.parse(X.json()):null;if(J?.state==="ready")return J.agentId;if(J?.state==="creating"&&J.expiresAt>Date.now()){await J$(200);continue}let G=Aj8.encode(JSON.stringify({state:"creating",expiresAt:Date.now()+40000})),W;try{W=X&&J?await Z.update(Q,G,X.revision):await Z.create(Q,G)}catch{await J$(200);continue}try{let K=await $.ensureConversationAgent();return await Z.update(Q,Aj8.encode(JSON.stringify({state:"ready",agentId:K})),W),K}catch(K){throw await Z.delete(Q,{previousSeq:W}).catch(()=>{}),K}}throw new R1(503,{message:"Voice conversation is starting; try again"})}async createSession($){let Z=this.adapter.forConversationModel($.model),Q=await this.conversationAgent(Z);try{return{provider:"elevenlabs",conversationToken:await Z.createConversationToken(Q)}}catch(Y){let X=await this.kv(),J=`agent.${Z.conversationKey}`,G=await X.get(J),W=G?.operation==="PUT"?Tj8.parse(G.json()):null;if(G&&W?.state==="ready"&&W.agentId===Q)await X.delete(J,{previousSeq:G.revision}).catch(()=>{});throw Y}}}var Dg0,qj8,Rj8,Aj8,Tj8;var Mj8=L(()=>{UG();TB();n$();Dg0=_(_H(),1),qj8=_(Mq(),1),Rj8=_(c2(),1),Aj8=new TextEncoder,Tj8=mu.discriminatedUnion("state",[mu.object({state:mu.literal("ready"),agentId:mu.string()}),mu.object({state:mu.literal("creating"),expiresAt:mu.number()})])});import{z as As}from"zod";function XK5($){return{model:$.model,instructions:`${Et$}
-Start in ${$.language==="pt"?"Brazilian Portuguese":"English"}, and follow the user's language.`,delegation:{type:"client"},audio:{output:{voice:$.voice}},store:!1}}class HT1{config;constructor($){this.config=$}async createSession(){return{provider:"openai",transport:"webrtc"}}async negotiate($){let Z=await fetch("https://api.openai.com/v1/live/sessions",{method:"POST",headers:{Authorization:`Bearer ${this.config.apiKey}`,"Content-Type":"application/json","OpenAI-Safety-Identifier":$.safetyIdentifier},body:JSON.stringify({session:XK5({...this.config,language:$.language,model:$.model}),transport:{type:"webrtc",sdp:$.sdp}}),signal:AbortSignal.timeout(15000)});if(!Z.ok)throw await Z.body?.cancel(),Error(`OpenAI Live request failed (${Z.status})`);return{sdp:As.object({session:As.object({id:As.string().min(1)}),transport:As.object({type:As.literal("webrtc"),sdp:As.string().min(1).max(1e5)})}).parse(await Z.json()).transport.sdp}}}var Vj8=L(()=>{TB()});var Ij8;var kj8=L(()=>{Ij8=[{name:"delegate_to_agent",description:"Submit a complete request to the selected Studio agent. Returns after acceptance while work continues in the background. Results arrive later.",parameters:{type:"object",properties:{request:{type:"string",description:"The complete user request, with relevant conversational details. Preserve intent and constraints."}},required:["request"]}},{name:"get_agent_status",description:"Read the current chat's work status and known results. This does not track independent organization tasks; delegate fresh task-status queries to the Studio agent. Use when asked, never poll.",parameters:{type:"object",properties:{}}},{name:"stop_agent_work",description:"Request cancellation in the current chat ONLY when the user explicitly asks. Speaking over the companion is not cancellation. To stop independent tasks, delegate that request to the Studio agent.",parameters:{type:"object",properties:{}}}]});function FT1($){return{conversation_config:{agent:{first_message:"",language:"en",prompt:{prompt:jt$,llm:$.conversationModel,thinking_budget:0,max_tokens:512,tools:Ij8.map((Z)=>({...Z,type:"client",expects_response:!0,response_timeout_secs:Z.name==="delegate_to_agent"?20:5,...Z.name==="delegate_to_agent"?{execution_mode:"async",interruption_mode:"allow",pre_tool_speech:"off"}:{}}))}},asr:{provider:"scribe_realtime",quality:"high"},turn:{turn_eagerness:"normal",turn_timeout:-1,silence_end_call_timeout:-1},tts:{voice_id:$.voiceId,model_id:$.model},conversation:{max_duration_seconds:DO/1000,client_events:["audio","interruption","user_transcript","agent_response","client_tool_call","vad_score"]}},platform_settings:{auth:{enable_auth:!0},privacy:{record_voice:!1,retention_days:1,delete_audio:!0,delete_transcript_and_pii:!0},overrides:{conversation_config_override:{agent:{language:!0}}}}}}var Cj8=L(()=>{TB();kj8()});import{z as dJ}from"zod";import{createHash as JK5,createHmac as GK5}from"crypto";class Lg0{config;conversationKey;configurationKey;constructor($){this.config=$;this.configurationKey=JK5("sha256").update(JSON.stringify(FT1($))).digest("hex"),this.conversationKey=GK5("sha256",$.apiKey).update(this.configurationKey).digest("hex")}forConversationModel($){return $===this.config.conversationModel?this:new Lg0({...this.config,conversationModel:$})}async request($,Z,Q){let Y=await fetch(`https://api.elevenlabs.io/v1${$}`,{method:Z===void 0?"GET":"POST",headers:{"xi-api-key":this.config.apiKey,"Content-Type":"application/json"},body:JSON.stringify(Z),signal:Q});if(!Y.ok)throw await Y.body?.cancel(),Error(`ElevenLabs request failed (${Y.status})`);return Y}async ensureConversationAgent(){let $=`Studio voice ${this.configurationKey.slice(0,24)}`,Z=await this.request(`/convai/agents?search=${encodeURIComponent($)}&page_size=100`,void 0,AbortSignal.timeout(15000)),{agents:Q}=dJ.object({agents:dJ.array(dJ.object({agent_id:dJ.string(),name:dJ.string()}))}).parse(await Z.json()),Y=Q.find((J)=>J.name===$);if(Y){let J=await this.request(`/convai/agents/${encodeURIComponent(Y.agent_id)}`,void 0,AbortSignal.timeout(15000));return dJ.object({platform_settings:dJ.object({auth:dJ.object({enable_auth:dJ.literal(!0)})})}).parse(await J.json()),Y.agent_id}let X=await this.request("/convai/agents/create",{name:$,...FT1(this.config)},AbortSignal.timeout(15000));return dJ.object({agent_id:dJ.string().min(1)}).parse(await X.json()).agent_id}async createConversationToken($){let Z=await this.request(`/convai/conversation/token?agent_id=${encodeURIComponent($)}`,void 0,AbortSignal.timeout(15000));return dJ.object({token:dJ.string().min(1)}).parse(await Z.json()).token}async createTranscriptionToken(){let $=await this.request("/single-use-token/realtime_scribe",{},AbortSignal.timeout(15000));return dJ.object({token:dJ.string().min(1)}).parse(await $.json()).token}synthesize($,Z){return this.request(`/text-to-speech/${encodeURIComponent(this.config.voiceId)}/stream?output_format=mp3_44100_128`,{text:$,model_id:this.config.model},AbortSignal.any([Z,AbortSignal.timeout(60000)]))}}var Sj8=L(()=>{Cj8()});import{createHmac as WK5,timingSafeEqual as KK5}from"crypto";import{z as Ts}from"zod";function vj8($,Z){if(!Z)throw Error("Voice requires a shared authentication secret");return WK5("sha256",Z).update(`studio-voice-session:v1:${$}`).digest("base64url")}function bj8($,Z){let Q=Buffer.from(JSON.stringify(_j8.parse($))).toString("base64url");return`${Q}.${vj8(Q,Z)}`}function xj8($,Z,Q=Date.now()){if(!Z||$.length>4096)return null;let Y=$.split(".");if(Y.length!==2)return null;let[X,J]=Y;if(!X||!J)return null;let G=Buffer.from(vj8(X,Z)),W=Buffer.from(J);if(W.length!==G.length||!KK5(W,G))return null;try{let K=_j8.safeParse(JSON.parse(Buffer.from(X,"base64url").toString()));if(!K.success||K.data.expiresAt<=Q||K.data.expiresAt>Q+DO)return null;return K.data}catch{return null}}var _j8;var fj8=L(()=>{TB();_j8=Ts.object({sessionId:Ts.string().uuid(),organizationId:Ts.string().min(1).max(256),userId:Ts.string().min(1).max(256),threadId:Ts.string().min(1).max(256),expiresAt:Ts.number().int().positive()})});import{z as UT1}from"zod";function yj8($,Z){if(Z?.voice_model!=null&&Z.voice_provider==null)throw Error("A voice model override requires a provider");let Q=Z?.voice_provider??$.voiceConversationProvider;return NT1.parse({provider:Q,model:Z?.voice_model??(Q==="openai"?$.openaiLiveModel:$.elevenlabsConversationModel)})}var NT1;var gj8=L(()=>{NT1=UT1.object({provider:UT1.enum(["elevenlabs","openai"]),model:UT1.string().trim().min(1).max(128)})});import{createHash as HK5}from"crypto";import{z as qs}from"zod";function Rs($){return`user.${HK5("sha256").update(JSON.stringify([$.organizationId,$.userId])).digest("hex")}`}class DT1{deps;kvPromise;constructor($){this.deps=$}kv(){let $=this.deps.getConnection();if(!$||$.isClosed())throw new R1(503,{message:"Voice transport is unavailable"});return this.kvPromise??=new hj8.Kvm(jg0.jetstream($)).create("STUDIO_VOICE_SESSIONS",{storage:jg0.StorageType.Memory,ttl:uj8.nanos(DO),max_bytes:10485760}).catch((Z)=>{throw this.kvPromise=void 0,Z}),this.kvPromise}adapter(){if(!this.deps.adapter)throw new R1(503,{message:"Voice is not configured on this deployment"});return this.deps.adapter}async create($,Z=!1,Q="en",Y){let X;if(Z)try{X=yj8(this.deps.defaults,Y)}catch{throw new R1(503,{message:"Voice configuration is invalid"})}let J=X?this.deps.conversationAdapters[X.provider]:this.adapter();if(!J)throw new R1(503,{message:"Voice is not configured on this deployment"});let G={...$,sessionId:crypto.randomUUID(),expiresAt:Date.now()+DO},W=bj8(G,this.deps.secret),K=await this.kv(),H=Rs(G),F=await K.get(H),U=F?.operation==="PUT"?Og0.parse(F.json()):null,N=BT1.encode(JSON.stringify({sessionId:G.sessionId,expiresAt:G.expiresAt,conversation:X,characters:0,requests:0}));try{if(F&&U&&U.expiresAt<=Date.now())await K.update(H,N,F.revision);else await K.create(H,N)}catch{throw new R1(409,{message:"Close your other voice session before starting a new one"})}try{if(X&&"createSession"in J){let D=await J.createSession({language:Q,model:X.model,safetyIdentifier:Rs($)});return{token:W,...D,expiresAt:G.expiresAt}}let B=await this.adapter().createTranscriptionToken();return{token:W,transcriptionToken:B,expiresAt:G.expiresAt}}catch(B){throw await this.release(G),B}}authorize($,Z){let Q=xj8(Z,this.deps.secret);if(!Q||Q.organizationId!==$.organizationId||Q.userId!==$.userId||Q.threadId!==$.threadId)throw new R1(403,{message:"Invalid voice session"});return Q}async connect($,Z){let Q=this.authorize($,Z.token),Y=await this.kv(),X=Rs(Q),J=await Y.get(X),G=J?.operation==="PUT"?Og0.parse(J.json()):null;if(!J||!G||G.sessionId!==Q.sessionId||G.expiresAt<=Date.now())throw new R1(403,{message:"Voice session expired"});let W=G.conversation?this.deps.conversationAdapters[G.conversation.provider]:null;if(!W?.negotiate||!G.conversation)throw new R1(409,{message:"Voice session does not support SDP negotiation"});if(G.connected)throw new R1(409,{message:"Voice session already connected"});try{await Y.update(X,BT1.encode(JSON.stringify({...G,connected:!0})),J.revision)}catch{throw new R1(409,{message:"Voice session is busy"})}return W.negotiate({sdp:Z.sdp,language:Z.language,model:G.conversation.model,safetyIdentifier:X})}async speak($,Z,Q,Y){let X=this.authorize($,Z),J=await this.kv(),G=Rs(X);for(let W=0;;W++){let K=await J.get(G),H=K?.operation==="PUT"?Og0.parse(K.json()):null;if(!K||!H||H.sessionId!==X.sessionId||H.expiresAt<=Date.now())throw new R1(403,{message:"Voice session expired"});if(H.characters+Q.length>24000||H.requests>=120)throw new R1(429,{message:"Voice session speech limit reached"});try{await J.update(G,BT1.encode(JSON.stringify({...H,characters:H.characters+Q.length,requests:H.requests+1})),K.revision);break}catch{if(W>=2)throw new R1(409,{message:"Voice session is busy"})}}return this.adapter().synthesize(Q,Y)}async release($){let Z=await this.kv(),Q=await Z.get(Rs($));if(Q?.operation==="PUT"&&Og0.parse(Q.json()).sessionId===$.sessionId)await Z.delete(Rs($),{previousSeq:Q.revision})}async revoke($,Z){await this.release(this.authorize($,Z))}}var jg0,hj8,uj8,Og0,BT1;var lj8=L(()=>{UG();TB();fj8();gj8();jg0=_(_H(),1),hj8=_(Mq(),1),uj8=_(c2(),1),Og0=qs.object({sessionId:qs.string().uuid(),expiresAt:qs.number(),connected:qs.boolean().optional(),conversation:NT1.optional(),characters:qs.number().int().nonnegative(),requests:qs.number().int().nonnegative()}),BT1=new TextEncoder});import{z as m1}from"zod";function oB($,Z="invalid_request_error",Q=null,Y=null){return{error:{message:$,type:Z,param:Q,code:Y}}}function EK5($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let Q=$.substring(0,Z),Y=$.substring(Z+1);if(!Q||!Y)return null;return{credentialId:Q,modelId:Y}}function PK5($,Z,Q){try{return JSON.parse($)}catch{throw new dj8(`Invalid JSON in tool call arguments for function '${Q}' (tool_call_id: ${Z}): ${$}`)}}function zK5($){let Z={};for(let Q of $)if(Q.role==="assistant"&&Q.tool_calls)for(let Y of Q.tool_calls)Z[Y.id]=Y.function.name;return $.map((Q)=>{switch(Q.role){case"system":return{role:"system",content:Q.content};case"user":if(typeof Q.content==="string")return{role:"user",content:Q.content};return{role:"user",content:Q.content.map((X)=>{if(X.type==="text")return{type:"text",text:X.text};return{type:"image",image:X.image_url.url}})};case"assistant":if(Q.tool_calls&&Q.tool_calls.length>0)return{role:"assistant",content:Q.tool_calls.map((X)=>({type:"tool-call",toolCallId:X.id,toolName:X.function.name,input:PK5(X.function.arguments,X.id,X.function.name)}))};return{role:"assistant",content:Q.content??""};case"tool":let Y=Z[Q.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:Q.tool_call_id,toolName:Y,output:{type:"text",value:Q.content}}]}}})}function AK5($){let Z=$.map((Q)=>{let Y=Q.function.parameters?PN(Q.function.parameters):PN({type:"object",properties:{}});return[Q.function.name,s$({description:Q.function.description,inputSchema:Y})]});return Object.fromEntries(Z)}function TK5($){if(!$)return;return{openai:{response_format:$}}}function qK5(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function cj8($,Z,Q,Y,X,J){let G={model:$,instructions:Z.filter((W)=>W.role==="system"),messages:Z.filter((W)=>W.role!=="system"),tools:Q,temperature:Y.temperature,maxOutputTokens:Y.max_tokens,topP:Y.top_p,frequencyPenalty:Y.frequency_penalty,presencePenalty:Y.presence_penalty,stopSequences:Y.stop?Array.isArray(Y.stop)?Y.stop:[Y.stop]:void 0,abortSignal:J};return X?{...G,providerOptions:X}:G}function mj8($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var FK5=256,UK5,NK5,BK5,DK5,LK5,OK5,jK5,wK5,dj8,ij8,pj8;var nj8=L(()=>{l4();W8();Qs();JU();UK5=m1.object({type:m1.literal("function"),function:m1.object({name:m1.string(),description:m1.string().optional(),parameters:m1.record(m1.string(),m1.unknown()).optional()})}),NK5=m1.object({id:m1.string(),type:m1.literal("function"),function:m1.object({name:m1.string(),arguments:m1.string()})}),BK5=m1.discriminatedUnion("role",[m1.object({role:m1.literal("system"),content:m1.string(),name:m1.string().optional()}),m1.object({role:m1.literal("user"),content:m1.union([m1.string(),m1.array(m1.union([m1.object({type:m1.literal("text"),text:m1.string()}),m1.object({type:m1.literal("image_url"),image_url:m1.object({url:m1.string(),detail:m1.string().optional()})})]))]),name:m1.string().optional()}),m1.object({role:m1.literal("assistant"),content:m1.string().nullable().optional(),name:m1.string().optional(),tool_calls:m1.array(NK5).optional()}),m1.object({role:m1.literal("tool"),content:m1.string(),tool_call_id:m1.string()})]),DK5=m1.object({type:m1.literal("text")}),LK5=m1.object({type:m1.literal("json_object")}),OK5=m1.object({type:m1.literal("json_schema"),json_schema:m1.object({name:m1.string(),description:m1.string().optional(),schema:m1.record(m1.string(),m1.unknown()),strict:m1.boolean().optional()})}),jK5=m1.union([DK5,LK5,OK5]),wK5=m1.object({model:m1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:m1.array(BK5),stream:m1.boolean().optional().default(!1),temperature:m1.number().min(0).max(2).optional(),max_tokens:m1.number().positive().optional(),top_p:m1.number().min(0).max(1).optional(),frequency_penalty:m1.number().min(-2).max(2).optional(),presence_penalty:m1.number().min(-2).max(2).optional(),stop:m1.union([m1.string(),m1.array(m1.string())]).optional(),tools:m1.array(UK5).optional(),tool_choice:m1.union([m1.literal("auto"),m1.literal("none"),m1.literal("required"),m1.object({type:m1.literal("function"),function:m1.object({name:m1.string()})})]).optional(),response_format:jK5.optional(),user:m1.string().optional()});dj8=class dj8 extends Error{constructor($){super($);this.name="MessageConversionError"}};ij8=new Z1;ij8.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("studioContext"),Q=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(oB("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(oB("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==Q)return $.json(oB("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let Y=await $.req.json(),X=wK5.safeParse(Y);if(!X.success){let j=X.error.issues[0]??{message:"Invalid request",path:[]};return $.json(oB(`Invalid request: ${j.message}`,"invalid_request_error",j.path.length>0?j.path.join("."):null),400)}let J=X.data,G=EK5(J.model);if(!G)return $.json(oB("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=G,{modelId:K}=G;if(!W){let w=(await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id})).find((E)=>xA(E.providerId));if(!w)return $.json(oB("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=w.id}let H;try{H=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(oB(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let F=H.aiSdk.languageModel(K),U=zK5(J.messages),N=J.tools?AK5(J.tools):void 0,B=TK5(J.response_format),D=qK5(),O=Math.floor(Date.now()/1000);if(J.stream)return Jj($,async(j)=>{let w=cj8(F,U,N,J,B,$.req.raw.signal);try{let E=Yt(w),P=!1,T=0,z="",A=async()=>{if(z.length===0)return;let R=z;z="",await j.writeSSE({data:JSON.stringify({id:D,object:"chat.completion.chunk",created:O,model:J.model,choices:[{index:0,delta:{content:R},finish_reason:null}]})})};for await(let R of E.stream){if(!P&&(R.type==="text-delta"||R.type==="tool-call"))await j.writeSSE({data:JSON.stringify({id:D,object:"chat.completion.chunk",created:O,model:J.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),P=!0;if(R.type==="text-delta"){if(z+=R.text,z.length>=FK5)await A()}else if(R.type==="tool-call"){await A();let f=T++;await j.writeSSE({data:JSON.stringify({id:D,object:"chat.completion.chunk",created:O,model:J.model,choices:[{index:0,delta:{tool_calls:[{index:f,id:R.toolCallId,type:"function",function:{name:R.toolName,arguments:JSON.stringify(R.input)}}]},finish_reason:null}]})})}else if(R.type==="finish")await A(),await j.writeSSE({data:JSON.stringify({id:D,object:"chat.completion.chunk",created:O,model:J.model,choices:[{index:0,delta:{},finish_reason:mj8(R.finishReason)}],usage:R.totalUsage?{prompt_tokens:R.totalUsage.inputTokens??0,completion_tokens:R.totalUsage.outputTokens??0,total_tokens:R.totalUsage.totalTokens??0}:void 0})})}await A(),await j.writeSSE({data:"[DONE]"})}catch(E){let P=E;console.error("[openai-compat:stream] Error:",P.message),await j.writeSSE({data:JSON.stringify({error:{message:P.message,type:"server_error"}})})}});else{let j=cj8(F,U,N,J,B,$.req.raw.signal),w=await wO(j),E={role:"assistant",content:w.text||null};if(w.toolCalls&&w.toolCalls.length>0)E.tool_calls=w.toolCalls.map((P)=>({id:P.toolCallId,type:"function",function:{name:P.toolName,arguments:JSON.stringify("input"in P?P.input:{})}})),E.content=null;return $.json({id:D,object:"chat.completion",created:O,model:J.model,choices:[{index:0,message:E,finish_reason:mj8(w.finishReason)}],usage:{prompt_tokens:w.usage?.inputTokens??0,completion_tokens:w.usage?.outputTokens??0,total_tokens:w.usage?.totalTokens??0}})}}catch(Y){let X=Y;if(X.name==="AbortError")return $.json(oB("Request aborted","invalid_request_error"),400);if(X.name==="MessageConversionError")return $.json(oB(X.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",X.message,X.stack),$.json(oB(X.message,"server_error"),500)}});pj8=ij8});function RK5($){if(typeof $!=="object"||$===null)return!1;let Q=$.repository?.url;return typeof Q==="string"&&Q.length>0}function tj8(){let $=new Z1;return $.use("*",async(Z,Q)=>{await Q(),Z.header("Cache-Control","private, no-store"),Z.header("Vary","Cookie")}),$.get("/",async(Z)=>{let Q=Z.get("studioContext"),Y=_0(Q);if(!Y)return Z.json({error:"Authentication required"},401);let J=(Z.req.query("site")??"").trim().toLowerCase();if(!S5(J))return Z.json({error:"Invalid site slug"},400);let G=await Q.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.id as id","organization.slug as slug","organization.name as name","organization.metadata as metadata"]).where("member.userId","=",Y).execute(),W=[];for(let H of G){if(!H.slug||u9(H))continue;let F=await Q.storage.virtualMcps.list(H.id);for(let U of F){if(uA(U)!==J)continue;if(!RK5(U.metadata))continue;W.push({orgSlug:H.slug,orgName:H.name??H.slug,project:{id:U.id,title:U.title,icon:U.icon??null}})}}let K={matches:W};return Z.json(K)}),$}var oj8=L(()=>{W8();aY()});var wg0;var LT1=L(()=>{wg0={name:"decocms",version:"4.505.0",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run dev:server","dev:server":"NODE_ENV=development bun --env-file=.env --watch run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js","db:migrate:dbos":"bun run ./dist/server/migrate-dbos.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts","migrate:dbos":"bun run src/database/migrate-dbos.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^4.0.58","@ai-sdk/google":"^4.0.76","@ai-sdk/openai":"^4.0.71","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^3.1.0","@opentelemetry/core":"^2.6.0",kysely:"^0.28.12","posthog-node":"^5.0.0"},devDependencies:{"@ai-sdk/provider":"^4.0.17","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/blocks":"8.5.1","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^7.0.107","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});function IK5(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??VK5}}var sj8,VK5="https://ph.studio.decocms.com",rj8;var aj8=L(()=>{W8();D10();sh();K9();l1();Ho();Yz1();LT1();sj8=new Z1;sj8.get("/",($)=>{let Z={version:wg0.version,theme:x3$(),...HF().logo&&{logo:HF().logo},...kO()&&{internalUrl:Y$$()},...B0().enableDecoImport&&{enableDecoImport:!0},hostingEnabled:!!B0().controlplaneRestUrl&&!!B0().controlplaneServiceToken,hostingControlPlaneGa:B0().hostingControlPlaneGa,monitorEnabled:!!B0().clickhouseAnalyticsUrl&&!!B0().clickhouseAnalyticsPassword,monitorGa:B0().monitorGa,orderMonitorEnabled:!!B0().orderMonitorIngestUrl&&X2(),plansEnabled:B0().plansEnabled,auth:vH8(),posthog:IK5(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:PU()}};return $.header("Cache-Control","no-store"),$.json({success:!0,config:Z})});rj8=sj8});import{z as R$}from"zod";var kK5,ej8;var $w8=L(()=>{kK5=R$.object({check_id:R$.string(),title:R$.string(),description:R$.string().optional(),impact:R$.string().optional(),why:R$.string().optional(),category:R$.string(),severity:R$.string(),value_band:R$.string().optional(),value_driver:R$.string().optional(),controllability:R$.string().optional(),pages:R$.array(R$.string()),tasks:R$.array(R$.string()),evidence:R$.string(),sample_scope:R$.string().optional(),sources:R$.array(R$.string())}),ej8=R$.object({domain:R$.string(),brand:R$.string(),favicon:R$.string().optional(),scanned_at:R$.string().nullable(),lang:R$.string(),score:R$.number().nullable(),band:R$.string().nullable(),totals:R$.object({measured:R$.number(),registry_total:R$.number(),passed:R$.number(),failed:R$.number(),blocked:R$.number()}),buckets:R$.array(R$.object({id:R$.enum(["critical","important","worth"]),label:R$.string(),items:R$.array(kK5)})),passing:R$.object({count:R$.number(),items:R$.array(R$.object({check_id:R$.string(),title:R$.string()}))}),not_measured:R$.object({count:R$.number(),groups:R$.array(R$.object({reason:R$.string(),label:R$.string(),count:R$.number(),checks:R$.array(R$.string())}))}),categories:R$.array(R$.object({key:R$.string(),label:R$.string(),score:R$.number().nullable(),band:R$.string().nullable(),pass:R$.number(),fail:R$.number()})),screenshots:R$.array(R$.object({url:R$.string(),page_type:R$.string().optional(),viewport:R$.enum(["desktop","mobile"]),image_url:R$.string()}))})});function Zw8($,Z,Q){let Y=Q?`?${new URLSearchParams({lang:Q}).toString()}`:"";return`${kK({})}/api/v2/public/diagnostics/${encodeURIComponent($)}/onepager${Z}${Y}`}async function Eg0($,Z={}){let Q=await fetch(Zw8($,"",Z.lang),{headers:{Accept:"application/json"},signal:Z.signal});if(Q.status===404)return null;if(!Q.ok)throw Error(`onepager read HTTP ${Q.status}`);return ej8.parse(await Q.json())}async function Qw8($,Z={}){let Q=await fetch(Zw8($,".md",Z.lang),{headers:{Accept:"text/markdown"},signal:Z.signal});if(Q.status===404)return null;if(!Q.ok)throw Error(`onepager markdown HTTP ${Q.status}`);return Q.text()}var OT1=L(()=>{$w8();IL()});import{join as Yw8}from"path";async function SK5($){try{let Z=await Eg0($,{signal:AbortSignal.timeout(CK5)});if(!Z?.scanned_at)return null;return{brand:Z.brand.trim()||Sw1($),...Z.score!==null?{score:Z.score}:{}}}catch{return null}}function Q3($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function _K5($,Z){let Q=Eu($),Y=Z?.brand?.trim()||Sw1(Q),X=WG8(Q,128),G=`${(B0().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(Q)}`,{title:W,description:K}=KG8({brand:Y,domain:Q,score:Z?.score}),H=`${G}/og.png`,F=`${Y} Deco Score by decocms`;return[`<title>${Q3(W)}</title>`,`<meta name="description" content="${Q3(K)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${Q3(W)}" />`,`<meta property="og:description" content="${Q3(K)}" />`,`<meta property="og:url" content="${Q3(G)}" />`,`<meta property="og:image" content="${Q3(H)}" />`,'<meta property="og:image:width" content="1200" />','<meta property="og:image:height" content="630" />',`<meta property="og:image:alt" content="${Q3(F)}" />`,'<meta name="twitter:card" content="summary_large_image" />',`<meta name="twitter:title" content="${Q3(W)}" />`,`<meta name="twitter:description" content="${Q3(K)}" />`,`<meta name="twitter:image" content="${Q3(H)}" />`,`<meta name="twitter:image:alt" content="${Q3(F)}" />`,`<link rel="canonical" href="${Q3(G)}" />`,`<link rel="alternate" type="text/markdown" href="${Q3(G)}.md" />`,`<link rel="icon" href="${Q3(X)}" sizes="any" />`].join(`
+Start in ${$.language==="pt"?"Brazilian Portuguese":"English"}, and follow the user's language.`,delegation:{type:"client"},audio:{output:{voice:$.voice}},store:!1}}class HT1{config;constructor($){this.config=$}async createSession(){return{provider:"openai",transport:"webrtc"}}async negotiate($){let Z=await fetch("https://api.openai.com/v1/live/sessions",{method:"POST",headers:{Authorization:`Bearer ${this.config.apiKey}`,"Content-Type":"application/json","OpenAI-Safety-Identifier":$.safetyIdentifier},body:JSON.stringify({session:XK5({...this.config,language:$.language,model:$.model}),transport:{type:"webrtc",sdp:$.sdp}}),signal:AbortSignal.timeout(15000)});if(!Z.ok)throw await Z.body?.cancel(),Error(`OpenAI Live request failed (${Z.status})`);return{sdp:As.object({session:As.object({id:As.string().min(1)}),transport:As.object({type:As.literal("webrtc"),sdp:As.string().min(1).max(1e5)})}).parse(await Z.json()).transport.sdp}}}var Vj8=L(()=>{TB()});var Ij8;var kj8=L(()=>{Ij8=[{name:"delegate_to_agent",description:"Submit a complete request to the selected Studio agent. Returns after acceptance while work continues in the background. Results arrive later.",parameters:{type:"object",properties:{request:{type:"string",description:"The complete user request, with relevant conversational details. Preserve intent and constraints."}},required:["request"]}},{name:"get_agent_status",description:"Read the current chat's work status and known results. This does not track independent organization tasks; delegate fresh task-status queries to the Studio agent. Use when asked, never poll.",parameters:{type:"object",properties:{}}},{name:"stop_agent_work",description:"Request cancellation in the current chat ONLY when the user explicitly asks. Speaking over the companion is not cancellation. To stop independent tasks, delegate that request to the Studio agent.",parameters:{type:"object",properties:{}}}]});function FT1($){return{conversation_config:{agent:{first_message:"",language:"en",prompt:{prompt:jt$,llm:$.conversationModel,thinking_budget:0,max_tokens:512,tools:Ij8.map((Z)=>({...Z,type:"client",expects_response:!0,response_timeout_secs:Z.name==="delegate_to_agent"?20:5,...Z.name==="delegate_to_agent"?{execution_mode:"async",interruption_mode:"allow",pre_tool_speech:"off"}:{}}))}},asr:{provider:"scribe_realtime",quality:"high"},turn:{turn_eagerness:"normal",turn_timeout:-1,silence_end_call_timeout:-1},tts:{voice_id:$.voiceId,model_id:$.model},conversation:{max_duration_seconds:DO/1000,client_events:["audio","interruption","user_transcript","agent_response","client_tool_call","vad_score"]}},platform_settings:{auth:{enable_auth:!0},privacy:{record_voice:!1,retention_days:1,delete_audio:!0,delete_transcript_and_pii:!0},overrides:{conversation_config_override:{agent:{language:!0}}}}}}var Cj8=L(()=>{TB();kj8()});import{z as dJ}from"zod";import{createHash as JK5,createHmac as GK5}from"crypto";class Lg0{config;conversationKey;configurationKey;constructor($){this.config=$;this.configurationKey=JK5("sha256").update(JSON.stringify(FT1($))).digest("hex"),this.conversationKey=GK5("sha256",$.apiKey).update(this.configurationKey).digest("hex")}forConversationModel($){return $===this.config.conversationModel?this:new Lg0({...this.config,conversationModel:$})}async request($,Z,Q){let Y=await fetch(`https://api.elevenlabs.io/v1${$}`,{method:Z===void 0?"GET":"POST",headers:{"xi-api-key":this.config.apiKey,"Content-Type":"application/json"},body:JSON.stringify(Z),signal:Q});if(!Y.ok)throw await Y.body?.cancel(),Error(`ElevenLabs request failed (${Y.status})`);return Y}async ensureConversationAgent(){let $=`Studio voice ${this.configurationKey.slice(0,24)}`,Z=await this.request(`/convai/agents?search=${encodeURIComponent($)}&page_size=100`,void 0,AbortSignal.timeout(15000)),{agents:Q}=dJ.object({agents:dJ.array(dJ.object({agent_id:dJ.string(),name:dJ.string()}))}).parse(await Z.json()),Y=Q.find((J)=>J.name===$);if(Y){let J=await this.request(`/convai/agents/${encodeURIComponent(Y.agent_id)}`,void 0,AbortSignal.timeout(15000));return dJ.object({platform_settings:dJ.object({auth:dJ.object({enable_auth:dJ.literal(!0)})})}).parse(await J.json()),Y.agent_id}let X=await this.request("/convai/agents/create",{name:$,...FT1(this.config)},AbortSignal.timeout(15000));return dJ.object({agent_id:dJ.string().min(1)}).parse(await X.json()).agent_id}async createConversationToken($){let Z=await this.request(`/convai/conversation/token?agent_id=${encodeURIComponent($)}`,void 0,AbortSignal.timeout(15000));return dJ.object({token:dJ.string().min(1)}).parse(await Z.json()).token}async createTranscriptionToken(){let $=await this.request("/single-use-token/realtime_scribe",{},AbortSignal.timeout(15000));return dJ.object({token:dJ.string().min(1)}).parse(await $.json()).token}synthesize($,Z){return this.request(`/text-to-speech/${encodeURIComponent(this.config.voiceId)}/stream?output_format=mp3_44100_128`,{text:$,model_id:this.config.model},AbortSignal.any([Z,AbortSignal.timeout(60000)]))}}var Sj8=L(()=>{Cj8()});import{createHmac as WK5,timingSafeEqual as KK5}from"crypto";import{z as Ts}from"zod";function vj8($,Z){if(!Z)throw Error("Voice requires a shared authentication secret");return WK5("sha256",Z).update(`studio-voice-session:v1:${$}`).digest("base64url")}function bj8($,Z){let Q=Buffer.from(JSON.stringify(_j8.parse($))).toString("base64url");return`${Q}.${vj8(Q,Z)}`}function xj8($,Z,Q=Date.now()){if(!Z||$.length>4096)return null;let Y=$.split(".");if(Y.length!==2)return null;let[X,J]=Y;if(!X||!J)return null;let G=Buffer.from(vj8(X,Z)),W=Buffer.from(J);if(W.length!==G.length||!KK5(W,G))return null;try{let K=_j8.safeParse(JSON.parse(Buffer.from(X,"base64url").toString()));if(!K.success||K.data.expiresAt<=Q||K.data.expiresAt>Q+DO)return null;return K.data}catch{return null}}var _j8;var fj8=L(()=>{TB();_j8=Ts.object({sessionId:Ts.string().uuid(),organizationId:Ts.string().min(1).max(256),userId:Ts.string().min(1).max(256),threadId:Ts.string().min(1).max(256),expiresAt:Ts.number().int().positive()})});import{z as UT1}from"zod";function yj8($,Z){if(Z?.voice_model!=null&&Z.voice_provider==null)throw Error("A voice model override requires a provider");let Q=Z?.voice_provider??$.voiceConversationProvider;return NT1.parse({provider:Q,model:Z?.voice_model??(Q==="openai"?$.openaiLiveModel:$.elevenlabsConversationModel)})}var NT1;var gj8=L(()=>{NT1=UT1.object({provider:UT1.enum(["elevenlabs","openai"]),model:UT1.string().trim().min(1).max(128)})});import{createHash as HK5}from"crypto";import{z as qs}from"zod";function Rs($){return`user.${HK5("sha256").update(JSON.stringify([$.organizationId,$.userId])).digest("hex")}`}class DT1{deps;kvPromise;constructor($){this.deps=$}kv(){let $=this.deps.getConnection();if(!$||$.isClosed())throw new R1(503,{message:"Voice transport is unavailable"});return this.kvPromise??=new hj8.Kvm(jg0.jetstream($)).create("STUDIO_VOICE_SESSIONS",{storage:jg0.StorageType.Memory,ttl:uj8.nanos(DO),max_bytes:10485760}).catch((Z)=>{throw this.kvPromise=void 0,Z}),this.kvPromise}adapter(){if(!this.deps.adapter)throw new R1(503,{message:"Voice is not configured on this deployment"});return this.deps.adapter}async create($,Z=!1,Q="en",Y){let X;if(Z)try{X=yj8(this.deps.defaults,Y)}catch{throw new R1(503,{message:"Voice configuration is invalid"})}let J=X?this.deps.conversationAdapters[X.provider]:this.adapter();if(!J)throw new R1(503,{message:"Voice is not configured on this deployment"});let G={...$,sessionId:crypto.randomUUID(),expiresAt:Date.now()+DO},W=bj8(G,this.deps.secret),K=await this.kv(),H=Rs(G),F=await K.get(H),U=F?.operation==="PUT"?Og0.parse(F.json()):null,N=BT1.encode(JSON.stringify({sessionId:G.sessionId,expiresAt:G.expiresAt,conversation:X,characters:0,requests:0}));try{if(F&&U&&U.expiresAt<=Date.now())await K.update(H,N,F.revision);else await K.create(H,N)}catch{throw new R1(409,{message:"Close your other voice session before starting a new one"})}try{if(X&&"createSession"in J){let D=await J.createSession({language:Q,model:X.model,safetyIdentifier:Rs($)});return{token:W,...D,expiresAt:G.expiresAt}}let B=await this.adapter().createTranscriptionToken();return{token:W,transcriptionToken:B,expiresAt:G.expiresAt}}catch(B){throw await this.release(G),B}}authorize($,Z){let Q=xj8(Z,this.deps.secret);if(!Q||Q.organizationId!==$.organizationId||Q.userId!==$.userId||Q.threadId!==$.threadId)throw new R1(403,{message:"Invalid voice session"});return Q}async connect($,Z){let Q=this.authorize($,Z.token),Y=await this.kv(),X=Rs(Q),J=await Y.get(X),G=J?.operation==="PUT"?Og0.parse(J.json()):null;if(!J||!G||G.sessionId!==Q.sessionId||G.expiresAt<=Date.now())throw new R1(403,{message:"Voice session expired"});let W=G.conversation?this.deps.conversationAdapters[G.conversation.provider]:null;if(!W?.negotiate||!G.conversation)throw new R1(409,{message:"Voice session does not support SDP negotiation"});if(G.connected)throw new R1(409,{message:"Voice session already connected"});try{await Y.update(X,BT1.encode(JSON.stringify({...G,connected:!0})),J.revision)}catch{throw new R1(409,{message:"Voice session is busy"})}return W.negotiate({sdp:Z.sdp,language:Z.language,model:G.conversation.model,safetyIdentifier:X})}async speak($,Z,Q,Y){let X=this.authorize($,Z),J=await this.kv(),G=Rs(X);for(let W=0;;W++){let K=await J.get(G),H=K?.operation==="PUT"?Og0.parse(K.json()):null;if(!K||!H||H.sessionId!==X.sessionId||H.expiresAt<=Date.now())throw new R1(403,{message:"Voice session expired"});if(H.characters+Q.length>24000||H.requests>=120)throw new R1(429,{message:"Voice session speech limit reached"});try{await J.update(G,BT1.encode(JSON.stringify({...H,characters:H.characters+Q.length,requests:H.requests+1})),K.revision);break}catch{if(W>=2)throw new R1(409,{message:"Voice session is busy"})}}return this.adapter().synthesize(Q,Y)}async release($){let Z=await this.kv(),Q=await Z.get(Rs($));if(Q?.operation==="PUT"&&Og0.parse(Q.json()).sessionId===$.sessionId)await Z.delete(Rs($),{previousSeq:Q.revision})}async revoke($,Z){await this.release(this.authorize($,Z))}}var jg0,hj8,uj8,Og0,BT1;var lj8=L(()=>{UG();TB();fj8();gj8();jg0=_(_H(),1),hj8=_(Mq(),1),uj8=_(c2(),1),Og0=qs.object({sessionId:qs.string().uuid(),expiresAt:qs.number(),connected:qs.boolean().optional(),conversation:NT1.optional(),characters:qs.number().int().nonnegative(),requests:qs.number().int().nonnegative()}),BT1=new TextEncoder});import{z as m1}from"zod";function oB($,Z="invalid_request_error",Q=null,Y=null){return{error:{message:$,type:Z,param:Q,code:Y}}}function EK5($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let Q=$.substring(0,Z),Y=$.substring(Z+1);if(!Q||!Y)return null;return{credentialId:Q,modelId:Y}}function PK5($,Z,Q){try{return JSON.parse($)}catch{throw new dj8(`Invalid JSON in tool call arguments for function '${Q}' (tool_call_id: ${Z}): ${$}`)}}function zK5($){let Z={};for(let Q of $)if(Q.role==="assistant"&&Q.tool_calls)for(let Y of Q.tool_calls)Z[Y.id]=Y.function.name;return $.map((Q)=>{switch(Q.role){case"system":return{role:"system",content:Q.content};case"user":if(typeof Q.content==="string")return{role:"user",content:Q.content};return{role:"user",content:Q.content.map((X)=>{if(X.type==="text")return{type:"text",text:X.text};return{type:"image",image:X.image_url.url}})};case"assistant":if(Q.tool_calls&&Q.tool_calls.length>0)return{role:"assistant",content:Q.tool_calls.map((X)=>({type:"tool-call",toolCallId:X.id,toolName:X.function.name,input:PK5(X.function.arguments,X.id,X.function.name)}))};return{role:"assistant",content:Q.content??""};case"tool":let Y=Z[Q.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:Q.tool_call_id,toolName:Y,output:{type:"text",value:Q.content}}]}}})}function AK5($){let Z=$.map((Q)=>{let Y=Q.function.parameters?PN(Q.function.parameters):PN({type:"object",properties:{}});return[Q.function.name,s$({description:Q.function.description,inputSchema:Y})]});return Object.fromEntries(Z)}function TK5($){if(!$)return;return{openai:{response_format:$}}}function qK5(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function cj8($,Z,Q,Y,X,J){let G={model:$,instructions:Z.filter((W)=>W.role==="system"),messages:Z.filter((W)=>W.role!=="system"),tools:Q,temperature:Y.temperature,maxOutputTokens:Y.max_tokens,topP:Y.top_p,frequencyPenalty:Y.frequency_penalty,presencePenalty:Y.presence_penalty,stopSequences:Y.stop?Array.isArray(Y.stop)?Y.stop:[Y.stop]:void 0,abortSignal:J};return X?{...G,providerOptions:X}:G}function mj8($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var FK5=256,UK5,NK5,BK5,DK5,LK5,OK5,jK5,wK5,dj8,ij8,pj8;var nj8=L(()=>{l4();W8();Qs();JU();UK5=m1.object({type:m1.literal("function"),function:m1.object({name:m1.string(),description:m1.string().optional(),parameters:m1.record(m1.string(),m1.unknown()).optional()})}),NK5=m1.object({id:m1.string(),type:m1.literal("function"),function:m1.object({name:m1.string(),arguments:m1.string()})}),BK5=m1.discriminatedUnion("role",[m1.object({role:m1.literal("system"),content:m1.string(),name:m1.string().optional()}),m1.object({role:m1.literal("user"),content:m1.union([m1.string(),m1.array(m1.union([m1.object({type:m1.literal("text"),text:m1.string()}),m1.object({type:m1.literal("image_url"),image_url:m1.object({url:m1.string(),detail:m1.string().optional()})})]))]),name:m1.string().optional()}),m1.object({role:m1.literal("assistant"),content:m1.string().nullable().optional(),name:m1.string().optional(),tool_calls:m1.array(NK5).optional()}),m1.object({role:m1.literal("tool"),content:m1.string(),tool_call_id:m1.string()})]),DK5=m1.object({type:m1.literal("text")}),LK5=m1.object({type:m1.literal("json_object")}),OK5=m1.object({type:m1.literal("json_schema"),json_schema:m1.object({name:m1.string(),description:m1.string().optional(),schema:m1.record(m1.string(),m1.unknown()),strict:m1.boolean().optional()})}),jK5=m1.union([DK5,LK5,OK5]),wK5=m1.object({model:m1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:m1.array(BK5),stream:m1.boolean().optional().default(!1),temperature:m1.number().min(0).max(2).optional(),max_tokens:m1.number().positive().optional(),top_p:m1.number().min(0).max(1).optional(),frequency_penalty:m1.number().min(-2).max(2).optional(),presence_penalty:m1.number().min(-2).max(2).optional(),stop:m1.union([m1.string(),m1.array(m1.string())]).optional(),tools:m1.array(UK5).optional(),tool_choice:m1.union([m1.literal("auto"),m1.literal("none"),m1.literal("required"),m1.object({type:m1.literal("function"),function:m1.object({name:m1.string()})})]).optional(),response_format:jK5.optional(),user:m1.string().optional()});dj8=class dj8 extends Error{constructor($){super($);this.name="MessageConversionError"}};ij8=new Z1;ij8.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("studioContext"),Q=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(oB("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(oB("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==Q)return $.json(oB("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let Y=await $.req.json(),X=wK5.safeParse(Y);if(!X.success){let j=X.error.issues[0]??{message:"Invalid request",path:[]};return $.json(oB(`Invalid request: ${j.message}`,"invalid_request_error",j.path.length>0?j.path.join("."):null),400)}let J=X.data,G=EK5(J.model);if(!G)return $.json(oB("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=G,{modelId:K}=G;if(!W){let w=(await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id})).find((E)=>xA(E.providerId));if(!w)return $.json(oB("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=w.id}let H;try{H=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(oB(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let F=H.aiSdk.languageModel(K),U=zK5(J.messages),N=J.tools?AK5(J.tools):void 0,B=TK5(J.response_format),D=qK5(),O=Math.floor(Date.now()/1000);if(J.stream)return Jj($,async(j)=>{let w=cj8(F,U,N,J,B,$.req.raw.signal);try{let E=Yt(w),P=!1,T=0,z="",A=async()=>{if(z.length===0)return;let R=z;z="",await j.writeSSE({data:JSON.stringify({id:D,object:"chat.completion.chunk",created:O,model:J.model,choices:[{index:0,delta:{content:R},finish_reason:null}]})})};for await(let R of E.stream){if(!P&&(R.type==="text-delta"||R.type==="tool-call"))await j.writeSSE({data:JSON.stringify({id:D,object:"chat.completion.chunk",created:O,model:J.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),P=!0;if(R.type==="text-delta"){if(z+=R.text,z.length>=FK5)await A()}else if(R.type==="tool-call"){await A();let f=T++;await j.writeSSE({data:JSON.stringify({id:D,object:"chat.completion.chunk",created:O,model:J.model,choices:[{index:0,delta:{tool_calls:[{index:f,id:R.toolCallId,type:"function",function:{name:R.toolName,arguments:JSON.stringify(R.input)}}]},finish_reason:null}]})})}else if(R.type==="finish")await A(),await j.writeSSE({data:JSON.stringify({id:D,object:"chat.completion.chunk",created:O,model:J.model,choices:[{index:0,delta:{},finish_reason:mj8(R.finishReason)}],usage:R.totalUsage?{prompt_tokens:R.totalUsage.inputTokens??0,completion_tokens:R.totalUsage.outputTokens??0,total_tokens:R.totalUsage.totalTokens??0}:void 0})})}await A(),await j.writeSSE({data:"[DONE]"})}catch(E){let P=E;console.error("[openai-compat:stream] Error:",P.message),await j.writeSSE({data:JSON.stringify({error:{message:P.message,type:"server_error"}})})}});else{let j=cj8(F,U,N,J,B,$.req.raw.signal),w=await wO(j),E={role:"assistant",content:w.text||null};if(w.toolCalls&&w.toolCalls.length>0)E.tool_calls=w.toolCalls.map((P)=>({id:P.toolCallId,type:"function",function:{name:P.toolName,arguments:JSON.stringify("input"in P?P.input:{})}})),E.content=null;return $.json({id:D,object:"chat.completion",created:O,model:J.model,choices:[{index:0,message:E,finish_reason:mj8(w.finishReason)}],usage:{prompt_tokens:w.usage?.inputTokens??0,completion_tokens:w.usage?.outputTokens??0,total_tokens:w.usage?.totalTokens??0}})}}catch(Y){let X=Y;if(X.name==="AbortError")return $.json(oB("Request aborted","invalid_request_error"),400);if(X.name==="MessageConversionError")return $.json(oB(X.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",X.message,X.stack),$.json(oB(X.message,"server_error"),500)}});pj8=ij8});function RK5($){if(typeof $!=="object"||$===null)return!1;let Q=$.repository?.url;return typeof Q==="string"&&Q.length>0}function tj8(){let $=new Z1;return $.use("*",async(Z,Q)=>{await Q(),Z.header("Cache-Control","private, no-store"),Z.header("Vary","Cookie")}),$.get("/",async(Z)=>{let Q=Z.get("studioContext"),Y=_0(Q);if(!Y)return Z.json({error:"Authentication required"},401);let J=(Z.req.query("site")??"").trim().toLowerCase();if(!S5(J))return Z.json({error:"Invalid site slug"},400);let G=await Q.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.id as id","organization.slug as slug","organization.name as name","organization.metadata as metadata"]).where("member.userId","=",Y).execute(),W=[];for(let H of G){if(!H.slug||u9(H))continue;let F=await Q.storage.virtualMcps.list(H.id);for(let U of F){if(uA(U)!==J)continue;if(!RK5(U.metadata))continue;W.push({orgSlug:H.slug,orgName:H.name??H.slug,project:{id:U.id,title:U.title,icon:U.icon??null}})}}let K={matches:W};return Z.json(K)}),$}var oj8=L(()=>{W8();aY()});var wg0;var LT1=L(()=>{wg0={name:"decocms",version:"4.505.2",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/api"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:"bun run dev:server","dev:server":"NODE_ENV=development bun --env-file=.env --watch run src/index.ts",build:"bun run build:server","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","generate:tool-contracts":"bun run scripts/generate-tool-contracts.ts","db:migrate":"bun run ./dist/server/migrate.js","db:migrate:dbos":"bun run ./dist/server/migrate-dbos.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts","migrate:dbos":"bun run src/database/migrate-dbos.ts",test:"bun test src","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts",prepublishOnly:"bun run --cwd=../.. build:studio"},optionalDependencies:{"@duckdb/node-api":"^1.5.0-r.1"},dependencies:{"@ai-sdk/anthropic":"^4.0.58","@ai-sdk/google":"^4.0.76","@ai-sdk/openai":"^4.0.71","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^3.1.0","@opentelemetry/core":"^2.6.0",kysely:"^0.28.12","posthog-node":"^5.0.0"},devDependencies:{"@ai-sdk/provider":"^4.0.17","@better-auth/sso":"1.4.1","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/blocks":"8.5.1","@decocms/mcp-utils":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/shared":"workspace:*","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@vercel/nft":"^1.1.1",ai:"^7.0.107","better-auth":"1.4.22",croner:"^9.1.0",degit:"^2.8.4",hono:"^4.10.7",jose:"^6.0.11",nanoid:"^5.1.6",pg:"^8.16.3",typescript:"^7.0.2",typescript5:"npm:typescript@^5.9.3",zod:"4.3.6"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","tools"],license:"MIT",publishConfig:{access:"public"}}});function IK5(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??VK5}}var sj8,VK5="https://ph.studio.decocms.com",rj8;var aj8=L(()=>{W8();D10();sh();K9();l1();Ho();Yz1();LT1();sj8=new Z1;sj8.get("/",($)=>{let Z={version:wg0.version,theme:x3$(),...HF().logo&&{logo:HF().logo},...kO()&&{internalUrl:Y$$()},...B0().enableDecoImport&&{enableDecoImport:!0},hostingEnabled:!!B0().controlplaneRestUrl&&!!B0().controlplaneServiceToken,hostingControlPlaneGa:B0().hostingControlPlaneGa,monitorEnabled:!!B0().clickhouseAnalyticsUrl&&!!B0().clickhouseAnalyticsPassword,monitorGa:B0().monitorGa,orderMonitorEnabled:!!B0().orderMonitorIngestUrl&&X2(),plansEnabled:B0().plansEnabled,auth:vH8(),posthog:IK5(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:PU()}};return $.header("Cache-Control","no-store"),$.json({success:!0,config:Z})});rj8=sj8});import{z as R$}from"zod";var kK5,ej8;var $w8=L(()=>{kK5=R$.object({check_id:R$.string(),title:R$.string(),description:R$.string().optional(),impact:R$.string().optional(),why:R$.string().optional(),category:R$.string(),severity:R$.string(),value_band:R$.string().optional(),value_driver:R$.string().optional(),controllability:R$.string().optional(),pages:R$.array(R$.string()),tasks:R$.array(R$.string()),evidence:R$.string(),sample_scope:R$.string().optional(),sources:R$.array(R$.string())}),ej8=R$.object({domain:R$.string(),brand:R$.string(),favicon:R$.string().optional(),scanned_at:R$.string().nullable(),lang:R$.string(),score:R$.number().nullable(),band:R$.string().nullable(),totals:R$.object({measured:R$.number(),registry_total:R$.number(),passed:R$.number(),failed:R$.number(),blocked:R$.number()}),buckets:R$.array(R$.object({id:R$.enum(["critical","important","worth"]),label:R$.string(),items:R$.array(kK5)})),passing:R$.object({count:R$.number(),items:R$.array(R$.object({check_id:R$.string(),title:R$.string()}))}),not_measured:R$.object({count:R$.number(),groups:R$.array(R$.object({reason:R$.string(),label:R$.string(),count:R$.number(),checks:R$.array(R$.string())}))}),categories:R$.array(R$.object({key:R$.string(),label:R$.string(),score:R$.number().nullable(),band:R$.string().nullable(),pass:R$.number(),fail:R$.number()})),screenshots:R$.array(R$.object({url:R$.string(),page_type:R$.string().optional(),viewport:R$.enum(["desktop","mobile"]),image_url:R$.string()}))})});function Zw8($,Z,Q){let Y=Q?`?${new URLSearchParams({lang:Q}).toString()}`:"";return`${kK({})}/api/v2/public/diagnostics/${encodeURIComponent($)}/onepager${Z}${Y}`}async function Eg0($,Z={}){let Q=await fetch(Zw8($,"",Z.lang),{headers:{Accept:"application/json"},signal:Z.signal});if(Q.status===404)return null;if(!Q.ok)throw Error(`onepager read HTTP ${Q.status}`);return ej8.parse(await Q.json())}async function Qw8($,Z={}){let Q=await fetch(Zw8($,".md",Z.lang),{headers:{Accept:"text/markdown"},signal:Z.signal});if(Q.status===404)return null;if(!Q.ok)throw Error(`onepager markdown HTTP ${Q.status}`);return Q.text()}var OT1=L(()=>{$w8();IL()});import{join as Yw8}from"path";async function SK5($){try{let Z=await Eg0($,{signal:AbortSignal.timeout(CK5)});if(!Z?.scanned_at)return null;return{brand:Z.brand.trim()||Sw1($),...Z.score!==null?{score:Z.score}:{}}}catch{return null}}function Q3($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function _K5($,Z){let Q=Eu($),Y=Z?.brand?.trim()||Sw1(Q),X=WG8(Q,128),G=`${(B0().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(Q)}`,{title:W,description:K}=KG8({brand:Y,domain:Q,score:Z?.score}),H=`${G}/og.png`,F=`${Y} Deco Score by decocms`;return[`<title>${Q3(W)}</title>`,`<meta name="description" content="${Q3(K)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${Q3(W)}" />`,`<meta property="og:description" content="${Q3(K)}" />`,`<meta property="og:url" content="${Q3(G)}" />`,`<meta property="og:image" content="${Q3(H)}" />`,'<meta property="og:image:width" content="1200" />','<meta property="og:image:height" content="630" />',`<meta property="og:image:alt" content="${Q3(F)}" />`,'<meta name="twitter:card" content="summary_large_image" />',`<meta name="twitter:title" content="${Q3(W)}" />`,`<meta name="twitter:description" content="${Q3(K)}" />`,`<meta name="twitter:image" content="${Q3(H)}" />`,`<meta name="twitter:image:alt" content="${Q3(F)}" />`,`<link rel="canonical" href="${Q3(G)}" />`,`<link rel="alternate" type="text/markdown" href="${Q3(G)}.md" />`,`<link rel="icon" href="${Q3(X)}" sizes="any" />`].join(`
     `)}function vK5($,Z){return $.replace(/<title>[\s\S]*?<\/title>\s*/i,"").replace(/<meta\s+name="(?:description|twitter:[^"]*)"[^>]*>\s*/gi,"").replace(/<meta\s+property="og:[^"]*"[^>]*>\s*/gi,"").replace(/<link\s+rel="icon"[^>]*>\s*/gi,"").replace("</head>",`    ${Z}
   </head>`)}function Xw8($){let Z=new Z1;return Z.get("/:domain/og.png",async(Q)=>{let Y=Eu(Q.req.param("domain")),X=async()=>{let J=$?Bun.file(Yw8($,"report-og-fallback.png")):null;if(!J||!await J.exists())return Q.notFound();return Q.body(new Uint8Array(await J.arrayBuffer()),200,{"Content-Type":"image/png","Cache-Control":"public, max-age=0, s-maxage=3600"})};try{let J=await fetch(`${kK({})}/api/v2/public/diagnostics/${encodeURIComponent(Y)}/og.png`,{signal:AbortSignal.timeout(bK5)}),G=J.headers.get("content-type")??"";if(!J.ok||!G.startsWith("image/")||!J.body)return X();return Q.body(J.body,200,{"Content-Type":G,"Cache-Control":"public, max-age=0, s-maxage=604800"})}catch{return X()}}),Z.get("/:file{.+\\.md}",async(Q)=>{let Y=Eu(Q.req.param("file").replace(/\.md$/,""));try{let X=await Qw8(Y,{lang:Q.req.query("lang")?.trim()||void 0,signal:AbortSignal.timeout(xK5)});if(X===null)return Q.text("Deco Score not found",404);return Q.body(X,200,{"Content-Type":"text/markdown; charset=utf-8","Cache-Control":"public, max-age=600, stale-while-revalidate=3600","Access-Control-Allow-Origin":"*"})}catch{return Q.text("Deco Score unavailable",502)}}),Z.get("/:domain",async(Q)=>{let Y=Q.req.param("domain"),X=$?Yw8($,"index.html"):null,J=X?Bun.file(X):null;if(!J||!await J.exists())return Q.notFound();let G=await J.text();try{let W=await SK5(Eu(Y)),K=_K5(Y,W);return Q.html(vK5(G,K),200,{"Cache-Control":"public, max-age=0, s-maxage=300"})}catch{return Q.html(G)}}),Z}var CK5=2500,bK5=1e4,xK5=1e4;var Jw8=L(()=>{W8();IL();OT1();l1()});function Pg0($,Z){return fetch(`${kK({})}${$}`,Z)}async function fK5($,Z){let Q=await Eg0($,{lang:Z});if(!Q)return{status:"not_found",report:null};return Q.scanned_at?{status:"ready",report:Q}:{status:"empty",report:null}}function gK5($){let Z=typeof $==="object"&&$!==null?$:{},Q=typeof Z.domain==="string"?Z.domain.trim():"",Y=typeof Z.distinctId==="string"&&Z.distinctId.trim()&&Z.distinctId.length<=200?Z.distinctId.trim():void 0;return{domain:Q,distinctId:Y}}var yK5,Wj,Gw8=async($,Z)=>{if(!$.get("reportUser"))return $.json({error:"Authentication required"},401);await Z();return},Ww8;var Kw8=L(()=>{W8();dK();IL();OT1();yK5=new Set(["complete","errored","terminated","unknown"]);Wj=new Z1;Wj.use("*",async($,Z)=>{let Q=await B4.api.getSession({headers:$.req.raw.headers});$.set("reportUser",Q?.user?.id?{email:Q.user.email}:void 0),await Z(),$.header("Cache-Control","private, no-store"),$.header("Vary","Cookie");return});Wj.use("/link-token/*",Gw8);Wj.use("/suggest",Gw8);Wj.get("/site/:domain",async($)=>{let Z=$.req.param("domain").trim();if(!Z)return $.json({error:"domain is required"},400);let Q=$.req.query("lang")?.trim()||void 0;try{return $.json(await fK5(Z,Q))}catch{return $.json({error:"report read failed"},502)}});Wj.post("/run",async($)=>{let Z=$.get("reportUser"),Q;try{Q=await $.req.json()}catch{return $.json({error:"invalid JSON"},400)}let{domain:Y,distinctId:X}=gK5(Q);if(!Y)return $.json({error:"domain is required"},400);let J=Z?.email;try{let G=await Pg0("/api/v2/diagnostics/run",{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${$P({})}`},body:JSON.stringify({url:Y,...J?{email:J}:{},distinct_id:X})});if(!G.ok)return $.json({error:`run HTTP ${G.status}`},502);let W=await G.json(),K=W.blocked?{state:"blocked"}:W.status==="fresh"?{state:"fresh"}:W.mode==="sync"?{state:"sync"}:{state:"running",id:W.id??null};return $.json(K)}catch{return $.json({error:"run failed"},502)}});Wj.get("/status",async($)=>{let Z=$.req.query("id");if(!Z)return $.json({error:"id is required"},400);try{let Q=await Pg0(`/api/v2/diagnostics/status?id=${encodeURIComponent(Z)}`,{headers:{Authorization:`Bearer ${$P({})}`}});if(!Q.ok)return $.json({error:`status HTTP ${Q.status}`},502);let X=(await Q.json()).status??"unknown",J={done:yK5.has(X),status:X};return $.json(J)}catch{return $.json({error:"status failed"},502)}});Wj.get("/link-token/:id",async($)=>{let Z=$.req.param("id");try{let Q=await Pg0(`/api/v2/public/link-tokens/${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(Q.status===404)return $.json(null);if(!Q.ok)return $.json({error:`link token HTTP ${Q.status}`},502);return $.json(await Q.json())}catch{return $.json({error:"link token resolve failed"},502)}});Wj.get("/suggest",async($)=>{let Z=($.req.query("q")??"").trim().slice(0,64);if(Z.length<2)return $.json({suggestions:[]});try{let Q=await Pg0(`/api/v2/public/suggest?q=${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(!Q.ok)return $.json({suggestions:[]});let Y=await Q.json();return $.json({suggestions:Array.isArray(Y.suggestions)?Y.suggestions:[]})}catch{return $.json({suggestions:[]})}});Ww8=Wj});var hK5=1048576,jT1;var Hw8=L(()=>{W8();_W();l1();cP1();jT1=new Z1;jT1.post("/webhook",h6({maxSize:hK5,onError:($)=>$.json({error:"payload too large"},413)}),async($)=>{let Z=B0().stripeWebhookSecret;if(!Z)return $.json({error:"stripe billing not configured"},503);let Q=await $.req.text();if(!pK8(Q,$.req.header("stripe-signature"),Z))return $.json({error:"invalid signature"},400);let X=nK8(Q);if(!X)return $.json({error:"invalid payload"},400);let J=await tK8(X);return console.log("stripe webhook",{eventId:X.id,type:X.type,livemode:X.livemode,...J}),$.json({received:!0})})});import{timingSafeEqual as uK5}from"crypto";function mK5($,Z,Q){if(!Z?.startsWith("sha256="))return!1;let Y=new Bun.CryptoHasher("sha256",Q).update($).digest("hex"),X=Z.slice(7);if(X.length!==Y.length)return!1;return uK5(Buffer.from(X),Buffer.from(Y))}function dK5($,Z){let Q=Z,Y=Q?.repository?.name,X=Q?.repository?.owner?.login;if(typeof Y!=="string"||typeof X!=="string")return[];let J=[];if($==="check_suite"){if(Q.action!=="completed")return[];let G=Q.check_suite?.pull_requests;for(let W of Array.isArray(G)?G:[]){let K=W?.number;if(typeof K==="number")J.push(K)}}else if($==="issue_comment"&&Q.issue?.pull_request){let G=Q.issue.number;if(typeof G==="number")J.push(G)}return[...new Set(J)].map((G)=>({repoOwner:X,repoName:Y,number:G}))}function Fw8($){let Z=new Z1;return Z.post("/webhook",h6({maxSize:lK5,onError:(Q)=>Q.json({error:"payload too large"},413)}),async(Q)=>{let Y=process.env.GITHUB_WEBHOOK_SECRET;if(!Y)return Q.json({error:"github webhook not configured"},503);let X=await Q.req.text();if(!mK5(X,Q.req.header("x-hub-signature-256"),Y))return Q.json({error:"invalid signature"},400);let J=Q.req.header("x-github-event");if(J!=="push"&&!cK5.has(J??""))return Q.json({ok:!0,ignored:"event"});let G;try{G=JSON.parse(X)}catch{return Q.json({error:"invalid payload"},400)}if(J==="push"){let H=G.ref,F=G.repository?.full_name;if(!H||!F)return Q.json({ok:!0,ignored:"shape"});return f50().then((U)=>U?.markTenantPoolsDirty(`https://github.com/${F}`,H)).catch((U)=>console.warn(`[github-webhook] tenant pool refresh for ${F}@${H} failed: ${U instanceof Error?U.message:String(U)}`)),Q.json({ok:!0})}let W=dK5(J??"",G);if(W.length===0)return Q.json({ok:!0,ignored:"no-pr"});let K=await iK5($,W);return Q.json({ok:!0,refreshed:K})}),Z}async function iK5($,Z){let Q=0;for(let Y of Z){let X=$.taskBoard(),J;try{J=await X.findPrLinks(Y)}catch(G){console.error("[github-webhook] pr link lookup failed:",G);continue}for(let G of J)try{let W=await X.getById(G.taskBoardItemId,G.organizationId),K=W?await $.contextFactory()(G.organizationId,W.assignedBy??W.createdBy):null;if(!K)continue;if(await u88(K,G.organizationId,G.taskBoardItemId)!==null)Q++}catch(W){console.error(`[github-webhook] pr card refresh failed for ${G.taskBoardItemId}:`,W)}}return Q}var lK5=5242880,cK5;var Uw8=L(()=>{W8();_W();IX();fQ();cK5=new Set(["check_suite","issue_comment"])});import{DBOS as ET1,SchedulerMode as pK5}from"@dbos-inc/dbos-sdk";async function tK5(){try{return await oK5()}catch($){return console.warn(`[sandbox-credential-push] push failed: ${$ instanceof Error?$.message:String($)}`),null}}async function oK5(){if(!x50())return null;let[{RemoteSandboxProvider:$},{SandboxProviderRouter:Z}]=await Promise.all([Promise.resolve().then(() => (dH1(),mH1)),Promise.resolve().then(() => (cH1(),lH1))]),Q=await f50(),Y=Q instanceof Z?Q.providers.kubernetes:Q;if(!(Y instanceof $))return null;let{db:X}=E8(),{sandboxes:J,pools:G}=await Y.list(),W=Date.now(),K=si$({sandboxes:J,pools:G,records:await ri$(X,J,G),legacyPools:hC0(process.env.STUDIO_SANDBOX_TENANT_POOLS),now:W}),{batches:H,failed:F}=await ai$(K,Wj0(X,new XJ(B0().encryptionKey)),{now:W,orgFsLifetimeMs:cC0}),U=0,N=0,B=0;for(let D of H)try{let O=await Y.pushCredentials(D);U+=O.stored,N+=O.kept}catch(O){B++,console.warn(`[sandbox-credential-push] a push batch failed: ${O instanceof Error?O.message:String(O)}`)}return{sandboxes:J.length,pushed:U,kept:N,refused:K.refused,failed:F+B}}async function sK5($,Z){let Q=await ET1.runStep(tK5,{name:"pushSandboxCredentials"});if(Q&&(Q.refused>0||Q.failed>0))console.warn(`[sandbox-credential-push] ${Q.sandboxes} sandboxes: pushed ${Q.pushed}, kept ${Q.kept}, refused ${Q.refused}, failed ${Q.failed}`)}function Nw8(){if(wT1)return;if(!B0().agentSandboxEnabled||!x50())return;wT1=ET1.registerWorkflow(sK5,{name:"sandboxCredentialPushWorkflow"}),ET1.registerScheduled(wT1,{name:"sandboxCredentialPushWorkflow",crontab:nK5,mode:pK5.ExactlyOncePerIntervalWhenActive})}var nK5="1,11,21,31,41,51 * * * *",wT1=null;var Bw8=L(()=>{I3();Xw();C31();mC0();uC0();IX();l1()});function Dw8($){let Z=new iO($.db,new XJ($.encryptionKey)),Q=new Z1;return Q.get("/attachments/:token",async(Y)=>{let X=i18(Y.req.param("token"));if(!X)return Y.json({error:"Invalid or expired link"},404);let J=await Z.getByOrg(X.organizationId);if(!J)return Y.json({error:"Jira is not connected"},404);let W=await new $Q(J.siteUrl,J.email,J.apiToken).downloadAttachment(X.attachmentId);if(!W.ok||!W.body)return Y.json({error:"Jira refused the download"},502);let K=new Headers;for(let H of["content-type","content-length","content-disposition"]){let F=W.headers.get(H);if(F)K.set(H,F)}return K.set("cache-control","no-store"),new Response(W.body,{status:200,headers:K})}),Q}var Lw8=L(()=>{W8();Xw();jN1();EO()});function zg0(){try{return B0().jiraSettleSeconds*1000}catch{return pz}}function Ow8($,Z){let Q=Z.windowMs??pz,Y=$.at(-1);if(!Y)return null;if(Z.changeId!==void 0&&Y.id!==Z.changeId)return{kind:"superseded"};if(Z.now!==void 0&&Z.now-Y.at<Q)return{kind:"moving"};let X=rK5($,Q);if((X.id&&Y.toId?X.id===Y.toId:!1)||!X.id&&X.name===Y.to)return{kind:"returned",change:Y};return{kind:"moved",change:Y,from:X}}function rK5($,Z){for(let Y=$.length-2;Y>=0;Y--){let X=$[Y],J=$[Y+1];if(X&&J&&J.at-X.at>=Z)return{id:X.toId,name:X.to}}let Q=$[0];return{id:Q?.fromId??null,name:Q?.from??null}}var PT1=L(()=>{SO();l1()});function jw8($){if(typeof $!=="object"||$===null)return null;let Z=$;if(Z.webhookEvent!=="jira:issue_updated")return null;let Q=Z.issue?.id,Y=Z.issue?.key,X=Z.changelog?.id;if(typeof Q!=="string"&&typeof Q!=="number"||typeof Y!=="string"||typeof X!=="string"&&typeof X!=="number")return null;let J=Z.changelog?.items?.find((G)=>G.field==="status");if(!J||typeof J.toString!=="string")return null;return{issueId:String(Q),issueKey:Y,toStatus:J.toString,changelogId:String(X)}}async function zT1($,Z,Q){if(!Z.enabled)return"disabled";let Y=Z.organizationId,X=new $Q(Z.siteUrl,Z.email,Z.apiToken),J=Ow8(await X.listStatusChanges(Q.issueId),{changeId:Q.changelogId,now:Q.now,windowMs:zg0()});if(!J)return"no_rule";if(J.kind!=="moved")return J.kind;let{change:G,from:W}=J,K=(await $.storage.automations.listJiraTransitionTriggers(Y,{jiraStatus:G.to,activeOnly:!0})).map((N)=>({...N,from:iz(N)})),H=v98(K)&&Z.boardId?_98(await X.getBoardColumnStatusIds(Z.boardId),W.id,G.toId):null,F=S98(K,W.name,H);if(!F)return"no_rule";if(!await $.storage.jiraIntegrations.claimTrigger(Y,Q.issueId,G.id))return"duplicate";return await ZH({automationId:F.automation_id,organizationId:Y,triggerId:F.id,target:{kind:"jira",issues:[Q.issueId],move:{toStatus:G.to,fromStatus:W.name,movedBy:G.by,movedAt:new Date(G.at).toISOString()},eventKey:G.id}},{idempotencyKey:`jira:${F.id}:${G.id}`}),"fired"}var AT1=L(()=>{YU();EO();ut();PT1()});import{DBOS as z2,SchedulerMode as aK5}from"@dbos-inc/dbos-sdk";function ww8($){qT1=$}function MT1(){if(!qT1)throw Error("[jira-trigger] runtime not initialized \u2014 setJiraTriggerSweepRuntime() must run before the workflow fires");return qT1}function VT1(){let $=MT1();return new iO($.db,new XJ($.encryptionKey))}async function YH5($){try{let Z=await VT1().getById($);if(!Z?.enabled||!Z.boardId)return{integrationId:$,fired:0};let Q=await gJ(MT1().db,Z.organizationId);if(!Q)return{integrationId:$,fired:0};if((await Q.storage.automations.listJiraTransitionTriggers(Z.organizationId,{activeOnly:!0})).length===0)return{integrationId:$,fired:0};let X=new $Q(Z.siteUrl,Z.email,Z.apiToken),G=`(${await X.getBoardScopeJql(Z.boardId)}) AND status CHANGED AFTER "-${$H5}m"`,W=0,K;for(let H=0;H<ZH5;H++){let F=await X.searchIssues({jql:G,nextPageToken:K});for(let U of F.issues)if(await zT1(Q,Z,{issueId:U.id,now:Date.now()})==="fired")W++;if(K=F.nextPageToken??void 0,!K)break}return{integrationId:$,fired:W}}catch(Z){return{integrationId:$,fired:0,error:Z instanceof Error?Z.message:String(Z)}}}async function XH5($,Z){let Q=await z2.runStep(()=>VT1().listEnabledIds(),{name:"loadJiraIntegrations"});if(Q.length===0)return;let Y=await Promise.all(Q.map((X)=>z2.runStep(()=>YH5(X),{name:`sweepJira:${X}`})));for(let X of Y)if(X.error)console.warn(`[jira-trigger] integration ${X.integrationId} failed: ${X.error}`);else if(X.fired>0)console.log(`[jira-trigger] integration ${X.integrationId} fired ${X.fired} automation(s) the webhook missed`)}async function JH5($,Z){try{let Q=await VT1().getById($);if(!Q?.enabled)return"disabled";let Y=await gJ(MT1().db,Q.organizationId);if(!Y)return"disabled";let X=await zT1(Y,Q,{issueId:Z.issueId,changelogId:Z.changelogId});if(X==="fired")console.log(`[jira-trigger] fired an automation for ${Z.issueKey} after it settled`);else if(X==="returned")console.log(`[jira-trigger] ${Z.issueKey} went back where it was before settling in "${Z.toStatus}"; no fire`);return X}catch(Q){return console.error(`[jira-trigger] settling ${Z.issueKey} failed`,Q instanceof Error?Q.message:Q),"error"}}async function GH5($,Z){await z2.sleep(zg0()+QH5),await z2.runStep(()=>JH5($,Z),{name:"settleJiraMove"})}async function Ew8($,Z){if(!RT1)throw Error("[jira-trigger] settle workflow is not registered");await z2.startWorkflow(RT1,{workflowID:`jira-settle:${$}:${Z.changelogId}`})($,Z)}function Pw8(){if(TT1)return;RT1=z2.registerWorkflow(GH5,{name:"jiraSettleWorkflow"}),TT1=z2.registerWorkflow(XH5,{name:"jiraTriggerSweepWorkflow"}),z2.registerScheduled(TT1,{name:"jiraTriggerSweepWorkflow",crontab:eK5,mode:aK5.ExactlyOncePerIntervalWhenActive})}var eK5="*/5 * * * *",$H5=20,ZH5=5,QH5=5000,qT1=null,RT1=null,TT1=null;var IT1=L(()=>{Xw();hz();EO();PT1();AT1()});function zw8($){let Z=new iO($.db,new XJ($.encryptionKey)),Q=pw($.db);async function Y(J,G){let W=jw8(G);if(!W)return;let K=await Z.getByWebhookSecret(J);if(!K?.enabled)return;if((await Q.listJiraTransitionTriggers(K.organizationId,{activeOnly:!0})).length===0)return;await Ew8(K.id,W)}let X=new Z1;return X.post("/webhook/:secret",h6({maxSize:WH5}),async(J)=>{let G=J.req.param("secret");if(!await Z.getByWebhookSecret(G))return J.json({error:"Unknown webhook"},404);let K;try{K=await J.req.json()}catch{return J.json({error:"Body must be JSON"},400)}return Y(G,K).catch((H)=>{console.error("[jira-webhook] trigger failed",H)}),J.body(null,202)}),X}var WH5=1048576;var Aw8=L(()=>{W8();_W();Xw();IT1();AT1();O00()});function Tw8($,Z){if(Z.startsWith("text/html")||Z.startsWith("image/svg"))$.set("Content-Security-Policy","sandbox allow-scripts allow-modals allow-same-origin")}var qw8,KH5,HH5,Rw8;var Mw8=L(()=>{W8();UG();Vt();ui();qw8=new Z1,KH5=["range","if-none-match","if-modified-since"],HH5=["content-type","content-length","content-range","accept-ranges","etag","last-modified"];qw8.get("/:org/files/*",async($)=>{let Z=$.get("studioContext"),Q=Z.organization?.id;if(!Z.auth?.user?.id){if(Vo($))return $.redirect(`/login?next=${encodeURIComponent($.req.path)}`,302);throw new R1(401,{message:"Authentication required"})}if(!Q)throw new R1(401,{message:"Organization context required"});let Y=$.req.path.replace(/^.*\/files\//,"");if(!Y)throw new R1(400,{message:"Missing file key"});let X=await jZ0(Y,Z);if(!X)throw new R1(503,{message:"Object storage not configured"});if(X.startsWith("data:")&&_K()){let K=X.match(/^data:([^;]+);base64,(.+)$/s);if(!K)throw new R1(500,{message:"Invalid data URL from storage"});let[,H,F]=K,U=Buffer.from(F,"base64"),N=new Headers({"Content-Type":H,"Cache-Control":"private, max-age=86400"});return Tw8(N,H),new Response(U,{status:200,headers:N})}let J=new Headers;for(let K of KH5){let H=$.req.header(K);if(H)J.set(K,H)}let G=await fetch(X,{headers:J});if(G.status===403||G.status===404)throw new R1(404,{message:"File not found"});if(!G.ok&&G.status!==304&&G.status!==416)throw console.error(`[files] upstream storage error ${G.status} for key:`,Y),new R1(502,{message:"Upstream storage error"});let W=new Headers;for(let K of HH5){let H=G.headers.get(K);if(H)W.set(K,H)}return W.set("Cache-Control","private, max-age=86400"),Tw8(W,W.get("content-type")??""),new Response(G.body,{status:G.status,headers:W})});Rw8=qw8});var VQ0=y((du)=>{var FH5=du&&du.__createBinding||(Object.create?function($,Z,Q,Y){if(Y===void 0)Y=Q;var X=Object.getOwnPropertyDescriptor(Z,Q);if(!X||("get"in X?!Z.__esModule:X.writable||X.configurable))X={enumerable:!0,get:function(){return Z[Q]}};Object.defineProperty($,Y,X)}:function($,Z,Q,Y){if(Y===void 0)Y=Q;$[Y]=Z[Q]}),UH5=du&&du.__exportStar||function($,Z){for(var Q in $)if(Q!=="default"&&!Object.prototype.hasOwnProperty.call(Z,Q))FH5(Z,$,Q)};Object.defineProperty(du,"__esModule",{value:!0});UH5(F3(),du)});var kw8=y((Vw8)=>{Object.defineProperty(Vw8,"__esModule",{value:!0});Vw8.version=void 0;Vw8.version="3.4.0"});var _w8=y((sB)=>{var NH5=sB&&sB.__importDefault||function($){return $&&$.__esModule?$:{default:$}};Object.defineProperty(sB,"__esModule",{value:!0});sB.NodeTransport=sB.VERSION=void 0;sB.nodeResolveHost=wH5;var X9=VQ0(),BH5=V0("net"),kT1=V0("tls"),DH5=V0("path"),Cw8=V0("fs"),LH5=NH5(V0("dns")),OH5=kw8();sB.VERSION=OH5.version;var jH5="nats.js";class Sw8{socket;version;lang;yields=[];signal=(0,X9.deferred)();closedNotification=(0,X9.deferred)();options;connected=!1;tlsName="";done=!1;closeError;constructor(){this.lang=jH5,this.version=sB.VERSION}async connect($,Z){this.tlsName=$.tlsName,this.options=Z;let{tls:Q}=this.options,{handshakeFirst:Y}=Q||{};try{if(Y===!0)this.socket=await this.tlsFirst($);else this.socket=await this.dial($);if(this.done)this.socket?.destroy();let X=await this.peekInfo();(0,X9.checkOptions)(X,Z);let{tls_required:J,tls_available:G}=X,W=G===!0&&Z.tls!==null;if(!Y&&(J||W))this.socket=await this.startTLS();if(this.done)this.socket?.destroy();if(J&&this.socket.encrypted!==!0)throw X9.errors.InvalidArgumentError.format("tls","is not available on this server");return this.connected=!0,this.setupHandlers(),this.signal.resolve(),Promise.resolve()}catch(X){let J=X;if(!J)J=new X9.errors.ConnectionError("error connecting - node provided an undefined error");let{code:G}=J,W=G==="ECONNREFUSED"?new X9.errors.ConnectionError("connection refused",{cause:J}):J;throw this.socket?.destroy(),W}}dial($){let Z=(0,X9.deferred)(),Q,Y=(0,BH5.createConnection)($.port,$.hostname,()=>{Z.resolve(Y),Y.removeAllListeners()});return Y.on("error",(X)=>{Q=X}),Y.on("close",()=>{Y.removeAllListeners(),Z.reject(Q)}),Y.setNoDelay(!0),Z}get isClosed(){return this.done}close($){return this._closed($,!1)}peekInfo(){let $=(0,X9.deferred)(),Z;return this.socket.on("data",(Q)=>{this.yields.push(Q);let Y=X9.DataBuffer.concat(...this.yields),X=(0,X9.extractProtocolMessage)(Y);if(X!=="")try{let J=X9.INFO.exec(X);if(!J)throw Error("unexpected response from server");let G=JSON.parse(J[1]);$.resolve(G)}catch(J){$.reject(J)}finally{this.socket.removeAllListeners()}}),this.socket.on("error",(Q)=>{Z=Q}),this.socket.on("close",()=>{this.socket.removeAllListeners(),$.reject(Z)}),$}loadFile($){if(!$)return Promise.resolve();let Z=(0,X9.deferred)();try{if($=(0,DH5.resolve)($),!(0,Cw8.existsSync)($))Z.reject(Error(`${$} doesn't exist`));(0,Cw8.readFile)($,(Q,Y)=>{if(Q)return Z.reject(Q);Z.resolve(Y)})}catch(Q){Z.reject(Q)}return Z}async loadClientCerts(){let $={},{certFile:Z,cert:Q,caFile:Y,ca:X,keyFile:J,key:G}=this.options.tls;try{if(Z){let W=await this.loadFile(Z);if(W)$.cert=W}else if(Q)$.cert=Q;if(J){let W=await this.loadFile(J);if(W)$.key=W}else if(G)$.key=G;if(Y){let W=await this.loadFile(Y);if(W)$.ca=[W]}else if(X)$.ca=X;return Promise.resolve($)}catch(W){return Promise.reject(W)}}async tlsFirst($){let Z,Q={servername:this.tlsName,rejectUnauthorized:!0};if(this.socket)Q.socket=this.socket;if(typeof this.options.tls==="object")try{let X=await this.loadClientCerts()||{};Q=(0,X9.extend)(Q,this.options.tls,X)}catch(X){return Promise.reject(new X9.errors.ConnectionError(X.message,{cause:X}))}let Y=(0,X9.deferred)();try{let X=(0,kT1.connect)($.port,$.hostname,Q,()=>{X.removeAllListeners(),Y.resolve(X)});X.on("error",(J)=>{Z=J}),X.on("secureConnect",()=>{if(Q.rejectUnauthorized===!1)return;if(!X.authorized)throw X.authorizationError}),X.on("close",()=>{Y.reject(Z),X.removeAllListeners()}),X.setNoDelay(!0)}catch(X){Y.reject(new X9.errors.ConnectionError(X.message,{cause:X}))}return Y}async startTLS(){let $,Z={socket:this.socket,servername:this.tlsName,rejectUnauthorized:!0};if(typeof this.options.tls==="object")try{let Y=await this.loadClientCerts()||{};Z=(0,X9.extend)(Z,this.options.tls,Y)}catch(Y){return Promise.reject(new X9.errors.ConnectionError(Y.message,{cause:Y}))}let Q=(0,X9.deferred)();try{let Y=(0,kT1.connect)(Z,()=>{Y.removeAllListeners(),Q.resolve(Y)});Y.on("error",(X)=>{$=X}),Y.on("secureConnect",()=>{if(Z.rejectUnauthorized===!1)return;if(!Y.authorized)throw Y.authorizationError}),Y.on("close",()=>{Q.reject($),Y.removeAllListeners()})}catch(Y){Q.reject(new X9.errors.ConnectionError(Y.message,{cause:Y}))}return Q}setupHandlers(){let $;this.socket.on("data",(Z)=>{return this.yields.push(Z),this.signal.resolve()}),this.socket.on("error",(Z)=>{$=Z}),this.socket.on("end",()=>{if(this.socket?.destroyed)return;this.socket?.write(new Uint8Array(0),()=>{this.socket?.end()})}),this.socket.on("close",()=>{this._closed($,!1)})}[Symbol.asyncIterator](){return this.iterate()}async*iterate(){while(!0){if(this.yields.length===0)await this.signal;let $=this.yields;this.yields=[];for(let Z=0;Z<$.length;Z++){if(this.options.debug)console.info(`> ${(0,X9.render)($[Z])}`);yield $[Z]}if(this.done)break;else if(this.yields.length===0)$.length=0,this.yields=$,this.signal=(0,X9.deferred)()}}discard(){if(this.done=!0,this.socket)try{this.socket.removeAllListeners(),this.socket.destroy()}catch{}}disconnect(){this._closed(void 0,!0).then().catch()}isEncrypted(){return this.socket instanceof kT1.TLSSocket}_send($){if(this.isClosed||this.socket===void 0)return Promise.resolve();if(this.options.debug)console.info(`< ${(0,X9.render)($)}`);let Z=(0,X9.deferred)();try{this.socket.write($,(Q)=>{if(Q){if(this.options.debug)console.error(`!!! ${(0,X9.render)($)}: ${Q}`);return Z.reject(Q)}return Z.resolve()})}catch(Q){if(this.options.debug)console.error(`!!! ${(0,X9.render)($)}: ${Q}`);Z.reject(Q)}return Z}send($){this._send($).catch((Q)=>{})}async _closed($,Z=!0){if(!this.connected)return;if(this.done){this.socket?.destroy();return}if(this.closeError=$,!$&&this.socket&&Z)try{await this._send(new TextEncoder().encode(""))}catch(Q){if(this.options.debug)console.log("transport close terminated with an error",Q)}try{if(this.socket)this.socket.removeAllListeners(),this.socket?.destroy(),this.socket=void 0}catch(Q){console.log(Q)}this.done=!0,this.closedNotification.resolve(this.closeError)}closed(){return this.closedNotification}}sB.NodeTransport=Sw8;function wH5($){let Z=(0,X9.deferred)();return LH5.default.lookup($,{all:!0},(Q,Y)=>{if(Q){Z.reject(Q);return}let X=[];for(let J of Y)X.push(J.address);if(X.length===0)X.push($);Z.resolve(X)}),Z}});var yw8=y((fw8)=>{Object.defineProperty(fw8,"__esModule",{value:!0});fw8.connect=EH5;var vw8=_w8(),bw8=VQ0(),xw8=VQ0();function EH5($={}){if((0,xw8.hasWsProtocol)($))return Promise.reject(xw8.errors.InvalidArgumentError.format("servers","node client doesn't support websockets, use the 'wsconnect' function instead"));return(0,bw8.setTransportFactory)({factory:()=>{return new vw8.NodeTransport},dnsResolveFn:vw8.nodeResolveHost}),bw8.NatsConnectionImpl.connect($)}});var gw8=y((Kj)=>{var zH5=Kj&&Kj.__createBinding||(Object.create?function($,Z,Q,Y){if(Y===void 0)Y=Q;var X=Object.getOwnPropertyDescriptor(Z,Q);if(!X||("get"in X?!Z.__esModule:X.writable||X.configurable))X={enumerable:!0,get:function(){return Z[Q]}};Object.defineProperty($,Y,X)}:function($,Z,Q,Y){if(Y===void 0)Y=Q;$[Y]=Z[Q]}),AH5=Kj&&Kj.__exportStar||function($,Z){for(var Q in $)if(Q!=="default"&&!Object.prototype.hasOwnProperty.call(Z,Q))zH5(Z,$,Q)};Object.defineProperty(Kj,"__esModule",{value:!0});Kj.connect=void 0;var TH5=yw8();Object.defineProperty(Kj,"connect",{enumerable:!0,get:function(){return TH5.connect}});AH5(VQ0(),Kj)});function lw8($){let Z=$?.connectFn??VH5,Q=null,Y=null,X=!1,J=!1,G=!1,W=[];function K(){return Q!==null&&!Q.isClosed()&&!Q.isDraining()&&!G}function H(){console.log(`[NatsProvider] fireReady: ${W.length} callbacks`);for(let N of W)try{N()}catch{}}function F(N){(async()=>{for await(let B of N.status())if(B.type==="disconnect")console.log("[NatsProvider] Disconnected"),G=!0;else if(B.type==="reconnect")console.log("[NatsProvider] Reconnected, re-firing ready callbacks"),G=!1,Y=null,H()})().catch(()=>{})}async function U(N,B){let D=0;while(!J)try{Q=await Z({servers:N,timeout:MH5,reconnect:!0,maxReconnectAttempts:-1,...B?{authenticator:B}:{}}),console.log(`[NatsProvider] Connected to ${Q.getServer()} after ${D} attempt(s)`),Y=null,G=!1,F(Q),H();return}catch{D++;let O=k7(RH5,qH5,D-1,2,0.5);await J$(O)}}return{init(N,B){if(X)return;X=!0,J=!1;let D=B?.creds?Ag0.credsAuthenticator(new TextEncoder().encode(B.creds)):B?.user?Ag0.usernamePasswordAuthenticator(B.user,B.password):void 0;U(N,D).catch(()=>{})},isConnected(){return K()},getConnection(){return K()?Q:null},getJetStream(){if(!K())return null;if(!Y)Y=uw8.jetstream(Q);return Y},onReady(N){if(W.push(N),K())try{N()}catch{}},async drain(){if(J=!0,X=!1,Y=null,G=!1,Q){let N=Q;Q=null,await N.drain().catch(()=>{})}}}}function VH5($){return hw8.connect($)}var Ag0,hw8,uw8,qH5=100,RH5=3000,MH5=3000;var cw8=L(()=>{n$();Ag0=_(c2(),1),hw8=_(gw8(),1),uw8=_(_H(),1)});function Tg0($,Z){return`${$}.${Z}`}class CT1{cache;constructor($){this.cache=_P({ttlMs:$?.ttlMs??IH5,maxSize:$?.maxSize??kH5})}async get($,Z){return this.cache.get(Tg0($,Z))??null}async set($,Z,Q){this.cache.set(Tg0($,Z),Q)}async invalidate($,Z){this.cache.delete(Tg0($,Z)),this.cache.delete(Tg0($,`${Z}:decisions`))}teardown(){this.cache.clear()}}var IH5=600000,kH5=5000;var mw8=()=>{};function qg0($,Z){return`${$}:${Z}`}function ST1($){let Z=_P({ttlMs:$?.ttlMs??CH5,maxSize:$?.maxSize??SH5}),Q=$?.getConnection,Y=crypto.randomUUID(),X=new TextEncoder,J=new TextDecoder,G=null;function W(K,H){let F=Q?.();if(!F)return;try{F.publish(dw8,X.encode(JSON.stringify({organizationId:K,keyId:H,originId:Y})))}catch(U){console.warn("[ProviderKeyCache] Publish failed (non-critical):",U)}}return{get(K,H){return Z.get(qg0(K,H))},set(K,H,F){Z.set(qg0(K,H),F)},invalidate(K,H){Z.delete(qg0(K,H)),W(K,H)},start(){if(G)return;let K=Q?.();if(!K)return;G=K.subscribe(dw8),(async()=>{for await(let H of G)try{let F=JSON.parse(J.decode(H.data));if(F.originId===Y)continue;Z.delete(qg0(F.organizationId,F.keyId))}catch{}})().catch(console.error)},teardown(){G?.unsubscribe(),G=null,Z.clear()}}}var dw8="studio.ai-provider-keys.invalidate",CH5=30000,SH5=5000;var iw8=()=>{};class _T1{options;subscription=null;onCancel=null;encoder=new TextEncoder;originId=crypto.randomUUID();constructor($){this.options=$}async start($){if($)this.onCancel=$;if(this.subscription)return;if(!this.onCancel)return;let Z=this.options.getConnection();if(!Z)return;let Q=new TextDecoder,Y=Z.subscribe("studio.decopilot.cancel");this.subscription=Y,(async()=>{for await(let X of Y)try{let J=JSON.parse(Q.decode(X.data));if(J.originId===this.originId)continue;this.onCancel?.(J.taskId)}catch{}})().catch(console.error)}broadcast($){if(/[.*>\s]/.test($)){console.warn("[NatsCancelBroadcast] Invalid threadId, skipping broadcast");return}this.onCancel?.($);try{let Z=this.options.getConnection();if(!Z)return;let Q=this.encoder.encode(JSON.stringify({taskId:$,originId:this.originId}));Z.publish("studio.decopilot.cancel",Q)}catch(Z){console.warn("[NatsCancelBroadcast] Publish failed (non-critical):",Z)}}async stop(){this.subscription?.unsubscribe(),this.subscription=null,this.onCancel=null}}var pw8=($)=>{let Z;return()=>Z??=$()},vT1,bT1;var nw8=L(()=>{v6();vT1=pw8(()=>G$.createHistogram("decopilot.stream.encode_ms",{description:"Per-chunk JSON.stringify+encode time for decopilot stream",unit:"ms"})),bT1=pw8(()=>G$.createCounter("decopilot.stream.published_chunks",{description:"Logical decopilot stream chunks published to JetStream",unit:"{chunks}"}))});function gH5($=sw8){return{name:vB,subjects:[`${GL1}.>`],storage:jU.StorageType.File,max_age:bH5,max_bytes:fH5,max_msgs_per_subject:yH5,discard:jU.DiscardPolicy.Old,retention:jU.RetentionPolicy.Limits,duplicate_window:xH5,num_replicas:$}}class rw8{chunks=0;encodeMs=0;maxMs=0;bytes=0;windowStart=performance.now();constructor(){setInterval(()=>this.flush(),1e4).unref?.()}record($,Z){if(this.chunks++,this.encodeMs+=$,$>this.maxMs)this.maxMs=$;this.bytes+=Z}flush(){let $=performance.now(),Z=$-this.windowStart;if(this.chunks>0&&Z>0)console.warn(JSON.stringify({msg:"stream-encode-trace",windowMs:Math.round(Z),chunks:this.chunks,encodeMs:Math.round(this.encodeMs),pctOfLoop:+(this.encodeMs/Z*100).toFixed(1),maxChunkMs:+this.maxMs.toFixed(2),mbEncoded:+(this.bytes/1048576).toFixed(2)}));this.chunks=0,this.encodeMs=0,this.maxMs=0,this.bytes=0,this.windowStart=$}}function tw8($){let Z=ow8.headers();for(let[Q,Y]of Object.entries($))Z.set(Q,Y);return Z}function cH5($,Z){let Q=0;return{publish(Y,X,J,G){Y.publish(X,J,G?{headers:G}:void 0).catch((W)=>{if(Q++,vH5().add(1,{"org.id":Z??"unknown"}),Q===1||Q%100===0)console.warn(`[Decopilot] JetStream publish failed for thread ${$} (${Q} total):`,W)})},get errorCount(){return Q}}}function mH5($,Z){return $.info?.cluster?Z:1}function dH5($){if(!($ instanceof Error))return!1;if(/non-clustered/i.test($.message))return!0;return/replicas?\b/i.test($.message)&&/not supported|can ?not|exceed|insufficient|greater than/i.test($.message)}class xT1{options;js=null;jsm=null;constructor($){this.options=$}async init(){let $=this.options.getConnection();if(!$){console.log("[Decopilot] StreamBuffer.init skipped: NATS not connected yet");return}let Z=async(Y,X)=>{let J=gH5(X);try{await Y.streams.info(vB),await Y.streams.update(vB,J)}catch(G){if(G instanceof Error&&G.message.includes("stream not found"))await Y.streams.add(J),await Y.streams.update(vB,J);else if(G instanceof Error&&/can ?not change.*storage|storage type/i.test(G.message))await Y.streams.delete(vB),await Y.streams.add(J);else throw G}},Q=await F8(async()=>{let Y=this.options.getJetStreamManager?await this.options.getJetStreamManager():await jU.jetstreamManager($),X=mH5($,sw8);try{await Z(Y,X)}catch(J){if(X<=1||!dH5(J))throw J;console.warn(`[Decopilot] StreamBuffer: NATS rejected num_replicas=${X} (${J.message}); falling back to an unreplicated stream`),await Z(Y,1)}return Y},{maxAttempts:5,minTimeout:250,maxTimeout:4000,jitter:0.5,isRetriable:ht});this.js=this.options.getJetStream(),this.jsm=Q,console.log(`[Decopilot] StreamBuffer.init ${this.js?"ready":"degraded (js=null)"}`)}pump($,Z,Q,Y){let X=this.js;if(!X)return console.warn(`[Decopilot] pump: JetStream client unavailable for thread ${Z}; chunks NOT published to NATS`),Promise.resolve();let J=cH5(Z,Y),G=!1,W=()=>{if(G)return;G=!0;let H=G98(Z);X.publish(H.subject,H.data).catch(()=>{})};Q.addEventListener("abort",W,{once:!0});let K=(H)=>{let F=performance.now(),U=KL1(H,{runId:Z}),N=performance.now()-F;vT1().record(N),bT1().add(1,{"org.id":Y??"unknown"}),lH5?.record(N,U.reduce((B,D)=>B+D.data.length,0));for(let B of U)J.publish(X,B.subject,B.data,B.headers?tw8(B.headers):void 0)};return(async()=>{let H=$.getReader(),F=0,U=0,N;try{while(!0){let{done:B,value:D}=await H.read();if(B)break;if(K(D),U++,++F>=64)F=0,await new Promise((O)=>setImmediate(O))}}catch(B){N=B,console.warn(`[Decopilot] stream pump error for thread ${Z}:`,B?.message??B)}finally{if(H.releaseLock(),W(),uH5)console.warn(JSON.stringify({msg:"decopilot-stream-diag",event:"pump-done",taskId:Z,publishedChunks:U,publishErrors:J.errorCount}))}if(N!==void 0)throw N})()}async publishSerialized($,Z){try{return await F8(()=>$.publish(Z.subject,Z.data,{...Z.headers?{headers:tw8(Z.headers)}:{},...Z.msgId?{msgID:Z.msgId}:{}}),{maxAttempts:6,minTimeout:250,maxTimeout:5000,jitter:0.5,isRetriable:ht}),!0}catch(Q){return console.error(`[Decopilot] publish failed after retries subject=${Z.subject}`,Q),!1}}async publishRawChunk($,Z,Q){let Y=this.js;if(!Y)return!1;let X=performance.now(),J=KL1(Z,{runId:$,dedup:Q});vT1().record(performance.now()-X),bT1().add(1);for(let G of J)if(!await this.publishSerialized(Y,G))return!1;return!0}async publishDone($,Z,Q){let Y=this.js;if(!Y)return!1;let X=J98({runId:$,fenceToken:Z,finalSeq:Q});return await this.publishSerialized(Y,X)}async createTailStream($,Z,Q){let Y=this.js;if(!Y)return console.warn(`[Decopilot] createTailStream: JetStream client unavailable for thread ${$}; no live tail`),null;let X=Q?.deliverPolicy==="new"?jU.DeliverPolicy.New:jU.DeliverPolicy.All,J=Q?.closeOnDone??!1,G=dz($),W;try{W=await F8(async()=>{return(await Y.consumers.get(vB,{filter_subjects:G,deliver_policy:X})).consume()},{maxAttempts:6,minTimeout:250,maxTimeout:5000,jitter:0.5,isRetriable:ht})}catch(O){return console.warn("[Decopilot] JetStream tail unavailable (non-critical):",O?.message??O),null}let F=Hb0({messages:async function*(){try{for await(let O of W)yield{subject:O.subject,data:O.data,headers:O.headers}}finally{W.stop()}}(),onCancel:()=>W.stop()}).pipeThrough(Jb0()).pipeThrough(Gb0()).getReader(),U=!1,N=()=>{if(U)return;U=!0;try{F.releaseLock()}catch{}},B=!1,D=()=>{if(B)return;B=!0,W.stop(),F.cancel().catch(()=>{}),N()};return Z?.addEventListener("abort",D,{once:!0}),new ReadableStream({async pull(O){for(;;){let{done:j,value:w}=await F.read();if(j){D(),O.close();return}let E=w;if(E.kind==="done"){if(J){D(),O.close();return}continue}O.enqueue(E.chunk);return}},cancel(){D()}})}purge($){if(!this.jsm)return;this.jsm.streams.purge(vB,{filter:dz($)}).catch(()=>{})}teardown(){this.js=null,this.jsm=null}}var jU,ow8,_H5=($)=>{let Z;return()=>Z??=$()},vH5,bH5=86400000000000,xH5=120000000000,fH5=4294967296,sw8,yH5=500000,hH5,uH5,lH5;var aw8=L(()=>{n$();HL1();Fb0();Wb0();v6();nw8();jU=_(_H(),1),ow8=_(c2(),1),vH5=_H5(()=>G$.createCounter("decopilot.stream.publish_errors",{description:"Number of JetStream publish failures for decopilot stream chunks",unit:"{errors}"})),sw8=Math.max(1,Number(process.env.DECOPILOT_STREAM_REPLICAS??3)||3);hH5=process.env.STREAM_ENCODE_TRACE==="1",uH5=process.env.DECOPILOT_STREAM_TRACE==="1";lH5=hH5?new rw8:null});function Rg0($,Z,Q,Y){if(!Y)return!1;return $.emit(Z,hU(Q,Y.status,{title:Y.title??void 0,virtualMcpId:Y.virtual_mcp_id??void 0,createdBy:Y.created_by??void 0,triggerId:Y.trigger_id??null,branch:Y.branch??null,harnessId:Y.harness_id??void 0,createdAt:Y.created_at,updatedAt:Y.updated_at})),!0}var ew8=L(()=>{q8()});class fT1{storage;options;timer=null;constructor($,Z={}){this.storage=$;this.options=Z}start(){if(this.timer)return;let $=this.options.intervalMs??300000;this.timer=setInterval(()=>{this.runOnce()},$)}async runOnce(){let $=this.options.staleAfterMs??3600000;try{let Z=await this.storage.sweepAbandoned($);if(Z>0)console.log(`[async-research-sweeper] marked ${Z} stale jobs as abandoned`);return Z}catch(Z){return console.error("[async-research-sweeper] sweep failed",Z),0}}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}function iH5($,Z,Q={}){let Y=$.startsWith("thread:")?tF($,Q):$;return[...new Set([Z,Y].filter((X)=>!!X))]}async function yT1($,Z){let Q=Z.organizationId;try{let Y=await $.storage.taskBoard.linkedThreadIds(Z.id,Q);for(let X of Y){let J=await zB($,X);if(!J?.owner||!J?.name)continue;let G=await $.storage.threads.get(X),W=await AB($,{threadId:X,runBranch:G?.branch}),K=await v40($,Q,aB0(J)).catch(()=>null);if(!K){console.warn(`[task-board] no credential for ${J.owner}/${J.name} \u2014 `+`cannot look up ${Z.id}'s change request by branch`);continue}let H=iH5(W,await NS0($,X),{flat:zh(K.repo.provider)});for(let F of H){let U=await K.readForBranch(F).catch(()=>null);if(!U)continue;return await $.storage.taskBoard.linkPr({taskBoardItemId:Z.id,organizationId:Q,url:U.url,prNumber:U.number,repo:K.repo}),await $.storage.taskBoard.openReviewCycleIfInProgress(Z.id,Q),await LW(Q).catch(()=>{}),console.log(`[task-board] ${Z.id}: linked ${U.url} found on branch ${F}`),!0}}}catch(Y){console.error("[task-board] PR lookup by branch failed",Y)}return!1}var $E8=L(()=>{A5();xQ();fQ()});async function ZE8($,Z,Q){let Y=Z.organizationId;if(!hJ(Z))return!1;if(!nh(Q))return!1;if(!await vd($,Y,x10))return!1;if(await $.storage.taskBoard.hasHumanRejectedDone(Z.id,Y))return!1;let X=K1.shipped,J=await $.storage.taskBoard.update(Z.id,Y,{status:X},Z.updatedBy);return await Z9($,{taskBoardItemId:Z.id,action:"status_changed",actorId:null,data:{from:Z.status,to:X,reason:"pr_merged"}}),K8(Y,J),console.log(`[task-board-review-sweeper] ${Z.id}: linked PR already merged \u2014 moved to ${X}`),!0}var QE8=L(()=>{LG();u8();vX();Et();ZU();l5()});function aH5($){return $ instanceof AX}function YE8($,Z){return Z-$>=sH5}class gT1{taskBoard;contextFactory;billing;options;timer=null;running=!1;cursor=null;constructor($,Z,Q,Y={}){this.taskBoard=$;this.contextFactory=Z;this.billing=Q;this.options=Y}start(){if(this.timer)return;let $=this.options.intervalMs??pH5;this.timer=setInterval(()=>{this.runOnce()},$),this.timer.unref()}async runOnce(){if(this.running)return 0;this.running=!0;let $=0;try{let Z=this.options.batchSize??tH5,Q=this.options.itemIntervalMs??nH5,Y=new Date(Date.now()-Q),X=await this.taskBoard.listItemsPendingReview(Z,this.cursor,Y),J=X.at(-1);this.cursor=X.length===Z&&J?{updatedAt:J.updatedAt,id:J.id}:null;for(let{id:G,organizationId:W}of X)try{if(await this.reconcileItem(G,W,Y))$++}catch(K){console.error(`[task-board-review-sweeper] ${G} failed`,K)}await this.reapNeverStartedThreads(Z),$+=await this.dispatchDueRetries(Z),await this.reactToUnhandledFailures(Z),$+=await this.settleFinishedRunsWithoutPr(Z,Y)}catch(Z){console.error("[task-board-review-sweeper] sweep failed",Z)}finally{this.running=!1}return $}async reapNeverStartedThreads($){try{let Z=await this.taskBoard.failNeverStartedLinkedThreads($,new Date(Date.now()-FN1),xB1);for(let Q of Z)console.warn(`[task-board-review-sweeper] failed never-started thread ${Q.threadId} on ${Q.itemId}`)}catch(Z){console.error("[task-board-review-sweeper] reaping failed",Z)}}async reactToUnhandledFailures($){let Z=await this.taskBoard.listItemsStuckAfterFailure($,new Date(Date.now()-rH5));for(let{id:Q,organizationId:Y,threadId:X}of Z)try{console.warn(`[task-board-review-sweeper] reacting to an unhandled failure on ${Q}`),await vB1(this.taskBoard,X,Y),await bB1(this.taskBoard,this.billing,X,Y)}catch(J){console.error(`[task-board-review-sweeper] unhandled-failure reaction for ${Q} failed`,J)}}async settleFinishedRunsWithoutPr($,Z){let Q=0,Y=await this.taskBoard.listItemsFinishedWithoutPr($,Z);for(let{id:X,organizationId:J,finishedAt:G}of Y)try{if(!await this.taskBoard.claimSweep(X,J,Z))continue;let W=await this.taskBoard.getById(X,J);if(!W||W.status!==K1.progress||hJ(W)||W.assigneeId!==o$)continue;let K=await this.contextFactory(J,W.assignedBy??W.createdBy);if(!K)continue;if(await yT1(K,W)){if(await this.taskBoard.clearSweepBudget(X,J),await this.reconcileItem(X,J,Z))Q++;continue}if(!YE8(G.getTime(),Date.now()))continue;let H="the run finished without opening a pull request \u2014 there is "+"nothing for a reviewer to review",F=await this.taskBoard.advanceFromProgress(X,J,K1.review,W.updatedBy);if(!F)continue;await this.taskBoard.recordActivity({taskBoardItemId:X,action:"status_changed",actorId:null,data:{from:K1.progress,to:K1.review,reason:H}}).catch(()=>{}),K8(J,F),await QU(K,F,H)}catch(W){console.error(`[task-board-review-sweeper] settling finished run on ${X} failed`,W)}return Q}async dispatchDueRetries($){let Z=0,Q=await this.taskBoard.listItemsDueForRetry($,new Date);for(let{id:Y,organizationId:X,attempts:J}of Q)try{if(!await this.taskBoard.claimDueRetry(Y,X,new Date))continue;let G=await this.taskBoard.getById(Y,X);if(!G||G.status!==K1.progress||G.assigneeId!==o$)continue;let W=await this.contextFactory(X,G.assignedBy??G.createdBy);if(!W)continue;await RO(W,G,{runClass:"retry"}),Z++,console.warn(`[task-board-review-sweeper] re-dispatched ${Y} after a failure (attempt ${J})`)}catch(G){if(console.error(`[task-board-review-sweeper] retry dispatch for ${Y} failed`,G),aH5(G)){await this.returnToBacklog(Y,X,G instanceof Error?G.message:String(G));continue}await this.taskBoard.scheduleRunRetry(Y,X,J,new Date(Date.now()+oH5)).catch((W)=>console.error(`[task-board-review-sweeper] re-arming ${Y} failed`,W))}return Z}async returnToBacklog($,Z,Q){try{let Y=await this.taskBoard.getById($,Z);if(!Y||Y.status!==K1.progress)return;let X=await this.taskBoard.returnToBacklogAfterFailure($,Z,Y.updatedBy);if(!X)return;await this.taskBoard.recordActivity({taskBoardItemId:$,action:"status_changed",actorId:null,data:{from:K1.progress,to:K1.intake,reason:Q,retriesSpent:Y.retryAttempts}}).catch(()=>{}),K8(Z,X)}catch(Y){console.error(`[task-board-review-sweeper] returning ${$} to backlog failed`,Y)}}async handOffReviewWithoutPr($,Z){let Q=await this.taskBoard.listActivity(Z.id,Z.organizationId);if(!YE8(GL(Q,Z.reviewCycleStartedAt),Date.now()))return;await QU($,Z,"no pull request is linked to this task \u2014 there is nothing for a "+"reviewer to review")}async reconcileItem($,Z,Q){if(!await this.taskBoard.claimSweep($,Z,Q))return!1;let Y=await this.taskBoard.getById($,Z);if(!Y)return!1;if(!hJ(Y))return!1;let X=Y.assigneeId===o$,J=await this.taskBoard.listPrs($,Z),G=await this.contextFactory(Z,Y.assignedBy??Y.createdBy);if(!G)return!1;if(J.length===0){if(await yT1(G,Y))J=await this.taskBoard.listPrs($,Z);if(J.length===0){if(X)await this.handOffReviewWithoutPr(G,Y);return!1}}let W=await Promise.all(J.map(async(K)=>({...K,...await At(Z,K)})));if(W.every((K)=>K.state===null))console.warn(`[task-board-review-sweeper] ${$}: no live PR state from GitHub (${W.length} PR(s)) \u2014 proceeding on unknown`);if(await ZE8(G,Y,W))return!0;if(!X)return!1;if(await Q48(G,Y))return!0;if(!kB1(W))return!1;return await zt(G,Y,{previewMatchesHead:CB1(W)}),!0}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}var pH5=60000,nH5=300000,tH5=50,oH5=60000,sH5=900000,rH5=120000;var XE8=L(()=>{u8();Jv0();$E8();MO();Mt();ZU();QE8();l5();XW();fB1();fQ();c90()});async function JE8($,Z,Q=pz){return await WE8($,Z,Q,{})}async function GE8($,Z,Q,Y=pz){return await WE8($,Q,Y,{activityId:Z})}async function WE8($,Z,Q,Y){let X=await $.automations.findActiveBoardColumnTriggers();if(X.length===0)return 0;let J=new Map;for(let K of X){let H=K.automation.organization_id;J.set(H,[...J.get(H)??[],K])}let G=await $.taskBoard.listSettledTransitions({organizationIds:[...J.keys()],since:new Date(Z-eH5),settledBefore:new Date(Z-Q),limit:$F5,...Y}),W=0;for(let K of G)try{let H=(J.get(K.organizationId)??[]).filter((U)=>U.column_key===K.to&&Date.parse(U.created_at)<Date.parse(K.occurredAt));if(H.length===0)continue;let F=await ZF5($.taskBoard,K,Q);for(let U of H){if(!x98(U,{from:F,to:K.to}))continue;if(!await $.automations.claimTriggerFire(U.id,K.activityId))continue;await $.fire({automationId:U.automation_id,organizationId:K.organizationId,triggerId:U.id,target:{kind:"card",itemId:K.itemId,columnKey:K.to,eventKey:K.activityId,movedBy:K.actorId}},{idempotencyKey:`board:${U.id}:${K.activityId}`}),W++}}catch(H){console.error(`[automations] board transition ${K.activityId} failed`,H)}return W}async function ZF5($,Z,Q){let X=(await $.listActivity(Z.itemId,Z.organizationId)).flatMap((J)=>{let G=J.data;if(J.action!=="status_changed"||typeof G?.to!=="string")return[];let W=typeof G.from==="string"?G.from:null;return W===G.to?[]:[{from:W,to:G.to,occurredAt:J.occurredAt}]});return X.length>0?f98(X,Q):Z.from}var eH5=1800000,$F5=200;var KE8=L(()=>{SO()});import{DBOS as A2,DBOSClient as QF5,SchedulerMode as YF5}from"@dbos-inc/dbos-sdk";function HE8($){Hj=$}async function GF5($){if(!Hj)return 0;try{return await GE8(Hj,$,Date.now(),Hj.settleMs)}catch(Z){return console.error(`[automations] settling board move ${$} failed`,Z),0}}async function WF5(){if(!Hj)return 0;try{return await JE8(Hj,Date.now(),Hj.settleMs)}catch($){return console.error("[automations] board transition sweep failed",$),0}}async function KF5($){await A2.sleep((Hj?.settleMs??pz)+JF5),await A2.runStep(()=>GF5($),{name:"settleBoardMove"})}async function HF5($,Z){let Q=await A2.runStep(()=>WF5(),{name:"sweepBoardMoves"});if(Q>0)console.log(`[automations] board transition sweep fired ${Q} trigger(s) the settle wait missed`)}async function UE8($){let Z=Hj;if(!Z||!uT1)return;if(!await Z.automations.hasActiveBoardColumnTrigger($.taskBoardItemId,$.to))return;let Q=`board-settle:${$.activityId}`;if(!A2.isWithinWorkflow()){await A2.startWorkflow(uT1,{workflowID:Q,queueName:k2})($.activityId);return}let Y=await QF5.create({systemDatabaseUrl:Z.systemDatabaseUrl,systemDatabaseSchemaName:"dbos",systemDatabasePoolSize:1});try{await Y.enqueue({workflowName:FE8,queueName:k2,workflowID:Q},$.activityId)}finally{await Y.destroy()}}function NE8(){if(hT1)return;uT1=A2.registerWorkflow(KF5,{name:FE8}),hT1=A2.registerWorkflow(HF5,{name:"boardTransitionSweepWorkflow"}),A2.registerScheduled(hT1,{name:"boardTransitionSweepWorkflow",crontab:XF5,mode:YF5.ExactlyOncePerIntervalWhenActive})}var XF5="*/5 * * * *",JF5=2000,Hj=null,FE8="boardTransitionSettleWorkflow",uT1=null,hT1=null;var BE8=L(()=>{SO();KE8()});import{readdir as FF5,rm as Mg0}from"fs/promises";import{join as Vg0}from"path";async function Ig0($){let Z=new Date;Z.setUTCDate(Z.getUTCDate()-UF5),Z.setUTCHours(0,0,0,0);let Q=0;try{let Y=await iu($);for(let X of Y)if(/^\d{4}$/.test(X))Q+=await DE8($,X,Z);else if(!X.startsWith(".")){let J=Vg0($,X),G=await iu(J);for(let K of G){if(!/^\d{4}$/.test(K))continue;Q+=await DE8(J,K,Z)}if((await iu(J)).length===0)await Mg0(J,{recursive:!0,force:!0})}}catch(Y){console.warn("monitoring retention cleanup failed:",Y)}return Q}async function DE8($,Z,Q){let Y=0,X=Vg0($,Z),J=await iu(X);for(let W of J){if(!/^\d{2}$/.test(W))continue;let K=Vg0(X,W),H=await iu(K);for(let U of H){if(!/^\d{2}$/.test(U))continue;let N=new Date(`${Z}-${W}-${U}T00:00:00Z`);if(isNaN(N.getTime()))continue;if(N<Q){let B=Vg0(K,U);await Mg0(B,{recursive:!0,force:!0}),Y++}}if((await iu(K)).length===0)await Mg0(K,{recursive:!0,force:!0})}if((await iu(X)).length===0)await Mg0(X,{recursive:!0,force:!0});return Y}async function iu($){try{return(await FF5($)).filter((Q)=>!Q.startsWith("."))}catch{return[]}}var UF5=30;var lT1=()=>{};import{DBOS as cT1,SchedulerMode as NF5}from"@dbos-inc/dbos-sdk";async function DF5(){let $=[qH(),$l(),XD()],Z=0;for(let Q of $)try{Z+=await Ig0(Q)}catch(Y){console.error("[monitoring-retention] cleanup failed:",Y)}return console.log(`[monitoring-retention] deleted ${Z} day-dir(s) across ${$.length} signal dir(s)`),{deleted:Z,dirs:$.length}}async function LF5($,Z){await cT1.runStep(()=>DF5(),{name:"monitoringRetention"})}function OE8(){if(LE8)return;LE8=!0;let $=cT1.registerWorkflow(LF5,{name:"monitoringRetentionWorkflow"});cT1.registerScheduled($,{name:"monitoringRetentionWorkflow",crontab:BF5,mode:NF5.ExactlyOncePerIntervalWhenActive})}var BF5="23 4 * * *",LE8=!1;var jE8=L(()=>{uW();lT1()});function wE8($){return async(Z,Q)=>{let Y=await $.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.role","organization.id as orgId","organization.slug as orgSlug","organization.name as orgName"]).where("member.userId","=",Q).where("member.organizationId","=",Z).executeTakeFirst();if(!Y)return console.warn(`[automationContextFactory] User ${Q} not found in org ${Z} \u2014 returning null`),null;let X=await _Y.create();X.auth.user={id:Q,role:Y.role},X.organization={id:Y.orgId,slug:Y.orgSlug,name:Y.orgName};let J=await FP($.db,Z,Y.role);return X.boundAuth=BP1({auth:X.authInstance,headers:new Headers,role:Y.role,permissions:J,userId:Q}),X.access=new wT(Q,void 0,X.boundAuth,Y.role,"self"),uz(X,{id:Y.orgId,slug:Y.orgSlug}),X}}var EE8=L(()=>{GJ();mN()});function PE8(){return async($,Z)=>{let Q=Date.now(),Y=$.req.method,X=$.req.path;if(X==="/api/auth/get-session"||X.includes("favicon")){await Z();return}let J="",G=!1;if(X.startsWith("/mcp")&&Y==="POST"){G=!0;try{if($.req.header("Content-Type")?.includes("application/json")){let N=await $.req.raw.clone().json();if(N.method==="tools/call"&&N.params?.name){let B=IQ0(N.params.name),D=N.params.arguments||{},O=Object.keys(D).map((w)=>IQ0(w)),j=O.length>0?O.slice(0,3).join(",")+(O.length>3?"\u2026":""):"";J=`${L9.tool}${B}${L9.dim}(${j})${L9.reset}`}else if(N.method)J=`${L9.dim}${IQ0(N.method)}${L9.reset}`}}catch{}}let W=IQ0(X);if(X.startsWith("/mcp/conn_")){let F=X.split("/")[2]??"";W=`/mcp/${L9.mcp}${IQ0(F.slice(0,12))}\u2026${L9.reset}`}else if(X==="/mcp")W=`${L9.mcp}/mcp${L9.reset}`;else if(X==="/mcp/registry")W=`${L9.mcp}/mcp/registry${L9.reset}`;let K=jF5(Y),H=G?"\u25C0":"\u2190";console.log(`${L9.dim}${H}${L9.reset} ${K}${Y}${L9.reset} ${W}${J?` ${J}`:""}`);try{await Z()}finally{let F=Date.now()-Q,U=$.res.status,N=OF5(U),B=F<1000?`${F}ms`:`${(F/1000).toFixed(1)}s`,D=G?"\u25B6":"\u2192";console.log(`${L9.dim}${D}${L9.reset} ${K}${Y}${L9.reset} ${W}${J?` ${J}`:""} ${N}${U}${L9.reset} ${L9.duration}${B}${L9.reset}`)}}}var L9,OF5=($)=>{if($>=500)return L9.serverError;if($>=400)return L9.clientError;if($>=300)return L9.redirect;return L9.ok},jF5=($)=>{return L9[$]||L9.reset},IQ0=($)=>{return $.replace(/\r/g,"").replace(/\n/g,"").replace(/\x1b\[[0-9;]*m/g,"").replace(/[\x00-\x1f\x7f-\x9f]/g,"")};var zE8=L(()=>{L9={reset:"\x1B[0m",dim:"\x1B[2m",bold:"\x1B[1m",GET:"\x1B[36m",POST:"\x1B[33m",PUT:"\x1B[35m",DELETE:"\x1B[31m",ok:"\x1B[32m",redirect:"\x1B[36m",clientError:"\x1B[33m",serverError:"\x1B[31m",mcp:"\x1B[35m",tool:"\x1B[96m",duration:"\x1B[90m"}});import{createHmac as RE8}from"crypto";import{mkdir as wF5,readdir as EF5,rm as AE8,stat as ME8}from"fs/promises";import{join as dT1,relative as PF5}from"path";import{z as X8}from"zod";function IE8($){let Z=$.replace(/[^a-zA-Z0-9_-]/g,"_");return dT1(zF5,Z)}function kE8($){return $.replace(/^\/+/,"").replace(/\.\./g,"")}function mT1($,Z){let Q=IE8($),Y=kE8(Z);return dT1(Q,Y)}function AF5($,Z,Q,Y){let X=B0().encryptionKey||"dev-secret",J=`${$}:${Z}:${Q}:${Y}`;return RE8("sha256",X).update(J).digest("hex")}function qE8($,Z,Q,Y,X){let J=Math.floor(Date.now()/1000)+Y,G=AF5(Z,Q,J,X),W=new URL(`/api/dev-assets/${Z}/${kE8(Q)}`,$);return W.searchParams.set("expires",J.toString()),W.searchParams.set("signature",G),W.searchParams.set("method",X),W.toString()}function CE8($,Z,Q){let Y=`${$}:${Z.getTime()}:${Q}`;return`"${RE8("md5","etag").update(Y).digest("hex")}"`}async function SE8($,Z,Q,Y,X){try{let J=await EF5($,{withFileTypes:!0});for(let G of J){let W=dT1($,G.name),H=PF5(Z,W).replace(/\\/g,"/");if(Q&&!H.startsWith(Q))continue;if(G.isDirectory())if(Y){let F=H+"/";if(!Q||F.startsWith(Q)){if(!(Q?H.slice(Q.length):H).includes("/"))X.commonPrefixes.add(F)}}else await SE8(W,Z,Q,Y,X);else if(G.isFile()){if(Y&&Q){let F=H.slice(Q.length);if(F.includes(Y)){let U=F.indexOf(Y),N=Q+F.slice(0,U+1);X.commonPrefixes.add(N);continue}}try{let F=await ME8(W);X.objects.push({key:H,size:F.size,lastModified:F.mtime.toISOString(),etag:CE8(W,F.mtime,F.size)})}catch{}}}}catch{}}function _E8($,Z){let Y=Q0($).id;return[{name:"LIST_OBJECTS",description:"List objects in the local assets directory with pagination support",inputSchema:X8.object({prefix:X8.string().optional(),maxKeys:X8.number().optional().default(1000),continuationToken:X8.string().optional(),delimiter:X8.string().optional()}),outputSchema:X8.object({objects:X8.array(X8.object({key:X8.string(),size:X8.number(),lastModified:X8.string(),etag:X8.string()})),nextContinuationToken:X8.string().optional(),isTruncated:X8.boolean(),commonPrefixes:X8.array(X8.string()).optional()}),handler:async(X)=>{let J=X,G=J.prefix||"",W=J.maxKeys??1000,K=J.delimiter,H=J.continuationToken,F=IE8(Y);await wF5(F,{recursive:!0});let U={objects:[],commonPrefixes:new Set};await SE8(F,F,G,K,U),U.objects.sort((j,w)=>j.key.localeCompare(w.key));let N=0;if(H){if(N=U.objects.findIndex((j)=>j.key>H),N===-1)N=U.objects.length}let B=U.objects.slice(N,N+W),D=N+W<U.objects.length,O=D?B[B.length-1]?.key:void 0;return{objects:B,isTruncated:D,nextContinuationToken:O,commonPrefixes:Array.from(U.commonPrefixes).sort()}}},{name:"GET_OBJECT_METADATA",description:"Get metadata for a file in the local assets directory",inputSchema:X8.object({key:X8.string()}),outputSchema:X8.object({contentType:X8.string().optional(),contentLength:X8.number(),lastModified:X8.string(),etag:X8.string(),metadata:X8.record(X8.string(),X8.string()).optional()}),handler:async(X)=>{let J=X,G=mT1(Y,J.key),W=await ME8(G);return{contentType:xz1(J.key),contentLength:W.size,lastModified:W.mtime.toISOString(),etag:CE8(G,W.mtime,W.size)}}},{name:"GET_PRESIGNED_URL",description:"Generate a presigned URL for downloading a file from local storage",inputSchema:X8.object({key:X8.string(),expiresIn:X8.number().optional()}),outputSchema:X8.object({url:X8.string(),expiresIn:X8.number()}),handler:async(X)=>{let J=X,G=gO(J.expiresIn,TE8);return{url:qE8(Z,Y,J.key,G,"GET"),expiresIn:G}}},{name:"PUT_PRESIGNED_URL",description:"Generate a presigned URL for uploading a file to local storage",inputSchema:X8.object({key:X8.string(),expiresIn:X8.number().optional(),contentType:X8.string().optional()}),outputSchema:X8.object({url:X8.string(),expiresIn:X8.number()}),handler:async(X)=>{let J=X,G=gO(J.expiresIn,TE8);return{url:qE8(Z,Y,J.key,G,"PUT"),expiresIn:G}}},{name:"DELETE_OBJECT",description:"Delete a single file from local storage",inputSchema:X8.object({key:X8.string()}),outputSchema:X8.object({success:X8.boolean(),key:X8.string()}),handler:async(X)=>{let J=X,G=mT1(Y,J.key);try{return await AE8(G),{success:!0,key:J.key}}catch{return{success:!1,key:J.key}}}},{name:"DELETE_OBJECTS",description:"Delete multiple files from local storage",inputSchema:X8.object({keys:X8.array(X8.string()).max(1000)}),outputSchema:X8.object({deleted:X8.array(X8.string()),errors:X8.array(X8.object({key:X8.string(),message:X8.string()}))}),handler:async(X)=>{let J=X,G=[],W=[];return await Promise.all(J.keys.map(async(K)=>{let H=mT1(Y,K);try{await AE8(H),G.push(K)}catch(F){W.push({key:K,message:F instanceof Error?F.message:"Unknown error"})}})),{deleted:G,errors:W}}}]}async function iT1($,Z,Q){let Y=_E8(Z,Q),X=new WE({name:"dev-assets-mcp",version:"1.0.0"},{capabilities:{tools:{}},jsonSchemaValidator:ZZ});for(let G of Y){let W="shape"in G.inputSchema?G.inputSchema.shape:X8.object({}).shape,K=G.outputSchema&&"shape"in G.outputSchema?G.outputSchema.shape:X8.object({}).shape;X.registerTool(G.name,{description:G.description??"",inputSchema:W,outputSchema:K,annotations:G.annotations,_meta:G._meta},async(H)=>{try{let F=await G.handler(H);return{content:[{type:"text",text:JSON.stringify(F)}],structuredContent:F}}catch(F){return{content:[{type:"text",text:`Error: ${F.message}`}],isError:!0}}})}let J=new zW({enableJsonResponse:$.headers.get("Accept")?.includes("application/json")??!1});return await X.connect(J),FH(X,J,$,"mcp:dev-assets")}async function vE8($,Z,Q,Y){let J=_E8(Q,Y).find((G)=>G.name===$);if(!J)return{content:[{type:"text",text:`Tool not found: ${$}`}],isError:!0};try{let G=await J.handler(Z);return{content:[{type:"text",text:JSON.stringify(G)}]}}catch(G){return{content:[{type:"text",text:G instanceof Error?G.message:String(G)}],isError:!0}}}var zF5="./data/assets",TE8=3600,VE8,bE8;var xE8=L(()=>{l1();st();W8();OH0();ot();UJ();hO();Jy0();VE8=new Z1;VE8.all("/",async($)=>{let Z=$.get("studioContext"),Q=new URL($.req.url),Y=`${Q.protocol}//${Q.host}`;return iT1($.req.raw,Z,Y)});bE8=VE8});var fE8={};O6(fE8,{mountDevRoutes:()=>TF5});function TF5($,Z){$.all("/mcp/:connectionId{.*_dev-assets$}",Z,async(Y)=>{let X=Y.get("studioContext"),J=new URL(Y.req.url),G=`${J.protocol}//${J.host}`;return iT1(Y.req.raw,X,G)}),$.all("/mcp/:connectionId{.*_dev-assets$}/call-tool/:toolName",Z,async(Y)=>{let X=Y.get("studioContext"),J=new URL(Y.req.url),G=`${J.protocol}//${J.host}`,W=Y.req.param("toolName");if(!W)return Y.json({error:"Missing tool name"},400);let K=await Y.req.json(),H=await vE8(W,K,X,G);if(H.isError)return Y.json(H.content,500);return Y.json(H.content)}),$.use("/mcp/dev-assets",Z),$.route("/mcp/dev-assets",bE8);let Q=new Z1;Q.use("*",BU({mountPath:"/api/dev-assets"})),Q.route("/",Xy0({orgFromPath:!1})),$.route("/api/dev-assets",Q)}var yE8=L(()=>{W8();Vz1();Jy0();xE8()});var nE8={};O6(nE8,{watchHandler:()=>pE8,resolveVoiceSigningSecret:()=>mE8,resolveCorsOrigin:()=>dE8,isSsoExemptPath:()=>cE8,isAllowedOAuthRedirectUri:()=>iE8,createApp:()=>bF5});import{readFileSync as qF5}from"fs";import{randomBytes as RF5}from"crypto";import{PrometheusSerializer as MF5}from"@opentelemetry/exporter-prometheus";import{DBOS as rB}from"@dbos-inc/dbos-sdk";import{oAuthDiscoveryMetadata as kF5,oAuthProtectedResourceMetadata as CF5}from"better-auth/plugins";async function VF5($){let Z=$.connect(),Q;try{Q=await Promise.race([Z,hE8(gE8)])}catch{return Z.then((Y)=>Y.release(!0)).catch(()=>{}),!1}try{return await Promise.race([Q.query("SELECT 1"),hE8(gE8)]),Q.release(),!0}catch{return Q.release(!0),!1}}function hE8($){return new Promise((Z,Q)=>setTimeout(()=>Q(Error("pg health-check timeout")),$))}function cE8($){return $.startsWith("/api/org-sso/")||/^\/api\/[^/]+\/sso\//.test($)||$.startsWith("/api/auth/")||$.startsWith("/api/tools/management")||$.startsWith("/oauth-proxy/")||/^\/api\/[^/]+\/oauth-proxy\//.test($)||$.startsWith(`${uf0}/`)||$.startsWith(`${bf0}/`)}function mE8($){let Z=$.studioJwtSecret||$.betterAuthSecret;if(Z)return Z;return console.warn("STUDIO_JWT_SECRET/BETTER_AUTH_SECRET not set - generating a random secret for voice sessions (not persistent across restarts)"),RF5(32).toString("base64")}function dE8($,{baseUrl:Z,requestOrigin:Q}){let Y;try{Y=new URL($).hostname}catch{return null}if(Y==="localhost"||Y==="127.0.0.1")return $;let X=Z??Q;try{if(new URL(X).origin===$)return $}catch{}return null}function iE8($,Z){return $.origin===new URL(Z).origin||$.hostname==="localhost"}async function bF5($={}){let Z=$.database??E8(),Q=!1;I6.stop().catch((F0)=>{console.error("[SSEHub] Error stopping previous broadcast (HMR cleanup):",F0)});let Y,X,J,G,W=new CT1,K,H,F,U=null;if($.disableNats)K=ST1(),Y={get:async()=>null,set:async()=>{},invalidate:async()=>{},teardown:()=>{}},X=null,J=null,G=new mZ0,H={start:async()=>{},broadcast:()=>{},stop:async()=>{}},F={init:async()=>{},pump:(F0)=>{return(async()=>{let G0=F0.getReader();try{while(!0){let{done:P0}=await G0.read();if(P0)break}}catch{}finally{G0.releaseLock()}})()},publishRawChunk:async()=>!1,publishDone:async()=>!1,createTailStream:async()=>null,purge:()=>{},teardown:()=>{}};else{U=lw8();let F0=B0().natsCredsPath,G0;if(F0)try{G0=qF5(F0,"utf8")}catch(B8){console.error(`[app] failed to read NATS_CREDS at ${F0}; connecting anonymously`,B8)}U.init(B0().natsUrls,{creds:G0,user:B0().natsUser,password:B0().natsPassword});let P0=fZ1()?new PZ1({getJetStream:()=>U.getJetStream(),selfListVersion:wg0.version}):null;P0?.init().catch(()=>{}),Y=P0;let z0=new G71({getJetStream:()=>U.getJetStream()});z0.init().catch(()=>{}),X=z0;let j1=new th(TB1,{getJetStream:()=>U.getJetStream()}),b$=new th(m90,{getJetStream:()=>U.getJetStream()});j1.init().catch(()=>{}),b$.init().catch(()=>{}),J={reads:j1,cards:b$};let r$=new pO1({getJetStream:()=>U.getJetStream()});r$.init().catch(()=>{}),G=r$,K=ST1({getConnection:()=>U.getConnection()}),H=new _T1({getConnection:()=>U.getConnection()}),F=new xT1({getConnection:()=>U.getConnection(),getJetStream:()=>U.getJetStream()}),DH8(U),U.onReady(()=>{P0?.init().catch((B8)=>{console.error("[McpListCache] Deferred init failed:",B8)}),z0.init().catch((B8)=>{console.error("[SkillCatalogCache] Deferred init failed:",B8)}),j1.init().catch((B8)=>{console.error("[PrReadCache] Deferred init failed:",B8)}),b$.init().catch((B8)=>{console.error("[PrCardCache] Deferred init failed:",B8)}),r$.init().catch((B8)=>{console.error("[ConnectionCircuitStore] Deferred init failed:",B8)}),K.start(),T2$(()=>U.getConnection()),F.init().catch((B8)=>{console.warn("[Decopilot] StreamBuffer init failed (late-join disabled):",B8)})})}if(T2)await T2();zZ1(Y),K71(X),F71(()=>U?.getConnection()??null),qB1(J),nO1(G);let B={storage:new mc(Z.db),sseHub:I6,onThreadFinished:async(F0,G0)=>qt(new DW(Z.db),F0,G0,new V3(Z.db))},D=new VD1(B),O=new w70(Z.db),j=new fT1(O);j.start(),m98(H),H.start((F0)=>{ov0(F0),D.execute({type:"CANCEL",taskId:F0}).catch((G0)=>{console.error("[Decopilot] CancelBroadcast execute failed:",G0)})}).catch((F0)=>{console.error("[Decopilot] CancelBroadcast start failed:",F0)}),U?.onReady(()=>{H.start().catch((F0)=>{console.error("[CancelBroadcast] Deferred start failed:",F0)})});let w=()=>U?.getConnection()??null;zz1(w),U?.onReady(()=>zz1(w)),Vj1(w),U?.onReady(()=>Vj1(w)),F.init().catch((F0)=>{console.warn("[Decopilot] StreamBuffer init failed, attach/late-join disabled:",F0)}),T2=async()=>{await D.stopAll(),D.dispose(),j.dispose(),H.stop().catch(()=>{}),SF8(),F.teardown(),Y?.teardown(),X?.teardown(),J?.reads.teardown(),J?.cards.teardown(),W.teardown(),K.teardown(),q2$(),G.teardown(),zZ1(null),K71(null),F71(null),qB1(null),nO1(null)};let E=new Z1;if(E.use("*",mO1({enabled:(F0)=>Mo(F0,"debug")==="1"})),E.use("*",sg0),E.use("/*",HH8({origin:(F0,G0)=>dE8(F0,{baseUrl:B0().baseUrl,requestOrigin:new URL(G0.req.url).origin}),credentials:!0,allowMethods:["GET","POST","PUT","DELETE","OPTIONS"],allowHeaders:["Content-Type","Authorization","mcp-protocol-version"],exposeHeaders:["WWW-Authenticate"]})),E.use("*",async(F0,G0)=>{if(await G0(),F0.req.path.includes("/files/"))return;if(F0.req.path.includes("/fs/")&&F0.req.path.endsWith("/read"))return;F0.header("X-Frame-Options","DENY"),F0.header("Content-Security-Policy","frame-ancestors 'none'")}),B0().nodeEnv==="development")E.use("*",PE8());E.use("*",async(F0,G0)=>{if(await G0(),xs(F0.req.path))return;if(F0.res.status>=500){let z0=await F0.res.clone().text();console.error(`[5xx Response] ${F0.req.method} ${F0.req.path} - ${F0.res.status}:`,z0)}}),E.get(pX.HEALTH,(F0)=>{if(Q)return F0.json({status:"shutting_down"},503);return F0.json({status:"ok"})}),E.get(pX.HEALTH_LIVE,(F0)=>{return F0.json({status:"ok"})}),E.get(pX.HEALTH_READY,async(F0)=>{if(Q)return F0.json({status:"shutting_down"},503);let G0={};if(G0.postgres={status:await VF5(Z.pool)?"up":"down"},U)G0.nats=U.isConnected()?{status:"up"}:{status:"down"};else G0.nats={status:"down"};let P0=G0.postgres.status==="up",z0=P0?200:503;return F0.json({status:P0?"ready":"not_ready",services:G0},z0)}),E.get(pX.METRICS,async(F0)=>{try{let G0=await $h0.collect(),P0=IF5.serialize(G0.resourceMetrics);return F0.text(P0,200,{"Content-Type":"text/plain; version=0.0.4; charset=utf-8"})}catch(G0){return console.error("Failed to collect metrics:",G0),F0.text("# Error collecting metrics",500)}});let P=1800000;E.get(`${pX.DBOS_QUEUE_DEPTH_PREFIX}:queueName`,async(F0)=>{let G0=F0.req.param("queueName");if(!SF5.has(G0))return F0.json({error:`Unknown queue: ${G0}`},404);let[P0,z0]=await Promise.all([rB.listQueuedWorkflows({queueName:G0,status:"ENQUEUED",loadInput:!1,loadOutput:!1}),rB.listQueuedWorkflows({queueName:G0,status:"PENDING",loadInput:!1,loadOutput:!1,dequeuedAfter:new Date(Date.now()-P).toISOString()})]);return F0.json({queue_length:P0.length,in_flight:z0.length})}),E.route("/api/config",rj8),E.route("/api/_reports",Ww8),E.route("/api/_stripe",jT1),E.route("/api/_github",Fw8({taskBoard:()=>l,contextFactory:()=>b})),E.route("/api/_git",go);let T={db:Z.db,encryptionKey:B0().encryptionKey};E.route("/api/_jira",zw8(T)),E.route("/api/_jira",Dw8(T)),E.route("/report",Xw8($.clientDir)),E.route("/api/auth/custom",bH8),E.all("/api/auth/admin/*",wF8),E.all("/api/auth/*",async(F0)=>{return await B4.handler(F0.req.raw)});let z=NW8();z.use("/.well-known/oauth-protected-resource/mcp/:connectionId",_70),z.use("/mcp/:connectionId/.well-known/oauth-protected-resource",_70),E.route("/",z),E.get("/.well-known/oauth-protected-resource/api/:org/mcp/:connectionId",L70),E.route("/",jW8()),E.use("/oauth-proxy/:connectionId/*",_70),E.all("/oauth-proxy/:connectionId/*",uE8);let A=async(F0)=>{let P0=await _F5()(F0.req.raw),z0=await P0.json();return Response.json(z0,P0)};E.use("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",_70),E.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",A);let R=async(F0)=>{let P0=await vF5()(F0.req.raw),z0=await P0.json();return Response.json(z0,P0)};E.get("/.well-known/oauth-authorization-server/*/:gateway?/:connectionId?",R);let f=UH8({ttlMs:120000}),S=await UK8({db:Z.db,auth:B4,encryption:{key:B0().encryptionKey},observability:{tracer:jj,meter:G$},modelListCache:W,providerKeyCache:K,memberRoleCache:f});_Y.set(S),d1$({db:Z.db,baseUrl:N5()}),NK8({db:Z.db}),OK8({db:Z.db}),lK8({db:Z.db}),oK8({db:Z.db}),ww8({db:Z.db,encryptionKey:B0().encryptionKey}),o$8({db:Z.db}),ZH8({db:Z.db}),M88({db:Z.db});let V=pw(Z.db),v=new j00(Z.db),b=wE8({db:Z.db});gL1({storage:V,studioContextFactory:b,orgContextFactory:(F0)=>gJ(Z.db,F0),systemDatabaseUrl:V10(B0().databaseUrl,B0().databasePgSsl)}),zL1({systemDatabaseUrl:V10(B0().databaseUrl,B0().databasePgSsl),studioContextFactory:b,deps:{runRegistry:D,cancelBroadcast:H,streamBuffer:F,sseHub:I6}}),LL1({dispatchRunFn:a58,studioContextFactory:b,deps:{runRegistry:D,cancelBroadcast:H,streamBuffer:F,sseHub:I6}});let h=new mc(Z.db),l=new DW(Z.db),d=new V3(Z.db),W0=new gT1(l,b,d);if(B0().taskBoardReviewSweeperEnabled){W0.start();let F0=T2;T2=async()=>{await F0?.(),W0.dispose()}}HE8({automations:V,taskBoard:l,fire:ZH,systemDatabaseUrl:V10(B0().databaseUrl,B0().databasePgSsl),settleMs:B0().boardTransitionSettleSeconds*1000}),X88(UE8),E98({getJetStream:()=>U?.getJetStream()??null,getJetStreamManager:async()=>{let F0=U?.getConnection();return F0?await lE8.jetstreamManager(F0):null},messageParts:h.messageParts(),resolveRun:async(F0)=>{let G0=await Z.db.selectFrom("threads").select(["organization_id","created_by","message_storage_version","status","run_fence_token","title"]).where("id","=",F0).executeTakeFirst();return G0?{orgId:G0.organization_id,createdBy:G0.created_by,version:G0.message_storage_version??1,status:G0.status,runFenceToken:G0.run_fence_token,title:G0.title??null}:null},completeRunIfNotCompleted:async(F0,G0)=>{let P0=await h.completeRunIfNotCompleted(F0,G0);if(Rg0(I6,G0,F0,P0),P0)await qt(l,F0,G0,d);return P0},markRunRequiresAction:async(F0,G0)=>{let P0=await h.requiresActionIfInProgress(F0,G0);return Rg0(I6,G0,F0,P0),P0},markRunFailed:async(F0,G0,P0,z0)=>{let j1=await h.markRunFailed(F0,G0,P0,z0);if(Rg0(I6,G0,F0,j1),j1)await qt(l,F0,G0,d);return j1},clearSynthesizedError:async(F0,G0)=>{await h.messageParts().replaceMessageParts(F0,mz(F0,G0),[])},persistTitle:(F0,G0,P0)=>h.update(F0,G0,{title:P0}),onTitleUpdated:async({runId:F0,orgId:G0,title:P0})=>{let z0=await h.get(F0,G0).catch(()=>null);I6.emit(G0,hU(F0,z0?.status??"in_progress",{title:P0,virtualMcpId:z0?.virtual_mcp_id??void 0,createdBy:z0?.created_by,triggerId:z0?.trigger_id,branch:z0?.branch??null,harnessId:z0?.harness_id??void 0,createdAt:z0?.created_at,updatedAt:z0?.updated_at}))},bumpProgress:async({runId:F0,orgId:G0})=>{await h.bumpProgress(F0,G0)},recordCompleted:async({runId:F0,orgId:G0,distinctId:P0,usage:z0})=>{c1.capture({distinctId:P0,event:"chat_message_completed",groups:{organization:G0},properties:{organization_id:G0,thread_id:F0,transport:"projector",input_tokens:z0.inputTokens,output_tokens:z0.outputTokens,total_tokens:z0.totalTokens}})},recordFailed:async({runId:F0,orgId:G0,distinctId:P0,reason:z0,kind:j1})=>{c1.capture({distinctId:P0,event:"chat_message_failed",groups:{organization:G0},properties:{organization_id:G0,thread_id:F0,transport:"projector",error_category:j1,error_message:z0}})},purgeRun:async(F0)=>{F.purge(F0)}}),z58({studioContextFactory:b,systemDatabaseUrl:V10(B0().databaseUrl,B0().databasePgSsl),streamBuffer:F}),OE8(),i1$(),DK8(),wK8(),mK8(),rK8(),Pw8(),NE8(),$88(),YH8(),V88(),Nw8();let I0=async(F0,G0,P0)=>{let z0=await V.findById(F0,G0);if(!z0)throw Error("Automation not found");return mL1({automationId:z0.id,organizationId:z0.organization_id,triggerId:null})},J0=new _o(V,({automation:F0,trigger:G0,contextMessages:P0,idempotencyKey:z0})=>ZH({automationId:F0.id,organizationId:F0.organization_id,triggerId:G0.id,contextMessages:P0},{idempotencyKey:z0})),U0=[qH(),$l(),XD()];for(let F0 of U0)Ig0(F0).then(()=>{}).catch((G0)=>console.error("[monitoring] Retention cleanup failed:",G0));let o=()=>B4.api.deleteAllExpiredApiKeys().catch((F0)=>console.error("[auth] Expired API key cleanup failed:",F0));o(),setInterval(o,86400000).unref(),E.use("*",async(F0,G0)=>{if(tg0(F0.req.path))return G0();let P0={measure:async(j1,b$)=>{HH(F0,j1);try{return await b$()}finally{AW(F0,j1)}}},z0=await _Y.create(F0.req.raw,{timings:P0});z0.automationRunner=I0,F0.set("studioContext",z0);try{await G0()}finally{let j1=z0.pendingRevalidations;if(j1.length>0)Promise.race([Promise.allSettled(j1),J$(30000)]).catch((r$)=>console.error("[studio] revalidation cleanup error:",r$))}}),E.use("/api/:org/decopilot/*",Io),E.use("/api/:org/v1/*",Io),E.use("/api/:org/files/*",Io),E.use("*",async(F0,G0)=>{if(cE8(F0.req.path))return G0();let P0=F0.get("studioContext");if(!P0?.organization?.id||!P0?.auth?.user?.id)return G0();if(!(await P0.storage.orgSsoConfig.getByOrgId(P0.organization.id))?.enforced)return G0();if(!await P0.storage.orgSsoSessions.isValid(P0.auth.user.id,P0.organization.id))return F0.json({error:"SSO authentication required for this organization"},403);return G0()});let t=new Z1;t.use("*",BU({mountPath:"/api/org-sso"})),t.route("/",mf0()),E.route("/api/org-sso",t),E.get("/api/tools/management",(F0)=>{return F0.json({tools:A00,grouped:OT()})}),E.use("/mcp/*",async(F0,G0)=>{HH(F0,"mcp");try{return await G0()}finally{AW(F0,"mcp")}});let r=async(F0,G0)=>{let P0=F0.var.studioContext;if(!P0.auth.user?.id&&!P0.auth.apiKey?.id){let z0=new URL(F0.req.url),j1=F0.req.header("x-forwarded-proto")?.split(",")[0]?.trim(),b$=j1?`${j1}://${z0.host}`:z0.origin;return F0.res=new Response(null,{status:401,headers:{"WWW-Authenticate":`Bearer realm="mcp",resource_metadata="${b$}${z0.pathname}/.well-known/oauth-protected-resource"`}})}return await G0()};if(E.use("/mcp/:connectionId?",r),E.use("/mcp/gateway/:virtualMcpId?",r),E.use("/mcp/virtual-mcp/:virtualMcpId?",r),E.use("/mcp/self",r),_K()){let{mountDevRoutes:F0}=(yE8(),fg0(fE8));F0(E,r)}let $0=new Z1;$0.use("*",BU({mountPath:"/mcp"})),$0.route("/",ib0()),E.route("/mcp",$0);let X0=new Z1;X0.use("*",BU({mountPath:"/mcp/self"})),X0.route("/",fy0()),E.route("/mcp/self",X0);let h0=new Z1;h0.use("*",BU({mountPath:"/mcp"})),h0.route("/",tb0()),E.route("/mcp",h0),E.use("/api/:org/models/*",async(F0,G0)=>{HH(F0,"llm_models");try{return await G0()}finally{AW(F0,"llm_models")}});let C0=yF8({cancelBroadcast:H,streamBuffer:F,runRegistry:D});E.route("/api",C0),E.route("/api",Rw8);let H1=new Z1;H1.use("*",BU({mountPath:"/api"})),H1.route("/",uy0()),E.route("/api",H1),E.route("/api",pj8);let c0=new Z1;c0.use("*",BU({mountPath:"/api"})),c0.route("/",ly0({tokenStorage:v,automationEventDispatcher:J0})),E.route("/api",c0);let j0=new w00(Z.db),E0=new Z1;E0.use("*",BU({mountPath:"/api"})),E0.route("/",of0()),E.route("/api",E0),E.route("/api/deco-sites",aF8());let n0=new Z1;n0.use("*",BU({mountPath:"/api/deco-sites"})),n0.route("/",rf0()),E.route("/api/deco-sites",n0),E.route(uf0,EF8()),E.route(yD8,uD8()),E.route("/api/_editor-resolve",tj8()),E.route(yH8,gH8()),E.route(bf0,eH8());let O1=B0(),o0=O1.elevenlabsApiKey?new Lg0({apiKey:O1.elevenlabsApiKey,model:O1.elevenlabsVoiceModel,conversationModel:O1.elevenlabsConversationModel,voiceId:O1.elevenlabsVoiceId}):null,b0={openai:O1.openaiLiveApiKey?new HT1({apiKey:O1.openaiLiveApiKey,voice:O1.openaiLiveVoice}):null,elevenlabs:o0?new KT1(o0,()=>U?.getConnection()??null):null},d0=new DT1({adapter:o0,conversationAdapters:b0,defaults:O1,secret:mE8(O1),getConnection:()=>U?.getConnection()??null}),i0=Pj8({voiceSessions:d0,kvStorage:j0,runRegistry:D,streamBuffer:F,sseHub:I6,cancelBroadcast:H,tokenStorage:v,automationEventDispatcher:J0,mountDevAssets:_K(),mcpAuth:r,oauthProxyHandler:uE8,watchHandler:pE8,betterAuthProtectedResourceHandler:A,getNatsConnection:()=>U?.getConnection()??null});return E.route("/api/:org",i0),E.notFound((F0)=>{return F0.json({error:"Not Found",path:F0.req.path},404)}),E.onError(hF8),Object.assign(E,{markShuttingDown:()=>{Q=!0},shutdown:async()=>{if(console.log("[shutdown] Stopping workers..."),await Promise.allSettled([I6.stop(),T2?Promise.resolve(T2()).finally(()=>{T2=null}):Promise.resolve()]),U)await U.drain().catch((F0)=>console.error("[shutdown] NATS drain error:",F0));console.log("[shutdown] Flushing telemetry..."),await pJ().catch((F0)=>console.error("[shutdown] Telemetry flush error:",F0)),console.log("[shutdown] Closing database..."),await rK$(Z).catch((F0)=>console.error("[shutdown] Database close error:",F0)),console.log("[shutdown] Cleanup complete.")},initDbos:async()=>{await rB.registerQueue(G3,{partitionQueue:!0,concurrency:xL1,minPollingIntervalMs:fL1}),await rB.registerQueue(gW,{partitionQueue:!0,concurrency:EL1,priorityEnabled:!0}),await rB.registerQueue(QD,{workerConcurrency:B0().decopilotMaxConcurrentHostedRuns,priorityEnabled:!0}),await rB.registerQueue(YD,{workerConcurrency:B0().sandboxMaxConcurrentHostedRuns,priorityEnabled:!0}),await rB.registerQueue(Oj,{partitionQueue:!0,concurrency:P58}),await rB.registerQueue(I2,R88),await rB.registerQueue(k2),await Iz1(V),await Promise.allSettled(["automations-gate","automations-global","jira-push"].map((F0)=>rB.deleteQueue(F0))),await yL1(Z.pool),_N$().catch((F0)=>{console.error("[studio-pack-backfill] failed:",F0)}),_d(Z.db).catch((F0)=>{console.error("[automations] built-in seed failed:",F0)}),p1$().catch((F0)=>{console.error("[org-fs] public-sets boot sync kick failed:",F0)})}})}var lE8,gE8=5000,T2=null,uE8=async($)=>{let Z=$.req.param("connectionId");if(!Z)return $.json({error:"Missing connectionId"},400);let Q=$.req.path.split("/").filter(Boolean),Y=Q[Q.length-1],X=$.get("studioContext");if(!X)X=await _Y.create($.req.raw),$.set("studioContext",X);let J=$.req.param("org")?X.organization?.id:void 0,G=await X.storage.connections.findById(Z,J);if(!G?.connection_url)return $.json({error:"Connection not found"},404);if(Y==="register"&&G.oauth_config?.clientId){let v=await $.req.json().catch(()=>({}));return $.json({...typeof v==="object"&&v!==null?v:{},client_id:G.oauth_config.clientId,...G.oauth_config.clientSecret?{client_secret:G.oauth_config.clientSecret}:{},client_secret_expires_at:0})}let W=await Po(G.connection_url),K,H=new URL(G.connection_url),U=(typeof G.metadata?.oauthResource==="string"&&G.metadata.oauthResource.length>0?G.metadata.oauthResource:void 0)??G.connection_url;if(W.ok)K=fE1(await W.json());if(!K)K=H.origin;let N=await O70(K);if(!N.ok)return $.json({error:"Failed to get auth server metadata"},502);let B=await N.json(),D;if(Y==="authorize")D=B.authorization_endpoint;else if(Y==="token")D=B.token_endpoint;else if(Y==="register")D=B.registration_endpoint;if(!D)return $.json({error:`Unknown OAuth endpoint: ${Y}`},404);let O=OW8(D);if(O)return O;let j=new URL(D),w=new URL($.req.url);if(j.search=w.search,Y==="authorize"){let v=j.searchParams.get("redirect_uri");if(v){let b=B0().baseUrl??w.origin;try{if(!iE8(new URL(v),b))return $.json({error:"invalid_request",error_description:"redirect_uri is not allowed"},400)}catch{return $.json({error:"invalid_request",error_description:"redirect_uri is malformed"},400)}j.searchParams.set("redirect_uri",v)}if(j.searchParams.has("resource"))j.searchParams.set("resource",U);if(JH8(G.connection_url))j.searchParams.set("auto_personal","true"),j.searchParams.set("force_new","true");return $.redirect(j.toString(),302)}let E={Accept:$.req.header("Accept")||"application/json"},P=$.req.header("Content-Type");if(P)E["Content-Type"]=P;let T=$.req.header("Authorization");if(T)E.Authorization=T;let z,A=null,R=null;if($.req.method!=="GET"&&$.req.method!=="HEAD")if(Y==="token"&&P?.includes("application/x-www-form-urlencoded")){if(T?.toLowerCase().startsWith("basic "))try{let d=atob(T.slice(6).trim()),W0=d.indexOf(":");if(W0!==-1){let I0=decodeURIComponent(d.slice(0,W0)),J0=decodeURIComponent(d.slice(W0+1));A=I0||null,R=J0||null}}catch{}let v=await $.req.formData();if(v.has("resource"))v.set("resource",U);let b=v.get("client_id"),h=v.get("client_secret");if(typeof b==="string"&&b)A=b;if(typeof h==="string"&&h)R=h;let l=new URLSearchParams;for(let[d,W0]of v.entries())l.append(d,W0.toString());z=l.toString()}else if(Y==="register"&&P?.toLowerCase().includes("application/json")){let v=await X.db.selectFrom("organization").select(["id","slug","name"]).where("id","=",G.organization_id).executeTakeFirst(),b=await $.req.text(),h={};try{h=b?JSON.parse(b):{}}catch{z=b}let l=typeof h==="object"&&h!==null&&!Array.isArray(h);if(z===void 0&&!l)z=b;if(z===void 0){let d=h,W0=d.metadata&&typeof d.metadata==="object"?d.metadata:{};d.metadata={...W0,organization_id:G.organization_id,...v?.slug?{organization_slug:v.slug}:{},...v?.name?{organization_name:v.name}:{}},z=JSON.stringify(d),E["Content-Type"]="application/json"}}else z=$.req.raw.body??void 0;let f=await fetch(j.toString(),{method:$.req.method,headers:E,body:z,duplex:"half",redirect:"manual"}),S=new Headers,V=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];for(let[v,b]of f.headers.entries())if(!V.includes(v.toLowerCase()))S.set(v,b);if(Y==="token"&&f.ok){let v=await f.text();try{let b=JSON.parse(v);if(typeof b.access_token==="string"&&b.access_token){let h=typeof b.expires_in==="number"?new Date(Date.now()+b.expires_in*1000):null,l=null;try{l=await K2(G.connection_url)??D}catch{l=D}let d={connectionId:Z,accessToken:b.access_token,refreshToken:typeof b.refresh_token==="string"?b.refresh_token:null,scope:typeof b.scope==="string"?b.scope:null,expiresAt:h,clientId:A,clientSecret:R,tokenEndpoint:l};await new a5(X.db,X.vault).upsert(d)}}catch(b){console.error("[oauth-proxy] failed to persist downstream token:",b)}return new Response(v,{status:f.status,statusText:f.statusText,headers:S})}return new Response(f.body,{status:f.status,statusText:f.statusText,headers:S})},pE8=async($)=>{let Z=$.var.studioContext,Q=Z.auth.user?.id??Z.auth.apiKey?.userId;if(!Q)return $.json({error:"Unauthorized"},401);let Y=Z.organization?.id;if(!Y)return $.json({error:"organization id missing"},400);let X=$.req.query("types"),J=X?X.split(",").map((H)=>H.trim()).filter(Boolean):null,G=$.req.query("scope")==="all";if(G&&(!kB(Y)||!await CB(Z)))return $.json({error:"forbidden"},403);let W=G?i_0:Y;if(G)qO({action:"watch_all_orgs",actorUserId:Q,actorOrgId:Y,targetOrgId:"all"});let K=crypto.randomUUID();return Jj($,async(H)=>{if(await H.writeSSE({event:"connected",data:JSON.stringify({listenerId:K,organizationId:Y,typePatterns:J,connectedAt:new Date().toISOString()})}),!I6.add({id:K,organizationId:W,typePatterns:J?.length?J:null,push:(N,B)=>{H.writeSSE({id:N.id,event:N.type,data:JSON.stringify(G?{...N,organizationId:B}:N)}).catch(()=>{I6.remove(W,K)})}})){await H.writeSSE({event:"error",data:JSON.stringify({error:"Too many connections",message:"SSE connection limit reached. Try again later."})});return}let U=setInterval(()=>{H.writeSSE({event:"keepalive",data:""}).catch(()=>{clearInterval(U),I6.remove(W,K)})},30000);await new Promise((N)=>{H.onAbort(()=>{clearInterval(U),I6.remove(W,K),N()})})})},IF5,SF5,_F5=()=>CF5(B4),vF5=()=>kF5(B4);var tE8=L(()=>{n$();l1();n1$();LK8();EK8();dK8();aK8();sZ0();YB1();XH8();c90();K9();ui();q8();W8();Cf0();FH8();dO1();dK();mN();sP1();I3();v6();Q6();Yz1();hH8();$F8();Kz1();PF8();jz1();Rz1();Mz1();vK();j70();Vz1();uF8();_f0();zj8();Mj8();Vj8();Sj8();lj8();Sz1();pb0();dZ0();nj8();ob0();HA1();oj8();WA1();aj8();Jw8();Kw8();Hw8();Uw8();Bw8();Lw8();Aw8();IT1();yz1();Mw8();KA1();YA1();mQ0();cw8();LT1();AJ();AB0();Z40();MB1();o80();r80();oO1();mw8();iw8();Az1();aw8();gv0();ew8();ea();z00();TO();l5();rE1();XE8();BE8();LG();hz();jE8();cF0();lT1();uW();kz1();zO();BL1();cF0();qZ0();O00();Z01();EE8();nw();zE8();Qs();sP1();jt();ft();sv0();lE8=_(_H(),1);IF5=new MF5,SF5=new Set([G3,gW,QD,YD,Oj,I2])});var aE8={};O6(aE8,{resolveClientDir:()=>lF5,resolveAssetPathWithTraversalCheck:()=>rE8,isPathWithinDirectory:()=>sE8,createAssetHandler:()=>cF5});import{resolve as kQ0,dirname as xF5,join as fF5,extname as yF5,basename as gF5,sep as oE8}from"path";function hF5($,Z){if($===Z||gF5($)==="index.html")return{"Cache-Control":"no-cache"};if($.includes(`${oE8}assets${oE8}`))return{"Cache-Control":"public, max-age=31536000, immutable"};return{}}function sE8($,Z){let Q=kQ0(Z),Y=kQ0($);return Y===Q||Y.startsWith(Q+"/")}function rE8({requestPath:$,clientDir:Z}){let Q=$.startsWith("/")?$.slice(1):$,Y=kQ0(Z,Q);if(!sE8(Y,Z))return null;return Y}function lF5($,Z="../client"){let Q=new URL($),Y=xF5(Q.pathname);return kQ0(Y,Z)}function cF5($={}){let{env:Z="production",clientDir:Q=uF5,isServerPath:Y=()=>!1}=$;if(Z==="development")return async function(J){return null};return async function(J){if(J.method!=="GET")return null;let G=new URL(J.url),W;try{W=decodeURIComponent(G.pathname)}catch{return null}if(Y(W))return null;let K=rE8({requestPath:W,clientDir:Q});if(!K)return null;let H=fF5(K,"index.html"),F=kQ0(Q,"index.html"),U=J.headers.get("accept"),B=U?.includes("text/html")||U?.includes("*/*")&&["",".html"].includes(yF5(K))?[H,F]:[];for(let D of[K,...B])try{let O=Bun.file(D);if(await O.exists())return new Response(O,{headers:hF5(D,F)})}catch{}if(W.includes("/assets/"))return new Response("Not Found",{status:404,headers:{"Cache-Control":"no-store"}});return null}}var uF5="./dist/client";var eE8=()=>{};var $P8={};O6($P8,{tryUpgradePreviewWs:()=>oF5,tryHandlePreviewHttp:()=>tF5,previewWebSocketHandler:()=>sF5,parsePreviewBaseDomain:()=>nF5,isPreviewWsData:()=>kg0,extractHandleFromHost:()=>pT1});function iF5($){if($.method!=="GET")return!1;return($.headers.get("accept")??"").includes("text/html")}function pF5(){return new Response(dF5,{status:503,headers:{"content-type":"text/html; charset=utf-8","cache-control":"no-store","retry-after":"1","access-control-allow-origin":"*"}})}function nF5($){if(!$||$.trim()==="")return null;let Z=$.includes("{handle}")?$.replace("{handle}","__handle__"):$,Q;try{Q=new URL(Z)}catch{return null}let Y=Q.hostname;if($.includes("{handle}")){let X=Y.indexOf(".");if(X<=0||X===Y.length-1)return null;return Y.slice(X+1)}return Y}function pT1($,Z){if(!$||!Z)return null;let Q=$.indexOf(":"),Y=(Q>=0?$.slice(0,Q):$).toLowerCase(),J=`.${Z.toLowerCase().replace(/^\.+|\.+$/g,"")}`;if(!Y.endsWith(J))return null;let G=Y.slice(0,Y.length-J.length);if(!G||G.includes("."))return null;return G}async function tF5($,Z){let Q=pT1($.headers.get("host"),Z.baseDomain);if(!Q)return null;let Y=await Z.getRunner();if(!Y)return SQ0(503,"preview proxy not configured");let X=await Y.proxyPreviewRequest(Q,$);if(X.headers.get(Rn)&&iF5($))return pF5();return X.headers.delete(Rn),X}function SQ0($,Z){return new Response(JSON.stringify({error:Z}),{status:$,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function kg0($){return typeof $==="object"&&$!==null&&$.kind==="preview"}async function oF5($,Z,Q){if(($.headers.get("upgrade")??"").toLowerCase()!=="websocket")return null;let Y=pT1($.headers.get("host"),Q.baseDomain);if(!Y)return null;let X=await Q.getRunner();if(!X)return SQ0(503,"preview proxy not configured");let J=await X.resolvePreviewUpstreamUrl(Y);if(!J)return SQ0(404,"sandbox not found");let G=new URL($.url);if(G.pathname.startsWith("/_sandbox"))return SQ0(404,"not found");let W=`${J.replace(/^http/,"ws")}${G.pathname}${G.search}`,K=$.headers.get("sec-websocket-protocol"),H=K?K.split(",").map((N)=>N.trim()).filter(Boolean):[],F={kind:"preview",upstreamUrl:W,upstreamProtocols:H,pending:[],upstream:null,closed:!1};if(!Z.upgrade($,{data:F}))return SQ0(426,"upgrade failed");return}function CQ0($,Z,Q,Y){if(Z.closed)return;Z.closed=!0;try{$.close(Q,Y)}catch{}try{Z.upstream?.close()}catch{}}var mF5=256,dF5='<!DOCTYPE html><html><head><meta charset="utf-8"><title>Connecting\u2026</title><style>body{font-family:system-ui,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0;background:#fafafa;color:#555}div{text-align:center;max-width:420px;padding:24px}h3{margin:0 0 8px}p{margin:0;font-size:14px;color:#999;line-height:1.5}</style></head><body><div><h3>Connecting to sandbox\u2026</h3><p>Waiting for the sandbox to come online. This page refreshes automatically.</p></div><script>setTimeout(function(){window.location.reload()},1500)</script></body></html>',sF5;var ZP8=L(()=>{I50();sF5={open($){let Z=$.data;if(!kg0(Z))return;let Q;try{Q=Z.upstreamProtocols.length>0?new WebSocket(Z.upstreamUrl,Z.upstreamProtocols):new WebSocket(Z.upstreamUrl)}catch(Y){console.warn(`[preview-ws] failed to dial upstream ${Z.upstreamUrl}: ${Y instanceof Error?Y.message:String(Y)}`),CQ0($,Z,1011,"upstream connect failed");return}Q.binaryType="arraybuffer",Z.upstream=Q,Q.addEventListener("open",()=>{while(Z.pending.length>0){let Y=Z.pending.shift();if(Y!==void 0)Q.send(Y)}}),Q.addEventListener("message",(Y)=>{if(Z.closed)return;$.send(Y.data)}),Q.addEventListener("close",(Y)=>{CQ0($,Z,Y.code||1000,Y.reason||"")}),Q.addEventListener("error",()=>{CQ0($,Z,1011,"upstream error")})},message($,Z){let Q=$.data;if(!kg0(Q))return;let Y=Q.upstream;if(Y&&Y.readyState===WebSocket.OPEN){Y.send(Z);return}if(Q.pending.length>=mF5){CQ0($,Q,1011,"preview ws backlog overflow");return}Q.pending.push(Z)},close($){let Z=$.data;if(!kg0(Z))return;CQ0($,Z,1000,"")}}});n$();var Jq1="14";function Gq1($){return{name:"decocms",systemDatabaseUrl:$.systemDatabaseUrl,systemDatabaseSchemaName:"dbos",systemDatabasePoolSize:$.poolSize,runAdminServer:!1,executorID:$.executorID,applicationVersion:Jq1,...$.listenQueues!==void 0?{listenQueues:$.listenQueues}:{}}}n$();import EP8 from"pg";var Wq1=8314027461559302n,PP8=600000,zP8=500;async function Kq1($,Z){let{databaseUrl:Q,lockTimeoutMs:Y=PP8}=$,X=$.log??((K)=>console.log(K)),J=new EP8.Client({connectionString:Q});await J.connect();let G=Date.now(),W=!1;try{while(!W){if(W=(await J.query("SELECT pg_try_advisory_lock($1) AS locked",[Wq1.toString()])).rows[0]?.locked===!0,W)break;if(Date.now()-G>=Y)throw Error(`Timed out after ${Y}ms waiting for the DBOS migration lock. Another process is still migrating the dbos schema; this pod will restart and retry.`);await J$(zP8)}let K=Date.now()-G;if(K>1000)X(`[dbos] waited ${K}ms for the migration lock; another process migrated first`);return await Z()}finally{if(W)try{await J.query("SELECT pg_advisory_unlock($1)",[Wq1.toString()])}catch{}await J.end().catch(()=>{})}}l1();ug0();v6();function Ez8(){let $=(process.env.BUN_OPTIONS??"").split(/\s+/).filter(Boolean);return[...process.argv.slice(1),...$]}function Yh0($,Z){for(let Q=0;Q<$.length;Q++){let Y=$[Q];if(Y===void 0)continue;if(Y===Z)return $[Q+1];if(Y.startsWith(`${Z}=`))return Y.slice(Z.length+1)}return}function dq1(){let $=Ez8();if($.includes("--cpu-prof")){console.log(JSON.stringify({msg:"cpu-profiling-active",dir:Yh0($,"--cpu-prof-dir")??process.cwd(),name:Yh0($,"--cpu-prof-name"),markdown:$.includes("--cpu-prof-md"),intervalUs:Number(Yh0($,"--cpu-prof-interval")??1000),note:"profile is written on process exit"}));return}if(process.env.CPU_PROFILE)console.warn(JSON.stringify({msg:"cpu-profiling-requested-but-inactive",hint:'CPU profiling is a Bun launch flag. Set BUN_OPTIONS="--cpu-prof --cpu-prof-md --cpu-prof-dir=/tmp" before starting the process.'}))}Gh0();var pQ0;function eq1(){if(process.env.HEAP_WATCH!=="1")return()=>{};let $=Number(process.env.HEAP_WATCH_INTERVAL_MS??60000),Z=async()=>{let Q=_2();if(!Q)return;let Y={};try{let{heapStats:X}=await import("bun:jsc"),J=X(),G=Object.entries(J.objectTypeCounts).sort((W,K)=>K[1]-W[1]).slice(0,20);Y={objectCount:J.objectCount,heapSize:J.heapSize,top:Object.fromEntries(G)}}catch{}console.log(JSON.stringify({msg:"heap-watch",ts:new Date().toISOString(),uptimeS:Math.round(process.uptime()),rss:Q.rss,heapUsed:Q.heapUsed,heapTotal:Q.heapTotal,external:Q.external,arrayBuffers:Q.arrayBuffers,...Y}))};return Z().catch(()=>{}),pQ0=setInterval(()=>void Z().catch(()=>{}),$),pQ0.unref?.(),process.on("SIGUSR2",()=>{try{let Q=Bun.generateHeapSnapshot("v8"),Y=typeof Q==="string"?Q:JSON.stringify(Q),X=`/tmp/heap-${process.pid}-${Date.now()}.heapsnapshot`;Bun.write(X,Y),console.log(JSON.stringify({msg:"heap-snapshot-written",path:X}))}catch(Q){console.error("[heap-watch] snapshot failed:",Q)}}),()=>{if(pQ0)clearInterval(pQ0)}}import*as Az8 from"bun:jsc";var{startSamplingProfiler:Tz8,samplingProfilerStackTraces:qz8}=Az8;function $R1(){if(process.env.STALL_WATCHDOG!=="1")return()=>{};let $=Number(process.env.STALL_WATCHDOG_MS??100),Z=Number(process.env.STALL_WATCHDOG_TICK_MS??50);try{Tz8()}catch(J){return console.error("[stall-watchdog] failed to start sampling profiler:",J),()=>{}}let Q,Y=performance.now()+Z,X=()=>{let J=performance.now(),G=J-Y;Y=J+Z;let W=[];try{W=qz8()?.traces??[]}catch{}if(G>$&&W.length>0){let K=new Map;for(let F of W){let U=F.frames.find((D)=>D.sourceURL&&!/Unknown Executable/.test(D.category??""))??F.frames[0];if(!U)continue;let N=(U.sourceURL??"?").replace(/^.*\/node_modules\//,"node_modules/"),B=`${U.name??"?"} @ ${N}:${U.line??"?"}`;K.set(B,(K.get(B)??0)+1)}let H=[...K.entries()].sort((F,U)=>U[1]-F[1]).slice(0,8).map(([F,U])=>({frame:F,count:U}));console.warn(JSON.stringify({msg:"stall-stack",ts:new Date().toISOString(),lagMs:Math.round(G),samplesInWindow:W.length,top:H}))}Q=setTimeout(X,Z),Q.unref?.()};return Q=setTimeout(X,Z),Q.unref?.(),()=>{if(Q)clearTimeout(Q)}}function ZR1(){dq1();let $=[eq1(),aq1(),$R1()];return()=>{for(let Z of $)Z()}}import{existsSync as XU5}from"fs";var fW=B0();lq1();var{DBOS:_Q0,DBOSClient:rF5}=await import("@dbos-inc/dbos-sdk");function aT1($,Z){if(!Z)return $;let Q=new URL($);if(!Q.searchParams.has("sslmode"))Q.searchParams.set("sslmode","verify-full");return Q.toString()}var aF5=[G3,gW,QD,YD,Oj,I2,k2],eF5=fW.dispatchRole==="worker"?aF5:fW.dispatchRole==="api"?[]:void 0;_Q0.setConfig(Gq1({systemDatabaseUrl:aT1(fW.databaseUrl,fW.databasePgSsl),poolSize:fW.dbosPoolSize,executorID:fW.podName,listenQueues:eF5}));var{createApp:$U5}=await Promise.resolve().then(() => (tE8(),nE8)),{isServerPath:ZU5}=await Promise.resolve().then(() => (mQ0(),qq1)),{createAssetHandler:QU5,resolveClientDir:GP8}=await Promise.resolve().then(() => (eE8(),aE8)),YU5=fW.port,QP8=GP8(import.meta.url,"../client"),WP8=XU5(QP8)?QP8:GP8(import.meta.url,"../dist/client"),JU5=QU5({clientDir:WP8,isServerPath:ZU5}),GU5={"X-Frame-Options":"DENY","Content-Security-Policy":"frame-ancestors 'none'"};function WU5($){let Z=new Headers($.headers);for(let[Q,Y]of Object.entries(GU5))Z.set(Q,Y);return new Response($.body,{status:$.status,statusText:$.statusText,headers:Z})}var{parsePreviewBaseDomain:KU5,tryHandlePreviewHttp:HU5,tryUpgradePreviewWs:FU5,previewWebSocketHandler:nT1,isPreviewWsData:tT1}=await Promise.resolve().then(() => (ZP8(),$P8)),{getOrInitSharedRunner:KP8}=await Promise.resolve().then(() => (IX(),Nn$)),HP8=KU5(process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN),YP8={baseDomain:HP8??"",getRunner:KP8};if(process.env.STUDIO_SANDBOX_TENANT_POOLS?.trim())KP8().catch(($)=>{console.warn("[lifecycle] eager sandbox provider init for tenant pools failed:",$ instanceof Error?$.message:String($))});var Cg0=await $U5({clientDir:WP8}),oT1=process.env.DBOS_CONDUCTOR_KEY?.trim(),XP8=process.env.DBOS_CONDUCTOR_URL?.trim();await Kq1({databaseUrl:aT1(fW.databaseUrl,fW.databasePgSsl)},()=>_Q0.launch({...oT1?{conductorKey:oT1}:{},...oT1&&XP8?{conductorURL:XP8}:{}}));console.log(`[dbos] application version: ${_Q0.applicationVersion}`);var sT1=5,rT1=0;await F8(async()=>{rT1++;try{return await Cg0.initDbos()}catch($){let Z=rT1>=sT1?"giving up":"retrying";throw console.warn(`[dbos] initDbos attempt ${rT1}/${sT1} failed, ${Z}`,$),$}},{maxAttempts:sT1,minTimeout:1000,maxTimeout:1e4,jitter:0.5});var UU5=Bun.serve({idleTimeout:0,port:YU5,hostname:"0.0.0.0",fetch:async($,Z)=>{if(HP8){let Y=await FU5($,Z,YP8);if(Y===void 0)return;if(Y)return Y;let X=await HU5($,YP8);if(X)return X}let Q=await JU5($);if(Q)return WU5(Q);return Cg0.fetch($,{server:Z})},websocket:{open($){if(tT1($.data))nT1.open($)},message($,Z){if(tT1($.data))nT1.message($,Z)},close($){if(tT1($.data))nT1.close($)}},development:!1}),NU5=ZR1();if(fW.localMode)Promise.resolve().then(() => (sh(),Sv0)).then(async({seedLocalMode:$,markSeedComplete:Z,healLocalJwks:Q})=>{try{let Y=await Q();if(Y>0)console.log(`[local-mode] cleared ${Y} undecryptable JWKS key(s); Better Auth will generate a fresh one`);let X=await $()}catch(Y){console.error("Failed to seed local mode:",Y)}finally{Z()}}).catch(async($)=>{console.error("Failed to load local-mode module:",$);try{let{markSeedComplete:Z}=await Promise.resolve().then(() => (sh(),Sv0));Z()}catch{}});var JP8=!1;async function BU5($){let Z;try{Z=await rF5.create({systemDatabaseUrl:aT1(fW.databaseUrl,fW.databasePgSsl),systemDatabaseSchemaName:"dbos"});let Q=await Z.listWorkflows({status:"PENDING",queueName:gW,executorId:$,loadInput:!1,loadOutput:!1});if(Q.length===0){console.log(`[shutdown] no in-flight thread-gate gates to hand off (executor ${$})`);return}let Y=Q.map((X)=>X.workflowID);await Z.resumeWorkflows(Y,{queueName:gW}),console.log(`[shutdown] re-enqueued ${Y.length} in-flight thread-gate gate(s) for re-adoption by a live executor (from ${$}):`,Y)}catch(Q){console.error("[shutdown] thread-gate handoff failed:",Q)}finally{await Z?.destroy().catch(()=>{})}}async function Sg0($){if(JP8)return;JP8=!0,console.log(`
 [shutdown] Received ${$}, shutting down gracefully...`);let Z=Number(process.env.SHUTDOWN_GRACE_SECONDS??60)*1000,Q=Math.max(Z-5000,1e4),Y=setTimeout(()=>{console.error(`[shutdown] Timed out after ${Q}ms, forcing exit.`),process.exit(1)},Q);Y.unref?.();let X=0;try{NU5(),Cg0.markShuttingDown();let J=Hq1(fW.dispatchRole,Q,process.env.SHUTDOWN_DRAIN_MS);await J$(J),await UU5.stop(!0);let G=_Q0.executorID;await _Q0.shutdown(),await BU5(G),await Cg0.shutdown()}catch(J){console.error("[shutdown] Error during shutdown:",J),X=1}clearTimeout(Y),process.exit(X)}process.on("SIGTERM",()=>Sg0("SIGTERM"));process.on("SIGINT",()=>Sg0("SIGINT"));process.on("SIGHUP",()=>Sg0("SIGHUP"));process.on("unhandledRejection",($)=>{console.error("[process] Unhandled rejection:",$)});process.on("uncaughtException",($)=>{console.error("[process] Uncaught exception:",$),Sg0("uncaughtException")});