decocms 4.76.83 → 4.76.85

package/dist/server/cli.js

@@ -84517,7 +84517,7 @@ ${$}`;h(N);return}if(E(null,y),t.strategy==="count"){if(w--,w===0)h()}if(t.strat
   `);function h(_){if(t===void 0)return!0;let v=sM(_),D=v&&sM(t)?bmu(t):t,n=v?bmu(_):Cmu(_),O=ZCt(D,n);return O===""||!O.startsWith("..")&&!NCt(O)}return{upsert(_){f.run({$handle:_.handle,$status:_.status,$sandboxPath:_.sandboxPath,$port:_.port??null,$previewUrl:_.previewUrl??null,$repoCloneUrl:_.repoCloneUrl??null,$branch:_.branch??null,$projectName:_.projectName??null,$error:_.error??null,$now:Date.now()})},list(){return l.all().map(j1i)},reconcile(){let _=Date.now();for(let v of l.all().map(j1i)){if(!h(v.sandboxPath)){c.run({$handle:v.handle,$now:_});continue}if(!sM(v.sandboxPath)){E.run({$handle:v.handle,$now:_});continue}if(v.status==="spawning"||v.status==="ready"||v.status==="failed"||v.status==="missing")$.run({$handle:v.handle,$now:_})}return l.all().map(j1i)},prune(_){let v=[],D=[],n=this.reconcile();for(let O of n){if(!h(O.sandboxPath)){D.push({handle:O.handle,sandboxPath:O.sandboxPath,reason:"outside_root",deletedFiles:!1});continue}if(_.missing&&O.status==="missing"){w.run({$handle:O.handle}),v.push({handle:O.handle,sandboxPath:O.sandboxPath,reason:"missing",deletedFiles:!1});continue}if(!_.merged||!sM(O.sandboxPath))continue;if(O.branch===null||O.branch.trim()===""){D.push({handle:O.handle,sandboxPath:O.sandboxPath,reason:"no_branch",deletedFiles:!1});continue}if(!y2(O.sandboxPath,["rev-parse","--is-inside-work-tree"]).ok){D.push({handle:O.handle,sandboxPath:O.sandboxPath,reason:"git_unavailable",deletedFiles:!1});continue}let N=y2(O.sandboxPath,["status","--porcelain"]);if(!N.ok){D.push({handle:O.handle,sandboxPath:O.sandboxPath,reason:"git_unavailable",deletedFiles:!1});continue}if(N.stdout.trim()!==""){D.push({handle:O.handle,sandboxPath:O.sandboxPath,reason:"dirty_worktree",deletedFiles:!1});continue}let y=qmu(O.sandboxPath,O.branch);if(y===null){D.push({handle:O.handle,sandboxPath:O.sandboxPath,reason:"git_unavailable",deletedFiles:!1});continue}if(!y){D.push({handle:O.handle,sandboxPath:O.sandboxPath,reason:"branch_not_merged",deletedFiles:!1});continue}gCt(O.sandboxPath,{recursive:!0,force:!0}),w.run({$handle:O.handle}),v.push({handle:O.handle,sandboxPath:O.sandboxPath,reason:"merged",deletedFiles:!0})}return{removed:v,skipped:D}},delete(_){w.run({$handle:_})},inspect(_){let v=d.get({$handle:_});if(v===null)return null;let D=j1i(v),n=0,O=null;if(sM(D.sandboxPath)&&y2(D.sandboxPath,["rev-parse","--is-inside-work-tree"]).ok){let N=y2(D.sandboxPath,["status","--porcelain"]);if(N.ok){let y=N.stdout.trim();n=y===""?0:y.split(`
 `).length}if(D.branch!==null&&D.branch.trim()!=="")O=qmu(D.sandboxPath,D.branch)}return{handle:D.handle,branch:D.branch,sandboxPath:D.sandboxPath,dirtyCount:n,merged:O}},close(){u.close()}}}var KRi=()=>{};function UCt(i,u){return u?[["umount","-f",i]]:[["fusermount","-uz",i],["umount","-l",i]]}function rmu(i,u){if(process.platform==="win32")return;for(let t of UCt(i,u))if(Bun.spawnSync(t,{stdout:"ignore",stderr:"ignore",timeout:5000}).exitCode===0)break}var mmu=()=>{};import{existsSync as PCt,readdirSync as ACt}from"fs";import{rm as ICt}from"fs/promises";import{join as emu}from"path";async function amu(i,u={}){let t=u.detach??xCt,f=u.exists??PCt,l=u.readdir??(($)=>ACt($)),c=u.rm??(($)=>ICt($,{recursive:!0,force:!0})),E=emu(i,"org");if(f(E))for(let $ of l(E))t(emu(E,$));await c(i)}var xCt=(i)=>rmu(i,process.platform==="darwin");var omu=g(()=>{mmu()});import{join as kCt}from"path";function smu(i){let u=i.purge??amu;return{stopSandbox(t){return i.provider.deleteSandbox(t)},inspectSandbox(t){return i.registry.inspect(t)},async removeSandbox(t){try{return await Cl(async()=>{if(await i.provider.deleteSandbox(t),i.provider.hasHandle(t))throw Error("Can't delete \u2014 run in progress");let l=i.registry.inspect(t)?.sandboxPath??kCt(i.dataDir,"sandboxes",t);await u(l)},{maxAttempts:2,minTimeout:250,jitter:0}),i.registry.delete(t),{ok:!0}}catch(f){let l=f instanceof Wc?f.cause:f;return{ok:!1,error:l instanceof Error?l.message:String(l)}}}}}var pmu=g(()=>{y4();omu()});import{randomBytes as GCt}from"crypto";import{mkdir as SCt}from"fs/promises";import{createServer as jCt}from"net";import{join as KCt}from"path";function ieu(i,u){return Error(`sandbox failed to start: ${i}`,{cause:u})}function JCt(i){if(!(i instanceof Error))return!1;return i.name==="TimeoutError"||/timed out|timeout|operation was aborted|aborted/i.test(i.message)}function ueu(i){if(i instanceof Error){let u=i.cause;if(u instanceof Error&&u.message)return u.message;return i.message}return String(i)}function XCt(i){if(!i)return null;let u=i.trim().replace(/\/+$/,"");if(!u)return null;let t=u.split(/[/:]/).filter(Boolean).at(-1);if(!t)return null;return t.replace(/\.git$/i,"")||null}function LCt(i){return{repoCloneUrl:i.repo?.cloneUrl??null,branch:i.repo?.branch??null,projectName:XCt(i.repo?.cloneUrl)}}function teu(i){let u=i.maxSandboxes??20,t=new Map,f=i.pickPort??WCt,l=i.fetchImpl??fetch,c=i.resolvePreviewUrl??((n,O)=>`http://127.0.0.1:${O}`),E=(n)=>KCt(i.dataDir,"sandboxes",n),$=(n)=>{try{i.registry?.upsert(n)}catch(O){console.warn(`[user-desktop] failed to persist sandbox lifecycle handle=${n.handle} status=${n.status}:`,O)}},w=(n)=>{try{i.onEvent?.(n)}catch{}},d=async(n)=>{let O=new AbortController,N=setTimeout(()=>O.abort(),1500);try{let y=await l(`${n}/health`,{signal:O.signal});if(!y.ok)console.warn(`[user-desktop] probe ${n}/health \u2192 ${y.status} (treating as dead)`);return y.ok}catch(y){return console.warn(`[user-desktop] probe ${n}/health failed: ${y instanceof Error?y.message:String(y)} (treating as dead)`),!1}finally{clearTimeout(N)}},h=(n)=>{console.warn(`[user-desktop] evicting dead daemon handle=${n.handle} port=${n.port}`);try{n.process.kill("SIGTERM")}catch{}if(t.get(n.handle)===n)t.delete(n.handle),$({handle:n.handle,status:"stopped",sandboxPath:E(n.handle),port:null,previewUrl:null,...n.registryMetadata,error:null}),w({handle:n.handle,phase:"evicted"})},_=new Map;function v(){if(t.size<u)return;let n=[...t.values()].filter((N)=>N.activeDispatchCount===0).sort((N,y)=>N.lastUsedAt-y.lastUsedAt);if(n.length===0){console.warn(`[user-desktop] at cap ${t.size}/${u} but every sandbox is pinned (active dispatch) \u2014 exceeding cap temporarily`);return}let O=n[0];console.log(`[user-desktop] evicting LRU victim handle=${O.handle} port=${O.port} (cap ${u} reached, size=${t.size})`);try{O.process.kill("SIGTERM")}catch{}t.delete(O.handle),$({handle:O.handle,status:"stopped",sandboxPath:E(O.handle),port:null,previewUrl:null,...O.registryMetadata,error:null}),w({handle:O.handle,phase:"evicted"})}let D=async(n)=>{let O=LCt(n),N=E(n.handle);$({handle:n.handle,status:"spawning",sandboxPath:N,port:null,previewUrl:null,...O,error:null}),w({handle:n.handle,phase:"spawning",sandboxPath:N,projectName:O.projectName,branch:O.branch}),v();let y,Z=null,T;try{await SCt(N,{recursive:!0}),console.log(`[user-desktop] ensure handle=${n.handle} repo=${n.repo?.cloneUrl??"(none)"} branch=${n.repo?.branch??"(none)"} runtime=${n.workload?.runtime??"(autodetect)"} pm=${n.workload?.packageManager??"(autodetect)"}`),T=GCt(24).toString("hex");let[G,I]=await Promise.all([f(),f()]);y=G,console.log(`[user-desktop] spawn handle=${n.handle} port=${y} devPort=${I} workdir=${N}`),Z=await Promise.resolve(i.spawnDaemon({workdir:N,handle:n.handle,port:y,daemonToken:T,offloadAllowedHosts:n.offloadAllowedHosts??[],offloadAllowSameHostDev:n.offloadAllowSameHostDev??!1,orgFsConfigJson:n.orgFsConfigJson}));try{await i.waitForHealth(y)}catch(k){throw ieu("the sandbox didn't come online in time",k)}console.log(`[user-desktop] healthy handle=${n.handle} port=${y} \u2014 posting config`);try{await i.postConfig(y,I,{repo:n.repo,workload:n.workload,operator:n.operator},T)}catch(k){throw ieu(JCt(k)?"configuration timed out":"the sandbox rejected its configuration",k)}}catch(G){if(console.error(`[user-desktop] sandbox bring-up failed handle=${n.handle} port=${y??"(none)"}${Z?" (killing daemon)":""}:`,G),Z)try{Z.kill("SIGKILL")}catch{}throw w({handle:n.handle,phase:"failed",error:ueu(G),sandboxPath:N,projectName:O.projectName,branch:O.branch}),$({handle:n.handle,status:"failed",sandboxPath:N,port:null,previewUrl:null,...O,error:ueu(G)}),G}if(!Z||y===void 0)throw Error("sandbox bring-up invariant violated");let B=`http://127.0.0.1:${y}`,F=c(n.handle,y);console.log(`[user-desktop] ready handle=${n.handle} port=${y} sandboxApiUrl=${B} previewUrl=${F}`);let A={handle:n.handle,port:y,process:Z,sandboxApiUrl:B,previewUrl:F,lastUsedAt:Date.now(),activeDispatchCount:0,daemonToken:T,registryMetadata:O};if(t.set(n.handle,A),$({handle:n.handle,status:"ready",sandboxPath:N,port:y,previewUrl:F,...O,error:null}),w({handle:n.handle,phase:"ready",port:y,previewUrl:F,sandboxPath:N,projectName:O.projectName,branch:O.branch}),Z.exited)Z.exited.then(()=>{if(t.get(n.handle)===A)console.warn(`[user-desktop] daemon process exited unexpectedly handle=${n.handle} port=${y} \u2014 removing from cache`),t.delete(n.handle),$({handle:n.handle,status:"stopped",sandboxPath:N,port:null,previewUrl:null,...O,error:null}),w({handle:n.handle,phase:"evicted"});else console.log(`[user-desktop] daemon process exited handle=${n.handle} port=${y} (already replaced/removed)`)});return{sandboxApiUrl:B,previewUrl:F,port:y}};return{async ensureSandbox(n){let O=t.get(n.handle);if(O){if(await d(O.sandboxApiUrl))return console.log(`[user-desktop] cache hit handle=${n.handle} port=${O.port} (alive)`),O.lastUsedAt=Date.now(),{sandboxApiUrl:O.sandboxApiUrl,previewUrl:O.previewUrl,port:O.port};console.warn(`[user-desktop] cache stale handle=${n.handle} port=${O.port} \u2014 respawning`),h(O)}let N=_.get(n.handle);if(N)return console.log(`[user-desktop] joining in-flight ensure handle=${n.handle}`),N;let y=D(n).finally(()=>{_.delete(n.handle)});return _.set(n.handle,y),y},proxyPort(n){let O=t.get(n);if(O)O.lastUsedAt=Date.now();return O?.port??null},getDaemonToken(n){return t.get(n)?.daemonToken??null},hasHandle(n){return t.has(n)||_.has(n)},recordHit(n){let O=t.get(n);if(O)O.lastUsedAt=Date.now()},acquireDispatch(n){let O=t.get(n);if(!O)return()=>{};O.activeDispatchCount+=1;let N=!1;return()=>{if(N)return;N=!0;let y=t.get(n);if(y)y.activeDispatchCount=Math.max(0,y.activeDispatchCount-1)}},listSandboxes(){return[...t.values()]},async deleteSandbox(n){let O=t.get(n);if(!O){console.log(`[user-desktop] delete handle=${n} (not found, no-op)`);return}if(O.activeDispatchCount>0){console.warn(`[user-desktop] delete handle=${n} port=${O.port} REFUSED \u2014 ${O.activeDispatchCount} active dispatch(es) in flight`);return}console.log(`[user-desktop] delete handle=${n} port=${O.port}`);try{O.process.kill("SIGTERM")}catch{}t.delete(n),$({handle:n,status:"stopped",sandboxPath:E(n),port:null,previewUrl:null,repoCloneUrl:null,branch:null,projectName:null,error:null}),w({handle:n,phase:"deleted"})},async shutdown(){console.log(`[user-desktop] shutdown \u2014 killing ${t.size} sandbox(es)`);for(let n of t.values())try{n.process.kill("SIGTERM")}catch{}t.clear()}}}function WCt(){return new Promise((i,u)=>{let t=jCt();t.unref(),t.on("error",u),t.listen(0,"127.0.0.1",()=>{let f=t.address();if(f&&typeof f==="object"){let l=f.port;t.close(()=>i(l))}else t.close(()=>u(Error("could not allocate port")))})})}var feu=()=>{};import{randomUUID as YCt}from"crypto";import{hostname as QCt}from"os";async function leu(i){let u=QCt()||void 0;i.monitor?.onMachine?.(u??"this machine");let t=Qbu(i.dataDir,{outFd:i.logFd,perSandboxLog:i.perSandboxLogs,hotReload:i.hotReload}),f=J1i({path:K1i(i.dataDir),managedSandboxRoot:`${i.dataDir}/sandboxes`}),l=!1,c=()=>{if(l)return;l=!0;try{f.close()}catch{}};try{let E=0,$=teu({dataDir:i.dataDir,registry:f,resolvePreviewUrl:(k,q)=>E>0?`http://${k}.localhost:${E}`:`http://127.0.0.1:${q}`,spawnDaemon:async(k)=>{let q={DAEMON_BOOT_ID:YCt(),APP_ROOT:k.workdir,PROXY_PORT:String(k.port),DAEMON_TOKEN:k.daemonToken,OFFLOAD_ALLOWED_HOSTS:k.offloadAllowedHosts.join(","),...k.offloadAllowSameHostDev?{OFFLOAD_ALLOW_SAME_HOST_DEV:"1"}:{}};if(k.orgFsConfigJson){let W=await bbu(i.dataDir);if(W)q.ORGFS_CONFIG=k.orgFsConfigJson,q.ORGFS_RCLONE_PATH=W}let J=await t({workdir:k.workdir,env:q,daemonPort:k.port});return{port:k.port,kill:(W)=>J.kill(W),exited:J.exited.then(()=>{return})}},postConfig:async(k,q,J,W)=>{let r={port:q};if(J.workload)r.runtime=J.workload.runtime,r.packageManager={name:J.workload.packageManager,...J.workload.packageManagerPath?{path:J.workload.packageManagerPath}:{}};let Y={application:r},li=_h(J.operator??null);if(li)Y.operator=li;if(J.repo)Y.git={repository:{cloneUrl:J.repo.cloneUrl,branch:J.repo.branch},...J.repo.userName&&J.repo.userEmail?{identity:{userName:J.repo.userName,userEmail:J.repo.userEmail}}:{}};await $2(`http://127.0.0.1:${k}`,W,Y)},waitForHealth:async(k)=>{await Kli(`http://127.0.0.1:${k}`)},maxSandboxes:20,onEvent:i.monitor?.onEvent}),w=await Smu({port:i.port,lookupSandboxPort:(k)=>$.proxyPort(k)});E=w.port,console.log(`Local ingress listening on http://127.0.0.1:${w.port} (use http://<handle>.localhost:${w.port}/)`),i.monitor?.onIngress?.(w.port);let d=Mbu({provider:$}),h=async()=>{let k=await E2({dataDir:i.dataDir,target:i.clusterBaseUrl});if(!k)throw Object.assign(Error(`Session for ${i.clusterBaseUrl} is no longer valid \u2014 run \`deco auth login --target ${i.clusterBaseUrl}\` and restart \`deco link\`.`),{fatal:!0});return k.accessToken},_=await Hmu(i.dataDir),v=process.env.npm_package_version??"0.0.0",D=await jRi(),n=Qmu(D,{onChange:(k)=>{console.log(`[link-daemon] capabilities detected: +${k.join(",")} (now: ${D.join(",")})`)}}),O=Zzi({path:`${i.dataDir}/link/outbox.sqlite`});O.clear();let N=()=>{},y=new AbortController,Z={clusterBaseUrl:i.clusterBaseUrl,getAccessToken:h,provider:$,outbox:O,controlHandler:d,capabilities:D,machineId:_,cliVersion:v,previewPort:w.port,onConnected:()=>{i.monitor?.onCluster?.("linked"),console.log(`Linked to ${i.clusterBaseUrl}`)},onShutdown:()=>N(),runLifetimeSignal:y.signal};console.log(`[link-daemon] transport=tunnel cluster=${i.clusterBaseUrl}`);let T=await ymu(Z);console.log("[link-daemon] active transport=tunnel");let B,F=new Promise((k)=>{B=k}),A=!1,G=async()=>{if(A)return;A=!0,y.abort(),console.log(`
 Shutting down\u2026`),n();try{await T.close()}catch{}try{await w.stop()}catch{}try{await $.shutdown()}catch{}try{O.close()}catch{}c(),B(0)};process.on("SIGINT",()=>void G()),process.on("SIGTERM",()=>void G()),N=()=>{console.log("Disconnect requested from the Studio web UI \u2014 shutting down. Run `bunx decocms@latest link` to reconnect."),G()},T.closed.then(()=>{if(i.monitor?.onCluster?.("closed"),!A)console.error("Cluster connection closed permanently; exiting."),G()});let I=smu({provider:$,registry:f,dataDir:i.dataDir});return{stopped:F,stop:G,stopSandbox:I.stopSandbox,removeSandbox:I.removeSandbox,inspectSandbox:I.inspectSandbox}}catch(E){throw c(),E}}var ceu=g(()=>{vzi();BM();zbu();Cbu();qbu();Tzi();Zmu();jmu();zmu();Rmu();TM();KRi();pmu();feu()});function JRi(i){return i.map((u)=>typeof u==="string"?u:String(u)).join(" ")}import{createServer as zCt}from"net";async function RCt(i){for(let u of HCt)if(await XRi(i,u))return u;return null}async function Eeu(i,{intervalMs:u=1000}={}){for(;;){let t=await RCt(i);if(t)return t;await O0(u)}}function XRi(i,u){return new Promise((t)=>{let f=zCt();f.once("error",(l)=>{t(l.code==="EADDRINUSE")}),f.listen(i,u,()=>{f.close(()=>t(!1))})})}var HCt;var LRi=g(()=>{y4();HCt=["localhost","127.0.0.1","0.0.0.0"]});function $eu(i){return typeof i==="object"&&i!==null&&"code"in i&&i.code==="EADDRINUSE"}function bCt(i,u=process.platform){if(u==="win32")return`for /f "tokens=5" %P in ('netstat -ano ^| findstr /R /C:":${i} .*LISTENING"') do taskkill /F /PID %P`;return`kill -9 $(lsof -ti tcp:${i})`}function weu(i,u=process.platform){return[`Port ${i} is already in use.`,"Run this command to stop the process listening on it, then retry `decocms link`:","",`  ${bCt(i,u)}`].join(`
-`)}var WRi;var deu=g(()=>{WRi=class WRi extends Error{port;code="EADDRINUSE";constructor(i){super(`Port ${i} is already in use.`);this.port=i;this.name="PortInUseError"}}});var iW;var X1i=g(()=>{iW={name:"decocms",version:"4.76.83",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/mesh"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:'bun run migrate && concurrently "bun run dev:client" "bun run dev:server"',"dev:servers":'concurrently "bun run dev:client" "bun run dev:server"',"dev:client":"vite dev","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts","build:client":"bun --bun vite build","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","db:migrate":"bun run ./dist/server/migrate.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts",test:"bun test","test:ct":"playwright test -c playwright-ct.config.ts","test:ct:ui":"playwright test -c playwright-ct.config.ts --ui","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts","smoke:link":"bun run scripts/smoke-link.ts",prepublishOnly:"bun run build:client && bun run build:server"},optionalDependencies:{"@anthropic-ai/claude-agent-sdk":"^0.3.181","@duckdb/node-api":"^1.5.0-r.1","@openai/codex":"0.144.3","@openai/codex-darwin-arm64":"npm:@openai/codex@0.144.3-darwin-arm64","@openai/codex-darwin-x64":"npm:@openai/codex@0.144.3-darwin-x64","@openai/codex-linux-arm64":"npm:@openai/codex@0.144.3-linux-arm64","@openai/codex-linux-x64":"npm:@openai/codex@0.144.3-linux-x64","@openai/codex-win32-arm64":"npm:@openai/codex@0.144.3-win32-arm64","@openai/codex-win32-x64":"npm:@openai/codex@0.144.3-win32-x64"},dependencies:{"@ai-sdk/anthropic":"^3.0.85","@ai-sdk/google":"^3.0.83","@ai-sdk/openai":"^3.0.73","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@dnd-kit/core":"^6.3.1","@dnd-kit/sortable":"^10.0.0","@dnd-kit/utilities":"^3.2.2","@inkjs/ui":"^2.0.0","@modelcontextprotocol/ext-apps":"^1.7.1","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^2.9.1","@opentelemetry/core":"^2.6.0","@tanstack/react-virtual":"3.13.24","@tiptap/extension-text-align":"3.20.2","@xterm/addon-fit":"^0.11.0","@xterm/xterm":"^6.0.0",echarts:"^5.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","node-pty":"^1.0.0","posthog-js":"^1.371.1","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6","use-stick-to-bottom":"^1.1.6"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@ai-sdk/react":"^3.0.210","@better-auth/sso":"1.4.1","@daveyplate/better-auth-ui":"^3.2.7","@deco/ui":"workspace:*","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/harness":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/mesh-sdk":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/std":"workspace:*","@decocms/tunnel":"workspace:*","@floating-ui/react":"^0.27.16","@happy-dom/global-registrator":"^20.9.0","@hookform/resolvers":"^5.2.2","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@monaco-editor/react":"^4.7.0","@nats-io/jwt":"0.0.10-5","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@playwright/experimental-ct-react":"1.59.1","@playwright/test":"^1.58.2","@radix-ui/react-avatar":"^1.1.10","@radix-ui/react-checkbox":"^1.3.3","@radix-ui/react-dialog":"^1.1.15","@radix-ui/react-dropdown-menu":"^2.1.16","@radix-ui/react-label":"^2.1.7","@radix-ui/react-select":"^2.2.6","@radix-ui/react-separator":"^1.1.7","@radix-ui/react-slot":"^1.2.3","@radix-ui/react-tabs":"^1.1.13","@rjsf/shadcn":"^6.6.2","@rjsf/utils":"^6.6.2","@rjsf/validator-ajv8":"^6.6.2","@tailwindcss/vite":"^4.1.17","@tanstack/react-query":"5.100.10","@tanstack/react-router":"1.169.2","@testing-library/jest-dom":"^6.9.1","@testing-library/react":"^16.3.2","@tiptap/core":"3.20.2","@tiptap/extension-placeholder":"3.20.2","@tiptap/pm":"3.20.2","@tiptap/react":"3.20.2","@tiptap/starter-kit":"3.20.2","@tiptap/suggestion":"3.20.2","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@untitledui/icons":"^0.0.19","@vercel/nft":"^1.1.1","@vitejs/plugin-react":"^5.1.0",ai:"^6.0.208","babel-plugin-react-compiler":"^1.0.0","better-auth":"1.4.22","class-variance-authority":"^0.7.1",clsx:"^2.1.1",concurrently:"^9.2.1",croner:"^9.1.0","date-fns":"^4.1.0",degit:"^2.8.4",hono:"^4.10.7","input-otp":"^1.4.2",jose:"^6.0.11","lucide-react":"^0.468.0",marked:"^15.0.6",nanoid:"^5.1.6",pg:"^8.16.3",prettier:"^3.4.2","react-hook-form":"^7.66.0","react-markdown":"^10.1.0","react-resizable-panels":"^2.1.7","react-syntax-highlighter":"^15.6.1",recharts:"^3.6.0","rehype-raw":"^7.0.0","remark-gfm":"^4.0.0","sass-embedded":"^1.97.2",sonner:"^2.0.7","tailwind-merge":"^3.3.1",tailwindcss:"^4.1.17",typescript:"^5.9.3",vite:"^7.2.1","vite-tsconfig-paths":"^5.1.4",zod:"^4.0.0"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","mesh","tools"],license:"MIT",publishConfig:{access:"public"}}});var pM={};Xi(pM,{printBanner:()=>qCt,bannerLines:()=>heu,BANNER_LINES:()=>L1i,BANNER_GRADIENT:()=>W1i});function MCt(i){let u=Number.parseInt(i.slice(1),16);return[u>>16&255,u>>8&255,u&255]}function heu(i){let u=L1i.map((t,f)=>{let[l,c,E]=MCt(W1i[f]);return`\x1B[38;2;${l};${c};${E}m${t}\x1B[39m`});if(i!==void 0)u.push(`\x1B[2m  v${i}\x1B[22m`);return u}function qCt(i){console.log("");for(let u of heu(i))console.log(u);console.log("")}var L1i,W1i;var uW=g(()=>{L1i=[" \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588     \u2588\u2588\u2588\u2588\u2588\u2588\u2588   ","\u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588 "," \u2591\u2588\u2588\u2588   \u2591\u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588  \u2588 \u2591  \u2588\u2588\u2588     \u2591\u2591\u2591  \u2588\u2588\u2588     \u2591\u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2588\u2588\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2591\u2591\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2588\u2588\u2588  \u2591\u2588\u2588\u2588 \u2591   \u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588 "," \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588  \u2591\u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2591  ","\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591     \u2591\u2591\u2591\u2591\u2591\u2591\u2591   "],W1i=["#00ff64","#00ee5e","#00dc56","#00c84e","#00b444","#00a03c","#008832","#006e28"]});import{Box as VCt,Text as _eu}from"ink";import{jsx as rCt,jsxs as veu}from"react/jsx-runtime";function Y1i({version:i}){return veu(VCt,{flexDirection:"column",marginTop:1,children:[L1i.map((u,t)=>rCt(_eu,{color:W1i[t],children:u},t)),veu(_eu,{dimColor:!0,children:[" v",i]})]})}var YRi=g(()=>{uW()});function Deu(i){let u=i.branch??i.handle,t=[];if(i.dirtyCount>0)t.push(`${i.dirtyCount} uncommitted file${i.dirtyCount===1?"":"s"}`);if(i.merged===!1)t.push("branch not merged");return t.length>0?`\u26A0 ${t.join(", ")} \u2014 delete ${u}? (y/n)`:`Delete ${u}? (y/n)`}function tW(i){return[...i.values()].map((u)=>u.handle).sort((u,t)=>u.localeCompare(t))}function neu(i,u,t){if(i.length===0)return null;let f=u===null?-1:i.indexOf(u);if(f===-1)return t>0?i[0]:i[i.length-1];let l=Math.max(0,Math.min(i.length-1,f+t));return i[l]}function geu(i,u,t){if(t!==u)return t;let f=i.indexOf(u);if(f===-1)return t;return i[f+1]??i[f-1]??null}var RRi={};Xi(RRi,{subscribeLinkState:()=>QRi,setSelectedHandle:()=>zRi,setRemoving:()=>H1i,setPersistedSandboxes:()=>fMt,setPendingConfirm:()=>uq,setMachine:()=>pCt,setLogPath:()=>uMt,setLinkActions:()=>tMt,setIngress:()=>sCt,setDaemonError:()=>iMt,setClusterUrl:()=>oCt,setCluster:()=>aCt,setActionError:()=>z1i,resetLinkStateForTests:()=>cMt,removeSandboxRow:()=>HRi,pushSandboxEvent:()=>lMt,getLinkState:()=>iq,applySandboxEvent:()=>Oeu});function eCt(i){return i==="spawning"||i==="ready"||i==="failed"}function Oeu(i,u){let t=new Map(i),f=t.get(u.handle);if(u.phase==="evicted"||u.phase==="deleted"){if(f)t.set(u.handle,{...f,port:null,previewUrl:null,status:"stopped",error:null});return t}return t.set(u.handle,{handle:u.handle,port:u.port??f?.port??null,previewUrl:u.previewUrl??f?.previewUrl??null,status:u.phase,error:u.phase==="failed"?u.error??"failed":null,projectName:u.projectName??f?.projectName??null,branch:u.branch??f?.branch??null,sandboxPath:u.sandboxPath??f?.sandboxPath??null}),t}function Neu(){return{cluster:"connecting",clusterUrl:null,ingressUrl:null,ingressPort:null,machine:null,cap:mCt,sandboxes:new Map,daemonError:null,logPath:null,selectedHandle:null,pendingConfirm:null,removingHandles:new Set,actionError:null,actions:null}}function z$(){for(let i of Q1i)i()}function iq(){return cf}function QRi(i){return Q1i.add(i),()=>Q1i.delete(i)}function aCt(i){cf={...cf,cluster:i},z$()}function oCt(i){cf={...cf,clusterUrl:i},z$()}function sCt(i,u){cf={...cf,ingressPort:i,ingressUrl:u},z$()}function pCt(i){cf={...cf,machine:i},z$()}function iMt(i){cf={...cf,daemonError:i},z$()}function uMt(i){cf={...cf,logPath:i},z$()}function zRi(i){cf={...cf,selectedHandle:i},z$()}function uq(i){cf={...cf,pendingConfirm:i},z$()}function z1i(i){cf={...cf,actionError:i},z$()}function H1i(i,u){if(cf.removingHandles.has(i)===u)return;let t=new Set(cf.removingHandles);if(u)t.add(i);else t.delete(i);cf={...cf,removingHandles:t},z$()}function tMt(i){cf={...cf,actions:i},z$()}function HRi(i){let u=tW(cf.sandboxes),t=geu(u,i,cf.selectedHandle),f=new Map(cf.sandboxes);f.delete(i);let l=new Set(cf.removingHandles);l.delete(i),cf={...cf,sandboxes:f,selectedHandle:t,pendingConfirm:null,removingHandles:l},z$()}function fMt(i){let u=new Map;for(let t of i)u.set(t.handle,{handle:t.handle,port:t.port,previewUrl:t.previewUrl,status:t.status,error:t.error,projectName:t.projectName,branch:t.branch,sandboxPath:t.sandboxPath});for(let[t,f]of cf.sandboxes)if(eCt(f.status))u.set(t,f);cf={...cf,sandboxes:u},z$()}function lMt(i){cf={...cf,sandboxes:Oeu(cf.sandboxes,i)},z$()}function cMt(){cf=Neu(),Q1i.clear()}var mCt=20,cf,Q1i;var tq=g(()=>{cf=Neu(),Q1i=new Set});import{spawn as EMt}from"child_process";function $Mt(i){if(i==="darwin")return"open";if(i==="win32")return"start";return"xdg-open"}function yeu(i,u=process.platform){let t=$Mt(u);try{EMt(t,[i],{stdio:"ignore",detached:!0}).unref()}catch{}}var Zeu=()=>{};function Teu(i,u={}){let t=u.openUrl??yeu,f=iq(),l=tW(f.sandboxes),c=f.selectedHandle!==null&&l.includes(f.selectedHandle)?f.selectedHandle:l[0]??null,E=f.actions;switch(i.type){case"move":zRi(neu(l,f.selectedHandle,i.delta));return;case"open":{if(c===null)return;let $=f.sandboxes.get(c);if($?.status==="ready"&&$.previewUrl)t($.previewUrl);return}case"stop":if(c!==null&&E)E.stopSandbox(c);return;case"delete":{if(c===null||!E)return;let $=E.inspectSandbox(c),w=f.sandboxes.get(c);z1i(null),uq({handle:c,branch:$?.branch??w?.branch??null,dirtyCount:$?.dirtyCount??0,merged:$?.merged??null});return}case"confirmYes":{let $=f.pendingConfirm;if(uq(null),$===null||!E)return;H1i($.handle,!0),E.removeSandbox($.handle).then((w)=>{if(w.ok)HRi($.handle);else H1i($.handle,!1),z1i(w.error)});return}case"confirmNo":uq(null);return;case"quit":if(E)E.quit();return}}var Beu=g(()=>{tq();Zeu()});function Feu(i,u,t){if(t)return i==="y"||i==="Y"?{type:"confirmYes"}:{type:"confirmNo"};if(u.upArrow||i==="k")return{type:"move",delta:-1};if(u.downArrow||i==="j")return{type:"move",delta:1};if(i==="s")return{type:"stop"};if(i==="d")return{type:"delete"};if(i==="o")return{type:"open"};if(i==="q"||u.ctrl===!0&&i==="c")return{type:"quit"};return null}var Ueu={};Xi(Ueu,{LinkApp:()=>_Mt});import{Box as ql,Text as _1,useInput as wMt}from"ink";import{useSyncExternalStore as dMt}from"react";import{jsx as Gf,jsxs as Fh}from"react/jsx-runtime";function hMt(i,u){if(u)return{color:"yellow",text:"\u25CC Removing\u2026"};if(i.status==="ready")return{color:"green",text:"\u25CF Live"};if(i.status==="spawning")return{color:"yellow",text:"\u25CC Starting\u2026"};if(i.status==="stopped")return{color:"gray",text:"\u25A0 Stopped"};if(i.status==="missing")return{color:"yellow",text:"\u25A1 Missing"};if(i.status==="merged")return{color:"cyan",text:"\u2713 Merged"};if(i.status==="invalid")return{color:"red",text:"\u2717 Invalid"};if(i.status==="failed")return{color:"red",text:`\u2717 Failed: ${i.error??"failed"}`};return{color:"red",text:`\u2717 Error: ${i.error??""}`}}function _Mt(){let i=dMt(QRi,iq),u=[...i.sandboxes.values()].sort((l,c)=>l.handle.localeCompare(c.handle)),t=tW(i.sandboxes),f=i.selectedHandle!==null&&t.includes(i.selectedHandle)?i.selectedHandle:t[0]??null;return wMt((l,c)=>{let E=Feu(l,c,i.pendingConfirm!==null);if(E!==null)Teu(E)}),Fh(ql,{flexDirection:"column",children:[Gf(Y1i,{version:iW.version}),Gf(ql,{marginBottom:1,children:Gf(_1,{dimColor:!0,children:"\u2500".repeat(80)})}),Gf(ql,{children:i.cluster==="linked"?Fh(_1,{color:"green",children:["\u2713 Connected to ",i.clusterUrl??"deco"]}):i.cluster==="connecting"?Fh(_1,{color:"yellow",children:["\u25CC Connecting to ",i.clusterUrl??"deco","\u2026"]}):Fh(_1,{color:"red",children:["\u2717 Disconnected from ",i.clusterUrl??"deco"]})}),Gf(ql,{children:i.ingressUrl?Fh(_1,{color:"green",children:["\u2713 Serving at ",i.ingressUrl]}):Gf(_1,{dimColor:!0,children:"\u25CC Starting local server\u2026"})}),Gf(ql,{marginBottom:1,children:Gf(_1,{dimColor:!0,children:`${"Computer".padEnd(16)}${i.machine??"this computer"} \xB7 ${u.length} of ${i.cap} previews`})}),u.length===0?Gf(_1,{dimColor:!0,children:"No previews running yet."}):Fh(ql,{flexDirection:"column",children:[Fh(ql,{children:[Gf(ql,{width:2,flexShrink:0}),Gf(ql,{width:fW.project,flexShrink:0,marginRight:1,children:Gf(_1,{dimColor:!0,wrap:"truncate-end",children:"PROJECT"})}),Gf(ql,{width:fW.branch,flexShrink:0,marginRight:1,children:Gf(_1,{dimColor:!0,wrap:"truncate-end",children:"BRANCH"})}),Gf(ql,{width:fW.status,flexShrink:0,marginRight:1,children:Gf(_1,{dimColor:!0,wrap:"truncate-end",children:"STATUS"})}),Gf(ql,{flexGrow:1,children:Gf(_1,{dimColor:!0,wrap:"truncate-end",children:"PREVIEW URL"})})]}),u.map((l)=>{let c=hMt(l,i.removingHandles.has(l.handle)),E=l.handle===f;return Fh(ql,{children:[Gf(ql,{width:2,flexShrink:0,children:Gf(_1,{color:"cyan",children:E?"\u203A":" "})}),Gf(ql,{width:fW.project,flexShrink:0,marginRight:1,children:Gf(_1,{bold:E,wrap:"truncate-end",children:l.projectName??l.handle})}),Gf(ql,{width:fW.branch,flexShrink:0,marginRight:1,children:Gf(_1,{bold:E,wrap:"truncate-end",children:l.branch??"\u2014"})}),Gf(ql,{width:fW.status,flexShrink:0,marginRight:1,children:Gf(_1,{color:c.color,bold:E,wrap:"truncate-end",children:c.text})}),Gf(ql,{flexGrow:1,children:Gf(_1,{dimColor:!0,wrap:"truncate-end",children:l.previewUrl??"\u2014"})})]},l.handle)})]}),i.daemonError?Gf(ql,{marginTop:1,children:Fh(_1,{color:"red",children:["\u26A0 ",i.daemonError]})}):null,i.logPath?Gf(ql,{marginTop:1,children:Fh(_1,{dimColor:!0,children:["Logs: ",i.logPath]})}):null,i.pendingConfirm?Gf(ql,{marginTop:1,children:Gf(_1,{color:"yellow",children:Deu(i.pendingConfirm)})}):null,i.actionError?Gf(ql,{marginTop:1,children:Fh(_1,{color:"red",children:["\u2717 ",i.actionError]})}):null,Gf(ql,{marginTop:1,children:Gf(_1,{dimColor:!0,children:"\u2191\u2193 move \xB7 s stop \xB7 d delete \xB7 o open \xB7 q quit"})})]})}var fW;var Peu=g(()=>{X1i();YRi();Beu();tq();fW={project:18,branch:22,status:14}});var Aeu={};Xi(Aeu,{runLinkCommand:()=>ZMt});import{closeSync as vMt,mkdirSync as DMt,openSync as nMt,writeSync as gMt}from"fs";import{homedir as OMt}from"os";import{join as bRi}from"path";function NMt(i,u){let t={log:console.log,warn:console.warn,error:console.error},f=(l)=>{if(u===void 0)return;try{gMt(u,`${JRi(l)}
+`)}var WRi;var deu=g(()=>{WRi=class WRi extends Error{port;code="EADDRINUSE";constructor(i){super(`Port ${i} is already in use.`);this.port=i;this.name="PortInUseError"}}});var iW;var X1i=g(()=>{iW={name:"decocms",version:"4.76.85",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/mesh"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:'bun run migrate && concurrently "bun run dev:client" "bun run dev:server"',"dev:servers":'concurrently "bun run dev:client" "bun run dev:server"',"dev:client":"vite dev","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts","build:client":"bun --bun vite build","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","db:migrate":"bun run ./dist/server/migrate.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts",test:"bun test","test:ct":"playwright test -c playwright-ct.config.ts","test:ct:ui":"playwright test -c playwright-ct.config.ts --ui","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts","smoke:link":"bun run scripts/smoke-link.ts",prepublishOnly:"bun run build:client && bun run build:server"},optionalDependencies:{"@anthropic-ai/claude-agent-sdk":"^0.3.181","@duckdb/node-api":"^1.5.0-r.1","@openai/codex":"0.144.3","@openai/codex-darwin-arm64":"npm:@openai/codex@0.144.3-darwin-arm64","@openai/codex-darwin-x64":"npm:@openai/codex@0.144.3-darwin-x64","@openai/codex-linux-arm64":"npm:@openai/codex@0.144.3-linux-arm64","@openai/codex-linux-x64":"npm:@openai/codex@0.144.3-linux-x64","@openai/codex-win32-arm64":"npm:@openai/codex@0.144.3-win32-arm64","@openai/codex-win32-x64":"npm:@openai/codex@0.144.3-win32-x64"},dependencies:{"@ai-sdk/anthropic":"^3.0.85","@ai-sdk/google":"^3.0.83","@ai-sdk/openai":"^3.0.73","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@dnd-kit/core":"^6.3.1","@dnd-kit/sortable":"^10.0.0","@dnd-kit/utilities":"^3.2.2","@inkjs/ui":"^2.0.0","@modelcontextprotocol/ext-apps":"^1.7.1","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^2.9.1","@opentelemetry/core":"^2.6.0","@tanstack/react-virtual":"3.13.24","@tiptap/extension-text-align":"3.20.2","@xterm/addon-fit":"^0.11.0","@xterm/xterm":"^6.0.0",echarts:"^5.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","node-pty":"^1.0.0","posthog-js":"^1.371.1","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6","use-stick-to-bottom":"^1.1.6"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@ai-sdk/react":"^3.0.210","@better-auth/sso":"1.4.1","@daveyplate/better-auth-ui":"^3.2.7","@deco/ui":"workspace:*","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/harness":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/mesh-sdk":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/std":"workspace:*","@decocms/tunnel":"workspace:*","@floating-ui/react":"^0.27.16","@happy-dom/global-registrator":"^20.9.0","@hookform/resolvers":"^5.2.2","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@monaco-editor/react":"^4.7.0","@nats-io/jwt":"0.0.10-5","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@playwright/experimental-ct-react":"1.59.1","@playwright/test":"^1.58.2","@radix-ui/react-avatar":"^1.1.10","@radix-ui/react-checkbox":"^1.3.3","@radix-ui/react-dialog":"^1.1.15","@radix-ui/react-dropdown-menu":"^2.1.16","@radix-ui/react-label":"^2.1.7","@radix-ui/react-select":"^2.2.6","@radix-ui/react-separator":"^1.1.7","@radix-ui/react-slot":"^1.2.3","@radix-ui/react-tabs":"^1.1.13","@rjsf/shadcn":"^6.6.2","@rjsf/utils":"^6.6.2","@rjsf/validator-ajv8":"^6.6.2","@tailwindcss/vite":"^4.1.17","@tanstack/react-query":"5.100.10","@tanstack/react-router":"1.169.2","@testing-library/jest-dom":"^6.9.1","@testing-library/react":"^16.3.2","@tiptap/core":"3.20.2","@tiptap/extension-placeholder":"3.20.2","@tiptap/pm":"3.20.2","@tiptap/react":"3.20.2","@tiptap/starter-kit":"3.20.2","@tiptap/suggestion":"3.20.2","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@untitledui/icons":"^0.0.19","@vercel/nft":"^1.1.1","@vitejs/plugin-react":"^5.1.0",ai:"^6.0.208","babel-plugin-react-compiler":"^1.0.0","better-auth":"1.4.22","class-variance-authority":"^0.7.1",clsx:"^2.1.1",concurrently:"^9.2.1",croner:"^9.1.0","date-fns":"^4.1.0",degit:"^2.8.4",hono:"^4.10.7","input-otp":"^1.4.2",jose:"^6.0.11","lucide-react":"^0.468.0",marked:"^15.0.6",nanoid:"^5.1.6",pg:"^8.16.3",prettier:"^3.4.2","react-hook-form":"^7.66.0","react-markdown":"^10.1.0","react-resizable-panels":"^2.1.7","react-syntax-highlighter":"^15.6.1",recharts:"^3.6.0","rehype-raw":"^7.0.0","remark-gfm":"^4.0.0","sass-embedded":"^1.97.2",sonner:"^2.0.7","tailwind-merge":"^3.3.1",tailwindcss:"^4.1.17",typescript:"^5.9.3",vite:"^7.2.1","vite-tsconfig-paths":"^5.1.4",zod:"^4.0.0"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","mesh","tools"],license:"MIT",publishConfig:{access:"public"}}});var pM={};Xi(pM,{printBanner:()=>qCt,bannerLines:()=>heu,BANNER_LINES:()=>L1i,BANNER_GRADIENT:()=>W1i});function MCt(i){let u=Number.parseInt(i.slice(1),16);return[u>>16&255,u>>8&255,u&255]}function heu(i){let u=L1i.map((t,f)=>{let[l,c,E]=MCt(W1i[f]);return`\x1B[38;2;${l};${c};${E}m${t}\x1B[39m`});if(i!==void 0)u.push(`\x1B[2m  v${i}\x1B[22m`);return u}function qCt(i){console.log("");for(let u of heu(i))console.log(u);console.log("")}var L1i,W1i;var uW=g(()=>{L1i=[" \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588     \u2588\u2588\u2588\u2588\u2588\u2588\u2588   ","\u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588 "," \u2591\u2588\u2588\u2588   \u2591\u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588  \u2588 \u2591  \u2588\u2588\u2588     \u2591\u2591\u2591  \u2588\u2588\u2588     \u2591\u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2588\u2588\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2591\u2591\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2588\u2588\u2588  \u2591\u2588\u2588\u2588 \u2591   \u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588 "," \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588  \u2591\u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2591  ","\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591     \u2591\u2591\u2591\u2591\u2591\u2591\u2591   "],W1i=["#00ff64","#00ee5e","#00dc56","#00c84e","#00b444","#00a03c","#008832","#006e28"]});import{Box as VCt,Text as _eu}from"ink";import{jsx as rCt,jsxs as veu}from"react/jsx-runtime";function Y1i({version:i}){return veu(VCt,{flexDirection:"column",marginTop:1,children:[L1i.map((u,t)=>rCt(_eu,{color:W1i[t],children:u},t)),veu(_eu,{dimColor:!0,children:[" v",i]})]})}var YRi=g(()=>{uW()});function Deu(i){let u=i.branch??i.handle,t=[];if(i.dirtyCount>0)t.push(`${i.dirtyCount} uncommitted file${i.dirtyCount===1?"":"s"}`);if(i.merged===!1)t.push("branch not merged");return t.length>0?`\u26A0 ${t.join(", ")} \u2014 delete ${u}? (y/n)`:`Delete ${u}? (y/n)`}function tW(i){return[...i.values()].map((u)=>u.handle).sort((u,t)=>u.localeCompare(t))}function neu(i,u,t){if(i.length===0)return null;let f=u===null?-1:i.indexOf(u);if(f===-1)return t>0?i[0]:i[i.length-1];let l=Math.max(0,Math.min(i.length-1,f+t));return i[l]}function geu(i,u,t){if(t!==u)return t;let f=i.indexOf(u);if(f===-1)return t;return i[f+1]??i[f-1]??null}var RRi={};Xi(RRi,{subscribeLinkState:()=>QRi,setSelectedHandle:()=>zRi,setRemoving:()=>H1i,setPersistedSandboxes:()=>fMt,setPendingConfirm:()=>uq,setMachine:()=>pCt,setLogPath:()=>uMt,setLinkActions:()=>tMt,setIngress:()=>sCt,setDaemonError:()=>iMt,setClusterUrl:()=>oCt,setCluster:()=>aCt,setActionError:()=>z1i,resetLinkStateForTests:()=>cMt,removeSandboxRow:()=>HRi,pushSandboxEvent:()=>lMt,getLinkState:()=>iq,applySandboxEvent:()=>Oeu});function eCt(i){return i==="spawning"||i==="ready"||i==="failed"}function Oeu(i,u){let t=new Map(i),f=t.get(u.handle);if(u.phase==="evicted"||u.phase==="deleted"){if(f)t.set(u.handle,{...f,port:null,previewUrl:null,status:"stopped",error:null});return t}return t.set(u.handle,{handle:u.handle,port:u.port??f?.port??null,previewUrl:u.previewUrl??f?.previewUrl??null,status:u.phase,error:u.phase==="failed"?u.error??"failed":null,projectName:u.projectName??f?.projectName??null,branch:u.branch??f?.branch??null,sandboxPath:u.sandboxPath??f?.sandboxPath??null}),t}function Neu(){return{cluster:"connecting",clusterUrl:null,ingressUrl:null,ingressPort:null,machine:null,cap:mCt,sandboxes:new Map,daemonError:null,logPath:null,selectedHandle:null,pendingConfirm:null,removingHandles:new Set,actionError:null,actions:null}}function z$(){for(let i of Q1i)i()}function iq(){return cf}function QRi(i){return Q1i.add(i),()=>Q1i.delete(i)}function aCt(i){cf={...cf,cluster:i},z$()}function oCt(i){cf={...cf,clusterUrl:i},z$()}function sCt(i,u){cf={...cf,ingressPort:i,ingressUrl:u},z$()}function pCt(i){cf={...cf,machine:i},z$()}function iMt(i){cf={...cf,daemonError:i},z$()}function uMt(i){cf={...cf,logPath:i},z$()}function zRi(i){cf={...cf,selectedHandle:i},z$()}function uq(i){cf={...cf,pendingConfirm:i},z$()}function z1i(i){cf={...cf,actionError:i},z$()}function H1i(i,u){if(cf.removingHandles.has(i)===u)return;let t=new Set(cf.removingHandles);if(u)t.add(i);else t.delete(i);cf={...cf,removingHandles:t},z$()}function tMt(i){cf={...cf,actions:i},z$()}function HRi(i){let u=tW(cf.sandboxes),t=geu(u,i,cf.selectedHandle),f=new Map(cf.sandboxes);f.delete(i);let l=new Set(cf.removingHandles);l.delete(i),cf={...cf,sandboxes:f,selectedHandle:t,pendingConfirm:null,removingHandles:l},z$()}function fMt(i){let u=new Map;for(let t of i)u.set(t.handle,{handle:t.handle,port:t.port,previewUrl:t.previewUrl,status:t.status,error:t.error,projectName:t.projectName,branch:t.branch,sandboxPath:t.sandboxPath});for(let[t,f]of cf.sandboxes)if(eCt(f.status))u.set(t,f);cf={...cf,sandboxes:u},z$()}function lMt(i){cf={...cf,sandboxes:Oeu(cf.sandboxes,i)},z$()}function cMt(){cf=Neu(),Q1i.clear()}var mCt=20,cf,Q1i;var tq=g(()=>{cf=Neu(),Q1i=new Set});import{spawn as EMt}from"child_process";function $Mt(i){if(i==="darwin")return"open";if(i==="win32")return"start";return"xdg-open"}function yeu(i,u=process.platform){let t=$Mt(u);try{EMt(t,[i],{stdio:"ignore",detached:!0}).unref()}catch{}}var Zeu=()=>{};function Teu(i,u={}){let t=u.openUrl??yeu,f=iq(),l=tW(f.sandboxes),c=f.selectedHandle!==null&&l.includes(f.selectedHandle)?f.selectedHandle:l[0]??null,E=f.actions;switch(i.type){case"move":zRi(neu(l,f.selectedHandle,i.delta));return;case"open":{if(c===null)return;let $=f.sandboxes.get(c);if($?.status==="ready"&&$.previewUrl)t($.previewUrl);return}case"stop":if(c!==null&&E)E.stopSandbox(c);return;case"delete":{if(c===null||!E)return;let $=E.inspectSandbox(c),w=f.sandboxes.get(c);z1i(null),uq({handle:c,branch:$?.branch??w?.branch??null,dirtyCount:$?.dirtyCount??0,merged:$?.merged??null});return}case"confirmYes":{let $=f.pendingConfirm;if(uq(null),$===null||!E)return;H1i($.handle,!0),E.removeSandbox($.handle).then((w)=>{if(w.ok)HRi($.handle);else H1i($.handle,!1),z1i(w.error)});return}case"confirmNo":uq(null);return;case"quit":if(E)E.quit();return}}var Beu=g(()=>{tq();Zeu()});function Feu(i,u,t){if(t)return i==="y"||i==="Y"?{type:"confirmYes"}:{type:"confirmNo"};if(u.upArrow||i==="k")return{type:"move",delta:-1};if(u.downArrow||i==="j")return{type:"move",delta:1};if(i==="s")return{type:"stop"};if(i==="d")return{type:"delete"};if(i==="o")return{type:"open"};if(i==="q"||u.ctrl===!0&&i==="c")return{type:"quit"};return null}var Ueu={};Xi(Ueu,{LinkApp:()=>_Mt});import{Box as ql,Text as _1,useInput as wMt}from"ink";import{useSyncExternalStore as dMt}from"react";import{jsx as Gf,jsxs as Fh}from"react/jsx-runtime";function hMt(i,u){if(u)return{color:"yellow",text:"\u25CC Removing\u2026"};if(i.status==="ready")return{color:"green",text:"\u25CF Live"};if(i.status==="spawning")return{color:"yellow",text:"\u25CC Starting\u2026"};if(i.status==="stopped")return{color:"gray",text:"\u25A0 Stopped"};if(i.status==="missing")return{color:"yellow",text:"\u25A1 Missing"};if(i.status==="merged")return{color:"cyan",text:"\u2713 Merged"};if(i.status==="invalid")return{color:"red",text:"\u2717 Invalid"};if(i.status==="failed")return{color:"red",text:`\u2717 Failed: ${i.error??"failed"}`};return{color:"red",text:`\u2717 Error: ${i.error??""}`}}function _Mt(){let i=dMt(QRi,iq),u=[...i.sandboxes.values()].sort((l,c)=>l.handle.localeCompare(c.handle)),t=tW(i.sandboxes),f=i.selectedHandle!==null&&t.includes(i.selectedHandle)?i.selectedHandle:t[0]??null;return wMt((l,c)=>{let E=Feu(l,c,i.pendingConfirm!==null);if(E!==null)Teu(E)}),Fh(ql,{flexDirection:"column",children:[Gf(Y1i,{version:iW.version}),Gf(ql,{marginBottom:1,children:Gf(_1,{dimColor:!0,children:"\u2500".repeat(80)})}),Gf(ql,{children:i.cluster==="linked"?Fh(_1,{color:"green",children:["\u2713 Connected to ",i.clusterUrl??"deco"]}):i.cluster==="connecting"?Fh(_1,{color:"yellow",children:["\u25CC Connecting to ",i.clusterUrl??"deco","\u2026"]}):Fh(_1,{color:"red",children:["\u2717 Disconnected from ",i.clusterUrl??"deco"]})}),Gf(ql,{children:i.ingressUrl?Fh(_1,{color:"green",children:["\u2713 Serving at ",i.ingressUrl]}):Gf(_1,{dimColor:!0,children:"\u25CC Starting local server\u2026"})}),Gf(ql,{marginBottom:1,children:Gf(_1,{dimColor:!0,children:`${"Computer".padEnd(16)}${i.machine??"this computer"} \xB7 ${u.length} of ${i.cap} previews`})}),u.length===0?Gf(_1,{dimColor:!0,children:"No previews running yet."}):Fh(ql,{flexDirection:"column",children:[Fh(ql,{children:[Gf(ql,{width:2,flexShrink:0}),Gf(ql,{width:fW.project,flexShrink:0,marginRight:1,children:Gf(_1,{dimColor:!0,wrap:"truncate-end",children:"PROJECT"})}),Gf(ql,{width:fW.branch,flexShrink:0,marginRight:1,children:Gf(_1,{dimColor:!0,wrap:"truncate-end",children:"BRANCH"})}),Gf(ql,{width:fW.status,flexShrink:0,marginRight:1,children:Gf(_1,{dimColor:!0,wrap:"truncate-end",children:"STATUS"})}),Gf(ql,{flexGrow:1,children:Gf(_1,{dimColor:!0,wrap:"truncate-end",children:"PREVIEW URL"})})]}),u.map((l)=>{let c=hMt(l,i.removingHandles.has(l.handle)),E=l.handle===f;return Fh(ql,{children:[Gf(ql,{width:2,flexShrink:0,children:Gf(_1,{color:"cyan",children:E?"\u203A":" "})}),Gf(ql,{width:fW.project,flexShrink:0,marginRight:1,children:Gf(_1,{bold:E,wrap:"truncate-end",children:l.projectName??l.handle})}),Gf(ql,{width:fW.branch,flexShrink:0,marginRight:1,children:Gf(_1,{bold:E,wrap:"truncate-end",children:l.branch??"\u2014"})}),Gf(ql,{width:fW.status,flexShrink:0,marginRight:1,children:Gf(_1,{color:c.color,bold:E,wrap:"truncate-end",children:c.text})}),Gf(ql,{flexGrow:1,children:Gf(_1,{dimColor:!0,wrap:"truncate-end",children:l.previewUrl??"\u2014"})})]},l.handle)})]}),i.daemonError?Gf(ql,{marginTop:1,children:Fh(_1,{color:"red",children:["\u26A0 ",i.daemonError]})}):null,i.logPath?Gf(ql,{marginTop:1,children:Fh(_1,{dimColor:!0,children:["Logs: ",i.logPath]})}):null,i.pendingConfirm?Gf(ql,{marginTop:1,children:Gf(_1,{color:"yellow",children:Deu(i.pendingConfirm)})}):null,i.actionError?Gf(ql,{marginTop:1,children:Fh(_1,{color:"red",children:["\u2717 ",i.actionError]})}):null,Gf(ql,{marginTop:1,children:Gf(_1,{dimColor:!0,children:"\u2191\u2193 move \xB7 s stop \xB7 d delete \xB7 o open \xB7 q quit"})})]})}var fW;var Peu=g(()=>{X1i();YRi();Beu();tq();fW={project:18,branch:22,status:14}});var Aeu={};Xi(Aeu,{runLinkCommand:()=>ZMt});import{closeSync as vMt,mkdirSync as DMt,openSync as nMt,writeSync as gMt}from"fs";import{homedir as OMt}from"os";import{join as bRi}from"path";function NMt(i,u){let t={log:console.log,warn:console.warn,error:console.error},f=(l)=>{if(u===void 0)return;try{gMt(u,`${JRi(l)}
 `)}catch{}};return console.log=(...l)=>f(l),console.warn=(...l)=>f(l),console.error=(...l)=>{f(l),i(JRi(l))},()=>{console.log=t.log,console.warn=t.warn,console.error=t.error}}async function yMt(i,u){let t;try{t=await fetch(`${i}/api/links/me`,{headers:{authorization:`Bearer ${u}`},signal:AbortSignal.timeout(1e4)})}catch{return}if(t.status===401||t.status===403)throw Error(`Authentication rejected by ${i} \u2014 the session token was not accepted. `+`Run \`deco auth login --target ${i}\` and try again.`)}async function ZMt(i={}){let u=i.port??5174,t=i.dataDir??process.env.DATA_DIR??process.env.DECOCMS_HOME??bRi(OMt(),"deco"),f=i.clusterBaseUrl??process.env.MESH_CLUSTER_URL??"https://studio.decocms.com",l,c,E,$=()=>{if(E===void 0)return;try{E.close()}catch{}finally{E=void 0}};try{if(await XRi(u,"127.0.0.1"))throw new WRi(u);let w=bRi(t,"sandboxes");E=J1i({path:K1i(t),managedSandboxRoot:w});let d=await kli({dataDir:t,intent:"Link",target:f});if(process.env.DECOCMS_LINK_MANAGED!=="1")await yMt(f,d.accessToken);let h=E.reconcile();if(i.prune){let n=E.prune({missing:!0,merged:!0});if(!i.tui)console.log(`Pruned local sandboxes: removed ${n.removed.length}, skipped ${n.skipped.length}.`);h=E.reconcile()}let _;if(i.tui){let{render:n}=await import("ink"),{createElement:O}=await import("react"),{LinkApp:N}=await Promise.resolve().then(() => (Peu(),Ueu)),{pushSandboxEvent:y,setCluster:Z,setClusterUrl:T,setDaemonError:B,setIngress:F,setLogPath:A,setMachine:G,setPersistedSandboxes:I}=await Promise.resolve().then(() => (tq(),RRi));DMt(t,{recursive:!0});let k=bRi(t,"link.log");c=nMt(k,"w"),A(k),I(h),T(f),Z("connecting"),_={onEvent:(q)=>y(q),onIngress:(q)=>F(q,`http://127.0.0.1:${q}`),onCluster:(q)=>Z(q),onMachine:(q)=>G(q)},l=NMt(B,c),n(O(N),{patchConsole:!1})}else if(i.banner!==!1){let{printBanner:n}=await Promise.resolve().then(() => (uW(),pM));n(i.version??"0.0.0")}$();let v=process.env.DECOCMS_LINK_MANAGED!=="1",D=await leu({port:u,clusterBaseUrl:f,dataDir:t,session:d,monitor:_,logFd:c,perSandboxLogs:v,hotReload:i.hotReload});if(i.tui){let{setLinkActions:n}=await Promise.resolve().then(() => (tq(),RRi));n({stopSandbox:D.stopSandbox,removeSandbox:D.removeSandbox,inspectSandbox:D.inspectSandbox,quit:D.stop})}return await D.stopped}catch(w){return l?.(),console.error($eu(w)?weu(u):w instanceof Error?w.message:String(w)),1}finally{if(l?.(),c!==void 0)try{vMt(c)}catch{}$()}}var Ieu=g(()=>{_zi();ceu();LRi();deu();KRi()});var mRi={};Xi(mRi,{resolveDevLinkClusterUrl:()=>UMt,populateDevLinkToxiProxy:()=>Keu,isDevLinkToxiProxyEnabled:()=>FMt,ensureDevLinkToxiProxy:()=>kMt,buildDevLinkToxiProxyConfig:()=>Seu,DEV_LINK_TOXIPROXY_SERVICE_NAME:()=>keu,DEV_LINK_TOXIPROXY_PROXY_NAME:()=>Geu});function FMt(i=process.env){return i.DECO_DEV_LINK_TOXIPROXY==="1"}function CRi(i,u){if(!Number.isInteger(i)||i<1||i>65535)throw Error(`${u} must be an integer port in 1..65535`);return i}function Seu(i){let u=new URL(i.serverUrl);if(u.protocol!=="http:")throw Error("DECO_DEV_LINK_TOXIPROXY only supports http local Studio URLs");let t=CRi(i.apiPort,"apiPort"),f=CRi(i.listenPort,"listenPort");if(u.port.length===0)throw Error("serverUrl must include an explicit valid port");let l=CRi(Number.parseInt(u.port,10),"upstreamPort"),c=`http://127.0.0.1:${l}`,E=`http://127.0.0.1:${f}`;return{serviceName:keu,proxyName:Geu,apiUrl:`http://127.0.0.1:${t}`,listen:`0.0.0.0:${f}`,upstream:`host.docker.internal:${l}`,publicTargetUrl:c,clusterUrl:E,logLine:`[dev-link-toxiproxy] ready: ${E} -> ${c}`}}function UMt(i){return i.toxiproxy?.clusterUrl??i.serverUrl}async function MRi(i,u,t){if(i.ok)return;let f=await i.text();throw Error(`ToxiProxy ${u} failed for ${t}: status=${i.status} statusText=${i.statusText} body=${f}`)}function rRi(i){if(i instanceof Error)return i.name==="Error"?i.message:`${i.name}: ${i.message}`;return String(i)}function jeu(i){if(!(i instanceof Error))return!1;if(i.name==="TimeoutError")return!0;return jeu(i.cause)}async function qRi(i,u,t,f){try{return await i(t,f)}catch(l){throw Error(`ToxiProxy ${u} failed for ${t}: ${rRi(l)}`,{cause:l})}}async function Keu(i,u=fetch){let t=`${i.apiUrl}/reset`,f=await qRi(u,"reset",t,{method:"POST"});await MRi(f,"reset",t);let l=`${i.apiUrl}/populate`,c=await qRi(u,"populate",l,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify([{name:i.proxyName,listen:i.listen,upstream:i.upstream,enabled:!0}])});await MRi(c,"populate",l)}async function PMt(i,u){let t=`${i.apiUrl}/version`;try{await Cl(async()=>{let f=await qRi(u,"readiness check",t,{method:"GET",signal:AbortSignal.timeout(BMt)});await MRi(f,"readiness check",t)},{maxAttempts:TMt,minTimeout:xeu,maxTimeout:xeu,multiplier:1,jitter:0,isRetriable:(f)=>!jeu(f)})}catch(f){let l=f instanceof Wc?f.cause:f;throw Error(`ToxiProxy API did not become ready at ${t}: ${rRi(l)}`,{cause:l})}}async function AMt(i){if(i===null)return"";return await new Response(i).text()}async function VRi(i,u={}){let t=["docker",...i].join(" "),f=(()=>{try{return Bun.spawn(["docker",...i],{stdout:"ignore",stderr:"pipe"})}catch($){throw Error(`Docker command failed to start (${t}): ${rRi($)}`,{cause:$})}})(),[l,c]=await Promise.all([f.exited,AMt(f.stderr)]);if(l===0||u.ignoreFailure===!0)return;let E=c.trim().length>0?`: ${c.trim()}`:"";throw Error(`Docker command failed (${t}) with exit ${l}${E}`)}async function IMt(i,u){let t=`deco-dev-link-toxiproxy-${i}`;await VRi(["rm","-f",t],{ignoreFailure:!0}),await VRi(["run","--rm","-d","--name",t,"-p",`127.0.0.1:${i}:8474`,"-p",`127.0.0.1:${u}:${u}`,"ghcr.io/shopify/toxiproxy:2.12.0","-host=0.0.0.0"])}async function xMt(i,u){let t=`deco-dev-link-toxiproxy-${i}`;await VRi(["rm","-f",t],{ignoreFailure:!0})}async function kMt(i){let u=Seu(i),t=i.startDaemon??IMt,f=i.stopDaemon??(i.startDaemon===void 0?xMt:void 0);await t(i.apiPort,i.listenPort);let l=i.fetchImpl??fetch;try{await PMt(u,l),await Keu(u,l)}catch(c){if(f!==void 0)try{await f(i.apiPort,i.listenPort)}catch{}throw c}return{config:u,stop:async()=>{if(f!==void 0)await f(i.apiPort,i.listenPort)}}}var keu="ToxiProxy",Geu="dev_link_studio",TMt=20,xeu=100,BMt=100;var eRi=g(()=>{y4()});var Jeu={};Xi(Jeu,{migrateBetterAuth:()=>aRi});import{getMigrations as GMt}from"better-auth/db";import{sso as SMt}from"@better-auth/sso";import{organization as jMt}from"@decocms/better-auth/plugins";import{admin as KMt,apiKey as JMt,jwt as XMt,magicLink as LMt,mcp as WMt,openAPI as YMt}from"better-auth/plugins";import{emailOTP as QMt}from"better-auth/plugins/email-otp";async function aRi(i){let t={database:nM(i||t2()),plugins:[jMt({dynamicAccessControl:{enabled:!0,enableCustomResources:!0}}),KMt(),JMt(),XMt(),YMt(),WMt({loginPage:"/login"}),SMt(),LMt({sendMagicLink:async()=>{}}),QMt({sendVerificationOTP:async()=>{}})]},{toBeAdded:f,toBeCreated:l,runMigrations:c}=await GMt(t);if(!f.length&&!l.length)return"up to date";return await c(),`${l.length+f.length} table(s) migrated`}var oRi=g(()=>{lE()});var sRi={};Xi(sRi,{up:()=>zMt,down:()=>HMt});import{sql as $v}from"kysely";async function zMt(i){await i.schema.createTable("connections").addColumn("id","text",(u)=>u.primaryKey()).addColumn("organizationId","text",(u)=>u.notNull().references("organization.id").onDelete("cascade")).addColumn("createdById","text",(u)=>u.notNull().references("user.id").onDelete("cascade")).addColumn("name","text",(u)=>u.notNull()).addColumn("description","text").addColumn("icon","text").addColumn("appName","text").addColumn("appId","text").addColumn("connectionType","text",(u)=>u.notNull()).addColumn("connectionUrl","text",(u)=>u.notNull()).addColumn("connectionToken","text").addColumn("connectionHeaders","text").addColumn("oauthConfig","text").addColumn("metadata","text").addColumn("tools","text").addColumn("bindings","text").addColumn("status","text",(u)=>u.notNull().defaultTo("active")).addColumn("createdAt","text",(u)=>u.notNull().defaultTo($v`CURRENT_TIMESTAMP`)).addColumn("updatedAt","text",(u)=>u.notNull().defaultTo($v`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("api_keys").addColumn("id","text",(u)=>u.primaryKey()).addColumn("userId","text",(u)=>u.notNull().references("user.id").onDelete("cascade")).addColumn("name","text",(u)=>u.notNull()).addColumn("hashedKey","text",(u)=>u.notNull().unique()).addColumn("permissions","text",(u)=>u.notNull()).addColumn("expiresAt","text").addColumn("remaining","integer").addColumn("metadata","text").addColumn("createdAt","text",(u)=>u.notNull().defaultTo($v`CURRENT_TIMESTAMP`)).addColumn("updatedAt","text",(u)=>u.notNull().defaultTo($v`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("audit_logs").addColumn("id","text",(u)=>u.primaryKey()).addColumn("organizationId","text").addColumn("userId","text",(u)=>u.references("user.id").onDelete("set null")).addColumn("connectionId","text",(u)=>u.references("connections.id").onDelete("set null")).addColumn("toolName","text",(u)=>u.notNull()).addColumn("allowed","integer",(u)=>u.notNull()).addColumn("duration","integer").addColumn("timestamp","text",(u)=>u.notNull().defaultTo($v`CURRENT_TIMESTAMP`)).addColumn("requestMetadata","text").execute(),await i.schema.createTable("oauth_clients").addColumn("id","text",(u)=>u.primaryKey()).addColumn("clientId","text",(u)=>u.notNull().unique()).addColumn("clientSecret","text").addColumn("clientName","text",(u)=>u.notNull()).addColumn("redirectUris","text",(u)=>u.notNull()).addColumn("grantTypes","text",(u)=>u.notNull()).addColumn("scope","text").addColumn("clientUri","text").addColumn("logoUri","text").addColumn("createdAt","text",(u)=>u.notNull().defaultTo($v`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("oauth_authorization_codes").addColumn("code","text",(u)=>u.primaryKey()).addColumn("clientId","text",(u)=>u.notNull().references("oauth_clients.clientId").onDelete("cascade")).addColumn("userId","text",(u)=>u.notNull().references("user.id").onDelete("cascade")).addColumn("redirectUri","text",(u)=>u.notNull()).addColumn("scope","text").addColumn("codeChallenge","text").addColumn("codeChallengeMethod","text").addColumn("expiresAt","text",(u)=>u.notNull()).addColumn("createdAt","text",(u)=>u.notNull().defaultTo($v`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("oauth_refresh_tokens").addColumn("token","text",(u)=>u.primaryKey()).addColumn("clientId","text",(u)=>u.notNull().references("oauth_clients.clientId").onDelete("cascade")).addColumn("userId","text",(u)=>u.notNull().references("user.id").onDelete("cascade")).addColumn("scope","text").addColumn("expiresAt","text").addColumn("createdAt","text",(u)=>u.notNull().defaultTo($v`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("downstream_tokens").addColumn("id","text",(u)=>u.primaryKey()).addColumn("connectionId","text",(u)=>u.notNull().references("connections.id").onDelete("cascade")).addColumn("userId","text",(u)=>u.references("user.id").onDelete("cascade")).addColumn("accessToken","text",(u)=>u.notNull()).addColumn("refreshToken","text").addColumn("scope","text").addColumn("expiresAt","text").addColumn("createdAt","text",(u)=>u.notNull().defaultTo($v`CURRENT_TIMESTAMP`)).addColumn("updatedAt","text",(u)=>u.notNull().defaultTo($v`CURRENT_TIMESTAMP`)).execute(),await i.schema.createIndex("idx_connections_organizationId").on("connections").column("organizationId").execute(),await i.schema.createIndex("idx_audit_logs_organizationId").on("audit_logs").column("organizationId").execute(),await i.schema.createIndex("idx_audit_logs_userId").on("audit_logs").column("userId").execute(),await i.schema.createIndex("idx_audit_logs_timestamp").on("audit_logs").column("timestamp").execute()}async function HMt(i){await i.schema.dropTable("downstream_tokens").execute(),await i.schema.dropTable("oauth_refresh_tokens").execute(),await i.schema.dropTable("oauth_authorization_codes").execute(),await i.schema.dropTable("oauth_clients").execute(),await i.schema.dropTable("audit_logs").execute(),await i.schema.dropTable("api_keys").execute(),await i.schema.dropTable("connections").execute()}var Xeu=()=>{};var pRi={};Xi(pRi,{up:()=>RMt,down:()=>bMt});import{sql as Leu}from"kysely";async function RMt(i){await i.schema.createTable("organization_settings").addColumn("organizationId","text",(u)=>u.primaryKey().references("organization.id").onDelete("cascade")).addColumn("modelsBindingConnectionId","text",(u)=>u.references("connections.id").onDelete("set null")).addColumn("createdAt","text",(u)=>u.notNull().defaultTo(Leu`CURRENT_TIMESTAMP`)).addColumn("updatedAt","text",(u)=>u.notNull().defaultTo(Leu`CURRENT_TIMESTAMP`)).execute()}async function bMt(i){await i.schema.dropTable("organization_settings").execute()}var Weu=()=>{};var ibi={};Xi(ibi,{up:()=>CMt,down:()=>MMt});async function CMt(i){await i.schema.alterTable("connections").renameColumn("name","title").execute(),await i.schema.alterTable("connections").renameColumn("createdById","created_by").execute(),await i.schema.alterTable("connections").renameColumn("createdAt","created_at").execute(),await i.schema.alterTable("connections").renameColumn("updatedAt","updated_at").execute(),await i.schema.alterTable("connections").renameColumn("organizationId","organization_id").execute(),await i.schema.alterTable("connections").renameColumn("connectionType","connection_type").execute(),await i.schema.alterTable("connections").renameColumn("connectionUrl","connection_url").execute(),await i.schema.alterTable("connections").renameColumn("connectionToken","connection_token").execute(),await i.schema.alterTable("connections").renameColumn("connectionHeaders","connection_headers").execute(),await i.schema.alterTable("connections").renameColumn("oauthConfig","oauth_config").execute(),await i.schema.alterTable("connections").renameColumn("appName","app_name").execute(),await i.schema.alterTable("connections").renameColumn("appId","app_id").execute()}async function MMt(i){await i.schema.alterTable("connections").renameColumn("title","name").execute(),await i.schema.alterTable("connections").renameColumn("created_by","createdById").execute(),await i.schema.alterTable("connections").renameColumn("created_at","createdAt").execute(),await i.schema.alterTable("connections").renameColumn("updated_at","updatedAt").execute(),await i.schema.alterTable("connections").renameColumn("organization_id","organizationId").execute(),await i.schema.alterTable("connections").renameColumn("connection_type","connectionType").execute(),await i.schema.alterTable("connections").renameColumn("connection_url","connectionUrl").execute(),await i.schema.alterTable("connections").renameColumn("connection_token","connectionToken").execute(),await i.schema.alterTable("connections").renameColumn("connection_headers","connectionHeaders").execute(),await i.schema.alterTable("connections").renameColumn("oauth_config","oauthConfig").execute(),await i.schema.alterTable("connections").renameColumn("app_name","appName").execute(),await i.schema.alterTable("connections").renameColumn("app_id","appId").execute()}var ubi={};Xi(ubi,{up:()=>qMt,down:()=>VMt});async function qMt(i){await i.schema.createTable("organization_settings_new").addColumn("organizationId","text",(u)=>u.primaryKey().references("organization.id").onDelete("cascade")).addColumn("createdAt","text",(u)=>u.notNull()).addColumn("updatedAt","text",(u)=>u.notNull()).execute(),await i.insertInto("organization_settings_new").columns(["organizationId","createdAt","updatedAt"]).expression((u)=>u.selectFrom("organization_settings").select(["organizationId","createdAt","updatedAt"])).execute(),await i.schema.dropTable("organization_settings").execute(),await i.schema.alterTable("organization_settings_new").renameTo("organization_settings").execute()}async function VMt(i){await i.schema.createTable("organization_settings_new").addColumn("organizationId","text",(u)=>u.primaryKey().references("organization.id").onDelete("cascade")).addColumn("modelsBindingConnectionId","text",(u)=>u.references("connections.id").onDelete("set null")).addColumn("createdAt","text",(u)=>u.notNull()).addColumn("updatedAt","text",(u)=>u.notNull()).execute(),await i.insertInto("organization_settings_new").columns(["organizationId","modelsBindingConnectionId","createdAt","updatedAt"]).expression((u)=>u.selectFrom("organization_settings").select(["organizationId",u.val(null).as("modelsBindingConnectionId"),"createdAt","updatedAt"])).execute(),await i.schema.dropTable("organization_settings").execute(),await i.schema.alterTable("organization_settings_new").renameTo("organization_settings").execute()}var tbi={};Xi(tbi,{up:()=>rMt,down:()=>mMt});async function rMt(i){await i.schema.alterTable("connections").addColumn("configuration_state","text").execute(),await i.schema.alterTable("connections").addColumn("configuration_scopes","text").execute()}async function mMt(i){await i.schema.alterTable("connections").dropColumn("configuration_state").execute(),await i.schema.alterTable("connections").dropColumn("configuration_scopes").execute()}var fbi={};Xi(fbi,{up:()=>aMt,down:()=>oMt});import{sql as eMt}from"kysely";async function aMt(i){await i.schema.alterTable("organization_settings").addColumn("sidebar_items",eMt`text`).execute()}async function oMt(i){await i.schema.alterTable("organization_settings").dropColumn("sidebar_items").execute()}var Yeu=()=>{};var lbi={};Xi(lbi,{up:()=>sMt,down:()=>pMt});async function sMt(i){await i.schema.createTable("monitoring_logs").addColumn("id","text",(u)=>u.primaryKey()).addColumn("organization_id","text",(u)=>u.notNull().references("organization.id").onDelete("cascade")).addColumn("connection_id","text",(u)=>u.notNull().references("connections.id").onDelete("cascade")).addColumn("connection_title","text",(u)=>u.notNull()).addColumn("tool_name","text",(u)=>u.notNull()).addColumn("input","text",(u)=>u.notNull()).addColumn("output","text",(u)=>u.notNull()).addColumn("is_error","integer",(u)=>u.notNull()).addColumn("error_message","text").addColumn("duration_ms","integer",(u)=>u.notNull()).addColumn("timestamp","text",(u)=>u.notNull()).addColumn("user_id","text").addColumn("request_id","text",(u)=>u.notNull()).execute(),await i.schema.createIndex("monitoring_logs_org_timestamp").on("monitoring_logs").columns(["organization_id","timestamp"]).execute(),await i.schema.createIndex("monitoring_logs_connection_timestamp").on("monitoring_logs").columns(["connection_id","timestamp"]).execute(),await i.schema.createIndex("monitoring_logs_is_error").on("monitoring_logs").columns(["organization_id","is_error","timestamp"]).execute()}async function pMt(i){await i.schema.dropIndex("monitoring_logs_is_error").execute(),await i.schema.dropIndex("monitoring_logs_connection_timestamp").execute(),await i.schema.dropIndex("monitoring_logs_org_timestamp").execute(),await i.schema.dropTable("monitoring_logs").execute()}var cbi={};Xi(cbi,{up:()=>iqt,down:()=>uqt});import{sql as fq}from"kysely";async function iqt(i){await i.schema.createTable("events").addColumn("id","text",(u)=>u.primaryKey()).addColumn("organization_id","text",(u)=>u.notNull().references("organization.id").onDelete("cascade")).addColumn("type","text",(u)=>u.notNull()).addColumn("source","text",(u)=>u.notNull()).addColumn("specversion","text",(u)=>u.notNull().defaultTo("1.0")).addColumn("subject","text").addColumn("time","text",(u)=>u.notNull()).addColumn("datacontenttype","text",(u)=>u.notNull().defaultTo("application/json")).addColumn("dataschema","text").addColumn("data","text").addColumn("cron","varchar(255)").addColumn("status","text",(u)=>u.notNull().defaultTo("pending")).addColumn("attempts","integer",(u)=>u.notNull().defaultTo(0)).addColumn("last_error","text").addColumn("next_retry_at","text").addColumn("created_at","text",(u)=>u.notNull().defaultTo(fq`CURRENT_TIMESTAMP`)).addColumn("updated_at","text",(u)=>u.notNull().defaultTo(fq`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("event_subscriptions").addColumn("id","text",(u)=>u.primaryKey()).addColumn("organization_id","text",(u)=>u.notNull().references("organization.id").onDelete("cascade")).addColumn("connection_id","text",(u)=>u.notNull().references("connections.id").onDelete("cascade")).addColumn("publisher","text").addColumn("event_type","text",(u)=>u.notNull()).addColumn("filter","text").addColumn("enabled","integer",(u)=>u.notNull().defaultTo(1)).addColumn("created_at","text",(u)=>u.notNull().defaultTo(fq`CURRENT_TIMESTAMP`)).addColumn("updated_at","text",(u)=>u.notNull().defaultTo(fq`CURRENT_TIMESTAMP`)).execute(),await i.schema.createTable("event_deliveries").addColumn("id","text",(u)=>u.primaryKey()).addColumn("event_id","text",(u)=>u.notNull()).addColumn("subscription_id","text",(u)=>u.notNull().references("event_subscriptions.id").onDelete("cascade")).addColumn("status","text",(u)=>u.notNull().defaultTo("pending")).addColumn("attempts","integer",(u)=>u.notNull().defaultTo(0)).addColumn("last_error","text").addColumn("delivered_at","text").addColumn("next_retry_at","text").addColumn("created_at","text",(u)=>u.notNull().defaultTo(fq`CURRENT_TIMESTAMP`)).execute(),await i.schema.createIndex("idx_events_org_status").on("events").columns(["organization_id","status"]).execute(),await i.schema.createIndex("idx_events_source").on("events").columns(["source"]).execute(),await i.schema.createIndex("idx_events_type").on("events").columns(["type"]).execute(),await i.schema.createIndex("idx_events_retry").on("events").columns(["status","next_retry_at"]).execute(),await i.schema.createIndex("idx_subscriptions_connection").on("event_subscriptions").columns(["connection_id"]).execute(),await i.schema.createIndex("idx_subscriptions_type").on("event_subscriptions").columns(["event_type"]).execute(),await i.schema.createIndex("idx_subscriptions_org_enabled").on("event_subscriptions").columns(["organization_id","enabled"]).execute(),await i.schema.createIndex("idx_subscriptions_unique").on("event_subscriptions").columns(["connection_id","event_type","publisher","filter"]).unique().execute(),await i.schema.createIndex("idx_deliveries_event").on("event_deliveries").columns(["event_id"]).execute(),await i.schema.createIndex("idx_deliveries_subscription_status").on("event_deliveries").columns(["subscription_id","status"]).execute(),await i.schema.createIndex("idx_deliveries_retry").on("event_deliveries").columns(["status","next_retry_at"]).execute()}async function uqt(i){await i.schema.dropIndex("idx_deliveries_retry").execute(),await i.schema.dropIndex("idx_deliveries_subscription_status").execute(),await i.schema.dropIndex("idx_deliveries_event").execute(),await i.schema.dropIndex("idx_subscriptions_unique").execute(),await i.schema.dropIndex("idx_subscriptions_org_enabled").execute(),await i.schema.dropIndex("idx_subscriptions_type").execute(),await i.schema.dropIndex("idx_subscriptions_connection").execute(),await i.schema.dropIndex("idx_events_retry").execute(),await i.schema.dropIndex("idx_events_type").execute(),await i.schema.dropIndex("idx_events_source").execute(),await i.schema.dropIndex("idx_events_org_status").execute(),await i.schema.dropTable("event_deliveries").execute(),await i.schema.dropTable("event_subscriptions").execute(),await i.schema.dropTable("events").execute()}var Qeu=()=>{};var Ebi={};Xi(Ebi,{up:()=>fqt,down:()=>lqt});import{sql as tqt}from"kysely";async function fqt(i){await i.schema.dropTable("audit_logs").ifExists().execute()}async function lqt(i){await i.schema.createTable("audit_logs").ifNotExists().addColumn("id","text",(u)=>u.primaryKey()).addColumn("organizationId","text").addColumn("userId","text",(u)=>u.references("user.id").onDelete("set null")).addColumn("connectionId","text",(u)=>u.references("connections.id").onDelete("set null")).addColumn("toolName","text",(u)=>u.notNull()).addColumn("allowed","integer",(u)=>u.notNull()).addColumn("duration","integer").addColumn("timestamp","text",(u)=>u.notNull().defaultTo(tqt`CURRENT_TIMESTAMP`)).addColumn("requestMetadata","text").execute(),await i.schema.createIndex("idx_audit_logs_organizationId").on("audit_logs").column("organizationId").execute(),await i.schema.createIndex("idx_audit_logs_userId").on("audit_logs").column("userId").execute(),await i.schema.createIndex("idx_audit_logs_timestamp").on("audit_logs").column("timestamp").execute()}var zeu=()=>{};var $bi={};Xi($bi,{up:()=>cqt,down:()=>Eqt});import{sql as R1i}from"kysely";async function cqt(i){await i.schema.createTable("gateways").addColumn("id","text",(u)=>u.primaryKey()).addColumn("organization_id","text",(u)=>u.notNull().references("organization.id").onDelete("cascade")).addColumn("title","text",(u)=>u.notNull()).addColumn("description","text").addColumn("tool_selection_strategy","text").addColumn("status","text",(u)=>u.notNull().defaultTo("active")).addColumn("is_default","integer",(u)=>u.notNull().defaultTo(0)).addColumn("created_at","text",(u)=>u.notNull().defaultTo(R1i`CURRENT_TIMESTAMP`)).addColumn("updated_at","text",(u)=>u.notNull().defaultTo(R1i`CURRENT_TIMESTAMP`)).addColumn("created_by","text",(u)=>u.notNull().references("user.id").onDelete("cascade")).addColumn("updated_by","text").execute(),await i.schema.createTable("gateway_connections").addColumn("id","text",(u)=>u.primaryKey()).addColumn("gateway_id","text",(u)=>u.notNull().references("gateways.id").onDelete("cascade")).addColumn("connection_id","text",(u)=>u.notNull().references("connections.id").onDelete("cascade")).addColumn("selected_tools","text").addColumn("created_at","text",(u)=>u.notNull().defaultTo(R1i`CURRENT_TIMESTAMP`)).execute(),await i.schema.createIndex("idx_gateways_org").on("gateways").columns(["organization_id"]).execute(),await i.schema.createIndex("idx_gateways_org_status").on("gateways").columns(["organization_id","status"]).execute(),await R1i`CREATE UNIQUE INDEX idx_gateways_default_per_org ON gateways (organization_id) WHERE is_default = 1`.execute(i),await i.schema.createIndex("idx_gateway_connections_gateway").on("gateway_connections").columns(["gateway_id"]).execute(),await i.schema.createIndex("idx_gateway_connections_connection").on("gateway_connections").columns(["connection_id"]).execute(),await i.schema.createIndex("idx_gateway_connections_unique").on("gateway_connections").columns(["gateway_id","connection_id"]).unique().execute()}async function Eqt(i){await i.schema.dropIndex("idx_gateway_connections_unique").execute(),await i.schema.dropIndex("idx_gateway_connections_connection").execute(),await i.schema.dropIndex("idx_gateway_connections_gateway").execute(),await i.schema.dropIndex("idx_gateways_default_per_org").execute(),await i.schema.dropIndex("idx_gateways_org_status").execute(),await i.schema.dropIndex("idx_gateways_org").execute(),await i.schema.dropTable("gateway_connections").execute(),await i.schema.dropTable("gateways").execute()}var Heu=()=>{};var wbi={};Xi(wbi,{up:()=>$qt,down:()=>wqt});async function $qt(i){await i.schema.alterTable("gateways").addColumn("icon","text").execute()}async function wqt(i){await i.schema.alterTable("gateways").dropColumn("icon").execute()}var dbi={};Xi(dbi,{up:()=>dqt,down:()=>hqt});import{sql as b1i}from"kysely";async function dqt(i){await i.schema.alterTable("gateways").addColumn("tool_selection_mode","text",(u)=>u.notNull().defaultTo("inclusion")).execute(),await b1i`
     UPDATE gateways
     SET tool_selection_mode = CASE
@@ -86693,7 +86693,7 @@ ${LXf}`:""}
 `);let f=u.pax;if(f)for(let l in f)t+=J1u(" "+l+"="+f[l]+`
 `);return of.from(t)};rbf.decodePax=function(u){let t={};while(u.length){let f=0;while(f<u.length&&u[f]!==32)f++;let l=parseInt(of.toString(u.subarray(0,f)),10);if(!l)return t;let c=of.toString(u.subarray(f+1,l-1)),E=c.indexOf("=");if(E===-1)return t;t[c.slice(0,E)]=c.slice(E+1),u=u.subarray(l)}return t};rbf.encode=function(u){let t=of.alloc(512),f=u.name,l="";if(u.typeflag===5&&f[f.length-1]!=="/")f+="/";if(of.byteLength(f)!==f.length)return null;while(of.byteLength(f)>100){let c=f.indexOf("/");if(c===-1)return null;l+=l?"/"+f.slice(0,c):f.slice(0,c),f=f.slice(c+1)}if(of.byteLength(f)>100||of.byteLength(l)>155)return null;if(u.linkname&&of.byteLength(u.linkname)>100)return null;if(of.write(t,f),of.write(t,Qg(u.mode&4095,6),100),of.write(t,Qg(u.uid,6),108),of.write(t,Qg(u.gid,6),116),qbf(u.size,t,124),of.write(t,Qg(u.mtime.getTime()/1000|0,11),136),t[156]=48+Cbf(u.type),u.linkname)of.write(t,u.linkname,157);if(of.copy(cG0,t,257),of.copy(Wbf,t,263),u.uname)of.write(t,u.uname,265);if(u.gname)of.write(t,u.gname,297);if(of.write(t,Qg(u.devmajor||0,6),329),of.write(t,Qg(u.devminor||0,6),337),l)of.write(t,l,345);return of.write(t,Qg($G0(t),6),148),t};rbf.decode=function(u,t,f){let l=u[156]===0?0:u[156]-48,c=lH(u,0,100,t),E=Yg(u,100,8),$=Yg(u,108,8),w=Yg(u,116,8),d=Yg(u,124,12),h=Yg(u,136,12),_=bbf(l),v=u[157]===0?null:lH(u,157,100,t),D=lH(u,265,32),n=lH(u,297,32),O=Yg(u,329,8),N=Yg(u,337,8),y=$G0(u);if(y===256)return null;if(y!==Yg(u,148,8))throw Error("Invalid tar header. Maybe the tar is corrupted or it needs to be gunzipped?");if(zbf(u)){if(u[345])c=lH(u,345,155,t)+"/"+c}else if(Hbf(u));else if(!f)throw Error("Invalid tar header: unknown format.");if(l===0&&c&&c[c.length-1]==="/")l=5;return{name:c,mode:E,uid:$,gid:w,size:d,mtime:new Date(1000*h),type:_,linkname:v,uname:D,gname:n,devmajor:O,devminor:N,pax:null}};function zbf(i){return of.equals(cG0,i.subarray(257,263))}function Hbf(i){return of.equals(Ybf,i.subarray(257,263))&&of.equals(Qbf,i.subarray(263,265))}function Rbf(i,u,t){if(typeof i!=="number")return t;if(i=~~i,i>=u)return u;if(i>=0)return i;if(i+=u,i>=0)return i;return 0}function bbf(i){switch(i){case 0:return"file";case 1:return"link";case 2:return"symlink";case 3:return"character-device";case 4:return"block-device";case 5:return"directory";case 6:return"fifo";case 7:return"contiguous-file";case 72:return"pax-header";case 55:return"pax-global-header";case 27:return"gnu-long-link-path";case 28:case 30:return"gnu-long-path"}return null}function Cbf(i){switch(i){case"file":return 0;case"link":return 1;case"symlink":return 2;case"character-device":return 3;case"block-device":return 4;case"directory":return 5;case"fifo":return 6;case"contiguous-file":return 7;case"pax-header":return 72}return 0}function EG0(i,u,t,f){for(;t<f;t++)if(i[t]===u)return t;return f}function $G0(i){let u=256;for(let t=0;t<148;t++)u+=i[t];for(let t=156;t<512;t++)u+=i[t];return u}function Qg(i,u){if(i=i.toString(8),i.length>u)return"7777777777777777777".slice(0,u)+" ";return"0000000000000000000".slice(0,u-i.length)+i+" "}function Mbf(i,u,t){u[t]=128;for(let f=11;f>0;f--)u[t+f]=i&255,i=Math.floor(i/256)}function qbf(i,u,t){if(i.toString(8).length>11)Mbf(i,u,t);else of.write(u,Qg(i,11),t)}function Vbf(i){let u;if(i[0]===128)u=!0;else if(i[0]===255)u=!1;else return null;let t=[],f;for(f=i.length-1;f>0;f--){let E=i[f];if(u)t.push(E);else t.push(255-E)}let l=0,c=t.length;for(f=0;f<c;f++)l+=t[f]*Math.pow(256,f);return u?l:-1*l}function Yg(i,u,t){if(i=i.subarray(u,u+t),u=0,i[u]&128)return Vbf(i);else{while(u<i.length&&i[u]===32)u++;let f=Rbf(EG0(i,32,u,i.length),i.length,i.length);while(u<f&&i[u]===0)u++;if(f===u)return 0;return parseInt(of.toString(i.subarray(u,f)),8)}}function lH(i,u,t,f){return of.toString(i.subarray(u,EG0(i,0,u,u+t)),f)}function J1u(i){let u=of.byteLength(i),t=Math.floor(Math.log(u)/Math.log(10))+1;if(u+t>=Math.pow(10,t))t++;return u+t+i}});var gG0=K((w3c,nG0)=>{var{Writable:pbf,Readable:iCf,getStreamError:wG0}=K1u(),uCf=I1u(),dG0=fH(),cH=X1u(),tCf=dG0.alloc(0);class hG0{constructor(){this.buffered=0,this.shifted=0,this.queue=new uCf,this._offset=0}push(i){this.buffered+=i.byteLength,this.queue.push(i)}shiftFirst(i){return this._buffered===0?null:this._next(i)}shift(i){if(i>this.buffered)return null;if(i===0)return tCf;let u=this._next(i);if(i===u.byteLength)return u;let t=[u];while((i-=u.byteLength)>0)u=this._next(i),t.push(u);return dG0.concat(t)}_next(i){let u=this.queue.peek(),t=u.byteLength-this._offset;if(i>=t){let f=this._offset?u.subarray(this._offset,u.byteLength):u;return this.queue.shift(),this._offset=0,this.buffered-=t,this.shifted+=t,f}return this.buffered-=i,this.shifted+=i,u.subarray(this._offset,this._offset+=i)}}class _G0 extends iCf{constructor(i,u,t){super();this.header=u,this.offset=t,this._parent=i}_read(i){if(this.header.size===0)this.push(null);if(this._parent._stream===this)this._parent._update();i(null)}_predestroy(){this._parent.destroy(wG0(this))}_detach(){if(this._parent._stream===this)this._parent._stream=null,this._parent._missing=DG0(this.header.size),this._parent._update()}_destroy(i){this._detach(),i(null)}}class vG0 extends pbf{constructor(i){super(i);if(!i)i={};this._buffer=new hG0,this._offset=0,this._header=null,this._stream=null,this._missing=0,this._longHeader=!1,this._callback=L1u,this._locked=!1,this._finished=!1,this._pax=null,this._paxGlobal=null,this._gnuLongPath=null,this._gnuLongLinkPath=null,this._filenameEncoding=i.filenameEncoding||"utf-8",this._allowUnknownFormat=!!i.allowUnknownFormat,this._unlockBound=this._unlock.bind(this)}_unlock(i){if(this._locked=!1,i){this.destroy(i),this._continueWrite(i);return}this._update()}_consumeHeader(){if(this._locked)return!1;this._offset=this._buffer.shifted;try{this._header=cH.decode(this._buffer.shift(512),this._filenameEncoding,this._allowUnknownFormat)}catch(i){return this._continueWrite(i),!1}if(!this._header)return!0;switch(this._header.type){case"gnu-long-path":case"gnu-long-link-path":case"pax-global-header":case"pax-header":return this._longHeader=!0,this._missing=this._header.size,!0}if(this._locked=!0,this._applyLongHeaders(),this._header.size===0||this._header.type==="directory")return this.emit("entry",this._header,this._createStream(),this._unlockBound),!0;return this._stream=this._createStream(),this._missing=this._header.size,this.emit("entry",this._header,this._stream,this._unlockBound),!0}_applyLongHeaders(){if(this._gnuLongPath)this._header.name=this._gnuLongPath,this._gnuLongPath=null;if(this._gnuLongLinkPath)this._header.linkname=this._gnuLongLinkPath,this._gnuLongLinkPath=null;if(this._pax){if(this._pax.path)this._header.name=this._pax.path;if(this._pax.linkpath)this._header.linkname=this._pax.linkpath;if(this._pax.size)this._header.size=parseInt(this._pax.size,10);this._header.pax=this._pax,this._pax=null}}_decodeLongHeader(i){switch(this._header.type){case"gnu-long-path":this._gnuLongPath=cH.decodeLongPath(i,this._filenameEncoding);break;case"gnu-long-link-path":this._gnuLongLinkPath=cH.decodeLongPath(i,this._filenameEncoding);break;case"pax-global-header":this._paxGlobal=cH.decodePax(i);break;case"pax-header":this._pax=this._paxGlobal===null?cH.decodePax(i):Object.assign({},this._paxGlobal,cH.decodePax(i));break}}_consumeLongHeader(){this._longHeader=!1,this._missing=DG0(this._header.size);let i=this._buffer.shift(this._header.size);try{this._decodeLongHeader(i)}catch(u){return this._continueWrite(u),!1}return!0}_consumeStream(){let i=this._buffer.shiftFirst(this._missing);if(i===null)return!1;this._missing-=i.byteLength;let u=this._stream.push(i);if(this._missing===0){if(this._stream.push(null),u)this._stream._detach();return u&&this._locked===!1}return u}_createStream(){return new _G0(this,this._header,this._offset)}_update(){while(this._buffer.buffered>0&&!this.destroying){if(this._missing>0){if(this._stream!==null){if(this._consumeStream()===!1)return;continue}if(this._longHeader===!0){if(this._missing>this._buffer.buffered)break;if(this._consumeLongHeader()===!1)return!1;continue}let i=this._buffer.shiftFirst(this._missing);if(i!==null)this._missing-=i.byteLength;continue}if(this._buffer.buffered<512)break;if(this._stream!==null||this._consumeHeader()===!1)return}this._continueWrite(null)}_continueWrite(i){let u=this._callback;this._callback=L1u,u(i)}_write(i,u){this._callback=u,this._buffer.push(i),this._update()}_final(i){this._finished=this._missing===0&&this._buffer.buffered===0,i(this._finished?null:Error("Unexpected end of data"))}_predestroy(){this._continueWrite(null)}_destroy(i){if(this._stream)this._stream.destroy(wG0(this));i(null)}[Symbol.asyncIterator](){let i=null,u=null,t=null,f=null,l=null,c=this;return this.on("entry",w),this.on("error",(_)=>{i=_}),this.on("close",d),{[Symbol.asyncIterator](){return this},next(){return new Promise($)},return(){return h(null)},throw(_){return h(_)}};function E(_){if(!l)return;let v=l;l=null,v(_)}function $(_,v){if(i)return v(i);if(f){_({value:f,done:!1}),f=null;return}if(u=_,t=v,E(null),c._finished&&u)u({value:void 0,done:!0}),u=t=null}function w(_,v,D){if(l=D,v.on("error",L1u),u)u({value:v,done:!1}),u=t=null;else f=v}function d(){if(E(i),!u)return;if(i)t(i);else u({value:void 0,done:!0});u=t=null}function h(_){return c.destroy(_),E(_),new Promise((v,D)=>{if(c.destroyed)return v({value:void 0,done:!0});c.once("close",function(){if(_)D(_);else v({value:void 0,done:!0})})})}}}nG0.exports=function(u){return new vG0(u)};function L1u(){}function DG0(i){return i&=511,i&&512-i}});var NG0=K((d3c,W1u)=>{var OG0={S_IFMT:61440,S_IFDIR:16384,S_IFCHR:8192,S_IFBLK:24576,S_IFIFO:4096,S_IFLNK:40960};try{W1u.exports=Ni("fs").constants||OG0}catch{W1u.exports=OG0}});var PG0=K((h3c,UG0)=>{var{Readable:fCf,Writable:lCf,getStreamError:yG0}=K1u(),zK=fH(),EH=NG0(),cTi=X1u(),ZG0=zK.alloc(1024);class TG0 extends lCf{constructor(i,u,t){super({mapWritable:ECf,eagerOpen:!0});if(this.written=0,this.header=u,this._callback=t,this._linkname=null,this._isLinkname=u.type==="symlink"&&!u.linkname,this._isVoid=u.type!=="file"&&u.type!=="contiguous-file",this._finished=!1,this._pack=i,this._openCallback=null,this._pack._stream===null)this._pack._stream=this;else this._pack._pending.push(this)}_open(i){if(this._openCallback=i,this._pack._stream===this)this._continueOpen()}_continuePack(i){if(this._callback===null)return;let u=this._callback;this._callback=null,u(i)}_continueOpen(){if(this._pack._stream===null)this._pack._stream=this;let i=this._openCallback;if(this._openCallback=null,i===null)return;if(this._pack.destroying)return i(Error("pack stream destroyed"));if(this._pack._finalized)return i(Error("pack stream is already finalized"));if(this._pack._stream=this,!this._isLinkname)this._pack._encode(this.header);if(this._isVoid)this._finish(),this._continuePack(null);i(null)}_write(i,u){if(this._isLinkname)return this._linkname=this._linkname?zK.concat([this._linkname,i]):i,u(null);if(this._isVoid){if(i.byteLength>0)return u(Error("No body allowed for this entry"));return u()}if(this.written+=i.byteLength,this._pack.push(i))return u();this._pack._drain=u}_finish(){if(this._finished)return;if(this._finished=!0,this._isLinkname)this.header.linkname=this._linkname?zK.toString(this._linkname,"utf-8"):"",this._pack._encode(this.header);FG0(this._pack,this.header.size),this._pack._done(this)}_final(i){if(this.written!==this.header.size)return i(Error("Size mismatch"));this._finish(),i(null)}_getError(){return yG0(this)||Error("tar entry destroyed")}_predestroy(){this._pack.destroy(this._getError())}_destroy(i){this._pack._done(this),this._continuePack(this._finished?null:this._getError()),i()}}class BG0 extends fCf{constructor(i){super(i);this._drain=Y1u,this._finalized=!1,this._finalizing=!1,this._pending=[],this._stream=null}entry(i,u,t){if(this._finalized||this.destroying)throw Error("already finalized or destroyed");if(typeof u==="function")t=u,u=null;if(!t)t=Y1u;if(!i.size||i.type==="symlink")i.size=0;if(!i.type)i.type=cCf(i.mode);if(!i.mode)i.mode=i.type==="directory"?493:420;if(!i.uid)i.uid=0;if(!i.gid)i.gid=0;if(!i.mtime)i.mtime=new Date;if(typeof u==="string")u=zK.from(u);let f=new TG0(this,i,t);if(zK.isBuffer(u))return i.size=u.byteLength,f.write(u),f.end(),f;if(f._isVoid)return f;return f}finalize(){if(this._stream||this._pending.length>0){this._finalizing=!0;return}if(this._finalized)return;this._finalized=!0,this.push(ZG0),this.push(null)}_done(i){if(i!==this._stream)return;if(this._stream=null,this._finalizing)this.finalize();if(this._pending.length)this._pending.shift()._continueOpen()}_encode(i){if(!i.pax){let u=cTi.encode(i);if(u){this.push(u);return}}this._encodePax(i)}_encodePax(i){let u=cTi.encodePax({name:i.name,linkname:i.linkname,pax:i.pax}),t={name:"PaxHeader",mode:i.mode,uid:i.uid,gid:i.gid,size:u.byteLength,mtime:i.mtime,type:"pax-header",linkname:i.linkname&&"PaxHeader",uname:i.uname,gname:i.gname,devmajor:i.devmajor,devminor:i.devminor};this.push(cTi.encode(t)),this.push(u),FG0(this,u.byteLength),t.size=i.size,t.type=i.type,this.push(cTi.encode(t))}_doDrain(){let i=this._drain;this._drain=Y1u,i()}_predestroy(){let i=yG0(this);if(this._stream)this._stream.destroy(i);while(this._pending.length){let u=this._pending.shift();u.destroy(i),u._continueOpen()}this._doDrain()}_read(i){this._doDrain(),i()}}UG0.exports=function(u){return new BG0(u)};function cCf(i){switch(i&EH.S_IFMT){case EH.S_IFBLK:return"block-device";case EH.S_IFCHR:return"character-device";case EH.S_IFDIR:return"directory";case EH.S_IFIFO:return"fifo";case EH.S_IFLNK:return"symlink"}return"file"}function Y1u(){}function FG0(i,u){if(u&=511,u)i.push(ZG0.subarray(0,512-u))}function ECf(i){return zK.isBuffer(i)?i:zK.from(i)}});var AG0=K(($Cf)=>{$Cf.extract=gG0();$Cf.pack=PG0()});var kG0=K((v3c,xG0)=>{xG0.exports=IG0;function IG0(i,u){if(i&&u)return IG0(i)(u);if(typeof i!=="function")throw TypeError("need wrapper function");return Object.keys(i).forEach(function(f){t[f]=i[f]}),t;function t(){var f=Array(arguments.length);for(var l=0;l<f.length;l++)f[l]=arguments[l];var c=i.apply(this,f),E=f[f.length-1];if(typeof c==="function"&&c!==E)Object.keys(E).forEach(function($){c[$]=E[$]});return c}}});var z1u=K((D3c,Q1u)=>{var GG0=kG0();Q1u.exports=GG0(ETi);Q1u.exports.strict=GG0(SG0);ETi.proto=ETi(function(){Object.defineProperty(Function.prototype,"once",{value:function(){return ETi(this)},configurable:!0}),Object.defineProperty(Function.prototype,"onceStrict",{value:function(){return SG0(this)},configurable:!0})});function ETi(i){var u=function(){if(u.called)return u.value;return u.called=!0,u.value=i.apply(this,arguments)};return u.called=!1,u}function SG0(i){var u=function(){if(u.called)throw Error(u.onceError);return u.called=!0,u.value=i.apply(this,arguments)},t=i.name||"Function wrapped with `once`";return u.onceError=t+" shouldn't be called more than once",u.called=!1,u}});var JG0=K((n3c,KG0)=>{var hCf=z1u(),_Cf=function(){},vCf=global.Bare?queueMicrotask:process.nextTick.bind(process),DCf=function(i){return i.setHeader&&typeof i.abort==="function"},nCf=function(i){return i.stdio&&Array.isArray(i.stdio)&&i.stdio.length===3},jG0=function(i,u,t){if(typeof u==="function")return jG0(i,null,u);if(!u)u={};t=hCf(t||_Cf);var{_writableState:f,_readableState:l}=i,c=u.readable||u.readable!==!1&&i.readable,E=u.writable||u.writable!==!1&&i.writable,$=!1,w=function(){if(!i.writable)d()},d=function(){if(E=!1,!c)t.call(i)},h=function(){if(c=!1,!E)t.call(i)},_=function(N){t.call(i,N?Error("exited with error code: "+N):null)},v=function(N){t.call(i,N)},D=function(){vCf(n)},n=function(){if($)return;if(c&&!(l&&(l.ended&&!l.destroyed)))return t.call(i,Error("premature close"));if(E&&!(f&&(f.ended&&!f.destroyed)))return t.call(i,Error("premature close"))},O=function(){i.req.on("finish",d)};if(DCf(i))if(i.on("complete",d),i.on("abort",D),i.req)O();else i.on("request",O);else if(E&&!f)i.on("end",w),i.on("close",w);if(nCf(i))i.on("exit",_);if(i.on("end",h),i.on("finish",d),u.error!==!1)i.on("error",v);return i.on("close",D),function(){if($=!0,i.removeListener("complete",d),i.removeListener("abort",D),i.removeListener("request",O),i.req)i.req.removeListener("finish",d);i.removeListener("end",w),i.removeListener("close",w),i.removeListener("finish",d),i.removeListener("exit",_),i.removeListener("end",h),i.removeListener("error",v),i.removeListener("close",D)}};KG0.exports=jG0});var WG0=K((g3c,LG0)=>{var gCf=z1u(),OCf=JG0(),$Ti;try{$Ti=Ni("fs")}catch(i){}var Zo=function(){},NCf=typeof process>"u"?!1:/^v?\.0/.test(process.version),wTi=function(i){return typeof i==="function"},yCf=function(i){if(!NCf)return!1;if(!$Ti)return!1;return(i instanceof($Ti.ReadStream||Zo)||i instanceof($Ti.WriteStream||Zo))&&wTi(i.close)},ZCf=function(i){return i.setHeader&&wTi(i.abort)},TCf=function(i,u,t,f){f=gCf(f);var l=!1;i.on("close",function(){l=!0}),OCf(i,{readable:u,writable:t},function(E){if(E)return f(E);l=!0,f()});var c=!1;return function(E){if(l)return;if(c)return;if(c=!0,yCf(i))return i.close(Zo);if(ZCf(i))return i.abort();if(wTi(i.destroy))return i.destroy();f(E||Error("stream was destroyed"))}},XG0=function(i){i()},BCf=function(i,u){return i.pipe(u)},FCf=function(){var i=Array.prototype.slice.call(arguments),u=wTi(i[i.length-1]||Zo)&&i.pop()||Zo;if(Array.isArray(i[0]))i=i[0];if(i.length<2)throw Error("pump requires two streams per minimum");var t,f=i.map(function(l,c){var E=c<i.length-1,$=c>0;return TCf(l,E,$,function(w){if(!t)t=w;if(w)f.forEach(XG0);if(E)return;f.forEach(XG0),u(t)})});return i.reduce(BCf)};LG0.exports=FCf});var qG0=K((ICf)=>{var YG0=AG0(),QG0=WG0(),zG0=Ni("fs"),T1=Ni("path"),To=(global.Bare?global.Bare.platform:process.platform)==="win32";ICf.pack=function(u,t){if(!u)u=".";if(!t)t={};let f=t.fs||zG0,l=t.ignore||t.filter||Bo,c=t.mapStream||CG0,E=ACf(f,t.dereference?f.stat:f.lstat,u,l,t.entries,t.sort),$=t.strict!==!1,w=typeof t.umask==="number"?~t.umask:~HG0(),d=t.pack||YG0.pack(),h=t.finish||Bo,_=t.map||Bo,v=typeof t.dmode==="number"?t.dmode:0,D=typeof t.fmode==="number"?t.fmode:0;if(t.strip)_=MG0(_,t.strip);if(t.readable)v|=parseInt(555,8),D|=parseInt(444,8);if(t.writable)v|=parseInt(333,8),D|=parseInt(222,8);N();function n(y,Z){f.readlink(T1.join(u,y),function(T,B){if(T)return d.destroy(T);Z.linkname=H1u(B),d.entry(Z,N)})}function O(y,Z,T){if(d.destroyed)return;if(y)return d.destroy(y);if(!Z){if(t.finalize!==!1)d.finalize();return h(d)}if(T.isSocket())return N();let B={name:H1u(Z),mode:(T.mode|(T.isDirectory()?v:D))&w,mtime:T.mtime,size:T.size,type:"file",uid:T.uid,gid:T.gid};if(T.isDirectory())return B.size=0,B.type="directory",B=_(B)||B,d.entry(B,N);if(T.isSymbolicLink())return B.size=0,B.type="symlink",B=_(B)||B,n(Z,B);if(B=_(B)||B,!T.isFile()){if($)return d.destroy(Error("unsupported type for "+Z));return N()}let F=d.entry(B,N),A=c(f.createReadStream(T1.join(u,Z),{start:0,end:B.size>0?B.size-1:B.size}),B);A.on("error",function(G){F.destroy(G)}),QG0(A,F)}function N(y){if(y)return d.destroy(y);E(O)}return d};function UCf(i){return i.length?i[i.length-1]:null}function PCf(){return!global.Bare&&process.getuid?process.getuid():-1}function HG0(){return!global.Bare&&process.umask?process.umask():0}ICf.extract=function(u,t){if(!u)u=".";if(!t)t={};u=T1.resolve(u);let f=t.fs||zG0,l=t.ignore||t.filter||Bo,c=t.mapStream||CG0,E=t.chown!==!1&&!To&&PCf()===0,$=t.extract||YG0.extract(),w=[],d=new Date,h=typeof t.umask==="number"?~t.umask:~HG0(),_=t.strict!==!1,v=t.validateSymlinks!==!1,D=t.map||Bo,n=typeof t.dmode==="number"?t.dmode:0,O=typeof t.fmode==="number"?t.fmode:0;if(t.strip)D=MG0(D,t.strip);if(t.readable)n|=parseInt(555,8),O|=parseInt(444,8);if(t.writable)n|=parseInt(333,8),O|=parseInt(222,8);if($.on("entry",N),t.finish)$.on("finish",t.finish);return $;function N(F,A,G){F=D(F)||F,F.name=H1u(F.name);let I=T1.join(u,T1.join("/",F.name));if(l(I,F))return A.resume(),G();let k=T1.join(I,".")===T1.join(u,".")?u:T1.dirname(I);bG0(f,k,T1.join(u,"."),function(li,di){if(li)return G(li);if(!di)return G(Error(k+" is not a valid path"));if(F.type==="directory")return w.push([I,F.mtime]),B(I,{fs:f,own:E,uid:F.uid,gid:F.gid,mode:F.mode},q);B(k,{fs:f,own:E,uid:F.uid,gid:F.gid,mode:493},function(fi){if(fi)return G(fi);switch(F.type){case"file":return Y();case"link":return W();case"symlink":return J()}if(_)return G(Error("unsupported type for "+I+" ("+F.type+")"));A.resume(),G()})});function q(li){if(li)return G(li);Z(I,F,function(di){if(di)return G(di);if(To)return G();T(I,F,G)})}function J(){if(To)return G();f.unlink(I,function(){let li=T1.resolve(T1.dirname(I),F.linkname);if(!r(li)&&v)return G(Error(I+" is not a valid symlink"));RG0(f,li,T1.join(u,"."),function(di,fi){if(di)return G(di);if(!fi&&v)return G(Error(I+" is not a valid symlink"));f.symlink(F.linkname,I,q)})})}function W(){if(To)return G();f.unlink(I,function(){let li=T1.join(u,T1.join("/",F.linkname));f.realpath(li,function(di,fi){if(di||!r(fi))return G(Error(I+" is not a valid hardlink"));f.link(fi,I,function(p){if(p&&p.code==="EPERM"&&t.hardlinkAsFilesFallback)return A=f.createReadStream(fi),Y();q(p)})})})}function r(li){return li===u||li.startsWith(u+T1.sep)}function Y(){let li=f.createWriteStream(I),di=c(A,F);li.on("error",function(fi){di.destroy(fi)}),QG0(di,li,function(fi){if(fi)return G(fi);li.on("close",q)})}}function y(F,A){let G;while((G=UCf(w))&&F.slice(0,G[0].length)!==G[0])w.pop();if(!G)return A();f.utimes(G[0],d,G[1],A)}function Z(F,A,G){if(t.utimes===!1)return G();if(A.type==="directory")return f.utimes(F,d,A.mtime,G);if(A.type==="symlink")return y(F,G);f.utimes(F,d,A.mtime,function(I){if(I)return G(I);y(F,G)})}function T(F,A,G){let I=A.type==="symlink",k=I?f.lchmod:f.chmod,q=I?f.lchown:f.chown;if(!k)return G();let J=(A.mode|(A.type==="directory"?n:O))&h;if(q&&E)q.call(f,F,A.uid,A.gid,W);else W(null);function W(r){if(r)return G(r);if(!k)return G();k.call(f,F,J,G)}}function B(F,A,G){f.stat(F,function(I){if(!I)return G(null);if(I.code!=="ENOENT")return G(I);f.mkdir(F,{mode:A.mode,recursive:!0},function(k,q){if(k)return G(k);T(F,A,G)})})}};function RG0(i,u,t,f){if(u===t)return f(null,!0);if(!u.startsWith(t+T1.sep))return f(null,!1);i.lstat(u,function(l,c){if(l&&l.code!=="ENOENT"&&l.code!=="EPERM")return f(l);if(l||!c.isSymbolicLink())return RG0(i,T1.join(u,".."),t,f);f(null,!1)})}function bG0(i,u,t,f){if(u===t)return f(null,!0);i.lstat(u,function(l,c){if(l&&l.code!=="ENOENT"&&l.code!=="EPERM")return f(l);if(l||c.isDirectory())return bG0(i,T1.join(u,".."),t,f);f(null,!1)})}function Bo(){}function CG0(i){return i}function H1u(i){return To?i.replace(/\\/g,"/").replace(/[:?<>|]/g,"_"):i}function ACf(i,u,t,f,l,c){if(!l)l=["."];let E=l.slice(0);return function(w){if(!E.length)return w(null);let d=E.shift(),h=T1.join(t,d);u.call(i,h,function(_,v){if(_)return w(l.indexOf(d)===-1&&_.code==="ENOENT"?null:_);if(!v.isDirectory())return w(null,d,v);i.readdir(h,function(D,n){if(D)return w(D);if(c)n.sort();for(let O=0;O<n.length;O++)if(!f(T1.join(t,d,n[O])))E.push(T1.join(d,n[O]));w(null,d,v)})})}}function MG0(i,u){return function(t){t.name=t.name.split("/").slice(u).join("/");let f=t.linkname;if(f&&(t.type==="link"||T1.isAbsolute(f)))t.linkname=f.split("/").slice(u).join("/");return i(t)}}});var GCf,SCf;var VG0=g(()=>{P1u();GCf=S(Jk0(),1),SCf=S(qG0(),1)});var dTi=()=>{};var rG0=g(()=>{UZi()});var mG0=g(()=>{aZi();eZi();dTi()});var eG0=()=>{};var aG0=()=>{};var R1u=g(()=>{nk0();F1u();aZi();Zk0();T1u();P1u();Tk0();Bk0();Fk0();Uk0();B1u();Pk0();VG0();dTi();rG0();mG0();eG0();aG0();dTi()});var H1,p1,HK,Fo;var Uo=g(()=>{H1={CLAIM_API_GROUP:"extensions.agents.x-k8s.io",CLAIM_API_VERSION:"v1alpha1",CLAIM_PLURAL:"sandboxclaims",SANDBOX_API_GROUP:"agents.x-k8s.io",SANDBOX_API_VERSION:"v1alpha1",SANDBOX_PLURAL:"sandboxes",POD_NAME_ANNOTATION:"agents.x-k8s.io/pod-name"};p1=class p1 extends Error{cause;constructor(i,u){super(i);if(this.name="SandboxError",this.cause=u,u instanceof Error&&u.stack)this.stack=`${this.stack}
 Caused by: ${u.stack}`}};HK=class HK extends p1{constructor(i,u){super(i,u);this.name="SandboxTimeoutError"}};Fo=class Fo extends p1{constructor(i,u){super(i,u);this.name="SandboxAlreadyExistsError"}}});async function jCf(i){let u=i.getCurrentCluster();if(!u)throw new p1("No active cluster in kubeconfig");let t={};await i.applyToHTTPSOptions(t);let f={},l=t.headers??{};for(let[c,E]of Object.entries(l))if(Array.isArray(E))f[c]=E.join(", ");else if(E!==void 0)f[c]=String(E);if(typeof t.auth==="string"&&!f.Authorization)f.Authorization=`Basic ${Buffer.from(t.auth).toString("base64")}`;return{server:u.server.replace(/\/+$/,""),headers:f,tls:{cert:b1u(t.cert),key:b1u(t.key),ca:b1u(t.ca),rejectUnauthorized:u.skipTLSVerify?!1:void 0}}}function b1u(i){if(i==null)return;if(typeof i==="string")return i;if(Buffer.isBuffer(i))return i.toString("utf8");return String(i)}async function RK(i,u){let t=await jCf(i),f={...t.headers,...u.headers};if(u.method==="PATCH")f["content-type"]=u.patchType==="apply"?"application/apply-patch+yaml":u.patchType==="strategic-merge"?"application/strategic-merge-patch+json":"application/merge-patch+json";else if(u.body!==void 0&&!("content-type"in f))f["content-type"]="application/json";let l={method:u.method,headers:f,body:u.body===void 0?void 0:JSON.stringify(u.body),signal:u.signal,tls:t.tls,...u.stream?{timeout:!1}:{}};return fetch(`${t.server}${u.path}`,l)}async function C1u(i){try{return await i.json()}catch{return null}}async function M1u(i,u){if(i.ok)return;let t=await C1u(i),f=t?.message??`${u} failed: ${i.status} ${i.statusText}`;throw new oG0(i.status,t,f)}async function Po(i,u,t,f,l="none"){try{let c=await RK(i,u);if(c.status===404)return null;if(await M1u(c,t),l==="json")return await c.json();return null}catch(c){throw new p1(f,c)}}async function Ao(i,u,t){let f=`${sG0}/${encodeURIComponent(u)}/${H1.CLAIM_PLURAL}`,l;try{l=await RK(i,{method:"POST",path:f,body:t})}catch(d){let h=d instanceof Error?d.message:String(d);throw console.warn(`[agent-sandbox/client] createSandboxClaim ${t.metadata.name} transport error: ${h}`),new p1(`Failed to create SandboxClaim: ${t.metadata.name} (transport error: ${h})`,d)}if(l.ok)return;let c=await C1u(l),E=c?.reason?` ${c.reason}`:"",$=c?.message??l.statusText,w=`Failed to create SandboxClaim: ${t.metadata.name} (${l.status}${E}: ${$})`;if(console.warn(`[agent-sandbox/client] createSandboxClaim ${t.metadata.name} rejected: status=${l.status} reason=${c?.reason??"<none>"} message=${$}`),l.status===409)throw new Fo(w);throw new p1(w)}async function hTi(i,u,t,f=60000){let l=Date.now()+f,c=500,E;while(!0){let $=await Q8(i,u,t).catch(()=>{return});if(!$)return;if(E=$,Date.now()>=l){let w=E.metadata?.finalizers??[],d=E.metadata?.deletionTimestamp??"<unknown>";throw new HK(`SandboxClaim ${t} still terminating after ${f}ms (deletionTimestamp=${d}, finalizers=[${w.join(", ")}])`)}await O0(500)}}function q1u(i,u){return`${sG0}/${encodeURIComponent(i)}/${H1.CLAIM_PLURAL}/${encodeURIComponent(u)}`}async function pG0(i,u,t,f){await Po(i,{method:"PATCH",path:q1u(u,t),patchType:"merge",body:{spec:{lifecycle:{shutdownPolicy:"Delete",shutdownTime:f}}}},"patchSandboxClaimShutdown",`Failed to patch SandboxClaim shutdownTime: ${t}`)}async function zg(i,u,t){await Po(i,{method:"DELETE",path:q1u(u,t)},"deleteSandboxClaim",`Failed to delete SandboxClaim: ${t}`)}async function Q8(i,u,t){return await Po(i,{method:"GET",path:q1u(u,t)},"getSandboxClaim",`Failed to get SandboxClaim: ${t}`,"json")??void 0}async function iS0(i,u,t,f=60){let l=Date.now()+f*1000,c=200;while(Date.now()<l){let $=(await Q8(i,u,t).catch(()=>{return}))?.status?.sandbox?.name;if($)return $;await O0(200)}throw new HK(`SandboxClaim ${t} did not record an adopted Sandbox (status.sandbox.name) within ${f}s`)}function V1u(i,u){return`${KCf}/${encodeURIComponent(i)}/${fS0}/${encodeURIComponent(u)}`}async function _Ti(i,u,t){let f=new URLSearchParams({fieldManager:cS0,force:"true"}),l=`${V1u(u,t.metadata.name)}?${f}`;try{let c=await RK(i,{method:"PATCH",path:l,patchType:"apply",body:t});await M1u(c,"applyHttpRoute")}catch(c){throw new p1(`Failed to apply HTTPRoute: ${t.metadata.name}`,c)}}async function vTi(i,u,t){await Po(i,{method:"DELETE",path:V1u(u,t)},"deleteHttpRoute",`Failed to delete HTTPRoute: ${t}`)}async function lS0(i,u,t){return await Po(i,{method:"GET",path:V1u(u,t)},"getHttpRoute",`Failed to get HTTPRoute: ${t}`,"json")??void 0}async function ES0(i,u,t,f){let l={apiVersion:"v1",kind:"Service",metadata:{name:t},spec:{ports:[{name:f.name,port:f.port,targetPort:f.targetPort,protocol:f.protocol??"TCP"}]}},c=new URLSearchParams({fieldManager:cS0,force:"true"}),E=`/api/v1/namespaces/${encodeURIComponent(u)}/services/${encodeURIComponent(t)}?${c}`;try{let $=await RK(i,{method:"PATCH",path:E,patchType:"apply",body:l});await M1u($,"ensureServicePort")}catch($){throw new p1(`Failed to apply Service ports: ${t}`,$)}}function DTi(i,u,t,f=180){let l=`/apis/${H1.SANDBOX_API_GROUP}/${H1.SANDBOX_API_VERSION}/namespaces/${encodeURIComponent(u)}/${H1.SANDBOX_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${t}`)}`,{resolve:c,reject:E,promise:$}=Promise.withResolvers(),w=new AbortController,d=!1,h=setTimeout(()=>{if(d)return;d=!0,w.abort(),E(new HK(`Sandbox did not become ready within ${f} seconds`))},f*1000),_=(v)=>{if(d)return;d=!0,clearTimeout(h),w.abort(),v()};return(async()=>{let v;try{v=await RK(i,{method:"GET",path:l,signal:w.signal,headers:{accept:"application/json"},stream:!0})}catch(D){_(()=>E(new p1("Failed to start watch for sandbox readiness",D)));return}if(!v.ok||!v.body){let D=await C1u(v).catch(()=>null);_(()=>E(new p1(`Watch handshake failed (${v.status}): ${D?.message??v.statusText}`)));return}try{for await(let D of r1u(v.body)){if(d)return;if(D.type==="ERROR"){let Z=D.object;_(()=>E(new p1(`Watch stream error while waiting for sandbox: ${Z.message??"unknown"}`)));return}if(D.type!=="ADDED"&&D.type!=="MODIFIED")continue;let n=D.object;if(!n.status?.conditions?.find((Z)=>Z.type==="Ready"&&Z.status==="True"))continue;let N=n.metadata?.name;if(!N){_(()=>E(new p1("Sandbox metadata or name is missing")));return}let y=n.metadata?.annotations?.[H1.POD_NAME_ANNOTATION]??N;_(()=>c({sandboxName:N,podName:y}));return}_(()=>E(new p1("Watch stream closed before sandbox became ready")))}catch(D){if(d)return;if(D instanceof Error&&(D.name==="AbortError"||w.signal.aborted))return;_(()=>E(new p1("Watch stream error while waiting for sandbox",D)))}})(),$}async function*r1u(i){let u=i.getReader(),t=new TextDecoder,f="";try{while(!0){let{value:c,done:E}=await u.read();if(E)break;f+=t.decode(c,{stream:!0});let $;while(($=f.indexOf(`
-`))>=0){let w=f.slice(0,$).trim();if(f=f.slice($+1),!w)continue;yield JSON.parse(w)}}let l=f.trim();if(l)yield JSON.parse(l)}finally{u.releaseLock()}}var oG0,sG0,uS0="gateway.networking.k8s.io",tS0="v1",fS0="httproutes",KCf,Io,cS0="mesh-sandbox-runner";var nTi=g(()=>{y4();Uo();oG0=class oG0 extends Error{status;body;constructor(i,u,t){super(t);this.status=i;this.body=u;this.name="KubeHttpError"}};sG0=`/apis/${H1.CLAIM_API_GROUP}/${H1.CLAIM_API_VERSION}/namespaces`;KCf=`/apis/${uS0}/${tS0}/namespaces`;Io={API_GROUP:uS0,API_VERSION:tS0,PLURAL:fS0}});async function*dS0(i){let u=i.now??(()=>Date.now()),t=u(),f=i.schedulingTimeoutMs??LCf,l={pod:{},sandbox:{},events:{hasPulling:!1,hasPulled:!1},startedAt:t},c=[],E=null,$=!1,w=(Z)=>{if($)return;if(E){let T=E;E=null,T(Z)}else c.push(Z)},d=()=>{if(c.length>0)return Promise.resolve(c.shift());if($)return Promise.resolve(null);return new Promise((Z)=>{E=Z})},h=()=>{if($)return;if($=!0,E){let Z=E;E=null,Z(null)}},_=new AbortController,v=()=>{_.abort(),h()};if(i.signal)if(i.signal.aborted)_.abort(),h();else i.signal.addEventListener("abort",v,{once:!0});let D=Math.max(0,f-(u()-t)),n=setTimeout(()=>w("tick"),D+100),O,N=new Promise((Z)=>{O=Z}),y=Promise.allSettled([WCf(i.kc,i.namespace,i.claimName,_.signal,l,w,u,O),QCf(i.kc,i.namespace,i.claimName,_.signal,l,w),zCf(i.kc,i.namespace,i.claimName,N,_.signal,l,w,u)]);try{let Z=null,T=-1,B=$S0(l,f,u);if(Z=e1u(B),!m1u(B))T=wS0(B);if(yield B,m1u(B))return;while(!$){if(await d()===null)break;let A=$S0(l,f,u);if(m1u(A)){let k=e1u(A);if(k!==Z)Z=k,yield A;return}let G=wS0(A);if(G<T)continue;let I=e1u(A);if(I!==Z)Z=I,T=G,yield A}}finally{if(clearTimeout(n),_.abort(),i.signal)i.signal.removeEventListener("abort",v);h(),await y.catch(()=>{})}}function $S0(i,u,t){let{pod:f,sandbox:l,events:c,startedAt:E}=i;if(l.ready)return{kind:"ready"};let $=f.containerWaitingReason;if($==="ImagePullBackOff"||$==="ErrImagePull")return{kind:"failed",reason:"image-pull-backoff",message:"Sandbox image failed to download. The cluster may be missing pull credentials or the image tag may not exist."};if($==="CrashLoopBackOff")return{kind:"failed",reason:"crash-loop-backoff",message:"Sandbox crashed during startup and is now in CrashLoopBackOff. Check pod logs."};if(!f.scheduled&&c.lastFailedSchedulingAt!==void 0&&t()-E>u)return{kind:"failed",reason:"scheduling-timeout",message:c.failedSchedulingMessage??`Pod could not be scheduled within ${Math.round(u/1000)}s.`};if(f.containerRunning&&!f.containerReady)return{kind:"warming-daemon",since:E};if(c.hasPulling&&!c.hasPulled)return{kind:"pulling-image",since:E};if($==="ContainerCreating"||$==="PodInitializing"||f.scheduled&&!f.containerRunning)return{kind:"starting-container",since:E};if(f.scheduledFalseReason==="Unschedulable"||c.lastFailedSchedulingAt!==void 0&&!f.scheduled)return{kind:"waiting-for-capacity",since:E,message:c.failedSchedulingMessage??f.scheduledFalseMessage,nodeClaim:c.nominatedNodeClaim};return{kind:"claiming",since:E}}function m1u(i){return i.kind==="ready"||i.kind==="failed"}function wS0(i){switch(i.kind){case"claiming":return 0;case"waiting-for-capacity":return 1;case"pulling-image":return 2;case"starting-container":return 3;case"warming-daemon":return 4;case"ready":case"failed":return 99}}function e1u(i){switch(i.kind){case"claiming":case"pulling-image":case"starting-container":case"warming-daemon":return i.kind;case"waiting-for-capacity":return`waiting-for-capacity:${i.message??""}:${i.nodeClaim??""}`;case"ready":return"ready";case"failed":return`failed:${i.reason}:${i.message}`}}async function WCf(i,u,t,f,l,c,E,$){let w=`/api/v1/namespaces/${encodeURIComponent(u)}/pods?watch=true&labelSelector=${encodeURIComponent(`${JCf}=${t}`)}`;return gTi({kc:i,path:w,signal:f,label:`pod/${t}`,onEvent:(d)=>{if(d.type!=="ADDED"&&d.type!=="MODIFIED")return;let h=d.object;if(h.metadata?.name)$(h.metadata.name);YCf(h,l,E),c("pod")}})}function YCf(i,u,t){let l=(i.status?.conditions??[]).find((E)=>E.type==="PodScheduled");if(l?.status==="True")u.pod.scheduled=!0,u.pod.scheduledFalseReason=void 0,u.pod.scheduledFalseMessage=void 0;else if(l?.status==="False")u.pod.scheduled=!1,u.pod.scheduledFalseReason=l.reason,u.pod.scheduledFalseMessage=l.message;let c=(i.status?.containerStatuses??[]).find((E)=>E.name===XCf);if(c)u.pod.containerWaitingReason=c.state?.waiting?.reason,u.pod.containerRunning=!!c.state?.running,u.pod.containerReady=c.ready===!0}async function QCf(i,u,t,f,l,c){let E=`/apis/${H1.CLAIM_API_GROUP}/${H1.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(u)}/${H1.CLAIM_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${t}`)}`;return gTi({kc:i,path:E,signal:f,label:`sandboxclaim/${t}`,onEvent:($)=>{if($.type!=="ADDED"&&$.type!=="MODIFIED")return;let d=$.object.status?.conditions?.find((h)=>h.type==="Ready");if(!d)return;if(d.status==="True")l.sandbox.ready=!0,l.sandbox.notReadyReason=void 0,l.sandbox.notReadyMessage=void 0;else l.sandbox.ready=!1,l.sandbox.notReadyReason=d.reason,l.sandbox.notReadyMessage=d.message;c("sandbox")}})}async function zCf(i,u,t,f,l,c,E,$){let w=await Promise.race([f,new Promise((h)=>{if(l.aborted){h(t);return}l.addEventListener("abort",()=>h(t),{once:!0})})]);if(l.aborted)return;let d=`/api/v1/namespaces/${encodeURIComponent(u)}/events?watch=true&fieldSelector=${encodeURIComponent(`involvedObject.name=${w},involvedObject.kind=Pod`)}`;return gTi({kc:i,path:d,signal:l,label:`events/${t}`,onEvent:(h)=>{if(h.type!=="ADDED"&&h.type!=="MODIFIED")return;let _=h.object,v=_.reason;if(!v)return;switch(v){case"Pulling":c.events.hasPulling=!0;break;case"Pulled":c.events.hasPulling=!0,c.events.hasPulled=!0;break;case"FailedScheduling":c.events.lastFailedSchedulingAt=$(),c.events.failedSchedulingMessage=_.message;break;case"Nominated":{let D=_.message?.match(/nodeclaim\/([\w-]+)/);if(D)c.events.nominatedNodeClaim=D[1];break}default:return}E("event")}})}async function hS0(i){let{kc:u,namespace:t,labelSelector:f,signal:l,onDelete:c}=i,E=`/apis/${H1.CLAIM_API_GROUP}/${H1.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(t)}/${H1.CLAIM_PLURAL}?watch=true&labelSelector=${encodeURIComponent(f)}`;return gTi({kc:u,path:E,signal:l,label:"sandboxclaim-reaper",onEvent:($)=>{if($.type!=="DELETED")return;let w=$.object.metadata?.name;if(w)c(w)}})}async function gTi(i){let{kc:u,path:t,signal:f,label:l,onEvent:c}=i,E=0;while(!f.aborted){try{let w=await RK(u,{method:"GET",path:t,signal:f,headers:{accept:"application/json"},stream:!0});if(!w.ok||!w.body){try{await w.body?.cancel()}catch{}if(w.status===401||w.status===403){console.warn(`[lifecycle-watcher] ${l} stopped: watch denied (${w.status} ${w.statusText}). `+"The kubeconfig in use cannot watch SandboxClaims \u2014 if you are running locally, "+"this provider should not be active (check STUDIO_SANDBOX_PROVIDER / your sandbox preference).");return}throw Error(`watch handshake failed: ${w.status} ${w.statusText}`)}E=0;for await(let d of r1u(w.body)){if(f.aborted)return;try{c(d)}catch(h){console.warn(`[lifecycle-watcher] ${l} onEvent threw: ${h instanceof Error?h.message:String(h)}`)}}}catch(w){if(f.aborted)return;let d=w instanceof Error?w.message:String(w);console.warn(`[lifecycle-watcher] ${l} watch ended: ${d}`)}if(f.aborted)return;let $=c6(5000,250,E,2,0);E+=1,await O0($,{signal:f}).catch(()=>{})}}var JCf="studio.decocms.com/sandbox-handle",XCf="sandbox",LCf=300000;var _S0=g(()=>{y4();Uo();nTi()});async function vS0(i,u,t){let f=new Map;for(let l of i){let c=u(l);if(!c)continue;let E=f.get(c);if(E)E.push(l);else f.set(c,[l])}await Promise.allSettled([...f.values()].map(async(l)=>{for(let c of l)await t(c).catch(()=>{})}))}import{createHash as HCf,randomBytes as RCf,randomUUID as bCf}from"crypto";import*as OS0 from"net";import{PassThrough as CCf}from"stream";function MCf(i){if(i instanceof Error)return i.message;if(i&&typeof i==="object"){let u=i;if(u.error instanceof Error)return u.error.message;if(typeof u.message==="string"&&u.message)return u.message}return String(i)}class ucu{kind=Tw;records=new Map;inflight=new Shi;stateStore;previewUrlPattern;kubeConfig;portForward;namespace;sandboxTemplateName;envName;tokenGenerator;idleTtlMs;metrics;previewGateway;sentinelToken;mintCloneUrl;closed=!1;claimWatchAbort=new AbortController;constructor(i={}){this.stateStore=i.stateStore??null,this.previewUrlPattern=i.previewUrlPattern??null,this.kubeConfig=i.kubeConfig??tMf(),this.portForward=new A1u(this.kubeConfig),this.namespace=i.namespace??qCf,this.sandboxTemplateName=i.sandboxTemplateName??VCf,this.envName=wMf(i.envName),this.tokenGenerator=i.tokenGenerator??(()=>RCf(mCf).toString("hex")),this.idleTtlMs=i.idleTtlMs??aCf,this.metrics=i.meter?uMf(i.meter):null,this.previewGateway=i.previewGateway&&i.previewUrlPattern?{...i.previewGateway}:null;let u=i.sentinelToken?.trim()??"";this.sentinelToken=u.length>0?u:null,this.mintCloneUrl=i.mintCloneUrl,this.startClaimReaper(),this.startCredentialRefresher()}startClaimReaper(){let i=["app.kubernetes.io/managed-by=studio","app.kubernetes.io/name=studio-sandbox",...this.envName?[`${Y3.env}=${this.envName}`]:[]].join(",");hS0({kc:this.kubeConfig,namespace:this.namespace,labelSelector:i,signal:this.claimWatchAbort.signal,onDelete:(u)=>this.invalidateRecord(u)})}async ensure(i,u={}){let t=Pg(i,u.branch??u.repo?.branch??null);return this.inflight.run(t,()=>jhi(this.stateStore,i,Tw,(f)=>this.ensureLocked(i,t,u,f)))}async delete(i){let u=await this.getRecord(i);if(this.records.delete(i),u)this.closeForwarder(u.daemonForward),this.metrics?.active.add(-1,p1u(u.tenant));if(await this.deleteHttpRouteIfManaged(i).catch((t)=>{console.warn(`[${ic}] HTTPRoute delete failed for ${i}: ${t instanceof Error?t.message:String(t)}`)}),await zg(this.kubeConfig,this.namespace,i),this.stateStore)if(u)await this.stateStore.delete(u.id,Tw);else await this.stateStore.deleteByHandle(Tw,i)}async alive(i){return await Q8(this.kubeConfig,this.namespace,i)!==void 0}watchClaimLifecycle(i,u){return dS0({kc:this.kubeConfig,namespace:this.namespace,claimName:i,signal:u})}async getPreviewUrl(i){let u=await this.getRecord(i);if(!u)return null;return this.composePreviewUrl(u)}async proxyDaemonRequest(i,u,t){let f=await this.getRecord(i);if(!f&&this.previewUrlPattern&&this.stateStore){let w=await this.stateStore.getByHandle(Tw,i),d=w?.state,h=d?.token;if(w&&h){let v=`http://${d?.adoptedSandboxName??i}.${this.namespace}.svc.cluster.local:${Hg}`;try{let D=await FM(v,h,u,t);if(D.status!==404)return D;try{await D.body?.cancel()}catch{}}catch{}}}if(!f)f=await this.resurrectByHandle(i);if(!f)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let l=f,c=performance.now(),E=0,$=!(t.body instanceof ReadableStream);try{let w=await FM(f.daemonUrl,f.token,u,t);if(w.status===401&&$){this.invalidateRecord(i);let d=await this.getRecord(i).catch(()=>null)??await this.resurrectByHandle(i).catch(()=>null);if(d)l=d,w=await FM(d.daemonUrl,d.token,u,t)}return E=w.status,w}catch(w){if(!$)throw w;this.invalidateRecord(i);let d=await this.resurrectByHandle(i)??await this.getRecord(i).catch(()=>null);if(!d)throw w;l=d;let h=await FM(d.daemonUrl,d.token,u,t);return E=h.status,h}finally{this.recordProxyDuration("daemon",E,l,performance.now()-c)}}async adoptLiveClaim(i,u){if(this.records.has(u))return!0;let t=await Q8(this.kubeConfig,this.namespace,u).catch(()=>{return});if(!t||t.metadata?.deletionTimestamp)return!1;return await this.inflight.run(u,async()=>{let l=this.records.get(u);if(l)return this.toSandbox(l);let c=await this.adopt(i,u,t);if(!c)throw Error(`cannot adopt live claim ${u}`);return jhi(this.stateStore,i,Tw,(E)=>this.finish(c,E,!0,!0,"adopt"))}).catch(()=>null)!=null}async resolvePreviewUpstreamUrl(i){if(this.previewUrlPattern)return`http://${await this.resolveServiceNameForHandle(i)}.${this.namespace}.svc.cluster.local:${Hg}`;let u=await this.getRecord(i);if(u)return u.daemonUrl;let t=await this.resurrectByHandle(i);return t?t.daemonUrl:null}async resolveServiceNameForHandle(i){let u=this.records.get(i);if(u)return u.adoptedSandboxName;if(this.stateStore){let f=(await this.stateStore.getByHandle(Tw,i).catch(()=>null))?.state?.adoptedSandboxName;if(f)return f}return i}async proxyPreviewRequest(i,u){let t=performance.now(),f=this.records.get(i)??null,l=0;try{let c=await this.resolvePreviewUpstreamUrl(i);if(!c){l=404;let n=o1u(404,{error:"sandbox not found"});return n.headers.set(CK,"1"),n}let E=new URL(u.url);if((E.pathname==="/_sandbox"||E.pathname.startsWith("/_sandbox/")||E.pathname==="/_decopilot_vm"||E.pathname.startsWith("/_decopilot_vm/"))&&u.method!=="GET")return l=404,o1u(404,{error:"not found"});let w=(n)=>`${n}${E.pathname}${E.search}`,d=new Headers(u.headers);for(let n of pCf)d.delete(n);let h=u.method!=="GET"&&u.method!=="HEAD",_={method:u.method,headers:d,body:h?u.body:void 0,redirect:"manual",signal:u.signal,duplex:h?"half":void 0},v;try{v=await fetch(w(c),_)}catch(n){let O=`${c}${E.pathname}`;if(console.warn(`[${ic}] preview fetch to ${O} failed: ${n instanceof Error?n.message:String(n)}`),u.method==="GET"||u.method==="HEAD"){if(this.invalidateRecord(i),await this.resurrectByHandle(i).catch(()=>null)){let Z=await this.resolvePreviewUpstreamUrl(i);if(Z)try{v=await fetch(w(Z),_);let T=new Headers;for(let[B,F]of v.headers.entries())if(!DS0.includes(B.toLowerCase()))T.set(B,F);return l=v.status,new Response(v.body,{status:v.status,statusText:v.statusText,headers:T})}catch(T){console.warn(`[${ic}] preview fetch retry to ${O} failed: ${T instanceof Error?T.message:String(T)}`)}}}else this.invalidateRecord(i);l=502;let N=o1u(502,{error:"sandbox daemon unreachable"});return N.headers.set(CK,"1"),N}let D=new Headers;for(let[n,O]of v.headers.entries())if(!DS0.includes(n.toLowerCase()))D.set(n,O);return l=v.status,new Response(v.body,{status:v.status,statusText:v.statusText,headers:D})}finally{this.recordProxyDuration("preview",l,f,performance.now()-t,i)}}async ensureLocked(i,u,t,f){if(t.image)console.warn(`[${ic}] opts.image ignored (template ${this.sandboxTemplateName} pins image): got ${t.image}`);if(f){let E=await f.get(i,Tw);if(E){let $=await this.rehydrate(i,u,E);if($)return await this.refreshDaemonGitCredential($,t),this.finish($,f,!1,!0,"resume");await f.delete(i,Tw)}}let l=await Q8(this.kubeConfig,this.namespace,u).catch(()=>{return});if(l)if(l.metadata?.deletionTimestamp)await hTi(this.kubeConfig,this.namespace,u).catch((E)=>{console.warn(`[${ic}] wait for terminating claim ${u} failed: ${E instanceof Error?E.message:String(E)}`)});else{let E=await this.adopt(i,u,l).catch(($)=>{return console.warn(`[${ic}] adopt ${u} failed, recreating: ${$ instanceof Error?$.message:String($)}`),null});if(E)return await this.refreshDaemonGitCredential(E,t),this.finish(E,f,!0,!0,"adopt");await zg(this.kubeConfig,this.namespace,u).catch(()=>{}),await hTi(this.kubeConfig,this.namespace,u).catch(($)=>{console.warn(`[${ic}] wait for deleted claim ${u} failed: ${$ instanceof Error?$.message:String($)}`)})}let c=await this.provision(i,u,t);return this.finish(c,f,!0,!1,"fresh")}async finish(i,u,t,f,l){let c=this.records.get(i.handle),E=c!==void 0;if(c&&c.daemonForward!==i.daemonForward)this.closeForwarder(c.daemonForward);if(this.records.set(i.handle,i),t)await this.persist(u,i);if(f)await pG0(this.kubeConfig,this.namespace,i.handle,this.computeShutdownTime()).catch(($)=>console.warn(`[${ic}] TTL refresh failed for ${i.handle}: ${$ instanceof Error?$.message:String($)}`));if(this.metrics){let $=p1u(i.tenant);if(this.metrics.ensureOutcome.add(1,{...$,outcome:l}),!E)this.metrics.active.add(1,$)}return this.toSandbox(i)}buildEnvMap(i,u){let t={},f=[];for(let[l,c]of Object.entries(i.env??{}))if(eCf.has(l))f.push(l);else t[l]=c;if(f.length>0)console.warn(`[${ic}] opts.env keys overlap reserved bootstrap names and were dropped: ${f.join(",")}`);return{...t,DAEMON_TOKEN:u.token,DAEMON_BOOT_ID:u.daemonBootId,APP_ROOT:u.workdir,PROXY_PORT:String(Hg)}}buildClaim(i,u,t){let f=this.sentinelToken!==null,l=f?[]:Object.entries(this.buildEnvMap(u,t)).sort(([$],[w])=>$<w?-1:$>w?1:0).map(([$,w])=>({name:$,value:w})),c=_Mf(u),E=Object.keys(c).length>0;return{apiVersion:`${H1.CLAIM_API_GROUP}/${H1.CLAIM_API_VERSION}`,kind:"SandboxClaim",metadata:{name:i,namespace:this.namespace,labels:{"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[Y3.env]:this.envName}:{},...s1u(u.tenant)},...E?{annotations:c}:{}},spec:{sandboxTemplateRef:{name:this.sandboxTemplateName},additionalPodMetadata:{labels:s1u(u.tenant,{[Y3.role]:"claimed",[Y3.sandboxHandle]:i,...this.envName?{[Y3.env]:this.envName}:{}}),...E?{annotations:c}:{}},env:l,warmpool:f?"default":"none",lifecycle:{shutdownPolicy:"Delete",shutdownTime:this.computeShutdownTime()}}}}async provision(i,u,t){let f=this.tokenGenerator(),l=bCf(),c=a1u,E=this.buildClaim(u,t,{token:f,daemonBootId:l,workdir:c});try{await Ao(this.kubeConfig,this.namespace,E)}catch(v){if(v instanceof Fo)await hTi(this.kubeConfig,this.namespace,u),await Ao(this.kubeConfig,this.namespace,E);else throw v}let $;try{$=await iS0(this.kubeConfig,this.namespace,u),await DTi(this.kubeConfig,this.namespace,$)}catch(v){throw await zg(this.kubeConfig,this.namespace,u).catch(()=>{}),v}try{await this.ensureServicePortForAdoptedSandbox($),await this.ensureHttpRouteForHandle(u,$,t.tenant??null)}catch(v){throw await zg(this.kubeConfig,this.namespace,u).catch(()=>{}),v}let w=await this.openForwarder($,Hg,u),d=`http://127.0.0.1:${w.localPort}`,h=this.workloadConfigPayload(t),_=l;try{if(await Kli(d),this.sentinelToken!==null){let v=await jli(d);if(v)_=v.bootId;await $2(d,this.sentinelToken,h??{},{rotateToken:f})}else if(h)await $2(d,f,h);if(t.orgFsConfigJson)await jbu(d,f,t.orgFsConfigJson).catch((v)=>console.warn("[org-fs] sidecar config relay failed",v))}catch(v){throw this.closeForwarder(w),await this.deleteHttpRouteIfManaged(u).catch(()=>{}),await zg(this.kubeConfig,this.namespace,u).catch(()=>{}),v}return{id:i,handle:u,adoptedSandboxName:$,token:f,workdir:c,daemonUrl:d,daemonForward:w,workload:t.workload??null,daemonBootId:_,tenant:t.tenant??null,ensureOpts:DMf(t)}}workloadConfigPayload(i){return J4u({runtime:i?.workload?.runtime??"node",packageManager:i?.workload?.packageManager?{name:i.workload.packageManager,...i.workload.packageManagerPath?{path:i.workload.packageManagerPath}:{}}:null,repo:i?.repo??null,port:i?.workload?.devPort??rCf,tenant:i?.tenant??void 0})}async refreshDaemonGitCredential(i,u){let t=X4u(u);if(!t)return;try{await $2(i.daemonUrl,i.token,t)}catch(f){console.warn(`[${ic}] git credential refresh failed for ${i.handle}: ${f instanceof Error?f.message:String(f)}`)}}async withFreshCloneUrl(i,u){if(!this.mintCloneUrl)return i;try{let t=await this.mintCloneUrl(i,u!==void 0?{bufferMs:u}:void 0);return t?{...i,cloneUrl:t}:i}catch(t){return console.warn(`[${ic}] clone credential re-mint failed: ${t instanceof Error?t.message:String(t)}`),i}}startCredentialRefresher(){if(!this.mintCloneUrl)return;let{signal:i}=this.claimWatchAbort;(async()=>{while(!i.aborted){if(await O0(oCf,{signal:i}).catch(()=>{}),i.aborted)break;try{await this.refreshAllGitCredentials()}catch(u){console.warn(`[${ic}] periodic credential refresh failed: ${u instanceof Error?u.message:String(u)}`)}}})()}async refreshAllGitCredentials(){await vS0(this.records.values(),(i)=>i.ensureOpts?.repo?.connectionId,async(i)=>{if(this.claimWatchAbort.signal.aborted)return;let u=i.ensureOpts?.repo;if(!u)return;let t=await this.withFreshCloneUrl(u,sCf);await this.refreshDaemonGitCredential(i,{...i.ensureOpts,repo:t}),i.ensureOpts={...i.ensureOpts,repo:t}})}async rebootstrapDaemon(i,u,t){if(this.sentinelToken===null)return!1;let f=this.workloadConfigPayload(t)??{};try{return await $2(i,this.sentinelToken,f,{rotateToken:u}),!0}catch(l){if(l instanceof Sli&&l.status===401)try{return await $2(i,u,f,{rotateToken:u}),!0}catch(c){return console.warn(`[${ic}] re-bootstrap retry with claim token failed: ${c instanceof Error?c.message:String(c)}`),!1}return console.warn(`[${ic}] re-bootstrap failed: ${l instanceof Error?l.message:String(l)}`),!1}}async ensureServicePortForAdoptedSandbox(i){if(!this.previewGateway||!this.previewUrlPattern)return;await ES0(this.kubeConfig,this.namespace,i,{name:"daemon",port:Hg,targetPort:Hg})}async ensureHttpRouteForHandle(i,u,t){if(!this.previewGateway||!this.previewUrlPattern)return;let f=nMf(this.previewUrlPattern,i);if(!f)throw new p1(`Unable to derive preview hostname for ${i} from pattern: ${this.previewUrlPattern}`);let l={apiVersion:`${Io.API_GROUP}/${Io.API_VERSION}`,kind:"HTTPRoute",metadata:{name:i,namespace:this.namespace,labels:s1u(t??void 0,{[Y3.role]:"claimed",[Y3.sandboxHandle]:i,"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[Y3.env]:this.envName}:{}})},spec:{parentRefs:[{kind:"Gateway",group:"gateway.networking.k8s.io",name:this.previewGateway.name,namespace:this.previewGateway.namespace}],hostnames:[f],rules:[{backendRefs:[{group:"",kind:"Service",name:u,port:Hg}]}]}};await _Ti(this.kubeConfig,this.namespace,l)}async deleteHttpRouteIfManaged(i){if(!this.previewGateway)return;await vTi(this.kubeConfig,this.namespace,i)}async rehydrate(i,u,t){let f=t.state;if(!f.adoptedSandboxName&&!f.podName||!f.token)return null;let l=await Q8(this.kubeConfig,this.namespace,u).catch(()=>{return});if(!l||!nS0(l))return null;let c=l.status?.sandbox?.name??f.adoptedSandboxName??f.podName??u,E=await this.openAndProbeDaemon(c,u);if(!E)return null;if(f.daemonBootId&&f.daemonBootId!==E.bootId){if(this.sentinelToken!==null){let $=f.ensureOpts?.repo?{...f.ensureOpts,repo:await this.withFreshCloneUrl(f.ensureOpts.repo)}:f.ensureOpts??null;if(!await this.rebootstrapDaemon(E.daemonUrl,f.token,$))return this.closeForwarder(E.daemonForward),null}else console.warn(`[${ic}] daemon restart detected (handle=${u}): stored bootId=${f.daemonBootId} live bootId=${E.bootId}`);await this.stateStore?.put(i,Tw,{handle:u,state:{...f,daemonBootId:E.bootId}}).catch(($)=>console.warn(`[${ic}] bootId persist failed for ${u}: ${$ instanceof Error?$.message:String($)}`))}return{id:i,handle:u,adoptedSandboxName:c,token:f.token,workdir:f.workdir??a1u,daemonUrl:E.daemonUrl,daemonForward:E.daemonForward,workload:f.workload??null,daemonBootId:E.bootId,tenant:f.tenant??null,ensureOpts:f.ensureOpts??null}}async adopt(i,u,t){if(!nS0(t))return null;let f=t.status?.sandbox?.name??u;if(this.sentinelToken!==null)return null;let l=fMf(t);if(!l)return null;let c=await this.openAndProbeDaemon(f,u);if(!c)return null;let E=vMf(t);if(this.previewGateway)await this.ensureServicePortForAdoptedSandbox(f).catch(($)=>{console.warn(`[${ic}] Service port backfill failed for ${u}: ${$ instanceof Error?$.message:String($)}`)}),await this.ensureHttpRouteForHandle(u,f,E).catch(($)=>{console.warn(`[${ic}] HTTPRoute backfill failed for ${u}: ${$ instanceof Error?$.message:String($)}`)});return{id:i,handle:u,adoptedSandboxName:f,token:l,workdir:a1u,daemonUrl:c.daemonUrl,daemonForward:c.daemonForward,workload:null,daemonBootId:c.bootId,tenant:E,ensureOpts:null}}async openAndProbeDaemon(i,u){let t=await this.openForwarder(i,Hg,u).catch(()=>null);if(!t)return null;let f=`http://127.0.0.1:${t.localPort}`,l=await jli(f);if(!l)return this.closeForwarder(t),null;return{daemonForward:t,daemonUrl:f,bootId:l.bootId}}async getRecord(i){let u=this.records.get(i);if(u)return u;if(!this.stateStore)return null;let t=await this.stateStore.getByHandle(Tw,i);if(!t)return null;let f=await this.rehydrate(t.id,i,t);if(f)this.records.set(i,f);return f}async resurrectByHandle(i){if(!this.stateStore)return null;let u=await this.stateStore.getByHandle(Tw,i);if(!u)return null;let t=u.state.ensureOpts;if(!t)return null;let f=t.repo?{...t,repo:await this.withFreshCloneUrl(t.repo)}:t;return await this.ensure(u.id,f),this.records.get(i)??null}invalidateRecord(i){let u=this.records.get(i);if(!u)return;this.records.delete(i),this.closeForwarder(u.daemonForward)}recordProxyDuration(i,u,t,f,l){if(!this.metrics)return;this.metrics.proxyDurationMs.record(f,{...p1u(t?.tenant??null),source:i,sandbox_handle:t?.handle??l??"",status_code:u||0})}composePreviewUrl(i){if(this.previewUrlPattern)return Khi(this.previewUrlPattern,i.handle);return`http://127.0.0.1:${i.daemonForward.localPort}/`}toSandbox(i){return{handle:i.handle,workdir:i.workdir,previewUrl:this.composePreviewUrl(i)}}async persist(i,u){if(!i)return;let t={adoptedSandboxName:u.adoptedSandboxName,token:u.token,workdir:u.workdir,workload:u.workload,daemonBootId:u.daemonBootId,tenant:u.tenant,...u.ensureOpts?{ensureOpts:u.ensureOpts}:{}};await i.put(u.id,Tw,{handle:u.handle,state:t})}computeShutdownTime(){return new Date(Date.now()+this.idleTtlMs).toISOString()}openForwarder(i,u,t=i){let f=lMf(t,u);return new Promise((l,c)=>{let E=($,w)=>{let d=OS0.createServer((h)=>this.handleForwardedConnection(h,i,u,t));d.once("error",(h)=>{if(h.code==="EADDRINUSE"&&w<iMf){try{d.close()}catch{}let _=icu+($-icu+1)%NS0;E(_,w+1);return}c(h)}),d.listen($,"127.0.0.1",()=>{let h=d.address();if(!h||typeof h==="string"){d.close(),c(Error("port-forward listener failed to bind"));return}l({server:d,localPort:h.port})})};E(f,0)})}handleForwardedConnection(i,u,t,f){let l=new CCf,c=null,E=!1,$=()=>{if(E)return;if(E=!0,l.destroy(),c)try{c.close()}catch{}if(!i.destroyed)i.destroy()};i.pipe(l),i.on("error",$),i.on("close",$),this.portForward.portForward(this.namespace,u,[t],i,null,l).then((w)=>{let d=typeof w==="function"?w():w;if(!d){$();return}if(c=d,c.on("close",$),c.on("error",()=>{this.invalidateRecord(f),$()}),E)try{c.close()}catch{}}).catch((w)=>{console.warn(`[${ic}] port-forward to ${u}:${t} failed: ${MCf(w)}`),this.invalidateRecord(f),$()})}closeForwarder(i){i.server.close((u)=>{if(u)console.warn(`[${ic}] port-forward close on :${i.localPort} errored: ${u instanceof Error?u.message:String(u)}`)})}close(){if(this.closed)return;this.closed=!0,this.claimWatchAbort.abort();for(let i of this.records.values())this.closeForwarder(i.daemonForward);this.records.clear()}}function uMf(i){return{active:i.createUpDownCounter("studio.sandbox.active",{description:"Active sandbox count, by runner kind and owning org. Cross-checks the cAdvisor-derived count from the cluster \u2014 divergence between the two indicates orphaned claims (mesh deleted but K8s didn't reap) or unattributed pods.",unit:"{sandbox}"}),ensureOutcome:i.createCounter("studio.sandbox.ensure.outcome",{description:"Outcome of each ensure() call: fresh provision, resume from state-store after restart, or adopt of a cluster-side claim mesh didn't know about. Cold-start ratio is the primary input for warm-pool sizing.",unit:"{call}"}),proxyDurationMs:i.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of mesh-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"})}}function tMf(){let i=new tH;return i.loadFromDefault(),i}function nS0(i){return Boolean(i.status?.conditions?.some((u)=>u.type==="Ready"&&u.status==="True"))}function fMf(i){let u=i.spec?.env;if(!u)return null;for(let t of u)if(t.name==="DAEMON_TOKEN"&&t.value)return t.value;return null}function lMf(i,u){let t=HCf("sha256").update(`${i}:${u}`).digest();return icu+t.readUInt32BE(0)%NS0}function o1u(i,u){return new Response(JSON.stringify(u),{status:i,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function gS0(i){let u=i.slice(0,EMf);return cMf.test(u)?u:""}function wMf(i){if(i===void 0)return null;let u=i.trim();if(u==="")return null;if(!$Mf.test(u))throw Error(`AgentSandboxProvider: envName=${JSON.stringify(u)} is not a valid DNS-label-safe environment name (lowercase alphanumeric or '-', starts with a letter, ends alphanumeric, \u226432 chars). Mesh sets this from STUDIO_ENV; check the studio chart's configMap.`);return u}function s1u(i,u={}){let t={...u};if(i){let f=gS0(i.orgId),l=gS0(i.userId);if(f)t[Y3.orgId]=f;if(l)t[Y3.userId]=l}return t}function bK(i){let u="";for(let t of i){let f=t.codePointAt(0)??0;u+=f<32||f===127?" ":t}return u.slice(0,dMf)}function hMf(i){try{let u=new URL(i);return u.username="",u.password="",u.toString()}catch{return""}}function _Mf(i){let u={},t=i.tenant;if(t?.orgSlug)u[x_.orgSlug]=bK(t.orgSlug);if(t?.orgName)u[x_.orgName]=bK(t.orgName);if(t?.userEmail)u[x_.userEmail]=bK(t.userEmail);if(t?.userName)u[x_.userName]=bK(t.userName);let f=i.repo;if(f){if(f.displayName)u[x_.gitRepo]=bK(f.displayName);let l=hMf(f.cloneUrl);if(l)u[x_.gitRepoUrl]=bK(l);let c=i.branch??f.branch;if(c)u[x_.gitBranch]=bK(c)}return u}function vMf(i){let u=i.metadata?.labels;if(!u)return null;let t=u[Y3.orgId],f=u[Y3.userId];if(!t||!f)return null;let l=i.metadata?.annotations??{};return{orgId:t,userId:f,orgSlug:l[x_.orgSlug],orgName:l[x_.orgName],userEmail:l[x_.userEmail],userName:l[x_.userName]}}function p1u(i){return{org_id:i?.orgId??"",user_id:i?.userId??"",runner_kind:Tw}}function DMf(i){let u={};if(i.repo)u.repo=i.repo;if(i.workload)u.workload=i.workload;if(i.env&&Object.keys(i.env).length>0)u.env=i.env;if(i.tenant)u.tenant=i.tenant;return Object.keys(u).length>0?u:null}function nMf(i,u){try{return new URL(Khi(i,u)).hostname||null}catch{return null}}var Tw="agent-sandbox",ic="AgentSandboxProvider",CK="x-sandbox-preview-not-ready",qCf="agent-sandbox-system",VCf="studio-sandbox",Hg=9000,rCf=3000,a1u="/app",mCf=32,eCf,aCf=900000,oCf=900000,sCf=1800000,pCf,DS0,icu=40000,NS0=1e4,iMf=256,Y3,x_,cMf,EMf=63,$Mf,dMf=253;var yS0=g(()=>{y4();R1u();vzi();Jhi();nTi();Uo();_S0();eCf=new Set(["DAEMON_TOKEN","DAEMON_BOOT_ID","APP_ROOT","PROXY_PORT"]),pCf=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length","upgrade"],DS0=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];Y3={role:"studio.decocms.com/role",sandboxHandle:"studio.decocms.com/sandbox-handle",orgId:"studio.decocms.com/org-id",userId:"studio.decocms.com/user-id",env:"studio.decocms.com/env"},x_={orgSlug:"studio.decocms.com/org-slug",orgName:"studio.decocms.com/org-name",userEmail:"studio.decocms.com/user-email",userName:"studio.decocms.com/user-name",gitRepo:"studio.decocms.com/git-repo",gitRepoUrl:"studio.decocms.com/git-repo-url",gitBranch:"studio.decocms.com/git-branch"},cMf=/^([A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?)?$/;$Mf=/^[a-z]([a-z0-9-]{0,30}[a-z0-9])?$/});var ZS0={};Xi(ZS0,{waitForSandboxReady:()=>DTi,getSandboxClaim:()=>Q8,getHttpRoute:()=>lS0,deleteSandboxClaim:()=>zg,deleteHttpRoute:()=>vTi,createSandboxClaim:()=>Ao,applyHttpRoute:()=>_Ti,SandboxTimeoutError:()=>HK,SandboxError:()=>p1,PREVIEW_NOT_READY_HEADER:()=>CK,KubeConfig:()=>tH,K8S_CONSTANTS:()=>H1,HTTPROUTE_CONSTANTS:()=>Io,AgentSandboxProvider:()=>ucu});var tcu=g(()=>{R1u();Uo();nTi();yS0()});class OTi{kind=Rg;userSub;dispatch;stateStore;records=new Map;constructor(i){if(!i.userSub)throw Error("DesktopSandboxProvider requires userSub");if(!i.dispatch)throw Error("DesktopSandboxProvider requires dispatch");this.userSub=i.userSub,this.dispatch=i.dispatch,this.stateStore=i.stateStore??null}async ensure(i,u={}){let t=u.branch??u.repo?.branch,f=Pg(i,t),l=this.records.get(f);if(l){if(await this.probeHealth(f))return this.toSandbox(l);if(this.records.delete(f),this.stateStore)await this.stateStore.deleteByHandle(Rg,f).catch(()=>{})}else if(this.stateStore){let v=(await this.stateStore.getByHandle(Rg,f))?.state,D=v?.sandboxApiUrl;if(D){if(await this.probeHealth(f)){let n={handle:f,sandboxApiUrl:D,previewUrl:v?.previewUrl??D};return this.records.set(f,n),this.toSandbox(n)}await this.stateStore.deleteByHandle(Rg,f).catch(()=>{})}}let c=_h({userName:u.tenant?.userName,userEmail:u.tenant?.userEmail}),E=JSON.stringify({handle:f,repo:u.repo,branch:t,...u.workload?{workload:u.workload}:{},...c?{operator:c}:{},...u.offloadAllowedHosts?{offloadAllowedHosts:u.offloadAllowedHosts}:{},...u.offloadAllowSameHostDev!==void 0?{offloadAllowSameHostDev:u.offloadAllowSameHostDev}:{},...u.orgFsConfigJson?{orgFsConfigJson:u.orgFsConfigJson}:{}}),$=await this.dispatchJson("POST","/api/sandboxes",E),w=JSON.parse($);if(typeof w.sandboxApiUrl!=="string")throw Error("desktop ensure: daemon did not return a sandboxApiUrl string");let d=typeof w.previewUrl==="string"?w.previewUrl:w.sandboxApiUrl,h={handle:f,sandboxApiUrl:w.sandboxApiUrl,previewUrl:d};if(this.records.set(f,h),this.stateStore)await this.stateStore.put(i,Rg,{handle:f,state:{handle:f,sandboxApiUrl:w.sandboxApiUrl,previewUrl:d}});return this.toSandbox(h)}async proxyDaemonRequest(i,u,t){let f=u.startsWith("/")?u:`/${u}`,l=f.startsWith("/_sandbox/")?f.slice(9):f,c=`/_sandbox/${encodeURIComponent(i)}${l}`,E=new Headers(t.headers);for(let y of["host","cookie","connection","keep-alive","transfer-encoding","upgrade","authorization"])E.delete(y);let $={};E.forEach((y,Z)=>{$[Z]=y});let w;if(t.body!=null)w=await OMf(t.body);let h=this.dispatch(this.userSub,{method:t.method,path:c,headers:$,body:w},{signal:t.signal})[Symbol.asyncIterator](),_=gMf(),v=200,D={"content-type":"application/octet-stream"},n=[];try{while(!0){let y=await h.next();if(y.done)break;let Z=y.value;if(Z.headers){v=Z.headers.status,D=Z.headers.headers;break}if(Z.data!=null){let T=_.push(Z.data);if(T.length)n.push(T)}}}catch(y){let Z=y instanceof Error?y.message:"dispatch error";return new Response(JSON.stringify({error:Z}),{status:502,headers:{"content-type":"application/json"}})}let O=!1,N=new ReadableStream({async start(y){for(let Z of n)y.enqueue(Z)},async pull(y){try{while(!0){let Z=await h.next();if(O)return;if(Z.done){let B=_.flush();if(B.length)y.enqueue(B);y.close();return}let T=Z.value;if(T.data!=null){let B=_.push(T.data);if(B.length){y.enqueue(B);return}}}}catch(Z){if(!O)y.error(Z)}},cancel(){O=!0,h.return?.()}});return new Response(N,{status:v,headers:D})}async alive(i){return this.probeHealth(i)}async probeHealth(i){let u=new AbortController,t=setTimeout(()=>u.abort(),3000);try{return await this.dispatchJson("GET",`/api/sandboxes/${encodeURIComponent(i)}`,void 0,u.signal),!0}catch{return!1}finally{clearTimeout(t)}}async forgetHandle(i){if(this.records.delete(i),this.stateStore)await this.stateStore.deleteByHandle(Rg,i).catch(()=>{})}async delete(i){if(this.records.delete(i),this.stateStore)await this.stateStore.deleteByHandle(Rg,i).catch(()=>{});try{await this.dispatchJson("DELETE",`/api/sandboxes/${encodeURIComponent(i)}`)}catch(u){if(!(u instanceof Error?u.message:String(u)).includes("404"))throw u}}async getPreviewUrl(i){return(await this.resolveRecord(i))?.previewUrl??null}async localWorkdir(i){return null}async*watchClaimLifecycle(i,u){yield{kind:"ready"}}toSandbox(i){return{handle:i.handle,workdir:i.sandboxApiUrl,previewUrl:i.previewUrl}}async resolveRecord(i){let u=this.records.get(i);if(u)return u;if(!this.stateStore)return null;let f=(await this.stateStore.getByHandle(Rg,i))?.state,l=f?.sandboxApiUrl;if(!l)return null;let c={handle:i,sandboxApiUrl:l,previewUrl:f?.previewUrl??l};return this.records.set(i,c),c}async dispatchJson(i,u,t,f){let l={accept:"application/json"};if(t!==void 0)l["content-type"]="application/json";let c=this.dispatch(this.userSub,{method:i,path:u,headers:l,body:t},{signal:f}),E=null,$="";for await(let d of c)if(d.headers)E=d.headers.status;else if(d.data!=null)$+=d.data;let w=Buffer.from($,"base64").toString("utf8");if(E!=null&&(E<200||E>=300))throw Error(`daemon returned ${E}: ${w}`);return w}}function TS0(i){return new OTi(i)}function gMf(){let i="";return{push(u){if(u.length===0)return fcu;i+=u;let t=i.length-i.length%4;if(t===0)return fcu;let f=i.slice(0,t);return i=i.slice(t),new Uint8Array(Buffer.from(f,"base64"))},flush(){if(i.length===0)return fcu;let u=i;return i="",new Uint8Array(Buffer.from(u,"base64"))}}}async function OMf(i){if(typeof i==="string")return i;if(i instanceof ArrayBuffer)return Buffer.from(i).toString("utf8");if(ArrayBuffer.isView(i))return Buffer.from(i.buffer,i.byteOffset,i.byteLength).toString("utf8");if(i instanceof URLSearchParams)return i.toString();return await new Response(i).text()}var Rg="user-desktop",fcu;var BS0=g(()=>{Jhi();Gli();fcu=new Uint8Array(0)});var FS0={};Xi(FS0,{createDesktopProvider:()=>TS0,DesktopSandboxProvider:()=>OTi});var US0=g(()=>{BS0()});var GS0={};Xi(GS0,{subscribeLifecycle:()=>xo,getSandboxProviderByKind:()=>ccu,getOrInitSharedRunner:()=>PMf,buildDesktopProvider:()=>NTi,__resetSharedLifecyclesForTesting:()=>GMf});function xS0(i,u){let t=PS0[i];if(t)return Promise.resolve(t);let f=lcu[i];if(f)return f;let l=u().then((c)=>{return PS0[i]=c,c}).finally(()=>{delete lcu[i]});return lcu[i]=l,l}function ZMf(){let i=process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN;return i&&i.trim()!==""?i:void 0}function TMf(){let i=process.env.STUDIO_SANDBOX_TEMPLATE_NAME;return i&&i.trim()!==""?i:void 0}function BMf(){let i=process.env.STUDIO_ENV;return i&&i.trim()!==""?i:void 0}function FMf(){let i=process.env.STUDIO_SANDBOX_SENTINEL_TOKEN;return i&&i.trim()!==""?i:void 0}function UMf(){let i=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME?.trim(),u=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE?.trim();if(!i&&!u)return;if(!i||!u)throw Error("STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME and STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE must both be set, or both unset. Half-configured per-claim HTTPRoute routing would silently fail to attach.");return{name:i,namespace:u}}async function kS0(i,u){let t=new xg(u),f=ZMf();switch(i){case"agent-sandbox":{let{AgentSandboxProvider:l}=await Promise.resolve().then(() => (tcu(),ZS0)),c=new eD(yu().encryptionKey);return new l({stateStore:t,previewUrlPattern:f,sandboxTemplateName:TMf(),envName:BMf(),previewGateway:UMf(),sentinelToken:FMf(),meter:Bt,mintCloneUrl:async(E,$)=>{if(!E.connectionId)return null;let w=IU0(E.cloneUrl);if(!w)return null;let{cloneUrl:d}=await kg(E.connectionId,w.owner,w.name,u,c,{bufferMs:$?.bufferMs});return d}})}case"user-desktop":throw Error("user-desktop provider cannot be instantiated without a per-run link claim \u2014 call resolveSandboxProvider, which binds the link before constructing the provider.");default:throw Error(`Unknown sandbox provider kind: ${String(i)}`)}}async function NTi(i,u){let{DesktopSandboxProvider:t}=await Promise.resolve().then(() => (US0(),FS0)),{getProxyDispatch:f}=await Promise.resolve().then(() => ($cu(),Ecu)),l=new xg(i.db);if(!u)throw Error("buildDesktopProvider: userSub must be a non-empty string");let c=f();return new t({userSub:u,dispatch:c,stateStore:l})}function ccu(i,u){return xS0(u,()=>kS0(u,i.db))}async function PMf(){let i;try{i=S8()}catch(t){return console.warn("[lifecycle] cannot resolve sandbox runner:",t instanceof Error?t.message:String(t)),null}return await xS0(i,()=>kS0(i,Ft().db))}function xo(i,u,t){let f=bg.get(u);if(f){if(f.terminated){if(f.lastPhase)try{t(f.lastPhase)}catch{}return{unsubscribe:xMf}}if(f.listeners.add(t),f.lastPhase)try{t(f.lastPhase)}catch{}return AS0(u,f,t)}let l=new AbortController,c={lastPhase:null,terminated:!1,listeners:new Set([t]),abort:l};return bg.set(u,c),kMf(i,u,c),AS0(u,c,t)}function xMf(){}function AS0(i,u,t){return{unsubscribe(){if(bg.get(i)!==u)return;if(u.listeners.delete(t),u.listeners.size===0)bg.delete(i),u.abort.abort()}}}async function kMf(i,u,t){let f=null;try{for await(let l of i.watchClaimLifecycle(u,t.abort.signal)){if(t.abort.signal.aborted)break;t.lastPhase=l;let c=l.kind==="ready"||l.kind==="failed";if(c)t.terminated=!0;let E=Array.from(t.listeners);for(let $ of E)try{$(l)}catch{}if(c)break}}catch(l){f=l}finally{if(!t.terminated&&!t.abort.signal.aborted&&t.listeners.size>0){let l={kind:"failed",reason:"unknown",message:f instanceof Error?f.message:"Lifecycle watcher ended unexpectedly"};t.lastPhase=l,t.terminated=!0;for(let c of Array.from(t.listeners))try{c(l)}catch{}}if(bg.get(u)===t)bg.delete(u)}}function GMf(){for(let i of bg.values())i.abort.abort();bg.clear()}var NMf,yMf,IS0,PS0,lcu,AMf,IMf,bg;var ko=g(()=>{Zd();lE();jl();rhi();to();eV();vt();NMf=Symbol.for("decocms.sandbox.lifecycle.runners"),yMf=Symbol.for("decocms.sandbox.lifecycle.inflight"),IS0=globalThis,PS0=IS0[NMf]??={},lcu=IS0[yMf]??={};AMf=Symbol.for("decocms.sandbox.lifecycle.shared-lifecycles"),IMf=globalThis,bg=IMf[AMf]??=new Map});async function Pd(i,u){let{userId:t,branch:f,virtualMcpMetadata:l,explicitKind:c}=u;if(c)return{provider:await Go(i,t,c),kind:c};if(i.sandboxPreference==="agent-sandbox")return{provider:await Go(i,t,"agent-sandbox"),kind:"agent-sandbox"};if(i.sandboxPreference==="user-desktop")return{provider:await NTi(i,t),kind:"user-desktop"};if(i.sandboxPreference==="cluster-default"){let h=S8();return{provider:await Go(i,t,h),kind:h}}let[E,...$]=SMf(l,t,f);if(E){let h=$.length===0?E:jMf(E,$);return{provider:await Go(i,t,h),kind:h}}let w=SS0();return{provider:await Go(i,t,w),kind:w}}function SMf(i,u,t){let f=Il(i)[u]?.[t];if(!f)return[];let l=h3(f);return Object.keys(l)}function jMf(i,u){let t=SS0();if(t===i||u.includes(t))return t;return i}function SS0(){return S8()}async function Go(i,u,t){if(t!=="user-desktop")return ccu(i,t);return NTi(i,u)}var MK=g(()=>{Rt();Zd();nw();ko()});var So;var wcu=g(()=>{So={npm:{install:"npm install",run:(i)=>`npm run ${i}`,runtime:"node"},pnpm:{install:"pnpm install",run:(i)=>`pnpm run ${i}`,runtime:"node"},yarn:{install:"yarn install",run:(i)=>`yarn run ${i}`,runtime:"node"},bun:{install:"bun install",run:(i)=>`bun run ${i}`,runtime:"bun"},deno:{install:"deno install",run:(i)=>`deno task ${i}`,runtime:"deno"}}});function yTi(i){if(!i)return null;let u=i.runtime;if(!u||typeof u!=="object")return null;let t=u.env;if(!Array.isArray(t))return null;let f=[];for(let l of t){if(!l||typeof l!=="object")continue;let c=l;if(typeof c.key!=="string"||!DV.test(c.key))continue;if(c.kind==="literal"&&typeof c.value==="string"){f.push({key:c.key,kind:"literal",value:c.value});continue}if(c.kind==="secret"&&typeof c.secretId==="string"&&c.secretId.length>0)f.push({key:c.key,kind:"secret",secretId:c.secretId})}return f.length===0?null:f}async function jS0(i,u){ki(u);let t=yi(u);await u.access.check();let f=Hu(u);if(!f)throw Error("User ID required");let l=await u.storage.virtualMcps.findById(i.virtualMcpId);if(!l||l.organization_id!==t.id)throw Error("Virtual MCP not found");let c=l.metadata??{},E=Il(c),$=_5(E,f,i.branch,i.sandboxProviderKind);return{virtualMcp:l,metadata:c,userId:f,entry:$,organization:t}}function ZTi(i){let u=i.runtime??null,f=u?.selected??null,l=u?.port??null,c=u?.path??null;if(!f||!(f in So))return{packageManager:null,runtime:null,port:l,packageManagerPath:c,runtimeBinPath:null};let E=So[f].runtime;return{packageManager:f,runtime:E,port:l,packageManagerPath:c,runtimeBinPath:E==="deno"?"/opt/deno/bin":E==="bun"?"/opt/bun/bin":null}}var $H=g(()=>{Rt();wcu();nw()});async function TTi({ctx:i,runner:u,handle:t,orgId:f,userId:l,entries:c}){if(!c||c.length===0)return;let E={};for(let w of c){if(w.kind==="literal"){E[w.key]=w.value;continue}try{let{value:d}=await i.storage.secrets.resolveById(w.secretId,f,l);E[w.key]=d}catch(d){if(d instanceof Yv||d instanceof jQ){console.warn(`[SANDBOX_START] skipping env ${w.key}: ${d.message}. Re-link or recreate the secret to restore.`);continue}throw d}}if(Object.keys(E).length===0)return;let $=await u.proxyDaemonRequest(t,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({env:E})});if(!$.ok){let w=await $.text().catch(()=>$.statusText);console.warn(`[SANDBOX_START] daemon rejected env patch (${$.status}): ${w}`)}}var dcu=g(()=>{Xwi()});async function XS0(i,u,t,f,l){let c=await lg({connectionId:i,tokenStorage:new al(f,l)});if(!c.accessToken)return null;return WS0(u,t,c.accessToken)}function LS0(i,u){return WS0(i,u,null)}async function WS0(i,u,t){let f=new Map,l=new Set(KS0.map((w)=>w.path));for(let w of Object.values(JS0))for(let d of w??[])l.add(d);await Promise.all(Array.from(l).map(async(w)=>{f.set(w,await JMf(i,u,w,t))}));let c=KS0.find(({path:w})=>f.get(w)!==null);if(!c)return null;let E=JS0[c.pm]??[],$=null;for(let w of E)if($=XMf(f.get(w)??null),$)break;return{packageManager:c.pm,devPort:$}}async function JMf(i,u,t,f){let l=`https://api.github.com/repos/${i}/${u}/contents/${encodeURIComponent(t)}`;try{let c={Accept:"application/vnd.github+json","User-Agent":"mesh-runtime-detect"};if(f)c.Authorization=`token ${f}`;let E=await fetch(l,{headers:c,signal:AbortSignal.timeout(5000)});if(!E.ok)return null;let $=await E.json();if(!$.content||$.encoding!=="base64")return null;return Buffer.from($.content,"base64").toString("utf8")}catch{return null}}function XMf(i){if(!i)return null;try{let u=JSON.parse(i),t=u.tasks??u.scripts??{};return(t.dev??t.start??"").match(KMf)?.[1]??null}catch{return null}}var KS0,JS0,KMf;var YS0=g(()=>{cg();D_();KS0=[{path:"deno.json",pm:"deno"},{path:"deno.jsonc",pm:"deno"},{path:"bun.lock",pm:"bun"},{path:"bunfig.toml",pm:"bun"},{path:"pnpm-lock.yaml",pm:"pnpm"},{path:"yarn.lock",pm:"yarn"},{path:"package-lock.json",pm:"npm"},{path:"package.json",pm:"bun"}],JS0={deno:["deno.json","deno.jsonc"],bun:["package.json"],pnpm:["package.json"],yarn:["package.json"],npm:["package.json"]},KMf=/(?:--port|PORT=|:)(\d{4,5})/});function BTi(i,u){return u?`thread:${i}/${u}`:`thread:${i}`}function wH(i){if(!i||!i.startsWith("thread:"))return null;return i.slice(7).split("/")[0]||null}async function FTi(i,u){if(!u)return null;let t=await i.storage.threads.get(u).catch(()=>null);if(!t)return null;return t.metadata??{}}async function jo(i,u){return(await FTi(i,u))?.githubRepo??null}async function QS0(i,u,t,f,l,c){let E=await FTi(i,u);if(!E)return;let $=uo(Il(E),t,f,l,c);await i.storage.threads.update(u,{metadata:{...E,sandboxMap:$}}).catch((w)=>console.warn("[thread-repo] setThreadSandboxMapEntry failed",w))}async function zS0(i,u){return Il(await FTi(i,u))}async function HS0(i,u,t,f,l){let c=await FTi(i,u);if(!c)return;let E=m4u(Il(c),t,f,l);if(!E)return;await i.storage.threads.update(u,{metadata:{...c,sandboxMap:E}}).catch(($)=>console.warn("[thread-repo] removeThreadSandboxMapEntry failed",$))}var Ko=g(()=>{nw()});async function UTi(i,u){if(!i)return{hosts:[],allowSameHostDev:!1};let t;try{t=await i.presignedGetUrl("link-dispatch/_allowlist_probe",60,{requireFetchable:!0})}catch{return{hosts:[],allowSameHostDev:!1}}let f;try{f=new URL(t)}catch{return{hosts:[],allowSameHostDev:!1}}if(f.protocol!=="https:"&&f.protocol!=="http:")return{hosts:[],allowSameHostDev:!1};let l=f.hostname,c=LMf.has(l);return{hosts:[l],allowSameHostDev:c&&!u.isProduction}}var LMf;var hcu=g(()=>{LMf=new Set(["127.0.0.1","localhost","::1","[::1]","0.0.0.0"])});import{z as N5}from"zod";async function PTi(i,u){ki(u);let t=yi(u),f=Hu(u);if(!f)throw Error("User ID required");let l=await u.storage.virtualMcps.findById(i.virtualMcpId);if(!l||l.organization_id!==t.id)throw Error("Virtual MCP not found");let c=l.metadata??{},E=_5(Il(c),f,i.branch,i.sandboxProviderKind),$=i.sandboxProviderKind,{provider:w}=await Pd(u,{userId:f,branch:i.branch,virtualMcpMetadata:c,explicitKind:$});if(E){if($!=="user-desktop")return E;if(await w.alive(E.sandboxHandle).catch(()=>!1))return E;await Ig(u.storage.virtualMcps,i.virtualMcpId,f,f,i.branch,$).catch((D)=>{console.warn("[ensureSandbox] failed to reap stale user-desktop entry",D)})}let h=await jo(u,wH(i.branch)??u.metadata?.threadId)??c.githubRepo??null,{entry:_}=await RS0({ctx:u,userId:f,orgId:t.id,virtualMcpId:i.virtualMcpId,branch:i.branch,metadata:c,githubRepo:h,existing:null,providerKind:$,runner:w});return _}async function RS0(i){let{ctx:u,userId:t,orgId:f,virtualMcpId:l,branch:c,metadata:E,githubRepo:$,existing:w,runner:d}=i,{runtime:h,packageManager:_,port:v,packageManagerPath:D}=ZTi(E),n;if($){if($.connectionId)await qz({ctx:u,connectionId:$.connectionId,organizationId:f,forceRefresh:!0,onLegacyMintError:(fi)=>{console.error("[provisionSandbox] repo-scoped legacy token mint failed",{connectionId:$.connectionId,error:fi.message})}});let{cloneUrl:Y,gitUserName:li,gitUserEmail:di}=$.connectionId?await kg($.connectionId,$.owner,$.name,u.db,u.vault):mhi($.owner,$.name);if(!_){let fi=$.connectionId?await XS0($.connectionId,$.owner,$.name,u.db,u.vault):await LS0($.owner,$.name);if(fi)_=fi.packageManager,h=So[fi.packageManager].runtime,v=fi.devPort??v,await YMf(u,l,t,fi.packageManager,fi.devPort)}n={cloneUrl:Y,...$.connectionId?{connectionId:$.connectionId}:{},userName:li,userEmail:di,branch:c,displayName:`${$.owner}/${$.name}`}}let O=h&&_?{runtime:h,packageManager:_,...v!==null?{devPort:Number(v)}:{},...D?{packageManagerPath:D}:{}}:void 0,N=G8({orgId:f,virtualMcpId:l,branch:c}),y=d.kind==="user-desktop"?await UTi(u.objectStorage,{isProduction:yu().nodeEnv==="production"}):null,Z=(d.kind==="user-desktop"||d.kind==="agent-sandbox")&&!yu().orgFsMountsDisabled,T;if(Z){let Y=u.organization?.slug??(await u.db.selectFrom("organization").select(["slug"]).where("id","=",f).executeTakeFirst())?.slug;if(Y)T=await w3i(u,{orgSlug:Y,orgId:f,baseUrl:hh()})}let B=await d.ensure({userId:t,projectRef:N},{branch:c,repo:n,workload:O,tenant:{orgId:f,userId:t,...u.organization?.slug?{orgSlug:u.organization.slug}:{},...u.organization?.name?{orgName:u.organization.name}:{},...u.auth.user?.email?{userEmail:u.auth.user.email}:{},...u.auth.user?.name?{userName:u.auth.user.name}:{}},...y?{offloadAllowedHosts:y.hosts,offloadAllowSameHostDev:y.allowSameHostDev}:{},...T?{orgFsConfigJson:T}:{}}),F=E.runtime?.env??null;await TTi({ctx:u,runner:d,handle:B.handle,orgId:f,userId:t,entries:F});let G=!!w&&w.sandboxHandle===B.handle&&w?.createdAt?w.createdAt:Date.now(),I=E.runtime?.selected??null,k=E.runtime?.port??null,q=E.runtime?.path??null,J={sandboxHandle:B.handle,previewUrl:B.previewUrl,sandboxApiUrl:B.previewUrl,sandboxProviderKind:d.kind,createdAt:G,startedWith:{packageManager:I,port:k,path:q}};await OU0(u.storage.virtualMcps,l,t,t,c,i.providerKind,J);let W=wH(c);if(W)await QS0(u,W,t,c,i.providerKind,J);let r=!w||w.sandboxHandle!==B.handle;return{entry:J,isNewVm:r}}async function YMf(i,u,t,f,l){let c=await i.storage.virtualMcps.findById(u);if(!c)return;let E=c.metadata??{};await i.storage.virtualMcps.update(u,t,{metadata:{...E,runtime:{selected:f,port:l}}})}var WMf,_cu;var ATi=g(()=>{Zd();Eu();$H();dcu();nw();to();YS0();wcu();MK();Ko();hcu();vt();cE();Nz();nw();WMf=N5.enum(["agent-sandbox","user-desktop","cluster"]),_cu=ti({name:"SANDBOX_START",description:"Start a sandbox with the connected GitHub repo and dev server.",annotations:{title:"Start VM Preview",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:N5.object({virtualMcpId:N5.string().describe("Virtual MCP ID"),branch:N5.string().min(1).optional().describe("Optional git branch to check out. When omitted the handler generates a Bayer-style `<greek-letter>-<constellation>` name (e.g. `alpha-centauri`) and uses it. The resolved branch is returned in the response so callers can persist it."),sandboxProviderKind:WMf.optional().describe("Explicit runtime choice. Hosted provider is `agent-sandbox`; legacy `cluster` input is accepted only for compatibility and normalized to `agent-sandbox`. When omitted, defaults to `user-desktop` if the acting user's link daemon is online, else the env kind.")}),outputSchema:N5.object({previewUrl:N5.string().nullable(),sandboxHandle:N5.string(),branch:N5.string(),isNewVm:N5.boolean(),sandboxProviderKind:N5.enum(["agent-sandbox","user-desktop"])}),handler:async(i,u)=>{ki(u);let t=yi(u);await u.access.check();let f=i.branch??xhi(u.auth.user?.name??u.auth.user?.email?.split("@")[0]),l=Hu(u);if(!l)throw Error("User ID required");let c=await u.storage.virtualMcps.findById(i.virtualMcpId);if(!c||c.organization_id!==t.id)throw Error("Virtual MCP not found");let E=c.metadata??{},$=i.sandboxProviderKind?k8(i.sandboxProviderKind):void 0,{provider:w,kind:d}=await Pd(u,{userId:l,branch:f,virtualMcpMetadata:E,explicitKind:$}),h=_5(Il(E),l,f,d),v=await jo(u,wH(f)??u.metadata?.threadId)??E.githubRepo??null,{entry:D,isNewVm:n}=await RS0({ctx:u,userId:l,orgId:t.id,virtualMcpId:i.virtualMcpId,branch:f,metadata:E,githubRepo:v,existing:h,providerKind:d,runner:w});return{...D,branch:f,isNewVm:n,sandboxProviderKind:d}}})});async function QMf(i,u,t,f){try{let l=i.organization;if(!l)return;let c=await qhi(i,f.virtualMcpId,l,"tool-scripting",f.providerKind),E=await u.proxyDaemonRequest(t,"/_sandbox/tools/sync",{method:"POST",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify(c)});if(!E.ok)console.warn("[cluster-sandbox-fs] tools/sync failed",E.status,await E.text().catch(()=>""))}catch(l){console.warn("[cluster-sandbox-fs] tools/sync failed",l)}}async function Jo(i,u){let{provider:t,kind:f}=await Pd(i,{userId:u.userId,branch:u.branch,virtualMcpMetadata:null}),l=null,c=()=>{if(!l){if(l=PTi({virtualMcpId:u.virtualMcpId,branch:u.branch,sandboxProviderKind:f},i).then((w)=>w.sandboxHandle),l.catch(()=>{l=null}),u.syncTools)l.then((w)=>QMf(i,t,w,{virtualMcpId:u.virtualMcpId,providerKind:f})).catch(()=>{})}return l},E=u.branch==="ephemeral"||f==="user-desktop";return L4u(t,{ensureHandle:c,invalidateHandle:async()=>{let w=l;if(l=null,!E)return;try{await Ig(i.storage.virtualMcps,u.virtualMcpId,u.userId,u.userId,u.branch,f)}catch(d){console.warn("[cluster-sandbox-fs] failed to reap vmMap entry",d)}if(w&&typeof t.forgetHandle==="function")try{let d=await w;await t.forgetHandle(d)}catch(d){console.warn("[cluster-sandbox-fs] forgetHandle failed",d)}},canAutoRestart:E})}async function bS0(i,u){try{let t=await Jo(i,u),{stdout:f}=await t.onBash("test -d .deco && echo __DECO_SITE__");return f.includes("__DECO_SITE__")}catch(t){return console.warn("[cluster-sandbox-fs] .deco probe failed; assuming deco site",t),!0}}var ITi=g(()=>{Zd();r4u();MK();ATi();nw()});function dH(i){let u=i.toISOString();return`<current-context>
+`))>=0){let w=f.slice(0,$).trim();if(f=f.slice($+1),!w)continue;yield JSON.parse(w)}}let l=f.trim();if(l)yield JSON.parse(l)}finally{u.releaseLock()}}var oG0,sG0,uS0="gateway.networking.k8s.io",tS0="v1",fS0="httproutes",KCf,Io,cS0="mesh-sandbox-runner";var nTi=g(()=>{y4();Uo();oG0=class oG0 extends Error{status;body;constructor(i,u,t){super(t);this.status=i;this.body=u;this.name="KubeHttpError"}};sG0=`/apis/${H1.CLAIM_API_GROUP}/${H1.CLAIM_API_VERSION}/namespaces`;KCf=`/apis/${uS0}/${tS0}/namespaces`;Io={API_GROUP:uS0,API_VERSION:tS0,PLURAL:fS0}});async function*dS0(i){let u=i.now??(()=>Date.now()),t=u(),f=i.schedulingTimeoutMs??LCf,l={pod:{},sandbox:{},events:{hasPulling:!1,hasPulled:!1},startedAt:t},c=[],E=null,$=!1,w=(Z)=>{if($)return;if(E){let T=E;E=null,T(Z)}else c.push(Z)},d=()=>{if(c.length>0)return Promise.resolve(c.shift());if($)return Promise.resolve(null);return new Promise((Z)=>{E=Z})},h=()=>{if($)return;if($=!0,E){let Z=E;E=null,Z(null)}},_=new AbortController,v=()=>{_.abort(),h()};if(i.signal)if(i.signal.aborted)_.abort(),h();else i.signal.addEventListener("abort",v,{once:!0});let D=Math.max(0,f-(u()-t)),n=setTimeout(()=>w("tick"),D+100),O,N=new Promise((Z)=>{O=Z}),y=Promise.allSettled([WCf(i.kc,i.namespace,i.claimName,_.signal,l,w,u,O),QCf(i.kc,i.namespace,i.claimName,_.signal,l,w),zCf(i.kc,i.namespace,i.claimName,N,_.signal,l,w,u)]);try{let Z=null,T=-1,B=$S0(l,f,u);if(Z=e1u(B),!m1u(B))T=wS0(B);if(yield B,m1u(B))return;while(!$){if(await d()===null)break;let A=$S0(l,f,u);if(m1u(A)){let k=e1u(A);if(k!==Z)Z=k,yield A;return}let G=wS0(A);if(G<T)continue;let I=e1u(A);if(I!==Z)Z=I,T=G,yield A}}finally{if(clearTimeout(n),_.abort(),i.signal)i.signal.removeEventListener("abort",v);h(),await y.catch(()=>{})}}function $S0(i,u,t){let{pod:f,sandbox:l,events:c,startedAt:E}=i;if(l.ready)return{kind:"ready"};let $=f.containerWaitingReason;if($==="ImagePullBackOff"||$==="ErrImagePull")return{kind:"failed",reason:"image-pull-backoff",message:"Sandbox image failed to download. The cluster may be missing pull credentials or the image tag may not exist."};if($==="CrashLoopBackOff")return{kind:"failed",reason:"crash-loop-backoff",message:"Sandbox crashed during startup and is now in CrashLoopBackOff. Check pod logs."};if(!f.scheduled&&c.lastFailedSchedulingAt!==void 0&&t()-E>u)return{kind:"failed",reason:"scheduling-timeout",message:c.failedSchedulingMessage??`Pod could not be scheduled within ${Math.round(u/1000)}s.`};if(f.containerRunning&&!f.containerReady)return{kind:"warming-daemon",since:E};if(c.hasPulling&&!c.hasPulled)return{kind:"pulling-image",since:E};if($==="ContainerCreating"||$==="PodInitializing"||f.scheduled&&!f.containerRunning)return{kind:"starting-container",since:E};if(f.scheduledFalseReason==="Unschedulable"||c.lastFailedSchedulingAt!==void 0&&!f.scheduled)return{kind:"waiting-for-capacity",since:E,message:c.failedSchedulingMessage??f.scheduledFalseMessage,nodeClaim:c.nominatedNodeClaim};return{kind:"claiming",since:E}}function m1u(i){return i.kind==="ready"||i.kind==="failed"}function wS0(i){switch(i.kind){case"claiming":return 0;case"waiting-for-capacity":return 1;case"pulling-image":return 2;case"starting-container":return 3;case"warming-daemon":return 4;case"ready":case"failed":return 99}}function e1u(i){switch(i.kind){case"claiming":case"pulling-image":case"starting-container":case"warming-daemon":return i.kind;case"waiting-for-capacity":return`waiting-for-capacity:${i.message??""}:${i.nodeClaim??""}`;case"ready":return"ready";case"failed":return`failed:${i.reason}:${i.message}`}}async function WCf(i,u,t,f,l,c,E,$){let w=`/api/v1/namespaces/${encodeURIComponent(u)}/pods?watch=true&labelSelector=${encodeURIComponent(`${JCf}=${t}`)}`;return gTi({kc:i,path:w,signal:f,label:`pod/${t}`,onEvent:(d)=>{if(d.type!=="ADDED"&&d.type!=="MODIFIED")return;let h=d.object;if(h.metadata?.name)$(h.metadata.name);YCf(h,l,E),c("pod")}})}function YCf(i,u,t){let l=(i.status?.conditions??[]).find((E)=>E.type==="PodScheduled");if(l?.status==="True")u.pod.scheduled=!0,u.pod.scheduledFalseReason=void 0,u.pod.scheduledFalseMessage=void 0;else if(l?.status==="False")u.pod.scheduled=!1,u.pod.scheduledFalseReason=l.reason,u.pod.scheduledFalseMessage=l.message;let c=(i.status?.containerStatuses??[]).find((E)=>E.name===XCf);if(c)u.pod.containerWaitingReason=c.state?.waiting?.reason,u.pod.containerRunning=!!c.state?.running,u.pod.containerReady=c.ready===!0}async function QCf(i,u,t,f,l,c){let E=`/apis/${H1.CLAIM_API_GROUP}/${H1.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(u)}/${H1.CLAIM_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${t}`)}`;return gTi({kc:i,path:E,signal:f,label:`sandboxclaim/${t}`,onEvent:($)=>{if($.type!=="ADDED"&&$.type!=="MODIFIED")return;let d=$.object.status?.conditions?.find((h)=>h.type==="Ready");if(!d)return;if(d.status==="True")l.sandbox.ready=!0,l.sandbox.notReadyReason=void 0,l.sandbox.notReadyMessage=void 0;else l.sandbox.ready=!1,l.sandbox.notReadyReason=d.reason,l.sandbox.notReadyMessage=d.message;c("sandbox")}})}async function zCf(i,u,t,f,l,c,E,$){let w=await Promise.race([f,new Promise((h)=>{if(l.aborted){h(t);return}l.addEventListener("abort",()=>h(t),{once:!0})})]);if(l.aborted)return;let d=`/api/v1/namespaces/${encodeURIComponent(u)}/events?watch=true&fieldSelector=${encodeURIComponent(`involvedObject.name=${w},involvedObject.kind=Pod`)}`;return gTi({kc:i,path:d,signal:l,label:`events/${t}`,onEvent:(h)=>{if(h.type!=="ADDED"&&h.type!=="MODIFIED")return;let _=h.object,v=_.reason;if(!v)return;switch(v){case"Pulling":c.events.hasPulling=!0;break;case"Pulled":c.events.hasPulling=!0,c.events.hasPulled=!0;break;case"FailedScheduling":c.events.lastFailedSchedulingAt=$(),c.events.failedSchedulingMessage=_.message;break;case"Nominated":{let D=_.message?.match(/nodeclaim\/([\w-]+)/);if(D)c.events.nominatedNodeClaim=D[1];break}default:return}E("event")}})}async function hS0(i){let{kc:u,namespace:t,labelSelector:f,signal:l,onDelete:c}=i,E=`/apis/${H1.CLAIM_API_GROUP}/${H1.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(t)}/${H1.CLAIM_PLURAL}?watch=true&labelSelector=${encodeURIComponent(f)}`;return gTi({kc:u,path:E,signal:l,label:"sandboxclaim-reaper",onEvent:($)=>{if($.type!=="DELETED")return;let w=$.object.metadata?.name;if(w)c(w)}})}async function gTi(i){let{kc:u,path:t,signal:f,label:l,onEvent:c}=i,E=0;while(!f.aborted){try{let w=await RK(u,{method:"GET",path:t,signal:f,headers:{accept:"application/json"},stream:!0});if(!w.ok||!w.body){try{await w.body?.cancel()}catch{}if(w.status===401||w.status===403){console.warn(`[lifecycle-watcher] ${l} stopped: watch denied (${w.status} ${w.statusText}). `+"The kubeconfig in use cannot watch SandboxClaims \u2014 if you are running locally, "+"this provider should not be active (check STUDIO_SANDBOX_PROVIDER / your sandbox preference).");return}throw Error(`watch handshake failed: ${w.status} ${w.statusText}`)}E=0;for await(let d of r1u(w.body)){if(f.aborted)return;try{c(d)}catch(h){console.warn(`[lifecycle-watcher] ${l} onEvent threw: ${h instanceof Error?h.message:String(h)}`)}}}catch(w){if(f.aborted)return;let d=w instanceof Error?w.message:String(w);console.warn(`[lifecycle-watcher] ${l} watch ended: ${d}`)}if(f.aborted)return;let $=c6(5000,250,E,2,0);E+=1,await O0($,{signal:f}).catch(()=>{})}}var JCf="studio.decocms.com/sandbox-handle",XCf="sandbox",LCf=300000;var _S0=g(()=>{y4();Uo();nTi()});async function vS0(i,u,t){let f=new Map;for(let l of i){let c=u(l);if(!c)continue;let E=f.get(c);if(E)E.push(l);else f.set(c,[l])}await Promise.allSettled([...f.values()].map(async(l)=>{for(let c of l)await t(c).catch(()=>{})}))}import{createHash as HCf,randomBytes as RCf,randomUUID as bCf}from"crypto";import*as OS0 from"net";import{PassThrough as CCf}from"stream";function MCf(i){if(i instanceof Error)return i.message;if(i&&typeof i==="object"){let u=i;if(u.error instanceof Error)return u.error.message;if(typeof u.message==="string"&&u.message)return u.message}return String(i)}class ucu{kind=Tw;records=new Map;inflight=new Shi;stateStore;previewUrlPattern;kubeConfig;portForward;namespace;sandboxTemplateName;envName;tokenGenerator;idleTtlMs;metrics;previewGateway;sentinelToken;mintCloneUrl;closed=!1;claimWatchAbort=new AbortController;constructor(i={}){this.stateStore=i.stateStore??null,this.previewUrlPattern=i.previewUrlPattern??null,this.kubeConfig=i.kubeConfig??tMf(),this.portForward=new A1u(this.kubeConfig),this.namespace=i.namespace??qCf,this.sandboxTemplateName=i.sandboxTemplateName??VCf,this.envName=wMf(i.envName),this.tokenGenerator=i.tokenGenerator??(()=>RCf(mCf).toString("hex")),this.idleTtlMs=i.idleTtlMs??aCf,this.metrics=i.meter?uMf(i.meter):null,this.previewGateway=i.previewGateway&&i.previewUrlPattern?{...i.previewGateway}:null;let u=i.sentinelToken?.trim()??"";this.sentinelToken=u.length>0?u:null,this.mintCloneUrl=i.mintCloneUrl,this.startClaimReaper(),this.startCredentialRefresher()}startClaimReaper(){let i=["app.kubernetes.io/managed-by=studio","app.kubernetes.io/name=studio-sandbox",...this.envName?[`${Y3.env}=${this.envName}`]:[]].join(",");hS0({kc:this.kubeConfig,namespace:this.namespace,labelSelector:i,signal:this.claimWatchAbort.signal,onDelete:(u)=>this.invalidateRecord(u)})}async ensure(i,u={}){let t=Pg(i,u.branch??u.repo?.branch??null);return this.inflight.run(t,()=>jhi(this.stateStore,i,Tw,(f)=>this.ensureLocked(i,t,u,f)))}async delete(i){let u=await this.getRecord(i);if(this.records.delete(i),u)this.closeForwarder(u.daemonForward),this.metrics?.active.add(-1,p1u(u.tenant));if(await this.deleteHttpRouteIfManaged(i).catch((t)=>{console.warn(`[${ic}] HTTPRoute delete failed for ${i}: ${t instanceof Error?t.message:String(t)}`)}),await zg(this.kubeConfig,this.namespace,i),this.stateStore)if(u)await this.stateStore.delete(u.id,Tw);else await this.stateStore.deleteByHandle(Tw,i)}async alive(i){return await Q8(this.kubeConfig,this.namespace,i)!==void 0}watchClaimLifecycle(i,u){return dS0({kc:this.kubeConfig,namespace:this.namespace,claimName:i,signal:u})}async getPreviewUrl(i){let u=await this.getRecord(i);if(!u)return null;return this.composePreviewUrl(u)}async proxyDaemonRequest(i,u,t){let f=await this.getRecord(i);if(!f&&this.previewUrlPattern&&this.stateStore){let w=await this.stateStore.getByHandle(Tw,i),d=w?.state,h=d?.token;if(w&&h){let v=`http://${d?.adoptedSandboxName??i}.${this.namespace}.svc.cluster.local:${Hg}`;try{let D=await FM(v,h,u,t);if(D.status!==404)return D;try{await D.body?.cancel()}catch{}}catch{}}}if(!f)f=await this.resurrectByHandle(i);if(!f)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let l=f,c=performance.now(),E=0,$=!(t.body instanceof ReadableStream);try{let w=await FM(f.daemonUrl,f.token,u,t);if(w.status===401&&$){this.invalidateRecord(i);let d=await this.getRecord(i).catch(()=>null)??await this.resurrectByHandle(i).catch(()=>null);if(d)l=d,w=await FM(d.daemonUrl,d.token,u,t)}return E=w.status,w}catch(w){if(!$)throw w;this.invalidateRecord(i);let d=await this.resurrectByHandle(i)??await this.getRecord(i).catch(()=>null);if(!d)throw w;l=d;let h=await FM(d.daemonUrl,d.token,u,t);return E=h.status,h}finally{this.recordProxyDuration("daemon",E,l,performance.now()-c)}}async adoptLiveClaim(i,u){if(this.records.has(u))return!0;let t=await Q8(this.kubeConfig,this.namespace,u).catch(()=>{return});if(!t||t.metadata?.deletionTimestamp)return!1;return await this.inflight.run(u,async()=>{let l=this.records.get(u);if(l)return this.toSandbox(l);let c=await this.adopt(i,u,t);if(!c)throw Error(`cannot adopt live claim ${u}`);return jhi(this.stateStore,i,Tw,(E)=>this.finish(c,E,!0,!0,"adopt"))}).catch(()=>null)!=null}async resolvePreviewUpstreamUrl(i){if(this.previewUrlPattern)return`http://${await this.resolveServiceNameForHandle(i)}.${this.namespace}.svc.cluster.local:${Hg}`;let u=await this.getRecord(i);if(u)return u.daemonUrl;let t=await this.resurrectByHandle(i);return t?t.daemonUrl:null}async resolveServiceNameForHandle(i){let u=this.records.get(i);if(u)return u.adoptedSandboxName;if(this.stateStore){let f=(await this.stateStore.getByHandle(Tw,i).catch(()=>null))?.state?.adoptedSandboxName;if(f)return f}return i}async proxyPreviewRequest(i,u){let t=performance.now(),f=this.records.get(i)??null,l=0;try{let c=await this.resolvePreviewUpstreamUrl(i);if(!c){l=404;let n=o1u(404,{error:"sandbox not found"});return n.headers.set(CK,"1"),n}let E=new URL(u.url);if((E.pathname==="/_sandbox"||E.pathname.startsWith("/_sandbox/")||E.pathname==="/_decopilot_vm"||E.pathname.startsWith("/_decopilot_vm/"))&&u.method!=="GET")return l=404,o1u(404,{error:"not found"});let w=(n)=>`${n}${E.pathname}${E.search}`,d=new Headers(u.headers);for(let n of pCf)d.delete(n);let h=u.method!=="GET"&&u.method!=="HEAD",_={method:u.method,headers:d,body:h?u.body:void 0,redirect:"manual",signal:u.signal,duplex:h?"half":void 0},v;try{v=await fetch(w(c),_)}catch(n){let O=`${c}${E.pathname}`;if(console.warn(`[${ic}] preview fetch to ${O} failed: ${n instanceof Error?n.message:String(n)}`),u.method==="GET"||u.method==="HEAD"){if(this.invalidateRecord(i),await this.resurrectByHandle(i).catch(()=>null)){let Z=await this.resolvePreviewUpstreamUrl(i);if(Z)try{v=await fetch(w(Z),_);let T=new Headers;for(let[B,F]of v.headers.entries())if(!DS0.includes(B.toLowerCase()))T.set(B,F);return l=v.status,new Response(v.body,{status:v.status,statusText:v.statusText,headers:T})}catch(T){console.warn(`[${ic}] preview fetch retry to ${O} failed: ${T instanceof Error?T.message:String(T)}`)}}}else this.invalidateRecord(i);l=502;let N=o1u(502,{error:"sandbox daemon unreachable"});return N.headers.set(CK,"1"),N}let D=new Headers;for(let[n,O]of v.headers.entries())if(!DS0.includes(n.toLowerCase()))D.set(n,O);return l=v.status,new Response(v.body,{status:v.status,statusText:v.statusText,headers:D})}finally{this.recordProxyDuration("preview",l,f,performance.now()-t,i)}}async ensureLocked(i,u,t,f){if(t.image)console.warn(`[${ic}] opts.image ignored (template ${this.sandboxTemplateName} pins image): got ${t.image}`);if(f){let E=await f.get(i,Tw);if(E){let $=await this.rehydrate(i,u,E);if($)return await this.refreshDaemonGitCredential($,t),this.finish($,f,!1,!0,"resume");await f.delete(i,Tw)}}let l=await Q8(this.kubeConfig,this.namespace,u).catch(()=>{return});if(l)if(l.metadata?.deletionTimestamp)await hTi(this.kubeConfig,this.namespace,u).catch((E)=>{console.warn(`[${ic}] wait for terminating claim ${u} failed: ${E instanceof Error?E.message:String(E)}`)});else{let E=await this.adopt(i,u,l).catch(($)=>{return console.warn(`[${ic}] adopt ${u} failed, recreating: ${$ instanceof Error?$.message:String($)}`),null});if(E)return await this.refreshDaemonGitCredential(E,t),this.finish(E,f,!0,!0,"adopt");await zg(this.kubeConfig,this.namespace,u).catch(()=>{}),await hTi(this.kubeConfig,this.namespace,u).catch(($)=>{console.warn(`[${ic}] wait for deleted claim ${u} failed: ${$ instanceof Error?$.message:String($)}`)})}let c=await this.provision(i,u,t);return this.finish(c,f,!0,!1,"fresh")}async finish(i,u,t,f,l){let c=this.records.get(i.handle),E=c!==void 0;if(c&&c.daemonForward!==i.daemonForward)this.closeForwarder(c.daemonForward);if(this.records.set(i.handle,i),t)await this.persist(u,i);if(f)await pG0(this.kubeConfig,this.namespace,i.handle,this.computeShutdownTime()).catch(($)=>console.warn(`[${ic}] TTL refresh failed for ${i.handle}: ${$ instanceof Error?$.message:String($)}`));if(this.metrics){let $=p1u(i.tenant);if(this.metrics.ensureOutcome.add(1,{...$,outcome:l}),!E)this.metrics.active.add(1,$)}return this.toSandbox(i)}buildEnvMap(i,u){let t={},f=[];for(let[l,c]of Object.entries(i.env??{}))if(eCf.has(l))f.push(l);else t[l]=c;if(f.length>0)console.warn(`[${ic}] opts.env keys overlap reserved bootstrap names and were dropped: ${f.join(",")}`);return{...t,DAEMON_TOKEN:u.token,DAEMON_BOOT_ID:u.daemonBootId,APP_ROOT:u.workdir,PROXY_PORT:String(Hg)}}buildClaim(i,u,t){let f=this.sentinelToken!==null,l=f?[]:Object.entries(this.buildEnvMap(u,t)).sort(([$],[w])=>$<w?-1:$>w?1:0).map(([$,w])=>({name:$,value:w})),c=_Mf(u),E=Object.keys(c).length>0;return{apiVersion:`${H1.CLAIM_API_GROUP}/${H1.CLAIM_API_VERSION}`,kind:"SandboxClaim",metadata:{name:i,namespace:this.namespace,labels:{"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[Y3.env]:this.envName}:{},...s1u(u.tenant)},...E?{annotations:c}:{}},spec:{sandboxTemplateRef:{name:this.sandboxTemplateName},additionalPodMetadata:{labels:s1u(u.tenant,{[Y3.role]:"claimed",[Y3.sandboxHandle]:i,...this.envName?{[Y3.env]:this.envName}:{}}),...E?{annotations:c}:{}},env:l,warmpool:f?"default":"none",lifecycle:{shutdownPolicy:"Delete",shutdownTime:this.computeShutdownTime()}}}}async provision(i,u,t){let f=this.tokenGenerator(),l=bCf(),c=a1u,E=this.buildClaim(u,t,{token:f,daemonBootId:l,workdir:c});try{await Ao(this.kubeConfig,this.namespace,E)}catch(v){if(v instanceof Fo)await hTi(this.kubeConfig,this.namespace,u),await Ao(this.kubeConfig,this.namespace,E);else throw v}let $;try{$=await iS0(this.kubeConfig,this.namespace,u),await DTi(this.kubeConfig,this.namespace,$)}catch(v){throw await zg(this.kubeConfig,this.namespace,u).catch(()=>{}),v}try{await this.ensureServicePortForAdoptedSandbox($),await this.ensureHttpRouteForHandle(u,$,t.tenant??null)}catch(v){throw await zg(this.kubeConfig,this.namespace,u).catch(()=>{}),v}let w=await this.openForwarder($,Hg,u),d=`http://127.0.0.1:${w.localPort}`,h=this.workloadConfigPayload(t),_=l;try{if(await Kli(d),this.sentinelToken!==null){let v=await jli(d);if(v)_=v.bootId;await $2(d,this.sentinelToken,h??{},{rotateToken:f})}else if(h)await $2(d,f,h);if(t.orgFsConfigJson)await jbu(d,f,t.orgFsConfigJson).catch((v)=>console.warn("[org-fs] sidecar config relay failed",v))}catch(v){throw this.closeForwarder(w),await this.deleteHttpRouteIfManaged(u).catch(()=>{}),await zg(this.kubeConfig,this.namespace,u).catch(()=>{}),v}return{id:i,handle:u,adoptedSandboxName:$,token:f,workdir:c,daemonUrl:d,daemonForward:w,workload:t.workload??null,daemonBootId:_,tenant:t.tenant??null,ensureOpts:DMf(t)}}workloadConfigPayload(i){return J4u({runtime:i?.workload?.runtime??"node",packageManager:i?.workload?.packageManager?{name:i.workload.packageManager,...i.workload.packageManagerPath?{path:i.workload.packageManagerPath}:{}}:null,repo:i?.repo??null,port:i?.workload?.devPort??rCf,tenant:i?.tenant??void 0})}async refreshDaemonGitCredential(i,u){let t=X4u(u);if(!t)return;try{await $2(i.daemonUrl,i.token,t)}catch(f){console.warn(`[${ic}] git credential refresh failed for ${i.handle}: ${f instanceof Error?f.message:String(f)}`)}}async withFreshCloneUrl(i,u){if(!this.mintCloneUrl)return i;try{let t=await this.mintCloneUrl(i,u!==void 0?{bufferMs:u}:void 0);return t?{...i,cloneUrl:t}:i}catch(t){return console.warn(`[${ic}] clone credential re-mint failed: ${t instanceof Error?t.message:String(t)}`),i}}startCredentialRefresher(){if(!this.mintCloneUrl)return;let{signal:i}=this.claimWatchAbort;(async()=>{while(!i.aborted){if(await O0(oCf,{signal:i}).catch(()=>{}),i.aborted)break;try{await this.refreshAllGitCredentials()}catch(u){console.warn(`[${ic}] periodic credential refresh failed: ${u instanceof Error?u.message:String(u)}`)}}})()}async refreshAllGitCredentials(){await vS0(this.records.values(),(i)=>i.ensureOpts?.repo?.connectionId,async(i)=>{if(this.claimWatchAbort.signal.aborted)return;let u=i.ensureOpts?.repo;if(!u)return;let t=await this.withFreshCloneUrl(u,sCf);await this.refreshDaemonGitCredential(i,{...i.ensureOpts,repo:t}),i.ensureOpts={...i.ensureOpts,repo:t}})}async rebootstrapDaemon(i,u,t){if(this.sentinelToken===null)return!1;let f=this.workloadConfigPayload(t)??{};try{return await $2(i,this.sentinelToken,f,{rotateToken:u}),!0}catch(l){if(l instanceof Sli&&l.status===401)try{return await $2(i,u,f,{rotateToken:u}),!0}catch(c){return console.warn(`[${ic}] re-bootstrap retry with claim token failed: ${c instanceof Error?c.message:String(c)}`),!1}return console.warn(`[${ic}] re-bootstrap failed: ${l instanceof Error?l.message:String(l)}`),!1}}async ensureServicePortForAdoptedSandbox(i){if(!this.previewGateway||!this.previewUrlPattern)return;await ES0(this.kubeConfig,this.namespace,i,{name:"daemon",port:Hg,targetPort:Hg})}async ensureHttpRouteForHandle(i,u,t){if(!this.previewGateway||!this.previewUrlPattern)return;let f=nMf(this.previewUrlPattern,i);if(!f)throw new p1(`Unable to derive preview hostname for ${i} from pattern: ${this.previewUrlPattern}`);let l={apiVersion:`${Io.API_GROUP}/${Io.API_VERSION}`,kind:"HTTPRoute",metadata:{name:i,namespace:this.namespace,labels:s1u(t??void 0,{[Y3.role]:"claimed",[Y3.sandboxHandle]:i,"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[Y3.env]:this.envName}:{}})},spec:{parentRefs:[{kind:"Gateway",group:"gateway.networking.k8s.io",name:this.previewGateway.name,namespace:this.previewGateway.namespace}],hostnames:[f],rules:[{backendRefs:[{group:"",kind:"Service",name:u,port:Hg}]}]}};await _Ti(this.kubeConfig,this.namespace,l)}async deleteHttpRouteIfManaged(i){if(!this.previewGateway)return;await vTi(this.kubeConfig,this.namespace,i)}async rehydrate(i,u,t){let f=t.state;if(!f.adoptedSandboxName&&!f.podName||!f.token)return null;let l=await Q8(this.kubeConfig,this.namespace,u).catch(()=>{return});if(!l||!nS0(l))return null;let c=l.status?.sandbox?.name??f.adoptedSandboxName??f.podName??u,E=await this.openAndProbeDaemon(c,u);if(!E)return null;if(f.daemonBootId&&f.daemonBootId!==E.bootId){if(this.sentinelToken!==null){let $=f.ensureOpts?.repo?{...f.ensureOpts,repo:await this.withFreshCloneUrl(f.ensureOpts.repo)}:f.ensureOpts??null;if(!await this.rebootstrapDaemon(E.daemonUrl,f.token,$))return this.closeForwarder(E.daemonForward),null}else console.warn(`[${ic}] daemon restart detected (handle=${u}): stored bootId=${f.daemonBootId} live bootId=${E.bootId}`);await this.stateStore?.put(i,Tw,{handle:u,state:{...f,daemonBootId:E.bootId}}).catch(($)=>console.warn(`[${ic}] bootId persist failed for ${u}: ${$ instanceof Error?$.message:String($)}`))}return{id:i,handle:u,adoptedSandboxName:c,token:f.token,workdir:f.workdir??a1u,daemonUrl:E.daemonUrl,daemonForward:E.daemonForward,workload:f.workload??null,daemonBootId:E.bootId,tenant:f.tenant??null,ensureOpts:f.ensureOpts??null}}async adopt(i,u,t){if(!nS0(t))return null;let f=t.status?.sandbox?.name??u;if(this.sentinelToken!==null)return null;let l=fMf(t);if(!l)return null;let c=await this.openAndProbeDaemon(f,u);if(!c)return null;let E=vMf(t);if(this.previewGateway)await this.ensureServicePortForAdoptedSandbox(f).catch(($)=>{console.warn(`[${ic}] Service port backfill failed for ${u}: ${$ instanceof Error?$.message:String($)}`)}),await this.ensureHttpRouteForHandle(u,f,E).catch(($)=>{console.warn(`[${ic}] HTTPRoute backfill failed for ${u}: ${$ instanceof Error?$.message:String($)}`)});return{id:i,handle:u,adoptedSandboxName:f,token:l,workdir:a1u,daemonUrl:c.daemonUrl,daemonForward:c.daemonForward,workload:null,daemonBootId:c.bootId,tenant:E,ensureOpts:null}}async openAndProbeDaemon(i,u){let t=await this.openForwarder(i,Hg,u).catch(()=>null);if(!t)return null;let f=`http://127.0.0.1:${t.localPort}`,l=await jli(f);if(!l)return this.closeForwarder(t),null;return{daemonForward:t,daemonUrl:f,bootId:l.bootId}}async getRecord(i){let u=this.records.get(i);if(u)return u;if(!this.stateStore)return null;let t=await this.stateStore.getByHandle(Tw,i);if(!t)return null;let f=await this.rehydrate(t.id,i,t);if(f)this.records.set(i,f);return f}async resurrectByHandle(i){if(!this.stateStore)return null;let u=await this.stateStore.getByHandle(Tw,i);if(!u)return null;let t=u.state.ensureOpts;if(!t)return null;let f=t.repo?{...t,repo:await this.withFreshCloneUrl(t.repo)}:t;return await this.ensure(u.id,f),this.records.get(i)??null}invalidateRecord(i){let u=this.records.get(i);if(!u)return;this.records.delete(i),this.closeForwarder(u.daemonForward)}recordProxyDuration(i,u,t,f,l){if(!this.metrics)return;this.metrics.proxyDurationMs.record(f,{...p1u(t?.tenant??null),source:i,sandbox_handle:t?.handle??l??"",status_code:u||0})}composePreviewUrl(i){if(this.previewUrlPattern)return Khi(this.previewUrlPattern,i.handle);return`http://127.0.0.1:${i.daemonForward.localPort}/`}toSandbox(i){return{handle:i.handle,workdir:i.workdir,previewUrl:this.composePreviewUrl(i)}}async persist(i,u){if(!i)return;let t={adoptedSandboxName:u.adoptedSandboxName,token:u.token,workdir:u.workdir,workload:u.workload,daemonBootId:u.daemonBootId,tenant:u.tenant,...u.ensureOpts?{ensureOpts:u.ensureOpts}:{}};await i.put(u.id,Tw,{handle:u.handle,state:t})}computeShutdownTime(){return new Date(Date.now()+this.idleTtlMs).toISOString()}openForwarder(i,u,t=i){let f=lMf(t,u);return new Promise((l,c)=>{let E=($,w)=>{let d=OS0.createServer((h)=>this.handleForwardedConnection(h,i,u,t));d.once("error",(h)=>{if(h.code==="EADDRINUSE"&&w<iMf){try{d.close()}catch{}let _=icu+($-icu+1)%NS0;E(_,w+1);return}c(h)}),d.listen($,"127.0.0.1",()=>{let h=d.address();if(!h||typeof h==="string"){d.close(),c(Error("port-forward listener failed to bind"));return}l({server:d,localPort:h.port})})};E(f,0)})}handleForwardedConnection(i,u,t,f){let l=new CCf,c=null,E=!1,$=()=>{if(E)return;if(E=!0,l.destroy(),c)try{c.close()}catch{}if(!i.destroyed)i.destroy()};i.pipe(l),i.on("error",$),i.on("close",$),this.portForward.portForward(this.namespace,u,[t],i,null,l).then((w)=>{let d=typeof w==="function"?w():w;if(!d){$();return}if(c=d,c.on("close",$),c.on("error",()=>{this.invalidateRecord(f),$()}),E)try{c.close()}catch{}}).catch((w)=>{console.warn(`[${ic}] port-forward to ${u}:${t} failed: ${MCf(w)}`),this.invalidateRecord(f),$()})}closeForwarder(i){i.server.close((u)=>{if(u)console.warn(`[${ic}] port-forward close on :${i.localPort} errored: ${u instanceof Error?u.message:String(u)}`)})}close(){if(this.closed)return;this.closed=!0,this.claimWatchAbort.abort();for(let i of this.records.values())this.closeForwarder(i.daemonForward);this.records.clear()}}function uMf(i){return{active:i.createUpDownCounter("studio.sandbox.active",{description:"Active sandbox count, by runner kind and owning org. Cross-checks the cAdvisor-derived count from the cluster \u2014 divergence between the two indicates orphaned claims (studio deleted but K8s didn't reap) or unattributed pods.",unit:"{sandbox}"}),ensureOutcome:i.createCounter("studio.sandbox.ensure.outcome",{description:"Outcome of each ensure() call: fresh provision, resume from state-store after restart, or adopt of a cluster-side claim studio didn't know about. Cold-start ratio is the primary input for warm-pool sizing.",unit:"{call}"}),proxyDurationMs:i.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of studio-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"})}}function tMf(){let i=new tH;return i.loadFromDefault(),i}function nS0(i){return Boolean(i.status?.conditions?.some((u)=>u.type==="Ready"&&u.status==="True"))}function fMf(i){let u=i.spec?.env;if(!u)return null;for(let t of u)if(t.name==="DAEMON_TOKEN"&&t.value)return t.value;return null}function lMf(i,u){let t=HCf("sha256").update(`${i}:${u}`).digest();return icu+t.readUInt32BE(0)%NS0}function o1u(i,u){return new Response(JSON.stringify(u),{status:i,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function gS0(i){let u=i.slice(0,EMf);return cMf.test(u)?u:""}function wMf(i){if(i===void 0)return null;let u=i.trim();if(u==="")return null;if(!$Mf.test(u))throw Error(`AgentSandboxProvider: envName=${JSON.stringify(u)} is not a valid DNS-label-safe environment name (lowercase alphanumeric or '-', starts with a letter, ends alphanumeric, \u226432 chars). Studio sets this from STUDIO_ENV; check the studio chart's configMap.`);return u}function s1u(i,u={}){let t={...u};if(i){let f=gS0(i.orgId),l=gS0(i.userId);if(f)t[Y3.orgId]=f;if(l)t[Y3.userId]=l}return t}function bK(i){let u="";for(let t of i){let f=t.codePointAt(0)??0;u+=f<32||f===127?" ":t}return u.slice(0,dMf)}function hMf(i){try{let u=new URL(i);return u.username="",u.password="",u.toString()}catch{return""}}function _Mf(i){let u={},t=i.tenant;if(t?.orgSlug)u[x_.orgSlug]=bK(t.orgSlug);if(t?.orgName)u[x_.orgName]=bK(t.orgName);if(t?.userEmail)u[x_.userEmail]=bK(t.userEmail);if(t?.userName)u[x_.userName]=bK(t.userName);let f=i.repo;if(f){if(f.displayName)u[x_.gitRepo]=bK(f.displayName);let l=hMf(f.cloneUrl);if(l)u[x_.gitRepoUrl]=bK(l);let c=i.branch??f.branch;if(c)u[x_.gitBranch]=bK(c)}return u}function vMf(i){let u=i.metadata?.labels;if(!u)return null;let t=u[Y3.orgId],f=u[Y3.userId];if(!t||!f)return null;let l=i.metadata?.annotations??{};return{orgId:t,userId:f,orgSlug:l[x_.orgSlug],orgName:l[x_.orgName],userEmail:l[x_.userEmail],userName:l[x_.userName]}}function p1u(i){return{org_id:i?.orgId??"",user_id:i?.userId??"",runner_kind:Tw}}function DMf(i){let u={};if(i.repo)u.repo=i.repo;if(i.workload)u.workload=i.workload;if(i.env&&Object.keys(i.env).length>0)u.env=i.env;if(i.tenant)u.tenant=i.tenant;return Object.keys(u).length>0?u:null}function nMf(i,u){try{return new URL(Khi(i,u)).hostname||null}catch{return null}}var Tw="agent-sandbox",ic="AgentSandboxProvider",CK="x-sandbox-preview-not-ready",qCf="agent-sandbox-system",VCf="studio-sandbox",Hg=9000,rCf=3000,a1u="/app",mCf=32,eCf,aCf=900000,oCf=900000,sCf=1800000,pCf,DS0,icu=40000,NS0=1e4,iMf=256,Y3,x_,cMf,EMf=63,$Mf,dMf=253;var yS0=g(()=>{y4();R1u();vzi();Jhi();nTi();Uo();_S0();eCf=new Set(["DAEMON_TOKEN","DAEMON_BOOT_ID","APP_ROOT","PROXY_PORT"]),pCf=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length","upgrade"],DS0=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];Y3={role:"studio.decocms.com/role",sandboxHandle:"studio.decocms.com/sandbox-handle",orgId:"studio.decocms.com/org-id",userId:"studio.decocms.com/user-id",env:"studio.decocms.com/env"},x_={orgSlug:"studio.decocms.com/org-slug",orgName:"studio.decocms.com/org-name",userEmail:"studio.decocms.com/user-email",userName:"studio.decocms.com/user-name",gitRepo:"studio.decocms.com/git-repo",gitRepoUrl:"studio.decocms.com/git-repo-url",gitBranch:"studio.decocms.com/git-branch"},cMf=/^([A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?)?$/;$Mf=/^[a-z]([a-z0-9-]{0,30}[a-z0-9])?$/});var ZS0={};Xi(ZS0,{waitForSandboxReady:()=>DTi,getSandboxClaim:()=>Q8,getHttpRoute:()=>lS0,deleteSandboxClaim:()=>zg,deleteHttpRoute:()=>vTi,createSandboxClaim:()=>Ao,applyHttpRoute:()=>_Ti,SandboxTimeoutError:()=>HK,SandboxError:()=>p1,PREVIEW_NOT_READY_HEADER:()=>CK,KubeConfig:()=>tH,K8S_CONSTANTS:()=>H1,HTTPROUTE_CONSTANTS:()=>Io,AgentSandboxProvider:()=>ucu});var tcu=g(()=>{R1u();Uo();nTi();yS0()});class OTi{kind=Rg;userSub;dispatch;stateStore;records=new Map;constructor(i){if(!i.userSub)throw Error("DesktopSandboxProvider requires userSub");if(!i.dispatch)throw Error("DesktopSandboxProvider requires dispatch");this.userSub=i.userSub,this.dispatch=i.dispatch,this.stateStore=i.stateStore??null}async ensure(i,u={}){let t=u.branch??u.repo?.branch,f=Pg(i,t),l=this.records.get(f);if(l){if(await this.probeHealth(f))return this.toSandbox(l);if(this.records.delete(f),this.stateStore)await this.stateStore.deleteByHandle(Rg,f).catch(()=>{})}else if(this.stateStore){let v=(await this.stateStore.getByHandle(Rg,f))?.state,D=v?.sandboxApiUrl;if(D){if(await this.probeHealth(f)){let n={handle:f,sandboxApiUrl:D,previewUrl:v?.previewUrl??D};return this.records.set(f,n),this.toSandbox(n)}await this.stateStore.deleteByHandle(Rg,f).catch(()=>{})}}let c=_h({userName:u.tenant?.userName,userEmail:u.tenant?.userEmail}),E=JSON.stringify({handle:f,repo:u.repo,branch:t,...u.workload?{workload:u.workload}:{},...c?{operator:c}:{},...u.offloadAllowedHosts?{offloadAllowedHosts:u.offloadAllowedHosts}:{},...u.offloadAllowSameHostDev!==void 0?{offloadAllowSameHostDev:u.offloadAllowSameHostDev}:{},...u.orgFsConfigJson?{orgFsConfigJson:u.orgFsConfigJson}:{}}),$=await this.dispatchJson("POST","/api/sandboxes",E),w=JSON.parse($);if(typeof w.sandboxApiUrl!=="string")throw Error("desktop ensure: daemon did not return a sandboxApiUrl string");let d=typeof w.previewUrl==="string"?w.previewUrl:w.sandboxApiUrl,h={handle:f,sandboxApiUrl:w.sandboxApiUrl,previewUrl:d};if(this.records.set(f,h),this.stateStore)await this.stateStore.put(i,Rg,{handle:f,state:{handle:f,sandboxApiUrl:w.sandboxApiUrl,previewUrl:d}});return this.toSandbox(h)}async proxyDaemonRequest(i,u,t){let f=u.startsWith("/")?u:`/${u}`,l=f.startsWith("/_sandbox/")?f.slice(9):f,c=`/_sandbox/${encodeURIComponent(i)}${l}`,E=new Headers(t.headers);for(let y of["host","cookie","connection","keep-alive","transfer-encoding","upgrade","authorization"])E.delete(y);let $={};E.forEach((y,Z)=>{$[Z]=y});let w;if(t.body!=null)w=await OMf(t.body);let h=this.dispatch(this.userSub,{method:t.method,path:c,headers:$,body:w},{signal:t.signal})[Symbol.asyncIterator](),_=gMf(),v=200,D={"content-type":"application/octet-stream"},n=[];try{while(!0){let y=await h.next();if(y.done)break;let Z=y.value;if(Z.headers){v=Z.headers.status,D=Z.headers.headers;break}if(Z.data!=null){let T=_.push(Z.data);if(T.length)n.push(T)}}}catch(y){let Z=y instanceof Error?y.message:"dispatch error";return new Response(JSON.stringify({error:Z}),{status:502,headers:{"content-type":"application/json"}})}let O=!1,N=new ReadableStream({async start(y){for(let Z of n)y.enqueue(Z)},async pull(y){try{while(!0){let Z=await h.next();if(O)return;if(Z.done){let B=_.flush();if(B.length)y.enqueue(B);y.close();return}let T=Z.value;if(T.data!=null){let B=_.push(T.data);if(B.length){y.enqueue(B);return}}}}catch(Z){if(!O)y.error(Z)}},cancel(){O=!0,h.return?.()}});return new Response(N,{status:v,headers:D})}async alive(i){return this.probeHealth(i)}async probeHealth(i){let u=new AbortController,t=setTimeout(()=>u.abort(),3000);try{return await this.dispatchJson("GET",`/api/sandboxes/${encodeURIComponent(i)}`,void 0,u.signal),!0}catch{return!1}finally{clearTimeout(t)}}async forgetHandle(i){if(this.records.delete(i),this.stateStore)await this.stateStore.deleteByHandle(Rg,i).catch(()=>{})}async delete(i){if(this.records.delete(i),this.stateStore)await this.stateStore.deleteByHandle(Rg,i).catch(()=>{});try{await this.dispatchJson("DELETE",`/api/sandboxes/${encodeURIComponent(i)}`)}catch(u){if(!(u instanceof Error?u.message:String(u)).includes("404"))throw u}}async getPreviewUrl(i){return(await this.resolveRecord(i))?.previewUrl??null}async localWorkdir(i){return null}async*watchClaimLifecycle(i,u){yield{kind:"ready"}}toSandbox(i){return{handle:i.handle,workdir:i.sandboxApiUrl,previewUrl:i.previewUrl}}async resolveRecord(i){let u=this.records.get(i);if(u)return u;if(!this.stateStore)return null;let f=(await this.stateStore.getByHandle(Rg,i))?.state,l=f?.sandboxApiUrl;if(!l)return null;let c={handle:i,sandboxApiUrl:l,previewUrl:f?.previewUrl??l};return this.records.set(i,c),c}async dispatchJson(i,u,t,f){let l={accept:"application/json"};if(t!==void 0)l["content-type"]="application/json";let c=this.dispatch(this.userSub,{method:i,path:u,headers:l,body:t},{signal:f}),E=null,$="";for await(let d of c)if(d.headers)E=d.headers.status;else if(d.data!=null)$+=d.data;let w=Buffer.from($,"base64").toString("utf8");if(E!=null&&(E<200||E>=300))throw Error(`daemon returned ${E}: ${w}`);return w}}function TS0(i){return new OTi(i)}function gMf(){let i="";return{push(u){if(u.length===0)return fcu;i+=u;let t=i.length-i.length%4;if(t===0)return fcu;let f=i.slice(0,t);return i=i.slice(t),new Uint8Array(Buffer.from(f,"base64"))},flush(){if(i.length===0)return fcu;let u=i;return i="",new Uint8Array(Buffer.from(u,"base64"))}}}async function OMf(i){if(typeof i==="string")return i;if(i instanceof ArrayBuffer)return Buffer.from(i).toString("utf8");if(ArrayBuffer.isView(i))return Buffer.from(i.buffer,i.byteOffset,i.byteLength).toString("utf8");if(i instanceof URLSearchParams)return i.toString();return await new Response(i).text()}var Rg="user-desktop",fcu;var BS0=g(()=>{Jhi();Gli();fcu=new Uint8Array(0)});var FS0={};Xi(FS0,{createDesktopProvider:()=>TS0,DesktopSandboxProvider:()=>OTi});var US0=g(()=>{BS0()});var GS0={};Xi(GS0,{subscribeLifecycle:()=>xo,getSandboxProviderByKind:()=>ccu,getOrInitSharedRunner:()=>PMf,buildDesktopProvider:()=>NTi,__resetSharedLifecyclesForTesting:()=>GMf});function xS0(i,u){let t=PS0[i];if(t)return Promise.resolve(t);let f=lcu[i];if(f)return f;let l=u().then((c)=>{return PS0[i]=c,c}).finally(()=>{delete lcu[i]});return lcu[i]=l,l}function ZMf(){let i=process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN;return i&&i.trim()!==""?i:void 0}function TMf(){let i=process.env.STUDIO_SANDBOX_TEMPLATE_NAME;return i&&i.trim()!==""?i:void 0}function BMf(){let i=process.env.STUDIO_ENV;return i&&i.trim()!==""?i:void 0}function FMf(){let i=process.env.STUDIO_SANDBOX_SENTINEL_TOKEN;return i&&i.trim()!==""?i:void 0}function UMf(){let i=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME?.trim(),u=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE?.trim();if(!i&&!u)return;if(!i||!u)throw Error("STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME and STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE must both be set, or both unset. Half-configured per-claim HTTPRoute routing would silently fail to attach.");return{name:i,namespace:u}}async function kS0(i,u){let t=new xg(u),f=ZMf();switch(i){case"agent-sandbox":{let{AgentSandboxProvider:l}=await Promise.resolve().then(() => (tcu(),ZS0)),c=new eD(yu().encryptionKey);return new l({stateStore:t,previewUrlPattern:f,sandboxTemplateName:TMf(),envName:BMf(),previewGateway:UMf(),sentinelToken:FMf(),meter:Bt,mintCloneUrl:async(E,$)=>{if(!E.connectionId)return null;let w=IU0(E.cloneUrl);if(!w)return null;let{cloneUrl:d}=await kg(E.connectionId,w.owner,w.name,u,c,{bufferMs:$?.bufferMs});return d}})}case"user-desktop":throw Error("user-desktop provider cannot be instantiated without a per-run link claim \u2014 call resolveSandboxProvider, which binds the link before constructing the provider.");default:throw Error(`Unknown sandbox provider kind: ${String(i)}`)}}async function NTi(i,u){let{DesktopSandboxProvider:t}=await Promise.resolve().then(() => (US0(),FS0)),{getProxyDispatch:f}=await Promise.resolve().then(() => ($cu(),Ecu)),l=new xg(i.db);if(!u)throw Error("buildDesktopProvider: userSub must be a non-empty string");let c=f();return new t({userSub:u,dispatch:c,stateStore:l})}function ccu(i,u){return xS0(u,()=>kS0(u,i.db))}async function PMf(){let i;try{i=S8()}catch(t){return console.warn("[lifecycle] cannot resolve sandbox runner:",t instanceof Error?t.message:String(t)),null}return await xS0(i,()=>kS0(i,Ft().db))}function xo(i,u,t){let f=bg.get(u);if(f){if(f.terminated){if(f.lastPhase)try{t(f.lastPhase)}catch{}return{unsubscribe:xMf}}if(f.listeners.add(t),f.lastPhase)try{t(f.lastPhase)}catch{}return AS0(u,f,t)}let l=new AbortController,c={lastPhase:null,terminated:!1,listeners:new Set([t]),abort:l};return bg.set(u,c),kMf(i,u,c),AS0(u,c,t)}function xMf(){}function AS0(i,u,t){return{unsubscribe(){if(bg.get(i)!==u)return;if(u.listeners.delete(t),u.listeners.size===0)bg.delete(i),u.abort.abort()}}}async function kMf(i,u,t){let f=null;try{for await(let l of i.watchClaimLifecycle(u,t.abort.signal)){if(t.abort.signal.aborted)break;t.lastPhase=l;let c=l.kind==="ready"||l.kind==="failed";if(c)t.terminated=!0;let E=Array.from(t.listeners);for(let $ of E)try{$(l)}catch{}if(c)break}}catch(l){f=l}finally{if(!t.terminated&&!t.abort.signal.aborted&&t.listeners.size>0){let l={kind:"failed",reason:"unknown",message:f instanceof Error?f.message:"Lifecycle watcher ended unexpectedly"};t.lastPhase=l,t.terminated=!0;for(let c of Array.from(t.listeners))try{c(l)}catch{}}if(bg.get(u)===t)bg.delete(u)}}function GMf(){for(let i of bg.values())i.abort.abort();bg.clear()}var NMf,yMf,IS0,PS0,lcu,AMf,IMf,bg;var ko=g(()=>{Zd();lE();jl();rhi();to();eV();vt();NMf=Symbol.for("decocms.sandbox.lifecycle.runners"),yMf=Symbol.for("decocms.sandbox.lifecycle.inflight"),IS0=globalThis,PS0=IS0[NMf]??={},lcu=IS0[yMf]??={};AMf=Symbol.for("decocms.sandbox.lifecycle.shared-lifecycles"),IMf=globalThis,bg=IMf[AMf]??=new Map});async function Pd(i,u){let{userId:t,branch:f,virtualMcpMetadata:l,explicitKind:c}=u;if(c)return{provider:await Go(i,t,c),kind:c};if(i.sandboxPreference==="agent-sandbox")return{provider:await Go(i,t,"agent-sandbox"),kind:"agent-sandbox"};if(i.sandboxPreference==="user-desktop")return{provider:await NTi(i,t),kind:"user-desktop"};if(i.sandboxPreference==="cluster-default"){let h=S8();return{provider:await Go(i,t,h),kind:h}}let[E,...$]=SMf(l,t,f);if(E){let h=$.length===0?E:jMf(E,$);return{provider:await Go(i,t,h),kind:h}}let w=SS0();return{provider:await Go(i,t,w),kind:w}}function SMf(i,u,t){let f=Il(i)[u]?.[t];if(!f)return[];let l=h3(f);return Object.keys(l)}function jMf(i,u){let t=SS0();if(t===i||u.includes(t))return t;return i}function SS0(){return S8()}async function Go(i,u,t){if(t!=="user-desktop")return ccu(i,t);return NTi(i,u)}var MK=g(()=>{Rt();Zd();nw();ko()});var So;var wcu=g(()=>{So={npm:{install:"npm install",run:(i)=>`npm run ${i}`,runtime:"node"},pnpm:{install:"pnpm install",run:(i)=>`pnpm run ${i}`,runtime:"node"},yarn:{install:"yarn install",run:(i)=>`yarn run ${i}`,runtime:"node"},bun:{install:"bun install",run:(i)=>`bun run ${i}`,runtime:"bun"},deno:{install:"deno install",run:(i)=>`deno task ${i}`,runtime:"deno"}}});function yTi(i){if(!i)return null;let u=i.runtime;if(!u||typeof u!=="object")return null;let t=u.env;if(!Array.isArray(t))return null;let f=[];for(let l of t){if(!l||typeof l!=="object")continue;let c=l;if(typeof c.key!=="string"||!DV.test(c.key))continue;if(c.kind==="literal"&&typeof c.value==="string"){f.push({key:c.key,kind:"literal",value:c.value});continue}if(c.kind==="secret"&&typeof c.secretId==="string"&&c.secretId.length>0)f.push({key:c.key,kind:"secret",secretId:c.secretId})}return f.length===0?null:f}async function jS0(i,u){ki(u);let t=yi(u);await u.access.check();let f=Hu(u);if(!f)throw Error("User ID required");let l=await u.storage.virtualMcps.findById(i.virtualMcpId);if(!l||l.organization_id!==t.id)throw Error("Virtual MCP not found");let c=l.metadata??{},E=Il(c),$=_5(E,f,i.branch,i.sandboxProviderKind);return{virtualMcp:l,metadata:c,userId:f,entry:$,organization:t}}function ZTi(i){let u=i.runtime??null,f=u?.selected??null,l=u?.port??null,c=u?.path??null;if(!f||!(f in So))return{packageManager:null,runtime:null,port:l,packageManagerPath:c,runtimeBinPath:null};let E=So[f].runtime;return{packageManager:f,runtime:E,port:l,packageManagerPath:c,runtimeBinPath:E==="deno"?"/opt/deno/bin":E==="bun"?"/opt/bun/bin":null}}var $H=g(()=>{Rt();wcu();nw()});async function TTi({ctx:i,runner:u,handle:t,orgId:f,userId:l,entries:c}){if(!c||c.length===0)return;let E={};for(let w of c){if(w.kind==="literal"){E[w.key]=w.value;continue}try{let{value:d}=await i.storage.secrets.resolveById(w.secretId,f,l);E[w.key]=d}catch(d){if(d instanceof Yv||d instanceof jQ){console.warn(`[SANDBOX_START] skipping env ${w.key}: ${d.message}. Re-link or recreate the secret to restore.`);continue}throw d}}if(Object.keys(E).length===0)return;let $=await u.proxyDaemonRequest(t,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({env:E})});if(!$.ok){let w=await $.text().catch(()=>$.statusText);console.warn(`[SANDBOX_START] daemon rejected env patch (${$.status}): ${w}`)}}var dcu=g(()=>{Xwi()});async function XS0(i,u,t,f,l){let c=await lg({connectionId:i,tokenStorage:new al(f,l)});if(!c.accessToken)return null;return WS0(u,t,c.accessToken)}function LS0(i,u){return WS0(i,u,null)}async function WS0(i,u,t){let f=new Map,l=new Set(KS0.map((w)=>w.path));for(let w of Object.values(JS0))for(let d of w??[])l.add(d);await Promise.all(Array.from(l).map(async(w)=>{f.set(w,await JMf(i,u,w,t))}));let c=KS0.find(({path:w})=>f.get(w)!==null);if(!c)return null;let E=JS0[c.pm]??[],$=null;for(let w of E)if($=XMf(f.get(w)??null),$)break;return{packageManager:c.pm,devPort:$}}async function JMf(i,u,t,f){let l=`https://api.github.com/repos/${i}/${u}/contents/${encodeURIComponent(t)}`;try{let c={Accept:"application/vnd.github+json","User-Agent":"mesh-runtime-detect"};if(f)c.Authorization=`token ${f}`;let E=await fetch(l,{headers:c,signal:AbortSignal.timeout(5000)});if(!E.ok)return null;let $=await E.json();if(!$.content||$.encoding!=="base64")return null;return Buffer.from($.content,"base64").toString("utf8")}catch{return null}}function XMf(i){if(!i)return null;try{let u=JSON.parse(i),t=u.tasks??u.scripts??{};return(t.dev??t.start??"").match(KMf)?.[1]??null}catch{return null}}var KS0,JS0,KMf;var YS0=g(()=>{cg();D_();KS0=[{path:"deno.json",pm:"deno"},{path:"deno.jsonc",pm:"deno"},{path:"bun.lock",pm:"bun"},{path:"bunfig.toml",pm:"bun"},{path:"pnpm-lock.yaml",pm:"pnpm"},{path:"yarn.lock",pm:"yarn"},{path:"package-lock.json",pm:"npm"},{path:"package.json",pm:"bun"}],JS0={deno:["deno.json","deno.jsonc"],bun:["package.json"],pnpm:["package.json"],yarn:["package.json"],npm:["package.json"]},KMf=/(?:--port|PORT=|:)(\d{4,5})/});function BTi(i,u){return u?`thread:${i}/${u}`:`thread:${i}`}function wH(i){if(!i||!i.startsWith("thread:"))return null;return i.slice(7).split("/")[0]||null}async function FTi(i,u){if(!u)return null;let t=await i.storage.threads.get(u).catch(()=>null);if(!t)return null;return t.metadata??{}}async function jo(i,u){return(await FTi(i,u))?.githubRepo??null}async function QS0(i,u,t,f,l,c){let E=await FTi(i,u);if(!E)return;let $=uo(Il(E),t,f,l,c);await i.storage.threads.update(u,{metadata:{...E,sandboxMap:$}}).catch((w)=>console.warn("[thread-repo] setThreadSandboxMapEntry failed",w))}async function zS0(i,u){return Il(await FTi(i,u))}async function HS0(i,u,t,f,l){let c=await FTi(i,u);if(!c)return;let E=m4u(Il(c),t,f,l);if(!E)return;await i.storage.threads.update(u,{metadata:{...c,sandboxMap:E}}).catch(($)=>console.warn("[thread-repo] removeThreadSandboxMapEntry failed",$))}var Ko=g(()=>{nw()});async function UTi(i,u){if(!i)return{hosts:[],allowSameHostDev:!1};let t;try{t=await i.presignedGetUrl("link-dispatch/_allowlist_probe",60,{requireFetchable:!0})}catch{return{hosts:[],allowSameHostDev:!1}}let f;try{f=new URL(t)}catch{return{hosts:[],allowSameHostDev:!1}}if(f.protocol!=="https:"&&f.protocol!=="http:")return{hosts:[],allowSameHostDev:!1};let l=f.hostname,c=LMf.has(l);return{hosts:[l],allowSameHostDev:c&&!u.isProduction}}var LMf;var hcu=g(()=>{LMf=new Set(["127.0.0.1","localhost","::1","[::1]","0.0.0.0"])});import{z as N5}from"zod";async function PTi(i,u){ki(u);let t=yi(u),f=Hu(u);if(!f)throw Error("User ID required");let l=await u.storage.virtualMcps.findById(i.virtualMcpId);if(!l||l.organization_id!==t.id)throw Error("Virtual MCP not found");let c=l.metadata??{},E=_5(Il(c),f,i.branch,i.sandboxProviderKind),$=i.sandboxProviderKind,{provider:w}=await Pd(u,{userId:f,branch:i.branch,virtualMcpMetadata:c,explicitKind:$});if(E){if($!=="user-desktop")return E;if(await w.alive(E.sandboxHandle).catch(()=>!1))return E;await Ig(u.storage.virtualMcps,i.virtualMcpId,f,f,i.branch,$).catch((D)=>{console.warn("[ensureSandbox] failed to reap stale user-desktop entry",D)})}let h=await jo(u,wH(i.branch)??u.metadata?.threadId)??c.githubRepo??null,{entry:_}=await RS0({ctx:u,userId:f,orgId:t.id,virtualMcpId:i.virtualMcpId,branch:i.branch,metadata:c,githubRepo:h,existing:null,providerKind:$,runner:w});return _}async function RS0(i){let{ctx:u,userId:t,orgId:f,virtualMcpId:l,branch:c,metadata:E,githubRepo:$,existing:w,runner:d}=i,{runtime:h,packageManager:_,port:v,packageManagerPath:D}=ZTi(E),n;if($){if($.connectionId)await qz({ctx:u,connectionId:$.connectionId,organizationId:f,forceRefresh:!0,onLegacyMintError:(fi)=>{console.error("[provisionSandbox] repo-scoped legacy token mint failed",{connectionId:$.connectionId,error:fi.message})}});let{cloneUrl:Y,gitUserName:li,gitUserEmail:di}=$.connectionId?await kg($.connectionId,$.owner,$.name,u.db,u.vault):mhi($.owner,$.name);if(!_){let fi=$.connectionId?await XS0($.connectionId,$.owner,$.name,u.db,u.vault):await LS0($.owner,$.name);if(fi)_=fi.packageManager,h=So[fi.packageManager].runtime,v=fi.devPort??v,await YMf(u,l,t,fi.packageManager,fi.devPort)}n={cloneUrl:Y,...$.connectionId?{connectionId:$.connectionId}:{},userName:li,userEmail:di,branch:c,displayName:`${$.owner}/${$.name}`}}let O=h&&_?{runtime:h,packageManager:_,...v!==null?{devPort:Number(v)}:{},...D?{packageManagerPath:D}:{}}:void 0,N=G8({orgId:f,virtualMcpId:l,branch:c}),y=d.kind==="user-desktop"?await UTi(u.objectStorage,{isProduction:yu().nodeEnv==="production"}):null,Z=(d.kind==="user-desktop"||d.kind==="agent-sandbox")&&!yu().orgFsMountsDisabled,T;if(Z){let Y=u.organization?.slug??(await u.db.selectFrom("organization").select(["slug"]).where("id","=",f).executeTakeFirst())?.slug;if(Y)T=await w3i(u,{orgSlug:Y,orgId:f,baseUrl:hh()})}let B=await d.ensure({userId:t,projectRef:N},{branch:c,repo:n,workload:O,tenant:{orgId:f,userId:t,...u.organization?.slug?{orgSlug:u.organization.slug}:{},...u.organization?.name?{orgName:u.organization.name}:{},...u.auth.user?.email?{userEmail:u.auth.user.email}:{},...u.auth.user?.name?{userName:u.auth.user.name}:{}},...y?{offloadAllowedHosts:y.hosts,offloadAllowSameHostDev:y.allowSameHostDev}:{},...T?{orgFsConfigJson:T}:{}}),F=E.runtime?.env??null;await TTi({ctx:u,runner:d,handle:B.handle,orgId:f,userId:t,entries:F});let G=!!w&&w.sandboxHandle===B.handle&&w?.createdAt?w.createdAt:Date.now(),I=E.runtime?.selected??null,k=E.runtime?.port??null,q=E.runtime?.path??null,J={sandboxHandle:B.handle,previewUrl:B.previewUrl,sandboxApiUrl:B.previewUrl,sandboxProviderKind:d.kind,createdAt:G,startedWith:{packageManager:I,port:k,path:q}};await OU0(u.storage.virtualMcps,l,t,t,c,i.providerKind,J);let W=wH(c);if(W)await QS0(u,W,t,c,i.providerKind,J);let r=!w||w.sandboxHandle!==B.handle;return{entry:J,isNewVm:r}}async function YMf(i,u,t,f,l){let c=await i.storage.virtualMcps.findById(u);if(!c)return;let E=c.metadata??{};await i.storage.virtualMcps.update(u,t,{metadata:{...E,runtime:{selected:f,port:l}}})}var WMf,_cu;var ATi=g(()=>{Zd();Eu();$H();dcu();nw();to();YS0();wcu();MK();Ko();hcu();vt();cE();Nz();nw();WMf=N5.enum(["agent-sandbox","user-desktop","cluster"]),_cu=ti({name:"SANDBOX_START",description:"Start a sandbox with the connected GitHub repo and dev server.",annotations:{title:"Start VM Preview",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:N5.object({virtualMcpId:N5.string().describe("Virtual MCP ID"),branch:N5.string().min(1).optional().describe("Optional git branch to check out. When omitted the handler generates a Bayer-style `<greek-letter>-<constellation>` name (e.g. `alpha-centauri`) and uses it. The resolved branch is returned in the response so callers can persist it."),sandboxProviderKind:WMf.optional().describe("Explicit runtime choice. Hosted provider is `agent-sandbox`; legacy `cluster` input is accepted only for compatibility and normalized to `agent-sandbox`. When omitted, defaults to `user-desktop` if the acting user's link daemon is online, else the env kind.")}),outputSchema:N5.object({previewUrl:N5.string().nullable(),sandboxHandle:N5.string(),branch:N5.string(),isNewVm:N5.boolean(),sandboxProviderKind:N5.enum(["agent-sandbox","user-desktop"])}),handler:async(i,u)=>{ki(u);let t=yi(u);await u.access.check();let f=i.branch??xhi(u.auth.user?.name??u.auth.user?.email?.split("@")[0]),l=Hu(u);if(!l)throw Error("User ID required");let c=await u.storage.virtualMcps.findById(i.virtualMcpId);if(!c||c.organization_id!==t.id)throw Error("Virtual MCP not found");let E=c.metadata??{},$=i.sandboxProviderKind?k8(i.sandboxProviderKind):void 0,{provider:w,kind:d}=await Pd(u,{userId:l,branch:f,virtualMcpMetadata:E,explicitKind:$}),h=_5(Il(E),l,f,d),v=await jo(u,wH(f)??u.metadata?.threadId)??E.githubRepo??null,{entry:D,isNewVm:n}=await RS0({ctx:u,userId:l,orgId:t.id,virtualMcpId:i.virtualMcpId,branch:f,metadata:E,githubRepo:v,existing:h,providerKind:d,runner:w});return{...D,branch:f,isNewVm:n,sandboxProviderKind:d}}})});async function QMf(i,u,t,f){try{let l=i.organization;if(!l)return;let c=await qhi(i,f.virtualMcpId,l,"tool-scripting",f.providerKind),E=await u.proxyDaemonRequest(t,"/_sandbox/tools/sync",{method:"POST",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify(c)});if(!E.ok)console.warn("[cluster-sandbox-fs] tools/sync failed",E.status,await E.text().catch(()=>""))}catch(l){console.warn("[cluster-sandbox-fs] tools/sync failed",l)}}async function Jo(i,u){let{provider:t,kind:f}=await Pd(i,{userId:u.userId,branch:u.branch,virtualMcpMetadata:null}),l=null,c=()=>{if(!l){if(l=PTi({virtualMcpId:u.virtualMcpId,branch:u.branch,sandboxProviderKind:f},i).then((w)=>w.sandboxHandle),l.catch(()=>{l=null}),u.syncTools)l.then((w)=>QMf(i,t,w,{virtualMcpId:u.virtualMcpId,providerKind:f})).catch(()=>{})}return l},E=u.branch==="ephemeral"||f==="user-desktop";return L4u(t,{ensureHandle:c,invalidateHandle:async()=>{let w=l;if(l=null,!E)return;try{await Ig(i.storage.virtualMcps,u.virtualMcpId,u.userId,u.userId,u.branch,f)}catch(d){console.warn("[cluster-sandbox-fs] failed to reap vmMap entry",d)}if(w&&typeof t.forgetHandle==="function")try{let d=await w;await t.forgetHandle(d)}catch(d){console.warn("[cluster-sandbox-fs] forgetHandle failed",d)}},canAutoRestart:E})}async function bS0(i,u){try{let t=await Jo(i,u),{stdout:f}=await t.onBash("test -d .deco && echo __DECO_SITE__");return f.includes("__DECO_SITE__")}catch(t){return console.warn("[cluster-sandbox-fs] .deco probe failed; assuming deco site",t),!0}}var ITi=g(()=>{Zd();r4u();MK();ATi();nw()});function dH(i){let u=i.toISOString();return`<current-context>
 Current date: ${u.slice(0,10)}
 Current time: ${u.slice(11,16)} UTC
 </current-context>`}var CS0,MS0;var vcu=g(()=>{CS0={type:"ephemeral",ttl:"5m"},MS0={openrouter:{cache_control:{type:"ephemeral",ttl:"5m"}}}});function qS0(i,u){let t=[],f=i.length-1,l=i.length-2;for(let c=0;c<i.length;c++){let E=c===l||c===f;t.push({role:"system",content:i[c],...E?{providerOptions:zMf}:{}})}return t.push({role:"system",content:dH(u)}),t}var zMf;var VS0=g(()=>{vcu();zMf={anthropic:{cacheControl:CS0}}});function rS0(i){if(i.length===0)return null;return`
@@ -86947,7 +86947,7 @@ Guidelines:
 ${n}`:`[Uploaded files \u2014 use these URLs when calling tools]
 ${n}`,N=new Map(D.flatMap((B)=>B.dataUrl?[[B.dataUrl,B.meshStorageUrl]]:[])),y=c.parts.map((B)=>{if(B.type!=="file"||!("url"in B)||typeof B.url!=="string")return B;let F=N.get(B.url);if(!F)return B;return{...B,url:F}}),Z=y.findIndex((B)=>B.type==="text"),T;if(Z!==-1)T=y.map((B,F)=>{if(F!==Z||B.type!=="text")return B;return{...B,text:`${O}
 
-${"text"in B?B.text:""}`.trim()}});else T=[{type:"text",text:O},...y];return[...i.slice(0,l),{...c,parts:T},...i.slice(l+1)]}async function RTi(i,u){if(!u.organization)return i;let t=i.map(($)=>{let w=$.parts.filter((d)=>!iVf(d));return w.length===$.parts.length?$:{...$,parts:w}}),f=new Set;for(let $ of t)for(let w of $.parts)if(w.type==="file"&&"url"in w&&typeof w.url==="string"){let d=io(w.url);if(d)f.add(d)}let l=Q3(),c=new Map;if(await Promise.all(Array.from(f).map(async($)=>{let w=await Yo($,u);if(!w)return;if(l&&!w.startsWith("https://"))try{let d=await u.objectStorage.getBytes($);if(d.byteLength<=_K0){c.set($,{kind:"bytes",b64:Buffer.from(d).toString("base64")});return}console.warn(`[file-materializer] dev inline skipped (${d.byteLength}B > ${_K0}B):`,$)}catch(d){console.error("[file-materializer] dev inline read failed; passing URL through:",d)}c.set($,{kind:"url",url:w})})),c.size===0)return cVf(t,u);return t.map(($)=>{let w=$.parts.map((h)=>{if(h.type==="file"&&"url"in h&&typeof h.url==="string"){let _=io(h.url);if(_){let v=c.get(_);if(v?.kind==="url")return{...h,url:v.url};if(v?.kind==="bytes"){let D="mediaType"in h&&typeof h.mediaType==="string"?h.mediaType:"application/octet-stream";return{...h,url:`data:${D};base64,${v.b64}`}}}}return h});return w.some((h,_)=>h!==$.parts[_])?{...$,parts:w}:$})}async function NK0(i,u){let t=new Set;if(Gcu(i,t),t.size===0)return i;let f=new Map;if(await Promise.all(Array.from(t).map(async(l)=>{let c=await Yo(l,u);if(c)f.set(l,c)})),f.size===0)return i;return Scu(i,f)}function Gcu(i,u){if(typeof i==="string")for(let t of i.matchAll(z4u()))u.add(t[1]);else if(Array.isArray(i))for(let t of i)Gcu(t,u);else if(i!==null&&typeof i==="object")for(let t of Object.values(i))Gcu(t,u)}function Scu(i,u){if(typeof i==="string")return i.replace(z4u(),(t,f)=>u.get(f)??J6(f));if(Array.isArray(i))return i.map((t)=>Scu(t,u));if(i!==null&&typeof i==="object")return Object.fromEntries(Object.entries(i).map(([t,f])=>[t,Scu(f,u)]));return i}async function cVf(i,u){let t=i.findLastIndex((d)=>d.role==="user");if(t===-1)return i;let f=i[t],l=f.parts.filter((d)=>d.type==="file"&&("url"in d)&&typeof d.url==="string"&&d.url.startsWith("data:"));if(l.length===0)return i;let E=(await Promise.all(l.map(async(d)=>{if(d.type!=="file"||!("url"in d)||typeof d.url!=="string")return null;let h=gK0(d.url);if(!h)return null;let _=kcu(h.mimeType),v=`chat-uploads/${crypto.randomUUID()}.${_}`,D=await uVf(h.bytes,v,h.mimeType,u);if(!D)return null;let n=await Yo(D,u);return n?{dataUrl:d.url,presigned:n}:null}))).filter((d)=>d!==null);if(E.length===0)return i;let $=new Map(E.map((d)=>[d.dataUrl,d.presigned])),w=f.parts.map((d)=>{if(d.type!=="file"||!("url"in d)||typeof d.url!=="string")return d;let h=$.get(d.url);return h?{...d,url:h}:d});return[...i.slice(0,t),{...f,parts:w},...i.slice(t+1)]}var pqf,tVf=604800,_K0=20971520,fVf,lVf;var DH=g(()=>{qg();Zq();uv();hK0();pqf=new Set(["application/vnd.openxmlformats-officedocument.presentationml.presentation","application/vnd.openxmlformats-officedocument.wordprocessingml.document","application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"]);fVf=/^\[file::\/\/(.+?)\]$/,lVf=/^\[file::\/\/(.+?)\]\n([\s\S]*)$/});function bTi(i,u){return{resolveArgs:(t)=>NK0(t,i),onToolCalled:(t)=>{if(!t.isError&&xF0(t.toolName))Yz(i,"in_review",u);let f=i.organization?.id,l=i.auth?.user?.id;if(!f||!l)return;mu.capture({distinctId:l,event:"tool_called",groups:{organization:f},properties:{organization_id:f,tool_source:"mcp",tool_name:t.toolName,tool_safe_name:t.toolSafeName,read_only:t.annotations?.readOnlyHint??null,destructive:t.annotations?.destructiveHint??null,idempotent:t.annotations?.idempotentHint??null,open_world:t.annotations?.openWorldHint??null,latency_ms:Math.round(t.latencyMs),is_error:t.isError}})},onPrOpened:(t)=>{Bhi(i,t.result,t.connectionId,u)}}}var jcu=g(()=>{H4();DH();I8()});function yK0(i){if(i instanceof Error)return i.message;if(typeof i==="string")return i;if(typeof i==="object"&&i!==null){let u=i.message;if(typeof u==="string")return u;try{return JSON.stringify(i)}catch{return String(i)}}return String(i)}function ZK0(i){let u,t,f=new Promise(($)=>{t=$}),l=($)=>{if(u===void 0)u=$;t(u)},E=(i.streamText??X3)({model:i.model,system:i.systemMessages,messages:i.messages,tools:i.tools,providerOptions:MS0,prepareStep:i.prepareStep,temperature:i.temperature,maxOutputTokens:i.maxOutputTokens,stopWhen:i.stopWhen,abortSignal:i.abortSignal,onStepFinish:i.onStepFinish,onError:async($)=>{let w=$.error??$,d=yK0(w);i.onError?.(d,w),l(d)},onAbort:async()=>{l(u??"Run aborted before completion.")}});return Promise.resolve(E.finishReason).then(()=>{if(u===void 0)t(void 0)}).catch(($)=>{let w=yK0($);i.onError?.(w,$),l(w)}),{result:E,error:f}}var TK0=g(()=>{Pf();vcu()});import{SpanStatusCode as Kcu,trace as EVf}from"@opentelemetry/api";async function _H(i){let u=i.tracer??EVf.getTracer("decopilot"),t=i.stepLimit??(i.kind==="agent"?_50:Y7),f=i.planMode??!1,l=i.toolApprovalLevel??"auto",c=u.startSpan("decopilot.agent_loop",{attributes:{"decopilot.agent.id":i.virtualMcp.id,"decopilot.agent.kind":i.kind,"decopilot.organization.id":i.organization.id,"decopilot.model.id":i.models.thinking.id}}),E=await $j0({ctx:i.ctx,organization:i.organization,virtualMcp:i.virtualMcp,kind:i.kind,planMode:f,isDecopilot:i.isDecopilot,agentInstructions:i.systemAgentInstructions,currentThreadId:i.currentThreadId,user:i.user,userContext:i.userContext,codingWorkspace:i.codingWorkspace,passthroughClient:i.passthroughClient,connectionsData:i.connectionsData}),$=i.additionalSystemMessages&&i.additionalSystemMessages.length>0?[...E,...i.additionalSystemMessages]:E,{resolveArgs:w,onToolCalled:d,onPrOpened:h}=bTi(i.ctx,i.currentThreadId),{tools:_}=await EK0({kind:i.kind,ctx:i.ctx,mcpClient:i.mcpClient,writer:i.writer,planMode:f,toolApprovalLevel:l,subtaskParams:i.subtaskParams,resolveArgs:w,onToolCalled:d,onPrOpened:h,fullBuiltInParams:i.subagentBuiltInParams}),v=i.extraTools?{..._,...i.extraTools}:_,D=i.__streamText?void 0:Rhi(i.provider,i.models.thinking),n=(N)=>{for(let y of N.toolCalls??[]){let Z=y.input?.command;if(y.toolName==="bash"&&Z&&kF0(Z)){Yz(i.ctx,"in_review",i.currentThreadId);let T=(N.toolResults??[]).find((B)=>B.toolCallId===y.toolCallId);Bhi(i.ctx,T?.output,null,i.currentThreadId);break}}return i.onStepFinish?.(N)},O=ZK0({model:D,systemMessages:$,messages:i.messages,tools:v,prepareStep:i.prepareStep,temperature:i.temperature,maxOutputTokens:nU0(i.models.thinking.limits,kE($)+kE(i.messages)+kE(v)),stopWhen:Og(t),abortSignal:i.abortSignal,onStepFinish:n,streamText:i.__streamText,onError:(N,y)=>{if(console.error(`[runAgentLoop:${i.kind}:${i.virtualMcp.id}] Error`,N),c.setStatus({code:Kcu.ERROR,message:N}),y instanceof Error)c.recordException(y)}});return Promise.resolve(O.result.finishReason).then(()=>{c.setStatus({code:Kcu.OK})}).catch((N)=>{let y=N instanceof Error?N.message:typeof N==="string"?N:`${N}`;c.setStatus({code:Kcu.ERROR,message:y})}).finally(()=>c.end()),{result:O.result,error:O.error,span:c,assembledSystemMessages:$}}var jTi=g(()=>{Pf();C4u();j8();wy();wj0();$K0();jcu();I8();TK0()});function CTi(){let i=[],u=!1,t=null,f=()=>{let E=t;t=null,E?.()},l=(E)=>{if(u)return;i.push(E),f()},c=async function*(){try{while(!u||i.length>0){let E=i.shift();if(E){yield E;continue}await new Promise(($)=>{t=$})}}finally{u=!0,f()}}();return{writer:{write:(E)=>l(E),merge:async(E)=>{let $=E;if(typeof $[Symbol.asyncIterator]==="function"){for await(let d of $)l(d);return}let w=E.getReader();try{while(!0){let{value:d,done:h}=await w.read();if(h)return;l(d)}}finally{w.releaseLock()}},onError:()=>{}},stream:c,close:()=>{u=!0,f()}}}async function wVf(i){let u=i.getReader();try{while(!0){let{done:t}=await u.read();if(t)return}}finally{u.releaseLock()}}async function MTi(i,u){let{runId:t,fenceToken:f}=i,l=i.fenceOk??(()=>!0),c=i.initialAckSeq??0,E=new Set,$;async function*w(){try{for await(let{seq:_,chunk:v}of i.chunks){if(!await l())continue;if(_<=c||E.has(_))continue;if(!await u.streamBuffer.publishRawChunk(t,v,{fenceToken:f,seq:_}))throw Error("publishRawChunk failed");E.add(_);let D=c;while(E.has(c+1))E.delete(c+1),c+=1;if(c>D)i.onPublished?.(c);yield v}}catch(_){throw $=_,_}}let{uiStream:d,whenComplete:h}=_hi({chunks:w(),originalMessages:i.originalMessages,title:{...u.title,persistTitle:async()=>{}},persistence:u.persistence??$Vf,hooks:u.hooks,errorMessageId:i.errorMessageId});if(await wVf(d),await h,$!==void 0){if($ instanceof Error)$.lastAckSeq=c;throw $}if(c>0)await u.streamBuffer.publishDone(t,f,c)}var $Vf;var Jcu=g(()=>{Rfu();$Vf={emitStepParts:async()=>{},emitFinal:async()=>{},emitError:async()=>{}}});import{DBOS as qK,DBOSClient as dVf}from"@dbos-inc/dbos-sdk";function UK0(i){Xcu=i}function VTi(){if(!Xcu)throw Error("[background-tool] DBOS runtime not initialized \u2014 setBackgroundToolRuntime() must run before workflows fire");return Xcu}function hVf(){return BK0??=dVf.create({systemDatabaseUrl:VTi().systemDatabaseUrl,systemDatabaseSchemaName:"dbos"}),BK0}function qTi(i){let u=i.modelMeta.capabilities;return{id:i.modelId,title:i.modelMeta.title??i.modelId,provider:i.modelMeta.providerId??null,capabilities:u&&u.length>0?{vision:u.includes("vision")||u.includes("image")||void 0,text:u.includes("text")||void 0,reasoning:u.includes("reasoning")||void 0}:void 0,limits:i.modelMeta.limits?{contextWindow:i.modelMeta.limits.contextWindow,maxOutputTokens:i.modelMeta.limits.maxOutputTokens??void 0}:void 0}}async function Lcu(i){let[u,t,f,l]=await Promise.all([T_(i,"smart"),K3(i,"image"),K3(i,"web_search"),K3(i,"deep_research")]);return{credentialId:u.credentialId,thinking:qTi(u),...t?{image:{...qTi(t),credentialId:t.credentialId}}:{},...f?{webSearch:{...qTi(f),credentialId:f.credentialId}}:{},...l?{deepResearch:{...qTi(l),credentialId:l.credentialId}}:{}}}async function rTi(i){let u=await VTi().studioContextFactory(i.orgId,i.userId);if(!u)throw Error(`[background-tool] mesh context unavailable for org ${i.orgId} user ${i.userId}`);return u}function PK0(i){return{target:Xhi({sandboxProviderKind:i?.sandbox_provider_kind??"agent-sandbox"}),harnessId:i?.harness_id??"decopilot"}}function AK0(i,u){return{messages:[{id:`${i.jobId}:react-msg`,role:"user",metadata:{internal:!0},parts:[{type:"text",text:u.nudge}]}],models:u.models,agent:{id:i.agentId},temperature:i.temperature,toolApprovalLevel:i.toolApprovalLevel,mode:"default",organizationId:i.orgId,userId:i.userId,taskId:i.threadId,branch:i.branch??void 0,resumedFromBackground:!0,target:u.target,harnessId:u.harnessId??void 0}}function _Vf(i){return{ctx:i,studioContext:()=>rTi(i),emitFinal:(u)=>qK.runStep(()=>OVf(i,u),{name:"appendResult"})}}function DVf(i){if(!i?.parts)return"";return i.parts.map((u)=>u&&typeof u==="object"&&u.type==="text"?u.text??"":"").filter((u)=>u.trim().length>0).join("").trim()}async function nVf(i){let u=await rTi(i),t=u.organization;if(!t)throw Error(`[background-tool] organization context unavailable for subtask (org ${i.orgId})`);let f=i.input,l=!f.agent_id||f.agent_id===i.agentId,c=l?i.agentId:f.agent_id,E=await Lcu(u),$=await u.aiProviders.activate(E.credentialId,i.orgId),w={thinking:{...E.thinking,credentialId:E.credentialId},...E.image?{image:E.image}:{},...E.webSearch?{webSearch:E.webSearch}:{},...E.deepResearch?{deepResearch:E.deepResearch}:{}},{mcpClient:d,targetKind:h,targetRef:_}=await STi(u,i.orgId,c,{superUser:l}),v=w.image,D=w.webSearch,n=w.deepResearch,O=v?.credentialId?await u.aiProviders.activate(v.credentialId,i.orgId):null,N=D?.credentialId?await u.aiProviders.activate(D.credentialId,i.orgId):null,y=n?.credentialId?await u.aiProviders.activate(n.credentialId,i.orgId):null,Z={provider:$,imageProvider:O,webSearchProvider:N,deepResearchProvider:y,organization:t,models:w,toolApprovalLevel:i.toolApprovalLevel,isPlanMode:!1,passthroughClient:d,pendingImages:[],vmContext:h==="virtual-mcp"?{virtualMcpId:_.id,branch:_.repo?i.branch??`thread:${i.threadId}`:"ephemeral",userId:i.userId,threadId:i.threadId}:null,taskId:i.threadId,agentId:_.id,backgroundDispatcher:null},T=CTi(),B=Y4u(i.threadId),F="",A="stop";try{let G=await _H({kind:"subagent",ctx:u,organization:t,virtualMcp:_,mcpClient:d,provider:$,models:w,messages:[{role:"user",content:f.prompt}],systemAgentInstructions:_.instructions,abortSignal:B.signal,stepLimit:Y7,toolApprovalLevel:"auto",planMode:!1,writer:T.writer,subtaskParams:{provider:$,organization:t,models:w,needsApproval:!1},passthroughClient:d,subagentBuiltInParams:Z}),I=0,k=G.result.toUIMessageStream({generateMessageId:()=>`${i.jobId}:msg:${I++}`,messageMetadata:({part:r})=>r.type==="start"?{subtaskJobId:i.jobId}:void 0}),q=0;async function*J(){let r=k.getReader();try{while(!0){let{done:Y,value:li}=await r.read();if(Y)break;yield{seq:++q,chunk:li}}}finally{r.releaseLock()}}let W=new D$({storage:u.storage.threads.messageParts(),orgId:i.orgId,threadId:i.threadId,runId:i.jobId});return await MTi({runId:i.jobId,fenceToken:i.jobId,chunks:J()},{streamBuffer:VTi().streamBuffer,persistence:W,title:{threadId:i.threadId,currentThreadTitle:void 0,persistTitle:async()=>{}},hooks:{onFinish:async(r,Y)=>{let li=DVf(r);if(li)F=li;if(Y)A=Y}}}),{report:F,finishReason:A,models:E}}finally{T.close(),Q4u(i.threadId,B),await d.close().catch(()=>{})}}async function gVf(i){let u=await i.studioContext(),t=await Lcu(u),f=t.image;if(!f?.credentialId)throw Error("[background-tool] no image model configured for org");let l=await u.aiProviders.activate(f.credentialId,i.ctx.orgId),c=Y4u(i.ctx.threadId);try{return{result:await H4u(i.ctx.input,{provider:l,imageModelInfo:{id:f.id},objectStorage:u.objectStorage,allowHttpExternalUrls:yu().localMode,abortSignal:c.signal}),models:t}}finally{Q4u(i.ctx.threadId,c)}}async function OVf(i,u){let t=await rTi(i);if(!await t.storage.threads.get(i.threadId))throw Error(`[background-tool] thread ${i.threadId} not found`);await new D$({storage:t.storage.threads.messageParts(),orgId:i.orgId,threadId:i.threadId,runId:i.jobId}).emitFinal({id:`${i.jobId}:msg`,role:"assistant",parts:u})}async function IK0(i){let{snapshot:u,jobId:t,report:f}=i,l={...u,jobId:t,toolName:"subtask",input:{},toolCallId:`${t}:deliver`},c=await rTi(l),E=f.trim().length>0;await new D$({storage:c.storage.threads.messageParts(),orgId:u.orgId,threadId:u.threadId,runId:t}).emitFinal({id:`${t}:result`,role:"assistant",parts:[{type:"text",text:E?f:"_The subtask produced no output._"}],metadata:{subtaskJobId:t}});let w=await Lcu(c),{target:d,harnessId:h}=PK0(await c.storage.threads.get(u.threadId)),_=E?`The background subtask you started has completed. Its result:
+${"text"in B?B.text:""}`.trim()}});else T=[{type:"text",text:O},...y];return[...i.slice(0,l),{...c,parts:T},...i.slice(l+1)]}async function RTi(i,u){if(!u.organization)return i;let t=i.map(($)=>{let w=$.parts.filter((d)=>!iVf(d));return w.length===$.parts.length?$:{...$,parts:w}}),f=new Set;for(let $ of t)for(let w of $.parts)if(w.type==="file"&&"url"in w&&typeof w.url==="string"){let d=io(w.url);if(d)f.add(d)}let l=Q3(),c=new Map;if(await Promise.all(Array.from(f).map(async($)=>{let w=await Yo($,u);if(!w)return;if(l&&!w.startsWith("https://"))try{let d=await u.objectStorage.getBytes($);if(d.byteLength<=_K0){c.set($,{kind:"bytes",b64:Buffer.from(d).toString("base64")});return}console.warn(`[file-materializer] dev inline skipped (${d.byteLength}B > ${_K0}B):`,$)}catch(d){console.error("[file-materializer] dev inline read failed; passing URL through:",d)}c.set($,{kind:"url",url:w})})),c.size===0)return cVf(t,u);return t.map(($)=>{let w=$.parts.map((h)=>{if(h.type==="file"&&"url"in h&&typeof h.url==="string"){let _=io(h.url);if(_){let v=c.get(_);if(v?.kind==="url")return{...h,url:v.url};if(v?.kind==="bytes"){let D="mediaType"in h&&typeof h.mediaType==="string"?h.mediaType:"application/octet-stream";return{...h,url:`data:${D};base64,${v.b64}`}}}}return h});return w.some((h,_)=>h!==$.parts[_])?{...$,parts:w}:$})}async function NK0(i,u){let t=new Set;if(Gcu(i,t),t.size===0)return i;let f=new Map;if(await Promise.all(Array.from(t).map(async(l)=>{let c=await Yo(l,u);if(c)f.set(l,c)})),f.size===0)return i;return Scu(i,f)}function Gcu(i,u){if(typeof i==="string")for(let t of i.matchAll(z4u()))u.add(t[1]);else if(Array.isArray(i))for(let t of i)Gcu(t,u);else if(i!==null&&typeof i==="object")for(let t of Object.values(i))Gcu(t,u)}function Scu(i,u){if(typeof i==="string")return i.replace(z4u(),(t,f)=>u.get(f)??J6(f));if(Array.isArray(i))return i.map((t)=>Scu(t,u));if(i!==null&&typeof i==="object")return Object.fromEntries(Object.entries(i).map(([t,f])=>[t,Scu(f,u)]));return i}async function cVf(i,u){let t=i.findLastIndex((d)=>d.role==="user");if(t===-1)return i;let f=i[t],l=f.parts.filter((d)=>d.type==="file"&&("url"in d)&&typeof d.url==="string"&&d.url.startsWith("data:"));if(l.length===0)return i;let E=(await Promise.all(l.map(async(d)=>{if(d.type!=="file"||!("url"in d)||typeof d.url!=="string")return null;let h=gK0(d.url);if(!h)return null;let _=kcu(h.mimeType),v=`chat-uploads/${crypto.randomUUID()}.${_}`,D=await uVf(h.bytes,v,h.mimeType,u);if(!D)return null;let n=await Yo(D,u);return n?{dataUrl:d.url,presigned:n}:null}))).filter((d)=>d!==null);if(E.length===0)return i;let $=new Map(E.map((d)=>[d.dataUrl,d.presigned])),w=f.parts.map((d)=>{if(d.type!=="file"||!("url"in d)||typeof d.url!=="string")return d;let h=$.get(d.url);return h?{...d,url:h}:d});return[...i.slice(0,t),{...f,parts:w},...i.slice(t+1)]}var pqf,tVf=604800,_K0=20971520,fVf,lVf;var DH=g(()=>{qg();Zq();uv();hK0();pqf=new Set(["application/vnd.openxmlformats-officedocument.presentationml.presentation","application/vnd.openxmlformats-officedocument.wordprocessingml.document","application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"]);fVf=/^\[file::\/\/(.+?)\]$/,lVf=/^\[file::\/\/(.+?)\]\n([\s\S]*)$/});function bTi(i,u){return{resolveArgs:(t)=>NK0(t,i),onToolCalled:(t)=>{if(!t.isError&&xF0(t.toolName))Yz(i,"in_review",u);let f=i.organization?.id,l=i.auth?.user?.id;if(!f||!l)return;mu.capture({distinctId:l,event:"tool_called",groups:{organization:f},properties:{organization_id:f,tool_source:"mcp",tool_name:t.toolName,tool_safe_name:t.toolSafeName,read_only:t.annotations?.readOnlyHint??null,destructive:t.annotations?.destructiveHint??null,idempotent:t.annotations?.idempotentHint??null,open_world:t.annotations?.openWorldHint??null,latency_ms:Math.round(t.latencyMs),is_error:t.isError}})},onPrOpened:(t)=>{Bhi(i,t.result,t.connectionId,u)}}}var jcu=g(()=>{H4();DH();I8()});function yK0(i){if(i instanceof Error)return i.message;if(typeof i==="string")return i;if(typeof i==="object"&&i!==null){let u=i.message;if(typeof u==="string")return u;try{return JSON.stringify(i)}catch{return String(i)}}return String(i)}function ZK0(i){let u,t,f=new Promise(($)=>{t=$}),l=($)=>{if(u===void 0)u=$;t(u)},E=(i.streamText??X3)({model:i.model,system:i.systemMessages,messages:i.messages,tools:i.tools,providerOptions:MS0,prepareStep:i.prepareStep,temperature:i.temperature,maxOutputTokens:i.maxOutputTokens,stopWhen:i.stopWhen,abortSignal:i.abortSignal,onStepFinish:i.onStepFinish,onError:async($)=>{let w=$.error??$,d=yK0(w);i.onError?.(d,w),l(d)},onAbort:async()=>{l(u??"Run aborted before completion.")}});return Promise.resolve(E.finishReason).then(()=>{if(u===void 0)t(void 0)}).catch(($)=>{let w=yK0($);i.onError?.(w,$),l(w)}),{result:E,error:f}}var TK0=g(()=>{Pf();vcu()});import{SpanStatusCode as Kcu,trace as EVf}from"@opentelemetry/api";async function _H(i){let u=i.tracer??EVf.getTracer("decopilot"),t=i.stepLimit??(i.kind==="agent"?_50:Y7),f=i.planMode??!1,l=i.toolApprovalLevel??"auto",c=u.startSpan("decopilot.agent_loop",{attributes:{"decopilot.agent.id":i.virtualMcp.id,"decopilot.agent.kind":i.kind,"decopilot.organization.id":i.organization.id,"decopilot.model.id":i.models.thinking.id}}),E=await $j0({ctx:i.ctx,organization:i.organization,virtualMcp:i.virtualMcp,kind:i.kind,planMode:f,isDecopilot:i.isDecopilot,agentInstructions:i.systemAgentInstructions,currentThreadId:i.currentThreadId,user:i.user,userContext:i.userContext,codingWorkspace:i.codingWorkspace,passthroughClient:i.passthroughClient,connectionsData:i.connectionsData}),$=i.additionalSystemMessages&&i.additionalSystemMessages.length>0?[...E,...i.additionalSystemMessages]:E,{resolveArgs:w,onToolCalled:d,onPrOpened:h}=bTi(i.ctx,i.currentThreadId),{tools:_}=await EK0({kind:i.kind,ctx:i.ctx,mcpClient:i.mcpClient,writer:i.writer,planMode:f,toolApprovalLevel:l,subtaskParams:i.subtaskParams,resolveArgs:w,onToolCalled:d,onPrOpened:h,fullBuiltInParams:i.subagentBuiltInParams}),v=i.extraTools?{..._,...i.extraTools}:_,D=i.__streamText?void 0:Rhi(i.provider,i.models.thinking),n=(N)=>{for(let y of N.toolCalls??[]){let Z=y.input?.command;if(y.toolName==="bash"&&Z&&kF0(Z)){Yz(i.ctx,"in_review",i.currentThreadId);let T=(N.toolResults??[]).find((B)=>B.toolCallId===y.toolCallId);Bhi(i.ctx,T?.output,null,i.currentThreadId);break}}return i.onStepFinish?.(N)},O=ZK0({model:D,systemMessages:$,messages:i.messages,tools:v,prepareStep:i.prepareStep,temperature:i.temperature,maxOutputTokens:nU0(i.models.thinking.limits,kE($)+kE(i.messages)+kE(v)),stopWhen:Og(t),abortSignal:i.abortSignal,onStepFinish:n,streamText:i.__streamText,onError:(N,y)=>{if(console.error(`[runAgentLoop:${i.kind}:${i.virtualMcp.id}] Error`,N),c.setStatus({code:Kcu.ERROR,message:N}),y instanceof Error)c.recordException(y)}});return Promise.resolve(O.result.finishReason).then(()=>{c.setStatus({code:Kcu.OK})}).catch((N)=>{let y=N instanceof Error?N.message:typeof N==="string"?N:`${N}`;c.setStatus({code:Kcu.ERROR,message:y})}).finally(()=>c.end()),{result:O.result,error:O.error,span:c,assembledSystemMessages:$}}var jTi=g(()=>{Pf();C4u();j8();wy();wj0();$K0();jcu();I8();TK0()});function CTi(){let i=[],u=!1,t=null,f=()=>{let E=t;t=null,E?.()},l=(E)=>{if(u)return;i.push(E),f()},c=async function*(){try{while(!u||i.length>0){let E=i.shift();if(E){yield E;continue}await new Promise(($)=>{t=$})}}finally{u=!0,f()}}();return{writer:{write:(E)=>l(E),merge:async(E)=>{let $=E;if(typeof $[Symbol.asyncIterator]==="function"){for await(let d of $)l(d);return}let w=E.getReader();try{while(!0){let{value:d,done:h}=await w.read();if(h)return;l(d)}}finally{w.releaseLock()}},onError:()=>{}},stream:c,close:()=>{u=!0,f()}}}async function wVf(i){let u=i.getReader();try{while(!0){let{done:t}=await u.read();if(t)return}}finally{u.releaseLock()}}async function MTi(i,u){let{runId:t,fenceToken:f}=i,l=i.fenceOk??(()=>!0),c=i.initialAckSeq??0,E=new Set,$;async function*w(){try{for await(let{seq:_,chunk:v}of i.chunks){if(!await l())continue;if(_<=c||E.has(_))continue;if(!await u.streamBuffer.publishRawChunk(t,v,{fenceToken:f,seq:_}))throw Error("publishRawChunk failed");E.add(_);let D=c;while(E.has(c+1))E.delete(c+1),c+=1;if(c>D)i.onPublished?.(c);yield v}}catch(_){throw $=_,_}}let{uiStream:d,whenComplete:h}=_hi({chunks:w(),originalMessages:i.originalMessages,title:{...u.title,persistTitle:async()=>{}},persistence:u.persistence??$Vf,hooks:u.hooks,errorMessageId:i.errorMessageId});if(await wVf(d),await h,$!==void 0){if($ instanceof Error)$.lastAckSeq=c;throw $}if(c>0)await u.streamBuffer.publishDone(t,f,c)}var $Vf;var Jcu=g(()=>{Rfu();$Vf={emitStepParts:async()=>{},emitFinal:async()=>{},emitError:async()=>{}}});import{DBOS as qK,DBOSClient as dVf}from"@dbos-inc/dbos-sdk";function UK0(i){Xcu=i}function VTi(){if(!Xcu)throw Error("[background-tool] DBOS runtime not initialized \u2014 setBackgroundToolRuntime() must run before workflows fire");return Xcu}function hVf(){return BK0??=dVf.create({systemDatabaseUrl:VTi().systemDatabaseUrl,systemDatabaseSchemaName:"dbos"}),BK0}function qTi(i){let u=i.modelMeta.capabilities;return{id:i.modelId,title:i.modelMeta.title??i.modelId,provider:i.modelMeta.providerId??null,capabilities:u&&u.length>0?{vision:u.includes("vision")||u.includes("image")||void 0,text:u.includes("text")||void 0,reasoning:u.includes("reasoning")||void 0}:void 0,limits:i.modelMeta.limits?{contextWindow:i.modelMeta.limits.contextWindow,maxOutputTokens:i.modelMeta.limits.maxOutputTokens??void 0}:void 0}}async function Lcu(i){let[u,t,f,l]=await Promise.all([T_(i,"smart"),K3(i,"image"),K3(i,"web_search"),K3(i,"deep_research")]);return{credentialId:u.credentialId,thinking:qTi(u),...t?{image:{...qTi(t),credentialId:t.credentialId}}:{},...f?{webSearch:{...qTi(f),credentialId:f.credentialId}}:{},...l?{deepResearch:{...qTi(l),credentialId:l.credentialId}}:{}}}async function rTi(i){let u=await VTi().studioContextFactory(i.orgId,i.userId);if(!u)throw Error(`[background-tool] studio context unavailable for org ${i.orgId} user ${i.userId}`);return u}function PK0(i){return{target:Xhi({sandboxProviderKind:i?.sandbox_provider_kind??"agent-sandbox"}),harnessId:i?.harness_id??"decopilot"}}function AK0(i,u){return{messages:[{id:`${i.jobId}:react-msg`,role:"user",metadata:{internal:!0},parts:[{type:"text",text:u.nudge}]}],models:u.models,agent:{id:i.agentId},temperature:i.temperature,toolApprovalLevel:i.toolApprovalLevel,mode:"default",organizationId:i.orgId,userId:i.userId,taskId:i.threadId,branch:i.branch??void 0,resumedFromBackground:!0,target:u.target,harnessId:u.harnessId??void 0}}function _Vf(i){return{ctx:i,studioContext:()=>rTi(i),emitFinal:(u)=>qK.runStep(()=>OVf(i,u),{name:"appendResult"})}}function DVf(i){if(!i?.parts)return"";return i.parts.map((u)=>u&&typeof u==="object"&&u.type==="text"?u.text??"":"").filter((u)=>u.trim().length>0).join("").trim()}async function nVf(i){let u=await rTi(i),t=u.organization;if(!t)throw Error(`[background-tool] organization context unavailable for subtask (org ${i.orgId})`);let f=i.input,l=!f.agent_id||f.agent_id===i.agentId,c=l?i.agentId:f.agent_id,E=await Lcu(u),$=await u.aiProviders.activate(E.credentialId,i.orgId),w={thinking:{...E.thinking,credentialId:E.credentialId},...E.image?{image:E.image}:{},...E.webSearch?{webSearch:E.webSearch}:{},...E.deepResearch?{deepResearch:E.deepResearch}:{}},{mcpClient:d,targetKind:h,targetRef:_}=await STi(u,i.orgId,c,{superUser:l}),v=w.image,D=w.webSearch,n=w.deepResearch,O=v?.credentialId?await u.aiProviders.activate(v.credentialId,i.orgId):null,N=D?.credentialId?await u.aiProviders.activate(D.credentialId,i.orgId):null,y=n?.credentialId?await u.aiProviders.activate(n.credentialId,i.orgId):null,Z={provider:$,imageProvider:O,webSearchProvider:N,deepResearchProvider:y,organization:t,models:w,toolApprovalLevel:i.toolApprovalLevel,isPlanMode:!1,passthroughClient:d,pendingImages:[],vmContext:h==="virtual-mcp"?{virtualMcpId:_.id,branch:_.repo?i.branch??`thread:${i.threadId}`:"ephemeral",userId:i.userId,threadId:i.threadId}:null,taskId:i.threadId,agentId:_.id,backgroundDispatcher:null},T=CTi(),B=Y4u(i.threadId),F="",A="stop";try{let G=await _H({kind:"subagent",ctx:u,organization:t,virtualMcp:_,mcpClient:d,provider:$,models:w,messages:[{role:"user",content:f.prompt}],systemAgentInstructions:_.instructions,abortSignal:B.signal,stepLimit:Y7,toolApprovalLevel:"auto",planMode:!1,writer:T.writer,subtaskParams:{provider:$,organization:t,models:w,needsApproval:!1},passthroughClient:d,subagentBuiltInParams:Z}),I=0,k=G.result.toUIMessageStream({generateMessageId:()=>`${i.jobId}:msg:${I++}`,messageMetadata:({part:r})=>r.type==="start"?{subtaskJobId:i.jobId}:void 0}),q=0;async function*J(){let r=k.getReader();try{while(!0){let{done:Y,value:li}=await r.read();if(Y)break;yield{seq:++q,chunk:li}}}finally{r.releaseLock()}}let W=new D$({storage:u.storage.threads.messageParts(),orgId:i.orgId,threadId:i.threadId,runId:i.jobId});return await MTi({runId:i.jobId,fenceToken:i.jobId,chunks:J()},{streamBuffer:VTi().streamBuffer,persistence:W,title:{threadId:i.threadId,currentThreadTitle:void 0,persistTitle:async()=>{}},hooks:{onFinish:async(r,Y)=>{let li=DVf(r);if(li)F=li;if(Y)A=Y}}}),{report:F,finishReason:A,models:E}}finally{T.close(),Q4u(i.threadId,B),await d.close().catch(()=>{})}}async function gVf(i){let u=await i.studioContext(),t=await Lcu(u),f=t.image;if(!f?.credentialId)throw Error("[background-tool] no image model configured for org");let l=await u.aiProviders.activate(f.credentialId,i.ctx.orgId),c=Y4u(i.ctx.threadId);try{return{result:await H4u(i.ctx.input,{provider:l,imageModelInfo:{id:f.id},objectStorage:u.objectStorage,allowHttpExternalUrls:yu().localMode,abortSignal:c.signal}),models:t}}finally{Q4u(i.ctx.threadId,c)}}async function OVf(i,u){let t=await rTi(i);if(!await t.storage.threads.get(i.threadId))throw Error(`[background-tool] thread ${i.threadId} not found`);await new D$({storage:t.storage.threads.messageParts(),orgId:i.orgId,threadId:i.threadId,runId:i.jobId}).emitFinal({id:`${i.jobId}:msg`,role:"assistant",parts:u})}async function IK0(i){let{snapshot:u,jobId:t,report:f}=i,l={...u,jobId:t,toolName:"subtask",input:{},toolCallId:`${t}:deliver`},c=await rTi(l),E=f.trim().length>0;await new D$({storage:c.storage.threads.messageParts(),orgId:u.orgId,threadId:u.threadId,runId:t}).emitFinal({id:`${t}:result`,role:"assistant",parts:[{type:"text",text:E?f:"_The subtask produced no output._"}],metadata:{subtaskJobId:t}});let w=await Lcu(c),{target:d,harnessId:h}=PK0(await c.storage.threads.get(u.threadId)),_=E?`The background subtask you started has completed. Its result:
 
 ${f}
 
@@ -88147,9 +88147,9 @@ ${l}`:f}}catch{let t=u.split(`
 Return ONLY valid JSON with this shape:
 {"title":"Short imperative commit title (max 72 chars)","body":"1-3 sentence PR description explaining what changed and why"}
 
-Use sentence case for the title. No markdown fences.`;var G0t=g(()=>{Pf();kz()});function bS4(i){if(!i||i.includes(".."))return!1;return RS4.test(i)}function S0t(i){let u=typeof i.__resolveType==="string"?i.__resolveType:null;if(!u||!bS4(u))return null;let{__resolveType:t,...f}=i;return{resolveType:u,payload:f}}function j0t(i,u){return`${i.replace(/\/+$/,"")}/deco/invoke/${u}`}var RS4;var K0t=g(()=>{RS4=/^[\w./@-]+$/});function Tvu(i){let u;try{u=new URL(i)}catch{return null}if(!u.hostname.endsWith(".localhost"))return null;let t=u.host;return u.hostname="127.0.0.1",{url:u.toString(),hostHeader:t}}function J0t(i,u){let t=i?.githubRepo;if(!t?.owner||!t?.name)return null;if(!t.connectionId)return t;if(!u.includes(t.connectionId))return null;return t}async function X0t(i,u,t,f){if(!f.connectionId)throw new bR("Push requires a connected GitHub account. Connect mcp-github for this project and restart the sandbox.");let l=i.organization?.id;if(!l)throw new bR(FE);await qz({ctx:i,connectionId:f.connectionId,organizationId:l,forceRefresh:!0,onLegacyMintError:(h)=>{let _=h instanceof Error?h.message:FE;throw new bR(_)}});let{cloneUrl:c,gitUserName:E,gitUserEmail:$}=await kg(f.connectionId,f.owner,f.name,i.db,i.vault),w=KAi(i),d=await u.proxyDaemonRequest(t,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({git:{repository:{cloneUrl:c},identity:{userName:E,userEmail:$}},...w?{operator:w}:{}})});if(!d.ok){let h=await d.text().catch(()=>d.statusText);throw Error(`Failed to refresh sandbox git credentials (${d.status}): ${h}`)}}var bR;var L0t=g(()=>{cg();gvu();to();bR=class bR extends Error{constructor(i){super(i);this.name="GitPushAuthError"}}});function MS4(i){let u=i.startsWith("thread:")?i.slice(7):i;if(!u||u.length>255||u.includes("..")||u.startsWith("/")||u.endsWith("/")||u.endsWith(".lock")||!CS4.test(u))throw Error(`Invalid branch name: ${i}`)}function CR(i){return AbortSignal.any([i.req.raw.signal,AbortSignal.timeout(rS4)])}function MR(i){let{runner:u}=i.get("vmClaim");if(!u)return i.json({error:"No sandbox runner configured"},503);return u}async function q6(i,u,t){let f=MR(i);if(f instanceof Response)return f;let{claimName:l,userId:c,projectRef:E}=i.get("vmClaim"),$=t?.method??"POST",w=null,d=new Headers;if(t?.jsonBody!==void 0)w=t.jsonBody,d.set("content-type","application/json");else if(t?.forwardJsonBody)w=await i.req.text(),d.set("content-type","application/json");let h=t?.signal,_={method:$,headers:d,body:w,...h?{signal:h}:{}},v=async()=>{let D=await f.proxyDaemonRequest(l,u,_);if(t?.map404to410&&D.status===404){try{await D.body?.cancel()}catch{}if(await f.adoptLiveClaim?.({userId:c,projectRef:E},l))D=await f.proxyDaemonRequest(l,u,_);if(D.status===404){try{await D.body?.cancel()}catch{}return new Response(JSON.stringify({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."}),{status:410,headers:{"content-type":"application/json",...dn}})}}let n=await D.text(),O=t?.redactRepoDirUnlessDesktop&&f.kind!=="user-desktop"?eS4(n):n,N=D.headers.get("content-type")??"application/json";return new Response(O,{status:D.status,headers:{"content-type":N,...dn}})};try{if(h){let D=v();return D.catch(()=>{}),await Promise.race([D,new Promise((O,N)=>{if(h.aborted)return N(h.reason);h.addEventListener("abort",()=>N(h.reason),{once:!0})})])}return await v()}catch(D){let n=D instanceof Error?D.message:String(D);return i.json({error:`Daemon unreachable: ${n}`},502)}}function eS4(i){try{let u=JSON.parse(i);if(u&&typeof u==="object"&&!Array.isArray(u)&&"repoDir"in u)return JSON.stringify({...u,repoDir:null})}catch{}return i}async function Y0t(i,u,t,f="GET",l){let c=await i.proxyDaemonRequest(u,t,{method:f,headers:new Headers,body:null});if(c.status===404&&l){try{await c.body?.cancel()}catch{}if(await i.adoptLiveClaim?.(l,u))c=await i.proxyDaemonRequest(u,t,{method:f,headers:new Headers,body:null})}if(c.status===404){try{await c.body?.cancel()}catch{}throw Error("SANDBOX_GONE")}let E=await c.text();if(!c.ok)try{let $=JSON.parse(E);throw Error($.error??`Daemon error (${c.status})`)}catch($){if($ instanceof Error&&$.message!==E)throw $;throw Error(`Daemon error (${c.status})`)}return JSON.parse(E)}function aS4(i){return Q0t.includes(i)}var CS4,qS4=524288,VS4=65536,rS4=1e4,W0t=2000,mS4,dn,Q0t,z0t=()=>{let i=new Wu;return i.use("/:virtualMcpId/:branch/*",mS4),i.post("/:virtualMcpId/:branch/write",(u)=>q6(u,"/_sandbox/write",{forwardJsonBody:!0,signal:CR(u)})),i.post("/:virtualMcpId/:branch/unlink",(u)=>q6(u,"/_sandbox/unlink",{forwardJsonBody:!0,signal:CR(u)})),i.post("/:virtualMcpId/:branch/mkdir",(u)=>q6(u,"/_sandbox/mkdir",{forwardJsonBody:!0,signal:CR(u)})),i.post("/:virtualMcpId/:branch/rename",(u)=>q6(u,"/_sandbox/rename",{forwardJsonBody:!0,signal:CR(u)})),i.post("/:virtualMcpId/:branch/read",(u)=>q6(u,"/_sandbox/read",{forwardJsonBody:!0,signal:CR(u)})),i.post("/:virtualMcpId/:branch/glob",(u)=>q6(u,"/_sandbox/glob",{forwardJsonBody:!0,signal:CR(u)})),i.post("/:virtualMcpId/:branch/exec/:script",(u)=>{let t=u.req.param("script");if(!t)return u.json({error:"missing script name"},400);return q6(u,`/_sandbox/exec/${encodeURIComponent(t)}`)}),i.post("/:virtualMcpId/:branch/exec/:script/kill",(u)=>{let t=u.req.param("script");if(!t)return u.json({error:"missing script name"},400);return q6(u,`/_sandbox/exec/${encodeURIComponent(t)}/kill`)}),i.get("/:virtualMcpId/:branch/config",(u)=>q6(u,"/_sandbox/config",{method:"GET",map404to410:!0,redactRepoDirUnlessDesktop:!0})),i.put("/:virtualMcpId/:branch/config",(u)=>q6(u,"/_sandbox/config",{method:"PUT",forwardJsonBody:!0,map404to410:!0})),i.post("/:virtualMcpId/:branch/setup/:step",async(u)=>{let t=u.req.param("step");if(!t||!aS4(t))return u.json({error:`step must be one of: ${Q0t.join(", ")}`},400);if(t==="start"){let f=u.get("vmClaim");if(f.runner){let l=yi(u.var.studioContext),c=yTi(f.virtualMcpMetadata);try{await TTi({ctx:u.var.studioContext,runner:f.runner,handle:f.claimName,orgId:l.id,userId:f.userId,entries:c})}catch(E){let $=E instanceof Error?E.message:String(E);return u.json({error:`Failed to push env to daemon: ${$}`},502)}}}return q6(u,`/_sandbox/setup/${t}`,{signal:u.req.raw.signal,map404to410:!0})}),i.get("/:virtualMcpId/:branch/events",(u)=>{let t=u.get("vmClaim");if(!t.runner)return e3(u,async(f)=>{await f.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:"No sandbox runner configured on this mesh."})})});return F0t(u,{ctx:u.var.studioContext,claimName:t.claimName,runner:t.runner,virtualMcpId:t.virtualMcpId,branch:t.branch,userId:t.userId,projectRef:t.projectRef,virtualMcpMetadata:t.virtualMcpMetadata})}),i.get("/:virtualMcpId/:branch/git/status",(u)=>q6(u,"/_sandbox/git/status",{method:"GET",map404to410:!0,signal:AbortSignal.any([u.req.raw.signal,AbortSignal.timeout(W0t)])})),i.post("/:virtualMcpId/:branch/git/status",(u)=>q6(u,"/_sandbox/git/status",{map404to410:!0,signal:AbortSignal.any([u.req.raw.signal,AbortSignal.timeout(W0t)])})),i.post("/:virtualMcpId/:branch/git/diff",(u)=>q6(u,"/_sandbox/git/diff",{forwardJsonBody:!0,map404to410:!0})),i.post("/:virtualMcpId/:branch/git/publish",async(u)=>{let t=MR(u);if(t instanceof Response)return t;let{claimName:f,virtualMcpMetadata:l,connectionIds:c}=u.get("vmClaim"),E=u.var.studioContext;try{await Ovu(E,t,f);let $=J0t(l,c);if($)await X0t(E,t,f,$)}catch($){if($ instanceof bR)return u.json({error:$.message},403,dn);let w=$ instanceof Error?$.message:String($);return u.json({error:w},502,dn)}return q6(u,"/_sandbox/git/publish",{forwardJsonBody:!0,map404to410:!0})}),i.post("/:virtualMcpId/:branch/git/discard",(u)=>q6(u,"/_sandbox/git/discard",{forwardJsonBody:!0,map404to410:!0})),i.post("/:virtualMcpId/:branch/git/rebase",async(u)=>{let t=MR(u);if(t instanceof Response)return t;let{claimName:f}=u.get("vmClaim"),l=u.var.studioContext;try{await Ovu(l,t,f)}catch(c){let E=c instanceof Error?c.message:String(c);return u.json({error:E},502,dn)}return q6(u,"/_sandbox/git/rebase",{forwardJsonBody:!0,map404to410:!0})}),i.post("/:virtualMcpId/:branch/git/suggest-commit",xw({maxSize:qS4,onError:(u)=>u.json({error:"Payload too large"},413,dn)}),async(u)=>{let t=MR(u);if(t instanceof Response)return t;let{claimName:f,userId:l,projectRef:c}=u.get("vmClaim"),E=u.var.studioContext;try{let $=await u.req.json().catch(()=>({})),w=$.status,d=$.diff,h=d!=null&&typeof d.diffs==="object"&&d.diffs!==null,[_,v]=I0t(w)&&h?[w,d]:await Promise.all([Y0t(t,f,"/_sandbox/git/status","GET",{userId:l,projectRef:c}),Y0t(t,f,"/_sandbox/git/diff","GET",{userId:l,projectRef:c})]),D=await k0t(E,_,v);return u.json(D,200,dn)}catch($){let w=$ instanceof Error?$.message:String($);if(w==="SANDBOX_GONE")return u.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,dn);return u.json({error:w},502,dn)}}),i.get("/:virtualMcpId/:branch/preview-fetch",async(u)=>{let t=MR(u);if(t instanceof Response)return t;let{claimName:f}=u.get("vmClaim"),l=u.req.query("path");if(l!=="/.decofile")return u.json({error:"Path not allowed"},403);let c;try{c=await t.getPreviewUrl(f)}catch{return u.json({error:"Preview not available"},502)}if(!c)return u.json({error:"Preview not available"},502);let E=c.replace(/\/+$/,""),$=Tvu(`${E}${l}`),w;try{w=await fetch($?.url??`${E}${l}`,{...$?{headers:{host:$.hostHeader}}:{}})}catch{return u.json({error:"Preview unreachable"},502)}let d;try{d=await w.text()}catch{return u.json({error:"Preview unreachable"},502)}return new Response(d,{status:w.status,headers:{"content-type":w.headers.get("content-type")??"application/json"}})}),i.post("/:virtualMcpId/:branch/preview-invoke",xw({maxSize:VS4,onError:(u)=>u.json({error:"Payload too large"},413)}),async(u)=>{let t=MR(u);if(t instanceof Response)return t;let{claimName:f}=u.get("vmClaim"),l;try{l=await t.getPreviewUrl(f)}catch{return u.json({error:"Preview not available"},502)}if(!l)return u.json({error:"Preview not available"},502);let c;try{c=await u.req.json()}catch{return u.json({error:"Invalid JSON body"},400)}if(!c||typeof c!=="object"||Array.isArray(c))return u.json({error:"Invalid JSON body"},400);let E=S0t(c);if(!E)return u.json({error:"Invalid or missing __resolveType"},400);let $=j0t(l,E.resolveType),w=Tvu($),d;try{d=await fetch(w?.url??$,{method:"POST",headers:{"content-type":"application/json",...w?{host:w.hostHeader}:{}},body:JSON.stringify(E.payload),signal:AbortSignal.timeout(30000)})}catch{return u.json({error:"Preview unreachable"},502)}let h;try{h=await d.text()}catch{return u.json({error:"Preview unreachable"},502)}return new Response(h,{status:d.status,headers:{"content-type":d.headers.get("content-type")??"application/json"}})}),i};var H0t=g(()=>{yf();AR();RJ();T0t();Zd();PPi();MK();B0t();U0t();dcu();$H();G0t();K0t();L0t();CS4=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;mS4=Z0t(async(i,u)=>{let t=i.var.studioContext;try{ki(t)}catch{return i.json({error:"Unauthorized"},401)}let f=Hu(t);if(!f)return i.json({error:"Unauthorized"},401);let l;try{l=yi(t)}catch{return i.json({error:"Organization scope required"},403)}let c=i.req.param("virtualMcpId"),E=i.req.param("branch");if(!c||!E)return i.json({error:"virtualMcpId and branch are required"},400);try{MS4(E)}catch(v){let D=v instanceof Error?v.message:String(v);return i.json({error:D},400)}let $=await t.storage.virtualMcps.findById(c);if(!$||$.organization_id!==l.id)return i.json({error:"Virtual MCP not found"},404);let w=G8({orgId:l.id,virtualMcpId:c,branch:E}),d=DR({userId:f,projectRef:w},E),h=$.metadata??null,_;try{_=(await Pd(t,{userId:f,branch:E,virtualMcpMetadata:h})).provider}catch{_=null}if(!_)return i.json({error:"No sandbox runner found"},404);return i.set("vmClaim",{claimName:d,runner:_,virtualMcpId:c,branch:E,userId:f,projectRef:w,virtualMcpMetadata:h,connectionIds:$.connections?.map((v)=>v.connection_id)??[]}),u()});dn={"Cache-Control":"no-store, no-cache, must-revalidate",Pragma:"no-cache"};Q0t=["clone","install","start"]});var R0t=(i)=>{let u=new Wu;if(u.use("*",KJ),u.route("/",ePi()),u.route("/",Dp0()),u.route("/",E0t()),u.route("/",GAi()),u.route("/tools",D0t()),u.route("/",h0t()),u.route("/",Vut({kvStorage:i.kvStorage})),u.route("/",Mut()),u.route("/fs",t0t({getConnection:i.getNatsConnection})),u.route("/sandbox",z0t()),u.route("/",l0t()),u.route("/deco-sites",oPi()),u.route("/sso",ZPi()),u.route("/",SAi({tokenStorage:i.tokenStorage,automationEventDispatcher:i.automationEventDispatcher})),u.route("/webhooks",fp0()),i.mountDevAssets)u.route("/dev-assets",sPi({orgFromPath:!0}));return u.use("/mcp/:connectionId?",i.mcpAuth),u.use("/mcp/:connectionId/ui-resource",i.mcpAuth),u.use("/mcp/gateway/:virtualMcpId?",i.mcpAuth),u.use("/mcp/virtual-mcp/:virtualMcpId?",i.mcpAuth),u.use("/mcp/self",i.mcpAuth),u.route("/",Lg0()),u.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",i.betterAuthProtectedResourceHandler),u.route("/mcp",cBi()),u.route("/mcp/self",kAi()),u.route("/mcp",wBi()),u.all("/oauth-proxy/:connectionId/*",i.oauthProxyHandler),u.get("/watch",i.watchHandler),u};var b0t=g(()=>{yf();Lhu();lp0();Hhu();pPi();Mhu();Jhu();qut();rut();f0t();_a();Q3u();dBi();dvu();c0t();$0t();_0t();hvu();n0t();_vu();EBi();H0t()});async function C0t(i,u){let t=new Headers({authorization:`Bearer ${i}`,"X-MCP-Session-Auth":"true"}),f=await u.getMcpSession({headers:t}).catch(()=>null);if(f?.userId)return f.userId;let l=await u.verifyApiKey({body:{key:i}}).catch(()=>null);if(l?.valid&&l.key?.userId)return l.key.userId;return null}function Bvu(i){try{i?.clear?.()}catch{}}async function M0t({accountJwt:i,accountSigningKey:u,expiresAt:t,permissions:f,userId:l,allowedConnectionTypes:c=["WEBSOCKET"]}){let E=C8u(i),$=zxi(E.sub),w=Ab(new TextEncoder().encode(u)),d=Mii();try{let h=await qii(l,d,$,{pub:{allow:f.publish.allow},sub:{allow:f.subscribe.allow},allowed_connection_types:c},{algorithm:e6.v2,exp:Math.floor(t.getTime()/1000),signer:w});return new TextDecoder().decode(Vii(h,d))}finally{Bvu(d),Bvu(w),Bvu($)}}var q0t=g(()=>{qxi()});function oS4(i){return/^wss?:\/\//i.test(i.trim())?["WEBSOCKET"]:["STANDARD","WEBSOCKET"]}function V0t(){let i=new Wu;return i.post("/links/session",async(u)=>{let f=u.get("studioContext").auth?.user?.id;if(!f)return u.json({error:"Unauthorized"},401);let l=yu();if(!l.natsTunnelPublicEnabled)return u.json(Fvu(),503);if(!l.natsPublicUrl)return u.json(Fvu(),503);if(!l.natsAccountJwt||!l.natsAccountSigningKey){if(!l.localMode)return u.json(Fvu(),503)}let c=Nh(f),E;if(l.natsAccountJwt&&l.natsAccountSigningKey){let $=new Date(Date.now()+l.natsTunnelSessionTtlSeconds*1000);E=await M0t({accountJwt:l.natsAccountJwt,accountSigningKey:l.natsAccountSigningKey,expiresAt:$,permissions:FVu(c),userId:f,allowedConnectionTypes:oS4(l.natsPublicUrl)})}return u.json(UVu({publicUrl:l.natsPublicUrl,userId:f,ttlSeconds:l.natsTunnelSessionTtlSeconds,credentials:E}))}),i}var Fvu=()=>({error:"link session unavailable"});var r0t=g(()=>{yf();vt();RHi();q0t()});async function ij4(i,u){try{return!await i.alive(u)}catch(t){return console.warn(`[vm-events] alive probe failed for ${u}; assuming alive: ${t instanceof Error?t.message:String(t)}`),!1}}async function uj4(i){let{ctx:u,runner:t,claimName:f,userId:l,projectRef:c,sandboxProviderKind:E}=i;try{await t.delete(f)}catch($){console.warn(`[vm-events] runner.delete failed for ${f}: ${$ instanceof Error?$.message:String($)}`)}try{await new xg(u.db).delete({userId:l,projectRef:c},E)}catch($){console.warn(`[vm-events] sandbox_runner_state delete failed for ${l}/${c}/${E}: ${$ instanceof Error?$.message:String($)}`)}}async function tj4(i){let{stream:u,claimName:t,runner:f,signal:l}=i;return new Promise((c)=>{let E=!1,$=!1,w=null,d=(v)=>{if(E)return;E=!0,clearTimeout(h),l.removeEventListener("abort",_),w?.unsubscribe(),c(v)},h=setTimeout(()=>{if($||E)return;u.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"claim-never-created",message:"Sandbox claim was never created. The SANDBOX_START call may have failed earlier \u2014 check the start error."})}).catch(()=>{}),d(!1)},sS4),_=()=>d(!1);l.addEventListener("abort",_,{once:!0}),w=xo(f,t,(v)=>{if(E)return;if(v.kind!=="claiming")$=!0;if(u.writeSSE({event:"phase",data:JSON.stringify(v)}).catch(()=>{}),v.kind==="ready")d(!0);else if(v.kind==="failed")d(!1)})})}async function fj4(i){let{stream:u,runner:t,claimName:f,signal:l}=i,c=Date.now(),E=null;while(!l.aborted){let w=null;try{w=await t.proxyDaemonRequest(f,"/_sandbox/events",{method:"GET",headers:new Headers({accept:"text/event-stream"}),body:null,signal:l})}catch(d){if(l.aborted)return;if(Date.now()-c<m0t){await O0(e0t,{signal:l}).catch(()=>{});continue}let h=d instanceof Error?d.message:String(d);await u.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:`Upstream daemon SSE error: ${h}`})}).catch(()=>{});return}if(w.status===404){try{await w.body?.cancel()}catch{}if(Date.now()-c<m0t){await O0(e0t,{signal:l}).catch(()=>{});continue}await u.writeSSE({event:"gone",data:""}).catch(()=>{});return}if(!w.ok||!w.body){try{await w.body?.cancel()}catch{}await u.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:`Upstream daemon SSE failed (${w.status}).`})}).catch(()=>{});return}E=w;break}if(!E||!E.body)return;let $=E.body.getReader();try{while(!l.aborted){let{value:w,done:d}=await $.read();if(d)break;if(w)await u.write(w)}}catch{}finally{try{$.releaseLock()}catch{}}}var sS4=90000,pS4=15000,a0t=()=>{let i=new Wu;return i.get("/",async(u)=>{let t=u.var.studioContext;try{ki(t)}catch{return u.json({error:"Unauthorized"},401)}let f=Hu(t);if(!f)return u.json({error:"Unauthorized"},401);let l;try{l=yi(t)}catch{return u.json({error:"Organization scope required"},403)}let c=u.req.query("virtualMcpId"),E=u.req.query("branch");if(!c||!E)return u.json({error:"virtualMcpId and branch are required"},400);let $=await t.storage.virtualMcps.findById(c);if(!$||$.organization_id!==l.id)return u.json({error:"Virtual MCP not found"},404);let w=G8({orgId:l.id,virtualMcpId:c,branch:E}),d=DR({userId:f,projectRef:w},E),h=$.metadata??null,_,v=null,D=null;try{let N=await Pd(t,{userId:f,branch:E,virtualMcpMetadata:h});_=N.provider,v=N.kind}catch(N){D=N instanceof Error?N:Error(String(N)),_=null}let n=v&&_5(Il(h),f,E,v),O=!!n&&n.sandboxHandle===d;if(!_)return e3(u,async(N)=>{await N.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:D?.message??"No sandbox runner configured on this mesh."})})});return u.header("X-Accel-Buffering","no"),u.header("Content-Encoding","identity"),e3(u,async(N)=>{let y=new AbortController,Z=setInterval(()=>{N.writeSSE({event:"keepalive",data:""}).catch(()=>{clearInterval(Z)})},pS4);N.onAbort(()=>{y.abort(),clearInterval(Z)});try{if(O&&v){if(await ij4(_,d)){await uj4({ctx:t,runner:_,claimName:d,userId:f,projectRef:w,sandboxProviderKind:v}),await N.writeSSE({event:"gone",data:""}).catch(()=>{});return}}if(!await tj4({stream:N,claimName:d,runner:_,signal:y.signal})||y.signal.aborted)return;await fj4({stream:N,runner:_,claimName:d,signal:y.signal})}finally{clearInterval(Z)}})}),i},m0t=60000,e0t=500;var o0t=g(()=>{yf();RJ();Zd();y4();PPi();ko();MK();rhi();nw()});function cj4(i){return i.filter((u)=>u.vendors?.alias).map((u)=>({name:u.name,title:u.title,description:u.description,logo:u.logo,category:u.category,vendor:{alias:u.vendors.alias,url:u.vendors.url}}))}async function Ej4(i,u){let t=await fetch(`${i}/rest/v1/apps?select=name,title,description,logo,category,vendors(alias,url)`,{headers:{apikey:u,Authorization:`Bearer ${u}`,Accept:"application/json"},signal:AbortSignal.timeout(lj4)});if(!t.ok){let f=await t.text().catch(()=>t.statusText);throw console.error(`[deco-apps] Supabase error (${t.status}): ${f.slice(0,200)}`),Error(`External service error (${t.status})`)}return await t.json()}var lj4=1e4,$j4=async(i,u)=>{if(!i.get("studioContext").auth.user?.id)return i.json({error:"Unauthorized"},401);return u()},s0t=()=>{let i=new Wu;return i.use("*",$j4),i.get("/",async(u)=>{let t=yu(),f=t.decoSupabaseUrl,l=t.decoSupabaseServiceKey;if(!f||!l)return u.json({apps:[]});try{let c=await Ej4(f,l);return u.json({apps:cj4(c)})}catch(c){return console.error("[deco-apps] GET error:",c),u.json({error:"Failed to fetch apps"},502)}}),i};var p0t=g(()=>{yf();vt()});import{z as bu}from"zod";function z5(i,u="invalid_request_error",t=null,f=null){return{error:{message:i,type:u,param:t,code:f}}}function Nj4(i){if(!i)return null;let u=i.indexOf(":");if(u===-1)return{credentialId:null,modelId:i};let t=i.substring(0,u),f=i.substring(u+1);if(!t||!f)return null;return{credentialId:t,modelId:f}}function yj4(i,u,t){try{return JSON.parse(i)}catch{throw new ttt(`Invalid JSON in tool call arguments for function '${t}' (tool_call_id: ${u}): ${i}`)}}function Zj4(i){let u={};for(let t of i)if(t.role==="assistant"&&t.tool_calls)for(let f of t.tool_calls)u[f.id]=f.function.name;return i.map((t)=>{switch(t.role){case"system":return{role:"system",content:t.content};case"user":if(typeof t.content==="string")return{role:"user",content:t.content};return{role:"user",content:t.content.map((l)=>{if(l.type==="text")return{type:"text",text:l.text};return{type:"image",image:l.image_url.url}})};case"assistant":if(t.tool_calls&&t.tool_calls.length>0)return{role:"assistant",content:t.tool_calls.map((l)=>({type:"tool-call",toolCallId:l.id,toolName:l.function.name,input:yj4(l.function.arguments,l.id,l.function.name)}))};return{role:"assistant",content:t.content??""};case"tool":let f=u[t.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:t.tool_call_id,toolName:f,output:{type:"text",value:t.content}}]}}})}function Tj4(i){let u=i.map((t)=>{let f=t.function.parameters?$d(t.function.parameters):$d({type:"object",properties:{}});return[t.function.name,H0({description:t.function.description,inputSchema:f})]});return Object.fromEntries(u)}function Bj4(i){if(!i)return;return{openai:{response_format:i}}}function Fj4(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function itt(i,u,t,f,l,c){let E={model:i,messages:u,tools:t,temperature:f.temperature,maxTokens:f.max_tokens,topP:f.top_p,frequencyPenalty:f.frequency_penalty,presencePenalty:f.presence_penalty,stopSequences:f.stop?Array.isArray(f.stop)?f.stop:[f.stop]:void 0,abortSignal:c};return l?{...E,providerOptions:l}:E}function utt(i){if(i==="tool-calls")return"tool_calls";if(i==="length")return"length";return"stop"}var wj4=256,dj4,hj4,_j4,vj4,Dj4,nj4,gj4,Oj4,ttt,ftt,ltt;var ctt=g(()=>{Pf();yf();RJ();dj4=bu.object({type:bu.literal("function"),function:bu.object({name:bu.string(),description:bu.string().optional(),parameters:bu.record(bu.string(),bu.unknown()).optional()})}),hj4=bu.object({id:bu.string(),type:bu.literal("function"),function:bu.object({name:bu.string(),arguments:bu.string()})}),_j4=bu.discriminatedUnion("role",[bu.object({role:bu.literal("system"),content:bu.string(),name:bu.string().optional()}),bu.object({role:bu.literal("user"),content:bu.union([bu.string(),bu.array(bu.union([bu.object({type:bu.literal("text"),text:bu.string()}),bu.object({type:bu.literal("image_url"),image_url:bu.object({url:bu.string(),detail:bu.string().optional()})})]))]),name:bu.string().optional()}),bu.object({role:bu.literal("assistant"),content:bu.string().nullable().optional(),name:bu.string().optional(),tool_calls:bu.array(hj4).optional()}),bu.object({role:bu.literal("tool"),content:bu.string(),tool_call_id:bu.string()})]),vj4=bu.object({type:bu.literal("text")}),Dj4=bu.object({type:bu.literal("json_object")}),nj4=bu.object({type:bu.literal("json_schema"),json_schema:bu.object({name:bu.string(),description:bu.string().optional(),schema:bu.record(bu.string(),bu.unknown()),strict:bu.boolean().optional()})}),gj4=bu.union([vj4,Dj4,nj4]),Oj4=bu.object({model:bu.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:bu.array(_j4),stream:bu.boolean().optional().default(!1),temperature:bu.number().min(0).max(2).optional(),max_tokens:bu.number().positive().optional(),top_p:bu.number().min(0).max(1).optional(),frequency_penalty:bu.number().min(-2).max(2).optional(),presence_penalty:bu.number().min(-2).max(2).optional(),stop:bu.union([bu.string(),bu.array(bu.string())]).optional(),tools:bu.array(dj4).optional(),tool_choice:bu.union([bu.literal("auto"),bu.literal("none"),bu.literal("required"),bu.object({type:bu.literal("function"),function:bu.object({name:bu.string()})})]).optional(),response_format:gj4.optional(),user:bu.string().optional()});ttt=class ttt extends Error{constructor(i){super(i);this.name="MessageConversionError"}};ftt=new Wu;ftt.post("/:org/v1/chat/completions",async(i)=>{let u=i.get("studioContext"),t=i.req.param("org");try{if(!u.auth.apiKey?.id)return i.json(z5("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!u.organization)return i.json(z5("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((u.organization.slug??u.organization.id)!==t)return i.json(z5("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let f=await i.req.json(),l=Oj4.safeParse(f);if(!l.success){let N=l.error.issues[0]??{message:"Invalid request",path:[]};return i.json(z5(`Invalid request: ${N.message}`,"invalid_request_error",N.path.length>0?N.path.join("."):null),400)}let c=l.data,E=Nj4(c.model);if(!E)return i.json(z5("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:$}=E,{modelId:w}=E;if(!$){let N=await u.storage.aiProviderKeys.list({organizationId:u.organization.id});if(N.length===0)return i.json(z5("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);$=N[0].id}let d;try{d=await u.aiProviders.activate($,u.organization.id)}catch{return i.json(z5(`AI provider credential not found or inaccessible: ${$}`,"invalid_request_error","model"),404)}let h=d.aiSdk.languageModel(w),_=Zj4(c.messages),v=c.tools?Tj4(c.tools):void 0,D=Bj4(c.response_format),n=Fj4(),O=Math.floor(Date.now()/1000);if(c.stream)return e3(i,async(N)=>{let y=itt(h,_,v,c,D,i.req.raw.signal);try{let Z=X3(y),T=!1,B=0,F="",A=async()=>{if(F.length===0)return;let G=F;F="",await N.writeSSE({data:JSON.stringify({id:n,object:"chat.completion.chunk",created:O,model:c.model,choices:[{index:0,delta:{content:G},finish_reason:null}]})})};for await(let G of Z.fullStream){if(!T&&(G.type==="text-delta"||G.type==="tool-call"))await N.writeSSE({data:JSON.stringify({id:n,object:"chat.completion.chunk",created:O,model:c.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),T=!0;if(G.type==="text-delta"){if(F+=G.text,F.length>=wj4)await A()}else if(G.type==="tool-call"){await A();let I=B++;await N.writeSSE({data:JSON.stringify({id:n,object:"chat.completion.chunk",created:O,model:c.model,choices:[{index:0,delta:{tool_calls:[{index:I,id:G.toolCallId,type:"function",function:{name:G.toolName,arguments:JSON.stringify(G.input)}}]},finish_reason:null}]})})}else if(G.type==="finish")await A(),await N.writeSSE({data:JSON.stringify({id:n,object:"chat.completion.chunk",created:O,model:c.model,choices:[{index:0,delta:{},finish_reason:utt(G.finishReason)}],usage:G.totalUsage?{prompt_tokens:G.totalUsage.inputTokens??0,completion_tokens:G.totalUsage.outputTokens??0,total_tokens:G.totalUsage.totalTokens??0}:void 0})})}await A(),await N.writeSSE({data:"[DONE]"})}catch(Z){let T=Z;console.error("[openai-compat:stream] Error:",T.message),await N.writeSSE({data:JSON.stringify({error:{message:T.message,type:"server_error"}})})}});else{let N=itt(h,_,v,c,D,i.req.raw.signal),y=await Ng(N),Z={role:"assistant",content:y.text||null};if(y.toolCalls&&y.toolCalls.length>0)Z.tool_calls=y.toolCalls.map((T)=>({id:T.toolCallId,type:"function",function:{name:T.toolName,arguments:JSON.stringify("input"in T?T.input:{})}})),Z.content=null;return i.json({id:n,object:"chat.completion",created:O,model:c.model,choices:[{index:0,message:Z,finish_reason:utt(y.finishReason)}],usage:{prompt_tokens:y.usage?.inputTokens??0,completion_tokens:y.usage?.outputTokens??0,total_tokens:y.usage?.totalTokens??0}})}}catch(f){let l=f;if(l.name==="AbortError")return i.json(z5("Request aborted","invalid_request_error"),400);if(l.name==="MessageConversionError")return i.json(z5(l.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",l.message,l.stack),i.json(z5(l.message,"server_error"),500)}});ltt=ftt});function Pj4(){let i=process.env.POSTHOG_KEY;if(!i)return null;return{key:i,host:process.env.POSTHOG_HOST??Uj4}}var Ett,Uj4="https://ph.studio.decocms.com",$tt;var wtt=g(()=>{yf();bmi();qg();cE();vt();J3u();X1i();Ett=new Wu;Ett.get("/",(i)=>{let u={version:iW.version,theme:Nl0(),...TN().logo&&{logo:TN().logo},...Q3()&&{internalUrl:Uli()},...yu().enableDecoImport&&{enableDecoImport:!0},brandExtractEnabled:!!yu().firecrawlApiKey,auth:ae0(),posthog:Pj4(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:!Q3()&&yu().sandboxProviderKind==="agent-sandbox"}};return i.header("Cache-Control","no-store"),i.json({success:!0,config:u})});$tt=Ett});function JAi(i){let u=(i??"").trim().toLowerCase();return u=u.replace(/^https?:\/\//,""),u=u.replace(/^www\./,""),u=u.split(/[/?#]/)[0]??"",u.replace(/\/+$/,"")}function htt(i){return(JAi(i).split(".")[0]||i).replace(/[-_]/g," ").split(" ").filter(Boolean).map((t)=>t.charAt(0).toUpperCase()+t.slice(1)).join(" ")}function _tt(i,u=64){return`https://www.google.com/s2/favicons?domain=${encodeURIComponent(JAi(i))}&sz=${u}`}function dtt(i,u){let t=i.trim();if(t.length<=u)return t;let f=t.slice(0,u-1),l=f.lastIndexOf(" ");return`${(l>u*0.6?f.slice(0,l):f).trimEnd()}\u2026`}function vtt(i){let{brand:u,domain:t,score:f,verdict:l}=i,c=typeof f==="number"?`${u} commerce report \u2014 ${Math.round(f)}/100 \xB7 decocms`:`${u} commerce report \xB7 decocms`,E=`See the full ${u} scorecard \u2014 SEO, performance, conversion & AEO signals scored by decocms.`,$=l?.trim()?dtt(`${l.trim().replace(/\s+/g," ")} \u2014 ${E}`,200):dtt(`How does ${t} really perform? ${E}`,200);return{title:c,description:$}}import{join as Aj4}from"path";function hn(i){return i.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function Ij4(i){let u=JAi(i),t=htt(u),f=_tt(u,128),c=`${(yu().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(u)}`,{title:E,description:$}=vtt({brand:t,domain:u});return[`<title>${hn(E)}</title>`,`<meta name="description" content="${hn($)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${hn(E)}" />`,`<meta property="og:description" content="${hn($)}" />`,`<meta property="og:url" content="${hn(c)}" />`,'<meta name="twitter:card" content="summary" />',`<meta name="twitter:title" content="${hn(E)}" />`,`<meta name="twitter:description" content="${hn($)}" />`,`<link rel="canonical" href="${hn(c)}" />`,`<link rel="icon" href="${hn(f)}" sizes="any" />`].join(`
+Use sentence case for the title. No markdown fences.`;var G0t=g(()=>{Pf();kz()});function bS4(i){if(!i||i.includes(".."))return!1;return RS4.test(i)}function S0t(i){let u=typeof i.__resolveType==="string"?i.__resolveType:null;if(!u||!bS4(u))return null;let{__resolveType:t,...f}=i;return{resolveType:u,payload:f}}function j0t(i,u){return`${i.replace(/\/+$/,"")}/deco/invoke/${u}`}var RS4;var K0t=g(()=>{RS4=/^[\w./@-]+$/});function Tvu(i){let u;try{u=new URL(i)}catch{return null}if(!u.hostname.endsWith(".localhost"))return null;let t=u.host;return u.hostname="127.0.0.1",{url:u.toString(),hostHeader:t}}function J0t(i,u){let t=i?.githubRepo;if(!t?.owner||!t?.name)return null;if(!t.connectionId)return t;if(!u.includes(t.connectionId))return null;return t}async function X0t(i,u,t,f){if(!f.connectionId)throw new bR("Push requires a connected GitHub account. Connect mcp-github for this project and restart the sandbox.");let l=i.organization?.id;if(!l)throw new bR(FE);await qz({ctx:i,connectionId:f.connectionId,organizationId:l,forceRefresh:!0,onLegacyMintError:(h)=>{let _=h instanceof Error?h.message:FE;throw new bR(_)}});let{cloneUrl:c,gitUserName:E,gitUserEmail:$}=await kg(f.connectionId,f.owner,f.name,i.db,i.vault),w=KAi(i),d=await u.proxyDaemonRequest(t,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({git:{repository:{cloneUrl:c},identity:{userName:E,userEmail:$}},...w?{operator:w}:{}})});if(!d.ok){let h=await d.text().catch(()=>d.statusText);throw Error(`Failed to refresh sandbox git credentials (${d.status}): ${h}`)}}var bR;var L0t=g(()=>{cg();gvu();to();bR=class bR extends Error{constructor(i){super(i);this.name="GitPushAuthError"}}});function MS4(i){let u=i.startsWith("thread:")?i.slice(7):i;if(!u||u.length>255||u.includes("..")||u.startsWith("/")||u.endsWith("/")||u.endsWith(".lock")||!CS4.test(u))throw Error(`Invalid branch name: ${i}`)}function CR(i){return AbortSignal.any([i.req.raw.signal,AbortSignal.timeout(rS4)])}function MR(i){let{runner:u}=i.get("vmClaim");if(!u)return i.json({error:"No sandbox runner configured"},503);return u}async function q6(i,u,t){let f=MR(i);if(f instanceof Response)return f;let{claimName:l,userId:c,projectRef:E}=i.get("vmClaim"),$=t?.method??"POST",w=null,d=new Headers;if(t?.jsonBody!==void 0)w=t.jsonBody,d.set("content-type","application/json");else if(t?.forwardJsonBody)w=await i.req.text(),d.set("content-type","application/json");let h=t?.signal,_={method:$,headers:d,body:w,...h?{signal:h}:{}},v=async()=>{let D=await f.proxyDaemonRequest(l,u,_);if(t?.map404to410&&D.status===404){try{await D.body?.cancel()}catch{}if(await f.adoptLiveClaim?.({userId:c,projectRef:E},l))D=await f.proxyDaemonRequest(l,u,_);if(D.status===404){try{await D.body?.cancel()}catch{}return new Response(JSON.stringify({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."}),{status:410,headers:{"content-type":"application/json",...dn}})}}let n=await D.text(),O=t?.redactRepoDirUnlessDesktop&&f.kind!=="user-desktop"?eS4(n):n,N=D.headers.get("content-type")??"application/json";return new Response(O,{status:D.status,headers:{"content-type":N,...dn}})};try{if(h){let D=v();return D.catch(()=>{}),await Promise.race([D,new Promise((O,N)=>{if(h.aborted)return N(h.reason);h.addEventListener("abort",()=>N(h.reason),{once:!0})})])}return await v()}catch(D){let n=D instanceof Error?D.message:String(D);return i.json({error:`Daemon unreachable: ${n}`},502)}}function eS4(i){try{let u=JSON.parse(i);if(u&&typeof u==="object"&&!Array.isArray(u)&&"repoDir"in u)return JSON.stringify({...u,repoDir:null})}catch{}return i}async function Y0t(i,u,t,f="GET",l){let c=await i.proxyDaemonRequest(u,t,{method:f,headers:new Headers,body:null});if(c.status===404&&l){try{await c.body?.cancel()}catch{}if(await i.adoptLiveClaim?.(l,u))c=await i.proxyDaemonRequest(u,t,{method:f,headers:new Headers,body:null})}if(c.status===404){try{await c.body?.cancel()}catch{}throw Error("SANDBOX_GONE")}let E=await c.text();if(!c.ok)try{let $=JSON.parse(E);throw Error($.error??`Daemon error (${c.status})`)}catch($){if($ instanceof Error&&$.message!==E)throw $;throw Error(`Daemon error (${c.status})`)}return JSON.parse(E)}function aS4(i){return Q0t.includes(i)}var CS4,qS4=524288,VS4=65536,rS4=1e4,W0t=2000,mS4,dn,Q0t,z0t=()=>{let i=new Wu;return i.use("/:virtualMcpId/:branch/*",mS4),i.post("/:virtualMcpId/:branch/write",(u)=>q6(u,"/_sandbox/write",{forwardJsonBody:!0,signal:CR(u)})),i.post("/:virtualMcpId/:branch/unlink",(u)=>q6(u,"/_sandbox/unlink",{forwardJsonBody:!0,signal:CR(u)})),i.post("/:virtualMcpId/:branch/mkdir",(u)=>q6(u,"/_sandbox/mkdir",{forwardJsonBody:!0,signal:CR(u)})),i.post("/:virtualMcpId/:branch/rename",(u)=>q6(u,"/_sandbox/rename",{forwardJsonBody:!0,signal:CR(u)})),i.post("/:virtualMcpId/:branch/read",(u)=>q6(u,"/_sandbox/read",{forwardJsonBody:!0,signal:CR(u)})),i.post("/:virtualMcpId/:branch/glob",(u)=>q6(u,"/_sandbox/glob",{forwardJsonBody:!0,signal:CR(u)})),i.post("/:virtualMcpId/:branch/exec/:script",(u)=>{let t=u.req.param("script");if(!t)return u.json({error:"missing script name"},400);return q6(u,`/_sandbox/exec/${encodeURIComponent(t)}`)}),i.post("/:virtualMcpId/:branch/exec/:script/kill",(u)=>{let t=u.req.param("script");if(!t)return u.json({error:"missing script name"},400);return q6(u,`/_sandbox/exec/${encodeURIComponent(t)}/kill`)}),i.get("/:virtualMcpId/:branch/config",(u)=>q6(u,"/_sandbox/config",{method:"GET",map404to410:!0,redactRepoDirUnlessDesktop:!0})),i.put("/:virtualMcpId/:branch/config",(u)=>q6(u,"/_sandbox/config",{method:"PUT",forwardJsonBody:!0,map404to410:!0})),i.post("/:virtualMcpId/:branch/setup/:step",async(u)=>{let t=u.req.param("step");if(!t||!aS4(t))return u.json({error:`step must be one of: ${Q0t.join(", ")}`},400);if(t==="start"){let f=u.get("vmClaim");if(f.runner){let l=yi(u.var.studioContext),c=yTi(f.virtualMcpMetadata);try{await TTi({ctx:u.var.studioContext,runner:f.runner,handle:f.claimName,orgId:l.id,userId:f.userId,entries:c})}catch(E){let $=E instanceof Error?E.message:String(E);return u.json({error:`Failed to push env to daemon: ${$}`},502)}}}return q6(u,`/_sandbox/setup/${t}`,{signal:u.req.raw.signal,map404to410:!0})}),i.get("/:virtualMcpId/:branch/events",(u)=>{let t=u.get("vmClaim");if(!t.runner)return e3(u,async(f)=>{await f.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:"No sandbox runner configured on this studio instance."})})});return F0t(u,{ctx:u.var.studioContext,claimName:t.claimName,runner:t.runner,virtualMcpId:t.virtualMcpId,branch:t.branch,userId:t.userId,projectRef:t.projectRef,virtualMcpMetadata:t.virtualMcpMetadata})}),i.get("/:virtualMcpId/:branch/git/status",(u)=>q6(u,"/_sandbox/git/status",{method:"GET",map404to410:!0,signal:AbortSignal.any([u.req.raw.signal,AbortSignal.timeout(W0t)])})),i.post("/:virtualMcpId/:branch/git/status",(u)=>q6(u,"/_sandbox/git/status",{map404to410:!0,signal:AbortSignal.any([u.req.raw.signal,AbortSignal.timeout(W0t)])})),i.post("/:virtualMcpId/:branch/git/diff",(u)=>q6(u,"/_sandbox/git/diff",{forwardJsonBody:!0,map404to410:!0})),i.post("/:virtualMcpId/:branch/git/publish",async(u)=>{let t=MR(u);if(t instanceof Response)return t;let{claimName:f,virtualMcpMetadata:l,connectionIds:c}=u.get("vmClaim"),E=u.var.studioContext;try{await Ovu(E,t,f);let $=J0t(l,c);if($)await X0t(E,t,f,$)}catch($){if($ instanceof bR)return u.json({error:$.message},403,dn);let w=$ instanceof Error?$.message:String($);return u.json({error:w},502,dn)}return q6(u,"/_sandbox/git/publish",{forwardJsonBody:!0,map404to410:!0})}),i.post("/:virtualMcpId/:branch/git/discard",(u)=>q6(u,"/_sandbox/git/discard",{forwardJsonBody:!0,map404to410:!0})),i.post("/:virtualMcpId/:branch/git/rebase",async(u)=>{let t=MR(u);if(t instanceof Response)return t;let{claimName:f}=u.get("vmClaim"),l=u.var.studioContext;try{await Ovu(l,t,f)}catch(c){let E=c instanceof Error?c.message:String(c);return u.json({error:E},502,dn)}return q6(u,"/_sandbox/git/rebase",{forwardJsonBody:!0,map404to410:!0})}),i.post("/:virtualMcpId/:branch/git/suggest-commit",xw({maxSize:qS4,onError:(u)=>u.json({error:"Payload too large"},413,dn)}),async(u)=>{let t=MR(u);if(t instanceof Response)return t;let{claimName:f,userId:l,projectRef:c}=u.get("vmClaim"),E=u.var.studioContext;try{let $=await u.req.json().catch(()=>({})),w=$.status,d=$.diff,h=d!=null&&typeof d.diffs==="object"&&d.diffs!==null,[_,v]=I0t(w)&&h?[w,d]:await Promise.all([Y0t(t,f,"/_sandbox/git/status","GET",{userId:l,projectRef:c}),Y0t(t,f,"/_sandbox/git/diff","GET",{userId:l,projectRef:c})]),D=await k0t(E,_,v);return u.json(D,200,dn)}catch($){let w=$ instanceof Error?$.message:String($);if(w==="SANDBOX_GONE")return u.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,dn);return u.json({error:w},502,dn)}}),i.get("/:virtualMcpId/:branch/preview-fetch",async(u)=>{let t=MR(u);if(t instanceof Response)return t;let{claimName:f}=u.get("vmClaim"),l=u.req.query("path");if(l!=="/.decofile")return u.json({error:"Path not allowed"},403);let c;try{c=await t.getPreviewUrl(f)}catch{return u.json({error:"Preview not available"},502)}if(!c)return u.json({error:"Preview not available"},502);let E=c.replace(/\/+$/,""),$=Tvu(`${E}${l}`),w;try{w=await fetch($?.url??`${E}${l}`,{...$?{headers:{host:$.hostHeader}}:{}})}catch{return u.json({error:"Preview unreachable"},502)}let d;try{d=await w.text()}catch{return u.json({error:"Preview unreachable"},502)}return new Response(d,{status:w.status,headers:{"content-type":w.headers.get("content-type")??"application/json"}})}),i.post("/:virtualMcpId/:branch/preview-invoke",xw({maxSize:VS4,onError:(u)=>u.json({error:"Payload too large"},413)}),async(u)=>{let t=MR(u);if(t instanceof Response)return t;let{claimName:f}=u.get("vmClaim"),l;try{l=await t.getPreviewUrl(f)}catch{return u.json({error:"Preview not available"},502)}if(!l)return u.json({error:"Preview not available"},502);let c;try{c=await u.req.json()}catch{return u.json({error:"Invalid JSON body"},400)}if(!c||typeof c!=="object"||Array.isArray(c))return u.json({error:"Invalid JSON body"},400);let E=S0t(c);if(!E)return u.json({error:"Invalid or missing __resolveType"},400);let $=j0t(l,E.resolveType),w=Tvu($),d;try{d=await fetch(w?.url??$,{method:"POST",headers:{"content-type":"application/json",...w?{host:w.hostHeader}:{}},body:JSON.stringify(E.payload),signal:AbortSignal.timeout(30000)})}catch{return u.json({error:"Preview unreachable"},502)}let h;try{h=await d.text()}catch{return u.json({error:"Preview unreachable"},502)}return new Response(h,{status:d.status,headers:{"content-type":d.headers.get("content-type")??"application/json"}})}),i};var H0t=g(()=>{yf();AR();RJ();T0t();Zd();PPi();MK();B0t();U0t();dcu();$H();G0t();K0t();L0t();CS4=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;mS4=Z0t(async(i,u)=>{let t=i.var.studioContext;try{ki(t)}catch{return i.json({error:"Unauthorized"},401)}let f=Hu(t);if(!f)return i.json({error:"Unauthorized"},401);let l;try{l=yi(t)}catch{return i.json({error:"Organization scope required"},403)}let c=i.req.param("virtualMcpId"),E=i.req.param("branch");if(!c||!E)return i.json({error:"virtualMcpId and branch are required"},400);try{MS4(E)}catch(v){let D=v instanceof Error?v.message:String(v);return i.json({error:D},400)}let $=await t.storage.virtualMcps.findById(c);if(!$||$.organization_id!==l.id)return i.json({error:"Virtual MCP not found"},404);let w=G8({orgId:l.id,virtualMcpId:c,branch:E}),d=DR({userId:f,projectRef:w},E),h=$.metadata??null,_;try{_=(await Pd(t,{userId:f,branch:E,virtualMcpMetadata:h})).provider}catch{_=null}if(!_)return i.json({error:"No sandbox runner found"},404);return i.set("vmClaim",{claimName:d,runner:_,virtualMcpId:c,branch:E,userId:f,projectRef:w,virtualMcpMetadata:h,connectionIds:$.connections?.map((v)=>v.connection_id)??[]}),u()});dn={"Cache-Control":"no-store, no-cache, must-revalidate",Pragma:"no-cache"};Q0t=["clone","install","start"]});var R0t=(i)=>{let u=new Wu;if(u.use("*",KJ),u.route("/",ePi()),u.route("/",Dp0()),u.route("/",E0t()),u.route("/",GAi()),u.route("/tools",D0t()),u.route("/",h0t()),u.route("/",Vut({kvStorage:i.kvStorage})),u.route("/",Mut()),u.route("/fs",t0t({getConnection:i.getNatsConnection})),u.route("/sandbox",z0t()),u.route("/",l0t()),u.route("/deco-sites",oPi()),u.route("/sso",ZPi()),u.route("/",SAi({tokenStorage:i.tokenStorage,automationEventDispatcher:i.automationEventDispatcher})),u.route("/webhooks",fp0()),i.mountDevAssets)u.route("/dev-assets",sPi({orgFromPath:!0}));return u.use("/mcp/:connectionId?",i.mcpAuth),u.use("/mcp/:connectionId/ui-resource",i.mcpAuth),u.use("/mcp/gateway/:virtualMcpId?",i.mcpAuth),u.use("/mcp/virtual-mcp/:virtualMcpId?",i.mcpAuth),u.use("/mcp/self",i.mcpAuth),u.route("/",Lg0()),u.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",i.betterAuthProtectedResourceHandler),u.route("/mcp",cBi()),u.route("/mcp/self",kAi()),u.route("/mcp",wBi()),u.all("/oauth-proxy/:connectionId/*",i.oauthProxyHandler),u.get("/watch",i.watchHandler),u};var b0t=g(()=>{yf();Lhu();lp0();Hhu();pPi();Mhu();Jhu();qut();rut();f0t();_a();Q3u();dBi();dvu();c0t();$0t();_0t();hvu();n0t();_vu();EBi();H0t()});async function C0t(i,u){let t=new Headers({authorization:`Bearer ${i}`,"X-MCP-Session-Auth":"true"}),f=await u.getMcpSession({headers:t}).catch(()=>null);if(f?.userId)return f.userId;let l=await u.verifyApiKey({body:{key:i}}).catch(()=>null);if(l?.valid&&l.key?.userId)return l.key.userId;return null}function Bvu(i){try{i?.clear?.()}catch{}}async function M0t({accountJwt:i,accountSigningKey:u,expiresAt:t,permissions:f,userId:l,allowedConnectionTypes:c=["WEBSOCKET"]}){let E=C8u(i),$=zxi(E.sub),w=Ab(new TextEncoder().encode(u)),d=Mii();try{let h=await qii(l,d,$,{pub:{allow:f.publish.allow},sub:{allow:f.subscribe.allow},allowed_connection_types:c},{algorithm:e6.v2,exp:Math.floor(t.getTime()/1000),signer:w});return new TextDecoder().decode(Vii(h,d))}finally{Bvu(d),Bvu(w),Bvu($)}}var q0t=g(()=>{qxi()});function oS4(i){return/^wss?:\/\//i.test(i.trim())?["WEBSOCKET"]:["STANDARD","WEBSOCKET"]}function V0t(){let i=new Wu;return i.post("/links/session",async(u)=>{let f=u.get("studioContext").auth?.user?.id;if(!f)return u.json({error:"Unauthorized"},401);let l=yu();if(!l.natsTunnelPublicEnabled)return u.json(Fvu(),503);if(!l.natsPublicUrl)return u.json(Fvu(),503);if(!l.natsAccountJwt||!l.natsAccountSigningKey){if(!l.localMode)return u.json(Fvu(),503)}let c=Nh(f),E;if(l.natsAccountJwt&&l.natsAccountSigningKey){let $=new Date(Date.now()+l.natsTunnelSessionTtlSeconds*1000);E=await M0t({accountJwt:l.natsAccountJwt,accountSigningKey:l.natsAccountSigningKey,expiresAt:$,permissions:FVu(c),userId:f,allowedConnectionTypes:oS4(l.natsPublicUrl)})}return u.json(UVu({publicUrl:l.natsPublicUrl,userId:f,ttlSeconds:l.natsTunnelSessionTtlSeconds,credentials:E}))}),i}var Fvu=()=>({error:"link session unavailable"});var r0t=g(()=>{yf();vt();RHi();q0t()});async function ij4(i,u){try{return!await i.alive(u)}catch(t){return console.warn(`[vm-events] alive probe failed for ${u}; assuming alive: ${t instanceof Error?t.message:String(t)}`),!1}}async function uj4(i){let{ctx:u,runner:t,claimName:f,userId:l,projectRef:c,sandboxProviderKind:E}=i;try{await t.delete(f)}catch($){console.warn(`[vm-events] runner.delete failed for ${f}: ${$ instanceof Error?$.message:String($)}`)}try{await new xg(u.db).delete({userId:l,projectRef:c},E)}catch($){console.warn(`[vm-events] sandbox_runner_state delete failed for ${l}/${c}/${E}: ${$ instanceof Error?$.message:String($)}`)}}async function tj4(i){let{stream:u,claimName:t,runner:f,signal:l}=i;return new Promise((c)=>{let E=!1,$=!1,w=null,d=(v)=>{if(E)return;E=!0,clearTimeout(h),l.removeEventListener("abort",_),w?.unsubscribe(),c(v)},h=setTimeout(()=>{if($||E)return;u.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"claim-never-created",message:"Sandbox claim was never created. The SANDBOX_START call may have failed earlier \u2014 check the start error."})}).catch(()=>{}),d(!1)},sS4),_=()=>d(!1);l.addEventListener("abort",_,{once:!0}),w=xo(f,t,(v)=>{if(E)return;if(v.kind!=="claiming")$=!0;if(u.writeSSE({event:"phase",data:JSON.stringify(v)}).catch(()=>{}),v.kind==="ready")d(!0);else if(v.kind==="failed")d(!1)})})}async function fj4(i){let{stream:u,runner:t,claimName:f,signal:l}=i,c=Date.now(),E=null;while(!l.aborted){let w=null;try{w=await t.proxyDaemonRequest(f,"/_sandbox/events",{method:"GET",headers:new Headers({accept:"text/event-stream"}),body:null,signal:l})}catch(d){if(l.aborted)return;if(Date.now()-c<m0t){await O0(e0t,{signal:l}).catch(()=>{});continue}let h=d instanceof Error?d.message:String(d);await u.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:`Upstream daemon SSE error: ${h}`})}).catch(()=>{});return}if(w.status===404){try{await w.body?.cancel()}catch{}if(Date.now()-c<m0t){await O0(e0t,{signal:l}).catch(()=>{});continue}await u.writeSSE({event:"gone",data:""}).catch(()=>{});return}if(!w.ok||!w.body){try{await w.body?.cancel()}catch{}await u.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:`Upstream daemon SSE failed (${w.status}).`})}).catch(()=>{});return}E=w;break}if(!E||!E.body)return;let $=E.body.getReader();try{while(!l.aborted){let{value:w,done:d}=await $.read();if(d)break;if(w)await u.write(w)}}catch{}finally{try{$.releaseLock()}catch{}}}var sS4=90000,pS4=15000,a0t=()=>{let i=new Wu;return i.get("/",async(u)=>{let t=u.var.studioContext;try{ki(t)}catch{return u.json({error:"Unauthorized"},401)}let f=Hu(t);if(!f)return u.json({error:"Unauthorized"},401);let l;try{l=yi(t)}catch{return u.json({error:"Organization scope required"},403)}let c=u.req.query("virtualMcpId"),E=u.req.query("branch");if(!c||!E)return u.json({error:"virtualMcpId and branch are required"},400);let $=await t.storage.virtualMcps.findById(c);if(!$||$.organization_id!==l.id)return u.json({error:"Virtual MCP not found"},404);let w=G8({orgId:l.id,virtualMcpId:c,branch:E}),d=DR({userId:f,projectRef:w},E),h=$.metadata??null,_,v=null,D=null;try{let N=await Pd(t,{userId:f,branch:E,virtualMcpMetadata:h});_=N.provider,v=N.kind}catch(N){D=N instanceof Error?N:Error(String(N)),_=null}let n=v&&_5(Il(h),f,E,v),O=!!n&&n.sandboxHandle===d;if(!_)return e3(u,async(N)=>{await N.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:D?.message??"No sandbox runner configured on this studio instance."})})});return u.header("X-Accel-Buffering","no"),u.header("Content-Encoding","identity"),e3(u,async(N)=>{let y=new AbortController,Z=setInterval(()=>{N.writeSSE({event:"keepalive",data:""}).catch(()=>{clearInterval(Z)})},pS4);N.onAbort(()=>{y.abort(),clearInterval(Z)});try{if(O&&v){if(await ij4(_,d)){await uj4({ctx:t,runner:_,claimName:d,userId:f,projectRef:w,sandboxProviderKind:v}),await N.writeSSE({event:"gone",data:""}).catch(()=>{});return}}if(!await tj4({stream:N,claimName:d,runner:_,signal:y.signal})||y.signal.aborted)return;await fj4({stream:N,runner:_,claimName:d,signal:y.signal})}finally{clearInterval(Z)}})}),i},m0t=60000,e0t=500;var o0t=g(()=>{yf();RJ();Zd();y4();PPi();ko();MK();rhi();nw()});function cj4(i){return i.filter((u)=>u.vendors?.alias).map((u)=>({name:u.name,title:u.title,description:u.description,logo:u.logo,category:u.category,vendor:{alias:u.vendors.alias,url:u.vendors.url}}))}async function Ej4(i,u){let t=await fetch(`${i}/rest/v1/apps?select=name,title,description,logo,category,vendors(alias,url)`,{headers:{apikey:u,Authorization:`Bearer ${u}`,Accept:"application/json"},signal:AbortSignal.timeout(lj4)});if(!t.ok){let f=await t.text().catch(()=>t.statusText);throw console.error(`[deco-apps] Supabase error (${t.status}): ${f.slice(0,200)}`),Error(`External service error (${t.status})`)}return await t.json()}var lj4=1e4,$j4=async(i,u)=>{if(!i.get("studioContext").auth.user?.id)return i.json({error:"Unauthorized"},401);return u()},s0t=()=>{let i=new Wu;return i.use("*",$j4),i.get("/",async(u)=>{let t=yu(),f=t.decoSupabaseUrl,l=t.decoSupabaseServiceKey;if(!f||!l)return u.json({apps:[]});try{let c=await Ej4(f,l);return u.json({apps:cj4(c)})}catch(c){return console.error("[deco-apps] GET error:",c),u.json({error:"Failed to fetch apps"},502)}}),i};var p0t=g(()=>{yf();vt()});import{z as bu}from"zod";function z5(i,u="invalid_request_error",t=null,f=null){return{error:{message:i,type:u,param:t,code:f}}}function Nj4(i){if(!i)return null;let u=i.indexOf(":");if(u===-1)return{credentialId:null,modelId:i};let t=i.substring(0,u),f=i.substring(u+1);if(!t||!f)return null;return{credentialId:t,modelId:f}}function yj4(i,u,t){try{return JSON.parse(i)}catch{throw new ttt(`Invalid JSON in tool call arguments for function '${t}' (tool_call_id: ${u}): ${i}`)}}function Zj4(i){let u={};for(let t of i)if(t.role==="assistant"&&t.tool_calls)for(let f of t.tool_calls)u[f.id]=f.function.name;return i.map((t)=>{switch(t.role){case"system":return{role:"system",content:t.content};case"user":if(typeof t.content==="string")return{role:"user",content:t.content};return{role:"user",content:t.content.map((l)=>{if(l.type==="text")return{type:"text",text:l.text};return{type:"image",image:l.image_url.url}})};case"assistant":if(t.tool_calls&&t.tool_calls.length>0)return{role:"assistant",content:t.tool_calls.map((l)=>({type:"tool-call",toolCallId:l.id,toolName:l.function.name,input:yj4(l.function.arguments,l.id,l.function.name)}))};return{role:"assistant",content:t.content??""};case"tool":let f=u[t.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:t.tool_call_id,toolName:f,output:{type:"text",value:t.content}}]}}})}function Tj4(i){let u=i.map((t)=>{let f=t.function.parameters?$d(t.function.parameters):$d({type:"object",properties:{}});return[t.function.name,H0({description:t.function.description,inputSchema:f})]});return Object.fromEntries(u)}function Bj4(i){if(!i)return;return{openai:{response_format:i}}}function Fj4(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function itt(i,u,t,f,l,c){let E={model:i,messages:u,tools:t,temperature:f.temperature,maxTokens:f.max_tokens,topP:f.top_p,frequencyPenalty:f.frequency_penalty,presencePenalty:f.presence_penalty,stopSequences:f.stop?Array.isArray(f.stop)?f.stop:[f.stop]:void 0,abortSignal:c};return l?{...E,providerOptions:l}:E}function utt(i){if(i==="tool-calls")return"tool_calls";if(i==="length")return"length";return"stop"}var wj4=256,dj4,hj4,_j4,vj4,Dj4,nj4,gj4,Oj4,ttt,ftt,ltt;var ctt=g(()=>{Pf();yf();RJ();dj4=bu.object({type:bu.literal("function"),function:bu.object({name:bu.string(),description:bu.string().optional(),parameters:bu.record(bu.string(),bu.unknown()).optional()})}),hj4=bu.object({id:bu.string(),type:bu.literal("function"),function:bu.object({name:bu.string(),arguments:bu.string()})}),_j4=bu.discriminatedUnion("role",[bu.object({role:bu.literal("system"),content:bu.string(),name:bu.string().optional()}),bu.object({role:bu.literal("user"),content:bu.union([bu.string(),bu.array(bu.union([bu.object({type:bu.literal("text"),text:bu.string()}),bu.object({type:bu.literal("image_url"),image_url:bu.object({url:bu.string(),detail:bu.string().optional()})})]))]),name:bu.string().optional()}),bu.object({role:bu.literal("assistant"),content:bu.string().nullable().optional(),name:bu.string().optional(),tool_calls:bu.array(hj4).optional()}),bu.object({role:bu.literal("tool"),content:bu.string(),tool_call_id:bu.string()})]),vj4=bu.object({type:bu.literal("text")}),Dj4=bu.object({type:bu.literal("json_object")}),nj4=bu.object({type:bu.literal("json_schema"),json_schema:bu.object({name:bu.string(),description:bu.string().optional(),schema:bu.record(bu.string(),bu.unknown()),strict:bu.boolean().optional()})}),gj4=bu.union([vj4,Dj4,nj4]),Oj4=bu.object({model:bu.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:bu.array(_j4),stream:bu.boolean().optional().default(!1),temperature:bu.number().min(0).max(2).optional(),max_tokens:bu.number().positive().optional(),top_p:bu.number().min(0).max(1).optional(),frequency_penalty:bu.number().min(-2).max(2).optional(),presence_penalty:bu.number().min(-2).max(2).optional(),stop:bu.union([bu.string(),bu.array(bu.string())]).optional(),tools:bu.array(dj4).optional(),tool_choice:bu.union([bu.literal("auto"),bu.literal("none"),bu.literal("required"),bu.object({type:bu.literal("function"),function:bu.object({name:bu.string()})})]).optional(),response_format:gj4.optional(),user:bu.string().optional()});ttt=class ttt extends Error{constructor(i){super(i);this.name="MessageConversionError"}};ftt=new Wu;ftt.post("/:org/v1/chat/completions",async(i)=>{let u=i.get("studioContext"),t=i.req.param("org");try{if(!u.auth.apiKey?.id)return i.json(z5("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!u.organization)return i.json(z5("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((u.organization.slug??u.organization.id)!==t)return i.json(z5("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let f=await i.req.json(),l=Oj4.safeParse(f);if(!l.success){let N=l.error.issues[0]??{message:"Invalid request",path:[]};return i.json(z5(`Invalid request: ${N.message}`,"invalid_request_error",N.path.length>0?N.path.join("."):null),400)}let c=l.data,E=Nj4(c.model);if(!E)return i.json(z5("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:$}=E,{modelId:w}=E;if(!$){let N=await u.storage.aiProviderKeys.list({organizationId:u.organization.id});if(N.length===0)return i.json(z5("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);$=N[0].id}let d;try{d=await u.aiProviders.activate($,u.organization.id)}catch{return i.json(z5(`AI provider credential not found or inaccessible: ${$}`,"invalid_request_error","model"),404)}let h=d.aiSdk.languageModel(w),_=Zj4(c.messages),v=c.tools?Tj4(c.tools):void 0,D=Bj4(c.response_format),n=Fj4(),O=Math.floor(Date.now()/1000);if(c.stream)return e3(i,async(N)=>{let y=itt(h,_,v,c,D,i.req.raw.signal);try{let Z=X3(y),T=!1,B=0,F="",A=async()=>{if(F.length===0)return;let G=F;F="",await N.writeSSE({data:JSON.stringify({id:n,object:"chat.completion.chunk",created:O,model:c.model,choices:[{index:0,delta:{content:G},finish_reason:null}]})})};for await(let G of Z.fullStream){if(!T&&(G.type==="text-delta"||G.type==="tool-call"))await N.writeSSE({data:JSON.stringify({id:n,object:"chat.completion.chunk",created:O,model:c.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),T=!0;if(G.type==="text-delta"){if(F+=G.text,F.length>=wj4)await A()}else if(G.type==="tool-call"){await A();let I=B++;await N.writeSSE({data:JSON.stringify({id:n,object:"chat.completion.chunk",created:O,model:c.model,choices:[{index:0,delta:{tool_calls:[{index:I,id:G.toolCallId,type:"function",function:{name:G.toolName,arguments:JSON.stringify(G.input)}}]},finish_reason:null}]})})}else if(G.type==="finish")await A(),await N.writeSSE({data:JSON.stringify({id:n,object:"chat.completion.chunk",created:O,model:c.model,choices:[{index:0,delta:{},finish_reason:utt(G.finishReason)}],usage:G.totalUsage?{prompt_tokens:G.totalUsage.inputTokens??0,completion_tokens:G.totalUsage.outputTokens??0,total_tokens:G.totalUsage.totalTokens??0}:void 0})})}await A(),await N.writeSSE({data:"[DONE]"})}catch(Z){let T=Z;console.error("[openai-compat:stream] Error:",T.message),await N.writeSSE({data:JSON.stringify({error:{message:T.message,type:"server_error"}})})}});else{let N=itt(h,_,v,c,D,i.req.raw.signal),y=await Ng(N),Z={role:"assistant",content:y.text||null};if(y.toolCalls&&y.toolCalls.length>0)Z.tool_calls=y.toolCalls.map((T)=>({id:T.toolCallId,type:"function",function:{name:T.toolName,arguments:JSON.stringify("input"in T?T.input:{})}})),Z.content=null;return i.json({id:n,object:"chat.completion",created:O,model:c.model,choices:[{index:0,message:Z,finish_reason:utt(y.finishReason)}],usage:{prompt_tokens:y.usage?.inputTokens??0,completion_tokens:y.usage?.outputTokens??0,total_tokens:y.usage?.totalTokens??0}})}}catch(f){let l=f;if(l.name==="AbortError")return i.json(z5("Request aborted","invalid_request_error"),400);if(l.name==="MessageConversionError")return i.json(z5(l.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",l.message,l.stack),i.json(z5(l.message,"server_error"),500)}});ltt=ftt});function Pj4(){let i=process.env.POSTHOG_KEY;if(!i)return null;return{key:i,host:process.env.POSTHOG_HOST??Uj4}}var Ett,Uj4="https://ph.studio.decocms.com",$tt;var wtt=g(()=>{yf();bmi();qg();cE();vt();J3u();X1i();Ett=new Wu;Ett.get("/",(i)=>{let u={version:iW.version,theme:Nl0(),...TN().logo&&{logo:TN().logo},...Q3()&&{internalUrl:Uli()},...yu().enableDecoImport&&{enableDecoImport:!0},brandExtractEnabled:!!yu().firecrawlApiKey,auth:ae0(),posthog:Pj4(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:!Q3()&&yu().sandboxProviderKind==="agent-sandbox"}};return i.header("Cache-Control","no-store"),i.json({success:!0,config:u})});$tt=Ett});function JAi(i){let u=(i??"").trim().toLowerCase();return u=u.replace(/^https?:\/\//,""),u=u.replace(/^www\./,""),u=u.split(/[/?#]/)[0]??"",u.replace(/\/+$/,"")}function htt(i){return(JAi(i).split(".")[0]||i).replace(/[-_]/g," ").split(" ").filter(Boolean).map((t)=>t.charAt(0).toUpperCase()+t.slice(1)).join(" ")}function _tt(i,u=64){return`https://www.google.com/s2/favicons?domain=${encodeURIComponent(JAi(i))}&sz=${u}`}function dtt(i,u){let t=i.trim();if(t.length<=u)return t;let f=t.slice(0,u-1),l=f.lastIndexOf(" ");return`${(l>u*0.6?f.slice(0,l):f).trimEnd()}\u2026`}function vtt(i){let{brand:u,domain:t,score:f,verdict:l}=i,c=typeof f==="number"?`${u} commerce report \u2014 ${Math.round(f)}/100 \xB7 decocms`:`${u} commerce report \xB7 decocms`,E=`See the full ${u} scorecard \u2014 SEO, performance, conversion & AEO signals scored by decocms.`,$=l?.trim()?dtt(`${l.trim().replace(/\s+/g," ")} \u2014 ${E}`,200):dtt(`How does ${t} really perform? ${E}`,200);return{title:c,description:$}}import{join as Aj4}from"path";function hn(i){return i.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function Ij4(i){let u=JAi(i),t=htt(u),f=_tt(u,128),c=`${(yu().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(u)}`,{title:E,description:$}=vtt({brand:t,domain:u});return[`<title>${hn(E)}</title>`,`<meta name="description" content="${hn($)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${hn(E)}" />`,`<meta property="og:description" content="${hn($)}" />`,`<meta property="og:url" content="${hn(c)}" />`,'<meta name="twitter:card" content="summary" />',`<meta name="twitter:title" content="${hn(E)}" />`,`<meta name="twitter:description" content="${hn($)}" />`,`<link rel="canonical" href="${hn(c)}" />`,`<link rel="icon" href="${hn(f)}" sizes="any" />`].join(`
     `)}function xj4(i,u){return i.replace(/<title>[\s\S]*?<\/title>\s*/i,"").replace(/<meta\s+name="(?:description|twitter:[^"]*)"[^>]*>\s*/gi,"").replace(/<meta\s+property="og:[^"]*"[^>]*>\s*/gi,"").replace(/<link\s+rel="icon"[^>]*>\s*/gi,"").replace("</head>",`    ${u}
-  </head>`)}function Dtt(i){let u=new Wu;return u.get("/:domain",async(t)=>{let f=t.req.param("domain"),l=i?Aj4(i,"index.html"):null,c=l?Bun.file(l):null;if(!c||!await c.exists())return t.notFound();let E=await c.text();try{let $=Ij4(f);return t.html(xj4(E,$),200,{"Cache-Control":"public, max-age=0, s-maxage=300"})}catch{return t.html(E)}}),u}var ntt=g(()=>{yf();vt()});import{z as $u}from"zod";var bJ,kj4,Gj4,Sj4,jj4,gtt;var Ott=g(()=>{bJ=$u.enum(["good","bad","neutral"]),kj4=$u.preprocess((i)=>{if(Array.isArray(i))return{kind:"text",value:i.find((t)=>t!==null&&typeof t!=="object")??""};return i!==null&&typeof i==="object"?i:{kind:"text",value:i}},$u.object({kind:$u.enum(["text","number","sparkline","badge","score"]).catch("text"),value:$u.coerce.string().optional(),tone:bJ.optional(),muted:$u.boolean().optional(),delta:$u.coerce.string().optional(),deltaDir:$u.enum(["up","down","neutral"]).optional(),points:$u.array($u.coerce.number()).optional(),label:$u.coerce.string().optional()}).transform((i)=>{if(i.kind==="badge"&&i.label==null)i.label=i.value??"";if(i.kind==="score"){let u=Number(i.value);if(Number.isNaN(u))return{...i,kind:"text"}}return i})),Gj4=$u.preprocess((i)=>{let u=i;if(u&&typeof u==="object"&&!Array.isArray(u)&&Array.isArray(u.cells))u=u.cells;if(Array.isArray(u)&&u.length===1&&Array.isArray(u[0]))u=u[0];if(Array.isArray(u))return u;if(u&&typeof u==="object")return Object.values(u);return u},$u.array(kj4)),Sj4={key:$u.coerce.string(),title:$u.coerce.string(),eyebrow:$u.coerce.string().optional(),headline:$u.coerce.string(),annotation:$u.coerce.string().optional(),methodology:$u.coerce.string().optional(),sources:$u.array($u.object({name:$u.coerce.string(),logoUrl:$u.coerce.string()})).optional()},jj4=$u.discriminatedUnion("template",[$u.object({template:$u.literal("cover"),score:$u.object({value:$u.coerce.number(),max:$u.coerce.number().optional(),grade:$u.coerce.string().optional(),label:$u.coerce.string().optional()}).optional(),brandImage:$u.coerce.string().optional(),screenshot:$u.coerce.string().optional(),mobileScreenshot:$u.coerce.string().optional()}),$u.object({template:$u.literal("cta"),ctaUrl:$u.coerce.string().optional(),ctaLabel:$u.coerce.string().optional(),bullets:$u.array($u.coerce.string()).optional()}),$u.object({template:$u.literal("series"),points:$u.array($u.coerce.number()).min(2),xLabels:$u.array($u.coerce.string()).min(1),unit:$u.coerce.string().optional(),callout:$u.object({index:$u.coerce.number(),value:$u.coerce.string(),tone:bJ.optional()})}),$u.object({template:$u.literal("threshold"),value:$u.coerce.string().default(""),metricLabel:$u.coerce.string().optional(),ratio:$u.coerce.number(),thresholdRatio:$u.coerce.number().optional(),thresholdLabel:$u.coerce.string().default(""),tone:bJ.optional()}),$u.object({template:$u.literal("stats"),stats:$u.array($u.object({value:$u.coerce.string(),label:$u.coerce.string(),tone:bJ.optional()})).min(1)}),$u.object({template:$u.literal("bars"),items:$u.array($u.object({value:$u.coerce.string(),label:$u.coerce.string(),ratio:$u.coerce.number(),tone:bJ.optional()})).min(1)}),$u.object({template:$u.literal("gauges"),gauges:$u.array($u.object({label:$u.coerce.string(),value:$u.coerce.string(),status:$u.enum(["good","warn","bad"]).catch("warn"),caption:$u.coerce.string().optional(),ratio:$u.coerce.number().optional()})).min(1)}),$u.object({template:$u.literal("checklist"),checks:$u.array($u.object({label:$u.coerce.string(),status:$u.enum(["pass","fail","warn"]).catch("fail"),value:$u.coerce.string().optional()})).min(1)}),$u.object({template:$u.literal("table"),columns:$u.array($u.object({label:$u.coerce.string(),align:$u.enum(["left","right"]).optional()})).min(1),rows:$u.array(Gj4).min(1),highlightRow:$u.coerce.number().optional()}),$u.object({template:$u.literal("products"),products:$u.array($u.object({name:$u.coerce.string(),price:$u.coerce.string().optional(),image:$u.coerce.string().optional(),url:$u.coerce.string().optional()})).min(1)}),$u.object({template:$u.literal("list"),entries:$u.array($u.object({label:$u.coerce.string(),severity:$u.enum(["error","warning","notice"]).catch("notice")})).min(1),moreCount:$u.coerce.number().optional()}),$u.object({template:$u.literal("keywords"),volumeLabel:$u.coerce.string().optional(),keywords:$u.array($u.object({term:$u.coerce.string(),volume:$u.coerce.string(),position:$u.coerce.number().catch(0)})).min(1)}),$u.object({template:$u.literal("competitor"),metricLabel:$u.coerce.string().optional(),competitors:$u.array($u.object({name:$u.coerce.string(),value:$u.coerce.string(),tone:bJ.optional(),isYou:$u.boolean().optional()})).min(1)}),$u.object({template:$u.literal("scorecard"),rivalLabel:$u.coerce.string().optional(),dimensions:$u.array($u.object({label:$u.coerce.string(),you:$u.coerce.string(),rival:$u.coerce.string().optional(),rivalName:$u.coerce.string().optional(),tone:bJ.optional()})).min(1)})]),gtt=$u.object({...Sj4,template:jj4})});function Ntt(i){let u=[],t=[...i.sections].sort((f,l)=>f.position-l.position).map((f)=>{let l=gtt.safeParse(f.props);if(l.success)return l.data;let c=l.error.issues[0];return u.push({section_type:f.section_type,position:f.position,reason:c?`${c.path.join(".")||"(root)"}: ${c.message}`:"contract violation"}),null}).filter((f)=>f!==null);return{deck:{meta:{...i.meta,scores:i.summary?.scores},slides:t},drops:u}}var ytt=g(()=>{Ott()});function Wp(i,u){return fetch(`${JN({})}${i}`,u)}async function Kj4(i,u){let t=await Wp(`/api/v2/public/diagnostics/${encodeURIComponent(i)}`+(u?`?pw=${encodeURIComponent(u)}`:""),{headers:{Accept:"application/json"}});if(t.status===404)return{status:"not_found",deck:null,scanned_at:null,drops:[]};if(!t.ok)throw Error(`report read HTTP ${t.status}`);let f=await t.json(),{deck:l,drops:c}=Ntt(f);return{status:l.slides.length?"ready":"empty",deck:l,scanned_at:f.scanned_at,drops:c}}var Jj4,CJ,Ztt;var Ttt=g(()=>{yf();Z_();FY();ytt();Jj4=new Set(["complete","errored","terminated","unknown"]),CJ=new Wu;CJ.use("*",async(i,u)=>{let t=await et.api.getSession({headers:i.req.raw.headers});if(!t?.user?.id)return i.json({error:"Authentication required"},401,{"Cache-Control":"private, no-store",Vary:"Cookie"});i.set("reportUser",{email:t.user.email}),await u(),i.header("Cache-Control","private, no-store"),i.header("Vary","Cookie");return});CJ.get("/site/:domain",async(i)=>{let u=i.req.param("domain").trim();if(!u)return i.json({error:"domain is required"},400);let t=i.req.query("key")?.trim()||void 0;try{let f=await Kj4(u,t);return i.header("Cache-Control","private, no-store"),i.json(f)}catch{return i.json({error:"report read failed"},502)}});CJ.post("/run",async(i)=>{let u;try{u=await i.req.json()}catch{return i.json({error:"invalid JSON"},400)}let t=typeof u.domain==="string"?u.domain.trim():"";if(!t)return i.json({error:"domain is required"},400);let f=i.get("reportUser").email,l=typeof u.distinctId==="string"&&u.distinctId.trim()&&u.distinctId.length<=200?u.distinctId.trim():void 0;try{let c=await Wp("/api/v2/diagnostics/run",{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${XN({})}`},body:JSON.stringify({url:t,email:f,distinct_id:l})});if(!c.ok)return i.json({error:`run HTTP ${c.status}`},502);let E=await c.json(),$=E.blocked?{state:"blocked"}:E.status==="fresh"?{state:"fresh"}:E.mode==="sync"?{state:"sync"}:{state:"running",id:E.id??null};return i.json($)}catch{return i.json({error:"run failed"},502)}});CJ.get("/status",async(i)=>{let u=i.req.query("id");if(!u)return i.json({error:"id is required"},400);try{let t=await Wp(`/api/v2/diagnostics/status?id=${encodeURIComponent(u)}`,{headers:{Authorization:`Bearer ${XN({})}`}});if(!t.ok)return i.json({error:`status HTTP ${t.status}`},502);let l=(await t.json()).status??"unknown",c={done:Jj4.has(l),status:l};return i.json(c)}catch{return i.json({error:"status failed"},502)}});CJ.get("/link-token/:id",async(i)=>{let u=i.req.param("id");try{let t=await Wp(`/api/v2/public/link-tokens/${encodeURIComponent(u)}`,{headers:{Accept:"application/json"}});if(t.status===404)return i.json(null);if(!t.ok)return i.json({error:`link token HTTP ${t.status}`},502);return i.json(await t.json())}catch{return i.json({error:"link token resolve failed"},502)}});CJ.get("/suggest",async(i)=>{let u=(i.req.query("q")??"").trim().slice(0,64);if(u.length<2)return i.json({suggestions:[]});try{let t=await Wp(`/api/v2/public/suggest?q=${encodeURIComponent(u)}`,{headers:{Accept:"application/json"}});if(!t.ok)return i.json({suggestions:[]});let f=await t.json();return i.json({suggestions:Array.isArray(f.suggestions)?f.suggestions:[]})}catch{return i.json({suggestions:[]})}});Ztt=CJ});function Btt(i,u){if(u.startsWith("text/html")||u.startsWith("image/svg"))i.set("Content-Security-Policy","sandbox allow-scripts allow-modals allow-same-origin")}var Ftt,Xj4,Lj4,Utt;var Ptt=g(()=>{yf();Ch();DH();aW();Ftt=new Wu,Xj4=["range","if-none-match","if-modified-since"],Lj4=["content-type","content-length","content-range","accept-ranges","etag","last-modified"];Ftt.get("/:org/files/*",async(i)=>{let u=i.get("studioContext"),t=u.organization?.id;if(!u.auth?.user?.id){if(PR(i))return i.redirect(`/login?next=${encodeURIComponent(i.req.path)}`,302);throw new I0(401,{message:"Authentication required"})}if(!t)throw new I0(401,{message:"Organization context required"});let f=i.req.path.replace(/^.*\/files\//,"");if(!f)throw new I0(400,{message:"Missing file key"});let l=await Yo(f,u);if(!l)throw new I0(503,{message:"Object storage not configured"});if(l.startsWith("data:")&&bh()){let w=l.match(/^data:([^;]+);base64,(.+)$/s);if(!w)throw new I0(500,{message:"Invalid data URL from storage"});let[,d,h]=w,_=Buffer.from(h,"base64"),v=new Headers({"Content-Type":d,"Cache-Control":"private, max-age=86400"});return Btt(v,d),new Response(_,{status:200,headers:v})}let c=new Headers;for(let w of Xj4){let d=i.req.header(w);if(d)c.set(w,d)}let E=await fetch(l,{headers:c});if(E.status===403||E.status===404)throw new I0(404,{message:"File not found"});if(!E.ok&&E.status!==304&&E.status!==416)throw console.error(`[files] upstream storage error ${E.status} for key:`,f),new I0(502,{message:"Upstream storage error"});let $=new Headers;for(let w of Lj4){let d=E.headers.get(w);if(d)$.set(w,d)}return $.set("Cache-Control","private, max-age=86400"),Btt($,$.get("content-type")??""),new Response(E.body,{status:E.status,headers:$})});Utt=Ftt});function ktt(i){let u=i?.connectFn??zj4,t=null,f=null,l=!1,c=!1,E=!1,$=[];function w(){return t!==null&&!t.isClosed()&&!t.isDraining()&&!E}function d(){console.log(`[NatsProvider] fireReady: ${$.length} callbacks`);for(let v of $)try{v()}catch{}}function h(v){(async()=>{for await(let D of v.status())if(D.type==="disconnect")console.log("[NatsProvider] Disconnected"),E=!0;else if(D.type==="reconnect")console.log("[NatsProvider] Reconnected, re-firing ready callbacks"),E=!1,f=null,d()})().catch(()=>{})}async function _(v,D){let n=0;while(!c)try{t=await u({servers:v,timeout:Qj4,reconnect:!0,maxReconnectAttempts:-1,...D?{authenticator:D}:{}}),console.log(`[NatsProvider] Connected to ${t.getServer()} after ${n} attempt(s)`),f=null,E=!1,h(t),d();return}catch{n++;let O=c6(Yj4,Wj4,n-1,2,0.5);await O0(O)}}return{init(v,D){if(l)return;l=!0,c=!1;let n=D?.creds?Att.credsAuthenticator(new TextEncoder().encode(D.creds)):void 0;_(v,n).catch(()=>{})},isConnected(){return w()},getConnection(){return w()?t:null},getJetStream(){if(!w())return null;if(!f)f=xtt.jetstream(t);return f},onReady(v){if($.push(v),w())try{v()}catch{}},async drain(){if(c=!0,l=!1,f=null,E=!1,t){let v=t;t=null,await v.drain().catch(()=>{})}}}}function zj4(i){return Itt.connect(i)}var Att,Itt,xtt,Wj4=100,Yj4=3000,Qj4=3000;var Gtt=g(()=>{y4();Att=S(RO(),1),Itt=S(HHi(),1),xtt=S(O2(),1)});function qR(i){let u=i?.ttlMs??60000,t=i?.maxSize??1e4,f=i?.updateRecencyOnGet??!1,l=new Map;function c(){if(l.size<=t)return;let E=Date.now();for(let[$,w]of l)if(w.expiresAt<=E)l.delete($);while(l.size>t){let $=l.keys().next().value;if($===void 0)break;l.delete($)}}return{get(E){let $=l.get(E);if(!$)return;if($.expiresAt<=Date.now()){l.delete(E);return}if(f)l.delete(E),l.set(E,$);return $.value},set(E,$){l.delete(E),l.set(E,{value:$,expiresAt:Date.now()+u}),c()},delete(E){l.delete(E)},clear(){l.clear()},size(){return l.size}}}function Uvu(i,u){return`${i}.${u}`}class Pvu{cache;constructor(i){this.cache=qR({ttlMs:i?.ttlMs??Hj4,maxSize:i?.maxSize??Rj4})}async get(i,u){return this.cache.get(Uvu(i,u))??null}async set(i,u,t){this.cache.set(Uvu(i,u),t)}async invalidate(i,u){this.cache.delete(Uvu(i,u))}teardown(){this.cache.clear()}}var Hj4=600000,Rj4=5000;var Stt=()=>{};function XAi(i,u){return`${i}:${u}`}function Avu(i){let u=qR({ttlMs:i?.ttlMs??bj4,maxSize:i?.maxSize??Cj4}),t=i?.getConnection,f=crypto.randomUUID(),l=new TextEncoder,c=new TextDecoder,E=null;function $(w,d){let h=t?.();if(!h)return;try{h.publish(jtt,l.encode(JSON.stringify({organizationId:w,keyId:d,originId:f})))}catch(_){console.warn("[ProviderKeyCache] Publish failed (non-critical):",_)}}return{get(w,d){return u.get(XAi(w,d))},set(w,d,h){u.set(XAi(w,d),h)},invalidate(w,d){u.delete(XAi(w,d)),$(w,d)},start(){if(E)return;let w=t?.();if(!w)return;E=w.subscribe(jtt),(async()=>{for await(let d of E)try{let h=JSON.parse(c.decode(d.data));if(h.originId===f)continue;u.delete(XAi(h.organizationId,h.keyId))}catch{}})().catch(console.error)},teardown(){E?.unsubscribe(),E=null,u.clear()}}}var jtt="studio.ai-provider-keys.invalidate",bj4=30000,Cj4=5000;var Ktt=()=>{};class Ivu{options;sub=null;onCancel=null;encoder=new TextEncoder;originId=crypto.randomUUID();constructor(i){this.options=i}async start(i){if(i)this.onCancel=i;if(this.sub)return;if(!this.onCancel)return;let u=this.options.getConnection();if(!u)return;this.sub=u.subscribe("mesh.decopilot.cancel");let t=new TextDecoder;(async()=>{for await(let f of this.sub)try{let l=JSON.parse(t.decode(f.data));if(l.originId===this.originId)continue;this.onCancel?.(l.taskId)}catch{}})().catch(console.error)}broadcast(i){if(/[.*>\s]/.test(i)){console.warn("[NatsCancelBroadcast] Invalid threadId, skipping broadcast");return}this.onCancel?.(i);try{let u=this.options.getConnection();if(!u)return;u.publish("mesh.decopilot.cancel",this.encoder.encode(JSON.stringify({taskId:i,originId:this.originId})))}catch(u){console.warn("[NatsCancelBroadcast] Publish failed (non-critical):",u)}}publishControlFrame(i,u){}async stop(){this.sub?.unsubscribe(),this.sub=null,this.onCancel=null}}function aj4(){return{name:P8,subjects:[`${gRi}.>`],storage:H_.StorageType.File,max_age:Vj4,max_bytes:mj4,max_msgs_per_subject:ej4,discard:H_.DiscardPolicy.Old,retention:H_.RetentionPolicy.Limits,duplicate_window:rj4,num_replicas:1}}class Ltt{chunks=0;encodeMs=0;maxMs=0;bytes=0;windowStart=performance.now();constructor(){setInterval(()=>this.flush(),1e4).unref?.()}record(i,u){if(this.chunks++,this.encodeMs+=i,i>this.maxMs)this.maxMs=i;this.bytes+=u}flush(){let i=performance.now(),u=i-this.windowStart;if(this.chunks>0&&u>0)console.warn(JSON.stringify({msg:"stream-encode-trace",windowMs:Math.round(u),chunks:this.chunks,encodeMs:Math.round(this.encodeMs),pctOfLoop:+(this.encodeMs/u*100).toFixed(1),maxChunkMs:+this.maxMs.toFixed(2),mbEncoded:+(this.bytes/1048576).toFixed(2)}));this.chunks=0,this.encodeMs=0,this.maxMs=0,this.bytes=0,this.windowStart=i}}function Jtt(i){let u=Xtt.headers();for(let[t,f]of Object.entries(i))u.set(t,f);return u}function iK4(i,u){let t=0;return{publish(f,l,c,E){f.publish(l,c,E?{headers:E}:void 0).catch(($)=>{if(t++,qj4().add(1,{"org.id":u??"unknown"}),t===1||t%100===0)console.warn(`[Decopilot] JetStream publish failed for thread ${i} (${t} total):`,$)})},get errorCount(){return t}}}class xvu{options;js=null;jsm=null;constructor(i){this.options=i}async init(){let i=this.options.getConnection();if(!i){console.log("[Decopilot] StreamBuffer.init skipped: NATS not connected yet");return}let u=this.options.getJetStreamManager?await this.options.getJetStreamManager():await H_.jetstreamManager(i),t=aj4();try{await u.streams.info(P8),await u.streams.update(P8,t)}catch(f){if(f instanceof Error&&f.message.includes("stream not found"))await u.streams.add(t);else if(f instanceof Error&&/can ?not change.*storage|storage type/i.test(f.message))await u.streams.delete(P8),await u.streams.add(t);else throw f}this.js=this.options.getJetStream(),this.jsm=u,console.log(`[Decopilot] StreamBuffer.init ${this.js?"ready":"degraded (js=null)"}`)}pump(i,u,t,f){let l=this.js;if(!l)return console.warn(`[Decopilot] pump: JetStream client unavailable for thread ${u}; chunks NOT published to NATS`),Promise.resolve();let c=iK4(u,f),E=!1,$=()=>{if(E)return;E=!0;let d=aru(u);l.publish(d.subject,d.data).catch(()=>{})};t.addEventListener("abort",$,{once:!0});let w=(d)=>{let h=performance.now(),_=sL(d,{runId:u}),v=performance.now()-h;if(aM().record(v),oM().add(1,{"org.id":f??"unknown"}),pj4?.record(v,_.reduce((D,n)=>D+n.data.length,0)),_.length===0){console.warn(`[Decopilot] dropping oversized stream chunk for thread ${u}`);return}for(let D of _)c.publish(l,D.subject,D.data,D.headers?Jtt(D.headers):void 0)};return(async()=>{let d=i.getReader(),h=0,_=0,v;try{while(!0){let{done:D,value:n}=await d.read();if(D)break;if(w(n),_++,++h>=64)h=0,await new Promise((O)=>setImmediate(O))}}catch(D){v=D,console.warn(`[Decopilot] stream pump error for thread ${u}:`,D?.message??D)}finally{if(d.releaseLock(),$(),sj4)console.warn(JSON.stringify({msg:"decopilot-stream-diag",event:"pump-done",taskId:u,publishedChunks:_,publishErrors:c.errorCount}))}if(v!==void 0)throw v})()}async publishRawChunk(i,u,t){let f=this.js;if(!f)return!1;let l=performance.now(),c=sL(u,{runId:i,dedup:t});if(aM().record(performance.now()-l),oM().add(1),c.length===0)return console.warn(`[Decopilot] dropping oversized raw chunk for thread ${i} (> MAX_CHUNKED_BYTES)`),!0;for(let E of c)await f.publish(E.subject,E.data,{...E.headers?{headers:Jtt(E.headers)}:{},...E.msgId?{msgID:E.msgId}:{}});return!0}async publishDone(i,u,t){let f=this.js;if(!f)return!1;let l=I1i({runId:i,fenceToken:u,finalSeq:t});return await f.publish(l.subject,l.data,{msgID:l.msgId}),!0}async createTailStream(i,u,t){let f=this.js;if(!f)return console.warn(`[Decopilot] createTailStream: JetStream client unavailable for thread ${i}; no live tail`),null;let l=t?.deliverPolicy==="new"?H_.DeliverPolicy.New:H_.DeliverPolicy.All,c=t?.closeOnDone??!1,E=N2(i),$;try{$=await(await f.consumers.get(P8,{filter_subjects:E,deliver_policy:l})).consume()}catch(O){return console.warn("[Decopilot] JetStream tail unavailable (non-critical):",O?.message??O),null}let h=Dhi({messages:async function*(){try{for await(let O of $)yield{subject:O.subject,data:O.data,headers:O.headers}}finally{$.stop()}}(),onCancel:()=>$.stop()}).pipeThrough(x1i()).pipeThrough(k1i()).getReader(),_=!1,v=()=>{if(_)return;_=!0;try{h.releaseLock()}catch{}},D=!1,n=()=>{if(D)return;D=!0,$.stop(),h.cancel().catch(()=>{}),v()};return u?.addEventListener("abort",n,{once:!0}),new ReadableStream({async pull(O){for(;;){let{done:N,value:y}=await h.read();if(N){n(),O.close();return}let Z=y;if(Z.kind==="done"){if(c){n(),O.close();return}continue}O.enqueue(Z.chunk);return}},cancel(){n()}})}purge(i){if(!this.jsm)return;this.jsm.streams.purge(P8,{filter:N2(i)}).catch(()=>{})}teardown(){this.js=null,this.jsm=null}}var H_,Xtt,Mj4=(i)=>{let u;return()=>u??=i()},qj4,Vj4=86400000000000,rj4=120000000000,mj4=4294967296,ej4=500000,oj4,sj4,pj4;var Wtt=g(()=>{bfu();nhi();G1i();jl();ZRi();H_=S(O2(),1),Xtt=S(RO(),1),qj4=Mj4(()=>Bt.createCounter("decopilot.stream.publish_errors",{description:"Number of JetStream publish failures for decopilot stream chunks",unit:"{errors}"}));oj4=process.env.STREAM_ENCODE_TRACE==="1",sj4=process.env.DECOPILOT_STREAM_TRACE==="1";pj4=oj4?new Ltt:null});function Ytt(i){let u=i.createFetch??uK4,t=i.timeoutMs??2000;return async(f)=>{try{let l=i.getConnection();if(!l)return kvu;let c=Nh(f),$=await u(l,t)(`tunnel://${c}/api/links/status`,{method:"GET"});if(!$.ok)return kvu;let w=await $.json();return{online:!0,hostname:w.hostname,capabilities:w.capabilities??[],cliVersion:w.cliVersion}}catch{return kvu}}}var kvu,uK4=(i,u)=>w2({connection:i,firstFrameTimeoutMs:u});var Qtt=g(()=>{IM();HM();kvu={online:!1,capabilities:[]}});async function*tK4(i){if(!i.body){yield{headers:{status:i.status,headers:Object.fromEntries(i.headers.entries())}};return}let u=i.body.getReader(),t=!1;try{yield{headers:{status:i.status,headers:Object.fromEntries(i.headers.entries())}};while(!0){let{done:f,value:l}=await u.read();if(f){t=!0;return}yield{data:Buffer.from(l).toString("base64")}}}finally{try{if(!t)await u.cancel()}catch{}finally{u.releaseLock()}}}function ztt(i){let u=i.createFetch??((t)=>w2({connection:t,idleTimeoutMs:fK4}));return async function*(f,l,c){let E=i.getConnection();if(!E)throw Error("link_unavailable: NATS unavailable");let $=Nh(f),w=u(E),d={method:l.method,headers:l.headers,signal:c?.signal};if(l.body!=null)d.body=l.body;let h=await w(`tunnel://${$}${l.path}`,d);yield*tK4(h)}}var fK4=45000;var Htt=g(()=>{IM();HM()});function Rtt(i){let u=i.createFetch??((t)=>w2({connection:t,idleTimeoutMs:lK4}));return{async publish(t,f,l){let c=i.getConnection();if(!c)throw Error("link_unavailable: NATS unavailable");let E=Nh(t),w=await u(c)(`tunnel://${E}/api/links/work`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(f),signal:l?.signal});if(!w.ok){let d=await w.text().catch(()=>"");throw Error(`tunnel work publish failed (${w.status})${d?`: ${d}`:""}`)}await w.body?.cancel().catch(()=>{})}}}function btt(i){let u=i.createFetch??w2;return{async publishControlFrame(t,f,l){let c=i.getConnection();if(!c)throw Error("link_unavailable: NATS unavailable");let E=Nh(t),w=await u(c)(`tunnel://${E}/api/links/control`,{method:"POST",headers:{"content-type":"application/json"},body:vmu(f),signal:l?.signal});if(!w.ok){let d=await w.text().catch(()=>"");throw Error(`tunnel control publish failed (${w.status})${d?`: ${d}`:""}`)}await w.body?.cancel().catch(()=>{})}}}var lK4=45000;var Ctt=g(()=>{IM();ARi();HM()});function LAi(i,u,t,f){if(!f)return!1;return i.emit(u,Rh(t,f.status,{title:f.title??void 0,virtualMcpId:f.virtual_mcp_id??void 0,createdBy:f.created_by??void 0,triggerId:f.trigger_id??null,branch:f.branch??null,createdAt:f.created_at,updatedAt:f.updated_at})),!0}var Mtt=g(()=>{Rt()});class Gvu{storage;options;timer=null;constructor(i,u={}){this.storage=i;this.options=u}start(){if(this.timer)return;let i=this.options.intervalMs??300000;this.timer=setInterval(()=>{this.runOnce()},i)}async runOnce(){let i=this.options.staleAfterMs??3600000;try{let u=await this.storage.sweepAbandoned(i);if(u>0)console.log(`[async-research-sweeper] marked ${u} stale jobs as abandoned`);return u}catch(u){return console.error("[async-research-sweeper] sweep failed",u),0}}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}import{readdir as cK4,rm as WAi}from"fs/promises";import{join as YAi}from"path";async function QAi(i){let u=new Date;u.setUTCDate(u.getUTCDate()-EK4),u.setUTCHours(0,0,0,0);let t=0;try{let f=await MJ(i);for(let l of f)if(/^\d{4}$/.test(l))t+=await qtt(i,l,u);else if(!l.startsWith(".")){let c=YAi(i,l),E=await MJ(c);for(let w of E){if(!/^\d{4}$/.test(w))continue;t+=await qtt(c,w,u)}if((await MJ(c)).length===0)await WAi(c,{recursive:!0,force:!0})}}catch(f){console.warn("monitoring retention cleanup failed:",f)}return t}async function qtt(i,u,t){let f=0,l=YAi(i,u),c=await MJ(l);for(let $ of c){if(!/^\d{2}$/.test($))continue;let w=YAi(l,$),d=await MJ(w);for(let _ of d){if(!/^\d{2}$/.test(_))continue;let v=new Date(`${u}-${$}-${_}T00:00:00Z`);if(isNaN(v.getTime()))continue;if(v<t){let D=YAi(w,_);await WAi(D,{recursive:!0,force:!0}),f++}}if((await MJ(w)).length===0)await WAi(w,{recursive:!0,force:!0})}if((await MJ(l)).length===0)await WAi(l,{recursive:!0,force:!0});return f}async function MJ(i){try{return(await cK4(i)).filter((t)=>!t.startsWith("."))}catch{return[]}}var EK4=30;var Svu=()=>{};import{DBOS as jvu,SchedulerMode as $K4}from"@dbos-inc/dbos-sdk";async function dK4(){let i=[dh(),SL(),BD()],u=0;for(let t of i)try{u+=await QAi(t)}catch(f){console.error("[monitoring-retention] cleanup failed:",f)}return console.log(`[monitoring-retention] deleted ${u} day-dir(s) across ${i.length} signal dir(s)`),{deleted:u,dirs:i.length}}async function hK4(i,u){await jvu.runStep(()=>dK4(),{name:"monitoringRetention"})}function rtt(){if(Vtt)return;Vtt=!0;let i=jvu.registerWorkflow(hK4,{name:"monitoringRetentionWorkflow"});jvu.registerScheduled(i,{name:"monitoringRetentionWorkflow",crontab:wK4,mode:$K4.ExactlyOncePerIntervalWhenActive})}var wK4="23 4 * * *",Vtt=!1;var mtt=g(()=>{bw();Svu()});function ett(i){return async(u,t)=>{let f=await i.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.role","organization.id as orgId","organization.slug as orgSlug","organization.name as orgName"]).where("member.userId","=",t).where("member.organizationId","=",u).executeTakeFirst();if(!f)return console.warn(`[automationContextFactory] User ${t} not found in org ${u} \u2014 returning null`),null;let l=await fg.create();l.auth.user={id:t,role:f.role},l.organization={id:f.orgId,slug:f.orgSlug,name:f.orgName};let c=await d0u(i.db,u,f.role);return l.boundAuth=w0u({auth:l.authInstance,headers:new Headers,role:f.role,permissions:c,userId:t}),l.access=new Ey(t,void 0,l.boundAuth,f.role,"self"),adi(l,{id:f.orgId,slug:f.orgSlug}),l}}var att=g(()=>{$y();wa()});import{EventEmitter as _K4}from"events";var Kvu;var ott=g(()=>{aO();Kvu=new _K4;Kvu.on("request",(i)=>{vv(i)})});function stt(){return async(i,u)=>{let t=Date.now(),f=i.req.method,l=i.req.path;if(l==="/api/auth/get-session"||l.includes("favicon")){await u();return}let c="",E=!1;if(l.startsWith("/mcp")&&f==="POST"){E=!0;try{if(i.req.header("Content-Type")?.includes("application/json")){let v=await i.req.raw.clone().json();if(v.method==="tools/call"&&v.params?.name){let D=VR(v.params.name),n=v.params.arguments||{},O=Object.keys(n).map((y)=>VR(y)),N=O.length>0?O.slice(0,3).join(",")+(O.length>3?"\u2026":""):"";c=`${nl.tool}${D}${nl.dim}(${N})${nl.reset}`}else if(v.method)c=`${nl.dim}${VR(v.method)}${nl.reset}`}}catch{}}let $=VR(l);if(l.startsWith("/mcp/conn_")){let h=l.split("/")[2]??"";$=`/mcp/${nl.mcp}${VR(h.slice(0,12))}\u2026${nl.reset}`}else if(l==="/mcp")$=`${nl.mcp}/mcp${nl.reset}`;else if(l==="/mcp/registry")$=`${nl.mcp}/mcp/registry${nl.reset}`;let w=DK4(f),d=E?"\u25C0":"\u2190";if(!uci())console.log(`${nl.dim}${d}${nl.reset} ${w}${f}${nl.reset} ${$}${c?` ${c}`:""}`);try{await u()}finally{let h=Date.now()-t,_=i.res.status,v=vK4(_),D=h<1000?`${h}ms`:`${(h/1000).toFixed(1)}s`,n=E?"\u25B6":"\u2192";if(!uci())console.log(`${nl.dim}${n}${nl.reset} ${w}${f}${nl.reset} ${$}${c?` ${c}`:""} ${v}${_}${nl.reset} ${nl.duration}${D}${nl.reset}`);Kvu.emit("request",{method:f,path:VR(l),status:_,duration:h,timestamp:new Date})}}}var nl,vK4=(i)=>{if(i>=500)return nl.serverError;if(i>=400)return nl.clientError;if(i>=300)return nl.redirect;return nl.ok},DK4=(i)=>{return nl[i]||nl.reset},VR=(i)=>{return i.replace(/\r/g,"").replace(/\n/g,"").replace(/\x1b\[[0-9;]*m/g,"").replace(/[\x00-\x1f\x7f-\x9f]/g,"")};var ptt=g(()=>{aO();ott();nl={reset:"\x1B[0m",dim:"\x1B[2m",bold:"\x1B[1m",GET:"\x1B[36m",POST:"\x1B[33m",PUT:"\x1B[35m",DELETE:"\x1B[31m",ok:"\x1B[32m",redirect:"\x1B[36m",clientError:"\x1B[33m",serverError:"\x1B[31m",mcp:"\x1B[35m",tool:"\x1B[96m",duration:"\x1B[90m"}});import{createHmac as fft}from"crypto";import{mkdir as nK4,readdir as gK4,rm as ift,stat as lft}from"fs/promises";import{join as Xvu,relative as OK4}from"path";import{z as k0}from"zod";function Eft(i){let u=i.replace(/[^a-zA-Z0-9_-]/g,"_");return Xvu(NK4,u)}function $ft(i){return i.replace(/^\/+/,"").replace(/\.\./g,"")}function Jvu(i,u){let t=Eft(i),f=$ft(u);return Xvu(t,f)}function yK4(i,u,t,f){let l=yu().encryptionKey||"dev-secret",c=`${i}:${u}:${t}:${f}`;return fft("sha256",l).update(c).digest("hex")}function tft(i,u,t,f,l){let c=Math.floor(Date.now()/1000)+f,E=yK4(u,t,c,l),$=new URL(`/api/dev-assets/${u}/${$ft(t)}`,i);return $.searchParams.set("expires",c.toString()),$.searchParams.set("signature",E),$.searchParams.set("method",l),$.toString()}function wft(i,u,t){let f=`${i}:${u.getTime()}:${t}`;return`"${fft("md5","etag").update(f).digest("hex")}"`}async function dft(i,u,t,f,l){try{let c=await gK4(i,{withFileTypes:!0});for(let E of c){let $=Xvu(i,E.name),d=OK4(u,$).replace(/\\/g,"/");if(t&&!d.startsWith(t))continue;if(E.isDirectory())if(f){let h=d+"/";if(!t||h.startsWith(t)){if(!(t?d.slice(t.length):d).includes("/"))l.commonPrefixes.add(h)}}else await dft($,u,t,f,l);else if(E.isFile()){if(f&&t){let h=d.slice(t.length);if(h.includes(f)){let _=h.indexOf(f),v=t+h.slice(0,_+1);l.commonPrefixes.add(v);continue}}try{let h=await lft($);l.objects.push({key:d,size:h.size,lastModified:h.mtime.toISOString(),etag:wft($,h.mtime,h.size)})}catch{}}}}catch{}}function hft(i,u){let f=yi(i).id;return[{name:"LIST_OBJECTS",description:"List objects in the local assets directory with pagination support",inputSchema:k0.object({prefix:k0.string().optional(),maxKeys:k0.number().optional().default(1000),continuationToken:k0.string().optional(),delimiter:k0.string().optional()}),outputSchema:k0.object({objects:k0.array(k0.object({key:k0.string(),size:k0.number(),lastModified:k0.string(),etag:k0.string()})),nextContinuationToken:k0.string().optional(),isTruncated:k0.boolean(),commonPrefixes:k0.array(k0.string()).optional()}),handler:async(l)=>{let c=l,E=c.prefix||"",$=c.maxKeys??1000,w=c.delimiter,d=c.continuationToken,h=Eft(f);await nK4(h,{recursive:!0});let _={objects:[],commonPrefixes:new Set};await dft(h,h,E,w,_),_.objects.sort((N,y)=>N.key.localeCompare(y.key));let v=0;if(d){if(v=_.objects.findIndex((N)=>N.key>d),v===-1)v=_.objects.length}let D=_.objects.slice(v,v+$),n=v+$<_.objects.length,O=n?D[D.length-1]?.key:void 0;return{objects:D,isTruncated:n,nextContinuationToken:O,commonPrefixes:Array.from(_.commonPrefixes).sort()}}},{name:"GET_OBJECT_METADATA",description:"Get metadata for a file in the local assets directory",inputSchema:k0.object({key:k0.string()}),outputSchema:k0.object({contentType:k0.string().optional(),contentLength:k0.number(),lastModified:k0.string(),etag:k0.string(),metadata:k0.record(k0.string(),k0.string()).optional()}),handler:async(l)=>{let c=l,E=Jvu(f,c.key),$=await lft(E);return{contentType:Rhu(c.key),contentLength:$.size,lastModified:$.mtime.toISOString(),etag:wft(E,$.mtime,$.size)}}},{name:"GET_PRESIGNED_URL",description:"Generate a presigned URL for downloading a file from local storage",inputSchema:k0.object({key:k0.string(),expiresIn:k0.number().optional()}),outputSchema:k0.object({url:k0.string(),expiresIn:k0.number()}),handler:async(l)=>{let c=l,E=c.expiresIn??uft;return{url:tft(u,f,c.key,E,"GET"),expiresIn:E}}},{name:"PUT_PRESIGNED_URL",description:"Generate a presigned URL for uploading a file to local storage",inputSchema:k0.object({key:k0.string(),expiresIn:k0.number().optional(),contentType:k0.string().optional()}),outputSchema:k0.object({url:k0.string(),expiresIn:k0.number()}),handler:async(l)=>{let c=l,E=c.expiresIn??uft;return{url:tft(u,f,c.key,E,"PUT"),expiresIn:E}}},{name:"DELETE_OBJECT",description:"Delete a single file from local storage",inputSchema:k0.object({key:k0.string()}),outputSchema:k0.object({success:k0.boolean(),key:k0.string()}),handler:async(l)=>{let c=l,E=Jvu(f,c.key);try{return await ift(E),{success:!0,key:c.key}}catch{return{success:!1,key:c.key}}}},{name:"DELETE_OBJECTS",description:"Delete multiple files from local storage",inputSchema:k0.object({keys:k0.array(k0.string()).max(1000)}),outputSchema:k0.object({deleted:k0.array(k0.string()),errors:k0.array(k0.object({key:k0.string(),message:k0.string()}))}),handler:async(l)=>{let c=l,E=[],$=[];return await Promise.all(c.keys.map(async(w)=>{let d=Jvu(f,w);try{await ift(d),E.push(w)}catch(h){$.push({key:w,message:h instanceof Error?h.message:"Unknown error"})}})),{deleted:E,errors:$}}}]}async function Lvu(i,u,t){let f=hft(u,t),l=new bD({name:"dev-assets-mcp",version:"1.0.0"},{capabilities:{tools:{}},jsonSchemaValidator:Xl});for(let E of f){let $="shape"in E.inputSchema?E.inputSchema.shape:k0.object({}).shape,w=E.outputSchema&&"shape"in E.outputSchema?E.outputSchema.shape:k0.object({}).shape;l.registerTool(E.name,{description:E.description??"",inputSchema:$,outputSchema:w,annotations:E.annotations,_meta:E._meta},async(d)=>{try{let h=await E.handler(d);return{content:[{type:"text",text:JSON.stringify(h)}],structuredContent:h}}catch(h){return{content:[{type:"text",text:`Error: ${h.message}`}],isError:!0}}})}let c=new kd({enableJsonResponse:i.headers.get("Accept")?.includes("application/json")??!1});return await l.connect(c),y5(l,c,i,"mcp:dev-assets")}async function _ft(i,u,t,f){let c=hft(t,f).find((E)=>E.name===i);if(!c)return{content:[{type:"text",text:`Tool not found: ${i}`}],isError:!0};try{let E=await c.handler(u);return{content:[{type:"text",text:JSON.stringify(E)}]}}catch(E){return{content:[{type:"text",text:E instanceof Error?E.message:String(E)}],isError:!0}}}var NK4="./data/assets",uft=3600,cft,vft;var Dft=g(()=>{vt();Ro();yf();ZV();NH();i$();pPi();cft=new Wu;cft.all("/",async(i)=>{let u=i.get("studioContext"),t=new URL(i.req.url),f=`${t.protocol}//${t.host}`;return Lvu(i.req.raw,u,f)});vft=cft});var nft={};Xi(nft,{mountDevRoutes:()=>ZK4});function ZK4(i,u){i.all("/mcp/:connectionId{.*_dev-assets$}",u,async(f)=>{let l=f.get("studioContext"),c=new URL(f.req.url),E=`${c.protocol}//${c.host}`;return Lvu(f.req.raw,l,E)}),i.all("/mcp/:connectionId{.*_dev-assets$}/call-tool/:toolName",u,async(f)=>{let l=f.get("studioContext"),c=new URL(f.req.url),E=`${c.protocol}//${c.host}`,$=f.req.param("toolName");if(!$)return f.json({error:"Missing tool name"},400);let w=await f.req.json(),d=await _ft($,w,l,E);if(d.isError)return f.json(d.content,500);return f.json(d.content)}),i.use("/mcp/dev-assets",u),i.route("/mcp/dev-assets",vft);let t=new Wu;t.use("*",m3({mountPath:"/api/dev-assets"})),t.route("/",sPi({orgFromPath:!1})),i.route("/api/dev-assets",t)}var gft=g(()=>{yf();Xhu();pPi();Dft()});var Oft=g(()=>{j0u();K0u();Ry()});var zAi=g(()=>{Oft()});var yft={};Xi(yft,{streamAgent:()=>Nft,createDecopilotClient:()=>BK4});async function TK4(i){let{parseJsonEventStream:u,uiMessageChunkSchema:t}=await Promise.resolve().then(() => (Pf(),Qfu));return u({stream:i,schema:t}).pipeThrough(new TransformStream({transform(f,l){if(!f.success)throw f.error;l.enqueue(f.value)}}))}async function Nft(i,u,t,f,l){let{readUIMessageStream:c}=await Promise.resolve().then(() => (Pf(),Qfu)),E=t.value??t.id;if(!E)throw Error("Agent binding has no id or value \u2014 cannot resolve agent");let $=f.credentialId??t.credentialId,w=f.thinking??t.thinking,d=w?.id,h={messages:f.messages,...d?{models:{credentialId:$,thinking:w,...f.fast??t.fast?{fast:f.fast??t.fast}:{}}}:{},agent:{id:E},temperature:f.temperature??t.temperature,toolApprovalLevel:f.toolApprovalLevel??t.toolApprovalLevel,mode:f.mode??t.mode??"default",...f.memory?{memory:f.memory}:{},...f.thread_id?{thread_id:f.thread_id}:{}},_=await fetch(i,{method:"POST",headers:{"Content-Type":"application/json","x-mesh-token":u,Authorization:`Bearer ${u}`},body:JSON.stringify(h),signal:l?.signal});if(!_.ok){let D=await _.text().catch(()=>""),n=`HTTP ${_.status}`;try{let O=JSON.parse(D);if(O?.error)n=O.error}catch{if(D)n=D}throw Error(n)}if(!_.body)throw Error("Empty response body from decopilot stream");let v=await TK4(_.body);return c({stream:v})}function BK4(i){let{baseUrl:u,orgSlug:t,token:f}=i,l=`${u}/${t}/decopilot/runtime/stream`;return{stream(c,E){let $={__type:"@deco/agent",id:c.agent.id,credentialId:c.credentialId??"",thinking:c.thinking??{id:"",title:""},fast:c.fast,toolApprovalLevel:c.toolApprovalLevel,mode:c.mode,temperature:c.temperature};return Nft(l,f,$,c,E)}}}import{z as Sw}from"zod";function Zft(i){let u=i.properties;if(!u)return i;for(let t of Object.values(u)){let f=t.properties;if(!f?.__type?.const)continue;let l=f.__type.const,c=FK4.get(l);if(!c)continue;let E=c.map(($)=>({name:String($.name),...$.inputSchema&&{inputSchema:Sw.toJSONSchema($.inputSchema)},...$.outputSchema&&{outputSchema:Sw.toJSONSchema($.outputSchema)}}));f.__binding={const:E}}return i}var FK4,YRc,UK4=(i)=>{return typeof i==="object"&&i!==null&&i.__type==="@deco/agent"},Yvu=(i)=>{return typeof i==="object"&&i!==null&&typeof i.__type==="string"&&i.__type!=="@deco/agent"&&typeof i.value==="string"},HAi=(i,u,t)=>{let f=t?{"x-caller-app":t}:void 0;if(u.cookie)f??={},f.cookie=u.cookie;if(u.token)f??={},f["x-mesh-token"]=u.token;return{type:"HTTP",url:new URL(`/mcp/${i}`,u.meshUrl).href,token:u.token,headers:f}},PK4=(i,u,t)=>{let f=HAi(i,u,t);return new Proxy(Zz.forConnection(f),{get(l,c){if(c==="value")return i;if(c==="__type")return t;return l[c]}})},AK4=(i,u)=>{let t=u.organizationSlug;if(!t)throw Error("organizationSlug is required for agent bindings");let f=`${u.meshUrl}/api/${t}/decopilot/runtime/stream`;return{STREAM:async(l,c)=>{let{streamAgent:E}=await Promise.resolve().then(() => yft);return E(f,u.token,i,l,c)}}},Wvu=(i,u)=>{if(i===null||i===void 0)return i;if(Array.isArray(i))return i.map((t)=>Wvu(t,u));if(typeof i==="object"){if(UK4(i))return AK4(i,u);if(Yvu(i))return PK4(i.value,u,i.__type);let t={};for(let[f,l]of Object.entries(i))t[f]=Wvu(l,u);return t}return i},Tft=(i)=>{return Wvu(i.state,i)};var rR=g(()=>{zAi();FK4=new Map;YRc=Sw.object({id:Sw.string(),title:Sw.string(),capabilities:Sw.object({vision:Sw.boolean().optional(),text:Sw.boolean().optional(),tools:Sw.boolean().optional(),reasoning:Sw.boolean().optional()}).passthrough().optional(),provider:Sw.string().optional().nullable(),limits:Sw.object({contextWindow:Sw.number().optional(),maxOutputTokens:Sw.number().optional()}).passthrough().optional()})});var IK4,Bft=(i,u,t)=>{if(!u)return null;if(i===void 0||i==="*")return"*";if(typeof i==="string")return i===u?i:null;if(Array.isArray(i))return i.includes(u)?u:null;if(typeof i==="function")return i(u,t)??null;return null},xK4=(i,u,t)=>{let f=u.headers.get("Origin"),l=Bft(t.origin,f,u);if(l)i.set("Access-Control-Allow-Origin",l);if(t.credentials)i.set("Access-Control-Allow-Credentials","true");if(t.exposeHeaders?.length)i.set("Access-Control-Expose-Headers",t.exposeHeaders.join(", "))},Fft=(i,u)=>{let t=new Headers,f=i.headers.get("Origin"),l=Bft(u.origin,f,i);if(l)t.set("Access-Control-Allow-Origin",l);if(u.credentials)t.set("Access-Control-Allow-Credentials","true");let c=u.allowMethods??IK4;t.set("Access-Control-Allow-Methods",c.join(", "));let E=i.headers.get("Access-Control-Request-Headers");if(u.allowHeaders?.length)t.set("Access-Control-Allow-Headers",u.allowHeaders.join(", "));else if(E)t.set("Access-Control-Allow-Headers",E);if(u.maxAge!==void 0)t.set("Access-Control-Max-Age",u.maxAge.toString());return new Response(null,{status:204,headers:t})},Uft=(i,u,t)=>{let f=new Headers(i.headers);return xK4(f,u,t),new Response(i.body,{status:i.status,statusText:i.statusText,headers:f})};var Pft=g(()=>{IK4=["GET","HEAD","PUT","POST","DELETE","PATCH"]});function Aft(i=32){let t=new Uint8Array(i);return crypto.getRandomValues(t),Array.from(t,(f)=>"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"[f%62]).join("")}function kK4(i){try{let u=new URL(i);return u.protocol==="https:"||u.hostname==="localhost"||u.hostname.endsWith(".localhost")||u.hostname==="127.0.0.1"||!u.protocol.startsWith("http")}catch{return!1}}function Ift(i){return btoa(JSON.stringify(i)).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function xft(i){try{let u=i.replace(/-/g,"+").replace(/_/g,"/");return JSON.parse(atob(u))}catch{return null}}function kft(i){return{handleProtectedResourceMetadata:(d)=>{let h=H5(new URL(d.url)),_=`${h.origin}/mcp`;return Response.json({resource:_,authorization_servers:[h.origin],scopes_supported:["*"],bearer_methods_supported:["header"],resource_signing_alg_values_supported:["RS256","none"]})},handleAuthorizationServerMetadata:(d)=>{let _=H5(new URL(d.url)).origin;return Response.json({issuer:_,authorization_endpoint:`${_}/authorize`,token_endpoint:`${_}/token`,registration_endpoint:`${_}/register`,scopes_supported:["*"],response_types_supported:["code"],response_modes_supported:["query"],grant_types_supported:["authorization_code","refresh_token"],token_endpoint_auth_methods_supported:["none","client_secret_post"],code_challenge_methods_supported:["S256","plain"]})},handleAuthorize:(d)=>{let h=H5(new URL(d.url)),_=h.searchParams.get("redirect_uri"),v=h.searchParams.get("response_type"),D=h.searchParams.get("state"),n=h.searchParams.get("code_challenge"),O=h.searchParams.get("code_challenge_method");if(!_)return Response.json({error:"invalid_request",error_description:"redirect_uri required"},{status:400});if(v!=="code")return Response.json({error:"unsupported_response_type",error_description:"Only 'code' is supported"},{status:400});let N=H5(new URL(`${h.origin}/oauth/callback`)),y=N.toString(),T=Ift({redirectUri:_,clientState:D??void 0,codeChallenge:n??void 0,codeChallengeMethod:O??void 0,oauthCallbackUri:y});N.searchParams.set("state",T);let B=i.authorizationUrl(N.toString());return Response.redirect(B,302)},handleOAuthCallback:async(d)=>{let h=H5(new URL(d.url)),_=h.searchParams.get("code"),v=h.searchParams.get("state"),D=h.searchParams.get("error"),n=v?xft(v):null;if(D){let O=h.searchParams.get("error_description")??"Authorization failed";if(n?.redirectUri){let N=H5(new URL(n.redirectUri));if(N.searchParams.set("error",D),N.searchParams.set("error_description",O),n.clientState)N.searchParams.set("state",n.clientState);return Response.redirect(N.toString(),302)}return Response.json({error:D,error_description:O},{status:400})}if(!_||!n)return Response.json({error:"invalid_request",error_description:"Missing code or state"},{status:400});try{let O=n.oauthCallbackUri??H5(new URL(`${h.origin}/oauth/callback`)).toString(),N={code:_,redirect_uri:O},y=await i.exchangeCode(N),Z={accessToken:y.access_token,tokenType:y.token_type,refreshToken:y.refresh_token,expiresIn:y.expires_in,scope:y.scope,codeChallenge:n.codeChallenge,codeChallengeMethod:n.codeChallengeMethod},T=Ift(Z),B=H5(new URL(n.redirectUri));if(B.searchParams.set("code",T),n.clientState)B.searchParams.set("state",n.clientState);return Response.redirect(B.toString(),302)}catch(O){console.error("OAuth callback error:",O);let N=H5(new URL(n.redirectUri));if(N.searchParams.set("error","server_error"),N.searchParams.set("error_description","Failed to exchange authorization code"),n.clientState)N.searchParams.set("state",n.clientState);return Response.redirect(N.toString(),302)}},handleToken:async(d)=>{try{let h=d.headers.get("content-type")??"",_;if(h.includes("application/x-www-form-urlencoded")){let Z=await d.formData();_=Object.fromEntries(Z.entries())}else{let Z=await d.json();if(typeof Z!=="object"||Z===null||Array.isArray(Z))return Response.json({error:"invalid_request",error_description:"Request body must be a JSON object"},{status:400});_=Z}let{code:v,code_verifier:D,grant_type:n,refresh_token:O}=_;if(n==="refresh_token"){if(typeof O!=="string"||!O)return Response.json({error:"invalid_request",error_description:"refresh_token is required and must be a string"},{status:400});if(!i.refreshToken)return Response.json({error:"unsupported_grant_type",error_description:"refresh_token grant not supported"},{status:400});let Z;try{Z=await i.refreshToken(O)}catch(B){if(B instanceof Qvu)return Response.json({error:B.error,...B.errorDescription?{error_description:B.errorDescription}:{}},{status:400});throw B}let T={access_token:Z.access_token,token_type:Z.token_type};if(Z.refresh_token)T.refresh_token=Z.refresh_token;if(Z.expires_in!==void 0)T.expires_in=Z.expires_in;if(Z.scope)T.scope=Z.scope;return Response.json(T,{headers:{"Cache-Control":"no-store",Pragma:"no-cache"}})}if(n!=="authorization_code")return Response.json({error:"unsupported_grant_type",error_description:"Only authorization_code and refresh_token supported"},{status:400});if(typeof v!=="string"||!v)return Response.json({error:"invalid_request",error_description:"code is required and must be a string"},{status:400});let N=xft(v);if(!N||!N.accessToken)return Response.json({error:"invalid_grant",error_description:"Invalid or expired code"},{status:400});if(N.codeChallenge){if(typeof D!=="string"||!D)return Response.json({error:"invalid_grant",error_description:"code_verifier required and must be a string"},{status:400});let Z;if(N.codeChallengeMethod==="S256"){let B=new TextEncoder().encode(D),F=await crypto.subtle.digest("SHA-256",B);Z=btoa(String.fromCharCode(...new Uint8Array(F))).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}else Z=D;if(Z!==N.codeChallenge)return Response.json({error:"invalid_grant",error_description:"Invalid code_verifier"},{status:400})}let y={access_token:N.accessToken,token_type:N.tokenType};if(N.refreshToken)y.refresh_token=N.refreshToken;if(N.expiresIn!==void 0)y.expires_in=N.expiresIn;if(N.scope)y.scope=N.scope;return Response.json(y,{headers:{"Cache-Control":"no-store",Pragma:"no-cache"}})}catch(h){return console.error("Token exchange error:",h),Response.json({error:"server_error",error_description:"Failed to process token request"},{status:500})}},handleClientRegistration:async(d)=>{try{let h=await d.json();if(!h.redirect_uris||h.redirect_uris.length===0)return Response.json({error:"invalid_redirect_uri",error_description:"At least one redirect_uri is required"},{status:400});for(let O of h.redirect_uris)if(!kK4(O))return Response.json({error:"invalid_redirect_uri",error_description:`Invalid redirect URI: ${O}`},{status:400});let _=Aft(32),v=h.token_endpoint_auth_method!=="none"?Aft(32):void 0,D=Math.floor(Date.now()/1000),n={client_id:_,client_secret:v,client_name:h.client_name,redirect_uris:h.redirect_uris,grant_types:h.grant_types??["authorization_code"],response_types:h.response_types??["code"],token_endpoint_auth_method:h.token_endpoint_auth_method??"client_secret_post",scope:h.scope,client_id_issued_at:D,client_secret_expires_at:0};if(i.persistence)await i.persistence.saveClient(n);return new Response(JSON.stringify(n),{status:201,headers:{"Content-Type":"application/json","Cache-Control":"no-store",Pragma:"no-cache"}})}catch(h){return console.error("Client registration error:",h),Response.json({error:"invalid_client_metadata",error_description:"Invalid client registration request"},{status:400})}},createUnauthorizedResponse:(d)=>{let v=`Bearer resource_metadata="${`${H5(new URL(d.url)).origin}/.well-known/oauth-protected-resource`}", scope="*"`;return Response.json({jsonrpc:"2.0",error:{code:-32000,message:"Unauthorized: Authentication required"},id:null},{status:401,headers:{"WWW-Authenticate":v,"Access-Control-Expose-Headers":"WWW-Authenticate"}})},hasAuth:(d)=>d.headers.has("Authorization")}}var Qvu,H5=(i)=>{if(!(i.hostname==="localhost"||i.hostname.endsWith(".localhost")||i.hostname==="127.0.0.1"))i.protocol="https:";return i};var zvu=g(()=>{Qvu=class Qvu extends Error{error;errorDescription;constructor(i="invalid_grant",u){super(u??i);this.name="OAuthInvalidGrantError",this.error=i,this.errorDescription=u}}});import{AsyncLocalStorage as GK4}from"async_hooks";var Gft,Yp;var Hvu=g(()=>{Gft=new GK4,Yp={getStore:()=>{return Gft.getStore()},run:(i,u,...t)=>Gft.run(i,u,...t)}});var jft="SELF",bAi=(i)=>{return typeof i==="object"&&i!==null&&"handler"in i&&"events"in i&&typeof i.handler==="function"&&Array.isArray(i.events)},Kft=(i)=>{return typeof i==="object"&&i!==null&&"handler"in i&&"events"in i&&typeof i.handler==="function"&&Array.isArray(i.events)},Sft="::",Jft=(i)=>{let u=i.indexOf(Sft);if(u===-1)return null;let t=i.substring(0,u),f=i.substring(u+Sft.length);return[t,f]},SK4=(i)=>{if(!i.startsWith("cron/"))return null;let u=i.substring(5),t=u.indexOf("/");if(t===-1)return null;let f=u.substring(0,t),l=u.substring(t+1);return[f,l]},Xft=(i)=>{if(bAi(i))return[];return Object.keys(i)},jK4=(i,u)=>{if(bAi(i))return i.events;let t=i[u];if(!t)return[];if(Kft(t))return t.events;return Object.keys(t)},RAi=(i,u,t)=>{if(i===jft){if(!t)return console.warn("[Event] SELF binding used but no connectionId available"),null;return t}let f=u[i];if(!Yvu(f))return console.warn(`[Event] Binding "${i}" not found in state`),null;return f.value},KK4=(i,u,t)=>{let f=u;if(bAi(i)){let c=[];for(let E of i.events){let $=Jft(E);if(!$){console.warn(`[Event] Global handler event "${E}" must be prefixed with BINDING:: (e.g., "SELF::${E}" or "DATABASE::${E}")`);continue}let[w,d]=$,h=RAi(w,f,t);if(!h)continue;c.push({eventType:d,publisher:h})}return c}let l=[];for(let c of Xft(i)){let E=RAi(c,f,t);if(!E)continue;let $=jK4(i,c);for(let w of $)l.push({eventType:w,publisher:E})}return l},JK4=(i)=>{let u=new Map;for(let t of i){let f=t.source,l=u.get(f)||[];l.push(t),u.set(f,l)}return u},XK4=(i)=>{let u=new Map;for(let t of i){let f=t.type,l=u.get(f)||[];l.push(t),u.set(f,l)}return u},LK4=(i)=>{let u={},t={},f=!1,l=0,c=[];for(let E of i){if(E.results)Object.assign(t,E.results);if(E.success===!1){if(f=!0,E.error)c.push(E.error)}if(E.processedCount!==void 0)l+=E.processedCount}if(Object.keys(t).length>0)u.results=t;if(u.success=!f,c.length>0)u.error=c.join("; ");if(l>0)u.processedCount=l;return u},WK4=async(i,u,t,f,l)=>{let c=f;if(bAi(i)){let h=new Set;for(let v of i.events){let D=Jft(v);if(!D)continue;let[n,O]=D,N=RAi(n,c,l);if(!N)continue;h.add(`${N}:${O}`)}let _=u.filter((v)=>{let D=`${v.source}:${v.type}`;return h.has(D)});if(_.length===0)return{success:!0};try{return await i.handler({events:_},t)}catch(v){return{success:!1,error:v instanceof Error?v.message:String(v)}}}let E=new Map;for(let h of Xft(i)){let _=RAi(h,c,l);if(_)E.set(_,h)}let $=JK4(u),w=[];for(let[h,_]of $){let v=E.get(h);if(!v)continue;let D=i[v];if(!D)continue;if(Kft(D)){w.push((async()=>{try{return await D.handler({events:_},t)}catch(N){let y={};for(let Z of _)y[Z.id]={success:!1,error:N instanceof Error?N.message:String(N)};return{results:y}}})());continue}let n=D,O=XK4(_);for(let[N,y]of O){let Z=n[N];if(!Z)continue;w.push((async()=>{try{let T=await Z({events:y},t),B={};for(let F of y)B[F.id]=T;return{results:B}}catch(T){let B={};for(let F of y)B[F.id]={success:!1,error:T instanceof Error?T.message:String(T)};return{results:B}}})())}}let d=await Promise.all(w);if(d.length===0)return{success:!0};return LK4(d)},Lft;var Rvu=g(()=>{rR();Lft={subscriptions:KK4,execute:WK4,parseCron:SK4}});function YK4(i,u){let t=HAi("self",{meshUrl:i,token:u});return Zz.forConnection(t)}function QK4(i,u){switch(u.type){case"cron":return{automation_id:i,type:"cron",cron_expression:u.cron};case"event":return{automation_id:i,type:"event",connection_id:u.connectionId,event_type:u.eventType,params:u.params};case"webhook":return{automation_id:i,type:"webhook"}}}function Wft(i,u,t){return async(f)=>{if(!i)throw Error("createAgent: missing meshUrl in MESH_REQUEST_CONTEXT");let l=YK4(i,u),E=(await l.COLLECTION_VIRTUAL_MCP_LIST({where:{operator:"and",conditions:[{field:["title"],operator:"eq",value:f.name}]},limit:1})).items.find((h)=>h.title===f.name);if(E)return{id:E.id,automations:[],automationIds:[],alreadyExisted:!0};let $=f.tools&&f.tools.length>0?f.tools.map((h)=>({connection_id:h.connectionId,selected_tools:h.tools??null,selected_resources:null,selected_prompts:null})):t?[{connection_id:t,selected_tools:null,selected_resources:null,selected_prompts:null}]:[],{item:w}=await l.COLLECTION_VIRTUAL_MCP_CREATE({data:{title:f.name,description:f.description,metadata:f.instructions?{instructions:f.instructions}:void 0,connections:$}}),d=[];for(let h of f.automations??[]){let _=await l.AUTOMATION_CREATE({name:h.name,virtual_mcp_id:w.id,messages:h.messages,models:h.models,tools:h.tools,active:h.active??!0}),v=[];for(let D of h.triggers??[])try{let n=await l.AUTOMATION_TRIGGER_ADD(QK4(_.id,D));v.push({type:D.type,ok:!0,id:n.id,webhook:n.webhook??void 0})}catch(n){v.push({type:D.type,ok:!1,error:n instanceof Error?n.message:String(n)})}d.push({id:_.id,name:h.name,triggers:v})}return{id:w.id,automations:d,automationIds:d.map((h)=>h.id),alreadyExisted:!1}}}var bvu=g(()=>{rR();zAi()});import{z as jc}from"zod";function _n(i){return{...i,execute:(u)=>{let t=Qp(u.runtimeContext);return i.execute({...u,runtimeContext:t},t)}}}var Qp=(i)=>{let u=Yp.getStore();if(!u){if(i)return i;throw Error("Missing context, did you forget to call State.bind?")}return u},Yft=(i)=>{let u=i.runtimeContext.env.MESH_REQUEST_CONTEXT;return{connectionId:u?.connectionId,meshUrl:u?.meshUrl,token:u?.token}},zK4=({events:i,configuration:{state:u,scopes:t,onChange:f,onInstall:l}={}}={})=>{let c=u?Zft(jc.toJSONSchema(u)):{type:"object",properties:{}};return[...f||l||i?[_n({id:"ON_MCP_CONFIGURATION",description:"MCP Configuration On Change",inputSchema:jc.object({state:u??jc.unknown(),scopes:jc.array(jc.string()).describe("Array of scopes in format 'KEY::SCOPE' (e.g., 'GMAIL::GetCurrentUser')"),firstRun:jc.boolean().optional().describe("True on the first configuration save for this connection \u2014 fires onInstall."),vault:jc.object({baseUrl:jc.string(),org:jc.string(),subjectConnectionId:jc.string(),token:jc.string()}).optional()}),outputSchema:jc.object({}),execute:async(E)=>{let $=E.context.state,w=E.context.vault;if(await f?.(E.runtimeContext.env,{state:$,scopes:E.context.scopes,vault:w}),l&&E.context.firstRun){let{meshUrl:d,token:h,connectionId:_}=Yft(E);await l(E.runtimeContext.env,{createAgent:Wft(d,h,_),vault:w})}return Promise.resolve({})}})]:[],...i?.handlers?[_n({id:"ON_EVENTS",description:"Receive and process CloudEvents from the event bus. Returns per-event or batch results.",inputSchema:F3i,outputSchema:U3i,execute:async(E)=>{let $=E.runtimeContext.env,w=$.MESH_REQUEST_CONTEXT?.state,{connectionId:d}=Yft(E);return Lft.execute(i.handlers,E.context.events,$,w,d)}})]:[],_n({id:"MCP_CONFIGURATION",description:"MCP Configuration",inputSchema:jc.object({}),outputSchema:jc.object({stateSchema:jc.unknown(),scopes:jc.array(jc.string()).optional()}),execute:()=>{return Promise.resolve({stateSchema:c,scopes:[...t??[]]})}})]},Qft=(i)=>{let u=null,t=null,f=null,l=!1,c=()=>{if(!l)console.warn("[runtime] Passing factory functions to tools/prompts/resources is deprecated. Pass createTool()/createPrompt()/createResource() instances directly."),l=!0},E=(D)=>typeof D==="object"&&D!==null&&(("id"in D)||("name"in D)||("uri"in D));async function $(D,n){if(!D)return[];return(await Promise.all(D.flatMap(async(O)=>{if(E(O))return[O];c();let N=await O(n);if(Array.isArray(N))return N;return[N]}))).flat()}let w=async(D)=>{if(u)return u;if(t)return t;return t=(async()=>{try{let n;if(typeof i.tools==="function")c(),n=await i.tools(D);else n=await $(i.tools,D);n.push(...zK4({...i}));let O;if(typeof i.prompts==="function")c(),O=await i.prompts(D);else O=await $(i.prompts,D);let N;if(typeof i.resources==="function")c(),N=await i.resources(D);else N=await $(i.resources,D);let y={tools:n,prompts:O,resources:N};return u=y,y}catch(n){throw t=null,n}})(),t},d=(D,n)=>{for(let O of n.tools)D.registerTool(O.id,{_meta:O._meta,title:O.title,description:O.description,annotations:O.annotations,inputSchema:O.inputSchema&&"shape"in O.inputSchema?O.inputSchema:jc.object({}),outputSchema:O.outputSchema&&typeof O.outputSchema==="object"&&"shape"in O.outputSchema?O.outputSchema:void 0},async(N)=>{let y=Qp(),Z=await O.execute({context:N,runtimeContext:y},y);if(Z!=null&&typeof Z==="object"&&"content"in Z&&Array.isArray(Z.content)&&Z.content.every((T)=>T!=null&&typeof T==="object"&&("type"in T)&&typeof T.type==="string"))return Z;return{structuredContent:Z,content:[{type:"text",text:JSON.stringify(Z)}]}});for(let O of n.prompts)D.registerPrompt(O.name,{title:O.title,description:O.description,argsSchema:O.argsSchema?O.argsSchema:jc.object({}).shape},async(N)=>{let y=Qp();return await O.execute({args:N,runtimeContext:y},y)});for(let O of n.resources)D.resource(O.name,O.uri,{description:O.description,mimeType:O.mimeType},async(N)=>{let y=Qp(),Z=await O.read({uri:N,runtimeContext:y},y),T=Z._meta??void 0;if(Z.text!==void 0)return{contents:[{uri:Z.uri,mimeType:Z.mimeType,text:Z.text,...T!==void 0?{_meta:T}:{}}]};else if(Z.blob!==void 0)return{contents:[{uri:Z.uri,mimeType:Z.mimeType,blob:Z.blob,...T!==void 0?{_meta:T}:{}}]};return{contents:[{uri:Z.uri,mimeType:Z.mimeType,text:""}]}})},h=async(D)=>{await i.before?.(D);let{instructions:n,...O}=i.serverInfo??{},N=new bD({...O,name:O.name??"@deco/mcp-api",version:O.version??"1.0.0"},{capabilities:{tools:{},prompts:{},resources:{}},jsonSchemaValidator:Xl,...n&&{instructions:n}}),y=await w(D);d(N,y);let Z="tools/list",T=N.server._requestHandlers,B=T.get(Z);if(B)T.set(Z,async(F,A)=>{if(!f)f=await B(F,A);return f});return{server:N,...y}};return{fetch:async(D,n)=>{let{server:O}=await h(n),N=new kd;await O.connect(N);let y=()=>{try{N.close?.()}catch{}try{O.close?.()}catch{}};try{let Z=await N.handleRequest(D),T=Z.headers.get("content-type");if(!(T?.includes("text/event-stream")||T?.includes("application/json-rpc"))||!Z.body)return y(),Z;let{readable:F,writable:A}=new TransformStream;return Z.body.pipeTo(A).catch(()=>{}).finally(y),new Response(F,{status:Z.status,statusText:Z.statusText,headers:Z.headers})}catch(Z){throw y(),Z}},callTool:async({toolCallId:D,toolCallInput:n})=>{let O=Yp.getStore();if(!O)throw Error("Missing state, did you forget to call State.bind?");let N=O?.env,{tools:y}=await w(N),T=y.find((F)=>F.id===D)?.execute;if(!T)throw Error(`Tool ${D} not found or does not have an execute function`);let B=Qp();return T({context:n,runtimeContext:B},B)}}};var CAi=g(()=>{W0u();i$();ZV();NH();rR();Rvu();Hvu();bvu();Rvu();bvu()});import{decodeJwt as zft}from"jose";var HK4=({env:i,server:u,url:t})=>{i.SELF=new Proxy({},{get:(f,l)=>{if(l==="toJSON")return null;return async(c)=>{return await u.callTool({toolCallId:l,toolCallInput:c})}}}),i.IS_LOCAL=(t?.startsWith("http://localhost")||t?.startsWith("http://127.0.0.1"))??!1},Hft=(i)=>()=>{return{...i??{}}},RK4=({env:i,server:u,tokenOrContext:t,url:f,authToken:l})=>{let c=i,E=l?l.split(" ")[1]:void 0,$;if(typeof t==="string"){let w=zft(t),d=w.metadata??{};$={authorization:E,state:w.state??d.state??{},token:t,meshUrl:w.meshUrl??d.meshUrl,connectionId:w.connectionId??d.connectionId,organizationId:w.organizationId??d.organizationId,organizationName:w.organizationName??d.organizationName,organizationSlug:w.organizationSlug??d.organizationSlug,ensureAuthenticated:Hft(w.user??w.sub)}}else if(typeof t==="object"){$=t;let w=zft(t.token),d=w.metadata??{},h=w.appName;$.authorization??=E,$.callerApp=h,$.connectionId??=w.connectionId??d.connectionId,$.organizationId??=w.organizationId??d.organizationId,$.organizationName??=w.organizationName??d.organizationName,$.organizationSlug??=w.organizationSlug??d.organizationSlug,$.ensureAuthenticated=Hft(w.user??w.sub)}else $={state:{},authorization:E,token:void 0,meshUrl:void 0,connectionId:void 0,ensureAuthenticated:()=>{throw Error("Unauthorized")}};return c.MESH_REQUEST_CONTEXT=$,$.state=Tft($),HK4({env:c,server:u,url:f}),c},bK4,Rft=(i)=>{let u=Qft(i),t=i.cors??bK4,f=i.oauth,l=f?kft(f):null,c=async(E,$,w)=>{let d=new URL(E.url);if(l){if(d.pathname==="/.well-known/oauth-protected-resource"||d.pathname==="/mcp/.well-known/oauth-protected-resource")return l.handleProtectedResourceMetadata(E);if(d.pathname==="/.well-known/oauth-authorization-server")return l.handleAuthorizationServerMetadata(E);if(d.pathname==="/authorize")return l.handleAuthorize(E);if(d.pathname==="/oauth/callback")return l.handleOAuthCallback(E);if(d.pathname==="/token"&&E.method==="POST")return l.handleToken(E);if((d.pathname==="/register"||d.pathname==="/mcp/register")&&E.method==="POST")return l.handleClientRegistration(E)}if(d.pathname==="/mcp"){if(E.method==="GET")return new Response("Method not allowed",{status:405});if(l&&!l.hasAuth(E)){let h=E.clone();try{if((await h.json())?.method!=="tools/list")return l.createUnauthorizedResponse(E)}catch{return l.createUnauthorizedResponse(E)}}return u.fetch(E,$,w)}if(d.pathname.startsWith("/mcp/call-tool")){let h=d.pathname.split("/").pop();if(!h)return new Response("Not found",{status:404});let _=await E.json(),v=await u.callTool({toolCallId:h,toolCallInput:_});return new Response(JSON.stringify(v),{headers:{"Content-Type":"application/json"}})}return i.fetch?.(E,$,w)||new Response("Not found",{status:404})};return{fetch:async(E,$,w)=>{if(new URL(E.url).pathname==="/_healthcheck")return new Response("OK",{status:200});if(t!==!1&&E.method==="OPTIONS")return Fft(E,t??{});let d=RK4({authToken:E.headers.get("authorization")??null,env:{...process.env,...$},server:u,tokenOrContext:E.headers.get("x-mesh-token")??void 0,url:E.url}),h=await Yp.run({req:E,env:d,ctx:w},async()=>await c(E,d,w));if(t!==!1)return Uft(h,E,t??{});return h}}};var bft=g(()=>{rR();Pft();zvu();zvu();Hvu();CAi();CAi();rR();zAi();bK4={origin:(i)=>{if(i.includes("localhost")||i.includes("127.0.0.1"))return i;return i},credentials:!0,allowMethods:["GET","POST","PUT","DELETE","OPTIONS"],allowHeaders:["Content-Type","Authorization","mcp-protocol-version"]}});import{z as Cvu}from"zod";function qK4(i,u){let t=_n({id:"COLLECTION_REGISTRY_APP_LIST",description:"List public registry items",annotations:{readOnlyHint:!0,idempotentHint:!0},inputSchema:wR,outputSchema:dR,execute:async({context:$})=>{let w={limit:$.limit,offset:$.offset,cursor:$.cursor,tags:$.tags,categories:$.categories,where:$.where},d=`${u}:${JSON.stringify(w)}`,h=Cft.get(d);if(h)return h;let _=await i.listPublic(u,w);return Cft.set(d,_),_}}),f=_n({id:"COLLECTION_REGISTRY_APP_GET",description:"Get a public registry item by ID or name",annotations:{readOnlyHint:!0,idempotentHint:!0},inputSchema:j5,outputSchema:IJ,execute:async({context:$})=>{let w=$.id??$.name;if(!w)return{item:null};let d=await i.findByIdOrName(u,w);if(d&&d.is_public)return{item:d};return{item:null}}}),l=_n({id:"COLLECTION_REGISTRY_APP_VERSIONS",description:"Get available versions of a public registry item",annotations:{readOnlyHint:!0,idempotentHint:!0},inputSchema:j5,outputSchema:Cvu.object({versions:Cvu.array(IJ.shape.item)}),execute:async({context:$})=>{let w=$.id??$.name;if(!w)return{versions:[]};let d=await i.findByIdOrName(u,w);if(d&&d.is_public)return{versions:[d]};return{versions:[]}}}),c=_n({id:"COLLECTION_REGISTRY_APP_SEARCH",description:"Search public registry items returning minimal data (id, title, tags, categories, is_public). Use this instead of LIST when you need to find items efficiently without loading full details.",annotations:{readOnlyHint:!0,idempotentHint:!0},inputSchema:lPi,outputSchema:cPi,execute:async({context:$})=>{return await i.search(u,$,{publicOnly:!0})}}),E=_n({id:"COLLECTION_REGISTRY_APP_FILTERS",description:"Get available tags and categories for public registry items",annotations:{readOnlyHint:!0,idempotentHint:!0},inputSchema:Cvu.object({}),outputSchema:hR,execute:async()=>{return await i.getFilters(u,{publicOnly:!0})}});return[t,c,f,l,E]}function Mft(i){let u=i.db,t=new BQ(u);return async(f)=>{let l=f.req.param("orgSlug")??f.req.param("org");if(!l)return f.json({error:"Organization not found"},404);let c=await u.selectFrom("organization").select(["id","slug","name"]).where("slug","=",l).executeTakeFirst();if(!c)return f.json({error:"Organization not found"},404);let E=qK4(t,c.id),$=Rft({tools:E}),w=new URL(f.req.url),d=f.req.path.indexOf("/registry"),h=d>=0?f.req.path.slice(d+9):"",_=new URL(h||"/",w.origin);w.searchParams.forEach((n,O)=>{_.searchParams.set(O,n)});let v=new Request(_.toString(),{method:f.req.method,headers:f.req.raw.headers,body:f.req.method!=="GET"&&f.req.method!=="HEAD"?f.req.raw.body:void 0}),D={organizationId:c.id,db:u,MESH_REQUEST_CONTEXT:{},MESH_APP_DEPLOYMENT_ID:"public-registry",IS_LOCAL:!1};return await $.fetch(v,D,f)}}var CK4=3600000,MK4=500,Cft;var qft=g(()=>{bft();CAi();zsi();U1();Cft=qR({ttlMs:CK4,maxSize:MK4,updateRecencyOnGet:!0})});import{sql as VK4}from"kysely";import{randomUUID as Vft}from"crypto";import{z as rK4}from"zod";async function eK4(i){let u=new Date().toISOString(),t=Vft(),f=_4.SELF(i.organizationId),l="registry.publish_request.created",c={requestId:i.request.id,requestedId:i.request.requested_id,title:i.request.title,status:i.request.status,createdAt:i.request.created_at,requester:{name:i.request.requester_name,email:i.request.requester_email}};await i.db.insertInto("events").values({id:t,organization_id:i.organizationId,type:"registry.publish_request.created",source:f,specversion:"1.0",subject:i.request.id,time:u,datacontenttype:"application/json",dataschema:null,data:JSON.stringify(c),cron:null,status:"pending",attempts:0,last_error:null,next_retry_at:null,created_at:u,updated_at:u}).execute();let E=await i.db.selectFrom("event_subscriptions").select(["id"]).where("organization_id","=",i.organizationId).where("enabled","=",1).where("event_type","=","registry.publish_request.created").where(($)=>$.or([$("publisher","is",null),$("publisher","=",f)])).execute();if(E.length>0)await i.db.insertInto("event_deliveries").values(E.map(($)=>({id:Vft(),event_id:t,subscription_id:$.id,status:"pending",attempts:0,last_error:null,delivered_at:null,next_retry_at:null,created_at:u}))).execute();try{await VK4`SELECT pg_notify('mesh_events', ${t})`.execute(i.db)}catch{}}async function aK4(i,u){let f=(await i.selectFrom("organization").select(["id"]).where("id","=",u).execute())[0];if(f?.id)return f.id;return(await i.selectFrom("organization").select(["id"]).where("slug","=",u).execute())[0]?.id??null}async function oK4(i,u){let t=await i.selectFrom("virtual_mcp_plugin_configs").innerJoin("connections","connections.id","virtual_mcp_plugin_configs.virtual_mcp_id").select(["virtual_mcp_plugin_configs.settings as settings"]).where("connections.organization_id","=",u).where("virtual_mcp_plugin_configs.plugin_id","=",xJ).execute();for(let f of t){let l=f.settings,c=typeof l==="string"?(()=>{try{return JSON.parse(l)}catch{return{}}})():l??{};if(c.acceptPublishRequests===!0){let E=c.rateLimitWindow==="minute"?"minute":"hour",$=c.rateLimitMax,w=typeof $==="number"&&Number.isFinite($)&&$>=1?Math.floor($):mft;return{acceptPublishRequests:!0,requireApiToken:c.requireApiToken===!0,rateLimitEnabled:c.rateLimitEnabled===void 0?rft:c.rateLimitEnabled===!0,rateLimitWindow:E,rateLimitMax:w}}}return{acceptPublishRequests:!1,requireApiToken:!1,rateLimitEnabled:rft,rateLimitWindow:mK4,rateLimitMax:mft}}async function sK4(i,u,t){let f=t==="minute"?60000:3600000,l=new Date(Date.now()-f).toISOString(),c=await i.selectFrom("private_registry_publish_request").select((E)=>E.fn.countAll().as("count")).where("organization_id","=",u).where("created_at",">=",l).executeTakeFirst();return Number(c?.count??0)}async function pK4(i,u,t,f){let l=await i.selectFrom("private_registry_item").select(["id","title"]).where("organization_id","=",u).where((c)=>c.or([c("id","=",t),c("title","=",f)])).executeTakeFirst();return l?{id:String(l.id),title:String(l.title)}:null}function eft(i){let{db:u,db:t}=i,f=new FQ(t),l=new UQ(t);return async(c)=>{let E=c.req.param("orgRef")??c.req.param("org");if(!E)return c.json({error:"Organization not found"},404);let $=await aK4(u,E);if(!$)return c.json({error:"Organization not found"},404);let w=await oK4(u,$);if(!w.acceptPublishRequests)return c.json({error:"Publish requests are not enabled for this registry."},403);if(w.requireApiToken){let D=c.req.header("Authorization"),n=D?.startsWith("Bearer ")?D.slice(7).trim():null;if(!n)return c.json({error:"API key required. Use Authorization: Bearer <key>"},401);if(!await l.validate($,n))return c.json({error:"Invalid API key"},401)}if(w.rateLimitEnabled){if(await sK4(t,$,w.rateLimitWindow)>=w.rateLimitMax)return c.json({error:"Too many publish requests. Please try again later.",retryAfterSeconds:w.rateLimitWindow==="minute"?60:3600},429)}let d;try{d=await c.req.json()}catch{return c.json({error:"Invalid JSON body"},400)}let h=Er0.safeParse(d);if(!h.success)return c.json({error:"Invalid publish request payload",details:rK4.treeifyError(h.error)},400);let _=await pK4(t,$,h.data.data.id,h.data.data.title);if(_)return c.json({error:"A registry item with the same id or title already exists. Please use a different name/id.",conflict:_},409);let v=await f.createOrUpdate({organization_id:$,requested_id:h.data.data.id,title:h.data.data.title,description:h.data.data.description??null,_meta:h.data.data._meta,server:h.data.data.server,requester_name:h.data.requester?.name??null,requester_email:h.data.requester?.email??null});try{await eK4({db:u,organizationId:$,request:v})}catch(D){console.warn("[private-registry] failed to emit publish-request event:",D)}return mu.capture({distinctId:h.data.requester?.email??`org:${$}`,event:"registry_publish_request_submitted",groups:{organization:$},properties:{organization_id:$,request_id:v.id,requested_id:v.requested_id,title:h.data.data.title,requester_email:h.data.requester?.email??null}}),c.json({id:v.id,requested_id:v.requested_id,status:v.status},201)}}var rft=!0,mK4="hour",mft=100;var aft=g(()=>{H4();Rt();_R();Hsi();Rsi();U1()});var oft={};Xi(oft,{createPublishRequestHandler:()=>eft,createPublicMCPHandler:()=>Mft});var sft=g(()=>{qft();aft()});var Ecu={};Xi(Ecu,{watchHandler:()=>f4t,getProxyDispatch:()=>fJ4,createApp:()=>vJ4});import{readFileSync as iJ4}from"fs";import{PrometheusSerializer as uJ4}from"@opentelemetry/exporter-prometheus";import{DBOS as mR}from"@dbos-inc/dbos-sdk";import{oAuthDiscoveryMetadata as $J4,oAuthProtectedResourceMetadata as wJ4}from"better-auth/plugins";async function tJ4(i){let u=i.connect(),t;try{t=await Promise.race([u,i4t(pft)])}catch{return u.then((f)=>f.release(!0)).catch(()=>{}),!1}try{return await Promise.race([t.query("SELECT 1"),i4t(pft)]),t.release(),!0}catch{return t.release(!0),!1}}function i4t(i){return new Promise((u,t)=>setTimeout(()=>t(Error("pg health-check timeout")),i))}function fJ4(){if(!Mvu)throw Error("getProxyDispatch() called before createApp() or without NATS \u2014 proxy dispatch unavailable");return Mvu}async function lJ4(i,u){let{items:t}=await i.storage.connections.list(u,{where:{field:["connection_url"],operator:"like",value:`${F40}%`},limit:1}),f=t[0];if(!f?.configuration_state)return null;return f.configuration_state.project_locator}function cJ4(i){let u=new URLSearchParams;if(i){let[t,f]=i.split("/");if(t)u.set("workspace_hint",t);if(f)u.set("project_hint",f)}else u.set("auto_personal","true");return u.set("force_new","true"),u}async function vJ4(i={}){let u=i.database??Ft(),t=!1;Z1.stop().catch((H)=>{console.error("[SSEHub] Error stopping previous broadcast (HMR cleanup):",H)});let f,l,c=new Pvu,E,$,w,d,h,_=null;if(i.disableNats)E=Avu(),f={get:async()=>null,set:async()=>{},invalidate:async()=>{},teardown:()=>{}},l=new bo,$={start:async()=>{},broadcast:()=>{},publishControlFrame:()=>{},stop:async()=>{}},h=void 0,w={init:async()=>{},pump:(H)=>{return(async()=>{let ni=H.getReader();try{while(!0){let{done:Yi}=await ni.read();if(Yi)break}}catch{}finally{ni.releaseLock()}})()},publishRawChunk:async()=>!1,publishDone:async()=>!1,createTailStream:async()=>null,purge:()=>{},teardown:()=>{}};else{_=ktt();let H=yu().natsCredsPath,ni;if(H)try{ni=iJ4(H,"utf8")}catch(t0){console.error(`[app] failed to read NATS_CREDS at ${H}; connecting anonymously`,t0)}_.init(yu().natsUrls,ni?{creds:ni}:void 0);let Yi=rsi()?new Qai({getJetStream:()=>_.getJetStream()}):null;Yi?.init().catch(()=>{}),f=Yi;let uu=new t6u({getJetStream:()=>_.getJetStream()});uu.init().catch(()=>{}),l=uu,E=Avu({getConnection:()=>_.getConnection()}),$=new Ivu({getConnection:()=>_.getConnection()}),w=new xvu({getConnection:()=>_.getConnection(),getJetStream:()=>_.getJetStream()}),d=Ytt({getConnection:()=>_.getConnection()}),h=Rtt({getConnection:()=>_.getConnection()});let bi=btt({getConnection:()=>_.getConnection()}),Au=$;$={start:(t0)=>Au.start(t0),broadcast:(t0)=>Au.broadcast(t0),publishControlFrame:(t0,Af)=>{bi.publishControlFrame(t0,Af).catch((O4)=>{console.warn("[TunnelControl] publishControlFrame failed (non-critical):",O4)})},stop:()=>Au.stop()},Se0(_),_.onReady(()=>{Yi?.init().catch((t0)=>{console.error("[McpListCache] Deferred init failed:",t0)}),uu.init().catch((t0)=>{console.error("[ConnectionCircuitStore] Deferred init failed:",t0)}),E.start(),f50(()=>_.getConnection()),w.init().catch((t0)=>{console.warn("[Decopilot] StreamBuffer init failed (late-join disabled):",t0)})})}if(eR)await eR();zai(f),f6u(l);let D={storage:new SQ(u.db),sseHub:Z1},n=new sfu(D),O=new Lm(u.db),N=new Gvu(O);N.start(),$.start((H)=>{Lhi(H),n.execute({type:"CANCEL",taskId:H}).catch((ni)=>{console.error("[Decopilot] CancelBroadcast execute failed:",ni)})}).catch((H)=>{console.error("[Decopilot] CancelBroadcast start failed:",H)}),_?.onReady(()=>{$.start().catch((H)=>{console.error("[CancelBroadcast] Deferred start failed:",H)})}),w.init().catch((H)=>{console.warn("[Decopilot] StreamBuffer init failed, attach/late-join disabled:",H)}),eR=async()=>{await n.stopAll(),n.dispose(),N.dispose(),$.stop().catch(()=>{}),w.teardown(),f?.teardown(),c.teardown(),E.teardown(),l50(),l.teardown(),zai(null),f6u(null)};let y=new Wu;if(y.use("*",Wmi({enabled:(H)=>pW(H,"debug")==="1"})),y.use("*",qQi),y.use("/*",$l0({origin:(H)=>{if(H.includes("localhost")||H.includes("127.0.0.1"))return H;return H},credentials:!0,allowMethods:["GET","POST","PUT","DELETE","OPTIONS"],allowHeaders:["Content-Type","Authorization","mcp-protocol-version"],exposeHeaders:["WWW-Authenticate"]})),y.use("*",async(H,ni)=>{if(await ni(),H.req.path.includes("/files/"))return;if(H.req.path.includes("/fs/")&&H.req.path.endsWith("/read"))return;H.header("X-Frame-Options","DENY"),H.header("Content-Security-Policy","frame-ancestors 'none'")}),!yu().noTui)y.use("*",stt());y.use("*",async(H,ni)=>{if(await ni(),EM(H.req.path))return;if(H.res.status>=500){let uu=await H.res.clone().text();console.error(`[5xx Response] ${H.req.method} ${H.req.path} - ${H.res.status}:`,uu)}}),y.get(D6.HEALTH,(H)=>{if(t)return H.json({status:"shutting_down"},503);return H.json({status:"ok"})}),y.get(D6.HEALTH_LIVE,(H)=>{return H.json({status:"ok"})}),y.get(D6.HEALTH_READY,async(H)=>{if(t)return H.json({status:"shutting_down"},503);let ni={};if(ni.postgres={status:await tJ4(u.pool)?"up":"down"},_)ni.nats=_.isConnected()?{status:"up"}:{status:"down"};else ni.nats={status:"down"};let Yi=ni.postgres.status==="up",uu=Yi?200:503;return H.json({status:Yi?"ready":"not_ready",services:ni},uu)}),y.get(D6.METRICS,async(H)=>{try{let ni=await eQi.collect(),Yi=EJ4.serialize(ni.resourceMetrics);return H.text(Yi,200,{"Content-Type":"text/plain; version=0.0.4; charset=utf-8"})}catch(ni){return console.error("Failed to collect metrics:",ni),H.text("# Error collecting metrics",500)}}),y.get(`${D6.DBOS_QUEUE_DEPTH_PREFIX}:queueName`,async(H)=>{let ni=H.req.param("queueName");if(!dJ4.has(ni))return H.json({error:`Unknown queue: ${ni}`},404);let Yi=await mR.listQueuedWorkflows({queueName:ni,status:"ENQUEUED"});return H.json({queue_length:Yi.length})}),y.get(D6.HOSTED_RUN_PENDING,(H)=>{let{active:ni,pending:Yi,max:uu}=nF0();return H.json({pending:Yi,active:ni,max:uu})}),y.route("/api/config",$tt),y.route("/api/_reports",Ztt),y.route("/report",Dtt(i.clientDir)),y.route("/api/auth/custom",oe0),y.all("/api/auth/admin/*",ia0),y.all("/api/auth/*",async(H)=>{return await et.handler(H.req.raw)});let Z=Xg0();Z.use("/.well-known/oauth-protected-resource/mcp/:connectionId",jJ),Z.use("/mcp/:connectionId/.well-known/oauth-protected-resource",jJ),y.route("/",Z),y.get("/.well-known/oauth-protected-resource/api/:org/mcp/:connectionId",da),y.route("/",Qg0()),y.use("/oauth-proxy/:connectionId/*",jJ),y.all("/oauth-proxy/:connectionId/*",u4t);let T=async(H)=>{let Yi=await hJ4()(H.req.raw),uu=await Yi.json();return Response.json(uu,Yi)};y.use("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",jJ),y.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",T);let B=async(H)=>{let Yi=await _J4()(H.req.raw),uu=await Yi.json();return Response.json(uu,Yi)};y.get("/.well-known/oauth-authorization-server/*/:gateway?/:connectionId?",B);let F=Ge0({ttlMs:120000}),A=await Tg0({db:u.db,auth:et,encryption:{key:yu().encryptionKey},observability:{tracer:i2,meter:Bt},modelListCache:c,providerKeyCache:E,memberRoleCache:F,linkStatusProbe:d,publishLinkControlFrame:(H,ni)=>$.publishControlFrame(H,ni)});fg.set(A);let G=new eD(yu().encryptionKey);nsu({db:u.db,baseUrl:hh()});let I=hwi(u.db),k=new xm(u.db),q=ett({db:u.db});ocu({storage:I,studioContextFactory:q}),v4u({studioContextFactory:q,deps:{runRegistry:n,cancelBroadcast:$,streamBuffer:w,sseHub:Z1},prepareLinkWorkFn:Hs0,workPublisher:h}),$4u({dispatchRunFn:Qs0,studioContextFactory:q,deps:{runRegistry:n,cancelBroadcast:$,streamBuffer:w,sseHub:Z1}});let J=new SQ(u.db),W=new Wm(u.db);oB0({getJetStream:()=>_?.getJetStream()??null,getJetStreamManager:async()=>{let H=_?.getConnection();return H?await t4t.jetstreamManager(H):null},messageParts:J.messageParts(),resolveRun:async(H)=>{let ni=await u.db.selectFrom("threads").select(["organization_id","created_by","message_storage_version","status","run_fence_token","title"]).where("id","=",H).executeTakeFirst();return ni?{orgId:ni.organization_id,createdBy:ni.created_by,version:ni.message_storage_version??1,status:ni.status,runFenceToken:ni.run_fence_token,title:ni.title??null}:null},completeRunIfNotCompleted:async(H,ni)=>{let Yi=await J.completeRunIfNotCompleted(H,ni);if(LAi(Z1,ni,H,Yi),Yi)await l4u(W,H,ni);return Yi},markRunRequiresAction:async(H,ni)=>{let Yi=await J.requiresActionIfInProgress(H,ni);return LAi(Z1,ni,H,Yi),Yi},markRunFailed:async(H,ni,Yi,uu)=>{let bi=await J.markRunFailed(H,ni,Yi,uu);if(LAi(Z1,ni,H,bi),bi)await l4u(W,H,ni);return bi},clearSynthesizedError:async(H,ni)=>{await J.messageParts().replaceMessageParts(H,Zg(H,ni),[])},persistTitle:(H,ni,Yi)=>J.update(H,ni,{title:Yi}),onTitleUpdated:async({runId:H,orgId:ni,title:Yi})=>{let uu=await J.get(H,ni).catch(()=>null);Z1.emit(ni,Rh(H,uu?.status??"in_progress",{title:Yi,virtualMcpId:uu?.virtual_mcp_id??void 0,createdBy:uu?.created_by,triggerId:uu?.trigger_id,branch:uu?.branch??null,createdAt:uu?.created_at,updatedAt:uu?.updated_at}))},bumpProgress:async({runId:H,orgId:ni})=>{await J.bumpProgress(H,ni)},recordCompleted:async({runId:H,orgId:ni,distinctId:Yi,usage:uu})=>{mu.capture({distinctId:Yi,event:"chat_message_completed",groups:{organization:ni},properties:{organization_id:ni,thread_id:H,transport:"projector",input_tokens:uu.inputTokens,output_tokens:uu.outputTokens,total_tokens:uu.totalTokens}})},recordFailed:async({runId:H,orgId:ni,distinctId:Yi,reason:uu,kind:bi})=>{mu.capture({distinctId:Yi,event:"chat_message_failed",groups:{organization:ni},properties:{organization_id:ni,thread_id:H,transport:"projector",error_category:bi,error_message:uu}})},purgeRun:async(H)=>{w.purge(H)}}),UK0({studioContextFactory:q,systemDatabaseUrl:tzi(yu().databaseUrl,yu().databasePgSsl),streamBuffer:w}),rtt(),gsu();let r=async(H,ni,Yi)=>{let uu=await I.findById(H,ni);if(!uu)throw Error("Automation not found");return i6u({automationId:uu.id,organizationId:uu.organization_id,triggerId:null})},Y=new IR(I,({automation:H,trigger:ni,contextMessages:Yi,idempotencyKey:uu})=>Ho({automationId:H.id,organizationId:H.organization_id,triggerId:ni.id,contextMessages:Yi},{idempotencyKey:uu})),li=[dh(),SL(),BD()];for(let H of li)QAi(H).then(()=>{}).catch((ni)=>console.error("[monitoring] Retention cleanup failed:",ni));let di=()=>u.db.deleteFrom("apikey").where("expiresAt","<",new Date).execute().then(()=>{}).catch((H)=>console.error("[auth] Expired API key cleanup failed:",H));di(),setInterval(di,86400000).unref(),y.use("*",async(H,ni)=>{if(CQi(H.req.path))return ni();let Yi={measure:async(bi,Au)=>{_3(H,bi);try{return await Au()}finally{sw(H,bi)}}},uu=await fg.create(H.req.raw,{timings:Yi});uu.automationRunner=r,H.set("studioContext",uu);try{await ni()}finally{let bi=uu.pendingRevalidations;if(bi.length>0)Promise.race([Promise.allSettled(bi),O0(30000)]).catch((t0)=>console.error("[mesh] revalidation cleanup error:",t0))}}),y.use("/api/:org/decopilot/*",KJ),y.use("/api/:org/v1/*",KJ),y.use("/api/:org/files/*",KJ),y.use("*",async(H,ni)=>{let Yi=H.req.path;if(Yi.startsWith("/api/org-sso/")||Yi.startsWith("/api/auth/")||Yi.startsWith("/api/tools/management")||Yi.startsWith("/oauth-proxy/")||Yi.startsWith(`${X3u}/`))return ni();let uu=H.get("studioContext");if(!uu?.organization?.id||!uu?.auth?.user?.id)return ni();if(!(await uu.storage.orgSsoConfig.getByOrgId(uu.organization.id))?.enforced)return ni();if(!await uu.storage.orgSsoSessions.isValid(uu.auth.user.id,uu.organization.id))return H.json({error:"SSO authentication required for this organization"},403);return ni()});let fi=new Wu;fi.use("*",m3({mountPath:"/api/org-sso"})),fi.route("/",ZPi()),y.route("/api/org-sso",fi),y.get("/api/tools/management",(H)=>{return H.json({tools:Qmi,grouped:ZN()})}),y.use("/mcp/*",async(H,ni)=>{_3(H,"mcp");try{return await ni()}finally{sw(H,"mcp")}});let p=async(H,ni)=>{let Yi=H.var.studioContext;if(!Yi.auth.user?.id&&!Yi.auth.apiKey?.id){let uu=new URL(H.req.url);return H.res=new Response(null,{status:401,headers:{"WWW-Authenticate":`Bearer realm="mcp",resource_metadata="${uu.origin}${uu.pathname}/.well-known/oauth-protected-resource"`}})}return await ni()};if(y.use("/mcp/:connectionId?",p),y.use("/mcp/gateway/:virtualMcpId?",p),y.use("/mcp/virtual-mcp/:virtualMcpId?",p),y.use("/mcp/self",p),bh()){let{mountDevRoutes:H}=(gft(),oAi(nft));H(y,p)}let o=new Wu;o.use("*",m3({mountPath:"/mcp"})),o.route("/",cBi()),y.route("/mcp",o);let Oi=new Wu;Oi.use("*",m3({mountPath:"/mcp/self"})),Oi.route("/",kAi()),y.route("/mcp/self",Oi);let wi=new Wu;wi.use("*",m3({mountPath:"/mcp"})),wi.route("/",wBi()),y.route("/mcp",wi),y.use("/api/:org/models/*",async(H,ni)=>{_3(H,"llm_models");try{return await ni()}finally{sw(H,"llm_models")}});let Si=Khu({cancelBroadcast:$,streamBuffer:w,runRegistry:n,linkStatusProbe:d});if(y.route("/api",Si),_!=null)Mvu=ztt({getConnection:()=>_?.getConnection()??null});y.route("/api",V0t()),y.get("/api/links/me",async(H)=>{try{let ni=H.req.header("authorization")??"",Yi=/^Bearer\s+(.+)$/i.exec(ni),uu=null;if(Yi){let Au=(Yi[1]??"").trim();uu=await C0t(Au,et.api)}else uu=H.get("studioContext")?.auth?.user?.id??null;if(!uu)return H.json({error:"unauthorized"},401);let bi=d?await d(uu):{online:!1,capabilities:[]};if(!bi.online)return H.json(null);return H.json({hostname:bi.hostname,cliVersion:bi.cliVersion})}catch(ni){return console.error("[links/me] presence probe failed; reporting offline:",ni instanceof Error?ni.message:String(ni)),H.json(null)}}),y.use("/api/:org/files/*",KJ),y.route("/api",Utt);let Ci=new Wu;Ci.use("*",m3({mountPath:"/api"})),Ci.route("/",GAi()),y.route("/api",Ci),y.route("/api",ltt);let Vi=new Wu;Vi.use("*",m3({mountPath:"/api"})),Vi.route("/",SAi({tokenStorage:k,automationEventDispatcher:Y})),y.route("/api",Vi);let ri=new Gm(u.db),vi=new Wu;vi.use("*",m3({mountPath:"/api"})),vi.route("/",ePi()),y.route("/api",vi),y.route("/api/deco-sites",wp0()),y.route("/api/deco-apps",s0t());let Ji=new Wu;Ji.use("*",m3({mountPath:"/api/deco-sites"})),Ji.route("/",oPi()),y.route("/api/deco-sites",Ji);let Pi=new Wu;Pi.use("*",m3({mountPath:"/api/vm-events"})),Pi.route("/",a0t()),y.route("/api/vm-events",Pi);let{createPublishRequestHandler:gi,createPublicMCPHandler:$i}=await Promise.resolve().then(() => (sft(),oft)),ci={db:u.db,vault:{encrypt:(H)=>G.encrypt(H),decrypt:(H)=>G.decrypt(H)}},Ki=gi(ci),m=$i(ci);y.use("/org/:orgRef/registry/publish-request",jJ),y.post("/org/:orgRef/registry/publish-request",Ki),y.use("/org/:orgSlug/registry/*",jJ),y.all("/org/:orgSlug/registry/*",m),y.post("/api/:org/registry/publish-request",Ki),y.all("/api/:org/registry/*",m),y.route(X3u,ua0());let ui=R0t({kvStorage:ri,runRegistry:n,streamBuffer:w,sseHub:Z1,cancelBroadcast:$,tokenStorage:k,automationEventDispatcher:Y,mountDevAssets:bh(),mcpAuth:p,oauthProxyHandler:u4t,watchHandler:f4t,betterAuthProtectedResourceHandler:T,getNatsConnection:()=>_?.getConnection()??null});return y.route("/api/:org",ui),y.notFound((H)=>{return H.json({error:"Not Found",path:H.req.path},404)}),y.onError(es0),Object.assign(y,{markShuttingDown:()=>{t=!0},shutdown:async()=>{if(console.log("[shutdown] Stopping workers..."),await Promise.allSettled([Z1.stop(),eR?Promise.resolve(eR()).finally(()=>{eR=null}):Promise.resolve()]),_)await _.drain().catch((H)=>console.error("[shutdown] NATS drain error:",H));console.log("[shutdown] Flushing telemetry..."),await od().catch((H)=>console.error("[shutdown] Telemetry flush error:",H)),console.log("[shutdown] Closing database..."),await f2(u).catch((H)=>console.error("[shutdown] Database close error:",H)),console.log("[shutdown] Cleanup complete.")},initDbos:async()=>{await mR.registerQueue(u3,{partitionQueue:!0,concurrency:mcu,minPollingIntervalMs:ecu}),await mR.registerQueue(Ih,{partitionQueue:!0,concurrency:_4u}),await mR.registerQueue(jD,{partitionQueue:!0,concurrency:E4u}),await mR.registerQueue(F2,{partitionQueue:!0,concurrency:FK0}),await Whu(I),await Promise.allSettled(["automations-gate","automations-global"].map((H)=>mR.deleteQueue(H))),await acu(u.pool),V$0().catch((H)=>{console.error("[studio-pack-backfill] failed:",H)}),Osu().catch((H)=>{console.error("[org-fs] public-sets boot sync kick failed:",H)})}})}var t4t,pft=5000,Mvu=null,eR=null,u4t=async(i)=>{let u=i.req.param("connectionId");if(!u)return i.json({error:"Missing connectionId"},400);let t=i.req.path.split("/").filter(Boolean),f=t[t.length-1],l=i.get("studioContext");if(!l)l=await fg.create(i.req.raw),i.set("studioContext",l);let c=i.req.param("org")?l.organization?.id:void 0,E=await l.storage.connections.findById(u,c);if(!E?.connection_url)return i.json({error:"Connection not found"},404);let $=await Dz(E.connection_url),w,d=new URL(E.connection_url);if($.ok)w=(await $.json()).authorization_servers?.[0];if(!w)w=d.origin;let h=await ha(w);if(!h.ok)return i.json({error:"Failed to get auth server metadata"},502);let _=await h.json(),v;if(f==="authorize")v=_.authorization_endpoint;else if(f==="token")v=_.token_endpoint;else if(f==="register")v=_.registration_endpoint;if(!v)return i.json({error:`Unknown OAuth endpoint: ${f}`},404);let D=new URL(v),n=new URL(i.req.url);if(D.search=n.search,f==="authorize"){let I=D.searchParams.get("redirect_uri");if(I){let k=yu().baseUrl??n.origin;try{let q=new URL(I),J=new URL(k);if(!(q.origin===J.origin||q.hostname==="localhost"))return i.json({error:"invalid_request",error_description:"redirect_uri is not allowed"},400)}catch{return i.json({error:"invalid_request",error_description:"redirect_uri is malformed"},400)}D.searchParams.set("redirect_uri",I)}if(D.searchParams.has("resource"))D.searchParams.set("resource",E.connection_url);if(U40(E.connection_url))try{let k=await lJ4(l,E.organization_id),q=cJ4(k);for(let[J,W]of q)D.searchParams.set(J,W)}catch(k){console.warn("[oauth-proxy] Failed to get smart OAuth params, proceeding without:",k)}return i.redirect(D.toString(),302)}let O={Accept:i.req.header("Accept")||"application/json"},N=i.req.header("Content-Type");if(N)O["Content-Type"]=N;let y=i.req.header("Authorization");if(y)O.Authorization=y;let Z,T=null,B=null;if(i.req.method!=="GET"&&i.req.method!=="HEAD")if(f==="token"&&N?.includes("application/x-www-form-urlencoded")){if(y?.toLowerCase().startsWith("basic "))try{let W=atob(y.slice(6).trim()),r=W.indexOf(":");if(r!==-1){let Y=decodeURIComponent(W.slice(0,r)),li=decodeURIComponent(W.slice(r+1));T=Y||null,B=li||null}}catch{}let I=await i.req.formData();if(I.has("resource"))I.set("resource",E.connection_url);let k=I.get("client_id"),q=I.get("client_secret");if(typeof k==="string"&&k)T=k;if(typeof q==="string"&&q)B=q;let J=new URLSearchParams;for(let[W,r]of I.entries())J.append(W,r.toString());Z=J.toString()}else if(f==="register"&&N?.toLowerCase().includes("application/json")){let I=await l.db.selectFrom("organization").select(["id","slug","name"]).where("id","=",E.organization_id).executeTakeFirst(),k=await i.req.text(),q={};try{q=k?JSON.parse(k):{}}catch{Z=k}let J=typeof q==="object"&&q!==null&&!Array.isArray(q);if(Z===void 0&&!J)Z=k;if(Z===void 0){let W=q,r=W.metadata&&typeof W.metadata==="object"?W.metadata:{};W.metadata={...r,organization_id:E.organization_id,...I?.slug?{organization_slug:I.slug}:{},...I?.name?{organization_name:I.name}:{}},Z=JSON.stringify(W),O["Content-Type"]="application/json"}}else Z=i.req.raw.body??void 0;let F=await fetch(D.toString(),{method:i.req.method,headers:O,body:Z,duplex:"half",redirect:"manual"}),A=new Headers,G=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];for(let[I,k]of F.headers.entries())if(!G.includes(I.toLowerCase()))A.set(I,k);if(f==="token"&&F.ok){let I=await F.text();try{let k=JSON.parse(I);if(typeof k.access_token==="string"&&k.access_token){let q=typeof k.expires_in==="number"?new Date(Date.now()+k.expires_in*1000):null,J=null;try{J=await nz(E.connection_url)??v}catch{J=v}let W={connectionId:u,accessToken:k.access_token,refreshToken:typeof k.refresh_token==="string"?k.refresh_token:null,scope:typeof k.scope==="string"?k.scope:null,expiresAt:q,clientId:T,clientSecret:B,tokenEndpoint:J};await new al(l.db,l.vault).upsert(W)}}catch(k){console.error("[oauth-proxy] failed to persist downstream token:",k)}return new Response(I,{status:F.status,statusText:F.statusText,headers:A})}return new Response(F.body,{status:F.status,statusText:F.statusText,headers:A})},f4t=async(i)=>{let u=i.var.studioContext;if(!(u.auth.user?.id??u.auth.apiKey?.userId))return i.json({error:"Unauthorized"},401);let f=u.organization?.id;if(!f)return i.json({error:"organization id missing"},400);let l=i.req.query("types"),c=l?l.split(",").map(($)=>$.trim()).filter(Boolean):null,E=crypto.randomUUID();return e3(i,async($)=>{if(await $.writeSSE({event:"connected",data:JSON.stringify({listenerId:E,organizationId:f,typePatterns:c,connectedAt:new Date().toISOString()})}),!Z1.add({id:E,organizationId:f,typePatterns:c?.length?c:null,push:(h)=>{$.writeSSE({id:h.id,event:h.type,data:JSON.stringify(h)}).catch(()=>{Z1.remove(f,E)})}})){await $.writeSSE({event:"error",data:JSON.stringify({error:"Too many connections",message:"SSE connection limit reached. Try again later."})});return}let d=setInterval(()=>{$.writeSSE({event:"keepalive",data:""}).catch(()=>{clearInterval(d)})},30000);await new Promise((h)=>{$.onAbort(()=>{clearInterval(d),Z1.remove(f,E),h()})})})},EJ4,dJ4,hJ4=()=>wJ4(et),_J4=()=>$J4(et);var $cu=g(()=>{y4();vt();Nsu();cE();aW();Rt();yf();dEi();wl0();Ymi();Z_();wa();I3u();lE();jl();H4();J3u();ta0();Q3u();rs0();Jhu();D_();odi();Xhu();as0();Lhu();b0t();r0t();o0t();Hhu();p0t();EBi();_a();ctt();dBi();_vu();wtt();ntt();Ttt();Ptt();hvu();dvu();vli();eV();Gtt();ud();kwi();jm();c6u();Stt();Ktt();Wtt();Qtt();Htt();Ctt();pfu();Mtt();Epi();Zpi();I8();_pi();mtt();t$i();Svu();bw();Yhu();zz();f4u();afu();t$i();khu();Ssi();jsi();att();iY();ptt();RJ();I3u();nH();Whi();t4t=S(O2(),1);EJ4=new uJ4,dJ4=new Set([u3,Ih,jD,F2])});var $4t={};Xi($4t,{resolveClientDir:()=>ZJ4,resolveAssetPathWithTraversalCheck:()=>E4t,isPathWithinDirectory:()=>c4t,createAssetHandler:()=>TJ4});import{resolve as zp,dirname as DJ4,join as nJ4,extname as gJ4,basename as OJ4,sep as l4t}from"path";function NJ4(i,u){if(i===u||OJ4(i)==="index.html")return{"Cache-Control":"no-cache"};if(i.includes(`${l4t}assets${l4t}`))return{"Cache-Control":"public, max-age=31536000, immutable"};return{}}function c4t(i,u){let t=zp(u),f=zp(i);return f===t||f.startsWith(t+"/")}function E4t({requestPath:i,clientDir:u}){let t=i.startsWith("/")?i.slice(1):i,f=zp(u,t);if(!c4t(f,u))return null;return f}function ZJ4(i,u="../client"){let t=new URL(i),f=DJ4(t.pathname);return zp(f,u)}function TJ4(i={}){let{env:u="production",clientDir:t=yJ4,isServerPath:f=()=>!1}=i;if(u==="development")return async function(c){return null};return async function(c){if(c.method!=="GET")return null;let E=new URL(c.url),$;try{$=decodeURIComponent(E.pathname)}catch{return null}if(f($))return null;let w=E4t({requestPath:$,clientDir:t});if(!w)return null;let d=nJ4(w,"index.html"),h=zp(t,"index.html"),_=c.headers.get("accept"),D=_?.includes("text/html")||_?.includes("*/*")&&["",".html"].includes(gJ4(w))?[d,h]:[];for(let n of[w,...D])try{let O=Bun.file(n);if(await O.exists())return new Response(O,{headers:NJ4(n,h)})}catch{}if($.includes("/assets/"))return new Response("Not Found",{status:404,headers:{"Cache-Control":"no-store"}});return null}}var yJ4="./dist/client";var w4t=()=>{};var d4t={};Xi(d4t,{tryUpgradePreviewWs:()=>xJ4,tryHandlePreviewHttp:()=>IJ4,previewWebSocketHandler:()=>kJ4,parsePreviewBaseDomain:()=>AJ4,isPreviewWsData:()=>MAi,extractHandleFromHost:()=>qvu});function UJ4(i){if(i.method!=="GET")return!1;return(i.headers.get("accept")??"").includes("text/html")}function PJ4(){return new Response(FJ4,{status:503,headers:{"content-type":"text/html; charset=utf-8","cache-control":"no-store","retry-after":"1","access-control-allow-origin":"*"}})}function AJ4(i){if(!i||i.trim()==="")return null;let u=i.includes("{handle}")?i.replace("{handle}","__handle__"):i,t;try{t=new URL(u)}catch{return null}let f=t.hostname;if(i.includes("{handle}")){let l=f.indexOf(".");if(l<=0||l===f.length-1)return null;return f.slice(l+1)}return f}function qvu(i,u){if(!i||!u)return null;let t=i.indexOf(":"),f=(t>=0?i.slice(0,t):i).toLowerCase(),c=`.${u.toLowerCase().replace(/^\.+|\.+$/g,"")}`;if(!f.endsWith(c))return null;let E=f.slice(0,f.length-c.length);if(!E||E.includes("."))return null;return E}async function IJ4(i,u){let t=qvu(i.headers.get("host"),u.baseDomain);if(!t)return null;let f=await u.getRunner();if(!f)return Rp(503,"preview proxy not configured");let l=await f.proxyPreviewRequest(t,i);if(l.headers.get(CK)&&UJ4(i))return PJ4();return l.headers.delete(CK),l}function Rp(i,u){return new Response(JSON.stringify({error:u}),{status:i,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function MAi(i){return typeof i==="object"&&i!==null&&i.kind==="preview"}async function xJ4(i,u,t){if((i.headers.get("upgrade")??"").toLowerCase()!=="websocket")return null;let f=qvu(i.headers.get("host"),t.baseDomain);if(!f)return null;let l=await t.getRunner();if(!l)return Rp(503,"preview proxy not configured");let c=await l.resolvePreviewUpstreamUrl(f);if(!c)return Rp(404,"sandbox not found");let E=new URL(i.url);if(E.pathname.startsWith("/_sandbox")||E.pathname.startsWith("/_decopilot_vm"))return Rp(404,"not found");let $=`${c.replace(/^http/,"ws")}${E.pathname}${E.search}`,w=i.headers.get("sec-websocket-protocol"),d=w?w.split(",").map((v)=>v.trim()).filter(Boolean):[],h={kind:"preview",upstreamUrl:$,upstreamProtocols:d,pending:[],upstream:null,closed:!1};if(!u.upgrade(i,{data:h}))return Rp(426,"upgrade failed");return}function Hp(i,u,t,f){if(u.closed)return;u.closed=!0;try{i.close(t,f)}catch{}try{u.upstream?.close()}catch{}}var BJ4=256,FJ4='<!DOCTYPE html><html><head><meta charset="utf-8"><title>Connecting\u2026</title><style>body{font-family:system-ui,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0;background:#fafafa;color:#555}div{text-align:center;max-width:420px;padding:24px}h3{margin:0 0 8px}p{margin:0;font-size:14px;color:#999;line-height:1.5}</style></head><body><div><h3>Connecting to sandbox\u2026</h3><p>Waiting for the sandbox to come online. This page refreshes automatically.</p></div><script>setTimeout(function(){window.location.reload()},1500)</script></body></html>',kJ4;var h4t=g(()=>{tcu();kJ4={open(i){let u=i.data;if(!MAi(u))return;let t;try{t=u.upstreamProtocols.length>0?new WebSocket(u.upstreamUrl,u.upstreamProtocols):new WebSocket(u.upstreamUrl)}catch(f){console.warn(`[preview-ws] failed to dial upstream ${u.upstreamUrl}: ${f instanceof Error?f.message:String(f)}`),Hp(i,u,1011,"upstream connect failed");return}t.binaryType="arraybuffer",u.upstream=t,t.addEventListener("open",()=>{while(u.pending.length>0){let f=u.pending.shift();if(f!==void 0)t.send(f)}}),t.addEventListener("message",(f)=>{if(u.closed)return;i.send(f.data)}),t.addEventListener("close",(f)=>{Hp(i,u,f.code||1000,f.reason||"")}),t.addEventListener("error",()=>{Hp(i,u,1011,"upstream error")})},message(i,u){let t=i.data;if(!MAi(t))return;let f=t.upstream;if(f&&f.readyState===WebSocket.OPEN){f.send(u);return}if(t.pending.length>=BJ4){Hp(i,t,1011,"preview ws backlog overflow");return}t.pending.push(u)},close(i){let u=i.data;if(!MAi(u))return;Hp(i,u,1000,"")}}});var v4t={};Xi(v4t,{bootstrapDevLinkSession:()=>YJ4});import{existsSync as GJ4}from"fs";import{chmod as SJ4,mkdir as jJ4,rename as KJ4,writeFile as JJ4}from"fs/promises";import{dirname as XJ4,join as _4t}from"path";function LJ4(i){return _4t(i,"dev-link")}function WJ4(i){let u=process.env.DEV_LINK_SESSION_PATH;if(u&&u.trim()!=="")return u;return _4t(LJ4(i),"session.json")}async function YJ4(i,u){let t=WJ4(i),f=Ft().db,l=Q3()?await Wo():await f.selectFrom("user").select(["id","email","name"]).orderBy("createdAt","desc").executeTakeFirst();if(!l?.id)return null;if(GJ4(t))try{let d=await Bun.file(t).json(),h=d.user?.sub,_=d.accessToken;if(h===l.id&&typeof _==="string"){if(await et.api.verifyApiKey({body:{key:_}}).then((D)=>D?.valid===!0).catch(()=>!1))return{path:t,userSub:h}}}catch{}let c=null;try{c=await et.api.createApiKey({body:{name:"dev-link (auto-minted by bun run dev)",userId:l.id,permissions:{"*":["*"]},expiresIn:2592000,rateLimitEnabled:!1}})}catch(w){return console.warn("[dev-link] failed to mint API key:",w instanceof Error?w.message:String(w)),null}if(!c?.key)return null;let E={target:u,clientId:"dev-link",user:{sub:l.id,...l.email?{email:l.email}:{},...l.name?{name:l.name}:{}},accessToken:c.key,createdAt:new Date().toISOString()};await jJ4(XJ4(t),{recursive:!0});let $=`${t}.tmp`;return await JJ4($,JSON.stringify(E,null,2),{mode:384}),await SJ4($,384),await KJ4($,t),{path:t,userSub:l.id}}var D4t=g(()=>{lE();Z_();qg()});var tX4={};import{existsSync as qJ4}from"fs";function y4t(i,u){if(!u)return i;let t=new URL(i);if(!t.searchParams.has("sslmode"))t.searchParams.set("sslmode","verify-full");return t.toString()}function mJ4(i){let u=new Headers(i.headers);for(let[t,f]of Object.entries(rJ4))u.set(t,f);return new Response(i.body,{status:i.status,statusText:i.statusText,headers:u})}async function uX4(i){let u;try{u=await QJ4.create({systemDatabaseUrl:y4t(jw.databaseUrl,jw.databasePgSsl),systemDatabaseSchemaName:"dbos"});let t=await u.listWorkflows({status:"PENDING",queueName:Ih,executorId:i,loadInput:!1,loadOutput:!1});if(t.length===0){console.log(`[shutdown] no in-flight thread-gate gates to hand off (executor ${i})`);return}let f=t.map((l)=>l.workflowID);await u.resumeWorkflows(f,{queueName:Ih}),console.log(`[shutdown] re-enqueued ${f.length} in-flight thread-gate gate(s) for re-adoption by a live executor (from ${i}):`,f)}catch(t){console.error("[shutdown] thread-gate handoff failed:",t)}finally{await u?.destroy().catch(()=>{})}}async function VAi(i){if(N4t)return;N4t=!0,console.log(`
+  </head>`)}function Dtt(i){let u=new Wu;return u.get("/:domain",async(t)=>{let f=t.req.param("domain"),l=i?Aj4(i,"index.html"):null,c=l?Bun.file(l):null;if(!c||!await c.exists())return t.notFound();let E=await c.text();try{let $=Ij4(f);return t.html(xj4(E,$),200,{"Cache-Control":"public, max-age=0, s-maxage=300"})}catch{return t.html(E)}}),u}var ntt=g(()=>{yf();vt()});import{z as $u}from"zod";var bJ,kj4,Gj4,Sj4,jj4,gtt;var Ott=g(()=>{bJ=$u.enum(["good","bad","neutral"]),kj4=$u.preprocess((i)=>{if(Array.isArray(i))return{kind:"text",value:i.find((t)=>t!==null&&typeof t!=="object")??""};return i!==null&&typeof i==="object"?i:{kind:"text",value:i}},$u.object({kind:$u.enum(["text","number","sparkline","badge","score"]).catch("text"),value:$u.coerce.string().optional(),tone:bJ.optional(),muted:$u.boolean().optional(),delta:$u.coerce.string().optional(),deltaDir:$u.enum(["up","down","neutral"]).optional(),points:$u.array($u.coerce.number()).optional(),label:$u.coerce.string().optional()}).transform((i)=>{if(i.kind==="badge"&&i.label==null)i.label=i.value??"";if(i.kind==="score"){let u=Number(i.value);if(Number.isNaN(u))return{...i,kind:"text"}}return i})),Gj4=$u.preprocess((i)=>{let u=i;if(u&&typeof u==="object"&&!Array.isArray(u)&&Array.isArray(u.cells))u=u.cells;if(Array.isArray(u)&&u.length===1&&Array.isArray(u[0]))u=u[0];if(Array.isArray(u))return u;if(u&&typeof u==="object")return Object.values(u);return u},$u.array(kj4)),Sj4={key:$u.coerce.string(),title:$u.coerce.string(),eyebrow:$u.coerce.string().optional(),headline:$u.coerce.string(),annotation:$u.coerce.string().optional(),methodology:$u.coerce.string().optional(),sources:$u.array($u.object({name:$u.coerce.string(),logoUrl:$u.coerce.string()})).optional()},jj4=$u.discriminatedUnion("template",[$u.object({template:$u.literal("cover"),score:$u.object({value:$u.coerce.number(),max:$u.coerce.number().optional(),grade:$u.coerce.string().optional(),label:$u.coerce.string().optional()}).optional(),brandImage:$u.coerce.string().optional(),screenshot:$u.coerce.string().optional(),mobileScreenshot:$u.coerce.string().optional()}),$u.object({template:$u.literal("cta"),ctaUrl:$u.coerce.string().optional(),ctaLabel:$u.coerce.string().optional(),bullets:$u.array($u.coerce.string()).optional()}),$u.object({template:$u.literal("series"),points:$u.array($u.coerce.number()).min(2),xLabels:$u.array($u.coerce.string()).min(1),unit:$u.coerce.string().optional(),callout:$u.object({index:$u.coerce.number(),value:$u.coerce.string(),tone:bJ.optional()})}),$u.object({template:$u.literal("threshold"),value:$u.coerce.string().default(""),metricLabel:$u.coerce.string().optional(),ratio:$u.coerce.number(),thresholdRatio:$u.coerce.number().optional(),thresholdLabel:$u.coerce.string().default(""),tone:bJ.optional()}),$u.object({template:$u.literal("stats"),stats:$u.array($u.object({value:$u.coerce.string(),label:$u.coerce.string(),tone:bJ.optional()})).min(1)}),$u.object({template:$u.literal("bars"),items:$u.array($u.object({value:$u.coerce.string(),label:$u.coerce.string(),ratio:$u.coerce.number(),tone:bJ.optional()})).min(1)}),$u.object({template:$u.literal("gauges"),gauges:$u.array($u.object({label:$u.coerce.string(),value:$u.coerce.string(),status:$u.enum(["good","warn","bad"]).catch("warn"),caption:$u.coerce.string().optional(),ratio:$u.coerce.number().optional()})).min(1)}),$u.object({template:$u.literal("checklist"),checks:$u.array($u.object({label:$u.coerce.string(),status:$u.enum(["pass","fail","warn"]).catch("fail"),value:$u.coerce.string().optional()})).min(1)}),$u.object({template:$u.literal("table"),columns:$u.array($u.object({label:$u.coerce.string(),align:$u.enum(["left","right"]).optional()})).min(1),rows:$u.array(Gj4).min(1),highlightRow:$u.coerce.number().optional()}),$u.object({template:$u.literal("products"),products:$u.array($u.object({name:$u.coerce.string(),price:$u.coerce.string().optional(),image:$u.coerce.string().optional(),url:$u.coerce.string().optional()})).min(1)}),$u.object({template:$u.literal("list"),entries:$u.array($u.object({label:$u.coerce.string(),severity:$u.enum(["error","warning","notice"]).catch("notice")})).min(1),moreCount:$u.coerce.number().optional()}),$u.object({template:$u.literal("keywords"),volumeLabel:$u.coerce.string().optional(),keywords:$u.array($u.object({term:$u.coerce.string(),volume:$u.coerce.string(),position:$u.coerce.number().catch(0)})).min(1)}),$u.object({template:$u.literal("competitor"),metricLabel:$u.coerce.string().optional(),competitors:$u.array($u.object({name:$u.coerce.string(),value:$u.coerce.string(),tone:bJ.optional(),isYou:$u.boolean().optional()})).min(1)}),$u.object({template:$u.literal("scorecard"),rivalLabel:$u.coerce.string().optional(),dimensions:$u.array($u.object({label:$u.coerce.string(),you:$u.coerce.string(),rival:$u.coerce.string().optional(),rivalName:$u.coerce.string().optional(),tone:bJ.optional()})).min(1)})]),gtt=$u.object({...Sj4,template:jj4})});function Ntt(i){let u=[],t=[...i.sections].sort((f,l)=>f.position-l.position).map((f)=>{let l=gtt.safeParse(f.props);if(l.success)return l.data;let c=l.error.issues[0];return u.push({section_type:f.section_type,position:f.position,reason:c?`${c.path.join(".")||"(root)"}: ${c.message}`:"contract violation"}),null}).filter((f)=>f!==null);return{deck:{meta:{...i.meta,scores:i.summary?.scores},slides:t},drops:u}}var ytt=g(()=>{Ott()});function Wp(i,u){return fetch(`${JN({})}${i}`,u)}async function Kj4(i,u){let t=await Wp(`/api/v2/public/diagnostics/${encodeURIComponent(i)}`+(u?`?pw=${encodeURIComponent(u)}`:""),{headers:{Accept:"application/json"}});if(t.status===404)return{status:"not_found",deck:null,scanned_at:null,drops:[]};if(!t.ok)throw Error(`report read HTTP ${t.status}`);let f=await t.json(),{deck:l,drops:c}=Ntt(f);return{status:l.slides.length?"ready":"empty",deck:l,scanned_at:f.scanned_at,drops:c}}var Jj4,CJ,Ztt;var Ttt=g(()=>{yf();Z_();FY();ytt();Jj4=new Set(["complete","errored","terminated","unknown"]),CJ=new Wu;CJ.use("*",async(i,u)=>{let t=await et.api.getSession({headers:i.req.raw.headers});if(!t?.user?.id)return i.json({error:"Authentication required"},401,{"Cache-Control":"private, no-store",Vary:"Cookie"});i.set("reportUser",{email:t.user.email}),await u(),i.header("Cache-Control","private, no-store"),i.header("Vary","Cookie");return});CJ.get("/site/:domain",async(i)=>{let u=i.req.param("domain").trim();if(!u)return i.json({error:"domain is required"},400);let t=i.req.query("key")?.trim()||void 0;try{let f=await Kj4(u,t);return i.header("Cache-Control","private, no-store"),i.json(f)}catch{return i.json({error:"report read failed"},502)}});CJ.post("/run",async(i)=>{let u;try{u=await i.req.json()}catch{return i.json({error:"invalid JSON"},400)}let t=typeof u.domain==="string"?u.domain.trim():"";if(!t)return i.json({error:"domain is required"},400);let f=i.get("reportUser").email,l=typeof u.distinctId==="string"&&u.distinctId.trim()&&u.distinctId.length<=200?u.distinctId.trim():void 0;try{let c=await Wp("/api/v2/diagnostics/run",{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${XN({})}`},body:JSON.stringify({url:t,email:f,distinct_id:l})});if(!c.ok)return i.json({error:`run HTTP ${c.status}`},502);let E=await c.json(),$=E.blocked?{state:"blocked"}:E.status==="fresh"?{state:"fresh"}:E.mode==="sync"?{state:"sync"}:{state:"running",id:E.id??null};return i.json($)}catch{return i.json({error:"run failed"},502)}});CJ.get("/status",async(i)=>{let u=i.req.query("id");if(!u)return i.json({error:"id is required"},400);try{let t=await Wp(`/api/v2/diagnostics/status?id=${encodeURIComponent(u)}`,{headers:{Authorization:`Bearer ${XN({})}`}});if(!t.ok)return i.json({error:`status HTTP ${t.status}`},502);let l=(await t.json()).status??"unknown",c={done:Jj4.has(l),status:l};return i.json(c)}catch{return i.json({error:"status failed"},502)}});CJ.get("/link-token/:id",async(i)=>{let u=i.req.param("id");try{let t=await Wp(`/api/v2/public/link-tokens/${encodeURIComponent(u)}`,{headers:{Accept:"application/json"}});if(t.status===404)return i.json(null);if(!t.ok)return i.json({error:`link token HTTP ${t.status}`},502);return i.json(await t.json())}catch{return i.json({error:"link token resolve failed"},502)}});CJ.get("/suggest",async(i)=>{let u=(i.req.query("q")??"").trim().slice(0,64);if(u.length<2)return i.json({suggestions:[]});try{let t=await Wp(`/api/v2/public/suggest?q=${encodeURIComponent(u)}`,{headers:{Accept:"application/json"}});if(!t.ok)return i.json({suggestions:[]});let f=await t.json();return i.json({suggestions:Array.isArray(f.suggestions)?f.suggestions:[]})}catch{return i.json({suggestions:[]})}});Ztt=CJ});function Btt(i,u){if(u.startsWith("text/html")||u.startsWith("image/svg"))i.set("Content-Security-Policy","sandbox allow-scripts allow-modals allow-same-origin")}var Ftt,Xj4,Lj4,Utt;var Ptt=g(()=>{yf();Ch();DH();aW();Ftt=new Wu,Xj4=["range","if-none-match","if-modified-since"],Lj4=["content-type","content-length","content-range","accept-ranges","etag","last-modified"];Ftt.get("/:org/files/*",async(i)=>{let u=i.get("studioContext"),t=u.organization?.id;if(!u.auth?.user?.id){if(PR(i))return i.redirect(`/login?next=${encodeURIComponent(i.req.path)}`,302);throw new I0(401,{message:"Authentication required"})}if(!t)throw new I0(401,{message:"Organization context required"});let f=i.req.path.replace(/^.*\/files\//,"");if(!f)throw new I0(400,{message:"Missing file key"});let l=await Yo(f,u);if(!l)throw new I0(503,{message:"Object storage not configured"});if(l.startsWith("data:")&&bh()){let w=l.match(/^data:([^;]+);base64,(.+)$/s);if(!w)throw new I0(500,{message:"Invalid data URL from storage"});let[,d,h]=w,_=Buffer.from(h,"base64"),v=new Headers({"Content-Type":d,"Cache-Control":"private, max-age=86400"});return Btt(v,d),new Response(_,{status:200,headers:v})}let c=new Headers;for(let w of Xj4){let d=i.req.header(w);if(d)c.set(w,d)}let E=await fetch(l,{headers:c});if(E.status===403||E.status===404)throw new I0(404,{message:"File not found"});if(!E.ok&&E.status!==304&&E.status!==416)throw console.error(`[files] upstream storage error ${E.status} for key:`,f),new I0(502,{message:"Upstream storage error"});let $=new Headers;for(let w of Lj4){let d=E.headers.get(w);if(d)$.set(w,d)}return $.set("Cache-Control","private, max-age=86400"),Btt($,$.get("content-type")??""),new Response(E.body,{status:E.status,headers:$})});Utt=Ftt});function ktt(i){let u=i?.connectFn??zj4,t=null,f=null,l=!1,c=!1,E=!1,$=[];function w(){return t!==null&&!t.isClosed()&&!t.isDraining()&&!E}function d(){console.log(`[NatsProvider] fireReady: ${$.length} callbacks`);for(let v of $)try{v()}catch{}}function h(v){(async()=>{for await(let D of v.status())if(D.type==="disconnect")console.log("[NatsProvider] Disconnected"),E=!0;else if(D.type==="reconnect")console.log("[NatsProvider] Reconnected, re-firing ready callbacks"),E=!1,f=null,d()})().catch(()=>{})}async function _(v,D){let n=0;while(!c)try{t=await u({servers:v,timeout:Qj4,reconnect:!0,maxReconnectAttempts:-1,...D?{authenticator:D}:{}}),console.log(`[NatsProvider] Connected to ${t.getServer()} after ${n} attempt(s)`),f=null,E=!1,h(t),d();return}catch{n++;let O=c6(Yj4,Wj4,n-1,2,0.5);await O0(O)}}return{init(v,D){if(l)return;l=!0,c=!1;let n=D?.creds?Att.credsAuthenticator(new TextEncoder().encode(D.creds)):void 0;_(v,n).catch(()=>{})},isConnected(){return w()},getConnection(){return w()?t:null},getJetStream(){if(!w())return null;if(!f)f=xtt.jetstream(t);return f},onReady(v){if($.push(v),w())try{v()}catch{}},async drain(){if(c=!0,l=!1,f=null,E=!1,t){let v=t;t=null,await v.drain().catch(()=>{})}}}}function zj4(i){return Itt.connect(i)}var Att,Itt,xtt,Wj4=100,Yj4=3000,Qj4=3000;var Gtt=g(()=>{y4();Att=S(RO(),1),Itt=S(HHi(),1),xtt=S(O2(),1)});function qR(i){let u=i?.ttlMs??60000,t=i?.maxSize??1e4,f=i?.updateRecencyOnGet??!1,l=new Map;function c(){if(l.size<=t)return;let E=Date.now();for(let[$,w]of l)if(w.expiresAt<=E)l.delete($);while(l.size>t){let $=l.keys().next().value;if($===void 0)break;l.delete($)}}return{get(E){let $=l.get(E);if(!$)return;if($.expiresAt<=Date.now()){l.delete(E);return}if(f)l.delete(E),l.set(E,$);return $.value},set(E,$){l.delete(E),l.set(E,{value:$,expiresAt:Date.now()+u}),c()},delete(E){l.delete(E)},clear(){l.clear()},size(){return l.size}}}function Uvu(i,u){return`${i}.${u}`}class Pvu{cache;constructor(i){this.cache=qR({ttlMs:i?.ttlMs??Hj4,maxSize:i?.maxSize??Rj4})}async get(i,u){return this.cache.get(Uvu(i,u))??null}async set(i,u,t){this.cache.set(Uvu(i,u),t)}async invalidate(i,u){this.cache.delete(Uvu(i,u))}teardown(){this.cache.clear()}}var Hj4=600000,Rj4=5000;var Stt=()=>{};function XAi(i,u){return`${i}:${u}`}function Avu(i){let u=qR({ttlMs:i?.ttlMs??bj4,maxSize:i?.maxSize??Cj4}),t=i?.getConnection,f=crypto.randomUUID(),l=new TextEncoder,c=new TextDecoder,E=null;function $(w,d){let h=t?.();if(!h)return;try{h.publish(jtt,l.encode(JSON.stringify({organizationId:w,keyId:d,originId:f})))}catch(_){console.warn("[ProviderKeyCache] Publish failed (non-critical):",_)}}return{get(w,d){return u.get(XAi(w,d))},set(w,d,h){u.set(XAi(w,d),h)},invalidate(w,d){u.delete(XAi(w,d)),$(w,d)},start(){if(E)return;let w=t?.();if(!w)return;E=w.subscribe(jtt),(async()=>{for await(let d of E)try{let h=JSON.parse(c.decode(d.data));if(h.originId===f)continue;u.delete(XAi(h.organizationId,h.keyId))}catch{}})().catch(console.error)},teardown(){E?.unsubscribe(),E=null,u.clear()}}}var jtt="studio.ai-provider-keys.invalidate",bj4=30000,Cj4=5000;var Ktt=()=>{};class Ivu{options;sub=null;onCancel=null;encoder=new TextEncoder;originId=crypto.randomUUID();constructor(i){this.options=i}async start(i){if(i)this.onCancel=i;if(this.sub)return;if(!this.onCancel)return;let u=this.options.getConnection();if(!u)return;this.sub=u.subscribe("mesh.decopilot.cancel");let t=new TextDecoder;(async()=>{for await(let f of this.sub)try{let l=JSON.parse(t.decode(f.data));if(l.originId===this.originId)continue;this.onCancel?.(l.taskId)}catch{}})().catch(console.error)}broadcast(i){if(/[.*>\s]/.test(i)){console.warn("[NatsCancelBroadcast] Invalid threadId, skipping broadcast");return}this.onCancel?.(i);try{let u=this.options.getConnection();if(!u)return;u.publish("mesh.decopilot.cancel",this.encoder.encode(JSON.stringify({taskId:i,originId:this.originId})))}catch(u){console.warn("[NatsCancelBroadcast] Publish failed (non-critical):",u)}}publishControlFrame(i,u){}async stop(){this.sub?.unsubscribe(),this.sub=null,this.onCancel=null}}function aj4(){return{name:P8,subjects:[`${gRi}.>`],storage:H_.StorageType.File,max_age:Vj4,max_bytes:mj4,max_msgs_per_subject:ej4,discard:H_.DiscardPolicy.Old,retention:H_.RetentionPolicy.Limits,duplicate_window:rj4,num_replicas:1}}class Ltt{chunks=0;encodeMs=0;maxMs=0;bytes=0;windowStart=performance.now();constructor(){setInterval(()=>this.flush(),1e4).unref?.()}record(i,u){if(this.chunks++,this.encodeMs+=i,i>this.maxMs)this.maxMs=i;this.bytes+=u}flush(){let i=performance.now(),u=i-this.windowStart;if(this.chunks>0&&u>0)console.warn(JSON.stringify({msg:"stream-encode-trace",windowMs:Math.round(u),chunks:this.chunks,encodeMs:Math.round(this.encodeMs),pctOfLoop:+(this.encodeMs/u*100).toFixed(1),maxChunkMs:+this.maxMs.toFixed(2),mbEncoded:+(this.bytes/1048576).toFixed(2)}));this.chunks=0,this.encodeMs=0,this.maxMs=0,this.bytes=0,this.windowStart=i}}function Jtt(i){let u=Xtt.headers();for(let[t,f]of Object.entries(i))u.set(t,f);return u}function iK4(i,u){let t=0;return{publish(f,l,c,E){f.publish(l,c,E?{headers:E}:void 0).catch(($)=>{if(t++,qj4().add(1,{"org.id":u??"unknown"}),t===1||t%100===0)console.warn(`[Decopilot] JetStream publish failed for thread ${i} (${t} total):`,$)})},get errorCount(){return t}}}class xvu{options;js=null;jsm=null;constructor(i){this.options=i}async init(){let i=this.options.getConnection();if(!i){console.log("[Decopilot] StreamBuffer.init skipped: NATS not connected yet");return}let u=this.options.getJetStreamManager?await this.options.getJetStreamManager():await H_.jetstreamManager(i),t=aj4();try{await u.streams.info(P8),await u.streams.update(P8,t)}catch(f){if(f instanceof Error&&f.message.includes("stream not found"))await u.streams.add(t);else if(f instanceof Error&&/can ?not change.*storage|storage type/i.test(f.message))await u.streams.delete(P8),await u.streams.add(t);else throw f}this.js=this.options.getJetStream(),this.jsm=u,console.log(`[Decopilot] StreamBuffer.init ${this.js?"ready":"degraded (js=null)"}`)}pump(i,u,t,f){let l=this.js;if(!l)return console.warn(`[Decopilot] pump: JetStream client unavailable for thread ${u}; chunks NOT published to NATS`),Promise.resolve();let c=iK4(u,f),E=!1,$=()=>{if(E)return;E=!0;let d=aru(u);l.publish(d.subject,d.data).catch(()=>{})};t.addEventListener("abort",$,{once:!0});let w=(d)=>{let h=performance.now(),_=sL(d,{runId:u}),v=performance.now()-h;if(aM().record(v),oM().add(1,{"org.id":f??"unknown"}),pj4?.record(v,_.reduce((D,n)=>D+n.data.length,0)),_.length===0){console.warn(`[Decopilot] dropping oversized stream chunk for thread ${u}`);return}for(let D of _)c.publish(l,D.subject,D.data,D.headers?Jtt(D.headers):void 0)};return(async()=>{let d=i.getReader(),h=0,_=0,v;try{while(!0){let{done:D,value:n}=await d.read();if(D)break;if(w(n),_++,++h>=64)h=0,await new Promise((O)=>setImmediate(O))}}catch(D){v=D,console.warn(`[Decopilot] stream pump error for thread ${u}:`,D?.message??D)}finally{if(d.releaseLock(),$(),sj4)console.warn(JSON.stringify({msg:"decopilot-stream-diag",event:"pump-done",taskId:u,publishedChunks:_,publishErrors:c.errorCount}))}if(v!==void 0)throw v})()}async publishRawChunk(i,u,t){let f=this.js;if(!f)return!1;let l=performance.now(),c=sL(u,{runId:i,dedup:t});if(aM().record(performance.now()-l),oM().add(1),c.length===0)return console.warn(`[Decopilot] dropping oversized raw chunk for thread ${i} (> MAX_CHUNKED_BYTES)`),!0;for(let E of c)await f.publish(E.subject,E.data,{...E.headers?{headers:Jtt(E.headers)}:{},...E.msgId?{msgID:E.msgId}:{}});return!0}async publishDone(i,u,t){let f=this.js;if(!f)return!1;let l=I1i({runId:i,fenceToken:u,finalSeq:t});return await f.publish(l.subject,l.data,{msgID:l.msgId}),!0}async createTailStream(i,u,t){let f=this.js;if(!f)return console.warn(`[Decopilot] createTailStream: JetStream client unavailable for thread ${i}; no live tail`),null;let l=t?.deliverPolicy==="new"?H_.DeliverPolicy.New:H_.DeliverPolicy.All,c=t?.closeOnDone??!1,E=N2(i),$;try{$=await(await f.consumers.get(P8,{filter_subjects:E,deliver_policy:l})).consume()}catch(O){return console.warn("[Decopilot] JetStream tail unavailable (non-critical):",O?.message??O),null}let h=Dhi({messages:async function*(){try{for await(let O of $)yield{subject:O.subject,data:O.data,headers:O.headers}}finally{$.stop()}}(),onCancel:()=>$.stop()}).pipeThrough(x1i()).pipeThrough(k1i()).getReader(),_=!1,v=()=>{if(_)return;_=!0;try{h.releaseLock()}catch{}},D=!1,n=()=>{if(D)return;D=!0,$.stop(),h.cancel().catch(()=>{}),v()};return u?.addEventListener("abort",n,{once:!0}),new ReadableStream({async pull(O){for(;;){let{done:N,value:y}=await h.read();if(N){n(),O.close();return}let Z=y;if(Z.kind==="done"){if(c){n(),O.close();return}continue}O.enqueue(Z.chunk);return}},cancel(){n()}})}purge(i){if(!this.jsm)return;this.jsm.streams.purge(P8,{filter:N2(i)}).catch(()=>{})}teardown(){this.js=null,this.jsm=null}}var H_,Xtt,Mj4=(i)=>{let u;return()=>u??=i()},qj4,Vj4=86400000000000,rj4=120000000000,mj4=4294967296,ej4=500000,oj4,sj4,pj4;var Wtt=g(()=>{bfu();nhi();G1i();jl();ZRi();H_=S(O2(),1),Xtt=S(RO(),1),qj4=Mj4(()=>Bt.createCounter("decopilot.stream.publish_errors",{description:"Number of JetStream publish failures for decopilot stream chunks",unit:"{errors}"}));oj4=process.env.STREAM_ENCODE_TRACE==="1",sj4=process.env.DECOPILOT_STREAM_TRACE==="1";pj4=oj4?new Ltt:null});function Ytt(i){let u=i.createFetch??uK4,t=i.timeoutMs??2000;return async(f)=>{try{let l=i.getConnection();if(!l)return kvu;let c=Nh(f),$=await u(l,t)(`tunnel://${c}/api/links/status`,{method:"GET"});if(!$.ok)return kvu;let w=await $.json();return{online:!0,hostname:w.hostname,capabilities:w.capabilities??[],cliVersion:w.cliVersion}}catch{return kvu}}}var kvu,uK4=(i,u)=>w2({connection:i,firstFrameTimeoutMs:u});var Qtt=g(()=>{IM();HM();kvu={online:!1,capabilities:[]}});async function*tK4(i){if(!i.body){yield{headers:{status:i.status,headers:Object.fromEntries(i.headers.entries())}};return}let u=i.body.getReader(),t=!1;try{yield{headers:{status:i.status,headers:Object.fromEntries(i.headers.entries())}};while(!0){let{done:f,value:l}=await u.read();if(f){t=!0;return}yield{data:Buffer.from(l).toString("base64")}}}finally{try{if(!t)await u.cancel()}catch{}finally{u.releaseLock()}}}function ztt(i){let u=i.createFetch??((t)=>w2({connection:t,idleTimeoutMs:fK4}));return async function*(f,l,c){let E=i.getConnection();if(!E)throw Error("link_unavailable: NATS unavailable");let $=Nh(f),w=u(E),d={method:l.method,headers:l.headers,signal:c?.signal};if(l.body!=null)d.body=l.body;let h=await w(`tunnel://${$}${l.path}`,d);yield*tK4(h)}}var fK4=45000;var Htt=g(()=>{IM();HM()});function Rtt(i){let u=i.createFetch??((t)=>w2({connection:t,idleTimeoutMs:lK4}));return{async publish(t,f,l){let c=i.getConnection();if(!c)throw Error("link_unavailable: NATS unavailable");let E=Nh(t),w=await u(c)(`tunnel://${E}/api/links/work`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(f),signal:l?.signal});if(!w.ok){let d=await w.text().catch(()=>"");throw Error(`tunnel work publish failed (${w.status})${d?`: ${d}`:""}`)}await w.body?.cancel().catch(()=>{})}}}function btt(i){let u=i.createFetch??w2;return{async publishControlFrame(t,f,l){let c=i.getConnection();if(!c)throw Error("link_unavailable: NATS unavailable");let E=Nh(t),w=await u(c)(`tunnel://${E}/api/links/control`,{method:"POST",headers:{"content-type":"application/json"},body:vmu(f),signal:l?.signal});if(!w.ok){let d=await w.text().catch(()=>"");throw Error(`tunnel control publish failed (${w.status})${d?`: ${d}`:""}`)}await w.body?.cancel().catch(()=>{})}}}var lK4=45000;var Ctt=g(()=>{IM();ARi();HM()});function LAi(i,u,t,f){if(!f)return!1;return i.emit(u,Rh(t,f.status,{title:f.title??void 0,virtualMcpId:f.virtual_mcp_id??void 0,createdBy:f.created_by??void 0,triggerId:f.trigger_id??null,branch:f.branch??null,createdAt:f.created_at,updatedAt:f.updated_at})),!0}var Mtt=g(()=>{Rt()});class Gvu{storage;options;timer=null;constructor(i,u={}){this.storage=i;this.options=u}start(){if(this.timer)return;let i=this.options.intervalMs??300000;this.timer=setInterval(()=>{this.runOnce()},i)}async runOnce(){let i=this.options.staleAfterMs??3600000;try{let u=await this.storage.sweepAbandoned(i);if(u>0)console.log(`[async-research-sweeper] marked ${u} stale jobs as abandoned`);return u}catch(u){return console.error("[async-research-sweeper] sweep failed",u),0}}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}import{readdir as cK4,rm as WAi}from"fs/promises";import{join as YAi}from"path";async function QAi(i){let u=new Date;u.setUTCDate(u.getUTCDate()-EK4),u.setUTCHours(0,0,0,0);let t=0;try{let f=await MJ(i);for(let l of f)if(/^\d{4}$/.test(l))t+=await qtt(i,l,u);else if(!l.startsWith(".")){let c=YAi(i,l),E=await MJ(c);for(let w of E){if(!/^\d{4}$/.test(w))continue;t+=await qtt(c,w,u)}if((await MJ(c)).length===0)await WAi(c,{recursive:!0,force:!0})}}catch(f){console.warn("monitoring retention cleanup failed:",f)}return t}async function qtt(i,u,t){let f=0,l=YAi(i,u),c=await MJ(l);for(let $ of c){if(!/^\d{2}$/.test($))continue;let w=YAi(l,$),d=await MJ(w);for(let _ of d){if(!/^\d{2}$/.test(_))continue;let v=new Date(`${u}-${$}-${_}T00:00:00Z`);if(isNaN(v.getTime()))continue;if(v<t){let D=YAi(w,_);await WAi(D,{recursive:!0,force:!0}),f++}}if((await MJ(w)).length===0)await WAi(w,{recursive:!0,force:!0})}if((await MJ(l)).length===0)await WAi(l,{recursive:!0,force:!0});return f}async function MJ(i){try{return(await cK4(i)).filter((t)=>!t.startsWith("."))}catch{return[]}}var EK4=30;var Svu=()=>{};import{DBOS as jvu,SchedulerMode as $K4}from"@dbos-inc/dbos-sdk";async function dK4(){let i=[dh(),SL(),BD()],u=0;for(let t of i)try{u+=await QAi(t)}catch(f){console.error("[monitoring-retention] cleanup failed:",f)}return console.log(`[monitoring-retention] deleted ${u} day-dir(s) across ${i.length} signal dir(s)`),{deleted:u,dirs:i.length}}async function hK4(i,u){await jvu.runStep(()=>dK4(),{name:"monitoringRetention"})}function rtt(){if(Vtt)return;Vtt=!0;let i=jvu.registerWorkflow(hK4,{name:"monitoringRetentionWorkflow"});jvu.registerScheduled(i,{name:"monitoringRetentionWorkflow",crontab:wK4,mode:$K4.ExactlyOncePerIntervalWhenActive})}var wK4="23 4 * * *",Vtt=!1;var mtt=g(()=>{bw();Svu()});function ett(i){return async(u,t)=>{let f=await i.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.role","organization.id as orgId","organization.slug as orgSlug","organization.name as orgName"]).where("member.userId","=",t).where("member.organizationId","=",u).executeTakeFirst();if(!f)return console.warn(`[automationContextFactory] User ${t} not found in org ${u} \u2014 returning null`),null;let l=await fg.create();l.auth.user={id:t,role:f.role},l.organization={id:f.orgId,slug:f.orgSlug,name:f.orgName};let c=await d0u(i.db,u,f.role);return l.boundAuth=w0u({auth:l.authInstance,headers:new Headers,role:f.role,permissions:c,userId:t}),l.access=new Ey(t,void 0,l.boundAuth,f.role,"self"),adi(l,{id:f.orgId,slug:f.orgSlug}),l}}var att=g(()=>{$y();wa()});import{EventEmitter as _K4}from"events";var Kvu;var ott=g(()=>{aO();Kvu=new _K4;Kvu.on("request",(i)=>{vv(i)})});function stt(){return async(i,u)=>{let t=Date.now(),f=i.req.method,l=i.req.path;if(l==="/api/auth/get-session"||l.includes("favicon")){await u();return}let c="",E=!1;if(l.startsWith("/mcp")&&f==="POST"){E=!0;try{if(i.req.header("Content-Type")?.includes("application/json")){let v=await i.req.raw.clone().json();if(v.method==="tools/call"&&v.params?.name){let D=VR(v.params.name),n=v.params.arguments||{},O=Object.keys(n).map((y)=>VR(y)),N=O.length>0?O.slice(0,3).join(",")+(O.length>3?"\u2026":""):"";c=`${nl.tool}${D}${nl.dim}(${N})${nl.reset}`}else if(v.method)c=`${nl.dim}${VR(v.method)}${nl.reset}`}}catch{}}let $=VR(l);if(l.startsWith("/mcp/conn_")){let h=l.split("/")[2]??"";$=`/mcp/${nl.mcp}${VR(h.slice(0,12))}\u2026${nl.reset}`}else if(l==="/mcp")$=`${nl.mcp}/mcp${nl.reset}`;else if(l==="/mcp/registry")$=`${nl.mcp}/mcp/registry${nl.reset}`;let w=DK4(f),d=E?"\u25C0":"\u2190";if(!uci())console.log(`${nl.dim}${d}${nl.reset} ${w}${f}${nl.reset} ${$}${c?` ${c}`:""}`);try{await u()}finally{let h=Date.now()-t,_=i.res.status,v=vK4(_),D=h<1000?`${h}ms`:`${(h/1000).toFixed(1)}s`,n=E?"\u25B6":"\u2192";if(!uci())console.log(`${nl.dim}${n}${nl.reset} ${w}${f}${nl.reset} ${$}${c?` ${c}`:""} ${v}${_}${nl.reset} ${nl.duration}${D}${nl.reset}`);Kvu.emit("request",{method:f,path:VR(l),status:_,duration:h,timestamp:new Date})}}}var nl,vK4=(i)=>{if(i>=500)return nl.serverError;if(i>=400)return nl.clientError;if(i>=300)return nl.redirect;return nl.ok},DK4=(i)=>{return nl[i]||nl.reset},VR=(i)=>{return i.replace(/\r/g,"").replace(/\n/g,"").replace(/\x1b\[[0-9;]*m/g,"").replace(/[\x00-\x1f\x7f-\x9f]/g,"")};var ptt=g(()=>{aO();ott();nl={reset:"\x1B[0m",dim:"\x1B[2m",bold:"\x1B[1m",GET:"\x1B[36m",POST:"\x1B[33m",PUT:"\x1B[35m",DELETE:"\x1B[31m",ok:"\x1B[32m",redirect:"\x1B[36m",clientError:"\x1B[33m",serverError:"\x1B[31m",mcp:"\x1B[35m",tool:"\x1B[96m",duration:"\x1B[90m"}});import{createHmac as fft}from"crypto";import{mkdir as nK4,readdir as gK4,rm as ift,stat as lft}from"fs/promises";import{join as Xvu,relative as OK4}from"path";import{z as k0}from"zod";function Eft(i){let u=i.replace(/[^a-zA-Z0-9_-]/g,"_");return Xvu(NK4,u)}function $ft(i){return i.replace(/^\/+/,"").replace(/\.\./g,"")}function Jvu(i,u){let t=Eft(i),f=$ft(u);return Xvu(t,f)}function yK4(i,u,t,f){let l=yu().encryptionKey||"dev-secret",c=`${i}:${u}:${t}:${f}`;return fft("sha256",l).update(c).digest("hex")}function tft(i,u,t,f,l){let c=Math.floor(Date.now()/1000)+f,E=yK4(u,t,c,l),$=new URL(`/api/dev-assets/${u}/${$ft(t)}`,i);return $.searchParams.set("expires",c.toString()),$.searchParams.set("signature",E),$.searchParams.set("method",l),$.toString()}function wft(i,u,t){let f=`${i}:${u.getTime()}:${t}`;return`"${fft("md5","etag").update(f).digest("hex")}"`}async function dft(i,u,t,f,l){try{let c=await gK4(i,{withFileTypes:!0});for(let E of c){let $=Xvu(i,E.name),d=OK4(u,$).replace(/\\/g,"/");if(t&&!d.startsWith(t))continue;if(E.isDirectory())if(f){let h=d+"/";if(!t||h.startsWith(t)){if(!(t?d.slice(t.length):d).includes("/"))l.commonPrefixes.add(h)}}else await dft($,u,t,f,l);else if(E.isFile()){if(f&&t){let h=d.slice(t.length);if(h.includes(f)){let _=h.indexOf(f),v=t+h.slice(0,_+1);l.commonPrefixes.add(v);continue}}try{let h=await lft($);l.objects.push({key:d,size:h.size,lastModified:h.mtime.toISOString(),etag:wft($,h.mtime,h.size)})}catch{}}}}catch{}}function hft(i,u){let f=yi(i).id;return[{name:"LIST_OBJECTS",description:"List objects in the local assets directory with pagination support",inputSchema:k0.object({prefix:k0.string().optional(),maxKeys:k0.number().optional().default(1000),continuationToken:k0.string().optional(),delimiter:k0.string().optional()}),outputSchema:k0.object({objects:k0.array(k0.object({key:k0.string(),size:k0.number(),lastModified:k0.string(),etag:k0.string()})),nextContinuationToken:k0.string().optional(),isTruncated:k0.boolean(),commonPrefixes:k0.array(k0.string()).optional()}),handler:async(l)=>{let c=l,E=c.prefix||"",$=c.maxKeys??1000,w=c.delimiter,d=c.continuationToken,h=Eft(f);await nK4(h,{recursive:!0});let _={objects:[],commonPrefixes:new Set};await dft(h,h,E,w,_),_.objects.sort((N,y)=>N.key.localeCompare(y.key));let v=0;if(d){if(v=_.objects.findIndex((N)=>N.key>d),v===-1)v=_.objects.length}let D=_.objects.slice(v,v+$),n=v+$<_.objects.length,O=n?D[D.length-1]?.key:void 0;return{objects:D,isTruncated:n,nextContinuationToken:O,commonPrefixes:Array.from(_.commonPrefixes).sort()}}},{name:"GET_OBJECT_METADATA",description:"Get metadata for a file in the local assets directory",inputSchema:k0.object({key:k0.string()}),outputSchema:k0.object({contentType:k0.string().optional(),contentLength:k0.number(),lastModified:k0.string(),etag:k0.string(),metadata:k0.record(k0.string(),k0.string()).optional()}),handler:async(l)=>{let c=l,E=Jvu(f,c.key),$=await lft(E);return{contentType:Rhu(c.key),contentLength:$.size,lastModified:$.mtime.toISOString(),etag:wft(E,$.mtime,$.size)}}},{name:"GET_PRESIGNED_URL",description:"Generate a presigned URL for downloading a file from local storage",inputSchema:k0.object({key:k0.string(),expiresIn:k0.number().optional()}),outputSchema:k0.object({url:k0.string(),expiresIn:k0.number()}),handler:async(l)=>{let c=l,E=c.expiresIn??uft;return{url:tft(u,f,c.key,E,"GET"),expiresIn:E}}},{name:"PUT_PRESIGNED_URL",description:"Generate a presigned URL for uploading a file to local storage",inputSchema:k0.object({key:k0.string(),expiresIn:k0.number().optional(),contentType:k0.string().optional()}),outputSchema:k0.object({url:k0.string(),expiresIn:k0.number()}),handler:async(l)=>{let c=l,E=c.expiresIn??uft;return{url:tft(u,f,c.key,E,"PUT"),expiresIn:E}}},{name:"DELETE_OBJECT",description:"Delete a single file from local storage",inputSchema:k0.object({key:k0.string()}),outputSchema:k0.object({success:k0.boolean(),key:k0.string()}),handler:async(l)=>{let c=l,E=Jvu(f,c.key);try{return await ift(E),{success:!0,key:c.key}}catch{return{success:!1,key:c.key}}}},{name:"DELETE_OBJECTS",description:"Delete multiple files from local storage",inputSchema:k0.object({keys:k0.array(k0.string()).max(1000)}),outputSchema:k0.object({deleted:k0.array(k0.string()),errors:k0.array(k0.object({key:k0.string(),message:k0.string()}))}),handler:async(l)=>{let c=l,E=[],$=[];return await Promise.all(c.keys.map(async(w)=>{let d=Jvu(f,w);try{await ift(d),E.push(w)}catch(h){$.push({key:w,message:h instanceof Error?h.message:"Unknown error"})}})),{deleted:E,errors:$}}}]}async function Lvu(i,u,t){let f=hft(u,t),l=new bD({name:"dev-assets-mcp",version:"1.0.0"},{capabilities:{tools:{}},jsonSchemaValidator:Xl});for(let E of f){let $="shape"in E.inputSchema?E.inputSchema.shape:k0.object({}).shape,w=E.outputSchema&&"shape"in E.outputSchema?E.outputSchema.shape:k0.object({}).shape;l.registerTool(E.name,{description:E.description??"",inputSchema:$,outputSchema:w,annotations:E.annotations,_meta:E._meta},async(d)=>{try{let h=await E.handler(d);return{content:[{type:"text",text:JSON.stringify(h)}],structuredContent:h}}catch(h){return{content:[{type:"text",text:`Error: ${h.message}`}],isError:!0}}})}let c=new kd({enableJsonResponse:i.headers.get("Accept")?.includes("application/json")??!1});return await l.connect(c),y5(l,c,i,"mcp:dev-assets")}async function _ft(i,u,t,f){let c=hft(t,f).find((E)=>E.name===i);if(!c)return{content:[{type:"text",text:`Tool not found: ${i}`}],isError:!0};try{let E=await c.handler(u);return{content:[{type:"text",text:JSON.stringify(E)}]}}catch(E){return{content:[{type:"text",text:E instanceof Error?E.message:String(E)}],isError:!0}}}var NK4="./data/assets",uft=3600,cft,vft;var Dft=g(()=>{vt();Ro();yf();ZV();NH();i$();pPi();cft=new Wu;cft.all("/",async(i)=>{let u=i.get("studioContext"),t=new URL(i.req.url),f=`${t.protocol}//${t.host}`;return Lvu(i.req.raw,u,f)});vft=cft});var nft={};Xi(nft,{mountDevRoutes:()=>ZK4});function ZK4(i,u){i.all("/mcp/:connectionId{.*_dev-assets$}",u,async(f)=>{let l=f.get("studioContext"),c=new URL(f.req.url),E=`${c.protocol}//${c.host}`;return Lvu(f.req.raw,l,E)}),i.all("/mcp/:connectionId{.*_dev-assets$}/call-tool/:toolName",u,async(f)=>{let l=f.get("studioContext"),c=new URL(f.req.url),E=`${c.protocol}//${c.host}`,$=f.req.param("toolName");if(!$)return f.json({error:"Missing tool name"},400);let w=await f.req.json(),d=await _ft($,w,l,E);if(d.isError)return f.json(d.content,500);return f.json(d.content)}),i.use("/mcp/dev-assets",u),i.route("/mcp/dev-assets",vft);let t=new Wu;t.use("*",m3({mountPath:"/api/dev-assets"})),t.route("/",sPi({orgFromPath:!1})),i.route("/api/dev-assets",t)}var gft=g(()=>{yf();Xhu();pPi();Dft()});var Oft=g(()=>{j0u();K0u();Ry()});var zAi=g(()=>{Oft()});var yft={};Xi(yft,{streamAgent:()=>Nft,createDecopilotClient:()=>BK4});async function TK4(i){let{parseJsonEventStream:u,uiMessageChunkSchema:t}=await Promise.resolve().then(() => (Pf(),Qfu));return u({stream:i,schema:t}).pipeThrough(new TransformStream({transform(f,l){if(!f.success)throw f.error;l.enqueue(f.value)}}))}async function Nft(i,u,t,f,l){let{readUIMessageStream:c}=await Promise.resolve().then(() => (Pf(),Qfu)),E=t.value??t.id;if(!E)throw Error("Agent binding has no id or value \u2014 cannot resolve agent");let $=f.credentialId??t.credentialId,w=f.thinking??t.thinking,d=w?.id,h={messages:f.messages,...d?{models:{credentialId:$,thinking:w,...f.fast??t.fast?{fast:f.fast??t.fast}:{}}}:{},agent:{id:E},temperature:f.temperature??t.temperature,toolApprovalLevel:f.toolApprovalLevel??t.toolApprovalLevel,mode:f.mode??t.mode??"default",...f.memory?{memory:f.memory}:{},...f.thread_id?{thread_id:f.thread_id}:{}},_=await fetch(i,{method:"POST",headers:{"Content-Type":"application/json","x-mesh-token":u,Authorization:`Bearer ${u}`},body:JSON.stringify(h),signal:l?.signal});if(!_.ok){let D=await _.text().catch(()=>""),n=`HTTP ${_.status}`;try{let O=JSON.parse(D);if(O?.error)n=O.error}catch{if(D)n=D}throw Error(n)}if(!_.body)throw Error("Empty response body from decopilot stream");let v=await TK4(_.body);return c({stream:v})}function BK4(i){let{baseUrl:u,orgSlug:t,token:f}=i,l=`${u}/${t}/decopilot/runtime/stream`;return{stream(c,E){let $={__type:"@deco/agent",id:c.agent.id,credentialId:c.credentialId??"",thinking:c.thinking??{id:"",title:""},fast:c.fast,toolApprovalLevel:c.toolApprovalLevel,mode:c.mode,temperature:c.temperature};return Nft(l,f,$,c,E)}}}import{z as Sw}from"zod";function Zft(i){let u=i.properties;if(!u)return i;for(let t of Object.values(u)){let f=t.properties;if(!f?.__type?.const)continue;let l=f.__type.const,c=FK4.get(l);if(!c)continue;let E=c.map(($)=>({name:String($.name),...$.inputSchema&&{inputSchema:Sw.toJSONSchema($.inputSchema)},...$.outputSchema&&{outputSchema:Sw.toJSONSchema($.outputSchema)}}));f.__binding={const:E}}return i}var FK4,YRc,UK4=(i)=>{return typeof i==="object"&&i!==null&&i.__type==="@deco/agent"},Yvu=(i)=>{return typeof i==="object"&&i!==null&&typeof i.__type==="string"&&i.__type!=="@deco/agent"&&typeof i.value==="string"},HAi=(i,u,t)=>{let f=t?{"x-caller-app":t}:void 0;if(u.cookie)f??={},f.cookie=u.cookie;if(u.token)f??={},f["x-mesh-token"]=u.token;return{type:"HTTP",url:new URL(`/mcp/${i}`,u.meshUrl).href,token:u.token,headers:f}},PK4=(i,u,t)=>{let f=HAi(i,u,t);return new Proxy(Zz.forConnection(f),{get(l,c){if(c==="value")return i;if(c==="__type")return t;return l[c]}})},AK4=(i,u)=>{let t=u.organizationSlug;if(!t)throw Error("organizationSlug is required for agent bindings");let f=`${u.meshUrl}/api/${t}/decopilot/runtime/stream`;return{STREAM:async(l,c)=>{let{streamAgent:E}=await Promise.resolve().then(() => yft);return E(f,u.token,i,l,c)}}},Wvu=(i,u)=>{if(i===null||i===void 0)return i;if(Array.isArray(i))return i.map((t)=>Wvu(t,u));if(typeof i==="object"){if(UK4(i))return AK4(i,u);if(Yvu(i))return PK4(i.value,u,i.__type);let t={};for(let[f,l]of Object.entries(i))t[f]=Wvu(l,u);return t}return i},Tft=(i)=>{return Wvu(i.state,i)};var rR=g(()=>{zAi();FK4=new Map;YRc=Sw.object({id:Sw.string(),title:Sw.string(),capabilities:Sw.object({vision:Sw.boolean().optional(),text:Sw.boolean().optional(),tools:Sw.boolean().optional(),reasoning:Sw.boolean().optional()}).passthrough().optional(),provider:Sw.string().optional().nullable(),limits:Sw.object({contextWindow:Sw.number().optional(),maxOutputTokens:Sw.number().optional()}).passthrough().optional()})});var IK4,Bft=(i,u,t)=>{if(!u)return null;if(i===void 0||i==="*")return"*";if(typeof i==="string")return i===u?i:null;if(Array.isArray(i))return i.includes(u)?u:null;if(typeof i==="function")return i(u,t)??null;return null},xK4=(i,u,t)=>{let f=u.headers.get("Origin"),l=Bft(t.origin,f,u);if(l)i.set("Access-Control-Allow-Origin",l);if(t.credentials)i.set("Access-Control-Allow-Credentials","true");if(t.exposeHeaders?.length)i.set("Access-Control-Expose-Headers",t.exposeHeaders.join(", "))},Fft=(i,u)=>{let t=new Headers,f=i.headers.get("Origin"),l=Bft(u.origin,f,i);if(l)t.set("Access-Control-Allow-Origin",l);if(u.credentials)t.set("Access-Control-Allow-Credentials","true");let c=u.allowMethods??IK4;t.set("Access-Control-Allow-Methods",c.join(", "));let E=i.headers.get("Access-Control-Request-Headers");if(u.allowHeaders?.length)t.set("Access-Control-Allow-Headers",u.allowHeaders.join(", "));else if(E)t.set("Access-Control-Allow-Headers",E);if(u.maxAge!==void 0)t.set("Access-Control-Max-Age",u.maxAge.toString());return new Response(null,{status:204,headers:t})},Uft=(i,u,t)=>{let f=new Headers(i.headers);return xK4(f,u,t),new Response(i.body,{status:i.status,statusText:i.statusText,headers:f})};var Pft=g(()=>{IK4=["GET","HEAD","PUT","POST","DELETE","PATCH"]});function Aft(i=32){let t=new Uint8Array(i);return crypto.getRandomValues(t),Array.from(t,(f)=>"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"[f%62]).join("")}function kK4(i){try{let u=new URL(i);return u.protocol==="https:"||u.hostname==="localhost"||u.hostname.endsWith(".localhost")||u.hostname==="127.0.0.1"||!u.protocol.startsWith("http")}catch{return!1}}function Ift(i){return btoa(JSON.stringify(i)).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function xft(i){try{let u=i.replace(/-/g,"+").replace(/_/g,"/");return JSON.parse(atob(u))}catch{return null}}function kft(i){return{handleProtectedResourceMetadata:(d)=>{let h=H5(new URL(d.url)),_=`${h.origin}/mcp`;return Response.json({resource:_,authorization_servers:[h.origin],scopes_supported:["*"],bearer_methods_supported:["header"],resource_signing_alg_values_supported:["RS256","none"]})},handleAuthorizationServerMetadata:(d)=>{let _=H5(new URL(d.url)).origin;return Response.json({issuer:_,authorization_endpoint:`${_}/authorize`,token_endpoint:`${_}/token`,registration_endpoint:`${_}/register`,scopes_supported:["*"],response_types_supported:["code"],response_modes_supported:["query"],grant_types_supported:["authorization_code","refresh_token"],token_endpoint_auth_methods_supported:["none","client_secret_post"],code_challenge_methods_supported:["S256","plain"]})},handleAuthorize:(d)=>{let h=H5(new URL(d.url)),_=h.searchParams.get("redirect_uri"),v=h.searchParams.get("response_type"),D=h.searchParams.get("state"),n=h.searchParams.get("code_challenge"),O=h.searchParams.get("code_challenge_method");if(!_)return Response.json({error:"invalid_request",error_description:"redirect_uri required"},{status:400});if(v!=="code")return Response.json({error:"unsupported_response_type",error_description:"Only 'code' is supported"},{status:400});let N=H5(new URL(`${h.origin}/oauth/callback`)),y=N.toString(),T=Ift({redirectUri:_,clientState:D??void 0,codeChallenge:n??void 0,codeChallengeMethod:O??void 0,oauthCallbackUri:y});N.searchParams.set("state",T);let B=i.authorizationUrl(N.toString());return Response.redirect(B,302)},handleOAuthCallback:async(d)=>{let h=H5(new URL(d.url)),_=h.searchParams.get("code"),v=h.searchParams.get("state"),D=h.searchParams.get("error"),n=v?xft(v):null;if(D){let O=h.searchParams.get("error_description")??"Authorization failed";if(n?.redirectUri){let N=H5(new URL(n.redirectUri));if(N.searchParams.set("error",D),N.searchParams.set("error_description",O),n.clientState)N.searchParams.set("state",n.clientState);return Response.redirect(N.toString(),302)}return Response.json({error:D,error_description:O},{status:400})}if(!_||!n)return Response.json({error:"invalid_request",error_description:"Missing code or state"},{status:400});try{let O=n.oauthCallbackUri??H5(new URL(`${h.origin}/oauth/callback`)).toString(),N={code:_,redirect_uri:O},y=await i.exchangeCode(N),Z={accessToken:y.access_token,tokenType:y.token_type,refreshToken:y.refresh_token,expiresIn:y.expires_in,scope:y.scope,codeChallenge:n.codeChallenge,codeChallengeMethod:n.codeChallengeMethod},T=Ift(Z),B=H5(new URL(n.redirectUri));if(B.searchParams.set("code",T),n.clientState)B.searchParams.set("state",n.clientState);return Response.redirect(B.toString(),302)}catch(O){console.error("OAuth callback error:",O);let N=H5(new URL(n.redirectUri));if(N.searchParams.set("error","server_error"),N.searchParams.set("error_description","Failed to exchange authorization code"),n.clientState)N.searchParams.set("state",n.clientState);return Response.redirect(N.toString(),302)}},handleToken:async(d)=>{try{let h=d.headers.get("content-type")??"",_;if(h.includes("application/x-www-form-urlencoded")){let Z=await d.formData();_=Object.fromEntries(Z.entries())}else{let Z=await d.json();if(typeof Z!=="object"||Z===null||Array.isArray(Z))return Response.json({error:"invalid_request",error_description:"Request body must be a JSON object"},{status:400});_=Z}let{code:v,code_verifier:D,grant_type:n,refresh_token:O}=_;if(n==="refresh_token"){if(typeof O!=="string"||!O)return Response.json({error:"invalid_request",error_description:"refresh_token is required and must be a string"},{status:400});if(!i.refreshToken)return Response.json({error:"unsupported_grant_type",error_description:"refresh_token grant not supported"},{status:400});let Z;try{Z=await i.refreshToken(O)}catch(B){if(B instanceof Qvu)return Response.json({error:B.error,...B.errorDescription?{error_description:B.errorDescription}:{}},{status:400});throw B}let T={access_token:Z.access_token,token_type:Z.token_type};if(Z.refresh_token)T.refresh_token=Z.refresh_token;if(Z.expires_in!==void 0)T.expires_in=Z.expires_in;if(Z.scope)T.scope=Z.scope;return Response.json(T,{headers:{"Cache-Control":"no-store",Pragma:"no-cache"}})}if(n!=="authorization_code")return Response.json({error:"unsupported_grant_type",error_description:"Only authorization_code and refresh_token supported"},{status:400});if(typeof v!=="string"||!v)return Response.json({error:"invalid_request",error_description:"code is required and must be a string"},{status:400});let N=xft(v);if(!N||!N.accessToken)return Response.json({error:"invalid_grant",error_description:"Invalid or expired code"},{status:400});if(N.codeChallenge){if(typeof D!=="string"||!D)return Response.json({error:"invalid_grant",error_description:"code_verifier required and must be a string"},{status:400});let Z;if(N.codeChallengeMethod==="S256"){let B=new TextEncoder().encode(D),F=await crypto.subtle.digest("SHA-256",B);Z=btoa(String.fromCharCode(...new Uint8Array(F))).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}else Z=D;if(Z!==N.codeChallenge)return Response.json({error:"invalid_grant",error_description:"Invalid code_verifier"},{status:400})}let y={access_token:N.accessToken,token_type:N.tokenType};if(N.refreshToken)y.refresh_token=N.refreshToken;if(N.expiresIn!==void 0)y.expires_in=N.expiresIn;if(N.scope)y.scope=N.scope;return Response.json(y,{headers:{"Cache-Control":"no-store",Pragma:"no-cache"}})}catch(h){return console.error("Token exchange error:",h),Response.json({error:"server_error",error_description:"Failed to process token request"},{status:500})}},handleClientRegistration:async(d)=>{try{let h=await d.json();if(!h.redirect_uris||h.redirect_uris.length===0)return Response.json({error:"invalid_redirect_uri",error_description:"At least one redirect_uri is required"},{status:400});for(let O of h.redirect_uris)if(!kK4(O))return Response.json({error:"invalid_redirect_uri",error_description:`Invalid redirect URI: ${O}`},{status:400});let _=Aft(32),v=h.token_endpoint_auth_method!=="none"?Aft(32):void 0,D=Math.floor(Date.now()/1000),n={client_id:_,client_secret:v,client_name:h.client_name,redirect_uris:h.redirect_uris,grant_types:h.grant_types??["authorization_code"],response_types:h.response_types??["code"],token_endpoint_auth_method:h.token_endpoint_auth_method??"client_secret_post",scope:h.scope,client_id_issued_at:D,client_secret_expires_at:0};if(i.persistence)await i.persistence.saveClient(n);return new Response(JSON.stringify(n),{status:201,headers:{"Content-Type":"application/json","Cache-Control":"no-store",Pragma:"no-cache"}})}catch(h){return console.error("Client registration error:",h),Response.json({error:"invalid_client_metadata",error_description:"Invalid client registration request"},{status:400})}},createUnauthorizedResponse:(d)=>{let v=`Bearer resource_metadata="${`${H5(new URL(d.url)).origin}/.well-known/oauth-protected-resource`}", scope="*"`;return Response.json({jsonrpc:"2.0",error:{code:-32000,message:"Unauthorized: Authentication required"},id:null},{status:401,headers:{"WWW-Authenticate":v,"Access-Control-Expose-Headers":"WWW-Authenticate"}})},hasAuth:(d)=>d.headers.has("Authorization")}}var Qvu,H5=(i)=>{if(!(i.hostname==="localhost"||i.hostname.endsWith(".localhost")||i.hostname==="127.0.0.1"))i.protocol="https:";return i};var zvu=g(()=>{Qvu=class Qvu extends Error{error;errorDescription;constructor(i="invalid_grant",u){super(u??i);this.name="OAuthInvalidGrantError",this.error=i,this.errorDescription=u}}});import{AsyncLocalStorage as GK4}from"async_hooks";var Gft,Yp;var Hvu=g(()=>{Gft=new GK4,Yp={getStore:()=>{return Gft.getStore()},run:(i,u,...t)=>Gft.run(i,u,...t)}});var jft="SELF",bAi=(i)=>{return typeof i==="object"&&i!==null&&"handler"in i&&"events"in i&&typeof i.handler==="function"&&Array.isArray(i.events)},Kft=(i)=>{return typeof i==="object"&&i!==null&&"handler"in i&&"events"in i&&typeof i.handler==="function"&&Array.isArray(i.events)},Sft="::",Jft=(i)=>{let u=i.indexOf(Sft);if(u===-1)return null;let t=i.substring(0,u),f=i.substring(u+Sft.length);return[t,f]},SK4=(i)=>{if(!i.startsWith("cron/"))return null;let u=i.substring(5),t=u.indexOf("/");if(t===-1)return null;let f=u.substring(0,t),l=u.substring(t+1);return[f,l]},Xft=(i)=>{if(bAi(i))return[];return Object.keys(i)},jK4=(i,u)=>{if(bAi(i))return i.events;let t=i[u];if(!t)return[];if(Kft(t))return t.events;return Object.keys(t)},RAi=(i,u,t)=>{if(i===jft){if(!t)return console.warn("[Event] SELF binding used but no connectionId available"),null;return t}let f=u[i];if(!Yvu(f))return console.warn(`[Event] Binding "${i}" not found in state`),null;return f.value},KK4=(i,u,t)=>{let f=u;if(bAi(i)){let c=[];for(let E of i.events){let $=Jft(E);if(!$){console.warn(`[Event] Global handler event "${E}" must be prefixed with BINDING:: (e.g., "SELF::${E}" or "DATABASE::${E}")`);continue}let[w,d]=$,h=RAi(w,f,t);if(!h)continue;c.push({eventType:d,publisher:h})}return c}let l=[];for(let c of Xft(i)){let E=RAi(c,f,t);if(!E)continue;let $=jK4(i,c);for(let w of $)l.push({eventType:w,publisher:E})}return l},JK4=(i)=>{let u=new Map;for(let t of i){let f=t.source,l=u.get(f)||[];l.push(t),u.set(f,l)}return u},XK4=(i)=>{let u=new Map;for(let t of i){let f=t.type,l=u.get(f)||[];l.push(t),u.set(f,l)}return u},LK4=(i)=>{let u={},t={},f=!1,l=0,c=[];for(let E of i){if(E.results)Object.assign(t,E.results);if(E.success===!1){if(f=!0,E.error)c.push(E.error)}if(E.processedCount!==void 0)l+=E.processedCount}if(Object.keys(t).length>0)u.results=t;if(u.success=!f,c.length>0)u.error=c.join("; ");if(l>0)u.processedCount=l;return u},WK4=async(i,u,t,f,l)=>{let c=f;if(bAi(i)){let h=new Set;for(let v of i.events){let D=Jft(v);if(!D)continue;let[n,O]=D,N=RAi(n,c,l);if(!N)continue;h.add(`${N}:${O}`)}let _=u.filter((v)=>{let D=`${v.source}:${v.type}`;return h.has(D)});if(_.length===0)return{success:!0};try{return await i.handler({events:_},t)}catch(v){return{success:!1,error:v instanceof Error?v.message:String(v)}}}let E=new Map;for(let h of Xft(i)){let _=RAi(h,c,l);if(_)E.set(_,h)}let $=JK4(u),w=[];for(let[h,_]of $){let v=E.get(h);if(!v)continue;let D=i[v];if(!D)continue;if(Kft(D)){w.push((async()=>{try{return await D.handler({events:_},t)}catch(N){let y={};for(let Z of _)y[Z.id]={success:!1,error:N instanceof Error?N.message:String(N)};return{results:y}}})());continue}let n=D,O=XK4(_);for(let[N,y]of O){let Z=n[N];if(!Z)continue;w.push((async()=>{try{let T=await Z({events:y},t),B={};for(let F of y)B[F.id]=T;return{results:B}}catch(T){let B={};for(let F of y)B[F.id]={success:!1,error:T instanceof Error?T.message:String(T)};return{results:B}}})())}}let d=await Promise.all(w);if(d.length===0)return{success:!0};return LK4(d)},Lft;var Rvu=g(()=>{rR();Lft={subscriptions:KK4,execute:WK4,parseCron:SK4}});function YK4(i,u){let t=HAi("self",{meshUrl:i,token:u});return Zz.forConnection(t)}function QK4(i,u){switch(u.type){case"cron":return{automation_id:i,type:"cron",cron_expression:u.cron};case"event":return{automation_id:i,type:"event",connection_id:u.connectionId,event_type:u.eventType,params:u.params};case"webhook":return{automation_id:i,type:"webhook"}}}function Wft(i,u,t){return async(f)=>{if(!i)throw Error("createAgent: missing meshUrl in MESH_REQUEST_CONTEXT");let l=YK4(i,u),E=(await l.COLLECTION_VIRTUAL_MCP_LIST({where:{operator:"and",conditions:[{field:["title"],operator:"eq",value:f.name}]},limit:1})).items.find((h)=>h.title===f.name);if(E)return{id:E.id,automations:[],automationIds:[],alreadyExisted:!0};let $=f.tools&&f.tools.length>0?f.tools.map((h)=>({connection_id:h.connectionId,selected_tools:h.tools??null,selected_resources:null,selected_prompts:null})):t?[{connection_id:t,selected_tools:null,selected_resources:null,selected_prompts:null}]:[],{item:w}=await l.COLLECTION_VIRTUAL_MCP_CREATE({data:{title:f.name,description:f.description,metadata:f.instructions?{instructions:f.instructions}:void 0,connections:$}}),d=[];for(let h of f.automations??[]){let _=await l.AUTOMATION_CREATE({name:h.name,virtual_mcp_id:w.id,messages:h.messages,models:h.models,tools:h.tools,active:h.active??!0}),v=[];for(let D of h.triggers??[])try{let n=await l.AUTOMATION_TRIGGER_ADD(QK4(_.id,D));v.push({type:D.type,ok:!0,id:n.id,webhook:n.webhook??void 0})}catch(n){v.push({type:D.type,ok:!1,error:n instanceof Error?n.message:String(n)})}d.push({id:_.id,name:h.name,triggers:v})}return{id:w.id,automations:d,automationIds:d.map((h)=>h.id),alreadyExisted:!1}}}var bvu=g(()=>{rR();zAi()});import{z as jc}from"zod";function _n(i){return{...i,execute:(u)=>{let t=Qp(u.runtimeContext);return i.execute({...u,runtimeContext:t},t)}}}var Qp=(i)=>{let u=Yp.getStore();if(!u){if(i)return i;throw Error("Missing context, did you forget to call State.bind?")}return u},Yft=(i)=>{let u=i.runtimeContext.env.MESH_REQUEST_CONTEXT;return{connectionId:u?.connectionId,meshUrl:u?.meshUrl,token:u?.token}},zK4=({events:i,configuration:{state:u,scopes:t,onChange:f,onInstall:l}={}}={})=>{let c=u?Zft(jc.toJSONSchema(u)):{type:"object",properties:{}};return[...f||l||i?[_n({id:"ON_MCP_CONFIGURATION",description:"MCP Configuration On Change",inputSchema:jc.object({state:u??jc.unknown(),scopes:jc.array(jc.string()).describe("Array of scopes in format 'KEY::SCOPE' (e.g., 'GMAIL::GetCurrentUser')"),firstRun:jc.boolean().optional().describe("True on the first configuration save for this connection \u2014 fires onInstall."),vault:jc.object({baseUrl:jc.string(),org:jc.string(),subjectConnectionId:jc.string(),token:jc.string()}).optional()}),outputSchema:jc.object({}),execute:async(E)=>{let $=E.context.state,w=E.context.vault;if(await f?.(E.runtimeContext.env,{state:$,scopes:E.context.scopes,vault:w}),l&&E.context.firstRun){let{meshUrl:d,token:h,connectionId:_}=Yft(E);await l(E.runtimeContext.env,{createAgent:Wft(d,h,_),vault:w})}return Promise.resolve({})}})]:[],...i?.handlers?[_n({id:"ON_EVENTS",description:"Receive and process CloudEvents from the event bus. Returns per-event or batch results.",inputSchema:F3i,outputSchema:U3i,execute:async(E)=>{let $=E.runtimeContext.env,w=$.MESH_REQUEST_CONTEXT?.state,{connectionId:d}=Yft(E);return Lft.execute(i.handlers,E.context.events,$,w,d)}})]:[],_n({id:"MCP_CONFIGURATION",description:"MCP Configuration",inputSchema:jc.object({}),outputSchema:jc.object({stateSchema:jc.unknown(),scopes:jc.array(jc.string()).optional()}),execute:()=>{return Promise.resolve({stateSchema:c,scopes:[...t??[]]})}})]},Qft=(i)=>{let u=null,t=null,f=null,l=!1,c=()=>{if(!l)console.warn("[runtime] Passing factory functions to tools/prompts/resources is deprecated. Pass createTool()/createPrompt()/createResource() instances directly."),l=!0},E=(D)=>typeof D==="object"&&D!==null&&(("id"in D)||("name"in D)||("uri"in D));async function $(D,n){if(!D)return[];return(await Promise.all(D.flatMap(async(O)=>{if(E(O))return[O];c();let N=await O(n);if(Array.isArray(N))return N;return[N]}))).flat()}let w=async(D)=>{if(u)return u;if(t)return t;return t=(async()=>{try{let n;if(typeof i.tools==="function")c(),n=await i.tools(D);else n=await $(i.tools,D);n.push(...zK4({...i}));let O;if(typeof i.prompts==="function")c(),O=await i.prompts(D);else O=await $(i.prompts,D);let N;if(typeof i.resources==="function")c(),N=await i.resources(D);else N=await $(i.resources,D);let y={tools:n,prompts:O,resources:N};return u=y,y}catch(n){throw t=null,n}})(),t},d=(D,n)=>{for(let O of n.tools)D.registerTool(O.id,{_meta:O._meta,title:O.title,description:O.description,annotations:O.annotations,inputSchema:O.inputSchema&&"shape"in O.inputSchema?O.inputSchema:jc.object({}),outputSchema:O.outputSchema&&typeof O.outputSchema==="object"&&"shape"in O.outputSchema?O.outputSchema:void 0},async(N)=>{let y=Qp(),Z=await O.execute({context:N,runtimeContext:y},y);if(Z!=null&&typeof Z==="object"&&"content"in Z&&Array.isArray(Z.content)&&Z.content.every((T)=>T!=null&&typeof T==="object"&&("type"in T)&&typeof T.type==="string"))return Z;return{structuredContent:Z,content:[{type:"text",text:JSON.stringify(Z)}]}});for(let O of n.prompts)D.registerPrompt(O.name,{title:O.title,description:O.description,argsSchema:O.argsSchema?O.argsSchema:jc.object({}).shape},async(N)=>{let y=Qp();return await O.execute({args:N,runtimeContext:y},y)});for(let O of n.resources)D.resource(O.name,O.uri,{description:O.description,mimeType:O.mimeType},async(N)=>{let y=Qp(),Z=await O.read({uri:N,runtimeContext:y},y),T=Z._meta??void 0;if(Z.text!==void 0)return{contents:[{uri:Z.uri,mimeType:Z.mimeType,text:Z.text,...T!==void 0?{_meta:T}:{}}]};else if(Z.blob!==void 0)return{contents:[{uri:Z.uri,mimeType:Z.mimeType,blob:Z.blob,...T!==void 0?{_meta:T}:{}}]};return{contents:[{uri:Z.uri,mimeType:Z.mimeType,text:""}]}})},h=async(D)=>{await i.before?.(D);let{instructions:n,...O}=i.serverInfo??{},N=new bD({...O,name:O.name??"@deco/mcp-api",version:O.version??"1.0.0"},{capabilities:{tools:{},prompts:{},resources:{}},jsonSchemaValidator:Xl,...n&&{instructions:n}}),y=await w(D);d(N,y);let Z="tools/list",T=N.server._requestHandlers,B=T.get(Z);if(B)T.set(Z,async(F,A)=>{if(!f)f=await B(F,A);return f});return{server:N,...y}};return{fetch:async(D,n)=>{let{server:O}=await h(n),N=new kd;await O.connect(N);let y=()=>{try{N.close?.()}catch{}try{O.close?.()}catch{}};try{let Z=await N.handleRequest(D),T=Z.headers.get("content-type");if(!(T?.includes("text/event-stream")||T?.includes("application/json-rpc"))||!Z.body)return y(),Z;let{readable:F,writable:A}=new TransformStream;return Z.body.pipeTo(A).catch(()=>{}).finally(y),new Response(F,{status:Z.status,statusText:Z.statusText,headers:Z.headers})}catch(Z){throw y(),Z}},callTool:async({toolCallId:D,toolCallInput:n})=>{let O=Yp.getStore();if(!O)throw Error("Missing state, did you forget to call State.bind?");let N=O?.env,{tools:y}=await w(N),T=y.find((F)=>F.id===D)?.execute;if(!T)throw Error(`Tool ${D} not found or does not have an execute function`);let B=Qp();return T({context:n,runtimeContext:B},B)}}};var CAi=g(()=>{W0u();i$();ZV();NH();rR();Rvu();Hvu();bvu();Rvu();bvu()});import{decodeJwt as zft}from"jose";var HK4=({env:i,server:u,url:t})=>{i.SELF=new Proxy({},{get:(f,l)=>{if(l==="toJSON")return null;return async(c)=>{return await u.callTool({toolCallId:l,toolCallInput:c})}}}),i.IS_LOCAL=(t?.startsWith("http://localhost")||t?.startsWith("http://127.0.0.1"))??!1},Hft=(i)=>()=>{return{...i??{}}},RK4=({env:i,server:u,tokenOrContext:t,url:f,authToken:l})=>{let c=i,E=l?l.split(" ")[1]:void 0,$;if(typeof t==="string"){let w=zft(t),d=w.metadata??{};$={authorization:E,state:w.state??d.state??{},token:t,meshUrl:w.meshUrl??d.meshUrl,connectionId:w.connectionId??d.connectionId,organizationId:w.organizationId??d.organizationId,organizationName:w.organizationName??d.organizationName,organizationSlug:w.organizationSlug??d.organizationSlug,ensureAuthenticated:Hft(w.user??w.sub)}}else if(typeof t==="object"){$=t;let w=zft(t.token),d=w.metadata??{},h=w.appName;$.authorization??=E,$.callerApp=h,$.connectionId??=w.connectionId??d.connectionId,$.organizationId??=w.organizationId??d.organizationId,$.organizationName??=w.organizationName??d.organizationName,$.organizationSlug??=w.organizationSlug??d.organizationSlug,$.ensureAuthenticated=Hft(w.user??w.sub)}else $={state:{},authorization:E,token:void 0,meshUrl:void 0,connectionId:void 0,ensureAuthenticated:()=>{throw Error("Unauthorized")}};return c.MESH_REQUEST_CONTEXT=$,$.state=Tft($),HK4({env:c,server:u,url:f}),c},bK4,Rft=(i)=>{let u=Qft(i),t=i.cors??bK4,f=i.oauth,l=f?kft(f):null,c=async(E,$,w)=>{let d=new URL(E.url);if(l){if(d.pathname==="/.well-known/oauth-protected-resource"||d.pathname==="/mcp/.well-known/oauth-protected-resource")return l.handleProtectedResourceMetadata(E);if(d.pathname==="/.well-known/oauth-authorization-server")return l.handleAuthorizationServerMetadata(E);if(d.pathname==="/authorize")return l.handleAuthorize(E);if(d.pathname==="/oauth/callback")return l.handleOAuthCallback(E);if(d.pathname==="/token"&&E.method==="POST")return l.handleToken(E);if((d.pathname==="/register"||d.pathname==="/mcp/register")&&E.method==="POST")return l.handleClientRegistration(E)}if(d.pathname==="/mcp"){if(E.method==="GET")return new Response("Method not allowed",{status:405});if(l&&!l.hasAuth(E)){let h=E.clone();try{if((await h.json())?.method!=="tools/list")return l.createUnauthorizedResponse(E)}catch{return l.createUnauthorizedResponse(E)}}return u.fetch(E,$,w)}if(d.pathname.startsWith("/mcp/call-tool")){let h=d.pathname.split("/").pop();if(!h)return new Response("Not found",{status:404});let _=await E.json(),v=await u.callTool({toolCallId:h,toolCallInput:_});return new Response(JSON.stringify(v),{headers:{"Content-Type":"application/json"}})}return i.fetch?.(E,$,w)||new Response("Not found",{status:404})};return{fetch:async(E,$,w)=>{if(new URL(E.url).pathname==="/_healthcheck")return new Response("OK",{status:200});if(t!==!1&&E.method==="OPTIONS")return Fft(E,t??{});let d=RK4({authToken:E.headers.get("authorization")??null,env:{...process.env,...$},server:u,tokenOrContext:E.headers.get("x-mesh-token")??void 0,url:E.url}),h=await Yp.run({req:E,env:d,ctx:w},async()=>await c(E,d,w));if(t!==!1)return Uft(h,E,t??{});return h}}};var bft=g(()=>{rR();Pft();zvu();zvu();Hvu();CAi();CAi();rR();zAi();bK4={origin:(i)=>{if(i.includes("localhost")||i.includes("127.0.0.1"))return i;return i},credentials:!0,allowMethods:["GET","POST","PUT","DELETE","OPTIONS"],allowHeaders:["Content-Type","Authorization","mcp-protocol-version"]}});import{z as Cvu}from"zod";function qK4(i,u){let t=_n({id:"COLLECTION_REGISTRY_APP_LIST",description:"List public registry items",annotations:{readOnlyHint:!0,idempotentHint:!0},inputSchema:wR,outputSchema:dR,execute:async({context:$})=>{let w={limit:$.limit,offset:$.offset,cursor:$.cursor,tags:$.tags,categories:$.categories,where:$.where},d=`${u}:${JSON.stringify(w)}`,h=Cft.get(d);if(h)return h;let _=await i.listPublic(u,w);return Cft.set(d,_),_}}),f=_n({id:"COLLECTION_REGISTRY_APP_GET",description:"Get a public registry item by ID or name",annotations:{readOnlyHint:!0,idempotentHint:!0},inputSchema:j5,outputSchema:IJ,execute:async({context:$})=>{let w=$.id??$.name;if(!w)return{item:null};let d=await i.findByIdOrName(u,w);if(d&&d.is_public)return{item:d};return{item:null}}}),l=_n({id:"COLLECTION_REGISTRY_APP_VERSIONS",description:"Get available versions of a public registry item",annotations:{readOnlyHint:!0,idempotentHint:!0},inputSchema:j5,outputSchema:Cvu.object({versions:Cvu.array(IJ.shape.item)}),execute:async({context:$})=>{let w=$.id??$.name;if(!w)return{versions:[]};let d=await i.findByIdOrName(u,w);if(d&&d.is_public)return{versions:[d]};return{versions:[]}}}),c=_n({id:"COLLECTION_REGISTRY_APP_SEARCH",description:"Search public registry items returning minimal data (id, title, tags, categories, is_public). Use this instead of LIST when you need to find items efficiently without loading full details.",annotations:{readOnlyHint:!0,idempotentHint:!0},inputSchema:lPi,outputSchema:cPi,execute:async({context:$})=>{return await i.search(u,$,{publicOnly:!0})}}),E=_n({id:"COLLECTION_REGISTRY_APP_FILTERS",description:"Get available tags and categories for public registry items",annotations:{readOnlyHint:!0,idempotentHint:!0},inputSchema:Cvu.object({}),outputSchema:hR,execute:async()=>{return await i.getFilters(u,{publicOnly:!0})}});return[t,c,f,l,E]}function Mft(i){let u=i.db,t=new BQ(u);return async(f)=>{let l=f.req.param("orgSlug")??f.req.param("org");if(!l)return f.json({error:"Organization not found"},404);let c=await u.selectFrom("organization").select(["id","slug","name"]).where("slug","=",l).executeTakeFirst();if(!c)return f.json({error:"Organization not found"},404);let E=qK4(t,c.id),$=Rft({tools:E}),w=new URL(f.req.url),d=f.req.path.indexOf("/registry"),h=d>=0?f.req.path.slice(d+9):"",_=new URL(h||"/",w.origin);w.searchParams.forEach((n,O)=>{_.searchParams.set(O,n)});let v=new Request(_.toString(),{method:f.req.method,headers:f.req.raw.headers,body:f.req.method!=="GET"&&f.req.method!=="HEAD"?f.req.raw.body:void 0}),D={organizationId:c.id,db:u,MESH_REQUEST_CONTEXT:{},MESH_APP_DEPLOYMENT_ID:"public-registry",IS_LOCAL:!1};return await $.fetch(v,D,f)}}var CK4=3600000,MK4=500,Cft;var qft=g(()=>{bft();CAi();zsi();U1();Cft=qR({ttlMs:CK4,maxSize:MK4,updateRecencyOnGet:!0})});import{sql as VK4}from"kysely";import{randomUUID as Vft}from"crypto";import{z as rK4}from"zod";async function eK4(i){let u=new Date().toISOString(),t=Vft(),f=_4.SELF(i.organizationId),l="registry.publish_request.created",c={requestId:i.request.id,requestedId:i.request.requested_id,title:i.request.title,status:i.request.status,createdAt:i.request.created_at,requester:{name:i.request.requester_name,email:i.request.requester_email}};await i.db.insertInto("events").values({id:t,organization_id:i.organizationId,type:"registry.publish_request.created",source:f,specversion:"1.0",subject:i.request.id,time:u,datacontenttype:"application/json",dataschema:null,data:JSON.stringify(c),cron:null,status:"pending",attempts:0,last_error:null,next_retry_at:null,created_at:u,updated_at:u}).execute();let E=await i.db.selectFrom("event_subscriptions").select(["id"]).where("organization_id","=",i.organizationId).where("enabled","=",1).where("event_type","=","registry.publish_request.created").where(($)=>$.or([$("publisher","is",null),$("publisher","=",f)])).execute();if(E.length>0)await i.db.insertInto("event_deliveries").values(E.map(($)=>({id:Vft(),event_id:t,subscription_id:$.id,status:"pending",attempts:0,last_error:null,delivered_at:null,next_retry_at:null,created_at:u}))).execute();try{await VK4`SELECT pg_notify('mesh_events', ${t})`.execute(i.db)}catch{}}async function aK4(i,u){let f=(await i.selectFrom("organization").select(["id"]).where("id","=",u).execute())[0];if(f?.id)return f.id;return(await i.selectFrom("organization").select(["id"]).where("slug","=",u).execute())[0]?.id??null}async function oK4(i,u){let t=await i.selectFrom("virtual_mcp_plugin_configs").innerJoin("connections","connections.id","virtual_mcp_plugin_configs.virtual_mcp_id").select(["virtual_mcp_plugin_configs.settings as settings"]).where("connections.organization_id","=",u).where("virtual_mcp_plugin_configs.plugin_id","=",xJ).execute();for(let f of t){let l=f.settings,c=typeof l==="string"?(()=>{try{return JSON.parse(l)}catch{return{}}})():l??{};if(c.acceptPublishRequests===!0){let E=c.rateLimitWindow==="minute"?"minute":"hour",$=c.rateLimitMax,w=typeof $==="number"&&Number.isFinite($)&&$>=1?Math.floor($):mft;return{acceptPublishRequests:!0,requireApiToken:c.requireApiToken===!0,rateLimitEnabled:c.rateLimitEnabled===void 0?rft:c.rateLimitEnabled===!0,rateLimitWindow:E,rateLimitMax:w}}}return{acceptPublishRequests:!1,requireApiToken:!1,rateLimitEnabled:rft,rateLimitWindow:mK4,rateLimitMax:mft}}async function sK4(i,u,t){let f=t==="minute"?60000:3600000,l=new Date(Date.now()-f).toISOString(),c=await i.selectFrom("private_registry_publish_request").select((E)=>E.fn.countAll().as("count")).where("organization_id","=",u).where("created_at",">=",l).executeTakeFirst();return Number(c?.count??0)}async function pK4(i,u,t,f){let l=await i.selectFrom("private_registry_item").select(["id","title"]).where("organization_id","=",u).where((c)=>c.or([c("id","=",t),c("title","=",f)])).executeTakeFirst();return l?{id:String(l.id),title:String(l.title)}:null}function eft(i){let{db:u,db:t}=i,f=new FQ(t),l=new UQ(t);return async(c)=>{let E=c.req.param("orgRef")??c.req.param("org");if(!E)return c.json({error:"Organization not found"},404);let $=await aK4(u,E);if(!$)return c.json({error:"Organization not found"},404);let w=await oK4(u,$);if(!w.acceptPublishRequests)return c.json({error:"Publish requests are not enabled for this registry."},403);if(w.requireApiToken){let D=c.req.header("Authorization"),n=D?.startsWith("Bearer ")?D.slice(7).trim():null;if(!n)return c.json({error:"API key required. Use Authorization: Bearer <key>"},401);if(!await l.validate($,n))return c.json({error:"Invalid API key"},401)}if(w.rateLimitEnabled){if(await sK4(t,$,w.rateLimitWindow)>=w.rateLimitMax)return c.json({error:"Too many publish requests. Please try again later.",retryAfterSeconds:w.rateLimitWindow==="minute"?60:3600},429)}let d;try{d=await c.req.json()}catch{return c.json({error:"Invalid JSON body"},400)}let h=Er0.safeParse(d);if(!h.success)return c.json({error:"Invalid publish request payload",details:rK4.treeifyError(h.error)},400);let _=await pK4(t,$,h.data.data.id,h.data.data.title);if(_)return c.json({error:"A registry item with the same id or title already exists. Please use a different name/id.",conflict:_},409);let v=await f.createOrUpdate({organization_id:$,requested_id:h.data.data.id,title:h.data.data.title,description:h.data.data.description??null,_meta:h.data.data._meta,server:h.data.data.server,requester_name:h.data.requester?.name??null,requester_email:h.data.requester?.email??null});try{await eK4({db:u,organizationId:$,request:v})}catch(D){console.warn("[private-registry] failed to emit publish-request event:",D)}return mu.capture({distinctId:h.data.requester?.email??`org:${$}`,event:"registry_publish_request_submitted",groups:{organization:$},properties:{organization_id:$,request_id:v.id,requested_id:v.requested_id,title:h.data.data.title,requester_email:h.data.requester?.email??null}}),c.json({id:v.id,requested_id:v.requested_id,status:v.status},201)}}var rft=!0,mK4="hour",mft=100;var aft=g(()=>{H4();Rt();_R();Hsi();Rsi();U1()});var oft={};Xi(oft,{createPublishRequestHandler:()=>eft,createPublicMCPHandler:()=>Mft});var sft=g(()=>{qft();aft()});var Ecu={};Xi(Ecu,{watchHandler:()=>f4t,getProxyDispatch:()=>fJ4,createApp:()=>vJ4});import{readFileSync as iJ4}from"fs";import{PrometheusSerializer as uJ4}from"@opentelemetry/exporter-prometheus";import{DBOS as mR}from"@dbos-inc/dbos-sdk";import{oAuthDiscoveryMetadata as $J4,oAuthProtectedResourceMetadata as wJ4}from"better-auth/plugins";async function tJ4(i){let u=i.connect(),t;try{t=await Promise.race([u,i4t(pft)])}catch{return u.then((f)=>f.release(!0)).catch(()=>{}),!1}try{return await Promise.race([t.query("SELECT 1"),i4t(pft)]),t.release(),!0}catch{return t.release(!0),!1}}function i4t(i){return new Promise((u,t)=>setTimeout(()=>t(Error("pg health-check timeout")),i))}function fJ4(){if(!Mvu)throw Error("getProxyDispatch() called before createApp() or without NATS \u2014 proxy dispatch unavailable");return Mvu}async function lJ4(i,u){let{items:t}=await i.storage.connections.list(u,{where:{field:["connection_url"],operator:"like",value:`${F40}%`},limit:1}),f=t[0];if(!f?.configuration_state)return null;return f.configuration_state.project_locator}function cJ4(i){let u=new URLSearchParams;if(i){let[t,f]=i.split("/");if(t)u.set("workspace_hint",t);if(f)u.set("project_hint",f)}else u.set("auto_personal","true");return u.set("force_new","true"),u}async function vJ4(i={}){let u=i.database??Ft(),t=!1;Z1.stop().catch((H)=>{console.error("[SSEHub] Error stopping previous broadcast (HMR cleanup):",H)});let f,l,c=new Pvu,E,$,w,d,h,_=null;if(i.disableNats)E=Avu(),f={get:async()=>null,set:async()=>{},invalidate:async()=>{},teardown:()=>{}},l=new bo,$={start:async()=>{},broadcast:()=>{},publishControlFrame:()=>{},stop:async()=>{}},h=void 0,w={init:async()=>{},pump:(H)=>{return(async()=>{let ni=H.getReader();try{while(!0){let{done:Yi}=await ni.read();if(Yi)break}}catch{}finally{ni.releaseLock()}})()},publishRawChunk:async()=>!1,publishDone:async()=>!1,createTailStream:async()=>null,purge:()=>{},teardown:()=>{}};else{_=ktt();let H=yu().natsCredsPath,ni;if(H)try{ni=iJ4(H,"utf8")}catch(t0){console.error(`[app] failed to read NATS_CREDS at ${H}; connecting anonymously`,t0)}_.init(yu().natsUrls,ni?{creds:ni}:void 0);let Yi=rsi()?new Qai({getJetStream:()=>_.getJetStream()}):null;Yi?.init().catch(()=>{}),f=Yi;let uu=new t6u({getJetStream:()=>_.getJetStream()});uu.init().catch(()=>{}),l=uu,E=Avu({getConnection:()=>_.getConnection()}),$=new Ivu({getConnection:()=>_.getConnection()}),w=new xvu({getConnection:()=>_.getConnection(),getJetStream:()=>_.getJetStream()}),d=Ytt({getConnection:()=>_.getConnection()}),h=Rtt({getConnection:()=>_.getConnection()});let bi=btt({getConnection:()=>_.getConnection()}),Au=$;$={start:(t0)=>Au.start(t0),broadcast:(t0)=>Au.broadcast(t0),publishControlFrame:(t0,Af)=>{bi.publishControlFrame(t0,Af).catch((O4)=>{console.warn("[TunnelControl] publishControlFrame failed (non-critical):",O4)})},stop:()=>Au.stop()},Se0(_),_.onReady(()=>{Yi?.init().catch((t0)=>{console.error("[McpListCache] Deferred init failed:",t0)}),uu.init().catch((t0)=>{console.error("[ConnectionCircuitStore] Deferred init failed:",t0)}),E.start(),f50(()=>_.getConnection()),w.init().catch((t0)=>{console.warn("[Decopilot] StreamBuffer init failed (late-join disabled):",t0)})})}if(eR)await eR();zai(f),f6u(l);let D={storage:new SQ(u.db),sseHub:Z1},n=new sfu(D),O=new Lm(u.db),N=new Gvu(O);N.start(),$.start((H)=>{Lhi(H),n.execute({type:"CANCEL",taskId:H}).catch((ni)=>{console.error("[Decopilot] CancelBroadcast execute failed:",ni)})}).catch((H)=>{console.error("[Decopilot] CancelBroadcast start failed:",H)}),_?.onReady(()=>{$.start().catch((H)=>{console.error("[CancelBroadcast] Deferred start failed:",H)})}),w.init().catch((H)=>{console.warn("[Decopilot] StreamBuffer init failed, attach/late-join disabled:",H)}),eR=async()=>{await n.stopAll(),n.dispose(),N.dispose(),$.stop().catch(()=>{}),w.teardown(),f?.teardown(),c.teardown(),E.teardown(),l50(),l.teardown(),zai(null),f6u(null)};let y=new Wu;if(y.use("*",Wmi({enabled:(H)=>pW(H,"debug")==="1"})),y.use("*",qQi),y.use("/*",$l0({origin:(H)=>{if(H.includes("localhost")||H.includes("127.0.0.1"))return H;return H},credentials:!0,allowMethods:["GET","POST","PUT","DELETE","OPTIONS"],allowHeaders:["Content-Type","Authorization","mcp-protocol-version"],exposeHeaders:["WWW-Authenticate"]})),y.use("*",async(H,ni)=>{if(await ni(),H.req.path.includes("/files/"))return;if(H.req.path.includes("/fs/")&&H.req.path.endsWith("/read"))return;H.header("X-Frame-Options","DENY"),H.header("Content-Security-Policy","frame-ancestors 'none'")}),!yu().noTui)y.use("*",stt());y.use("*",async(H,ni)=>{if(await ni(),EM(H.req.path))return;if(H.res.status>=500){let uu=await H.res.clone().text();console.error(`[5xx Response] ${H.req.method} ${H.req.path} - ${H.res.status}:`,uu)}}),y.get(D6.HEALTH,(H)=>{if(t)return H.json({status:"shutting_down"},503);return H.json({status:"ok"})}),y.get(D6.HEALTH_LIVE,(H)=>{return H.json({status:"ok"})}),y.get(D6.HEALTH_READY,async(H)=>{if(t)return H.json({status:"shutting_down"},503);let ni={};if(ni.postgres={status:await tJ4(u.pool)?"up":"down"},_)ni.nats=_.isConnected()?{status:"up"}:{status:"down"};else ni.nats={status:"down"};let Yi=ni.postgres.status==="up",uu=Yi?200:503;return H.json({status:Yi?"ready":"not_ready",services:ni},uu)}),y.get(D6.METRICS,async(H)=>{try{let ni=await eQi.collect(),Yi=EJ4.serialize(ni.resourceMetrics);return H.text(Yi,200,{"Content-Type":"text/plain; version=0.0.4; charset=utf-8"})}catch(ni){return console.error("Failed to collect metrics:",ni),H.text("# Error collecting metrics",500)}}),y.get(`${D6.DBOS_QUEUE_DEPTH_PREFIX}:queueName`,async(H)=>{let ni=H.req.param("queueName");if(!dJ4.has(ni))return H.json({error:`Unknown queue: ${ni}`},404);let Yi=await mR.listQueuedWorkflows({queueName:ni,status:"ENQUEUED"});return H.json({queue_length:Yi.length})}),y.get(D6.HOSTED_RUN_PENDING,(H)=>{let{active:ni,pending:Yi,max:uu}=nF0();return H.json({pending:Yi,active:ni,max:uu})}),y.route("/api/config",$tt),y.route("/api/_reports",Ztt),y.route("/report",Dtt(i.clientDir)),y.route("/api/auth/custom",oe0),y.all("/api/auth/admin/*",ia0),y.all("/api/auth/*",async(H)=>{return await et.handler(H.req.raw)});let Z=Xg0();Z.use("/.well-known/oauth-protected-resource/mcp/:connectionId",jJ),Z.use("/mcp/:connectionId/.well-known/oauth-protected-resource",jJ),y.route("/",Z),y.get("/.well-known/oauth-protected-resource/api/:org/mcp/:connectionId",da),y.route("/",Qg0()),y.use("/oauth-proxy/:connectionId/*",jJ),y.all("/oauth-proxy/:connectionId/*",u4t);let T=async(H)=>{let Yi=await hJ4()(H.req.raw),uu=await Yi.json();return Response.json(uu,Yi)};y.use("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",jJ),y.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",T);let B=async(H)=>{let Yi=await _J4()(H.req.raw),uu=await Yi.json();return Response.json(uu,Yi)};y.get("/.well-known/oauth-authorization-server/*/:gateway?/:connectionId?",B);let F=Ge0({ttlMs:120000}),A=await Tg0({db:u.db,auth:et,encryption:{key:yu().encryptionKey},observability:{tracer:i2,meter:Bt},modelListCache:c,providerKeyCache:E,memberRoleCache:F,linkStatusProbe:d,publishLinkControlFrame:(H,ni)=>$.publishControlFrame(H,ni)});fg.set(A);let G=new eD(yu().encryptionKey);nsu({db:u.db,baseUrl:hh()});let I=hwi(u.db),k=new xm(u.db),q=ett({db:u.db});ocu({storage:I,studioContextFactory:q}),v4u({studioContextFactory:q,deps:{runRegistry:n,cancelBroadcast:$,streamBuffer:w,sseHub:Z1},prepareLinkWorkFn:Hs0,workPublisher:h}),$4u({dispatchRunFn:Qs0,studioContextFactory:q,deps:{runRegistry:n,cancelBroadcast:$,streamBuffer:w,sseHub:Z1}});let J=new SQ(u.db),W=new Wm(u.db);oB0({getJetStream:()=>_?.getJetStream()??null,getJetStreamManager:async()=>{let H=_?.getConnection();return H?await t4t.jetstreamManager(H):null},messageParts:J.messageParts(),resolveRun:async(H)=>{let ni=await u.db.selectFrom("threads").select(["organization_id","created_by","message_storage_version","status","run_fence_token","title"]).where("id","=",H).executeTakeFirst();return ni?{orgId:ni.organization_id,createdBy:ni.created_by,version:ni.message_storage_version??1,status:ni.status,runFenceToken:ni.run_fence_token,title:ni.title??null}:null},completeRunIfNotCompleted:async(H,ni)=>{let Yi=await J.completeRunIfNotCompleted(H,ni);if(LAi(Z1,ni,H,Yi),Yi)await l4u(W,H,ni);return Yi},markRunRequiresAction:async(H,ni)=>{let Yi=await J.requiresActionIfInProgress(H,ni);return LAi(Z1,ni,H,Yi),Yi},markRunFailed:async(H,ni,Yi,uu)=>{let bi=await J.markRunFailed(H,ni,Yi,uu);if(LAi(Z1,ni,H,bi),bi)await l4u(W,H,ni);return bi},clearSynthesizedError:async(H,ni)=>{await J.messageParts().replaceMessageParts(H,Zg(H,ni),[])},persistTitle:(H,ni,Yi)=>J.update(H,ni,{title:Yi}),onTitleUpdated:async({runId:H,orgId:ni,title:Yi})=>{let uu=await J.get(H,ni).catch(()=>null);Z1.emit(ni,Rh(H,uu?.status??"in_progress",{title:Yi,virtualMcpId:uu?.virtual_mcp_id??void 0,createdBy:uu?.created_by,triggerId:uu?.trigger_id,branch:uu?.branch??null,createdAt:uu?.created_at,updatedAt:uu?.updated_at}))},bumpProgress:async({runId:H,orgId:ni})=>{await J.bumpProgress(H,ni)},recordCompleted:async({runId:H,orgId:ni,distinctId:Yi,usage:uu})=>{mu.capture({distinctId:Yi,event:"chat_message_completed",groups:{organization:ni},properties:{organization_id:ni,thread_id:H,transport:"projector",input_tokens:uu.inputTokens,output_tokens:uu.outputTokens,total_tokens:uu.totalTokens}})},recordFailed:async({runId:H,orgId:ni,distinctId:Yi,reason:uu,kind:bi})=>{mu.capture({distinctId:Yi,event:"chat_message_failed",groups:{organization:ni},properties:{organization_id:ni,thread_id:H,transport:"projector",error_category:bi,error_message:uu}})},purgeRun:async(H)=>{w.purge(H)}}),UK0({studioContextFactory:q,systemDatabaseUrl:tzi(yu().databaseUrl,yu().databasePgSsl),streamBuffer:w}),rtt(),gsu();let r=async(H,ni,Yi)=>{let uu=await I.findById(H,ni);if(!uu)throw Error("Automation not found");return i6u({automationId:uu.id,organizationId:uu.organization_id,triggerId:null})},Y=new IR(I,({automation:H,trigger:ni,contextMessages:Yi,idempotencyKey:uu})=>Ho({automationId:H.id,organizationId:H.organization_id,triggerId:ni.id,contextMessages:Yi},{idempotencyKey:uu})),li=[dh(),SL(),BD()];for(let H of li)QAi(H).then(()=>{}).catch((ni)=>console.error("[monitoring] Retention cleanup failed:",ni));let di=()=>u.db.deleteFrom("apikey").where("expiresAt","<",new Date).execute().then(()=>{}).catch((H)=>console.error("[auth] Expired API key cleanup failed:",H));di(),setInterval(di,86400000).unref(),y.use("*",async(H,ni)=>{if(CQi(H.req.path))return ni();let Yi={measure:async(bi,Au)=>{_3(H,bi);try{return await Au()}finally{sw(H,bi)}}},uu=await fg.create(H.req.raw,{timings:Yi});uu.automationRunner=r,H.set("studioContext",uu);try{await ni()}finally{let bi=uu.pendingRevalidations;if(bi.length>0)Promise.race([Promise.allSettled(bi),O0(30000)]).catch((t0)=>console.error("[studio] revalidation cleanup error:",t0))}}),y.use("/api/:org/decopilot/*",KJ),y.use("/api/:org/v1/*",KJ),y.use("/api/:org/files/*",KJ),y.use("*",async(H,ni)=>{let Yi=H.req.path;if(Yi.startsWith("/api/org-sso/")||Yi.startsWith("/api/auth/")||Yi.startsWith("/api/tools/management")||Yi.startsWith("/oauth-proxy/")||Yi.startsWith(`${X3u}/`))return ni();let uu=H.get("studioContext");if(!uu?.organization?.id||!uu?.auth?.user?.id)return ni();if(!(await uu.storage.orgSsoConfig.getByOrgId(uu.organization.id))?.enforced)return ni();if(!await uu.storage.orgSsoSessions.isValid(uu.auth.user.id,uu.organization.id))return H.json({error:"SSO authentication required for this organization"},403);return ni()});let fi=new Wu;fi.use("*",m3({mountPath:"/api/org-sso"})),fi.route("/",ZPi()),y.route("/api/org-sso",fi),y.get("/api/tools/management",(H)=>{return H.json({tools:Qmi,grouped:ZN()})}),y.use("/mcp/*",async(H,ni)=>{_3(H,"mcp");try{return await ni()}finally{sw(H,"mcp")}});let p=async(H,ni)=>{let Yi=H.var.studioContext;if(!Yi.auth.user?.id&&!Yi.auth.apiKey?.id){let uu=new URL(H.req.url);return H.res=new Response(null,{status:401,headers:{"WWW-Authenticate":`Bearer realm="mcp",resource_metadata="${uu.origin}${uu.pathname}/.well-known/oauth-protected-resource"`}})}return await ni()};if(y.use("/mcp/:connectionId?",p),y.use("/mcp/gateway/:virtualMcpId?",p),y.use("/mcp/virtual-mcp/:virtualMcpId?",p),y.use("/mcp/self",p),bh()){let{mountDevRoutes:H}=(gft(),oAi(nft));H(y,p)}let o=new Wu;o.use("*",m3({mountPath:"/mcp"})),o.route("/",cBi()),y.route("/mcp",o);let Oi=new Wu;Oi.use("*",m3({mountPath:"/mcp/self"})),Oi.route("/",kAi()),y.route("/mcp/self",Oi);let wi=new Wu;wi.use("*",m3({mountPath:"/mcp"})),wi.route("/",wBi()),y.route("/mcp",wi),y.use("/api/:org/models/*",async(H,ni)=>{_3(H,"llm_models");try{return await ni()}finally{sw(H,"llm_models")}});let Si=Khu({cancelBroadcast:$,streamBuffer:w,runRegistry:n,linkStatusProbe:d});if(y.route("/api",Si),_!=null)Mvu=ztt({getConnection:()=>_?.getConnection()??null});y.route("/api",V0t()),y.get("/api/links/me",async(H)=>{try{let ni=H.req.header("authorization")??"",Yi=/^Bearer\s+(.+)$/i.exec(ni),uu=null;if(Yi){let Au=(Yi[1]??"").trim();uu=await C0t(Au,et.api)}else uu=H.get("studioContext")?.auth?.user?.id??null;if(!uu)return H.json({error:"unauthorized"},401);let bi=d?await d(uu):{online:!1,capabilities:[]};if(!bi.online)return H.json(null);return H.json({hostname:bi.hostname,cliVersion:bi.cliVersion})}catch(ni){return console.error("[links/me] presence probe failed; reporting offline:",ni instanceof Error?ni.message:String(ni)),H.json(null)}}),y.use("/api/:org/files/*",KJ),y.route("/api",Utt);let Ci=new Wu;Ci.use("*",m3({mountPath:"/api"})),Ci.route("/",GAi()),y.route("/api",Ci),y.route("/api",ltt);let Vi=new Wu;Vi.use("*",m3({mountPath:"/api"})),Vi.route("/",SAi({tokenStorage:k,automationEventDispatcher:Y})),y.route("/api",Vi);let ri=new Gm(u.db),vi=new Wu;vi.use("*",m3({mountPath:"/api"})),vi.route("/",ePi()),y.route("/api",vi),y.route("/api/deco-sites",wp0()),y.route("/api/deco-apps",s0t());let Ji=new Wu;Ji.use("*",m3({mountPath:"/api/deco-sites"})),Ji.route("/",oPi()),y.route("/api/deco-sites",Ji);let Pi=new Wu;Pi.use("*",m3({mountPath:"/api/vm-events"})),Pi.route("/",a0t()),y.route("/api/vm-events",Pi);let{createPublishRequestHandler:gi,createPublicMCPHandler:$i}=await Promise.resolve().then(() => (sft(),oft)),ci={db:u.db,vault:{encrypt:(H)=>G.encrypt(H),decrypt:(H)=>G.decrypt(H)}},Ki=gi(ci),m=$i(ci);y.use("/org/:orgRef/registry/publish-request",jJ),y.post("/org/:orgRef/registry/publish-request",Ki),y.use("/org/:orgSlug/registry/*",jJ),y.all("/org/:orgSlug/registry/*",m),y.post("/api/:org/registry/publish-request",Ki),y.all("/api/:org/registry/*",m),y.route(X3u,ua0());let ui=R0t({kvStorage:ri,runRegistry:n,streamBuffer:w,sseHub:Z1,cancelBroadcast:$,tokenStorage:k,automationEventDispatcher:Y,mountDevAssets:bh(),mcpAuth:p,oauthProxyHandler:u4t,watchHandler:f4t,betterAuthProtectedResourceHandler:T,getNatsConnection:()=>_?.getConnection()??null});return y.route("/api/:org",ui),y.notFound((H)=>{return H.json({error:"Not Found",path:H.req.path},404)}),y.onError(es0),Object.assign(y,{markShuttingDown:()=>{t=!0},shutdown:async()=>{if(console.log("[shutdown] Stopping workers..."),await Promise.allSettled([Z1.stop(),eR?Promise.resolve(eR()).finally(()=>{eR=null}):Promise.resolve()]),_)await _.drain().catch((H)=>console.error("[shutdown] NATS drain error:",H));console.log("[shutdown] Flushing telemetry..."),await od().catch((H)=>console.error("[shutdown] Telemetry flush error:",H)),console.log("[shutdown] Closing database..."),await f2(u).catch((H)=>console.error("[shutdown] Database close error:",H)),console.log("[shutdown] Cleanup complete.")},initDbos:async()=>{await mR.registerQueue(u3,{partitionQueue:!0,concurrency:mcu,minPollingIntervalMs:ecu}),await mR.registerQueue(Ih,{partitionQueue:!0,concurrency:_4u}),await mR.registerQueue(jD,{partitionQueue:!0,concurrency:E4u}),await mR.registerQueue(F2,{partitionQueue:!0,concurrency:FK0}),await Whu(I),await Promise.allSettled(["automations-gate","automations-global"].map((H)=>mR.deleteQueue(H))),await acu(u.pool),V$0().catch((H)=>{console.error("[studio-pack-backfill] failed:",H)}),Osu().catch((H)=>{console.error("[org-fs] public-sets boot sync kick failed:",H)})}})}var t4t,pft=5000,Mvu=null,eR=null,u4t=async(i)=>{let u=i.req.param("connectionId");if(!u)return i.json({error:"Missing connectionId"},400);let t=i.req.path.split("/").filter(Boolean),f=t[t.length-1],l=i.get("studioContext");if(!l)l=await fg.create(i.req.raw),i.set("studioContext",l);let c=i.req.param("org")?l.organization?.id:void 0,E=await l.storage.connections.findById(u,c);if(!E?.connection_url)return i.json({error:"Connection not found"},404);let $=await Dz(E.connection_url),w,d=new URL(E.connection_url);if($.ok)w=(await $.json()).authorization_servers?.[0];if(!w)w=d.origin;let h=await ha(w);if(!h.ok)return i.json({error:"Failed to get auth server metadata"},502);let _=await h.json(),v;if(f==="authorize")v=_.authorization_endpoint;else if(f==="token")v=_.token_endpoint;else if(f==="register")v=_.registration_endpoint;if(!v)return i.json({error:`Unknown OAuth endpoint: ${f}`},404);let D=new URL(v),n=new URL(i.req.url);if(D.search=n.search,f==="authorize"){let I=D.searchParams.get("redirect_uri");if(I){let k=yu().baseUrl??n.origin;try{let q=new URL(I),J=new URL(k);if(!(q.origin===J.origin||q.hostname==="localhost"))return i.json({error:"invalid_request",error_description:"redirect_uri is not allowed"},400)}catch{return i.json({error:"invalid_request",error_description:"redirect_uri is malformed"},400)}D.searchParams.set("redirect_uri",I)}if(D.searchParams.has("resource"))D.searchParams.set("resource",E.connection_url);if(U40(E.connection_url))try{let k=await lJ4(l,E.organization_id),q=cJ4(k);for(let[J,W]of q)D.searchParams.set(J,W)}catch(k){console.warn("[oauth-proxy] Failed to get smart OAuth params, proceeding without:",k)}return i.redirect(D.toString(),302)}let O={Accept:i.req.header("Accept")||"application/json"},N=i.req.header("Content-Type");if(N)O["Content-Type"]=N;let y=i.req.header("Authorization");if(y)O.Authorization=y;let Z,T=null,B=null;if(i.req.method!=="GET"&&i.req.method!=="HEAD")if(f==="token"&&N?.includes("application/x-www-form-urlencoded")){if(y?.toLowerCase().startsWith("basic "))try{let W=atob(y.slice(6).trim()),r=W.indexOf(":");if(r!==-1){let Y=decodeURIComponent(W.slice(0,r)),li=decodeURIComponent(W.slice(r+1));T=Y||null,B=li||null}}catch{}let I=await i.req.formData();if(I.has("resource"))I.set("resource",E.connection_url);let k=I.get("client_id"),q=I.get("client_secret");if(typeof k==="string"&&k)T=k;if(typeof q==="string"&&q)B=q;let J=new URLSearchParams;for(let[W,r]of I.entries())J.append(W,r.toString());Z=J.toString()}else if(f==="register"&&N?.toLowerCase().includes("application/json")){let I=await l.db.selectFrom("organization").select(["id","slug","name"]).where("id","=",E.organization_id).executeTakeFirst(),k=await i.req.text(),q={};try{q=k?JSON.parse(k):{}}catch{Z=k}let J=typeof q==="object"&&q!==null&&!Array.isArray(q);if(Z===void 0&&!J)Z=k;if(Z===void 0){let W=q,r=W.metadata&&typeof W.metadata==="object"?W.metadata:{};W.metadata={...r,organization_id:E.organization_id,...I?.slug?{organization_slug:I.slug}:{},...I?.name?{organization_name:I.name}:{}},Z=JSON.stringify(W),O["Content-Type"]="application/json"}}else Z=i.req.raw.body??void 0;let F=await fetch(D.toString(),{method:i.req.method,headers:O,body:Z,duplex:"half",redirect:"manual"}),A=new Headers,G=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];for(let[I,k]of F.headers.entries())if(!G.includes(I.toLowerCase()))A.set(I,k);if(f==="token"&&F.ok){let I=await F.text();try{let k=JSON.parse(I);if(typeof k.access_token==="string"&&k.access_token){let q=typeof k.expires_in==="number"?new Date(Date.now()+k.expires_in*1000):null,J=null;try{J=await nz(E.connection_url)??v}catch{J=v}let W={connectionId:u,accessToken:k.access_token,refreshToken:typeof k.refresh_token==="string"?k.refresh_token:null,scope:typeof k.scope==="string"?k.scope:null,expiresAt:q,clientId:T,clientSecret:B,tokenEndpoint:J};await new al(l.db,l.vault).upsert(W)}}catch(k){console.error("[oauth-proxy] failed to persist downstream token:",k)}return new Response(I,{status:F.status,statusText:F.statusText,headers:A})}return new Response(F.body,{status:F.status,statusText:F.statusText,headers:A})},f4t=async(i)=>{let u=i.var.studioContext;if(!(u.auth.user?.id??u.auth.apiKey?.userId))return i.json({error:"Unauthorized"},401);let f=u.organization?.id;if(!f)return i.json({error:"organization id missing"},400);let l=i.req.query("types"),c=l?l.split(",").map(($)=>$.trim()).filter(Boolean):null,E=crypto.randomUUID();return e3(i,async($)=>{if(await $.writeSSE({event:"connected",data:JSON.stringify({listenerId:E,organizationId:f,typePatterns:c,connectedAt:new Date().toISOString()})}),!Z1.add({id:E,organizationId:f,typePatterns:c?.length?c:null,push:(h)=>{$.writeSSE({id:h.id,event:h.type,data:JSON.stringify(h)}).catch(()=>{Z1.remove(f,E)})}})){await $.writeSSE({event:"error",data:JSON.stringify({error:"Too many connections",message:"SSE connection limit reached. Try again later."})});return}let d=setInterval(()=>{$.writeSSE({event:"keepalive",data:""}).catch(()=>{clearInterval(d)})},30000);await new Promise((h)=>{$.onAbort(()=>{clearInterval(d),Z1.remove(f,E),h()})})})},EJ4,dJ4,hJ4=()=>wJ4(et),_J4=()=>$J4(et);var $cu=g(()=>{y4();vt();Nsu();cE();aW();Rt();yf();dEi();wl0();Ymi();Z_();wa();I3u();lE();jl();H4();J3u();ta0();Q3u();rs0();Jhu();D_();odi();Xhu();as0();Lhu();b0t();r0t();o0t();Hhu();p0t();EBi();_a();ctt();dBi();_vu();wtt();ntt();Ttt();Ptt();hvu();dvu();vli();eV();Gtt();ud();kwi();jm();c6u();Stt();Ktt();Wtt();Qtt();Htt();Ctt();pfu();Mtt();Epi();Zpi();I8();_pi();mtt();t$i();Svu();bw();Yhu();zz();f4u();afu();t$i();khu();Ssi();jsi();att();iY();ptt();RJ();I3u();nH();Whi();t4t=S(O2(),1);EJ4=new uJ4,dJ4=new Set([u3,Ih,jD,F2])});var $4t={};Xi($4t,{resolveClientDir:()=>ZJ4,resolveAssetPathWithTraversalCheck:()=>E4t,isPathWithinDirectory:()=>c4t,createAssetHandler:()=>TJ4});import{resolve as zp,dirname as DJ4,join as nJ4,extname as gJ4,basename as OJ4,sep as l4t}from"path";function NJ4(i,u){if(i===u||OJ4(i)==="index.html")return{"Cache-Control":"no-cache"};if(i.includes(`${l4t}assets${l4t}`))return{"Cache-Control":"public, max-age=31536000, immutable"};return{}}function c4t(i,u){let t=zp(u),f=zp(i);return f===t||f.startsWith(t+"/")}function E4t({requestPath:i,clientDir:u}){let t=i.startsWith("/")?i.slice(1):i,f=zp(u,t);if(!c4t(f,u))return null;return f}function ZJ4(i,u="../client"){let t=new URL(i),f=DJ4(t.pathname);return zp(f,u)}function TJ4(i={}){let{env:u="production",clientDir:t=yJ4,isServerPath:f=()=>!1}=i;if(u==="development")return async function(c){return null};return async function(c){if(c.method!=="GET")return null;let E=new URL(c.url),$;try{$=decodeURIComponent(E.pathname)}catch{return null}if(f($))return null;let w=E4t({requestPath:$,clientDir:t});if(!w)return null;let d=nJ4(w,"index.html"),h=zp(t,"index.html"),_=c.headers.get("accept"),D=_?.includes("text/html")||_?.includes("*/*")&&["",".html"].includes(gJ4(w))?[d,h]:[];for(let n of[w,...D])try{let O=Bun.file(n);if(await O.exists())return new Response(O,{headers:NJ4(n,h)})}catch{}if($.includes("/assets/"))return new Response("Not Found",{status:404,headers:{"Cache-Control":"no-store"}});return null}}var yJ4="./dist/client";var w4t=()=>{};var d4t={};Xi(d4t,{tryUpgradePreviewWs:()=>xJ4,tryHandlePreviewHttp:()=>IJ4,previewWebSocketHandler:()=>kJ4,parsePreviewBaseDomain:()=>AJ4,isPreviewWsData:()=>MAi,extractHandleFromHost:()=>qvu});function UJ4(i){if(i.method!=="GET")return!1;return(i.headers.get("accept")??"").includes("text/html")}function PJ4(){return new Response(FJ4,{status:503,headers:{"content-type":"text/html; charset=utf-8","cache-control":"no-store","retry-after":"1","access-control-allow-origin":"*"}})}function AJ4(i){if(!i||i.trim()==="")return null;let u=i.includes("{handle}")?i.replace("{handle}","__handle__"):i,t;try{t=new URL(u)}catch{return null}let f=t.hostname;if(i.includes("{handle}")){let l=f.indexOf(".");if(l<=0||l===f.length-1)return null;return f.slice(l+1)}return f}function qvu(i,u){if(!i||!u)return null;let t=i.indexOf(":"),f=(t>=0?i.slice(0,t):i).toLowerCase(),c=`.${u.toLowerCase().replace(/^\.+|\.+$/g,"")}`;if(!f.endsWith(c))return null;let E=f.slice(0,f.length-c.length);if(!E||E.includes("."))return null;return E}async function IJ4(i,u){let t=qvu(i.headers.get("host"),u.baseDomain);if(!t)return null;let f=await u.getRunner();if(!f)return Rp(503,"preview proxy not configured");let l=await f.proxyPreviewRequest(t,i);if(l.headers.get(CK)&&UJ4(i))return PJ4();return l.headers.delete(CK),l}function Rp(i,u){return new Response(JSON.stringify({error:u}),{status:i,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function MAi(i){return typeof i==="object"&&i!==null&&i.kind==="preview"}async function xJ4(i,u,t){if((i.headers.get("upgrade")??"").toLowerCase()!=="websocket")return null;let f=qvu(i.headers.get("host"),t.baseDomain);if(!f)return null;let l=await t.getRunner();if(!l)return Rp(503,"preview proxy not configured");let c=await l.resolvePreviewUpstreamUrl(f);if(!c)return Rp(404,"sandbox not found");let E=new URL(i.url);if(E.pathname.startsWith("/_sandbox")||E.pathname.startsWith("/_decopilot_vm"))return Rp(404,"not found");let $=`${c.replace(/^http/,"ws")}${E.pathname}${E.search}`,w=i.headers.get("sec-websocket-protocol"),d=w?w.split(",").map((v)=>v.trim()).filter(Boolean):[],h={kind:"preview",upstreamUrl:$,upstreamProtocols:d,pending:[],upstream:null,closed:!1};if(!u.upgrade(i,{data:h}))return Rp(426,"upgrade failed");return}function Hp(i,u,t,f){if(u.closed)return;u.closed=!0;try{i.close(t,f)}catch{}try{u.upstream?.close()}catch{}}var BJ4=256,FJ4='<!DOCTYPE html><html><head><meta charset="utf-8"><title>Connecting\u2026</title><style>body{font-family:system-ui,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0;background:#fafafa;color:#555}div{text-align:center;max-width:420px;padding:24px}h3{margin:0 0 8px}p{margin:0;font-size:14px;color:#999;line-height:1.5}</style></head><body><div><h3>Connecting to sandbox\u2026</h3><p>Waiting for the sandbox to come online. This page refreshes automatically.</p></div><script>setTimeout(function(){window.location.reload()},1500)</script></body></html>',kJ4;var h4t=g(()=>{tcu();kJ4={open(i){let u=i.data;if(!MAi(u))return;let t;try{t=u.upstreamProtocols.length>0?new WebSocket(u.upstreamUrl,u.upstreamProtocols):new WebSocket(u.upstreamUrl)}catch(f){console.warn(`[preview-ws] failed to dial upstream ${u.upstreamUrl}: ${f instanceof Error?f.message:String(f)}`),Hp(i,u,1011,"upstream connect failed");return}t.binaryType="arraybuffer",u.upstream=t,t.addEventListener("open",()=>{while(u.pending.length>0){let f=u.pending.shift();if(f!==void 0)t.send(f)}}),t.addEventListener("message",(f)=>{if(u.closed)return;i.send(f.data)}),t.addEventListener("close",(f)=>{Hp(i,u,f.code||1000,f.reason||"")}),t.addEventListener("error",()=>{Hp(i,u,1011,"upstream error")})},message(i,u){let t=i.data;if(!MAi(t))return;let f=t.upstream;if(f&&f.readyState===WebSocket.OPEN){f.send(u);return}if(t.pending.length>=BJ4){Hp(i,t,1011,"preview ws backlog overflow");return}t.pending.push(u)},close(i){let u=i.data;if(!MAi(u))return;Hp(i,u,1000,"")}}});var v4t={};Xi(v4t,{bootstrapDevLinkSession:()=>YJ4});import{existsSync as GJ4}from"fs";import{chmod as SJ4,mkdir as jJ4,rename as KJ4,writeFile as JJ4}from"fs/promises";import{dirname as XJ4,join as _4t}from"path";function LJ4(i){return _4t(i,"dev-link")}function WJ4(i){let u=process.env.DEV_LINK_SESSION_PATH;if(u&&u.trim()!=="")return u;return _4t(LJ4(i),"session.json")}async function YJ4(i,u){let t=WJ4(i),f=Ft().db,l=Q3()?await Wo():await f.selectFrom("user").select(["id","email","name"]).orderBy("createdAt","desc").executeTakeFirst();if(!l?.id)return null;if(GJ4(t))try{let d=await Bun.file(t).json(),h=d.user?.sub,_=d.accessToken;if(h===l.id&&typeof _==="string"){if(await et.api.verifyApiKey({body:{key:_}}).then((D)=>D?.valid===!0).catch(()=>!1))return{path:t,userSub:h}}}catch{}let c=null;try{c=await et.api.createApiKey({body:{name:"dev-link (auto-minted by bun run dev)",userId:l.id,permissions:{"*":["*"]},expiresIn:2592000,rateLimitEnabled:!1}})}catch(w){return console.warn("[dev-link] failed to mint API key:",w instanceof Error?w.message:String(w)),null}if(!c?.key)return null;let E={target:u,clientId:"dev-link",user:{sub:l.id,...l.email?{email:l.email}:{},...l.name?{name:l.name}:{}},accessToken:c.key,createdAt:new Date().toISOString()};await jJ4(XJ4(t),{recursive:!0});let $=`${t}.tmp`;return await JJ4($,JSON.stringify(E,null,2),{mode:384}),await SJ4($,384),await KJ4($,t),{path:t,userSub:l.id}}var D4t=g(()=>{lE();Z_();qg()});var tX4={};import{existsSync as qJ4}from"fs";function y4t(i,u){if(!u)return i;let t=new URL(i);if(!t.searchParams.has("sslmode"))t.searchParams.set("sslmode","verify-full");return t.toString()}function mJ4(i){let u=new Headers(i.headers);for(let[t,f]of Object.entries(rJ4))u.set(t,f);return new Response(i.body,{status:i.status,statusText:i.statusText,headers:u})}async function uX4(i){let u;try{u=await QJ4.create({systemDatabaseUrl:y4t(jw.databaseUrl,jw.databasePgSsl),systemDatabaseSchemaName:"dbos"});let t=await u.listWorkflows({status:"PENDING",queueName:Ih,executorId:i,loadInput:!1,loadOutput:!1});if(t.length===0){console.log(`[shutdown] no in-flight thread-gate gates to hand off (executor ${i})`);return}let f=t.map((l)=>l.workflowID);await u.resumeWorkflows(f,{queueName:Ih}),console.log(`[shutdown] re-enqueued ${f.length} in-flight thread-gate gate(s) for re-adoption by a live executor (from ${i}):`,f)}catch(t){console.error("[shutdown] thread-gate handoff failed:",t)}finally{await u?.destroy().catch(()=>{})}}async function VAi(i){if(N4t)return;N4t=!0,console.log(`
 [shutdown] Received ${i}, shutting down gracefully...`);let u=Number(process.env.SHUTDOWN_GRACE_SECONDS??60)*1000,t=Math.max(u-5000,1e4),f=setTimeout(()=>{console.error(`[shutdown] Timed out after ${t}ms, forcing exit.`),process.exit(1)},t);f.unref?.();let l=0;try{iX4(),qAi.markShuttingDown();let c=fRu(jw.dispatchRole,t,process.env.SHUTDOWN_DRAIN_MS);await O0(c),await pJ4.stop(!0);let E=bp.executorID;await bp.shutdown(),await uX4(E),await qAi.shutdown()}catch(c){console.error("[shutdown] Error during shutdown:",c),l=1}clearTimeout(f),process.exit(l)}var jw,bp,QJ4,zJ4,HJ4,RJ4,bJ4,CJ4,Z4t,MJ4,n4t,T4t,VJ4,rJ4,eJ4,aJ4,oJ4,Vvu,rvu,sJ4,B4t,g4t,qAi,mvu,O4t,evu=5,avu=0,pJ4,iX4,N4t=!1;var F4t=g(async()=>{y4();rou();vt();Eli();jl();isu();jw=yu();XRu();({DBOS:bp,DBOSClient:QJ4}=await import("@dbos-inc/dbos-sdk"));zJ4=[u3,Ih,jD,F2],HJ4=jw.dispatchRole==="worker"?zJ4:jw.dispatchRole==="api"?[]:void 0;bp.setConfig(Vou({systemDatabaseUrl:y4t(jw.databaseUrl,jw.databasePgSsl),poolSize:Number(process.env.DBOS_POOL_SIZE??5),executorID:jw.podName,listenQueues:HJ4}));({createApp:RJ4}=await Promise.resolve().then(() => ($cu(),Ecu))),{isServerPath:bJ4}=await Promise.resolve().then(() => (vli(),NRu)),{createAssetHandler:CJ4,resolveClientDir:Z4t}=await Promise.resolve().then(() => (w4t(),$4t)),MJ4=jw.port,n4t=Z4t(import.meta.url,"../client"),T4t=qJ4(n4t)?n4t:Z4t(import.meta.url,"../dist/client"),VJ4=CJ4({clientDir:T4t,isServerPath:bJ4}),rJ4={"X-Frame-Options":"DENY","Content-Security-Policy":"frame-ancestors 'none'"};({parsePreviewBaseDomain:eJ4,tryHandlePreviewHttp:aJ4,tryUpgradePreviewWs:oJ4,previewWebSocketHandler:Vvu,isPreviewWsData:rvu}=await Promise.resolve().then(() => (h4t(),d4t))),{getOrInitSharedRunner:sJ4}=await Promise.resolve().then(() => (ko(),GS0)),B4t=eJ4(process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN),g4t={baseDomain:B4t??"",getRunner:sJ4},qAi=await RJ4({clientDir:T4t}),mvu=process.env.DBOS_CONDUCTOR_KEY?.trim(),O4t=process.env.DBOS_CONDUCTOR_URL?.trim();await bp.launch({...mvu?{conductorKey:mvu}:{},...mvu&&O4t?{conductorURL:O4t}:{}});console.log(`[dbos] application version: ${bp.applicationVersion}`);await Cl(async()=>{avu++;try{return await qAi.initDbos()}catch(i){let u=avu>=evu?"giving up":"retrying";throw console.warn(`[dbos] initDbos attempt ${avu}/${evu} failed, ${u}`,i),i}},{maxAttempts:evu,minTimeout:1000,maxTimeout:1e4,jitter:0.5});if(!jw.isCli){let{bannerLines:i}=await Promise.resolve().then(() => (uW(),pM));console.log("");for(let u of i())console.log(u)}pJ4=Bun.serve({idleTimeout:0,port:MJ4,hostname:"0.0.0.0",fetch:async(i,u)=>{if(B4t){let f=await oJ4(i,u,g4t);if(f===void 0)return;if(f)return f;let l=await aJ4(i,g4t);if(l)return l}let t=await VJ4(i);if(t)return mJ4(t);return qAi.fetch(i,{server:u})},websocket:{open(i){if(rvu(i.data))Vvu.open(i)},message(i,u){if(rvu(i.data))Vvu.message(i,u)},close(i){if(rvu(i.data))Vvu.close(i)}},development:!1}),iX4=pou();if(jw.localMode)Promise.resolve().then(() => (qg(),zTi)).then(async({seedLocalMode:i,markSeedComplete:u})=>{try{let t=await i();if(process.env.DEV_LINK_SESSION_PATH)try{let{bootstrapDevLinkSession:f}=await Promise.resolve().then(() => (D4t(),v4t)),l=jw.baseUrl??`http://localhost:${jw.port}`,c=await f(jw.dataDir,l);if(c)console.log(`[dev-link] session ready at ${c.path} (userSub=${c.userSub})`);else console.warn("[dev-link] no admin user yet \u2014 skipping session bootstrap. The auto-spawned link will refuse to start until an admin exists.")}catch(f){console.error("[dev-link] bootstrap failed:",f)}}catch(t){console.error("Failed to seed local mode:",t)}finally{u()}}).catch(async(i)=>{console.error("Failed to load local-mode module:",i);try{let{markSeedComplete:u}=await Promise.resolve().then(() => (qg(),zTi));u()}catch{}});process.on("SIGTERM",()=>VAi("SIGTERM"));process.on("SIGINT",()=>VAi("SIGINT"));process.on("SIGHUP",()=>VAi("SIGHUP"));process.on("unhandledRejection",(i)=>{console.error("[process] Unhandled rejection:",i)});process.on("uncaughtException",(i)=>{console.error("[process] Uncaught exception:",i),VAi("uncaughtException")})});var ovu={};Xi(ovu,{startServer:()=>lX4,interceptConsoleForTui:()=>fX4});function fX4(){let{log:i,warn:u,error:t}=console;function f(...l){let c=l.map((E)=>typeof E==="string"?E:Bun.inspect(E)).join(" ");for(let E of c.split(`
 `)){let $=nq(E).trim();if(!$)continue;vv({method:"",path:"",status:0,duration:0,timestamp:new Date,rawLine:$})}}return console.log=f,console.warn=f,console.error=f,ici(!0),()=>{console.log=i,console.warn=u,console.error=t,ici(!1)}}async function lX4(i){let u=await oO(Number(i.port)),{settings:t,services:f}=await p1i({port:String(u),home:i.home,localMode:i.localMode,skipMigrations:i.skipMigrations,noTui:i.noTui});for(let l of f)_v({name:l.name,status:"ready",port:l.port});vq(),await F4t().then(() => tX4),Dq(`http://localhost:${t.port}`)}var svu=g(()=>{YMi();aO();RMi()});import{parseArgs as cX4}from"util";import{homedir as Cp}from"os";import{join as rAi}from"path";function Mp(i){if(i.noTui)return!1;return i.isTty===!0}var{values:g4,positionals:aR}=cX4({args:process.argv.slice(2),options:{port:{type:"string",short:"p",default:process.env.PORT||"3000"},"vite-port":{type:"string",default:process.env.VITE_PORT||"4000"},home:{type:"string"},"base-url":{type:"string"},help:{type:"boolean",short:"h",default:!1},version:{type:"boolean",short:"v",default:!1},"skip-migrations":{type:"boolean",default:!1},"no-tui":{type:"boolean",default:!1},"no-local-mode":{type:"boolean",default:!1},"local-sandbox-provider":{type:"boolean",default:!1},hot:{type:"boolean",default:!1},prune:{type:"boolean",default:!1},target:{type:"string"},env:{type:"string",short:"e"},"dry-run":{type:"boolean",default:!1},batch:{type:"string"},limit:{type:"string"},org:{type:"string"}},allowPositionals:!0});if(g4.help)console.log(`
 Deco CMS \u2014 Open-source control plane for your AI agents