npm - decocms - Versions diffs - 4.76.83 → 4.76.85 - Mend

decocms 4.76.83 → 4.76.85

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (236) hide show

package/dist/server/server.js CHANGED Viewed

@@ -1202,7 +1202,7 @@ ${n56}`:""}
 `);let X=Z.pax;if(X)for(let Y in X)G+=sn0(" "+Y+"="+X[Y]+`
 `);return m6.from(G)};YJ6.decodePax=function(Z){let G={};while(Z.length){let X=0;while(X<Z.length&&Z[X]!==32)X++;let Y=parseInt(m6.toString(Z.subarray(0,X)),10);if(!Y)return G;let Q=m6.toString(Z.subarray(X+1,Y-1)),J=Q.indexOf("=");if(J===-1)return G;G[Q.slice(0,J)]=Q.slice(J+1),Z=Z.subarray(Y)}return G};YJ6.encode=function(Z){let G=m6.alloc(512),X=Z.name,Y="";if(Z.typeflag===5&&X[X.length-1]!=="/")X+="/";if(m6.byteLength(X)!==X.length)return null;while(m6.byteLength(X)>100){let Q=X.indexOf("/");if(Q===-1)return null;Y+=Y?"/"+X.slice(0,Q):X.slice(0,Q),X=X.slice(Q+1)}if(m6.byteLength(X)>100||m6.byteLength(Y)>155)return null;if(Z.linkname&&m6.byteLength(Z.linkname)>100)return null;if(m6.write(G,X),m6.write(G,hN(Z.mode&4095,6),100),m6.write(G,hN(Z.uid,6),108),m6.write(G,hN(Z.gid,6),116),GJ6(Z.size,G,124),m6.write(G,hN(Z.mtime.getTime()/1000|0,11),136),G[156]=48+$J6(Z.type),Z.linkname)m6.write(G,Z.linkname,157);if(m6.copy(MY$,G,257),m6.copy(p36,G,263),Z.uname)m6.write(G,Z.uname,265);if(Z.gname)m6.write(G,Z.gname,297);if(m6.write(G,hN(Z.devmajor||0,6),329),m6.write(G,hN(Z.devminor||0,6),337),Y)m6.write(G,Y,345);return m6.write(G,hN(SY$(G),6),148),G};YJ6.decode=function(Z,G,X){let Y=Z[156]===0?0:Z[156]-48,Q=lv(Z,0,100,G),J=gN(Z,100,8),W=gN(Z,108,8),K=gN(Z,116,8),U=gN(Z,124,12),w=gN(Z,136,12),F=e36(Y),H=Z[157]===0?null:lv(Z,157,100,G),N=lv(Z,265,32),B=lv(Z,297,32),D=gN(Z,329,8),E=gN(Z,337,8),L=SY$(Z);if(L===256)return null;if(L!==gN(Z,148,8))throw Error("Invalid tar header. Maybe the tar is corrupted or it needs to be gunzipped?");if(o36(Z)){if(Z[345])Q=lv(Z,345,155,G)+"/"+Q}else if(a36(Z));else if(!X)throw Error("Invalid tar header: unknown format.");if(Y===0&&Q&&Q[Q.length-1]==="/")Y=5;return{name:Q,mode:J,uid:W,gid:K,size:U,mtime:new Date(1000*w),type:F,linkname:H,uname:N,gname:B,devmajor:D,devminor:E,pax:null}};function o36($){return m6.equals(MY$,$.subarray(257,263))}function a36($){return m6.equals(t36,$.subarray(257,263))&&m6.equals(r36,$.subarray(263,265))}function s36($,Z,G){if(typeof $!=="number")return G;if($=~~$,$>=Z)return Z;if($>=0)return $;if($+=Z,$>=0)return $;return 0}function e36($){switch($){case 0:return"file";case 1:return"link";case 2:return"symlink";case 3:return"character-device";case 4:return"block-device";case 5:return"directory";case 6:return"fifo";case 7:return"contiguous-file";case 72:return"pax-header";case 55:return"pax-global-header";case 27:return"gnu-long-link-path";case 28:case 30:return"gnu-long-path"}return null}function $J6($){switch($){case"file":return 0;case"link":return 1;case"symlink":return 2;case"character-device":return 3;case"block-device":return 4;case"directory":return 5;case"fifo":return 6;case"contiguous-file":return 7;case"pax-header":return 72}return 0}function kY$($,Z,G,X){for(;G<X;G++)if($[G]===Z)return G;return X}function SY$($){let Z=256;for(let G=0;G<148;G++)Z+=$[G];for(let G=156;G<512;G++)Z+=$[G];return Z}function hN($,Z){if($=$.toString(8),$.length>Z)return"7777777777777777777".slice(0,Z)+" ";return"0000000000000000000".slice(0,Z-$.length)+$+" "}function ZJ6($,Z,G){Z[G]=128;for(let X=11;X>0;X--)Z[G+X]=$&255,$=Math.floor($/256)}function GJ6($,Z,G){if($.toString(8).length>11)ZJ6($,Z,G);else m6.write(Z,hN($,11),G)}function XJ6($){let Z;if($[0]===128)Z=!0;else if($[0]===255)Z=!1;else return null;let G=[],X;for(X=$.length-1;X>0;X--){let J=$[X];if(Z)G.push(J);else G.push(255-J)}let Y=0,Q=G.length;for(X=0;X<Q;X++)Y+=G[X]*Math.pow(256,X);return Z?Y:-1*Y}function gN($,Z,G){if($=$.subarray(Z,Z+G),Z=0,$[Z]&128)return XJ6($);else{while(Z<$.length&&$[Z]===32)Z++;let X=s36(kY$($,32,Z,$.length),$.length,$.length);while(Z<X&&$[Z]===0)Z++;if(X===Z)return 0;return parseInt(m6.toString($.subarray(Z,X)),8)}}function lv($,Z,G,X){return m6.toString($.subarray(Z,kY$($,0,Z,Z+G)),X)}function sn0($){let Z=m6.byteLength($),G=Math.floor(Math.log(Z)/Math.log(10))+1;if(Z+G>=Math.pow(10,G))G++;return Z+G+$}});var yY$=_((vR9,vY$)=>{var{Writable:wJ6,Readable:FJ6,getStreamError:VY$}=an0(),HJ6=in0(),CY$=dv(),mv=en0(),NJ6=CY$.alloc(0);class _Y${constructor(){this.buffered=0,this.shifted=0,this.queue=new HJ6,this._offset=0}push($){this.buffered+=$.byteLength,this.queue.push($)}shiftFirst($){return this._buffered===0?null:this._next($)}shift($){if($>this.buffered)return null;if($===0)return NJ6;let Z=this._next($);if($===Z.byteLength)return Z;let G=[Z];while(($-=Z.byteLength)>0)Z=this._next($),G.push(Z);return CY$.concat(G)}_next($){let Z=this.queue.peek(),G=Z.byteLength-this._offset;if($>=G){let X=this._offset?Z.subarray(this._offset,Z.byteLength):Z;return this.queue.shift(),this._offset=0,this.buffered-=G,this.shifted+=G,X}return this.buffered-=$,this.shifted+=$,Z.subarray(this._offset,this._offset+=$)}}class bY$ extends FJ6{constructor($,Z,G){super();this.header=Z,this.offset=G,this._parent=$}_read($){if(this.header.size===0)this.push(null);if(this._parent._stream===this)this._parent._update();$(null)}_predestroy(){this._parent.destroy(VY$(this))}_detach(){if(this._parent._stream===this)this._parent._stream=null,this._parent._missing=xY$(this.header.size),this._parent._update()}_destroy($){this._detach(),$(null)}}class fY$ extends wJ6{constructor($){super($);if(!$)$={};this._buffer=new _Y$,this._offset=0,this._header=null,this._stream=null,this._missing=0,this._longHeader=!1,this._callback=$p0,this._locked=!1,this._finished=!1,this._pax=null,this._paxGlobal=null,this._gnuLongPath=null,this._gnuLongLinkPath=null,this._filenameEncoding=$.filenameEncoding||"utf-8",this._allowUnknownFormat=!!$.allowUnknownFormat,this._unlockBound=this._unlock.bind(this)}_unlock($){if(this._locked=!1,$){this.destroy($),this._continueWrite($);return}this._update()}_consumeHeader(){if(this._locked)return!1;this._offset=this._buffer.shifted;try{this._header=mv.decode(this._buffer.shift(512),this._filenameEncoding,this._allowUnknownFormat)}catch($){return this._continueWrite($),!1}if(!this._header)return!0;switch(this._header.type){case"gnu-long-path":case"gnu-long-link-path":case"pax-global-header":case"pax-header":return this._longHeader=!0,this._missing=this._header.size,!0}if(this._locked=!0,this._applyLongHeaders(),this._header.size===0||this._header.type==="directory")return this.emit("entry",this._header,this._createStream(),this._unlockBound),!0;return this._stream=this._createStream(),this._missing=this._header.size,this.emit("entry",this._header,this._stream,this._unlockBound),!0}_applyLongHeaders(){if(this._gnuLongPath)this._header.name=this._gnuLongPath,this._gnuLongPath=null;if(this._gnuLongLinkPath)this._header.linkname=this._gnuLongLinkPath,this._gnuLongLinkPath=null;if(this._pax){if(this._pax.path)this._header.name=this._pax.path;if(this._pax.linkpath)this._header.linkname=this._pax.linkpath;if(this._pax.size)this._header.size=parseInt(this._pax.size,10);this._header.pax=this._pax,this._pax=null}}_decodeLongHeader($){switch(this._header.type){case"gnu-long-path":this._gnuLongPath=mv.decodeLongPath($,this._filenameEncoding);break;case"gnu-long-link-path":this._gnuLongLinkPath=mv.decodeLongPath($,this._filenameEncoding);break;case"pax-global-header":this._paxGlobal=mv.decodePax($);break;case"pax-header":this._pax=this._paxGlobal===null?mv.decodePax($):Object.assign({},this._paxGlobal,mv.decodePax($));break}}_consumeLongHeader(){this._longHeader=!1,this._missing=xY$(this._header.size);let $=this._buffer.shift(this._header.size);try{this._decodeLongHeader($)}catch(Z){return this._continueWrite(Z),!1}return!0}_consumeStream(){let $=this._buffer.shiftFirst(this._missing);if($===null)return!1;this._missing-=$.byteLength;let Z=this._stream.push($);if(this._missing===0){if(this._stream.push(null),Z)this._stream._detach();return Z&&this._locked===!1}return Z}_createStream(){return new bY$(this,this._header,this._offset)}_update(){while(this._buffer.buffered>0&&!this.destroying){if(this._missing>0){if(this._stream!==null){if(this._consumeStream()===!1)return;continue}if(this._longHeader===!0){if(this._missing>this._buffer.buffered)break;if(this._consumeLongHeader()===!1)return!1;continue}let $=this._buffer.shiftFirst(this._missing);if($!==null)this._missing-=$.byteLength;continue}if(this._buffer.buffered<512)break;if(this._stream!==null||this._consumeHeader()===!1)return}this._continueWrite(null)}_continueWrite($){let Z=this._callback;this._callback=$p0,Z($)}_write($,Z){this._callback=Z,this._buffer.push($),this._update()}_final($){this._finished=this._missing===0&&this._buffer.buffered===0,$(this._finished?null:Error("Unexpected end of data"))}_predestroy(){this._continueWrite(null)}_destroy($){if(this._stream)this._stream.destroy(VY$(this));$(null)}[Symbol.asyncIterator](){let $=null,Z=null,G=null,X=null,Y=null,Q=this;return this.on("entry",K),this.on("error",(F)=>{$=F}),this.on("close",U),{[Symbol.asyncIterator](){return this},next(){return new Promise(W)},return(){return w(null)},throw(F){return w(F)}};function J(F){if(!Y)return;let H=Y;Y=null,H(F)}function W(F,H){if($)return H($);if(X){F({value:X,done:!1}),X=null;return}if(Z=F,G=H,J(null),Q._finished&&Z)Z({value:void 0,done:!0}),Z=G=null}function K(F,H,N){if(Y=N,H.on("error",$p0),Z)Z({value:H,done:!1}),Z=G=null;else X=H}function U(){if(J($),!Z)return;if($)G($);else Z({value:void 0,done:!0});Z=G=null}function w(F){return Q.destroy(F),J(F),new Promise((H,N)=>{if(Q.destroyed)return H({value:void 0,done:!0});Q.once("close",function(){if(F)N(F);else H({value:void 0,done:!0})})})}}}vY$.exports=function(Z){return new fY$(Z)};function $p0(){}function xY$($){return $&=511,$&&512-$}});var hY$=_((yR9,Zp0)=>{var gY$={S_IFMT:61440,S_IFDIR:16384,S_IFCHR:8192,S_IFBLK:24576,S_IFIFO:4096,S_IFLNK:40960};try{Zp0.exports=c0("fs").constants||gY$}catch{Zp0.exports=gY$}});var nY$=_((gR9,iY$)=>{var{Readable:BJ6,Writable:OJ6,getStreamError:cY$}=an0(),OV=dv(),iv=hY$(),XN0=en0(),uY$=OV.alloc(1024);class dY$ extends OJ6{constructor($,Z,G){super({mapWritable:EJ6,eagerOpen:!0});if(this.written=0,this.header=Z,this._callback=G,this._linkname=null,this._isLinkname=Z.type==="symlink"&&!Z.linkname,this._isVoid=Z.type!=="file"&&Z.type!=="contiguous-file",this._finished=!1,this._pack=$,this._openCallback=null,this._pack._stream===null)this._pack._stream=this;else this._pack._pending.push(this)}_open($){if(this._openCallback=$,this._pack._stream===this)this._continueOpen()}_continuePack($){if(this._callback===null)return;let Z=this._callback;this._callback=null,Z($)}_continueOpen(){if(this._pack._stream===null)this._pack._stream=this;let $=this._openCallback;if(this._openCallback=null,$===null)return;if(this._pack.destroying)return $(Error("pack stream destroyed"));if(this._pack._finalized)return $(Error("pack stream is already finalized"));if(this._pack._stream=this,!this._isLinkname)this._pack._encode(this.header);if(this._isVoid)this._finish(),this._continuePack(null);$(null)}_write($,Z){if(this._isLinkname)return this._linkname=this._linkname?OV.concat([this._linkname,$]):$,Z(null);if(this._isVoid){if($.byteLength>0)return Z(Error("No body allowed for this entry"));return Z()}if(this.written+=$.byteLength,this._pack.push($))return Z();this._pack._drain=Z}_finish(){if(this._finished)return;if(this._finished=!0,this._isLinkname)this.header.linkname=this._linkname?OV.toString(this._linkname,"utf-8"):"",this._pack._encode(this.header);mY$(this._pack,this.header.size),this._pack._done(this)}_final($){if(this.written!==this.header.size)return $(Error("Size mismatch"));this._finish(),$(null)}_getError(){return cY$(this)||Error("tar entry destroyed")}_predestroy(){this._pack.destroy(this._getError())}_destroy($){this._pack._done(this),this._continuePack(this._finished?null:this._getError()),$()}}class lY$ extends BJ6{constructor($){super($);this._drain=Gp0,this._finalized=!1,this._finalizing=!1,this._pending=[],this._stream=null}entry($,Z,G){if(this._finalized||this.destroying)throw Error("already finalized or destroyed");if(typeof Z==="function")G=Z,Z=null;if(!G)G=Gp0;if(!$.size||$.type==="symlink")$.size=0;if(!$.type)$.type=DJ6($.mode);if(!$.mode)$.mode=$.type==="directory"?493:420;if(!$.uid)$.uid=0;if(!$.gid)$.gid=0;if(!$.mtime)$.mtime=new Date;if(typeof Z==="string")Z=OV.from(Z);let X=new dY$(this,$,G);if(OV.isBuffer(Z))return $.size=Z.byteLength,X.write(Z),X.end(),X;if(X._isVoid)return X;return X}finalize(){if(this._stream||this._pending.length>0){this._finalizing=!0;return}if(this._finalized)return;this._finalized=!0,this.push(uY$),this.push(null)}_done($){if($!==this._stream)return;if(this._stream=null,this._finalizing)this.finalize();if(this._pending.length)this._pending.shift()._continueOpen()}_encode($){if(!$.pax){let Z=XN0.encode($);if(Z){this.push(Z);return}}this._encodePax($)}_encodePax($){let Z=XN0.encodePax({name:$.name,linkname:$.linkname,pax:$.pax}),G={name:"PaxHeader",mode:$.mode,uid:$.uid,gid:$.gid,size:Z.byteLength,mtime:$.mtime,type:"pax-header",linkname:$.linkname&&"PaxHeader",uname:$.uname,gname:$.gname,devmajor:$.devmajor,devminor:$.devminor};this.push(XN0.encode(G)),this.push(Z),mY$(this,Z.byteLength),G.size=$.size,G.type=$.type,this.push(XN0.encode(G))}_doDrain(){let $=this._drain;this._drain=Gp0,$()}_predestroy(){let $=cY$(this);if(this._stream)this._stream.destroy($);while(this._pending.length){let Z=this._pending.shift();Z.destroy($),Z._continueOpen()}this._doDrain()}_read($){this._doDrain(),$()}}iY$.exports=function(Z){return new lY$(Z)};function DJ6($){switch($&iv.S_IFMT){case iv.S_IFBLK:return"block-device";case iv.S_IFCHR:return"character-device";case iv.S_IFDIR:return"directory";case iv.S_IFIFO:return"fifo";case iv.S_IFLNK:return"symlink"}return"file"}function Gp0(){}function mY$($,Z){if(Z&=511,Z)$.push(uY$.subarray(0,512-Z))}function EJ6($){return OV.isBuffer($)?$:OV.from($)}});var pY$=_((LJ6)=>{LJ6.extract=yY$();LJ6.pack=nY$()});var oY$=_((cR9,rY$)=>{rY$.exports=tY$;function tY$($,Z){if($&&Z)return tY$($)(Z);if(typeof $!=="function")throw TypeError("need wrapper function");return Object.keys($).forEach(function(X){G[X]=$[X]}),G;function G(){var X=Array(arguments.length);for(var Y=0;Y<X.length;Y++)X[Y]=arguments[Y];var Q=$.apply(this,X),J=X[X.length-1];if(typeof Q==="function"&&Q!==J)Object.keys(J).forEach(function(W){Q[W]=J[W]});return Q}}});var Yp0=_((uR9,Xp0)=>{var aY$=oY$();Xp0.exports=aY$(YN0);Xp0.exports.strict=aY$(sY$);YN0.proto=YN0(function(){Object.defineProperty(Function.prototype,"once",{value:function(){return YN0(this)},configurable:!0}),Object.defineProperty(Function.prototype,"onceStrict",{value:function(){return sY$(this)},configurable:!0})});function YN0($){var Z=function(){if(Z.called)return Z.value;return Z.called=!0,Z.value=$.apply(this,arguments)};return Z.called=!1,Z}function sY$($){var Z=function(){if(Z.called)throw Error(Z.onceError);return Z.called=!0,Z.value=$.apply(this,arguments)},G=$.name||"Function wrapped with `once`";return Z.onceError=G+" shouldn't be called more than once",Z.called=!1,Z}});var ZQ$=_((dR9,$Q$)=>{var PJ6=Yp0(),AJ6=function(){},TJ6=global.Bare?queueMicrotask:process.nextTick.bind(process),IJ6=function($){return $.setHeader&&typeof $.abort==="function"},RJ6=function($){return $.stdio&&Array.isArray($.stdio)&&$.stdio.length===3},eY$=function($,Z,G){if(typeof Z==="function")return eY$($,null,Z);if(!Z)Z={};G=PJ6(G||AJ6);var{_writableState:X,_readableState:Y}=$,Q=Z.readable||Z.readable!==!1&&$.readable,J=Z.writable||Z.writable!==!1&&$.writable,W=!1,K=function(){if(!$.writable)U()},U=function(){if(J=!1,!Q)G.call($)},w=function(){if(Q=!1,!J)G.call($)},F=function(E){G.call($,E?Error("exited with error code: "+E):null)},H=function(E){G.call($,E)},N=function(){TJ6(B)},B=function(){if(W)return;if(Q&&!(Y&&(Y.ended&&!Y.destroyed)))return G.call($,Error("premature close"));if(J&&!(X&&(X.ended&&!X.destroyed)))return G.call($,Error("premature close"))},D=function(){$.req.on("finish",U)};if(IJ6($))if($.on("complete",U),$.on("abort",N),$.req)D();else $.on("request",D);else if(J&&!X)$.on("end",K),$.on("close",K);if(RJ6($))$.on("exit",F);if($.on("end",w),$.on("finish",U),Z.error!==!1)$.on("error",H);return $.on("close",N),function(){if(W=!0,$.removeListener("complete",U),$.removeListener("abort",N),$.removeListener("request",D),$.req)$.req.removeListener("finish",U);$.removeListener("end",K),$.removeListener("close",K),$.removeListener("finish",U),$.removeListener("exit",F),$.removeListener("end",w),$.removeListener("error",H),$.removeListener("close",N)}};$Q$.exports=eY$});var YQ$=_((lR9,XQ$)=>{var qJ6=Yp0(),MJ6=ZQ$(),QN0;try{QN0=c0("fs")}catch($){}var hn=function(){},kJ6=typeof process>"u"?!1:/^v?\.0/.test(process.version),JN0=function($){return typeof $==="function"},SJ6=function($){if(!kJ6)return!1;if(!QN0)return!1;return($ instanceof(QN0.ReadStream||hn)||$ instanceof(QN0.WriteStream||hn))&&JN0($.close)},VJ6=function($){return $.setHeader&&JN0($.abort)},CJ6=function($,Z,G,X){X=qJ6(X);var Y=!1;$.on("close",function(){Y=!0}),MJ6($,{readable:Z,writable:G},function(J){if(J)return X(J);Y=!0,X()});var Q=!1;return function(J){if(Y)return;if(Q)return;if(Q=!0,SJ6($))return $.close(hn);if(VJ6($))return $.abort();if(JN0($.destroy))return $.destroy();X(J||Error("stream was destroyed"))}},GQ$=function($){$()},_J6=function($,Z){return $.pipe(Z)},bJ6=function(){var $=Array.prototype.slice.call(arguments),Z=JN0($[$.length-1]||hn)&&$.pop()||hn;if(Array.isArray($[0]))$=$[0];if($.length<2)throw Error("pump requires two streams per minimum");var G,X=$.map(function(Y,Q){var J=Q<$.length-1,W=Q>0;return CJ6(Y,J,W,function(K){if(!G)G=K;if(K)X.forEach(GQ$);if(J)return;X.forEach(GQ$),Z(G)})});return $.reduce(_J6)};XQ$.exports=bJ6});var NQ$=_((yJ6)=>{var QQ$=pY$(),JQ$=YQ$(),WQ$=c0("fs"),G9=c0("path"),cn=(global.Bare?global.Bare.platform:process.platform)==="win32";yJ6.pack=function(Z,G){if(!Z)Z=".";if(!G)G={};let X=G.fs||WQ$,Y=G.ignore||G.filter||un,Q=G.mapStream||FQ$,J=vJ6(X,G.dereference?X.stat:X.lstat,Z,Y,G.entries,G.sort),W=G.strict!==!1,K=typeof G.umask==="number"?~G.umask:~KQ$(),U=G.pack||QQ$.pack(),w=G.finish||un,F=G.map||un,H=typeof G.dmode==="number"?G.dmode:0,N=typeof G.fmode==="number"?G.fmode:0;if(G.strip)F=HQ$(F,G.strip);if(G.readable)H|=parseInt(555,8),N|=parseInt(444,8);if(G.writable)H|=parseInt(333,8),N|=parseInt(222,8);E();function B(L,z){X.readlink(G9.join(Z,L),function(j,P){if(j)return U.destroy(j);z.linkname=Qp0(P),U.entry(z,E)})}function D(L,z,j){if(U.destroyed)return;if(L)return U.destroy(L);if(!z){if(G.finalize!==!1)U.finalize();return w(U)}if(j.isSocket())return E();let P={name:Qp0(z),mode:(j.mode|(j.isDirectory()?H:N))&K,mtime:j.mtime,size:j.size,type:"file",uid:j.uid,gid:j.gid};if(j.isDirectory())return P.size=0,P.type="directory",P=F(P)||P,U.entry(P,E);if(j.isSymbolicLink())return P.size=0,P.type="symlink",P=F(P)||P,B(z,P);if(P=F(P)||P,!j.isFile()){if(W)return U.destroy(Error("unsupported type for "+z));return E()}let A=U.entry(P,E),M=Q(X.createReadStream(G9.join(Z,z),{start:0,end:P.size>0?P.size-1:P.size}),P);M.on("error",function(S){A.destroy(S)}),JQ$(M,A)}function E(L){if(L)return U.destroy(L);J(D)}return U};function fJ6($){return $.length?$[$.length-1]:null}function xJ6(){return!global.Bare&&process.getuid?process.getuid():-1}function KQ$(){return!global.Bare&&process.umask?process.umask():0}yJ6.extract=function(Z,G){if(!Z)Z=".";if(!G)G={};Z=G9.resolve(Z);let X=G.fs||WQ$,Y=G.ignore||G.filter||un,Q=G.mapStream||FQ$,J=G.chown!==!1&&!cn&&xJ6()===0,W=G.extract||QQ$.extract(),K=[],U=new Date,w=typeof G.umask==="number"?~G.umask:~KQ$(),F=G.strict!==!1,H=G.validateSymlinks!==!1,N=G.map||un,B=typeof G.dmode==="number"?G.dmode:0,D=typeof G.fmode==="number"?G.fmode:0;if(G.strip)N=HQ$(N,G.strip);if(G.readable)B|=parseInt(555,8),D|=parseInt(444,8);if(G.writable)B|=parseInt(333,8),D|=parseInt(222,8);if(W.on("entry",E),G.finish)W.on("finish",G.finish);return W;function E(A,M,S){A=N(A)||A,A.name=Qp0(A.name);let R=G9.join(Z,G9.join("/",A.name));if(Y(R,A))return M.resume(),S();let V=G9.join(R,".")===G9.join(Z,".")?Z:G9.dirname(R);wQ$(X,V,G9.join(Z,"."),function(B0,D0){if(B0)return S(B0);if(!D0)return S(Error(V+" is not a valid path"));if(A.type==="directory")return K.push([R,A.mtime]),P(R,{fs:X,own:J,uid:A.uid,gid:A.gid,mode:A.mode},i);P(V,{fs:X,own:J,uid:A.uid,gid:A.gid,mode:493},function(J0){if(J0)return S(J0);switch(A.type){case"file":return o();case"link":return v();case"symlink":return f()}if(F)return S(Error("unsupported type for "+R+" ("+A.type+")"));M.resume(),S()})});function i(B0){if(B0)return S(B0);z(R,A,function(D0){if(D0)return S(D0);if(cn)return S();j(R,A,S)})}function f(){if(cn)return S();X.unlink(R,function(){let B0=G9.resolve(G9.dirname(R),A.linkname);if(!Z0(B0)&&H)return S(Error(R+" is not a valid symlink"));UQ$(X,B0,G9.join(Z,"."),function(D0,J0){if(D0)return S(D0);if(!J0&&H)return S(Error(R+" is not a valid symlink"));X.symlink(A.linkname,R,i)})})}function v(){if(cn)return S();X.unlink(R,function(){let B0=G9.join(Z,G9.join("/",A.linkname));X.realpath(B0,function(D0,J0){if(D0||!Z0(J0))return S(Error(R+" is not a valid hardlink"));X.link(J0,R,function(Y0){if(Y0&&Y0.code==="EPERM"&&G.hardlinkAsFilesFallback)return M=X.createReadStream(J0),o();i(Y0)})})})}function Z0(B0){return B0===Z||B0.startsWith(Z+G9.sep)}function o(){let B0=X.createWriteStream(R),D0=Q(M,A);B0.on("error",function(J0){D0.destroy(J0)}),JQ$(D0,B0,function(J0){if(J0)return S(J0);B0.on("close",i)})}}function L(A,M){let S;while((S=fJ6(K))&&A.slice(0,S[0].length)!==S[0])K.pop();if(!S)return M();X.utimes(S[0],U,S[1],M)}function z(A,M,S){if(G.utimes===!1)return S();if(M.type==="directory")return X.utimes(A,U,M.mtime,S);if(M.type==="symlink")return L(A,S);X.utimes(A,U,M.mtime,function(R){if(R)return S(R);L(A,S)})}function j(A,M,S){let R=M.type==="symlink",V=R?X.lchmod:X.chmod,i=R?X.lchown:X.chown;if(!V)return S();let f=(M.mode|(M.type==="directory"?B:D))&w;if(i&&J)i.call(X,A,M.uid,M.gid,v);else v(null);function v(Z0){if(Z0)return S(Z0);if(!V)return S();V.call(X,A,f,S)}}function P(A,M,S){X.stat(A,function(R){if(!R)return S(null);if(R.code!=="ENOENT")return S(R);X.mkdir(A,{mode:M.mode,recursive:!0},function(V,i){if(V)return S(V);j(A,M,S)})})}};function UQ$($,Z,G,X){if(Z===G)return X(null,!0);if(!Z.startsWith(G+G9.sep))return X(null,!1);$.lstat(Z,function(Y,Q){if(Y&&Y.code!=="ENOENT"&&Y.code!=="EPERM")return X(Y);if(Y||!Q.isSymbolicLink())return UQ$($,G9.join(Z,".."),G,X);X(null,!1)})}function wQ$($,Z,G,X){if(Z===G)return X(null,!0);$.lstat(Z,function(Y,Q){if(Y&&Y.code!=="ENOENT"&&Y.code!=="EPERM")return X(Y);if(Y||Q.isDirectory())return wQ$($,G9.join(Z,".."),G,X);X(null,!1)})}function un(){}function FQ$($){return $}function Qp0($){return cn?$.replace(/\\/g,"/").replace(/[:?<>|]/g,"_"):$}function vJ6($,Z,G,X,Y,Q){if(!Y)Y=["."];let J=Y.slice(0);return function(K){if(!J.length)return K(null);let U=J.shift(),w=G9.join(G,U);Z.call($,w,function(F,H){if(F)return K(Y.indexOf(U)===-1&&F.code==="ENOENT"?null:F);if(!H.isDirectory())return K(null,U,H);$.readdir(w,function(N,B){if(N)return K(N);if(Q)B.sort();for(let D=0;D<B.length;D++)if(!X(G9.join(G,U,B[D])))J.push(G9.join(U,B[D]));K(null,U,H)})})}}function HQ$($,Z){return function(G){G.name=G.name.split("/").slice(Z).join("/");let X=G.linkname;if(X&&(G.type==="link"||G9.isAbsolute(X)))G.linkname=X.split("/").slice(Z).join("/");return $(G)}}});var cJ6,uJ6;var BQ$=O(()=>{ln0();cJ6=k(ZY$(),1),uJ6=k(NQ$(),1)});var WN0=()=>{};var OQ$=O(()=>{PH0()});var DQ$=O(()=>{tH0();pH0();WN0()});var EQ$=()=>{};var LQ$=()=>{};var Jp0=O(()=>{vX$();un0();tH0();uX$();hn0();ln0();dX$();lX$();mX$();iX$();cn0();nX$();BQ$();WN0();OQ$();DQ$();EQ$();LQ$();WN0()});var P9,f9,DV,dn;var ln=O(()=>{P9={CLAIM_API_GROUP:"extensions.agents.x-k8s.io",CLAIM_API_VERSION:"v1alpha1",CLAIM_PLURAL:"sandboxclaims",SANDBOX_API_GROUP:"agents.x-k8s.io",SANDBOX_API_VERSION:"v1alpha1",SANDBOX_PLURAL:"sandboxes",POD_NAME_ANNOTATION:"agents.x-k8s.io/pod-name"};f9=class f9 extends Error{cause;constructor($,Z){super($);if(this.name="SandboxError",this.cause=Z,Z instanceof Error&&Z.stack)this.stack=`${this.stack}
 Caused by: ${Z.stack}`}};DV=class DV extends f9{constructor($,Z){super($,Z);this.name="SandboxTimeoutError"}};dn=class dn extends f9{constructor($,Z){super($,Z);this.name="SandboxAlreadyExistsError"}}});async function dJ6($){let Z=$.getCurrentCluster();if(!Z)throw new f9("No active cluster in kubeconfig");let G={};await $.applyToHTTPSOptions(G);let X={},Y=G.headers??{};for(let[Q,J]of Object.entries(Y))if(Array.isArray(J))X[Q]=J.join(", ");else if(J!==void 0)X[Q]=String(J);if(typeof G.auth==="string"&&!X.Authorization)X.Authorization=`Basic ${Buffer.from(G.auth).toString("base64")}`;return{server:Z.server.replace(/\/+$/,""),headers:X,tls:{cert:Wp0(G.cert),key:Wp0(G.key),ca:Wp0(G.ca),rejectUnauthorized:Z.skipTLSVerify?!1:void 0}}}function Wp0($){if($==null)return;if(typeof $==="string")return $;if(Buffer.isBuffer($))return $.toString("utf8");return String($)}async function EV($,Z){let G=await dJ6($),X={...G.headers,...Z.headers};if(Z.method==="PATCH")X["content-type"]=Z.patchType==="apply"?"application/apply-patch+yaml":Z.patchType==="strategic-merge"?"application/strategic-merge-patch+json":"application/merge-patch+json";else if(Z.body!==void 0&&!("content-type"in X))X["content-type"]="application/json";let Y={method:Z.method,headers:X,body:Z.body===void 0?void 0:JSON.stringify(Z.body),signal:Z.signal,tls:G.tls,...Z.stream?{timeout:!1}:{}};return fetch(`${G.server}${Z.path}`,Y)}async function Kp0($){try{return await $.json()}catch{return null}}async function Up0($,Z){if($.ok)return;let G=await Kp0($),X=G?.message??`${Z} failed: ${$.status} ${$.statusText}`;throw new zQ$($.status,G,X)}async function mn($,Z,G,X,Y="none"){try{let Q=await EV($,Z);if(Q.status===404)return null;if(await Up0(Q,G),Y==="json")return await Q.json();return null}catch(Q){throw new f9(X,Q)}}async function nn($,Z,G){let X=`${jQ$}/${encodeURIComponent(Z)}/${P9.CLAIM_PLURAL}`,Y;try{Y=await EV($,{method:"POST",path:X,body:G})}catch(U){let w=U instanceof Error?U.message:String(U);throw console.warn(`[agent-sandbox/client] createSandboxClaim ${G.metadata.name} transport error: ${w}`),new f9(`Failed to create SandboxClaim: ${G.metadata.name} (transport error: ${w})`,U)}if(Y.ok)return;let Q=await Kp0(Y),J=Q?.reason?` ${Q.reason}`:"",W=Q?.message??Y.statusText,K=`Failed to create SandboxClaim: ${G.metadata.name} (${Y.status}${J}: ${W})`;if(console.warn(`[agent-sandbox/client] createSandboxClaim ${G.metadata.name} rejected: status=${Y.status} reason=${Q?.reason??"<none>"} message=${W}`),Y.status===409)throw new dn(K);throw new f9(K)}async function KN0($,Z,G,X=60000){let Y=Date.now()+X,Q=500,J;while(!0){let W=await ww($,Z,G).catch(()=>{return});if(!W)return;if(J=W,Date.now()>=Y){let K=J.metadata?.finalizers??[],U=J.metadata?.deletionTimestamp??"<unknown>";throw new DV(`SandboxClaim ${G} still terminating after ${X}ms (deletionTimestamp=${U}, finalizers=[${K.join(", ")}])`)}await O8(500)}}function wp0($,Z){return`${jQ$}/${encodeURIComponent($)}/${P9.CLAIM_PLURAL}/${encodeURIComponent(Z)}`}async function PQ$($,Z,G,X){await mn($,{method:"PATCH",path:wp0(Z,G),patchType:"merge",body:{spec:{lifecycle:{shutdownPolicy:"Delete",shutdownTime:X}}}},"patchSandboxClaimShutdown",`Failed to patch SandboxClaim shutdownTime: ${G}`)}async function cN($,Z,G){await mn($,{method:"DELETE",path:wp0(Z,G)},"deleteSandboxClaim",`Failed to delete SandboxClaim: ${G}`)}async function ww($,Z,G){return await mn($,{method:"GET",path:wp0(Z,G)},"getSandboxClaim",`Failed to get SandboxClaim: ${G}`,"json")??void 0}async function AQ$($,Z,G,X=60){let Y=Date.now()+X*1000,Q=200;while(Date.now()<Y){let W=(await ww($,Z,G).catch(()=>{return}))?.status?.sandbox?.name;if(W)return W;await O8(200)}throw new DV(`SandboxClaim ${G} did not record an adopted Sandbox (status.sandbox.name) within ${X}s`)}function Fp0($,Z){return`${lJ6}/${encodeURIComponent($)}/${RQ$}/${encodeURIComponent(Z)}`}async function UN0($,Z,G){let X=new URLSearchParams({fieldManager:MQ$,force:"true"}),Y=`${Fp0(Z,G.metadata.name)}?${X}`;try{let Q=await EV($,{method:"PATCH",path:Y,patchType:"apply",body:G});await Up0(Q,"applyHttpRoute")}catch(Q){throw new f9(`Failed to apply HTTPRoute: ${G.metadata.name}`,Q)}}async function wN0($,Z,G){await mn($,{method:"DELETE",path:Fp0(Z,G)},"deleteHttpRoute",`Failed to delete HTTPRoute: ${G}`)}async function qQ$($,Z,G){return await mn($,{method:"GET",path:Fp0(Z,G)},"getHttpRoute",`Failed to get HTTPRoute: ${G}`,"json")??void 0}async function kQ$($,Z,G,X){let Y={apiVersion:"v1",kind:"Service",metadata:{name:G},spec:{ports:[{name:X.name,port:X.port,targetPort:X.targetPort,protocol:X.protocol??"TCP"}]}},Q=new URLSearchParams({fieldManager:MQ$,force:"true"}),J=`/api/v1/namespaces/${encodeURIComponent(Z)}/services/${encodeURIComponent(G)}?${Q}`;try{let W=await EV($,{method:"PATCH",path:J,patchType:"apply",body:Y});await Up0(W,"ensureServicePort")}catch(W){throw new f9(`Failed to apply Service ports: ${G}`,W)}}function FN0($,Z,G,X=180){let Y=`/apis/${P9.SANDBOX_API_GROUP}/${P9.SANDBOX_API_VERSION}/namespaces/${encodeURIComponent(Z)}/${P9.SANDBOX_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${G}`)}`,{resolve:Q,reject:J,promise:W}=Promise.withResolvers(),K=new AbortController,U=!1,w=setTimeout(()=>{if(U)return;U=!0,K.abort(),J(new DV(`Sandbox did not become ready within ${X} seconds`))},X*1000),F=(H)=>{if(U)return;U=!0,clearTimeout(w),K.abort(),H()};return(async()=>{let H;try{H=await EV($,{method:"GET",path:Y,signal:K.signal,headers:{accept:"application/json"},stream:!0})}catch(N){F(()=>J(new f9("Failed to start watch for sandbox readiness",N)));return}if(!H.ok||!H.body){let N=await Kp0(H).catch(()=>null);F(()=>J(new f9(`Watch handshake failed (${H.status}): ${N?.message??H.statusText}`)));return}try{for await(let N of Hp0(H.body)){if(U)return;if(N.type==="ERROR"){let z=N.object;F(()=>J(new f9(`Watch stream error while waiting for sandbox: ${z.message??"unknown"}`)));return}if(N.type!=="ADDED"&&N.type!=="MODIFIED")continue;let B=N.object;if(!B.status?.conditions?.find((z)=>z.type==="Ready"&&z.status==="True"))continue;let E=B.metadata?.name;if(!E){F(()=>J(new f9("Sandbox metadata or name is missing")));return}let L=B.metadata?.annotations?.[P9.POD_NAME_ANNOTATION]??E;F(()=>Q({sandboxName:E,podName:L}));return}F(()=>J(new f9("Watch stream closed before sandbox became ready")))}catch(N){if(U)return;if(N instanceof Error&&(N.name==="AbortError"||K.signal.aborted))return;F(()=>J(new f9("Watch stream error while waiting for sandbox",N)))}})(),W}async function*Hp0($){let Z=$.getReader(),G=new TextDecoder,X="";try{while(!0){let{value:Q,done:J}=await Z.read();if(J)break;X+=G.decode(Q,{stream:!0});let W;while((W=X.indexOf(`
-`))>=0){let K=X.slice(0,W).trim();if(X=X.slice(W+1),!K)continue;yield JSON.parse(K)}}let Y=X.trim();if(Y)yield JSON.parse(Y)}finally{Z.releaseLock()}}var zQ$,jQ$,TQ$="gateway.networking.k8s.io",IQ$="v1",RQ$="httproutes",lJ6,pn,MQ$="mesh-sandbox-runner";var HN0=O(()=>{l5();ln();zQ$=class zQ$ extends Error{status;body;constructor($,Z,G){super(G);this.status=$;this.body=Z;this.name="KubeHttpError"}};jQ$=`/apis/${P9.CLAIM_API_GROUP}/${P9.CLAIM_API_VERSION}/namespaces`;lJ6=`/apis/${TQ$}/${IQ$}/namespaces`;pn={API_GROUP:TQ$,API_VERSION:IQ$,PLURAL:RQ$}});var NN0=O(()=>{l5();V90()});async function ON0($){try{let Z=await fetch(`${$}/health`,{signal:AbortSignal.timeout(mJ6)});if(!Z.ok)return null;let G=await Z.json();if(typeof G==="object"&&G!==null&&typeof G.bootId==="string"&&typeof G.ready==="boolean"&&G.setup&&typeof G.setup.running==="boolean"&&typeof G.setup.done==="boolean")return G;return null}catch{return null}}async function _Q$($){for(let Z=0;Z<SQ$;Z++){if(await ON0($)!==null)return;let G=(Math.random()*2-1)*iJ6;await O8(VQ$+G)}throw Error(`sandbox daemon at ${$} did not respond on /health within ${SQ$*VQ$/1000}s`)}async function nv($,Z,G,X,Y){return nJ6($,Z,"POST",G,X,Y)}async function nJ6($,Z,G,X,Y,Q){let J={...X};if(Y&&Y.rotateToken!==void 0)J.auth=Y;let W=await fetch(`${$}/_sandbox/config`,{method:G,headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:JSON.stringify(J),signal:AbortSignal.timeout(Q?.timeoutMs??CQ$)}),K=await W.text();if(!W.ok)throw new BN0(W.status,K);return JSON.parse(K)}async function bQ$($,Z,G){let X=await fetch(`${$}/_sandbox/orgfs-config`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:G,signal:AbortSignal.timeout(CQ$)}),Y=await X.text();if(!X.ok)throw Error(`sandbox daemon /_sandbox/orgfs-config returned ${X.status}: ${Y}`);return JSON.parse(Y)}async function tn($,Z,G,X){let Y=new Headers(X.headers);for(let W of pJ6)Y.delete(W);Y.set("authorization",`Bearer ${Z}`);let Q=X.method!=="GET"&&X.method!=="HEAD",J=`${$}${G.startsWith("/")?G:`/${G}`}`;return fetch(J,{method:X.method,headers:Y,body:Q?X.body:void 0,redirect:"manual",signal:X.signal,duplex:Q?"half":void 0})}var BN0,mJ6=500,CQ$=30000,SQ$=25,VQ$=200,iJ6=50,pJ6;var fQ$=O(()=>{NN0();BN0=class BN0 extends Error{status;constructor($,Z){super(`sandbox daemon /_sandbox/config returned ${$}: ${Z}`);this.status=$;this.name="ConfigRequestError"}};pJ6=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length"]});async function*yQ$($){let Z=$.now??(()=>Date.now()),G=Z(),X=$.schedulingTimeoutMs??oJ6,Y={pod:{},sandbox:{},events:{hasPulling:!1,hasPulled:!1},startedAt:G},Q=[],J=null,W=!1,K=(z)=>{if(W)return;if(J){let j=J;J=null,j(z)}else Q.push(z)},U=()=>{if(Q.length>0)return Promise.resolve(Q.shift());if(W)return Promise.resolve(null);return new Promise((z)=>{J=z})},w=()=>{if(W)return;if(W=!0,J){let z=J;J=null,z(null)}},F=new AbortController,H=()=>{F.abort(),w()};if($.signal)if($.signal.aborted)F.abort(),w();else $.signal.addEventListener("abort",H,{once:!0});let N=Math.max(0,X-(Z()-G)),B=setTimeout(()=>K("tick"),N+100),D,E=new Promise((z)=>{D=z}),L=Promise.allSettled([aJ6($.kc,$.namespace,$.claimName,F.signal,Y,K,Z,D),eJ6($.kc,$.namespace,$.claimName,F.signal,Y,K),$W6($.kc,$.namespace,$.claimName,E,F.signal,Y,K,Z)]);try{let z=null,j=-1,P=xQ$(Y,X,Z);if(z=Bp0(P),!Np0(P))j=vQ$(P);if(yield P,Np0(P))return;while(!W){if(await U()===null)break;let M=xQ$(Y,X,Z);if(Np0(M)){let V=Bp0(M);if(V!==z)z=V,yield M;return}let S=vQ$(M);if(S<j)continue;let R=Bp0(M);if(R!==z)z=R,j=S,yield M}}finally{if(clearTimeout(B),F.abort(),$.signal)$.signal.removeEventListener("abort",H);w(),await L.catch(()=>{})}}function xQ$($,Z,G){let{pod:X,sandbox:Y,events:Q,startedAt:J}=$;if(Y.ready)return{kind:"ready"};let W=X.containerWaitingReason;if(W==="ImagePullBackOff"||W==="ErrImagePull")return{kind:"failed",reason:"image-pull-backoff",message:"Sandbox image failed to download. The cluster may be missing pull credentials or the image tag may not exist."};if(W==="CrashLoopBackOff")return{kind:"failed",reason:"crash-loop-backoff",message:"Sandbox crashed during startup and is now in CrashLoopBackOff. Check pod logs."};if(!X.scheduled&&Q.lastFailedSchedulingAt!==void 0&&G()-J>Z)return{kind:"failed",reason:"scheduling-timeout",message:Q.failedSchedulingMessage??`Pod could not be scheduled within ${Math.round(Z/1000)}s.`};if(X.containerRunning&&!X.containerReady)return{kind:"warming-daemon",since:J};if(Q.hasPulling&&!Q.hasPulled)return{kind:"pulling-image",since:J};if(W==="ContainerCreating"||W==="PodInitializing"||X.scheduled&&!X.containerRunning)return{kind:"starting-container",since:J};if(X.scheduledFalseReason==="Unschedulable"||Q.lastFailedSchedulingAt!==void 0&&!X.scheduled)return{kind:"waiting-for-capacity",since:J,message:Q.failedSchedulingMessage??X.scheduledFalseMessage,nodeClaim:Q.nominatedNodeClaim};return{kind:"claiming",since:J}}function Np0($){return $.kind==="ready"||$.kind==="failed"}function vQ$($){switch($.kind){case"claiming":return 0;case"waiting-for-capacity":return 1;case"pulling-image":return 2;case"starting-container":return 3;case"warming-daemon":return 4;case"ready":case"failed":return 99}}function Bp0($){switch($.kind){case"claiming":case"pulling-image":case"starting-container":case"warming-daemon":return $.kind;case"waiting-for-capacity":return`waiting-for-capacity:${$.message??""}:${$.nodeClaim??""}`;case"ready":return"ready";case"failed":return`failed:${$.reason}:${$.message}`}}async function aJ6($,Z,G,X,Y,Q,J,W){let K=`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?watch=true&labelSelector=${encodeURIComponent(`${tJ6}=${G}`)}`;return DN0({kc:$,path:K,signal:X,label:`pod/${G}`,onEvent:(U)=>{if(U.type!=="ADDED"&&U.type!=="MODIFIED")return;let w=U.object;if(w.metadata?.name)W(w.metadata.name);sJ6(w,Y,J),Q("pod")}})}function sJ6($,Z,G){let Y=($.status?.conditions??[]).find((J)=>J.type==="PodScheduled");if(Y?.status==="True")Z.pod.scheduled=!0,Z.pod.scheduledFalseReason=void 0,Z.pod.scheduledFalseMessage=void 0;else if(Y?.status==="False")Z.pod.scheduled=!1,Z.pod.scheduledFalseReason=Y.reason,Z.pod.scheduledFalseMessage=Y.message;let Q=($.status?.containerStatuses??[]).find((J)=>J.name===rJ6);if(Q)Z.pod.containerWaitingReason=Q.state?.waiting?.reason,Z.pod.containerRunning=!!Q.state?.running,Z.pod.containerReady=Q.ready===!0}async function eJ6($,Z,G,X,Y,Q){let J=`/apis/${P9.CLAIM_API_GROUP}/${P9.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(Z)}/${P9.CLAIM_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${G}`)}`;return DN0({kc:$,path:J,signal:X,label:`sandboxclaim/${G}`,onEvent:(W)=>{if(W.type!=="ADDED"&&W.type!=="MODIFIED")return;let U=W.object.status?.conditions?.find((w)=>w.type==="Ready");if(!U)return;if(U.status==="True")Y.sandbox.ready=!0,Y.sandbox.notReadyReason=void 0,Y.sandbox.notReadyMessage=void 0;else Y.sandbox.ready=!1,Y.sandbox.notReadyReason=U.reason,Y.sandbox.notReadyMessage=U.message;Q("sandbox")}})}async function $W6($,Z,G,X,Y,Q,J,W){let K=await Promise.race([X,new Promise((w)=>{if(Y.aborted){w(G);return}Y.addEventListener("abort",()=>w(G),{once:!0})})]);if(Y.aborted)return;let U=`/api/v1/namespaces/${encodeURIComponent(Z)}/events?watch=true&fieldSelector=${encodeURIComponent(`involvedObject.name=${K},involvedObject.kind=Pod`)}`;return DN0({kc:$,path:U,signal:Y,label:`events/${G}`,onEvent:(w)=>{if(w.type!=="ADDED"&&w.type!=="MODIFIED")return;let F=w.object,H=F.reason;if(!H)return;switch(H){case"Pulling":Q.events.hasPulling=!0;break;case"Pulled":Q.events.hasPulling=!0,Q.events.hasPulled=!0;break;case"FailedScheduling":Q.events.lastFailedSchedulingAt=W(),Q.events.failedSchedulingMessage=F.message;break;case"Nominated":{let N=F.message?.match(/nodeclaim\/([\w-]+)/);if(N)Q.events.nominatedNodeClaim=N[1];break}default:return}J("event")}})}async function gQ$($){let{kc:Z,namespace:G,labelSelector:X,signal:Y,onDelete:Q}=$,J=`/apis/${P9.CLAIM_API_GROUP}/${P9.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(G)}/${P9.CLAIM_PLURAL}?watch=true&labelSelector=${encodeURIComponent(X)}`;return DN0({kc:Z,path:J,signal:Y,label:"sandboxclaim-reaper",onEvent:(W)=>{if(W.type!=="DELETED")return;let K=W.object.metadata?.name;if(K)Q(K)}})}async function DN0($){let{kc:Z,path:G,signal:X,label:Y,onEvent:Q}=$,J=0;while(!X.aborted){try{let K=await EV(Z,{method:"GET",path:G,signal:X,headers:{accept:"application/json"},stream:!0});if(!K.ok||!K.body){try{await K.body?.cancel()}catch{}if(K.status===401||K.status===403){console.warn(`[lifecycle-watcher] ${Y} stopped: watch denied (${K.status} ${K.statusText}). `+"The kubeconfig in use cannot watch SandboxClaims \u2014 if you are running locally, "+"this provider should not be active (check STUDIO_SANDBOX_PROVIDER / your sandbox preference).");return}throw Error(`watch handshake failed: ${K.status} ${K.statusText}`)}J=0;for await(let U of Hp0(K.body)){if(X.aborted)return;try{Q(U)}catch(w){console.warn(`[lifecycle-watcher] ${Y} onEvent threw: ${w instanceof Error?w.message:String(w)}`)}}}catch(K){if(X.aborted)return;let U=K instanceof Error?K.message:String(K);console.warn(`[lifecycle-watcher] ${Y} watch ended: ${U}`)}if(X.aborted)return;let W=mX(5000,250,J,2,0);J+=1,await O8(W,{signal:X}).catch(()=>{})}}var tJ6="studio.decocms.com/sandbox-handle",rJ6="sandbox",oJ6=300000;var hQ$=O(()=>{l5();ln();HN0()});async function cQ$($,Z,G){let X=new Map;for(let Y of $){let Q=Z(Y);if(!Q)continue;let J=X.get(Q);if(J)J.push(Y);else X.set(Q,[Y])}await Promise.allSettled([...X.values()].map(async(Y)=>{for(let Q of Y)await G(Q).catch(()=>{})}))}import{createHash as ZW6,randomBytes as GW6,randomUUID as XW6}from"crypto";import*as mQ$ from"net";import{PassThrough as YW6}from"stream";function QW6($){if($ instanceof Error)return $.message;if($&&typeof $==="object"){let Z=$;if(Z.error instanceof Error)return Z.error.message;if(typeof Z.message==="string"&&Z.message)return Z.message}return String($)}class jp0{kind=_X;records=new Map;inflight=new M90;stateStore;previewUrlPattern;kubeConfig;portForward;namespace;sandboxTemplateName;envName;tokenGenerator;idleTtlMs;metrics;previewGateway;sentinelToken;mintCloneUrl;closed=!1;claimWatchAbort=new AbortController;constructor($={}){this.stateStore=$.stateStore??null,this.previewUrlPattern=$.previewUrlPattern??null,this.kubeConfig=$.kubeConfig??EW6(),this.portForward=new mn0(this.kubeConfig),this.namespace=$.namespace??JW6,this.sandboxTemplateName=$.sandboxTemplateName??WW6,this.envName=TW6($.envName),this.tokenGenerator=$.tokenGenerator??(()=>GW6(UW6).toString("hex")),this.idleTtlMs=$.idleTtlMs??FW6,this.metrics=$.meter?DW6($.meter):null,this.previewGateway=$.previewGateway&&$.previewUrlPattern?{...$.previewGateway}:null;let Z=$.sentinelToken?.trim()??"";this.sentinelToken=Z.length>0?Z:null,this.mintCloneUrl=$.mintCloneUrl,this.startClaimReaper(),this.startCredentialRefresher()}startClaimReaper(){let $=["app.kubernetes.io/managed-by=studio","app.kubernetes.io/name=studio-sandbox",...this.envName?[`${vQ.env}=${this.envName}`]:[]].join(",");gQ$({kc:this.kubeConfig,namespace:this.namespace,labelSelector:$,signal:this.claimWatchAbort.signal,onDelete:(Z)=>this.invalidateRecord(Z)})}async ensure($,Z={}){let G=RN($,Z.branch??Z.repo?.branch??null);return this.inflight.run(G,()=>k90(this.stateStore,$,_X,(X)=>this.ensureLocked($,G,Z,X)))}async delete($){let Z=await this.getRecord($);if(this.records.delete($),Z)this.closeForwarder(Z.daemonForward),this.metrics?.active.add(-1,Lp0(Z.tenant));if(await this.deleteHttpRouteIfManaged($).catch((G)=>{console.warn(`[${x9}] HTTPRoute delete failed for ${$}: ${G instanceof Error?G.message:String(G)}`)}),await cN(this.kubeConfig,this.namespace,$),this.stateStore)if(Z)await this.stateStore.delete(Z.id,_X);else await this.stateStore.deleteByHandle(_X,$)}async alive($){return await ww(this.kubeConfig,this.namespace,$)!==void 0}watchClaimLifecycle($,Z){return yQ$({kc:this.kubeConfig,namespace:this.namespace,claimName:$,signal:Z})}async getPreviewUrl($){let Z=await this.getRecord($);if(!Z)return null;return this.composePreviewUrl(Z)}async proxyDaemonRequest($,Z,G){let X=await this.getRecord($);if(!X&&this.previewUrlPattern&&this.stateStore){let K=await this.stateStore.getByHandle(_X,$),U=K?.state,w=U?.token;if(K&&w){let H=`http://${U?.adoptedSandboxName??$}.${this.namespace}.svc.cluster.local:${uN}`;try{let N=await tn(H,w,Z,G);if(N.status!==404)return N;try{await N.body?.cancel()}catch{}}catch{}}}if(!X)X=await this.resurrectByHandle($);if(!X)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let Y=X,Q=performance.now(),J=0,W=!(G.body instanceof ReadableStream);try{let K=await tn(X.daemonUrl,X.token,Z,G);if(K.status===401&&W){this.invalidateRecord($);let U=await this.getRecord($).catch(()=>null)??await this.resurrectByHandle($).catch(()=>null);if(U)Y=U,K=await tn(U.daemonUrl,U.token,Z,G)}return J=K.status,K}catch(K){if(!W)throw K;this.invalidateRecord($);let U=await this.resurrectByHandle($)??await this.getRecord($).catch(()=>null);if(!U)throw K;Y=U;let w=await tn(U.daemonUrl,U.token,Z,G);return J=w.status,w}finally{this.recordProxyDuration("daemon",J,Y,performance.now()-Q)}}async adoptLiveClaim($,Z){if(this.records.has(Z))return!0;let G=await ww(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!G||G.metadata?.deletionTimestamp)return!1;return await this.inflight.run(Z,async()=>{let Y=this.records.get(Z);if(Y)return this.toSandbox(Y);let Q=await this.adopt($,Z,G);if(!Q)throw Error(`cannot adopt live claim ${Z}`);return k90(this.stateStore,$,_X,(J)=>this.finish(Q,J,!0,!0,"adopt"))}).catch(()=>null)!=null}async resolvePreviewUpstreamUrl($){if(this.previewUrlPattern)return`http://${await this.resolveServiceNameForHandle($)}.${this.namespace}.svc.cluster.local:${uN}`;let Z=await this.getRecord($);if(Z)return Z.daemonUrl;let G=await this.resurrectByHandle($);return G?G.daemonUrl:null}async resolveServiceNameForHandle($){let Z=this.records.get($);if(Z)return Z.adoptedSandboxName;if(this.stateStore){let X=(await this.stateStore.getByHandle(_X,$).catch(()=>null))?.state?.adoptedSandboxName;if(X)return X}return $}async proxyPreviewRequest($,Z){let G=performance.now(),X=this.records.get($)??null,Y=0;try{let Q=await this.resolvePreviewUpstreamUrl($);if(!Q){Y=404;let B=Dp0(404,{error:"sandbox not found"});return B.headers.set(zV,"1"),B}let J=new URL(Z.url);if((J.pathname==="/_sandbox"||J.pathname.startsWith("/_sandbox/")||J.pathname==="/_decopilot_vm"||J.pathname.startsWith("/_decopilot_vm/"))&&Z.method!=="GET")return Y=404,Dp0(404,{error:"not found"});let K=(B)=>`${B}${J.pathname}${J.search}`,U=new Headers(Z.headers);for(let B of BW6)U.delete(B);let w=Z.method!=="GET"&&Z.method!=="HEAD",F={method:Z.method,headers:U,body:w?Z.body:void 0,redirect:"manual",signal:Z.signal,duplex:w?"half":void 0},H;try{H=await fetch(K(Q),F)}catch(B){let D=`${Q}${J.pathname}`;if(console.warn(`[${x9}] preview fetch to ${D} failed: ${B instanceof Error?B.message:String(B)}`),Z.method==="GET"||Z.method==="HEAD"){if(this.invalidateRecord($),await this.resurrectByHandle($).catch(()=>null)){let z=await this.resolvePreviewUpstreamUrl($);if(z)try{H=await fetch(K(z),F);let j=new Headers;for(let[P,A]of H.headers.entries())if(!uQ$.includes(P.toLowerCase()))j.set(P,A);return Y=H.status,new Response(H.body,{status:H.status,statusText:H.statusText,headers:j})}catch(j){console.warn(`[${x9}] preview fetch retry to ${D} failed: ${j instanceof Error?j.message:String(j)}`)}}}else this.invalidateRecord($);Y=502;let E=Dp0(502,{error:"sandbox daemon unreachable"});return E.headers.set(zV,"1"),E}let N=new Headers;for(let[B,D]of H.headers.entries())if(!uQ$.includes(B.toLowerCase()))N.set(B,D);return Y=H.status,new Response(H.body,{status:H.status,statusText:H.statusText,headers:N})}finally{this.recordProxyDuration("preview",Y,X,performance.now()-G,$)}}async ensureLocked($,Z,G,X){if(G.image)console.warn(`[${x9}] opts.image ignored (template ${this.sandboxTemplateName} pins image): got ${G.image}`);if(X){let J=await X.get($,_X);if(J){let W=await this.rehydrate($,Z,J);if(W)return await this.refreshDaemonGitCredential(W,G),this.finish(W,X,!1,!0,"resume");await X.delete($,_X)}}let Y=await ww(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(Y)if(Y.metadata?.deletionTimestamp)await KN0(this.kubeConfig,this.namespace,Z).catch((J)=>{console.warn(`[${x9}] wait for terminating claim ${Z} failed: ${J instanceof Error?J.message:String(J)}`)});else{let J=await this.adopt($,Z,Y).catch((W)=>{return console.warn(`[${x9}] adopt ${Z} failed, recreating: ${W instanceof Error?W.message:String(W)}`),null});if(J)return await this.refreshDaemonGitCredential(J,G),this.finish(J,X,!0,!0,"adopt");await cN(this.kubeConfig,this.namespace,Z).catch(()=>{}),await KN0(this.kubeConfig,this.namespace,Z).catch((W)=>{console.warn(`[${x9}] wait for deleted claim ${Z} failed: ${W instanceof Error?W.message:String(W)}`)})}let Q=await this.provision($,Z,G);return this.finish(Q,X,!0,!1,"fresh")}async finish($,Z,G,X,Y){let Q=this.records.get($.handle),J=Q!==void 0;if(Q&&Q.daemonForward!==$.daemonForward)this.closeForwarder(Q.daemonForward);if(this.records.set($.handle,$),G)await this.persist(Z,$);if(X)await PQ$(this.kubeConfig,this.namespace,$.handle,this.computeShutdownTime()).catch((W)=>console.warn(`[${x9}] TTL refresh failed for ${$.handle}: ${W instanceof Error?W.message:String(W)}`));if(this.metrics){let W=Lp0($.tenant);if(this.metrics.ensureOutcome.add(1,{...W,outcome:Y}),!J)this.metrics.active.add(1,W)}return this.toSandbox($)}buildEnvMap($,Z){let G={},X=[];for(let[Y,Q]of Object.entries($.env??{}))if(wW6.has(Y))X.push(Y);else G[Y]=Q;if(X.length>0)console.warn(`[${x9}] opts.env keys overlap reserved bootstrap names and were dropped: ${X.join(",")}`);return{...G,DAEMON_TOKEN:Z.token,DAEMON_BOOT_ID:Z.daemonBootId,APP_ROOT:Z.workdir,PROXY_PORT:String(uN)}}buildClaim($,Z,G){let X=this.sentinelToken!==null,Y=X?[]:Object.entries(this.buildEnvMap(Z,G)).sort(([W],[K])=>W<K?-1:W>K?1:0).map(([W,K])=>({name:W,value:K})),Q=qW6(Z),J=Object.keys(Q).length>0;return{apiVersion:`${P9.CLAIM_API_GROUP}/${P9.CLAIM_API_VERSION}`,kind:"SandboxClaim",metadata:{name:$,namespace:this.namespace,labels:{"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[vQ.env]:this.envName}:{},...Ep0(Z.tenant)},...J?{annotations:Q}:{}},spec:{sandboxTemplateRef:{name:this.sandboxTemplateName},additionalPodMetadata:{labels:Ep0(Z.tenant,{[vQ.role]:"claimed",[vQ.sandboxHandle]:$,...this.envName?{[vQ.env]:this.envName}:{}}),...J?{annotations:Q}:{}},env:Y,warmpool:X?"default":"none",lifecycle:{shutdownPolicy:"Delete",shutdownTime:this.computeShutdownTime()}}}}async provision($,Z,G){let X=this.tokenGenerator(),Y=XW6(),Q=Op0,J=this.buildClaim(Z,G,{token:X,daemonBootId:Y,workdir:Q});try{await nn(this.kubeConfig,this.namespace,J)}catch(H){if(H instanceof dn)await KN0(this.kubeConfig,this.namespace,Z),await nn(this.kubeConfig,this.namespace,J);else throw H}let W;try{W=await AQ$(this.kubeConfig,this.namespace,Z),await FN0(this.kubeConfig,this.namespace,W)}catch(H){throw await cN(this.kubeConfig,this.namespace,Z).catch(()=>{}),H}try{await this.ensureServicePortForAdoptedSandbox(W),await this.ensureHttpRouteForHandle(Z,W,G.tenant??null)}catch(H){throw await cN(this.kubeConfig,this.namespace,Z).catch(()=>{}),H}let K=await this.openForwarder(W,uN,Z),U=`http://127.0.0.1:${K.localPort}`,w=this.workloadConfigPayload(G),F=Y;try{if(await _Q$(U),this.sentinelToken!==null){let H=await ON0(U);if(H)F=H.bootId;await nv(U,this.sentinelToken,w??{},{rotateToken:X})}else if(w)await nv(U,X,w);if(G.orgFsConfigJson)await bQ$(U,X,G.orgFsConfigJson).catch((H)=>console.warn("[org-fs] sidecar config relay failed",H))}catch(H){throw this.closeForwarder(K),await this.deleteHttpRouteIfManaged(Z).catch(()=>{}),await cN(this.kubeConfig,this.namespace,Z).catch(()=>{}),H}return{id:$,handle:Z,adoptedSandboxName:W,token:X,workdir:Q,daemonUrl:U,daemonForward:K,workload:G.workload??null,daemonBootId:F,tenant:G.tenant??null,ensureOpts:kW6(G)}}workloadConfigPayload($){return sm0({runtime:$?.workload?.runtime??"node",packageManager:$?.workload?.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:$?.repo??null,port:$?.workload?.devPort??KW6,tenant:$?.tenant??void 0})}async refreshDaemonGitCredential($,Z){let G=em0(Z);if(!G)return;try{await nv($.daemonUrl,$.token,G)}catch(X){console.warn(`[${x9}] git credential refresh failed for ${$.handle}: ${X instanceof Error?X.message:String(X)}`)}}async withFreshCloneUrl($,Z){if(!this.mintCloneUrl)return $;try{let G=await this.mintCloneUrl($,Z!==void 0?{bufferMs:Z}:void 0);return G?{...$,cloneUrl:G}:$}catch(G){return console.warn(`[${x9}] clone credential re-mint failed: ${G instanceof Error?G.message:String(G)}`),$}}startCredentialRefresher(){if(!this.mintCloneUrl)return;let{signal:$}=this.claimWatchAbort;(async()=>{while(!$.aborted){if(await O8(HW6,{signal:$}).catch(()=>{}),$.aborted)break;try{await this.refreshAllGitCredentials()}catch(Z){console.warn(`[${x9}] periodic credential refresh failed: ${Z instanceof Error?Z.message:String(Z)}`)}}})()}async refreshAllGitCredentials(){await cQ$(this.records.values(),($)=>$.ensureOpts?.repo?.connectionId,async($)=>{if(this.claimWatchAbort.signal.aborted)return;let Z=$.ensureOpts?.repo;if(!Z)return;let G=await this.withFreshCloneUrl(Z,NW6);await this.refreshDaemonGitCredential($,{...$.ensureOpts,repo:G}),$.ensureOpts={...$.ensureOpts,repo:G}})}async rebootstrapDaemon($,Z,G){if(this.sentinelToken===null)return!1;let X=this.workloadConfigPayload(G)??{};try{return await nv($,this.sentinelToken,X,{rotateToken:Z}),!0}catch(Y){if(Y instanceof BN0&&Y.status===401)try{return await nv($,Z,X,{rotateToken:Z}),!0}catch(Q){return console.warn(`[${x9}] re-bootstrap retry with claim token failed: ${Q instanceof Error?Q.message:String(Q)}`),!1}return console.warn(`[${x9}] re-bootstrap failed: ${Y instanceof Error?Y.message:String(Y)}`),!1}}async ensureServicePortForAdoptedSandbox($){if(!this.previewGateway||!this.previewUrlPattern)return;await kQ$(this.kubeConfig,this.namespace,$,{name:"daemon",port:uN,targetPort:uN})}async ensureHttpRouteForHandle($,Z,G){if(!this.previewGateway||!this.previewUrlPattern)return;let X=SW6(this.previewUrlPattern,$);if(!X)throw new f9(`Unable to derive preview hostname for ${$} from pattern: ${this.previewUrlPattern}`);let Y={apiVersion:`${pn.API_GROUP}/${pn.API_VERSION}`,kind:"HTTPRoute",metadata:{name:$,namespace:this.namespace,labels:Ep0(G??void 0,{[vQ.role]:"claimed",[vQ.sandboxHandle]:$,"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[vQ.env]:this.envName}:{}})},spec:{parentRefs:[{kind:"Gateway",group:"gateway.networking.k8s.io",name:this.previewGateway.name,namespace:this.previewGateway.namespace}],hostnames:[X],rules:[{backendRefs:[{group:"",kind:"Service",name:Z,port:uN}]}]}};await UN0(this.kubeConfig,this.namespace,Y)}async deleteHttpRouteIfManaged($){if(!this.previewGateway)return;await wN0(this.kubeConfig,this.namespace,$)}async rehydrate($,Z,G){let X=G.state;if(!X.adoptedSandboxName&&!X.podName||!X.token)return null;let Y=await ww(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!Y||!dQ$(Y))return null;let Q=Y.status?.sandbox?.name??X.adoptedSandboxName??X.podName??Z,J=await this.openAndProbeDaemon(Q,Z);if(!J)return null;if(X.daemonBootId&&X.daemonBootId!==J.bootId){if(this.sentinelToken!==null){let W=X.ensureOpts?.repo?{...X.ensureOpts,repo:await this.withFreshCloneUrl(X.ensureOpts.repo)}:X.ensureOpts??null;if(!await this.rebootstrapDaemon(J.daemonUrl,X.token,W))return this.closeForwarder(J.daemonForward),null}else console.warn(`[${x9}] daemon restart detected (handle=${Z}): stored bootId=${X.daemonBootId} live bootId=${J.bootId}`);await this.stateStore?.put($,_X,{handle:Z,state:{...X,daemonBootId:J.bootId}}).catch((W)=>console.warn(`[${x9}] bootId persist failed for ${Z}: ${W instanceof Error?W.message:String(W)}`))}return{id:$,handle:Z,adoptedSandboxName:Q,token:X.token,workdir:X.workdir??Op0,daemonUrl:J.daemonUrl,daemonForward:J.daemonForward,workload:X.workload??null,daemonBootId:J.bootId,tenant:X.tenant??null,ensureOpts:X.ensureOpts??null}}async adopt($,Z,G){if(!dQ$(G))return null;let X=G.status?.sandbox?.name??Z;if(this.sentinelToken!==null)return null;let Y=LW6(G);if(!Y)return null;let Q=await this.openAndProbeDaemon(X,Z);if(!Q)return null;let J=MW6(G);if(this.previewGateway)await this.ensureServicePortForAdoptedSandbox(X).catch((W)=>{console.warn(`[${x9}] Service port backfill failed for ${Z}: ${W instanceof Error?W.message:String(W)}`)}),await this.ensureHttpRouteForHandle(Z,X,J).catch((W)=>{console.warn(`[${x9}] HTTPRoute backfill failed for ${Z}: ${W instanceof Error?W.message:String(W)}`)});return{id:$,handle:Z,adoptedSandboxName:X,token:Y,workdir:Op0,daemonUrl:Q.daemonUrl,daemonForward:Q.daemonForward,workload:null,daemonBootId:Q.bootId,tenant:J,ensureOpts:null}}async openAndProbeDaemon($,Z){let G=await this.openForwarder($,uN,Z).catch(()=>null);if(!G)return null;let X=`http://127.0.0.1:${G.localPort}`,Y=await ON0(X);if(!Y)return this.closeForwarder(G),null;return{daemonForward:G,daemonUrl:X,bootId:Y.bootId}}async getRecord($){let Z=this.records.get($);if(Z)return Z;if(!this.stateStore)return null;let G=await this.stateStore.getByHandle(_X,$);if(!G)return null;let X=await this.rehydrate(G.id,$,G);if(X)this.records.set($,X);return X}async resurrectByHandle($){if(!this.stateStore)return null;let Z=await this.stateStore.getByHandle(_X,$);if(!Z)return null;let G=Z.state.ensureOpts;if(!G)return null;let X=G.repo?{...G,repo:await this.withFreshCloneUrl(G.repo)}:G;return await this.ensure(Z.id,X),this.records.get($)??null}invalidateRecord($){let Z=this.records.get($);if(!Z)return;this.records.delete($),this.closeForwarder(Z.daemonForward)}recordProxyDuration($,Z,G,X,Y){if(!this.metrics)return;this.metrics.proxyDurationMs.record(X,{...Lp0(G?.tenant??null),source:$,sandbox_handle:G?.handle??Y??"",status_code:Z||0})}composePreviewUrl($){if(this.previewUrlPattern)return S90(this.previewUrlPattern,$.handle);return`http://127.0.0.1:${$.daemonForward.localPort}/`}toSandbox($){return{handle:$.handle,workdir:$.workdir,previewUrl:this.composePreviewUrl($)}}async persist($,Z){if(!$)return;let G={adoptedSandboxName:Z.adoptedSandboxName,token:Z.token,workdir:Z.workdir,workload:Z.workload,daemonBootId:Z.daemonBootId,tenant:Z.tenant,...Z.ensureOpts?{ensureOpts:Z.ensureOpts}:{}};await $.put(Z.id,_X,{handle:Z.handle,state:G})}computeShutdownTime(){return new Date(Date.now()+this.idleTtlMs).toISOString()}openForwarder($,Z,G=$){let X=zW6(G,Z);return new Promise((Y,Q)=>{let J=(W,K)=>{let U=mQ$.createServer((w)=>this.handleForwardedConnection(w,$,Z,G));U.once("error",(w)=>{if(w.code==="EADDRINUSE"&&K<OW6){try{U.close()}catch{}let F=zp0+(W-zp0+1)%iQ$;J(F,K+1);return}Q(w)}),U.listen(W,"127.0.0.1",()=>{let w=U.address();if(!w||typeof w==="string"){U.close(),Q(Error("port-forward listener failed to bind"));return}Y({server:U,localPort:w.port})})};J(X,0)})}handleForwardedConnection($,Z,G,X){let Y=new YW6,Q=null,J=!1,W=()=>{if(J)return;if(J=!0,Y.destroy(),Q)try{Q.close()}catch{}if(!$.destroyed)$.destroy()};$.pipe(Y),$.on("error",W),$.on("close",W),this.portForward.portForward(this.namespace,Z,[G],$,null,Y).then((K)=>{let U=typeof K==="function"?K():K;if(!U){W();return}if(Q=U,Q.on("close",W),Q.on("error",()=>{this.invalidateRecord(X),W()}),J)try{Q.close()}catch{}}).catch((K)=>{console.warn(`[${x9}] port-forward to ${Z}:${G} failed: ${QW6(K)}`),this.invalidateRecord(X),W()})}closeForwarder($){$.server.close((Z)=>{if(Z)console.warn(`[${x9}] port-forward close on :${$.localPort} errored: ${Z instanceof Error?Z.message:String(Z)}`)})}close(){if(this.closed)return;this.closed=!0,this.claimWatchAbort.abort();for(let $ of this.records.values())this.closeForwarder($.daemonForward);this.records.clear()}}function DW6($){return{active:$.createUpDownCounter("studio.sandbox.active",{description:"Active sandbox count, by runner kind and owning org. Cross-checks the cAdvisor-derived count from the cluster \u2014 divergence between the two indicates orphaned claims (mesh deleted but K8s didn't reap) or unattributed pods.",unit:"{sandbox}"}),ensureOutcome:$.createCounter("studio.sandbox.ensure.outcome",{description:"Outcome of each ensure() call: fresh provision, resume from state-store after restart, or adopt of a cluster-side claim mesh didn't know about. Cold-start ratio is the primary input for warm-pool sizing.",unit:"{call}"}),proxyDurationMs:$.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of mesh-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"})}}function EW6(){let $=new uv;return $.loadFromDefault(),$}function dQ$($){return Boolean($.status?.conditions?.some((Z)=>Z.type==="Ready"&&Z.status==="True"))}function LW6($){let Z=$.spec?.env;if(!Z)return null;for(let G of Z)if(G.name==="DAEMON_TOKEN"&&G.value)return G.value;return null}function zW6($,Z){let G=ZW6("sha256").update(`${$}:${Z}`).digest();return zp0+G.readUInt32BE(0)%iQ$}function Dp0($,Z){return new Response(JSON.stringify(Z),{status:$,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function lQ$($){let Z=$.slice(0,PW6);return jW6.test(Z)?Z:""}function TW6($){if($===void 0)return null;let Z=$.trim();if(Z==="")return null;if(!AW6.test(Z))throw Error(`AgentSandboxProvider: envName=${JSON.stringify(Z)} is not a valid DNS-label-safe environment name (lowercase alphanumeric or '-', starts with a letter, ends alphanumeric, \u226432 chars). Mesh sets this from STUDIO_ENV; check the studio chart's configMap.`);return Z}function Ep0($,Z={}){let G={...Z};if($){let X=lQ$($.orgId),Y=lQ$($.userId);if(X)G[vQ.orgId]=X;if(Y)G[vQ.userId]=Y}return G}function LV($){let Z="";for(let G of $){let X=G.codePointAt(0)??0;Z+=X<32||X===127?" ":G}return Z.slice(0,IW6)}function RW6($){try{let Z=new URL($);return Z.username="",Z.password="",Z.toString()}catch{return""}}function qW6($){let Z={},G=$.tenant;if(G?.orgSlug)Z[LJ.orgSlug]=LV(G.orgSlug);if(G?.orgName)Z[LJ.orgName]=LV(G.orgName);if(G?.userEmail)Z[LJ.userEmail]=LV(G.userEmail);if(G?.userName)Z[LJ.userName]=LV(G.userName);let X=$.repo;if(X){if(X.displayName)Z[LJ.gitRepo]=LV(X.displayName);let Y=RW6(X.cloneUrl);if(Y)Z[LJ.gitRepoUrl]=LV(Y);let Q=$.branch??X.branch;if(Q)Z[LJ.gitBranch]=LV(Q)}return Z}function MW6($){let Z=$.metadata?.labels;if(!Z)return null;let G=Z[vQ.orgId],X=Z[vQ.userId];if(!G||!X)return null;let Y=$.metadata?.annotations??{};return{orgId:G,userId:X,orgSlug:Y[LJ.orgSlug],orgName:Y[LJ.orgName],userEmail:Y[LJ.userEmail],userName:Y[LJ.userName]}}function Lp0($){return{org_id:$?.orgId??"",user_id:$?.userId??"",runner_kind:_X}}function kW6($){let Z={};if($.repo)Z.repo=$.repo;if($.workload)Z.workload=$.workload;if($.env&&Object.keys($.env).length>0)Z.env=$.env;if($.tenant)Z.tenant=$.tenant;return Object.keys(Z).length>0?Z:null}function SW6($,Z){try{return new URL(S90($,Z)).hostname||null}catch{return null}}var _X="agent-sandbox",x9="AgentSandboxProvider",zV="x-sandbox-preview-not-ready",JW6="agent-sandbox-system",WW6="studio-sandbox",uN=9000,KW6=3000,Op0="/app",UW6=32,wW6,FW6=900000,HW6=900000,NW6=1800000,BW6,uQ$,zp0=40000,iQ$=1e4,OW6=256,vQ,LJ,jW6,PW6=63,AW6,IW6=253;var nQ$=O(()=>{l5();Jp0();fQ$();C90();HN0();ln();hQ$();wW6=new Set(["DAEMON_TOKEN","DAEMON_BOOT_ID","APP_ROOT","PROXY_PORT"]),BW6=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length","upgrade"],uQ$=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];vQ={role:"studio.decocms.com/role",sandboxHandle:"studio.decocms.com/sandbox-handle",orgId:"studio.decocms.com/org-id",userId:"studio.decocms.com/user-id",env:"studio.decocms.com/env"},LJ={orgSlug:"studio.decocms.com/org-slug",orgName:"studio.decocms.com/org-name",userEmail:"studio.decocms.com/user-email",userName:"studio.decocms.com/user-name",gitRepo:"studio.decocms.com/git-repo",gitRepoUrl:"studio.decocms.com/git-repo-url",gitBranch:"studio.decocms.com/git-branch"},jW6=/^([A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?)?$/;AW6=/^[a-z]([a-z0-9-]{0,30}[a-z0-9])?$/});var pQ$={};X6(pQ$,{waitForSandboxReady:()=>FN0,getSandboxClaim:()=>ww,getHttpRoute:()=>qQ$,deleteSandboxClaim:()=>cN,deleteHttpRoute:()=>wN0,createSandboxClaim:()=>nn,applyHttpRoute:()=>UN0,SandboxTimeoutError:()=>DV,SandboxError:()=>f9,PREVIEW_NOT_READY_HEADER:()=>zV,KubeConfig:()=>uv,K8S_CONSTANTS:()=>P9,HTTPROUTE_CONSTANTS:()=>pn,AgentSandboxProvider:()=>jp0});var Pp0=O(()=>{Jp0();ln();HN0();nQ$()});class EN0{kind=dN;userSub;dispatch;stateStore;records=new Map;constructor($){if(!$.userSub)throw Error("DesktopSandboxProvider requires userSub");if(!$.dispatch)throw Error("DesktopSandboxProvider requires dispatch");this.userSub=$.userSub,this.dispatch=$.dispatch,this.stateStore=$.stateStore??null}async ensure($,Z={}){let G=Z.branch??Z.repo?.branch,X=RN($,G),Y=this.records.get(X);if(Y){if(await this.probeHealth(X))return this.toSandbox(Y);if(this.records.delete(X),this.stateStore)await this.stateStore.deleteByHandle(dN,X).catch(()=>{})}else if(this.stateStore){let H=(await this.stateStore.getByHandle(dN,X))?.state,N=H?.sandboxApiUrl;if(N){if(await this.probeHealth(X)){let B={handle:X,sandboxApiUrl:N,previewUrl:H?.previewUrl??N};return this.records.set(X,B),this.toSandbox(B)}await this.stateStore.deleteByHandle(dN,X).catch(()=>{})}}let Q=$w({userName:Z.tenant?.userName,userEmail:Z.tenant?.userEmail}),J=JSON.stringify({handle:X,repo:Z.repo,branch:G,...Z.workload?{workload:Z.workload}:{},...Q?{operator:Q}:{},...Z.offloadAllowedHosts?{offloadAllowedHosts:Z.offloadAllowedHosts}:{},...Z.offloadAllowSameHostDev!==void 0?{offloadAllowSameHostDev:Z.offloadAllowSameHostDev}:{},...Z.orgFsConfigJson?{orgFsConfigJson:Z.orgFsConfigJson}:{}}),W=await this.dispatchJson("POST","/api/sandboxes",J),K=JSON.parse(W);if(typeof K.sandboxApiUrl!=="string")throw Error("desktop ensure: daemon did not return a sandboxApiUrl string");let U=typeof K.previewUrl==="string"?K.previewUrl:K.sandboxApiUrl,w={handle:X,sandboxApiUrl:K.sandboxApiUrl,previewUrl:U};if(this.records.set(X,w),this.stateStore)await this.stateStore.put($,dN,{handle:X,state:{handle:X,sandboxApiUrl:K.sandboxApiUrl,previewUrl:U}});return this.toSandbox(w)}async proxyDaemonRequest($,Z,G){let X=Z.startsWith("/")?Z:`/${Z}`,Y=X.startsWith("/_sandbox/")?X.slice(9):X,Q=`/_sandbox/${encodeURIComponent($)}${Y}`,J=new Headers(G.headers);for(let L of["host","cookie","connection","keep-alive","transfer-encoding","upgrade","authorization"])J.delete(L);let W={};J.forEach((L,z)=>{W[z]=L});let K;if(G.body!=null)K=await CW6(G.body);let w=this.dispatch(this.userSub,{method:G.method,path:Q,headers:W,body:K},{signal:G.signal})[Symbol.asyncIterator](),F=VW6(),H=200,N={"content-type":"application/octet-stream"},B=[];try{while(!0){let L=await w.next();if(L.done)break;let z=L.value;if(z.headers){H=z.headers.status,N=z.headers.headers;break}if(z.data!=null){let j=F.push(z.data);if(j.length)B.push(j)}}}catch(L){let z=L instanceof Error?L.message:"dispatch error";return new Response(JSON.stringify({error:z}),{status:502,headers:{"content-type":"application/json"}})}let D=!1,E=new ReadableStream({async start(L){for(let z of B)L.enqueue(z)},async pull(L){try{while(!0){let z=await w.next();if(D)return;if(z.done){let P=F.flush();if(P.length)L.enqueue(P);L.close();return}let j=z.value;if(j.data!=null){let P=F.push(j.data);if(P.length){L.enqueue(P);return}}}}catch(z){if(!D)L.error(z)}},cancel(){D=!0,w.return?.()}});return new Response(E,{status:H,headers:N})}async alive($){return this.probeHealth($)}async probeHealth($){let Z=new AbortController,G=setTimeout(()=>Z.abort(),3000);try{return await this.dispatchJson("GET",`/api/sandboxes/${encodeURIComponent($)}`,void 0,Z.signal),!0}catch{return!1}finally{clearTimeout(G)}}async forgetHandle($){if(this.records.delete($),this.stateStore)await this.stateStore.deleteByHandle(dN,$).catch(()=>{})}async delete($){if(this.records.delete($),this.stateStore)await this.stateStore.deleteByHandle(dN,$).catch(()=>{});try{await this.dispatchJson("DELETE",`/api/sandboxes/${encodeURIComponent($)}`)}catch(Z){if(!(Z instanceof Error?Z.message:String(Z)).includes("404"))throw Z}}async getPreviewUrl($){return(await this.resolveRecord($))?.previewUrl??null}async localWorkdir($){return null}async*watchClaimLifecycle($,Z){yield{kind:"ready"}}toSandbox($){return{handle:$.handle,workdir:$.sandboxApiUrl,previewUrl:$.previewUrl}}async resolveRecord($){let Z=this.records.get($);if(Z)return Z;if(!this.stateStore)return null;let X=(await this.stateStore.getByHandle(dN,$))?.state,Y=X?.sandboxApiUrl;if(!Y)return null;let Q={handle:$,sandboxApiUrl:Y,previewUrl:X?.previewUrl??Y};return this.records.set($,Q),Q}async dispatchJson($,Z,G,X){let Y={accept:"application/json"};if(G!==void 0)Y["content-type"]="application/json";let Q=this.dispatch(this.userSub,{method:$,path:Z,headers:Y,body:G},{signal:X}),J=null,W="";for await(let U of Q)if(U.headers)J=U.headers.status;else if(U.data!=null)W+=U.data;let K=Buffer.from(W,"base64").toString("utf8");if(J!=null&&(J<200||J>=300))throw Error(`daemon returned ${J}: ${K}`);return K}}function tQ$($){return new EN0($)}function VW6(){let $="";return{push(Z){if(Z.length===0)return Ap0;$+=Z;let G=$.length-$.length%4;if(G===0)return Ap0;let X=$.slice(0,G);return $=$.slice(G),new Uint8Array(Buffer.from(X,"base64"))},flush(){if($.length===0)return Ap0;let Z=$;return $="",new Uint8Array(Buffer.from(Z,"base64"))}}}async function CW6($){if(typeof $==="string")return $;if($ instanceof ArrayBuffer)return Buffer.from($).toString("utf8");if(ArrayBuffer.isView($))return Buffer.from($.buffer,$.byteOffset,$.byteLength).toString("utf8");if($ instanceof URLSearchParams)return $.toString();return await new Response($).text()}var dN="user-desktop",Ap0;var rQ$=O(()=>{C90();V90();Ap0=new Uint8Array(0)});var oQ$={};X6(oQ$,{createDesktopProvider:()=>tQ$,DesktopSandboxProvider:()=>EN0});var aQ$=O(()=>{rQ$()});var X3$={};X6(X3$,{subscribeLifecycle:()=>rn,getSandboxProviderByKind:()=>Ip0,getOrInitSharedRunner:()=>hW6,buildDesktopProvider:()=>LN0,__resetSharedLifecyclesForTesting:()=>mW6});function Z3$($,Z){let G=sQ$[$];if(G)return Promise.resolve(G);let X=Tp0[$];if(X)return X;let Y=Z().then((Q)=>{return sQ$[$]=Q,Q}).finally(()=>{delete Tp0[$]});return Tp0[$]=Y,Y}function fW6(){let $=process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN;return $&&$.trim()!==""?$:void 0}function xW6(){let $=process.env.STUDIO_SANDBOX_TEMPLATE_NAME;return $&&$.trim()!==""?$:void 0}function vW6(){let $=process.env.STUDIO_ENV;return $&&$.trim()!==""?$:void 0}function yW6(){let $=process.env.STUDIO_SANDBOX_SENTINEL_TOKEN;return $&&$.trim()!==""?$:void 0}function gW6(){let $=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME?.trim(),Z=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE?.trim();if(!$&&!Z)return;if(!$||!Z)throw Error("STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME and STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE must both be set, or both unset. Half-configured per-claim HTTPRoute routing would silently fail to attach.");return{name:$,namespace:Z}}async function G3$($,Z){let G=new kN(Z),X=fW6();switch($){case"agent-sandbox":{let{AgentSandboxProvider:Y}=await Promise.resolve().then(() => (Pp0(),pQ$)),Q=new jU(O1().encryptionKey);return new Y({stateStore:G,previewUrlPattern:X,sandboxTemplateName:xW6(),envName:vW6(),previewGateway:gW6(),sentinelToken:yW6(),meter:D8,mintCloneUrl:async(J,W)=>{if(!J.connectionId)return null;let K=t5$(J.cloneUrl);if(!K)return null;let{cloneUrl:U}=await SN(J.connectionId,K.owner,K.name,Z,Q,{bufferMs:W?.bufferMs});return U}})}case"user-desktop":throw Error("user-desktop provider cannot be instantiated without a per-run link claim \u2014 call resolveSandboxProvider, which binds the link before constructing the provider.");default:throw Error(`Unknown sandbox provider kind: ${String($)}`)}}async function LN0($,Z){let{DesktopSandboxProvider:G}=await Promise.resolve().then(() => (aQ$(),oQ$)),{getProxyDispatch:X}=await Promise.resolve().then(() => (qp0(),Rp0)),Y=new kN($.db);if(!Z)throw Error("buildDesktopProvider: userSub must be a non-empty string");let Q=X();return new G({userSub:Z,dispatch:Q,stateStore:Y})}function Ip0($,Z){return Z3$(Z,()=>G3$(Z,$.db))}async function hW6(){let $;try{$=Gw()}catch(G){return console.warn("[lifecycle] cannot resolve sandbox runner:",G instanceof Error?G.message:String(G)),null}return await Z3$($,()=>G3$($,H6().db))}function rn($,Z,G){let X=lN.get(Z);if(X){if(X.terminated){if(X.lastPhase)try{G(X.lastPhase)}catch{}return{unsubscribe:dW6}}if(X.listeners.add(G),X.lastPhase)try{G(X.lastPhase)}catch{}return eQ$(Z,X,G)}let Y=new AbortController,Q={lastPhase:null,terminated:!1,listeners:new Set([G]),abort:Y};return lN.set(Z,Q),lW6($,Z,Q),eQ$(Z,Q,G)}function dW6(){}function eQ$($,Z,G){return{unsubscribe(){if(lN.get($)!==Z)return;if(Z.listeners.delete(G),Z.listeners.size===0)lN.delete($),Z.abort.abort()}}}async function lW6($,Z,G){let X=null;try{for await(let Y of $.watchClaimLifecycle(Z,G.abort.signal)){if(G.abort.signal.aborted)break;G.lastPhase=Y;let Q=Y.kind==="ready"||Y.kind==="failed";if(Q)G.terminated=!0;let J=Array.from(G.listeners);for(let W of J)try{W(Y)}catch{}if(Q)break}}catch(Y){X=Y}finally{if(!G.terminated&&!G.abort.signal.aborted&&G.listeners.size>0){let Y={kind:"failed",reason:"unknown",message:X instanceof Error?X.message:"Lifecycle watcher ended unexpectedly"};G.lastPhase=Y,G.terminated=!0;for(let Q of Array.from(G.listeners))try{Q(Y)}catch{}}if(lN.get(Z)===G)lN.delete(Z)}}function mW6(){for(let $ of lN.values())$.abort.abort();lN.clear()}var _W6,bW6,$3$,sQ$,Tp0,cW6,uW6,lN;var on=O(()=>{MY();HQ();B5();i90();Tn();Bd();F8();_W6=Symbol.for("decocms.sandbox.lifecycle.runners"),bW6=Symbol.for("decocms.sandbox.lifecycle.inflight"),$3$=globalThis,sQ$=$3$[_W6]??={},Tp0=$3$[bW6]??={};cW6=Symbol.for("decocms.sandbox.lifecycle.shared-lifecycles"),uW6=globalThis,lN=uW6[cW6]??=new Map});async function _Y($,Z){let{userId:G,branch:X,virtualMcpMetadata:Y,explicitKind:Q}=Z;if(Q)return{provider:await an($,G,Q),kind:Q};if($.sandboxPreference==="agent-sandbox")return{provider:await an($,G,"agent-sandbox"),kind:"agent-sandbox"};if($.sandboxPreference==="user-desktop")return{provider:await LN0($,G),kind:"user-desktop"};if($.sandboxPreference==="cluster-default"){let w=Gw();return{provider:await an($,G,w),kind:w}}let[J,...W]=iW6(Y,G,X);if(J){let w=W.length===0?J:nW6(J,W);return{provider:await an($,G,w),kind:w}}let K=Y3$();return{provider:await an($,G,K),kind:K}}function iW6($,Z,G){let X=F5($)[Z]?.[G];if(!X)return[];let Y=KQ(X);return Object.keys(Y)}function nW6($,Z){let G=Y3$();if(G===$||Z.includes(G))return G;return $}function Y3$(){return Gw()}async function an($,Z,G){if(G!=="user-desktop")return Ip0($,G);return LN0($,Z)}var jV=O(()=>{f8();MY();qX();on()});var sn;var Mp0=O(()=>{sn={npm:{install:"npm install",run:($)=>`npm run ${$}`,runtime:"node"},pnpm:{install:"pnpm install",run:($)=>`pnpm run ${$}`,runtime:"node"},yarn:{install:"yarn install",run:($)=>`yarn run ${$}`,runtime:"node"},bun:{install:"bun install",run:($)=>`bun run ${$}`,runtime:"bun"},deno:{install:"deno install",run:($)=>`deno task ${$}`,runtime:"deno"}}});function zN0($){if(!$)return null;let Z=$.runtime;if(!Z||typeof Z!=="object")return null;let G=Z.env;if(!Array.isArray(G))return null;let X=[];for(let Y of G){if(!Y||typeof Y!=="object")continue;let Q=Y;if(typeof Q.key!=="string"||!Vu.test(Q.key))continue;if(Q.kind==="literal"&&typeof Q.value==="string"){X.push({key:Q.key,kind:"literal",value:Q.value});continue}if(Q.kind==="secret"&&typeof Q.secretId==="string"&&Q.secretId.length>0)X.push({key:Q.key,kind:"secret",secretId:Q.secretId})}return X.length===0?null:X}async function Q3$($,Z){M0(Z);let G=O0(Z);await Z.access.check();let X=y1(Z);if(!X)throw Error("User ID required");let Y=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!Y||Y.organization_id!==G.id)throw Error("Virtual MCP not found");let Q=Y.metadata??{},J=F5(Q),W=iW(J,X,$.branch,$.sandboxProviderKind);return{virtualMcp:Y,metadata:Q,userId:X,entry:W,organization:G}}function jN0($){let Z=$.runtime??null,X=Z?.selected??null,Y=Z?.port??null,Q=Z?.path??null;if(!X||!(X in sn))return{packageManager:null,runtime:null,port:Y,packageManagerPath:Q,runtimeBinPath:null};let J=sn[X].runtime;return{packageManager:X,runtime:J,port:Y,packageManagerPath:Q,runtimeBinPath:J==="deno"?"/opt/deno/bin":J==="bun"?"/opt/bun/bin":null}}var pv=O(()=>{f8();Mp0();qX()});async function PN0({ctx:$,runner:Z,handle:G,orgId:X,userId:Y,entries:Q}){if(!Q||Q.length===0)return;let J={};for(let K of Q){if(K.kind==="literal"){J[K.key]=K.value;continue}try{let{value:U}=await $.storage.secrets.resolveById(K.secretId,X,Y);J[K.key]=U}catch(U){if(U instanceof EW||U instanceof Dx){console.warn(`[SANDBOX_START] skipping env ${K.key}: ${U.message}. Re-link or recreate the secret to restore.`);continue}throw U}}if(Object.keys(J).length===0)return;let W=await Z.proxyDaemonRequest(G,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({env:J})});if(!W.ok){let K=await W.text().catch(()=>W.statusText);console.warn(`[SANDBOX_START] daemon rejected env patch (${W.status}): ${K}`)}}var kp0=O(()=>{k60()});async function K3$($,Z,G,X,Y){let Q=await YN({connectionId:$,tokenStorage:new b5(X,Y)});if(!Q.accessToken)return null;return w3$(Z,G,Q.accessToken)}function U3$($,Z){return w3$($,Z,null)}async function w3$($,Z,G){let X=new Map,Y=new Set(J3$.map((K)=>K.path));for(let K of Object.values(W3$))for(let U of K??[])Y.add(U);await Promise.all(Array.from(Y).map(async(K)=>{X.set(K,await tW6($,Z,K,G))}));let Q=J3$.find(({path:K})=>X.get(K)!==null);if(!Q)return null;let J=W3$[Q.pm]??[],W=null;for(let K of J)if(W=rW6(X.get(K)??null),W)break;return{packageManager:Q.pm,devPort:W}}async function tW6($,Z,G,X){let Y=`https://api.github.com/repos/${$}/${Z}/contents/${encodeURIComponent(G)}`;try{let Q={Accept:"application/vnd.github+json","User-Agent":"mesh-runtime-detect"};if(X)Q.Authorization=`token ${X}`;let J=await fetch(Y,{headers:Q,signal:AbortSignal.timeout(5000)});if(!J.ok)return null;let W=await J.json();if(!W.content||W.encoding!=="base64")return null;return Buffer.from(W.content,"base64").toString("utf8")}catch{return null}}function rW6($){if(!$)return null;try{let Z=JSON.parse($),G=Z.tasks??Z.scripts??{};return(G.dev??G.start??"").match(pW6)?.[1]??null}catch{return null}}var J3$,W3$,pW6;var F3$=O(()=>{QN();YJ();J3$=[{path:"deno.json",pm:"deno"},{path:"deno.jsonc",pm:"deno"},{path:"bun.lock",pm:"bun"},{path:"bunfig.toml",pm:"bun"},{path:"pnpm-lock.yaml",pm:"pnpm"},{path:"yarn.lock",pm:"yarn"},{path:"package-lock.json",pm:"npm"},{path:"package.json",pm:"bun"}],W3$={deno:["deno.json","deno.jsonc"],bun:["package.json"],pnpm:["package.json"],yarn:["package.json"],npm:["package.json"]},pW6=/(?:--port|PORT=|:)(\d{4,5})/});function AN0($,Z){return Z?`thread:${$}/${Z}`:`thread:${$}`}function tv($){if(!$||!$.startsWith("thread:"))return null;return $.slice(7).split("/")[0]||null}async function TN0($,Z){if(!Z)return null;let G=await $.storage.threads.get(Z).catch(()=>null);if(!G)return null;return G.metadata??{}}async function en($,Z){return(await TN0($,Z))?.githubRepo??null}async function H3$($,Z,G,X,Y,Q){let J=await TN0($,Z);if(!J)return;let W=An(F5(J),G,X,Y,Q);await $.storage.threads.update(Z,{metadata:{...J,sandboxMap:W}}).catch((K)=>console.warn("[thread-repo] setThreadSandboxMapEntry failed",K))}async function N3$($,Z){return F5(await TN0($,Z))}async function B3$($,Z,G,X,Y){let Q=await TN0($,Z);if(!Q)return;let J=Ni0(F5(Q),G,X,Y);if(!J)return;await $.storage.threads.update(Z,{metadata:{...Q,sandboxMap:J}}).catch((W)=>console.warn("[thread-repo] removeThreadSandboxMapEntry failed",W))}var $p=O(()=>{qX()});async function IN0($,Z){if(!$)return{hosts:[],allowSameHostDev:!1};let G;try{G=await $.presignedGetUrl("link-dispatch/_allowlist_probe",60,{requireFetchable:!0})}catch{return{hosts:[],allowSameHostDev:!1}}let X;try{X=new URL(G)}catch{return{hosts:[],allowSameHostDev:!1}}if(X.protocol!=="https:"&&X.protocol!=="http:")return{hosts:[],allowSameHostDev:!1};let Y=X.hostname,Q=oW6.has(Y);return{hosts:[Y],allowSameHostDev:Q&&!Z.isProduction}}var oW6;var Sp0=O(()=>{oW6=new Set(["127.0.0.1","localhost","::1","[::1]","0.0.0.0"])});import{z as aW}from"zod";async function RN0($,Z){M0(Z);let G=O0(Z),X=y1(Z);if(!X)throw Error("User ID required");let Y=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!Y||Y.organization_id!==G.id)throw Error("Virtual MCP not found");let Q=Y.metadata??{},J=iW(F5(Q),X,$.branch,$.sandboxProviderKind),W=$.sandboxProviderKind,{provider:K}=await _Y(Z,{userId:X,branch:$.branch,virtualMcpMetadata:Q,explicitKind:W});if(J){if(W!=="user-desktop")return J;if(await K.alive(J.sandboxHandle).catch(()=>!1))return J;await MN(Z.storage.virtualMcps,$.virtualMcpId,X,X,$.branch,W).catch((N)=>{console.warn("[ensureSandbox] failed to reap stale user-desktop entry",N)})}let w=await en(Z,tv($.branch)??Z.metadata?.threadId)??Q.githubRepo??null,{entry:F}=await O3$({ctx:Z,userId:X,orgId:G.id,virtualMcpId:$.virtualMcpId,branch:$.branch,metadata:Q,githubRepo:w,existing:null,providerKind:W,runner:K});return F}async function O3$($){let{ctx:Z,userId:G,orgId:X,virtualMcpId:Y,branch:Q,metadata:J,githubRepo:W,existing:K,runner:U}=$,{runtime:w,packageManager:F,port:H,packageManagerPath:N}=jN0(J),B;if(W){if(W.connectionId)await Vv({ctx:Z,connectionId:W.connectionId,organizationId:X,forceRefresh:!0,onLegacyMintError:(J0)=>{console.error("[provisionSandbox] repo-scoped legacy token mint failed",{connectionId:W.connectionId,error:J0.message})}});let{cloneUrl:o,gitUserName:B0,gitUserEmail:D0}=W.connectionId?await SN(W.connectionId,W.owner,W.name,Z.db,Z.vault):n90(W.owner,W.name);if(!F){let J0=W.connectionId?await K3$(W.connectionId,W.owner,W.name,Z.db,Z.vault):await U3$(W.owner,W.name);if(J0)F=J0.packageManager,w=sn[J0.packageManager].runtime,H=J0.devPort??H,await sW6(Z,Y,G,J0.packageManager,J0.devPort)}B={cloneUrl:o,...W.connectionId?{connectionId:W.connectionId}:{},userName:B0,userEmail:D0,branch:Q,displayName:`${W.owner}/${W.name}`}}let D=w&&F?{runtime:w,packageManager:F,...H!==null?{devPort:Number(H)}:{},...N?{packageManagerPath:N}:{}}:void 0,E=Zw({orgId:X,virtualMcpId:Y,branch:Q}),L=U.kind==="user-desktop"?await IN0(Z.objectStorage,{isProduction:O1().nodeEnv==="production"}):null,z=(U.kind==="user-desktop"||U.kind==="agent-sandbox")&&!O1().orgFsMountsDisabled,j;if(z){let o=Z.organization?.slug??(await Z.db.selectFrom("organization").select(["slug"]).where("id","=",X).executeTakeFirst())?.slug;if(o)j=await X50(Z,{orgSlug:o,orgId:X,baseUrl:j3()})}let P=await U.ensure({userId:G,projectRef:E},{branch:Q,repo:B,workload:D,tenant:{orgId:X,userId:G,...Z.organization?.slug?{orgSlug:Z.organization.slug}:{},...Z.organization?.name?{orgName:Z.organization.name}:{},...Z.auth.user?.email?{userEmail:Z.auth.user.email}:{},...Z.auth.user?.name?{userName:Z.auth.user.name}:{}},...L?{offloadAllowedHosts:L.hosts,offloadAllowSameHostDev:L.allowSameHostDev}:{},...j?{orgFsConfigJson:j}:{}}),A=J.runtime?.env??null;await PN0({ctx:Z,runner:U,handle:P.handle,orgId:X,userId:G,entries:A});let S=!!K&&K.sandboxHandle===P.handle&&K?.createdAt?K.createdAt:Date.now(),R=J.runtime?.selected??null,V=J.runtime?.port??null,i=J.runtime?.path??null,f={sandboxHandle:P.handle,previewUrl:P.previewUrl,sandboxApiUrl:P.previewUrl,sandboxProviderKind:U.kind,createdAt:S,startedWith:{packageManager:R,port:V,path:i}};await g5$(Z.storage.virtualMcps,Y,G,G,Q,$.providerKind,f);let v=tv(Q);if(v)await H3$(Z,v,G,Q,$.providerKind,f);let Z0=!K||K.sandboxHandle!==P.handle;return{entry:f,isNewVm:Z0}}async function sW6($,Z,G,X,Y){let Q=await $.storage.virtualMcps.findById(Z);if(!Q)return;let J=Q.metadata??{};await $.storage.virtualMcps.update(Z,G,{metadata:{...J,runtime:{selected:X,port:Y}}})}var aW6,Vp0;var qN0=O(()=>{MY();Y1();pv();kp0();qX();Tn();F3$();Mp0();jV();$p();Sp0();F8();BG();Gv();qX();aW6=aW.enum(["agent-sandbox","user-desktop","cluster"]),Vp0=$0({name:"SANDBOX_START",description:"Start a sandbox with the connected GitHub repo and dev server.",annotations:{title:"Start VM Preview",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:aW.object({virtualMcpId:aW.string().describe("Virtual MCP ID"),branch:aW.string().min(1).optional().describe("Optional git branch to check out. When omitted the handler generates a Bayer-style `<greek-letter>-<constellation>` name (e.g. `alpha-centauri`) and uses it. The resolved branch is returned in the response so callers can persist it."),sandboxProviderKind:aW6.optional().describe("Explicit runtime choice. Hosted provider is `agent-sandbox`; legacy `cluster` input is accepted only for compatibility and normalized to `agent-sandbox`. When omitted, defaults to `user-desktop` if the acting user's link daemon is online, else the env kind.")}),outputSchema:aW.object({previewUrl:aW.string().nullable(),sandboxHandle:aW.string(),branch:aW.string(),isNewVm:aW.boolean(),sandboxProviderKind:aW.enum(["agent-sandbox","user-desktop"])}),handler:async($,Z)=>{M0(Z);let G=O0(Z);await Z.access.check();let X=$.branch??I90(Z.auth.user?.name??Z.auth.user?.email?.split("@")[0]),Y=y1(Z);if(!Y)throw Error("User ID required");let Q=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!Q||Q.organization_id!==G.id)throw Error("Virtual MCP not found");let J=Q.metadata??{},W=$.sandboxProviderKind?eU($.sandboxProviderKind):void 0,{provider:K,kind:U}=await _Y(Z,{userId:Y,branch:X,virtualMcpMetadata:J,explicitKind:W}),w=iW(F5(J),Y,X,U),H=await en(Z,tv(X)??Z.metadata?.threadId)??J.githubRepo??null,{entry:N,isNewVm:B}=await O3$({ctx:Z,userId:Y,orgId:G.id,virtualMcpId:$.virtualMcpId,branch:X,metadata:J,githubRepo:H,existing:w,providerKind:U,runner:K});return{...N,branch:X,isNewVm:B,sandboxProviderKind:U}}})});async function eW6($,Z,G,X){try{let Y=$.organization;if(!Y)return;let Q=await l90($,X.virtualMcpId,Y,"tool-scripting",X.providerKind),J=await Z.proxyDaemonRequest(G,"/_sandbox/tools/sync",{method:"POST",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify(Q)});if(!J.ok)console.warn("[cluster-sandbox-fs] tools/sync failed",J.status,await J.text().catch(()=>""))}catch(Y){console.warn("[cluster-sandbox-fs] tools/sync failed",Y)}}async function Zp($,Z){let{provider:G,kind:X}=await _Y($,{userId:Z.userId,branch:Z.branch,virtualMcpMetadata:null}),Y=null,Q=()=>{if(!Y){if(Y=RN0({virtualMcpId:Z.virtualMcpId,branch:Z.branch,sandboxProviderKind:X},$).then((K)=>K.sandboxHandle),Y.catch(()=>{Y=null}),Z.syncTools)Y.then((K)=>eW6($,G,K,{virtualMcpId:Z.virtualMcpId,providerKind:X})).catch(()=>{})}return Y},J=Z.branch==="ephemeral"||X==="user-desktop";return $i0(G,{ensureHandle:Q,invalidateHandle:async()=>{let K=Y;if(Y=null,!J)return;try{await MN($.storage.virtualMcps,Z.virtualMcpId,Z.userId,Z.userId,Z.branch,X)}catch(U){console.warn("[cluster-sandbox-fs] failed to reap vmMap entry",U)}if(K&&typeof G.forgetHandle==="function")try{let U=await K;await G.forgetHandle(U)}catch(U){console.warn("[cluster-sandbox-fs] forgetHandle failed",U)}},canAutoRestart:J})}async function D3$($,Z){try{let G=await Zp($,Z),{stdout:X}=await G.onBash("test -d .deco && echo __DECO_SITE__");return X.includes("__DECO_SITE__")}catch(G){return console.warn("[cluster-sandbox-fs] .deco probe failed; assuming deco site",G),!0}}var MN0=O(()=>{MY();Hi0();jV();qN0();qX()});function rv($){let Z=$.toISOString();return`<current-context>
+`))>=0){let K=X.slice(0,W).trim();if(X=X.slice(W+1),!K)continue;yield JSON.parse(K)}}let Y=X.trim();if(Y)yield JSON.parse(Y)}finally{Z.releaseLock()}}var zQ$,jQ$,TQ$="gateway.networking.k8s.io",IQ$="v1",RQ$="httproutes",lJ6,pn,MQ$="mesh-sandbox-runner";var HN0=O(()=>{l5();ln();zQ$=class zQ$ extends Error{status;body;constructor($,Z,G){super(G);this.status=$;this.body=Z;this.name="KubeHttpError"}};jQ$=`/apis/${P9.CLAIM_API_GROUP}/${P9.CLAIM_API_VERSION}/namespaces`;lJ6=`/apis/${TQ$}/${IQ$}/namespaces`;pn={API_GROUP:TQ$,API_VERSION:IQ$,PLURAL:RQ$}});var NN0=O(()=>{l5();V90()});async function ON0($){try{let Z=await fetch(`${$}/health`,{signal:AbortSignal.timeout(mJ6)});if(!Z.ok)return null;let G=await Z.json();if(typeof G==="object"&&G!==null&&typeof G.bootId==="string"&&typeof G.ready==="boolean"&&G.setup&&typeof G.setup.running==="boolean"&&typeof G.setup.done==="boolean")return G;return null}catch{return null}}async function _Q$($){for(let Z=0;Z<SQ$;Z++){if(await ON0($)!==null)return;let G=(Math.random()*2-1)*iJ6;await O8(VQ$+G)}throw Error(`sandbox daemon at ${$} did not respond on /health within ${SQ$*VQ$/1000}s`)}async function nv($,Z,G,X,Y){return nJ6($,Z,"POST",G,X,Y)}async function nJ6($,Z,G,X,Y,Q){let J={...X};if(Y&&Y.rotateToken!==void 0)J.auth=Y;let W=await fetch(`${$}/_sandbox/config`,{method:G,headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:JSON.stringify(J),signal:AbortSignal.timeout(Q?.timeoutMs??CQ$)}),K=await W.text();if(!W.ok)throw new BN0(W.status,K);return JSON.parse(K)}async function bQ$($,Z,G){let X=await fetch(`${$}/_sandbox/orgfs-config`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${Z}`},body:G,signal:AbortSignal.timeout(CQ$)}),Y=await X.text();if(!X.ok)throw Error(`sandbox daemon /_sandbox/orgfs-config returned ${X.status}: ${Y}`);return JSON.parse(Y)}async function tn($,Z,G,X){let Y=new Headers(X.headers);for(let W of pJ6)Y.delete(W);Y.set("authorization",`Bearer ${Z}`);let Q=X.method!=="GET"&&X.method!=="HEAD",J=`${$}${G.startsWith("/")?G:`/${G}`}`;return fetch(J,{method:X.method,headers:Y,body:Q?X.body:void 0,redirect:"manual",signal:X.signal,duplex:Q?"half":void 0})}var BN0,mJ6=500,CQ$=30000,SQ$=25,VQ$=200,iJ6=50,pJ6;var fQ$=O(()=>{NN0();BN0=class BN0 extends Error{status;constructor($,Z){super(`sandbox daemon /_sandbox/config returned ${$}: ${Z}`);this.status=$;this.name="ConfigRequestError"}};pJ6=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length"]});async function*yQ$($){let Z=$.now??(()=>Date.now()),G=Z(),X=$.schedulingTimeoutMs??oJ6,Y={pod:{},sandbox:{},events:{hasPulling:!1,hasPulled:!1},startedAt:G},Q=[],J=null,W=!1,K=(z)=>{if(W)return;if(J){let j=J;J=null,j(z)}else Q.push(z)},U=()=>{if(Q.length>0)return Promise.resolve(Q.shift());if(W)return Promise.resolve(null);return new Promise((z)=>{J=z})},w=()=>{if(W)return;if(W=!0,J){let z=J;J=null,z(null)}},F=new AbortController,H=()=>{F.abort(),w()};if($.signal)if($.signal.aborted)F.abort(),w();else $.signal.addEventListener("abort",H,{once:!0});let N=Math.max(0,X-(Z()-G)),B=setTimeout(()=>K("tick"),N+100),D,E=new Promise((z)=>{D=z}),L=Promise.allSettled([aJ6($.kc,$.namespace,$.claimName,F.signal,Y,K,Z,D),eJ6($.kc,$.namespace,$.claimName,F.signal,Y,K),$W6($.kc,$.namespace,$.claimName,E,F.signal,Y,K,Z)]);try{let z=null,j=-1,P=xQ$(Y,X,Z);if(z=Bp0(P),!Np0(P))j=vQ$(P);if(yield P,Np0(P))return;while(!W){if(await U()===null)break;let M=xQ$(Y,X,Z);if(Np0(M)){let V=Bp0(M);if(V!==z)z=V,yield M;return}let S=vQ$(M);if(S<j)continue;let R=Bp0(M);if(R!==z)z=R,j=S,yield M}}finally{if(clearTimeout(B),F.abort(),$.signal)$.signal.removeEventListener("abort",H);w(),await L.catch(()=>{})}}function xQ$($,Z,G){let{pod:X,sandbox:Y,events:Q,startedAt:J}=$;if(Y.ready)return{kind:"ready"};let W=X.containerWaitingReason;if(W==="ImagePullBackOff"||W==="ErrImagePull")return{kind:"failed",reason:"image-pull-backoff",message:"Sandbox image failed to download. The cluster may be missing pull credentials or the image tag may not exist."};if(W==="CrashLoopBackOff")return{kind:"failed",reason:"crash-loop-backoff",message:"Sandbox crashed during startup and is now in CrashLoopBackOff. Check pod logs."};if(!X.scheduled&&Q.lastFailedSchedulingAt!==void 0&&G()-J>Z)return{kind:"failed",reason:"scheduling-timeout",message:Q.failedSchedulingMessage??`Pod could not be scheduled within ${Math.round(Z/1000)}s.`};if(X.containerRunning&&!X.containerReady)return{kind:"warming-daemon",since:J};if(Q.hasPulling&&!Q.hasPulled)return{kind:"pulling-image",since:J};if(W==="ContainerCreating"||W==="PodInitializing"||X.scheduled&&!X.containerRunning)return{kind:"starting-container",since:J};if(X.scheduledFalseReason==="Unschedulable"||Q.lastFailedSchedulingAt!==void 0&&!X.scheduled)return{kind:"waiting-for-capacity",since:J,message:Q.failedSchedulingMessage??X.scheduledFalseMessage,nodeClaim:Q.nominatedNodeClaim};return{kind:"claiming",since:J}}function Np0($){return $.kind==="ready"||$.kind==="failed"}function vQ$($){switch($.kind){case"claiming":return 0;case"waiting-for-capacity":return 1;case"pulling-image":return 2;case"starting-container":return 3;case"warming-daemon":return 4;case"ready":case"failed":return 99}}function Bp0($){switch($.kind){case"claiming":case"pulling-image":case"starting-container":case"warming-daemon":return $.kind;case"waiting-for-capacity":return`waiting-for-capacity:${$.message??""}:${$.nodeClaim??""}`;case"ready":return"ready";case"failed":return`failed:${$.reason}:${$.message}`}}async function aJ6($,Z,G,X,Y,Q,J,W){let K=`/api/v1/namespaces/${encodeURIComponent(Z)}/pods?watch=true&labelSelector=${encodeURIComponent(`${tJ6}=${G}`)}`;return DN0({kc:$,path:K,signal:X,label:`pod/${G}`,onEvent:(U)=>{if(U.type!=="ADDED"&&U.type!=="MODIFIED")return;let w=U.object;if(w.metadata?.name)W(w.metadata.name);sJ6(w,Y,J),Q("pod")}})}function sJ6($,Z,G){let Y=($.status?.conditions??[]).find((J)=>J.type==="PodScheduled");if(Y?.status==="True")Z.pod.scheduled=!0,Z.pod.scheduledFalseReason=void 0,Z.pod.scheduledFalseMessage=void 0;else if(Y?.status==="False")Z.pod.scheduled=!1,Z.pod.scheduledFalseReason=Y.reason,Z.pod.scheduledFalseMessage=Y.message;let Q=($.status?.containerStatuses??[]).find((J)=>J.name===rJ6);if(Q)Z.pod.containerWaitingReason=Q.state?.waiting?.reason,Z.pod.containerRunning=!!Q.state?.running,Z.pod.containerReady=Q.ready===!0}async function eJ6($,Z,G,X,Y,Q){let J=`/apis/${P9.CLAIM_API_GROUP}/${P9.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(Z)}/${P9.CLAIM_PLURAL}?watch=true&fieldSelector=${encodeURIComponent(`metadata.name=${G}`)}`;return DN0({kc:$,path:J,signal:X,label:`sandboxclaim/${G}`,onEvent:(W)=>{if(W.type!=="ADDED"&&W.type!=="MODIFIED")return;let U=W.object.status?.conditions?.find((w)=>w.type==="Ready");if(!U)return;if(U.status==="True")Y.sandbox.ready=!0,Y.sandbox.notReadyReason=void 0,Y.sandbox.notReadyMessage=void 0;else Y.sandbox.ready=!1,Y.sandbox.notReadyReason=U.reason,Y.sandbox.notReadyMessage=U.message;Q("sandbox")}})}async function $W6($,Z,G,X,Y,Q,J,W){let K=await Promise.race([X,new Promise((w)=>{if(Y.aborted){w(G);return}Y.addEventListener("abort",()=>w(G),{once:!0})})]);if(Y.aborted)return;let U=`/api/v1/namespaces/${encodeURIComponent(Z)}/events?watch=true&fieldSelector=${encodeURIComponent(`involvedObject.name=${K},involvedObject.kind=Pod`)}`;return DN0({kc:$,path:U,signal:Y,label:`events/${G}`,onEvent:(w)=>{if(w.type!=="ADDED"&&w.type!=="MODIFIED")return;let F=w.object,H=F.reason;if(!H)return;switch(H){case"Pulling":Q.events.hasPulling=!0;break;case"Pulled":Q.events.hasPulling=!0,Q.events.hasPulled=!0;break;case"FailedScheduling":Q.events.lastFailedSchedulingAt=W(),Q.events.failedSchedulingMessage=F.message;break;case"Nominated":{let N=F.message?.match(/nodeclaim\/([\w-]+)/);if(N)Q.events.nominatedNodeClaim=N[1];break}default:return}J("event")}})}async function gQ$($){let{kc:Z,namespace:G,labelSelector:X,signal:Y,onDelete:Q}=$,J=`/apis/${P9.CLAIM_API_GROUP}/${P9.CLAIM_API_VERSION}/namespaces/${encodeURIComponent(G)}/${P9.CLAIM_PLURAL}?watch=true&labelSelector=${encodeURIComponent(X)}`;return DN0({kc:Z,path:J,signal:Y,label:"sandboxclaim-reaper",onEvent:(W)=>{if(W.type!=="DELETED")return;let K=W.object.metadata?.name;if(K)Q(K)}})}async function DN0($){let{kc:Z,path:G,signal:X,label:Y,onEvent:Q}=$,J=0;while(!X.aborted){try{let K=await EV(Z,{method:"GET",path:G,signal:X,headers:{accept:"application/json"},stream:!0});if(!K.ok||!K.body){try{await K.body?.cancel()}catch{}if(K.status===401||K.status===403){console.warn(`[lifecycle-watcher] ${Y} stopped: watch denied (${K.status} ${K.statusText}). `+"The kubeconfig in use cannot watch SandboxClaims \u2014 if you are running locally, "+"this provider should not be active (check STUDIO_SANDBOX_PROVIDER / your sandbox preference).");return}throw Error(`watch handshake failed: ${K.status} ${K.statusText}`)}J=0;for await(let U of Hp0(K.body)){if(X.aborted)return;try{Q(U)}catch(w){console.warn(`[lifecycle-watcher] ${Y} onEvent threw: ${w instanceof Error?w.message:String(w)}`)}}}catch(K){if(X.aborted)return;let U=K instanceof Error?K.message:String(K);console.warn(`[lifecycle-watcher] ${Y} watch ended: ${U}`)}if(X.aborted)return;let W=mX(5000,250,J,2,0);J+=1,await O8(W,{signal:X}).catch(()=>{})}}var tJ6="studio.decocms.com/sandbox-handle",rJ6="sandbox",oJ6=300000;var hQ$=O(()=>{l5();ln();HN0()});async function cQ$($,Z,G){let X=new Map;for(let Y of $){let Q=Z(Y);if(!Q)continue;let J=X.get(Q);if(J)J.push(Y);else X.set(Q,[Y])}await Promise.allSettled([...X.values()].map(async(Y)=>{for(let Q of Y)await G(Q).catch(()=>{})}))}import{createHash as ZW6,randomBytes as GW6,randomUUID as XW6}from"crypto";import*as mQ$ from"net";import{PassThrough as YW6}from"stream";function QW6($){if($ instanceof Error)return $.message;if($&&typeof $==="object"){let Z=$;if(Z.error instanceof Error)return Z.error.message;if(typeof Z.message==="string"&&Z.message)return Z.message}return String($)}class jp0{kind=_X;records=new Map;inflight=new M90;stateStore;previewUrlPattern;kubeConfig;portForward;namespace;sandboxTemplateName;envName;tokenGenerator;idleTtlMs;metrics;previewGateway;sentinelToken;mintCloneUrl;closed=!1;claimWatchAbort=new AbortController;constructor($={}){this.stateStore=$.stateStore??null,this.previewUrlPattern=$.previewUrlPattern??null,this.kubeConfig=$.kubeConfig??EW6(),this.portForward=new mn0(this.kubeConfig),this.namespace=$.namespace??JW6,this.sandboxTemplateName=$.sandboxTemplateName??WW6,this.envName=TW6($.envName),this.tokenGenerator=$.tokenGenerator??(()=>GW6(UW6).toString("hex")),this.idleTtlMs=$.idleTtlMs??FW6,this.metrics=$.meter?DW6($.meter):null,this.previewGateway=$.previewGateway&&$.previewUrlPattern?{...$.previewGateway}:null;let Z=$.sentinelToken?.trim()??"";this.sentinelToken=Z.length>0?Z:null,this.mintCloneUrl=$.mintCloneUrl,this.startClaimReaper(),this.startCredentialRefresher()}startClaimReaper(){let $=["app.kubernetes.io/managed-by=studio","app.kubernetes.io/name=studio-sandbox",...this.envName?[`${vQ.env}=${this.envName}`]:[]].join(",");gQ$({kc:this.kubeConfig,namespace:this.namespace,labelSelector:$,signal:this.claimWatchAbort.signal,onDelete:(Z)=>this.invalidateRecord(Z)})}async ensure($,Z={}){let G=RN($,Z.branch??Z.repo?.branch??null);return this.inflight.run(G,()=>k90(this.stateStore,$,_X,(X)=>this.ensureLocked($,G,Z,X)))}async delete($){let Z=await this.getRecord($);if(this.records.delete($),Z)this.closeForwarder(Z.daemonForward),this.metrics?.active.add(-1,Lp0(Z.tenant));if(await this.deleteHttpRouteIfManaged($).catch((G)=>{console.warn(`[${x9}] HTTPRoute delete failed for ${$}: ${G instanceof Error?G.message:String(G)}`)}),await cN(this.kubeConfig,this.namespace,$),this.stateStore)if(Z)await this.stateStore.delete(Z.id,_X);else await this.stateStore.deleteByHandle(_X,$)}async alive($){return await ww(this.kubeConfig,this.namespace,$)!==void 0}watchClaimLifecycle($,Z){return yQ$({kc:this.kubeConfig,namespace:this.namespace,claimName:$,signal:Z})}async getPreviewUrl($){let Z=await this.getRecord($);if(!Z)return null;return this.composePreviewUrl(Z)}async proxyDaemonRequest($,Z,G){let X=await this.getRecord($);if(!X&&this.previewUrlPattern&&this.stateStore){let K=await this.stateStore.getByHandle(_X,$),U=K?.state,w=U?.token;if(K&&w){let H=`http://${U?.adoptedSandboxName??$}.${this.namespace}.svc.cluster.local:${uN}`;try{let N=await tn(H,w,Z,G);if(N.status!==404)return N;try{await N.body?.cancel()}catch{}}catch{}}}if(!X)X=await this.resurrectByHandle($);if(!X)return new Response(JSON.stringify({error:"sandbox not found"}),{status:404,headers:{"content-type":"application/json"}});let Y=X,Q=performance.now(),J=0,W=!(G.body instanceof ReadableStream);try{let K=await tn(X.daemonUrl,X.token,Z,G);if(K.status===401&&W){this.invalidateRecord($);let U=await this.getRecord($).catch(()=>null)??await this.resurrectByHandle($).catch(()=>null);if(U)Y=U,K=await tn(U.daemonUrl,U.token,Z,G)}return J=K.status,K}catch(K){if(!W)throw K;this.invalidateRecord($);let U=await this.resurrectByHandle($)??await this.getRecord($).catch(()=>null);if(!U)throw K;Y=U;let w=await tn(U.daemonUrl,U.token,Z,G);return J=w.status,w}finally{this.recordProxyDuration("daemon",J,Y,performance.now()-Q)}}async adoptLiveClaim($,Z){if(this.records.has(Z))return!0;let G=await ww(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!G||G.metadata?.deletionTimestamp)return!1;return await this.inflight.run(Z,async()=>{let Y=this.records.get(Z);if(Y)return this.toSandbox(Y);let Q=await this.adopt($,Z,G);if(!Q)throw Error(`cannot adopt live claim ${Z}`);return k90(this.stateStore,$,_X,(J)=>this.finish(Q,J,!0,!0,"adopt"))}).catch(()=>null)!=null}async resolvePreviewUpstreamUrl($){if(this.previewUrlPattern)return`http://${await this.resolveServiceNameForHandle($)}.${this.namespace}.svc.cluster.local:${uN}`;let Z=await this.getRecord($);if(Z)return Z.daemonUrl;let G=await this.resurrectByHandle($);return G?G.daemonUrl:null}async resolveServiceNameForHandle($){let Z=this.records.get($);if(Z)return Z.adoptedSandboxName;if(this.stateStore){let X=(await this.stateStore.getByHandle(_X,$).catch(()=>null))?.state?.adoptedSandboxName;if(X)return X}return $}async proxyPreviewRequest($,Z){let G=performance.now(),X=this.records.get($)??null,Y=0;try{let Q=await this.resolvePreviewUpstreamUrl($);if(!Q){Y=404;let B=Dp0(404,{error:"sandbox not found"});return B.headers.set(zV,"1"),B}let J=new URL(Z.url);if((J.pathname==="/_sandbox"||J.pathname.startsWith("/_sandbox/")||J.pathname==="/_decopilot_vm"||J.pathname.startsWith("/_decopilot_vm/"))&&Z.method!=="GET")return Y=404,Dp0(404,{error:"not found"});let K=(B)=>`${B}${J.pathname}${J.search}`,U=new Headers(Z.headers);for(let B of BW6)U.delete(B);let w=Z.method!=="GET"&&Z.method!=="HEAD",F={method:Z.method,headers:U,body:w?Z.body:void 0,redirect:"manual",signal:Z.signal,duplex:w?"half":void 0},H;try{H=await fetch(K(Q),F)}catch(B){let D=`${Q}${J.pathname}`;if(console.warn(`[${x9}] preview fetch to ${D} failed: ${B instanceof Error?B.message:String(B)}`),Z.method==="GET"||Z.method==="HEAD"){if(this.invalidateRecord($),await this.resurrectByHandle($).catch(()=>null)){let z=await this.resolvePreviewUpstreamUrl($);if(z)try{H=await fetch(K(z),F);let j=new Headers;for(let[P,A]of H.headers.entries())if(!uQ$.includes(P.toLowerCase()))j.set(P,A);return Y=H.status,new Response(H.body,{status:H.status,statusText:H.statusText,headers:j})}catch(j){console.warn(`[${x9}] preview fetch retry to ${D} failed: ${j instanceof Error?j.message:String(j)}`)}}}else this.invalidateRecord($);Y=502;let E=Dp0(502,{error:"sandbox daemon unreachable"});return E.headers.set(zV,"1"),E}let N=new Headers;for(let[B,D]of H.headers.entries())if(!uQ$.includes(B.toLowerCase()))N.set(B,D);return Y=H.status,new Response(H.body,{status:H.status,statusText:H.statusText,headers:N})}finally{this.recordProxyDuration("preview",Y,X,performance.now()-G,$)}}async ensureLocked($,Z,G,X){if(G.image)console.warn(`[${x9}] opts.image ignored (template ${this.sandboxTemplateName} pins image): got ${G.image}`);if(X){let J=await X.get($,_X);if(J){let W=await this.rehydrate($,Z,J);if(W)return await this.refreshDaemonGitCredential(W,G),this.finish(W,X,!1,!0,"resume");await X.delete($,_X)}}let Y=await ww(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(Y)if(Y.metadata?.deletionTimestamp)await KN0(this.kubeConfig,this.namespace,Z).catch((J)=>{console.warn(`[${x9}] wait for terminating claim ${Z} failed: ${J instanceof Error?J.message:String(J)}`)});else{let J=await this.adopt($,Z,Y).catch((W)=>{return console.warn(`[${x9}] adopt ${Z} failed, recreating: ${W instanceof Error?W.message:String(W)}`),null});if(J)return await this.refreshDaemonGitCredential(J,G),this.finish(J,X,!0,!0,"adopt");await cN(this.kubeConfig,this.namespace,Z).catch(()=>{}),await KN0(this.kubeConfig,this.namespace,Z).catch((W)=>{console.warn(`[${x9}] wait for deleted claim ${Z} failed: ${W instanceof Error?W.message:String(W)}`)})}let Q=await this.provision($,Z,G);return this.finish(Q,X,!0,!1,"fresh")}async finish($,Z,G,X,Y){let Q=this.records.get($.handle),J=Q!==void 0;if(Q&&Q.daemonForward!==$.daemonForward)this.closeForwarder(Q.daemonForward);if(this.records.set($.handle,$),G)await this.persist(Z,$);if(X)await PQ$(this.kubeConfig,this.namespace,$.handle,this.computeShutdownTime()).catch((W)=>console.warn(`[${x9}] TTL refresh failed for ${$.handle}: ${W instanceof Error?W.message:String(W)}`));if(this.metrics){let W=Lp0($.tenant);if(this.metrics.ensureOutcome.add(1,{...W,outcome:Y}),!J)this.metrics.active.add(1,W)}return this.toSandbox($)}buildEnvMap($,Z){let G={},X=[];for(let[Y,Q]of Object.entries($.env??{}))if(wW6.has(Y))X.push(Y);else G[Y]=Q;if(X.length>0)console.warn(`[${x9}] opts.env keys overlap reserved bootstrap names and were dropped: ${X.join(",")}`);return{...G,DAEMON_TOKEN:Z.token,DAEMON_BOOT_ID:Z.daemonBootId,APP_ROOT:Z.workdir,PROXY_PORT:String(uN)}}buildClaim($,Z,G){let X=this.sentinelToken!==null,Y=X?[]:Object.entries(this.buildEnvMap(Z,G)).sort(([W],[K])=>W<K?-1:W>K?1:0).map(([W,K])=>({name:W,value:K})),Q=qW6(Z),J=Object.keys(Q).length>0;return{apiVersion:`${P9.CLAIM_API_GROUP}/${P9.CLAIM_API_VERSION}`,kind:"SandboxClaim",metadata:{name:$,namespace:this.namespace,labels:{"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[vQ.env]:this.envName}:{},...Ep0(Z.tenant)},...J?{annotations:Q}:{}},spec:{sandboxTemplateRef:{name:this.sandboxTemplateName},additionalPodMetadata:{labels:Ep0(Z.tenant,{[vQ.role]:"claimed",[vQ.sandboxHandle]:$,...this.envName?{[vQ.env]:this.envName}:{}}),...J?{annotations:Q}:{}},env:Y,warmpool:X?"default":"none",lifecycle:{shutdownPolicy:"Delete",shutdownTime:this.computeShutdownTime()}}}}async provision($,Z,G){let X=this.tokenGenerator(),Y=XW6(),Q=Op0,J=this.buildClaim(Z,G,{token:X,daemonBootId:Y,workdir:Q});try{await nn(this.kubeConfig,this.namespace,J)}catch(H){if(H instanceof dn)await KN0(this.kubeConfig,this.namespace,Z),await nn(this.kubeConfig,this.namespace,J);else throw H}let W;try{W=await AQ$(this.kubeConfig,this.namespace,Z),await FN0(this.kubeConfig,this.namespace,W)}catch(H){throw await cN(this.kubeConfig,this.namespace,Z).catch(()=>{}),H}try{await this.ensureServicePortForAdoptedSandbox(W),await this.ensureHttpRouteForHandle(Z,W,G.tenant??null)}catch(H){throw await cN(this.kubeConfig,this.namespace,Z).catch(()=>{}),H}let K=await this.openForwarder(W,uN,Z),U=`http://127.0.0.1:${K.localPort}`,w=this.workloadConfigPayload(G),F=Y;try{if(await _Q$(U),this.sentinelToken!==null){let H=await ON0(U);if(H)F=H.bootId;await nv(U,this.sentinelToken,w??{},{rotateToken:X})}else if(w)await nv(U,X,w);if(G.orgFsConfigJson)await bQ$(U,X,G.orgFsConfigJson).catch((H)=>console.warn("[org-fs] sidecar config relay failed",H))}catch(H){throw this.closeForwarder(K),await this.deleteHttpRouteIfManaged(Z).catch(()=>{}),await cN(this.kubeConfig,this.namespace,Z).catch(()=>{}),H}return{id:$,handle:Z,adoptedSandboxName:W,token:X,workdir:Q,daemonUrl:U,daemonForward:K,workload:G.workload??null,daemonBootId:F,tenant:G.tenant??null,ensureOpts:kW6(G)}}workloadConfigPayload($){return sm0({runtime:$?.workload?.runtime??"node",packageManager:$?.workload?.packageManager?{name:$.workload.packageManager,...$.workload.packageManagerPath?{path:$.workload.packageManagerPath}:{}}:null,repo:$?.repo??null,port:$?.workload?.devPort??KW6,tenant:$?.tenant??void 0})}async refreshDaemonGitCredential($,Z){let G=em0(Z);if(!G)return;try{await nv($.daemonUrl,$.token,G)}catch(X){console.warn(`[${x9}] git credential refresh failed for ${$.handle}: ${X instanceof Error?X.message:String(X)}`)}}async withFreshCloneUrl($,Z){if(!this.mintCloneUrl)return $;try{let G=await this.mintCloneUrl($,Z!==void 0?{bufferMs:Z}:void 0);return G?{...$,cloneUrl:G}:$}catch(G){return console.warn(`[${x9}] clone credential re-mint failed: ${G instanceof Error?G.message:String(G)}`),$}}startCredentialRefresher(){if(!this.mintCloneUrl)return;let{signal:$}=this.claimWatchAbort;(async()=>{while(!$.aborted){if(await O8(HW6,{signal:$}).catch(()=>{}),$.aborted)break;try{await this.refreshAllGitCredentials()}catch(Z){console.warn(`[${x9}] periodic credential refresh failed: ${Z instanceof Error?Z.message:String(Z)}`)}}})()}async refreshAllGitCredentials(){await cQ$(this.records.values(),($)=>$.ensureOpts?.repo?.connectionId,async($)=>{if(this.claimWatchAbort.signal.aborted)return;let Z=$.ensureOpts?.repo;if(!Z)return;let G=await this.withFreshCloneUrl(Z,NW6);await this.refreshDaemonGitCredential($,{...$.ensureOpts,repo:G}),$.ensureOpts={...$.ensureOpts,repo:G}})}async rebootstrapDaemon($,Z,G){if(this.sentinelToken===null)return!1;let X=this.workloadConfigPayload(G)??{};try{return await nv($,this.sentinelToken,X,{rotateToken:Z}),!0}catch(Y){if(Y instanceof BN0&&Y.status===401)try{return await nv($,Z,X,{rotateToken:Z}),!0}catch(Q){return console.warn(`[${x9}] re-bootstrap retry with claim token failed: ${Q instanceof Error?Q.message:String(Q)}`),!1}return console.warn(`[${x9}] re-bootstrap failed: ${Y instanceof Error?Y.message:String(Y)}`),!1}}async ensureServicePortForAdoptedSandbox($){if(!this.previewGateway||!this.previewUrlPattern)return;await kQ$(this.kubeConfig,this.namespace,$,{name:"daemon",port:uN,targetPort:uN})}async ensureHttpRouteForHandle($,Z,G){if(!this.previewGateway||!this.previewUrlPattern)return;let X=SW6(this.previewUrlPattern,$);if(!X)throw new f9(`Unable to derive preview hostname for ${$} from pattern: ${this.previewUrlPattern}`);let Y={apiVersion:`${pn.API_GROUP}/${pn.API_VERSION}`,kind:"HTTPRoute",metadata:{name:$,namespace:this.namespace,labels:Ep0(G??void 0,{[vQ.role]:"claimed",[vQ.sandboxHandle]:$,"app.kubernetes.io/name":"studio-sandbox","app.kubernetes.io/managed-by":"studio",...this.envName?{[vQ.env]:this.envName}:{}})},spec:{parentRefs:[{kind:"Gateway",group:"gateway.networking.k8s.io",name:this.previewGateway.name,namespace:this.previewGateway.namespace}],hostnames:[X],rules:[{backendRefs:[{group:"",kind:"Service",name:Z,port:uN}]}]}};await UN0(this.kubeConfig,this.namespace,Y)}async deleteHttpRouteIfManaged($){if(!this.previewGateway)return;await wN0(this.kubeConfig,this.namespace,$)}async rehydrate($,Z,G){let X=G.state;if(!X.adoptedSandboxName&&!X.podName||!X.token)return null;let Y=await ww(this.kubeConfig,this.namespace,Z).catch(()=>{return});if(!Y||!dQ$(Y))return null;let Q=Y.status?.sandbox?.name??X.adoptedSandboxName??X.podName??Z,J=await this.openAndProbeDaemon(Q,Z);if(!J)return null;if(X.daemonBootId&&X.daemonBootId!==J.bootId){if(this.sentinelToken!==null){let W=X.ensureOpts?.repo?{...X.ensureOpts,repo:await this.withFreshCloneUrl(X.ensureOpts.repo)}:X.ensureOpts??null;if(!await this.rebootstrapDaemon(J.daemonUrl,X.token,W))return this.closeForwarder(J.daemonForward),null}else console.warn(`[${x9}] daemon restart detected (handle=${Z}): stored bootId=${X.daemonBootId} live bootId=${J.bootId}`);await this.stateStore?.put($,_X,{handle:Z,state:{...X,daemonBootId:J.bootId}}).catch((W)=>console.warn(`[${x9}] bootId persist failed for ${Z}: ${W instanceof Error?W.message:String(W)}`))}return{id:$,handle:Z,adoptedSandboxName:Q,token:X.token,workdir:X.workdir??Op0,daemonUrl:J.daemonUrl,daemonForward:J.daemonForward,workload:X.workload??null,daemonBootId:J.bootId,tenant:X.tenant??null,ensureOpts:X.ensureOpts??null}}async adopt($,Z,G){if(!dQ$(G))return null;let X=G.status?.sandbox?.name??Z;if(this.sentinelToken!==null)return null;let Y=LW6(G);if(!Y)return null;let Q=await this.openAndProbeDaemon(X,Z);if(!Q)return null;let J=MW6(G);if(this.previewGateway)await this.ensureServicePortForAdoptedSandbox(X).catch((W)=>{console.warn(`[${x9}] Service port backfill failed for ${Z}: ${W instanceof Error?W.message:String(W)}`)}),await this.ensureHttpRouteForHandle(Z,X,J).catch((W)=>{console.warn(`[${x9}] HTTPRoute backfill failed for ${Z}: ${W instanceof Error?W.message:String(W)}`)});return{id:$,handle:Z,adoptedSandboxName:X,token:Y,workdir:Op0,daemonUrl:Q.daemonUrl,daemonForward:Q.daemonForward,workload:null,daemonBootId:Q.bootId,tenant:J,ensureOpts:null}}async openAndProbeDaemon($,Z){let G=await this.openForwarder($,uN,Z).catch(()=>null);if(!G)return null;let X=`http://127.0.0.1:${G.localPort}`,Y=await ON0(X);if(!Y)return this.closeForwarder(G),null;return{daemonForward:G,daemonUrl:X,bootId:Y.bootId}}async getRecord($){let Z=this.records.get($);if(Z)return Z;if(!this.stateStore)return null;let G=await this.stateStore.getByHandle(_X,$);if(!G)return null;let X=await this.rehydrate(G.id,$,G);if(X)this.records.set($,X);return X}async resurrectByHandle($){if(!this.stateStore)return null;let Z=await this.stateStore.getByHandle(_X,$);if(!Z)return null;let G=Z.state.ensureOpts;if(!G)return null;let X=G.repo?{...G,repo:await this.withFreshCloneUrl(G.repo)}:G;return await this.ensure(Z.id,X),this.records.get($)??null}invalidateRecord($){let Z=this.records.get($);if(!Z)return;this.records.delete($),this.closeForwarder(Z.daemonForward)}recordProxyDuration($,Z,G,X,Y){if(!this.metrics)return;this.metrics.proxyDurationMs.record(X,{...Lp0(G?.tenant??null),source:$,sandbox_handle:G?.handle??Y??"",status_code:Z||0})}composePreviewUrl($){if(this.previewUrlPattern)return S90(this.previewUrlPattern,$.handle);return`http://127.0.0.1:${$.daemonForward.localPort}/`}toSandbox($){return{handle:$.handle,workdir:$.workdir,previewUrl:this.composePreviewUrl($)}}async persist($,Z){if(!$)return;let G={adoptedSandboxName:Z.adoptedSandboxName,token:Z.token,workdir:Z.workdir,workload:Z.workload,daemonBootId:Z.daemonBootId,tenant:Z.tenant,...Z.ensureOpts?{ensureOpts:Z.ensureOpts}:{}};await $.put(Z.id,_X,{handle:Z.handle,state:G})}computeShutdownTime(){return new Date(Date.now()+this.idleTtlMs).toISOString()}openForwarder($,Z,G=$){let X=zW6(G,Z);return new Promise((Y,Q)=>{let J=(W,K)=>{let U=mQ$.createServer((w)=>this.handleForwardedConnection(w,$,Z,G));U.once("error",(w)=>{if(w.code==="EADDRINUSE"&&K<OW6){try{U.close()}catch{}let F=zp0+(W-zp0+1)%iQ$;J(F,K+1);return}Q(w)}),U.listen(W,"127.0.0.1",()=>{let w=U.address();if(!w||typeof w==="string"){U.close(),Q(Error("port-forward listener failed to bind"));return}Y({server:U,localPort:w.port})})};J(X,0)})}handleForwardedConnection($,Z,G,X){let Y=new YW6,Q=null,J=!1,W=()=>{if(J)return;if(J=!0,Y.destroy(),Q)try{Q.close()}catch{}if(!$.destroyed)$.destroy()};$.pipe(Y),$.on("error",W),$.on("close",W),this.portForward.portForward(this.namespace,Z,[G],$,null,Y).then((K)=>{let U=typeof K==="function"?K():K;if(!U){W();return}if(Q=U,Q.on("close",W),Q.on("error",()=>{this.invalidateRecord(X),W()}),J)try{Q.close()}catch{}}).catch((K)=>{console.warn(`[${x9}] port-forward to ${Z}:${G} failed: ${QW6(K)}`),this.invalidateRecord(X),W()})}closeForwarder($){$.server.close((Z)=>{if(Z)console.warn(`[${x9}] port-forward close on :${$.localPort} errored: ${Z instanceof Error?Z.message:String(Z)}`)})}close(){if(this.closed)return;this.closed=!0,this.claimWatchAbort.abort();for(let $ of this.records.values())this.closeForwarder($.daemonForward);this.records.clear()}}function DW6($){return{active:$.createUpDownCounter("studio.sandbox.active",{description:"Active sandbox count, by runner kind and owning org. Cross-checks the cAdvisor-derived count from the cluster \u2014 divergence between the two indicates orphaned claims (studio deleted but K8s didn't reap) or unattributed pods.",unit:"{sandbox}"}),ensureOutcome:$.createCounter("studio.sandbox.ensure.outcome",{description:"Outcome of each ensure() call: fresh provision, resume from state-store after restart, or adopt of a cluster-side claim studio didn't know about. Cold-start ratio is the primary input for warm-pool sizing.",unit:"{call}"}),proxyDurationMs:$.createHistogram("studio.sandbox.proxy.duration_ms",{description:"Wall-clock latency of studio-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",unit:"ms"})}}function EW6(){let $=new uv;return $.loadFromDefault(),$}function dQ$($){return Boolean($.status?.conditions?.some((Z)=>Z.type==="Ready"&&Z.status==="True"))}function LW6($){let Z=$.spec?.env;if(!Z)return null;for(let G of Z)if(G.name==="DAEMON_TOKEN"&&G.value)return G.value;return null}function zW6($,Z){let G=ZW6("sha256").update(`${$}:${Z}`).digest();return zp0+G.readUInt32BE(0)%iQ$}function Dp0($,Z){return new Response(JSON.stringify(Z),{status:$,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function lQ$($){let Z=$.slice(0,PW6);return jW6.test(Z)?Z:""}function TW6($){if($===void 0)return null;let Z=$.trim();if(Z==="")return null;if(!AW6.test(Z))throw Error(`AgentSandboxProvider: envName=${JSON.stringify(Z)} is not a valid DNS-label-safe environment name (lowercase alphanumeric or '-', starts with a letter, ends alphanumeric, \u226432 chars). Studio sets this from STUDIO_ENV; check the studio chart's configMap.`);return Z}function Ep0($,Z={}){let G={...Z};if($){let X=lQ$($.orgId),Y=lQ$($.userId);if(X)G[vQ.orgId]=X;if(Y)G[vQ.userId]=Y}return G}function LV($){let Z="";for(let G of $){let X=G.codePointAt(0)??0;Z+=X<32||X===127?" ":G}return Z.slice(0,IW6)}function RW6($){try{let Z=new URL($);return Z.username="",Z.password="",Z.toString()}catch{return""}}function qW6($){let Z={},G=$.tenant;if(G?.orgSlug)Z[LJ.orgSlug]=LV(G.orgSlug);if(G?.orgName)Z[LJ.orgName]=LV(G.orgName);if(G?.userEmail)Z[LJ.userEmail]=LV(G.userEmail);if(G?.userName)Z[LJ.userName]=LV(G.userName);let X=$.repo;if(X){if(X.displayName)Z[LJ.gitRepo]=LV(X.displayName);let Y=RW6(X.cloneUrl);if(Y)Z[LJ.gitRepoUrl]=LV(Y);let Q=$.branch??X.branch;if(Q)Z[LJ.gitBranch]=LV(Q)}return Z}function MW6($){let Z=$.metadata?.labels;if(!Z)return null;let G=Z[vQ.orgId],X=Z[vQ.userId];if(!G||!X)return null;let Y=$.metadata?.annotations??{};return{orgId:G,userId:X,orgSlug:Y[LJ.orgSlug],orgName:Y[LJ.orgName],userEmail:Y[LJ.userEmail],userName:Y[LJ.userName]}}function Lp0($){return{org_id:$?.orgId??"",user_id:$?.userId??"",runner_kind:_X}}function kW6($){let Z={};if($.repo)Z.repo=$.repo;if($.workload)Z.workload=$.workload;if($.env&&Object.keys($.env).length>0)Z.env=$.env;if($.tenant)Z.tenant=$.tenant;return Object.keys(Z).length>0?Z:null}function SW6($,Z){try{return new URL(S90($,Z)).hostname||null}catch{return null}}var _X="agent-sandbox",x9="AgentSandboxProvider",zV="x-sandbox-preview-not-ready",JW6="agent-sandbox-system",WW6="studio-sandbox",uN=9000,KW6=3000,Op0="/app",UW6=32,wW6,FW6=900000,HW6=900000,NW6=1800000,BW6,uQ$,zp0=40000,iQ$=1e4,OW6=256,vQ,LJ,jW6,PW6=63,AW6,IW6=253;var nQ$=O(()=>{l5();Jp0();fQ$();C90();HN0();ln();hQ$();wW6=new Set(["DAEMON_TOKEN","DAEMON_BOOT_ID","APP_ROOT","PROXY_PORT"]),BW6=["cookie","host","connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","accept-encoding","content-length","upgrade"],uQ$=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];vQ={role:"studio.decocms.com/role",sandboxHandle:"studio.decocms.com/sandbox-handle",orgId:"studio.decocms.com/org-id",userId:"studio.decocms.com/user-id",env:"studio.decocms.com/env"},LJ={orgSlug:"studio.decocms.com/org-slug",orgName:"studio.decocms.com/org-name",userEmail:"studio.decocms.com/user-email",userName:"studio.decocms.com/user-name",gitRepo:"studio.decocms.com/git-repo",gitRepoUrl:"studio.decocms.com/git-repo-url",gitBranch:"studio.decocms.com/git-branch"},jW6=/^([A-Za-z0-9]([-A-Za-z0-9_.]*[A-Za-z0-9])?)?$/;AW6=/^[a-z]([a-z0-9-]{0,30}[a-z0-9])?$/});var pQ$={};X6(pQ$,{waitForSandboxReady:()=>FN0,getSandboxClaim:()=>ww,getHttpRoute:()=>qQ$,deleteSandboxClaim:()=>cN,deleteHttpRoute:()=>wN0,createSandboxClaim:()=>nn,applyHttpRoute:()=>UN0,SandboxTimeoutError:()=>DV,SandboxError:()=>f9,PREVIEW_NOT_READY_HEADER:()=>zV,KubeConfig:()=>uv,K8S_CONSTANTS:()=>P9,HTTPROUTE_CONSTANTS:()=>pn,AgentSandboxProvider:()=>jp0});var Pp0=O(()=>{Jp0();ln();HN0();nQ$()});class EN0{kind=dN;userSub;dispatch;stateStore;records=new Map;constructor($){if(!$.userSub)throw Error("DesktopSandboxProvider requires userSub");if(!$.dispatch)throw Error("DesktopSandboxProvider requires dispatch");this.userSub=$.userSub,this.dispatch=$.dispatch,this.stateStore=$.stateStore??null}async ensure($,Z={}){let G=Z.branch??Z.repo?.branch,X=RN($,G),Y=this.records.get(X);if(Y){if(await this.probeHealth(X))return this.toSandbox(Y);if(this.records.delete(X),this.stateStore)await this.stateStore.deleteByHandle(dN,X).catch(()=>{})}else if(this.stateStore){let H=(await this.stateStore.getByHandle(dN,X))?.state,N=H?.sandboxApiUrl;if(N){if(await this.probeHealth(X)){let B={handle:X,sandboxApiUrl:N,previewUrl:H?.previewUrl??N};return this.records.set(X,B),this.toSandbox(B)}await this.stateStore.deleteByHandle(dN,X).catch(()=>{})}}let Q=$w({userName:Z.tenant?.userName,userEmail:Z.tenant?.userEmail}),J=JSON.stringify({handle:X,repo:Z.repo,branch:G,...Z.workload?{workload:Z.workload}:{},...Q?{operator:Q}:{},...Z.offloadAllowedHosts?{offloadAllowedHosts:Z.offloadAllowedHosts}:{},...Z.offloadAllowSameHostDev!==void 0?{offloadAllowSameHostDev:Z.offloadAllowSameHostDev}:{},...Z.orgFsConfigJson?{orgFsConfigJson:Z.orgFsConfigJson}:{}}),W=await this.dispatchJson("POST","/api/sandboxes",J),K=JSON.parse(W);if(typeof K.sandboxApiUrl!=="string")throw Error("desktop ensure: daemon did not return a sandboxApiUrl string");let U=typeof K.previewUrl==="string"?K.previewUrl:K.sandboxApiUrl,w={handle:X,sandboxApiUrl:K.sandboxApiUrl,previewUrl:U};if(this.records.set(X,w),this.stateStore)await this.stateStore.put($,dN,{handle:X,state:{handle:X,sandboxApiUrl:K.sandboxApiUrl,previewUrl:U}});return this.toSandbox(w)}async proxyDaemonRequest($,Z,G){let X=Z.startsWith("/")?Z:`/${Z}`,Y=X.startsWith("/_sandbox/")?X.slice(9):X,Q=`/_sandbox/${encodeURIComponent($)}${Y}`,J=new Headers(G.headers);for(let L of["host","cookie","connection","keep-alive","transfer-encoding","upgrade","authorization"])J.delete(L);let W={};J.forEach((L,z)=>{W[z]=L});let K;if(G.body!=null)K=await CW6(G.body);let w=this.dispatch(this.userSub,{method:G.method,path:Q,headers:W,body:K},{signal:G.signal})[Symbol.asyncIterator](),F=VW6(),H=200,N={"content-type":"application/octet-stream"},B=[];try{while(!0){let L=await w.next();if(L.done)break;let z=L.value;if(z.headers){H=z.headers.status,N=z.headers.headers;break}if(z.data!=null){let j=F.push(z.data);if(j.length)B.push(j)}}}catch(L){let z=L instanceof Error?L.message:"dispatch error";return new Response(JSON.stringify({error:z}),{status:502,headers:{"content-type":"application/json"}})}let D=!1,E=new ReadableStream({async start(L){for(let z of B)L.enqueue(z)},async pull(L){try{while(!0){let z=await w.next();if(D)return;if(z.done){let P=F.flush();if(P.length)L.enqueue(P);L.close();return}let j=z.value;if(j.data!=null){let P=F.push(j.data);if(P.length){L.enqueue(P);return}}}}catch(z){if(!D)L.error(z)}},cancel(){D=!0,w.return?.()}});return new Response(E,{status:H,headers:N})}async alive($){return this.probeHealth($)}async probeHealth($){let Z=new AbortController,G=setTimeout(()=>Z.abort(),3000);try{return await this.dispatchJson("GET",`/api/sandboxes/${encodeURIComponent($)}`,void 0,Z.signal),!0}catch{return!1}finally{clearTimeout(G)}}async forgetHandle($){if(this.records.delete($),this.stateStore)await this.stateStore.deleteByHandle(dN,$).catch(()=>{})}async delete($){if(this.records.delete($),this.stateStore)await this.stateStore.deleteByHandle(dN,$).catch(()=>{});try{await this.dispatchJson("DELETE",`/api/sandboxes/${encodeURIComponent($)}`)}catch(Z){if(!(Z instanceof Error?Z.message:String(Z)).includes("404"))throw Z}}async getPreviewUrl($){return(await this.resolveRecord($))?.previewUrl??null}async localWorkdir($){return null}async*watchClaimLifecycle($,Z){yield{kind:"ready"}}toSandbox($){return{handle:$.handle,workdir:$.sandboxApiUrl,previewUrl:$.previewUrl}}async resolveRecord($){let Z=this.records.get($);if(Z)return Z;if(!this.stateStore)return null;let X=(await this.stateStore.getByHandle(dN,$))?.state,Y=X?.sandboxApiUrl;if(!Y)return null;let Q={handle:$,sandboxApiUrl:Y,previewUrl:X?.previewUrl??Y};return this.records.set($,Q),Q}async dispatchJson($,Z,G,X){let Y={accept:"application/json"};if(G!==void 0)Y["content-type"]="application/json";let Q=this.dispatch(this.userSub,{method:$,path:Z,headers:Y,body:G},{signal:X}),J=null,W="";for await(let U of Q)if(U.headers)J=U.headers.status;else if(U.data!=null)W+=U.data;let K=Buffer.from(W,"base64").toString("utf8");if(J!=null&&(J<200||J>=300))throw Error(`daemon returned ${J}: ${K}`);return K}}function tQ$($){return new EN0($)}function VW6(){let $="";return{push(Z){if(Z.length===0)return Ap0;$+=Z;let G=$.length-$.length%4;if(G===0)return Ap0;let X=$.slice(0,G);return $=$.slice(G),new Uint8Array(Buffer.from(X,"base64"))},flush(){if($.length===0)return Ap0;let Z=$;return $="",new Uint8Array(Buffer.from(Z,"base64"))}}}async function CW6($){if(typeof $==="string")return $;if($ instanceof ArrayBuffer)return Buffer.from($).toString("utf8");if(ArrayBuffer.isView($))return Buffer.from($.buffer,$.byteOffset,$.byteLength).toString("utf8");if($ instanceof URLSearchParams)return $.toString();return await new Response($).text()}var dN="user-desktop",Ap0;var rQ$=O(()=>{C90();V90();Ap0=new Uint8Array(0)});var oQ$={};X6(oQ$,{createDesktopProvider:()=>tQ$,DesktopSandboxProvider:()=>EN0});var aQ$=O(()=>{rQ$()});var X3$={};X6(X3$,{subscribeLifecycle:()=>rn,getSandboxProviderByKind:()=>Ip0,getOrInitSharedRunner:()=>hW6,buildDesktopProvider:()=>LN0,__resetSharedLifecyclesForTesting:()=>mW6});function Z3$($,Z){let G=sQ$[$];if(G)return Promise.resolve(G);let X=Tp0[$];if(X)return X;let Y=Z().then((Q)=>{return sQ$[$]=Q,Q}).finally(()=>{delete Tp0[$]});return Tp0[$]=Y,Y}function fW6(){let $=process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN;return $&&$.trim()!==""?$:void 0}function xW6(){let $=process.env.STUDIO_SANDBOX_TEMPLATE_NAME;return $&&$.trim()!==""?$:void 0}function vW6(){let $=process.env.STUDIO_ENV;return $&&$.trim()!==""?$:void 0}function yW6(){let $=process.env.STUDIO_SANDBOX_SENTINEL_TOKEN;return $&&$.trim()!==""?$:void 0}function gW6(){let $=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME?.trim(),Z=process.env.STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE?.trim();if(!$&&!Z)return;if(!$||!Z)throw Error("STUDIO_SANDBOX_PREVIEW_GATEWAY_NAME and STUDIO_SANDBOX_PREVIEW_GATEWAY_NAMESPACE must both be set, or both unset. Half-configured per-claim HTTPRoute routing would silently fail to attach.");return{name:$,namespace:Z}}async function G3$($,Z){let G=new kN(Z),X=fW6();switch($){case"agent-sandbox":{let{AgentSandboxProvider:Y}=await Promise.resolve().then(() => (Pp0(),pQ$)),Q=new jU(O1().encryptionKey);return new Y({stateStore:G,previewUrlPattern:X,sandboxTemplateName:xW6(),envName:vW6(),previewGateway:gW6(),sentinelToken:yW6(),meter:D8,mintCloneUrl:async(J,W)=>{if(!J.connectionId)return null;let K=t5$(J.cloneUrl);if(!K)return null;let{cloneUrl:U}=await SN(J.connectionId,K.owner,K.name,Z,Q,{bufferMs:W?.bufferMs});return U}})}case"user-desktop":throw Error("user-desktop provider cannot be instantiated without a per-run link claim \u2014 call resolveSandboxProvider, which binds the link before constructing the provider.");default:throw Error(`Unknown sandbox provider kind: ${String($)}`)}}async function LN0($,Z){let{DesktopSandboxProvider:G}=await Promise.resolve().then(() => (aQ$(),oQ$)),{getProxyDispatch:X}=await Promise.resolve().then(() => (qp0(),Rp0)),Y=new kN($.db);if(!Z)throw Error("buildDesktopProvider: userSub must be a non-empty string");let Q=X();return new G({userSub:Z,dispatch:Q,stateStore:Y})}function Ip0($,Z){return Z3$(Z,()=>G3$(Z,$.db))}async function hW6(){let $;try{$=Gw()}catch(G){return console.warn("[lifecycle] cannot resolve sandbox runner:",G instanceof Error?G.message:String(G)),null}return await Z3$($,()=>G3$($,H6().db))}function rn($,Z,G){let X=lN.get(Z);if(X){if(X.terminated){if(X.lastPhase)try{G(X.lastPhase)}catch{}return{unsubscribe:dW6}}if(X.listeners.add(G),X.lastPhase)try{G(X.lastPhase)}catch{}return eQ$(Z,X,G)}let Y=new AbortController,Q={lastPhase:null,terminated:!1,listeners:new Set([G]),abort:Y};return lN.set(Z,Q),lW6($,Z,Q),eQ$(Z,Q,G)}function dW6(){}function eQ$($,Z,G){return{unsubscribe(){if(lN.get($)!==Z)return;if(Z.listeners.delete(G),Z.listeners.size===0)lN.delete($),Z.abort.abort()}}}async function lW6($,Z,G){let X=null;try{for await(let Y of $.watchClaimLifecycle(Z,G.abort.signal)){if(G.abort.signal.aborted)break;G.lastPhase=Y;let Q=Y.kind==="ready"||Y.kind==="failed";if(Q)G.terminated=!0;let J=Array.from(G.listeners);for(let W of J)try{W(Y)}catch{}if(Q)break}}catch(Y){X=Y}finally{if(!G.terminated&&!G.abort.signal.aborted&&G.listeners.size>0){let Y={kind:"failed",reason:"unknown",message:X instanceof Error?X.message:"Lifecycle watcher ended unexpectedly"};G.lastPhase=Y,G.terminated=!0;for(let Q of Array.from(G.listeners))try{Q(Y)}catch{}}if(lN.get(Z)===G)lN.delete(Z)}}function mW6(){for(let $ of lN.values())$.abort.abort();lN.clear()}var _W6,bW6,$3$,sQ$,Tp0,cW6,uW6,lN;var on=O(()=>{MY();HQ();B5();i90();Tn();Bd();F8();_W6=Symbol.for("decocms.sandbox.lifecycle.runners"),bW6=Symbol.for("decocms.sandbox.lifecycle.inflight"),$3$=globalThis,sQ$=$3$[_W6]??={},Tp0=$3$[bW6]??={};cW6=Symbol.for("decocms.sandbox.lifecycle.shared-lifecycles"),uW6=globalThis,lN=uW6[cW6]??=new Map});async function _Y($,Z){let{userId:G,branch:X,virtualMcpMetadata:Y,explicitKind:Q}=Z;if(Q)return{provider:await an($,G,Q),kind:Q};if($.sandboxPreference==="agent-sandbox")return{provider:await an($,G,"agent-sandbox"),kind:"agent-sandbox"};if($.sandboxPreference==="user-desktop")return{provider:await LN0($,G),kind:"user-desktop"};if($.sandboxPreference==="cluster-default"){let w=Gw();return{provider:await an($,G,w),kind:w}}let[J,...W]=iW6(Y,G,X);if(J){let w=W.length===0?J:nW6(J,W);return{provider:await an($,G,w),kind:w}}let K=Y3$();return{provider:await an($,G,K),kind:K}}function iW6($,Z,G){let X=F5($)[Z]?.[G];if(!X)return[];let Y=KQ(X);return Object.keys(Y)}function nW6($,Z){let G=Y3$();if(G===$||Z.includes(G))return G;return $}function Y3$(){return Gw()}async function an($,Z,G){if(G!=="user-desktop")return Ip0($,G);return LN0($,Z)}var jV=O(()=>{f8();MY();qX();on()});var sn;var Mp0=O(()=>{sn={npm:{install:"npm install",run:($)=>`npm run ${$}`,runtime:"node"},pnpm:{install:"pnpm install",run:($)=>`pnpm run ${$}`,runtime:"node"},yarn:{install:"yarn install",run:($)=>`yarn run ${$}`,runtime:"node"},bun:{install:"bun install",run:($)=>`bun run ${$}`,runtime:"bun"},deno:{install:"deno install",run:($)=>`deno task ${$}`,runtime:"deno"}}});function zN0($){if(!$)return null;let Z=$.runtime;if(!Z||typeof Z!=="object")return null;let G=Z.env;if(!Array.isArray(G))return null;let X=[];for(let Y of G){if(!Y||typeof Y!=="object")continue;let Q=Y;if(typeof Q.key!=="string"||!Vu.test(Q.key))continue;if(Q.kind==="literal"&&typeof Q.value==="string"){X.push({key:Q.key,kind:"literal",value:Q.value});continue}if(Q.kind==="secret"&&typeof Q.secretId==="string"&&Q.secretId.length>0)X.push({key:Q.key,kind:"secret",secretId:Q.secretId})}return X.length===0?null:X}async function Q3$($,Z){M0(Z);let G=O0(Z);await Z.access.check();let X=y1(Z);if(!X)throw Error("User ID required");let Y=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!Y||Y.organization_id!==G.id)throw Error("Virtual MCP not found");let Q=Y.metadata??{},J=F5(Q),W=iW(J,X,$.branch,$.sandboxProviderKind);return{virtualMcp:Y,metadata:Q,userId:X,entry:W,organization:G}}function jN0($){let Z=$.runtime??null,X=Z?.selected??null,Y=Z?.port??null,Q=Z?.path??null;if(!X||!(X in sn))return{packageManager:null,runtime:null,port:Y,packageManagerPath:Q,runtimeBinPath:null};let J=sn[X].runtime;return{packageManager:X,runtime:J,port:Y,packageManagerPath:Q,runtimeBinPath:J==="deno"?"/opt/deno/bin":J==="bun"?"/opt/bun/bin":null}}var pv=O(()=>{f8();Mp0();qX()});async function PN0({ctx:$,runner:Z,handle:G,orgId:X,userId:Y,entries:Q}){if(!Q||Q.length===0)return;let J={};for(let K of Q){if(K.kind==="literal"){J[K.key]=K.value;continue}try{let{value:U}=await $.storage.secrets.resolveById(K.secretId,X,Y);J[K.key]=U}catch(U){if(U instanceof EW||U instanceof Dx){console.warn(`[SANDBOX_START] skipping env ${K.key}: ${U.message}. Re-link or recreate the secret to restore.`);continue}throw U}}if(Object.keys(J).length===0)return;let W=await Z.proxyDaemonRequest(G,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({env:J})});if(!W.ok){let K=await W.text().catch(()=>W.statusText);console.warn(`[SANDBOX_START] daemon rejected env patch (${W.status}): ${K}`)}}var kp0=O(()=>{k60()});async function K3$($,Z,G,X,Y){let Q=await YN({connectionId:$,tokenStorage:new b5(X,Y)});if(!Q.accessToken)return null;return w3$(Z,G,Q.accessToken)}function U3$($,Z){return w3$($,Z,null)}async function w3$($,Z,G){let X=new Map,Y=new Set(J3$.map((K)=>K.path));for(let K of Object.values(W3$))for(let U of K??[])Y.add(U);await Promise.all(Array.from(Y).map(async(K)=>{X.set(K,await tW6($,Z,K,G))}));let Q=J3$.find(({path:K})=>X.get(K)!==null);if(!Q)return null;let J=W3$[Q.pm]??[],W=null;for(let K of J)if(W=rW6(X.get(K)??null),W)break;return{packageManager:Q.pm,devPort:W}}async function tW6($,Z,G,X){let Y=`https://api.github.com/repos/${$}/${Z}/contents/${encodeURIComponent(G)}`;try{let Q={Accept:"application/vnd.github+json","User-Agent":"mesh-runtime-detect"};if(X)Q.Authorization=`token ${X}`;let J=await fetch(Y,{headers:Q,signal:AbortSignal.timeout(5000)});if(!J.ok)return null;let W=await J.json();if(!W.content||W.encoding!=="base64")return null;return Buffer.from(W.content,"base64").toString("utf8")}catch{return null}}function rW6($){if(!$)return null;try{let Z=JSON.parse($),G=Z.tasks??Z.scripts??{};return(G.dev??G.start??"").match(pW6)?.[1]??null}catch{return null}}var J3$,W3$,pW6;var F3$=O(()=>{QN();YJ();J3$=[{path:"deno.json",pm:"deno"},{path:"deno.jsonc",pm:"deno"},{path:"bun.lock",pm:"bun"},{path:"bunfig.toml",pm:"bun"},{path:"pnpm-lock.yaml",pm:"pnpm"},{path:"yarn.lock",pm:"yarn"},{path:"package-lock.json",pm:"npm"},{path:"package.json",pm:"bun"}],W3$={deno:["deno.json","deno.jsonc"],bun:["package.json"],pnpm:["package.json"],yarn:["package.json"],npm:["package.json"]},pW6=/(?:--port|PORT=|:)(\d{4,5})/});function AN0($,Z){return Z?`thread:${$}/${Z}`:`thread:${$}`}function tv($){if(!$||!$.startsWith("thread:"))return null;return $.slice(7).split("/")[0]||null}async function TN0($,Z){if(!Z)return null;let G=await $.storage.threads.get(Z).catch(()=>null);if(!G)return null;return G.metadata??{}}async function en($,Z){return(await TN0($,Z))?.githubRepo??null}async function H3$($,Z,G,X,Y,Q){let J=await TN0($,Z);if(!J)return;let W=An(F5(J),G,X,Y,Q);await $.storage.threads.update(Z,{metadata:{...J,sandboxMap:W}}).catch((K)=>console.warn("[thread-repo] setThreadSandboxMapEntry failed",K))}async function N3$($,Z){return F5(await TN0($,Z))}async function B3$($,Z,G,X,Y){let Q=await TN0($,Z);if(!Q)return;let J=Ni0(F5(Q),G,X,Y);if(!J)return;await $.storage.threads.update(Z,{metadata:{...Q,sandboxMap:J}}).catch((W)=>console.warn("[thread-repo] removeThreadSandboxMapEntry failed",W))}var $p=O(()=>{qX()});async function IN0($,Z){if(!$)return{hosts:[],allowSameHostDev:!1};let G;try{G=await $.presignedGetUrl("link-dispatch/_allowlist_probe",60,{requireFetchable:!0})}catch{return{hosts:[],allowSameHostDev:!1}}let X;try{X=new URL(G)}catch{return{hosts:[],allowSameHostDev:!1}}if(X.protocol!=="https:"&&X.protocol!=="http:")return{hosts:[],allowSameHostDev:!1};let Y=X.hostname,Q=oW6.has(Y);return{hosts:[Y],allowSameHostDev:Q&&!Z.isProduction}}var oW6;var Sp0=O(()=>{oW6=new Set(["127.0.0.1","localhost","::1","[::1]","0.0.0.0"])});import{z as aW}from"zod";async function RN0($,Z){M0(Z);let G=O0(Z),X=y1(Z);if(!X)throw Error("User ID required");let Y=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!Y||Y.organization_id!==G.id)throw Error("Virtual MCP not found");let Q=Y.metadata??{},J=iW(F5(Q),X,$.branch,$.sandboxProviderKind),W=$.sandboxProviderKind,{provider:K}=await _Y(Z,{userId:X,branch:$.branch,virtualMcpMetadata:Q,explicitKind:W});if(J){if(W!=="user-desktop")return J;if(await K.alive(J.sandboxHandle).catch(()=>!1))return J;await MN(Z.storage.virtualMcps,$.virtualMcpId,X,X,$.branch,W).catch((N)=>{console.warn("[ensureSandbox] failed to reap stale user-desktop entry",N)})}let w=await en(Z,tv($.branch)??Z.metadata?.threadId)??Q.githubRepo??null,{entry:F}=await O3$({ctx:Z,userId:X,orgId:G.id,virtualMcpId:$.virtualMcpId,branch:$.branch,metadata:Q,githubRepo:w,existing:null,providerKind:W,runner:K});return F}async function O3$($){let{ctx:Z,userId:G,orgId:X,virtualMcpId:Y,branch:Q,metadata:J,githubRepo:W,existing:K,runner:U}=$,{runtime:w,packageManager:F,port:H,packageManagerPath:N}=jN0(J),B;if(W){if(W.connectionId)await Vv({ctx:Z,connectionId:W.connectionId,organizationId:X,forceRefresh:!0,onLegacyMintError:(J0)=>{console.error("[provisionSandbox] repo-scoped legacy token mint failed",{connectionId:W.connectionId,error:J0.message})}});let{cloneUrl:o,gitUserName:B0,gitUserEmail:D0}=W.connectionId?await SN(W.connectionId,W.owner,W.name,Z.db,Z.vault):n90(W.owner,W.name);if(!F){let J0=W.connectionId?await K3$(W.connectionId,W.owner,W.name,Z.db,Z.vault):await U3$(W.owner,W.name);if(J0)F=J0.packageManager,w=sn[J0.packageManager].runtime,H=J0.devPort??H,await sW6(Z,Y,G,J0.packageManager,J0.devPort)}B={cloneUrl:o,...W.connectionId?{connectionId:W.connectionId}:{},userName:B0,userEmail:D0,branch:Q,displayName:`${W.owner}/${W.name}`}}let D=w&&F?{runtime:w,packageManager:F,...H!==null?{devPort:Number(H)}:{},...N?{packageManagerPath:N}:{}}:void 0,E=Zw({orgId:X,virtualMcpId:Y,branch:Q}),L=U.kind==="user-desktop"?await IN0(Z.objectStorage,{isProduction:O1().nodeEnv==="production"}):null,z=(U.kind==="user-desktop"||U.kind==="agent-sandbox")&&!O1().orgFsMountsDisabled,j;if(z){let o=Z.organization?.slug??(await Z.db.selectFrom("organization").select(["slug"]).where("id","=",X).executeTakeFirst())?.slug;if(o)j=await X50(Z,{orgSlug:o,orgId:X,baseUrl:j3()})}let P=await U.ensure({userId:G,projectRef:E},{branch:Q,repo:B,workload:D,tenant:{orgId:X,userId:G,...Z.organization?.slug?{orgSlug:Z.organization.slug}:{},...Z.organization?.name?{orgName:Z.organization.name}:{},...Z.auth.user?.email?{userEmail:Z.auth.user.email}:{},...Z.auth.user?.name?{userName:Z.auth.user.name}:{}},...L?{offloadAllowedHosts:L.hosts,offloadAllowSameHostDev:L.allowSameHostDev}:{},...j?{orgFsConfigJson:j}:{}}),A=J.runtime?.env??null;await PN0({ctx:Z,runner:U,handle:P.handle,orgId:X,userId:G,entries:A});let S=!!K&&K.sandboxHandle===P.handle&&K?.createdAt?K.createdAt:Date.now(),R=J.runtime?.selected??null,V=J.runtime?.port??null,i=J.runtime?.path??null,f={sandboxHandle:P.handle,previewUrl:P.previewUrl,sandboxApiUrl:P.previewUrl,sandboxProviderKind:U.kind,createdAt:S,startedWith:{packageManager:R,port:V,path:i}};await g5$(Z.storage.virtualMcps,Y,G,G,Q,$.providerKind,f);let v=tv(Q);if(v)await H3$(Z,v,G,Q,$.providerKind,f);let Z0=!K||K.sandboxHandle!==P.handle;return{entry:f,isNewVm:Z0}}async function sW6($,Z,G,X,Y){let Q=await $.storage.virtualMcps.findById(Z);if(!Q)return;let J=Q.metadata??{};await $.storage.virtualMcps.update(Z,G,{metadata:{...J,runtime:{selected:X,port:Y}}})}var aW6,Vp0;var qN0=O(()=>{MY();Y1();pv();kp0();qX();Tn();F3$();Mp0();jV();$p();Sp0();F8();BG();Gv();qX();aW6=aW.enum(["agent-sandbox","user-desktop","cluster"]),Vp0=$0({name:"SANDBOX_START",description:"Start a sandbox with the connected GitHub repo and dev server.",annotations:{title:"Start VM Preview",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!0},_meta:{ui:{visibility:"app"}},inputSchema:aW.object({virtualMcpId:aW.string().describe("Virtual MCP ID"),branch:aW.string().min(1).optional().describe("Optional git branch to check out. When omitted the handler generates a Bayer-style `<greek-letter>-<constellation>` name (e.g. `alpha-centauri`) and uses it. The resolved branch is returned in the response so callers can persist it."),sandboxProviderKind:aW6.optional().describe("Explicit runtime choice. Hosted provider is `agent-sandbox`; legacy `cluster` input is accepted only for compatibility and normalized to `agent-sandbox`. When omitted, defaults to `user-desktop` if the acting user's link daemon is online, else the env kind.")}),outputSchema:aW.object({previewUrl:aW.string().nullable(),sandboxHandle:aW.string(),branch:aW.string(),isNewVm:aW.boolean(),sandboxProviderKind:aW.enum(["agent-sandbox","user-desktop"])}),handler:async($,Z)=>{M0(Z);let G=O0(Z);await Z.access.check();let X=$.branch??I90(Z.auth.user?.name??Z.auth.user?.email?.split("@")[0]),Y=y1(Z);if(!Y)throw Error("User ID required");let Q=await Z.storage.virtualMcps.findById($.virtualMcpId);if(!Q||Q.organization_id!==G.id)throw Error("Virtual MCP not found");let J=Q.metadata??{},W=$.sandboxProviderKind?eU($.sandboxProviderKind):void 0,{provider:K,kind:U}=await _Y(Z,{userId:Y,branch:X,virtualMcpMetadata:J,explicitKind:W}),w=iW(F5(J),Y,X,U),H=await en(Z,tv(X)??Z.metadata?.threadId)??J.githubRepo??null,{entry:N,isNewVm:B}=await O3$({ctx:Z,userId:Y,orgId:G.id,virtualMcpId:$.virtualMcpId,branch:X,metadata:J,githubRepo:H,existing:w,providerKind:U,runner:K});return{...N,branch:X,isNewVm:B,sandboxProviderKind:U}}})});async function eW6($,Z,G,X){try{let Y=$.organization;if(!Y)return;let Q=await l90($,X.virtualMcpId,Y,"tool-scripting",X.providerKind),J=await Z.proxyDaemonRequest(G,"/_sandbox/tools/sync",{method:"POST",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify(Q)});if(!J.ok)console.warn("[cluster-sandbox-fs] tools/sync failed",J.status,await J.text().catch(()=>""))}catch(Y){console.warn("[cluster-sandbox-fs] tools/sync failed",Y)}}async function Zp($,Z){let{provider:G,kind:X}=await _Y($,{userId:Z.userId,branch:Z.branch,virtualMcpMetadata:null}),Y=null,Q=()=>{if(!Y){if(Y=RN0({virtualMcpId:Z.virtualMcpId,branch:Z.branch,sandboxProviderKind:X},$).then((K)=>K.sandboxHandle),Y.catch(()=>{Y=null}),Z.syncTools)Y.then((K)=>eW6($,G,K,{virtualMcpId:Z.virtualMcpId,providerKind:X})).catch(()=>{})}return Y},J=Z.branch==="ephemeral"||X==="user-desktop";return $i0(G,{ensureHandle:Q,invalidateHandle:async()=>{let K=Y;if(Y=null,!J)return;try{await MN($.storage.virtualMcps,Z.virtualMcpId,Z.userId,Z.userId,Z.branch,X)}catch(U){console.warn("[cluster-sandbox-fs] failed to reap vmMap entry",U)}if(K&&typeof G.forgetHandle==="function")try{let U=await K;await G.forgetHandle(U)}catch(U){console.warn("[cluster-sandbox-fs] forgetHandle failed",U)}},canAutoRestart:J})}async function D3$($,Z){try{let G=await Zp($,Z),{stdout:X}=await G.onBash("test -d .deco && echo __DECO_SITE__");return X.includes("__DECO_SITE__")}catch(G){return console.warn("[cluster-sandbox-fs] .deco probe failed; assuming deco site",G),!0}}var MN0=O(()=>{MY();Hi0();jV();qN0();qX()});function rv($){let Z=$.toISOString();return`<current-context>
 Current date: ${Z.slice(0,10)}
 Current time: ${Z.slice(11,16)} UTC
 </current-context>`}var E3$,L3$;var Cp0=O(()=>{E3$={type:"ephemeral",ttl:"5m"},L3$={openrouter:{cache_control:{type:"ephemeral",ttl:"5m"}}}});function z3$($,Z){let G=[],X=$.length-1,Y=$.length-2;for(let Q=0;Q<$.length;Q++){let J=Q===Y||Q===X;G.push({role:"system",content:$[Q],...J?{providerOptions:$K6}:{}})}return G.push({role:"system",content:rv(Z)}),G}var $K6;var j3$=O(()=>{Cp0();$K6={anthropic:{cacheControl:E3$}}});function P3$($){if($.length===0)return null;return`
@@ -1456,7 +1456,7 @@ Guidelines:
 ${B}`:`[Uploaded files \u2014 use these URLs when calling tools]
 ${B}`,E=new Map(N.flatMap((P)=>P.dataUrl?[[P.dataUrl,P.meshStorageUrl]]:[])),L=Q.parts.map((P)=>{if(P.type!=="file"||!("url"in P)||typeof P.url!=="string")return P;let A=E.get(P.url);if(!A)return P;return{...P,url:A}}),z=L.findIndex((P)=>P.type==="text"),j;if(z!==-1)j=L.map((P,A)=>{if(A!==z||P.type!=="text")return P;return{...P,text:`${D}
-${"text"in P?P.text:""}`.trim()}});else j=[{type:"text",text:D},...L];return[...$.slice(0,Y),{...Q,parts:j},...$.slice(Y+1)]}async function dN0($,Z){if(!Z.organization)return $;let G=$.map((W)=>{let K=W.parts.filter((U)=>!OU6(U));return K.length===W.parts.length?W:{...W,parts:K}}),X=new Set;for(let W of G)for(let K of W.parts)if(K.type==="file"&&"url"in K&&typeof K.url==="string"){let U=Pn(K.url);if(U)X.add(U)}let Y=yQ(),Q=new Map;if(await Promise.all(Array.from(X).map(async(W)=>{let K=await Qp(W,Z);if(!K)return;if(Y&&!K.startsWith("https://"))try{let U=await Z.objectStorage.getBytes(W);if(U.byteLength<=hJ$){Q.set(W,{kind:"bytes",b64:Buffer.from(U).toString("base64")});return}console.warn(`[file-materializer] dev inline skipped (${U.byteLength}B > ${hJ$}B):`,W)}catch(U){console.error("[file-materializer] dev inline read failed; passing URL through:",U)}Q.set(W,{kind:"url",url:K})})),Q.size===0)return jU6(G,Z);return G.map((W)=>{let K=W.parts.map((w)=>{if(w.type==="file"&&"url"in w&&typeof w.url==="string"){let F=Pn(w.url);if(F){let H=Q.get(F);if(H?.kind==="url")return{...w,url:H.url};if(H?.kind==="bytes"){let N="mediaType"in w&&typeof w.mediaType==="string"?w.mediaType:"application/octet-stream";return{...w,url:`data:${N};base64,${H.b64}`}}}}return w});return K.some((w,F)=>w!==W.parts[F])?{...W,parts:K}:W})}async function iJ$($,Z){let G=new Set;if(tp0($,G),G.size===0)return $;let X=new Map;if(await Promise.all(Array.from(G).map(async(Y)=>{let Q=await Qp(Y,Z);if(Q)X.set(Y,Q)})),X.size===0)return $;return rp0($,X)}function tp0($,Z){if(typeof $==="string")for(let G of $.matchAll(Yi0()))Z.add(G[1]);else if(Array.isArray($))for(let G of $)tp0(G,Z);else if($!==null&&typeof $==="object")for(let G of Object.values($))tp0(G,Z)}function rp0($,Z){if(typeof $==="string")return $.replace(Yi0(),(G,X)=>Z.get(X)??W7(X));if(Array.isArray($))return $.map((G)=>rp0(G,Z));if($!==null&&typeof $==="object")return Object.fromEntries(Object.entries($).map(([G,X])=>[G,rp0(X,Z)]));return $}async function jU6($,Z){let G=$.findLastIndex((U)=>U.role==="user");if(G===-1)return $;let X=$[G],Y=X.parts.filter((U)=>U.type==="file"&&("url"in U)&&typeof U.url==="string"&&U.url.startsWith("data:"));if(Y.length===0)return $;let J=(await Promise.all(Y.map(async(U)=>{if(U.type!=="file"||!("url"in U)||typeof U.url!=="string")return null;let w=lJ$(U.url);if(!w)return null;let F=pp0(w.mimeType),H=`chat-uploads/${crypto.randomUUID()}.${F}`,N=await DU6(w.bytes,H,w.mimeType,Z);if(!N)return null;let B=await Qp(N,Z);return B?{dataUrl:U.url,presigned:B}:null}))).filter((U)=>U!==null);if(J.length===0)return $;let W=new Map(J.map((U)=>[U.dataUrl,U.presigned])),K=X.parts.map((U)=>{if(U.type!=="file"||!("url"in U)||typeof U.url!=="string")return U;let w=W.get(U.url);return w?{...U,url:w}:U});return[...$.slice(0,G),{...X,parts:K},...$.slice(G+1)]}var BU6,EU6=604800,hJ$=20971520,LU6,zU6;var ev=O(()=>{nN();vc();nJ();gJ$();BU6=new Set(["application/vnd.openxmlformats-officedocument.presentationml.presentation","application/vnd.openxmlformats-officedocument.wordprocessingml.document","application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"]);LU6=/^\[file::\/\/(.+?)\]$/,zU6=/^\[file::\/\/(.+?)\]\n([\s\S]*)$/});function lN0($,Z){return{resolveArgs:(G)=>iJ$(G,$),onToolCalled:(G)=>{if(!G.isError&&t4$(G.toolName))Av($,"in_review",Z);let X=$.organization?.id,Y=$.auth?.user?.id;if(!X||!Y)return;i1.capture({distinctId:Y,event:"tool_called",groups:{organization:X},properties:{organization_id:X,tool_source:"mcp",tool_name:G.toolName,tool_safe_name:G.toolSafeName,read_only:G.annotations?.readOnlyHint??null,destructive:G.annotations?.destructiveHint??null,idempotent:G.annotations?.idempotentHint??null,open_world:G.annotations?.openWorldHint??null,latency_ms:Math.round(G.latencyMs),is_error:G.isError}})},onPrOpened:(G)=>{L90($,G.result,G.connectionId,Z)}}}var op0=O(()=>{q4();ev();aU()});function nJ$($){if($ instanceof Error)return $.message;if(typeof $==="string")return $;if(typeof $==="object"&&$!==null){let Z=$.message;if(typeof Z==="string")return Z;try{return JSON.stringify($)}catch{return String($)}}return String($)}function pJ$($){let Z,G,X=new Promise((W)=>{G=W}),Y=(W)=>{if(Z===void 0)Z=W;G(Z)},J=($.streamText??bQ)({model:$.model,system:$.systemMessages,messages:$.messages,tools:$.tools,providerOptions:L3$,prepareStep:$.prepareStep,temperature:$.temperature,maxOutputTokens:$.maxOutputTokens,stopWhen:$.stopWhen,abortSignal:$.abortSignal,onStepFinish:$.onStepFinish,onError:async(W)=>{let K=W.error??W,U=nJ$(K);$.onError?.(U,K),Y(U)},onAbort:async()=>{Y(Z??"Run aborted before completion.")}});return Promise.resolve(J.finishReason).then(()=>{if(Z===void 0)G(void 0)}).catch((W)=>{let K=nJ$(W);$.onError?.(K,W),Y(K)}),{result:J,error:X}}var tJ$=O(()=>{L6();Cp0()});import{SpanStatusCode as ap0,trace as PU6}from"@opentelemetry/api";async function av($){let Z=$.tracer??PU6.getTracer("decopilot"),G=$.stepLimit??($.kind==="agent"?Ti1:yH),X=$.planMode??!1,Y=$.toolApprovalLevel??"auto",Q=Z.startSpan("decopilot.agent_loop",{attributes:{"decopilot.agent.id":$.virtualMcp.id,"decopilot.agent.kind":$.kind,"decopilot.organization.id":$.organization.id,"decopilot.model.id":$.models.thinking.id}}),J=await x3$({ctx:$.ctx,organization:$.organization,virtualMcp:$.virtualMcp,kind:$.kind,planMode:X,isDecopilot:$.isDecopilot,agentInstructions:$.systemAgentInstructions,currentThreadId:$.currentThreadId,user:$.user,userContext:$.userContext,codingWorkspace:$.codingWorkspace,passthroughClient:$.passthroughClient,connectionsData:$.connectionsData}),W=$.additionalSystemMessages&&$.additionalSystemMessages.length>0?[...J,...$.additionalSystemMessages]:J,{resolveArgs:K,onToolCalled:U,onPrOpened:w}=lN0($.ctx,$.currentThreadId),{tools:F}=await fJ$({kind:$.kind,ctx:$.ctx,mcpClient:$.mcpClient,writer:$.writer,planMode:X,toolApprovalLevel:Y,subtaskParams:$.subtaskParams,resolveArgs:K,onToolCalled:U,onPrOpened:w,fullBuiltInParams:$.subagentBuiltInParams}),H=$.extraTools?{...F,...$.extraTools}:F,N=$.__streamText?void 0:h90($.provider,$.models.thinking),B=(E)=>{for(let L of E.toolCalls??[]){let z=L.input?.command;if(L.toolName==="bash"&&z&&r4$(z)){Av($.ctx,"in_review",$.currentThreadId);let j=(E.toolResults??[]).find((P)=>P.toolCallId===L.toolCallId);L90($.ctx,j?.output,null,$.currentThreadId);break}}return $.onStepFinish?.(E)},D=pJ$({model:N,systemMessages:W,messages:$.messages,tools:H,prepareStep:$.prepareStep,temperature:$.temperature,maxOutputTokens:v5$($.models.thinking.limits,o7(W)+o7($.messages)+o7(H)),stopWhen:DN(G),abortSignal:$.abortSignal,onStepFinish:B,streamText:$.__streamText,onError:(E,L)=>{if(console.error(`[runAgentLoop:${$.kind}:${$.virtualMcp.id}] Error`,E),Q.setStatus({code:ap0.ERROR,message:E}),L instanceof Error)Q.recordException(L)}});return Promise.resolve(D.result.finishReason).then(()=>{Q.setStatus({code:ap0.OK})}).catch((E)=>{let L=E instanceof Error?E.message:typeof E==="string"?E:`${E}`;Q.setStatus({code:ap0.ERROR,message:L})}).finally(()=>Q.end()),{result:D.result,error:D.error,span:Q,assembledSystemMessages:W}}var _N0=O(()=>{L6();Ki0();Xw();gD();v3$();xJ$();op0();aU();tJ$()});function mN0(){let $=[],Z=!1,G=null,X=()=>{let J=G;G=null,J?.()},Y=(J)=>{if(Z)return;$.push(J),X()},Q=async function*(){try{while(!Z||$.length>0){let J=$.shift();if(J){yield J;continue}await new Promise((W)=>{G=W})}}finally{Z=!0,X()}}();return{writer:{write:(J)=>Y(J),merge:async(J)=>{let W=J;if(typeof W[Symbol.asyncIterator]==="function"){for await(let U of W)Y(U);return}let K=J.getReader();try{while(!0){let{value:U,done:w}=await K.read();if(w)return;Y(U)}}finally{K.releaseLock()}},onError:()=>{}},stream:Q,close:()=>{Z=!0,X()}}}async function TU6($){let Z=$.getReader();try{while(!0){let{done:G}=await Z.read();if(G)return}}finally{Z.releaseLock()}}async function iN0($,Z){let{runId:G,fenceToken:X}=$,Y=$.fenceOk??(()=>!0),Q=$.initialAckSeq??0,J=new Set,W;async function*K(){try{for await(let{seq:F,chunk:H}of $.chunks){if(!await Y())continue;if(F<=Q||J.has(F))continue;if(!await Z.streamBuffer.publishRawChunk(G,H,{fenceToken:X,seq:F}))throw Error("publishRawChunk failed");J.add(F);let N=Q;while(J.has(Q+1))J.delete(Q+1),Q+=1;if(Q>N)$.onPublished?.(Q);yield H}}catch(F){throw W=F,F}}let{uiStream:U,whenComplete:w}=J90({chunks:K(),originalMessages:$.originalMessages,title:{...Z.title,persistTitle:async()=>{}},persistence:Z.persistence??AU6,hooks:Z.hooks,errorMessageId:$.errorMessageId});if(await TU6(U),await w,W!==void 0){if(W instanceof Error)W.lastAckSeq=Q;throw W}if(Q>0)await Z.streamBuffer.publishDone(G,X,Q)}var AU6;var sp0=O(()=>{Gm0();AU6={emitStepParts:async()=>{},emitFinal:async()=>{},emitError:async()=>{}}});import{DBOS as PV,DBOSClient as IU6}from"@dbos-inc/dbos-sdk";function aJ$($){ep0=$}function pN0(){if(!ep0)throw Error("[background-tool] DBOS runtime not initialized \u2014 setBackgroundToolRuntime() must run before workflows fire");return ep0}function RU6(){return rJ$??=IU6.create({systemDatabaseUrl:pN0().systemDatabaseUrl,systemDatabaseSchemaName:"dbos"}),rJ$}function nN0($){let Z=$.modelMeta.capabilities;return{id:$.modelId,title:$.modelMeta.title??$.modelId,provider:$.modelMeta.providerId??null,capabilities:Z&&Z.length>0?{vision:Z.includes("vision")||Z.includes("image")||void 0,text:Z.includes("text")||void 0,reasoning:Z.includes("reasoning")||void 0}:void 0,limits:$.modelMeta.limits?{contextWindow:$.modelMeta.limits.contextWindow,maxOutputTokens:$.modelMeta.limits.maxOutputTokens??void 0}:void 0}}async function $t0($){let[Z,G,X,Y]=await Promise.all([FJ($,"smart"),CQ($,"image"),CQ($,"web_search"),CQ($,"deep_research")]);return{credentialId:Z.credentialId,thinking:nN0(Z),...G?{image:{...nN0(G),credentialId:G.credentialId}}:{},...X?{webSearch:{...nN0(X),credentialId:X.credentialId}}:{},...Y?{deepResearch:{...nN0(Y),credentialId:Y.credentialId}}:{}}}async function tN0($){let Z=await pN0().studioContextFactory($.orgId,$.userId);if(!Z)throw Error(`[background-tool] mesh context unavailable for org ${$.orgId} user ${$.userId}`);return Z}function sJ$($){return{target:_90({sandboxProviderKind:$?.sandbox_provider_kind??"agent-sandbox"}),harnessId:$?.harness_id??"decopilot"}}function eJ$($,Z){return{messages:[{id:`${$.jobId}:react-msg`,role:"user",metadata:{internal:!0},parts:[{type:"text",text:Z.nudge}]}],models:Z.models,agent:{id:$.agentId},temperature:$.temperature,toolApprovalLevel:$.toolApprovalLevel,mode:"default",organizationId:$.orgId,userId:$.userId,taskId:$.threadId,branch:$.branch??void 0,resumedFromBackground:!0,target:Z.target,harnessId:Z.harnessId??void 0}}function qU6($){return{ctx:$,studioContext:()=>tN0($),emitFinal:(Z)=>PV.runStep(()=>CU6($,Z),{name:"appendResult"})}}function kU6($){if(!$?.parts)return"";return $.parts.map((Z)=>Z&&typeof Z==="object"&&Z.type==="text"?Z.text??"":"").filter((Z)=>Z.trim().length>0).join("").trim()}async function SU6($){let Z=await tN0($),G=Z.organization;if(!G)throw Error(`[background-tool] organization context unavailable for subtask (org ${$.orgId})`);let X=$.input,Y=!X.agent_id||X.agent_id===$.agentId,Q=Y?$.agentId:X.agent_id,J=await $t0(Z),W=await Z.aiProviders.activate(J.credentialId,$.orgId),K={thinking:{...J.thinking,credentialId:J.credentialId},...J.image?{image:J.image}:{},...J.webSearch?{webSearch:J.webSearch}:{},...J.deepResearch?{deepResearch:J.deepResearch}:{}},{mcpClient:U,targetKind:w,targetRef:F}=await CN0(Z,$.orgId,Q,{superUser:Y}),H=K.image,N=K.webSearch,B=K.deepResearch,D=H?.credentialId?await Z.aiProviders.activate(H.credentialId,$.orgId):null,E=N?.credentialId?await Z.aiProviders.activate(N.credentialId,$.orgId):null,L=B?.credentialId?await Z.aiProviders.activate(B.credentialId,$.orgId):null,z={provider:W,imageProvider:D,webSearchProvider:E,deepResearchProvider:L,organization:G,models:K,toolApprovalLevel:$.toolApprovalLevel,isPlanMode:!1,passthroughClient:U,pendingImages:[],vmContext:w==="virtual-mcp"?{virtualMcpId:F.id,branch:F.repo?$.branch??`thread:${$.threadId}`:"ephemeral",userId:$.userId,threadId:$.threadId}:null,taskId:$.threadId,agentId:F.id,backgroundDispatcher:null},j=mN0(),P=Gi0($.threadId),A="",M="stop";try{let S=await av({kind:"subagent",ctx:Z,organization:G,virtualMcp:F,mcpClient:U,provider:W,models:K,messages:[{role:"user",content:X.prompt}],systemAgentInstructions:F.instructions,abortSignal:P.signal,stepLimit:yH,toolApprovalLevel:"auto",planMode:!1,writer:j.writer,subtaskParams:{provider:W,organization:G,models:K,needsApproval:!1},passthroughClient:U,subagentBuiltInParams:z}),R=0,V=S.result.toUIMessageStream({generateMessageId:()=>`${$.jobId}:msg:${R++}`,messageMetadata:({part:Z0})=>Z0.type==="start"?{subtaskJobId:$.jobId}:void 0}),i=0;async function*f(){let Z0=V.getReader();try{while(!0){let{done:o,value:B0}=await Z0.read();if(o)break;yield{seq:++i,chunk:B0}}}finally{Z0.releaseLock()}}let v=new bG({storage:Z.storage.threads.messageParts(),orgId:$.orgId,threadId:$.threadId,runId:$.jobId});return await iN0({runId:$.jobId,fenceToken:$.jobId,chunks:f()},{streamBuffer:pN0().streamBuffer,persistence:v,title:{threadId:$.threadId,currentThreadTitle:void 0,persistTitle:async()=>{}},hooks:{onFinish:async(Z0,o)=>{let B0=kU6(Z0);if(B0)A=B0;if(o)M=o}}}),{report:A,finishReason:M,models:J}}finally{j.close(),Xi0($.threadId,P),await U.close().catch(()=>{})}}async function VU6($){let Z=await $.studioContext(),G=await $t0(Z),X=G.image;if(!X?.credentialId)throw Error("[background-tool] no image model configured for org");let Y=await Z.aiProviders.activate(X.credentialId,$.ctx.orgId),Q=Gi0($.ctx.threadId);try{return{result:await Qi0($.ctx.input,{provider:Y,imageModelInfo:{id:X.id},objectStorage:Z.objectStorage,allowHttpExternalUrls:O1().localMode,abortSignal:Q.signal}),models:G}}finally{Xi0($.ctx.threadId,Q)}}async function CU6($,Z){let G=await tN0($);if(!await G.storage.threads.get($.threadId))throw Error(`[background-tool] thread ${$.threadId} not found`);await new bG({storage:G.storage.threads.messageParts(),orgId:$.orgId,threadId:$.threadId,runId:$.jobId}).emitFinal({id:`${$.jobId}:msg`,role:"assistant",parts:Z})}async function $W$($){let{snapshot:Z,jobId:G,report:X}=$,Y={...Z,jobId:G,toolName:"subtask",input:{},toolCallId:`${G}:deliver`},Q=await tN0(Y),J=X.trim().length>0;await new bG({storage:Q.storage.threads.messageParts(),orgId:Z.orgId,threadId:Z.threadId,runId:G}).emitFinal({id:`${G}:result`,role:"assistant",parts:[{type:"text",text:J?X:"_The subtask produced no output._"}],metadata:{subtaskJobId:G}});let K=await $t0(Q),{target:U,harnessId:w}=sJ$(await Q.storage.threads.get(Z.threadId)),F=J?`The background subtask you started has completed. Its result:
+${"text"in P?P.text:""}`.trim()}});else j=[{type:"text",text:D},...L];return[...$.slice(0,Y),{...Q,parts:j},...$.slice(Y+1)]}async function dN0($,Z){if(!Z.organization)return $;let G=$.map((W)=>{let K=W.parts.filter((U)=>!OU6(U));return K.length===W.parts.length?W:{...W,parts:K}}),X=new Set;for(let W of G)for(let K of W.parts)if(K.type==="file"&&"url"in K&&typeof K.url==="string"){let U=Pn(K.url);if(U)X.add(U)}let Y=yQ(),Q=new Map;if(await Promise.all(Array.from(X).map(async(W)=>{let K=await Qp(W,Z);if(!K)return;if(Y&&!K.startsWith("https://"))try{let U=await Z.objectStorage.getBytes(W);if(U.byteLength<=hJ$){Q.set(W,{kind:"bytes",b64:Buffer.from(U).toString("base64")});return}console.warn(`[file-materializer] dev inline skipped (${U.byteLength}B > ${hJ$}B):`,W)}catch(U){console.error("[file-materializer] dev inline read failed; passing URL through:",U)}Q.set(W,{kind:"url",url:K})})),Q.size===0)return jU6(G,Z);return G.map((W)=>{let K=W.parts.map((w)=>{if(w.type==="file"&&"url"in w&&typeof w.url==="string"){let F=Pn(w.url);if(F){let H=Q.get(F);if(H?.kind==="url")return{...w,url:H.url};if(H?.kind==="bytes"){let N="mediaType"in w&&typeof w.mediaType==="string"?w.mediaType:"application/octet-stream";return{...w,url:`data:${N};base64,${H.b64}`}}}}return w});return K.some((w,F)=>w!==W.parts[F])?{...W,parts:K}:W})}async function iJ$($,Z){let G=new Set;if(tp0($,G),G.size===0)return $;let X=new Map;if(await Promise.all(Array.from(G).map(async(Y)=>{let Q=await Qp(Y,Z);if(Q)X.set(Y,Q)})),X.size===0)return $;return rp0($,X)}function tp0($,Z){if(typeof $==="string")for(let G of $.matchAll(Yi0()))Z.add(G[1]);else if(Array.isArray($))for(let G of $)tp0(G,Z);else if($!==null&&typeof $==="object")for(let G of Object.values($))tp0(G,Z)}function rp0($,Z){if(typeof $==="string")return $.replace(Yi0(),(G,X)=>Z.get(X)??W7(X));if(Array.isArray($))return $.map((G)=>rp0(G,Z));if($!==null&&typeof $==="object")return Object.fromEntries(Object.entries($).map(([G,X])=>[G,rp0(X,Z)]));return $}async function jU6($,Z){let G=$.findLastIndex((U)=>U.role==="user");if(G===-1)return $;let X=$[G],Y=X.parts.filter((U)=>U.type==="file"&&("url"in U)&&typeof U.url==="string"&&U.url.startsWith("data:"));if(Y.length===0)return $;let J=(await Promise.all(Y.map(async(U)=>{if(U.type!=="file"||!("url"in U)||typeof U.url!=="string")return null;let w=lJ$(U.url);if(!w)return null;let F=pp0(w.mimeType),H=`chat-uploads/${crypto.randomUUID()}.${F}`,N=await DU6(w.bytes,H,w.mimeType,Z);if(!N)return null;let B=await Qp(N,Z);return B?{dataUrl:U.url,presigned:B}:null}))).filter((U)=>U!==null);if(J.length===0)return $;let W=new Map(J.map((U)=>[U.dataUrl,U.presigned])),K=X.parts.map((U)=>{if(U.type!=="file"||!("url"in U)||typeof U.url!=="string")return U;let w=W.get(U.url);return w?{...U,url:w}:U});return[...$.slice(0,G),{...X,parts:K},...$.slice(G+1)]}var BU6,EU6=604800,hJ$=20971520,LU6,zU6;var ev=O(()=>{nN();vc();nJ();gJ$();BU6=new Set(["application/vnd.openxmlformats-officedocument.presentationml.presentation","application/vnd.openxmlformats-officedocument.wordprocessingml.document","application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"]);LU6=/^\[file::\/\/(.+?)\]$/,zU6=/^\[file::\/\/(.+?)\]\n([\s\S]*)$/});function lN0($,Z){return{resolveArgs:(G)=>iJ$(G,$),onToolCalled:(G)=>{if(!G.isError&&t4$(G.toolName))Av($,"in_review",Z);let X=$.organization?.id,Y=$.auth?.user?.id;if(!X||!Y)return;i1.capture({distinctId:Y,event:"tool_called",groups:{organization:X},properties:{organization_id:X,tool_source:"mcp",tool_name:G.toolName,tool_safe_name:G.toolSafeName,read_only:G.annotations?.readOnlyHint??null,destructive:G.annotations?.destructiveHint??null,idempotent:G.annotations?.idempotentHint??null,open_world:G.annotations?.openWorldHint??null,latency_ms:Math.round(G.latencyMs),is_error:G.isError}})},onPrOpened:(G)=>{L90($,G.result,G.connectionId,Z)}}}var op0=O(()=>{q4();ev();aU()});function nJ$($){if($ instanceof Error)return $.message;if(typeof $==="string")return $;if(typeof $==="object"&&$!==null){let Z=$.message;if(typeof Z==="string")return Z;try{return JSON.stringify($)}catch{return String($)}}return String($)}function pJ$($){let Z,G,X=new Promise((W)=>{G=W}),Y=(W)=>{if(Z===void 0)Z=W;G(Z)},J=($.streamText??bQ)({model:$.model,system:$.systemMessages,messages:$.messages,tools:$.tools,providerOptions:L3$,prepareStep:$.prepareStep,temperature:$.temperature,maxOutputTokens:$.maxOutputTokens,stopWhen:$.stopWhen,abortSignal:$.abortSignal,onStepFinish:$.onStepFinish,onError:async(W)=>{let K=W.error??W,U=nJ$(K);$.onError?.(U,K),Y(U)},onAbort:async()=>{Y(Z??"Run aborted before completion.")}});return Promise.resolve(J.finishReason).then(()=>{if(Z===void 0)G(void 0)}).catch((W)=>{let K=nJ$(W);$.onError?.(K,W),Y(K)}),{result:J,error:X}}var tJ$=O(()=>{L6();Cp0()});import{SpanStatusCode as ap0,trace as PU6}from"@opentelemetry/api";async function av($){let Z=$.tracer??PU6.getTracer("decopilot"),G=$.stepLimit??($.kind==="agent"?Ti1:yH),X=$.planMode??!1,Y=$.toolApprovalLevel??"auto",Q=Z.startSpan("decopilot.agent_loop",{attributes:{"decopilot.agent.id":$.virtualMcp.id,"decopilot.agent.kind":$.kind,"decopilot.organization.id":$.organization.id,"decopilot.model.id":$.models.thinking.id}}),J=await x3$({ctx:$.ctx,organization:$.organization,virtualMcp:$.virtualMcp,kind:$.kind,planMode:X,isDecopilot:$.isDecopilot,agentInstructions:$.systemAgentInstructions,currentThreadId:$.currentThreadId,user:$.user,userContext:$.userContext,codingWorkspace:$.codingWorkspace,passthroughClient:$.passthroughClient,connectionsData:$.connectionsData}),W=$.additionalSystemMessages&&$.additionalSystemMessages.length>0?[...J,...$.additionalSystemMessages]:J,{resolveArgs:K,onToolCalled:U,onPrOpened:w}=lN0($.ctx,$.currentThreadId),{tools:F}=await fJ$({kind:$.kind,ctx:$.ctx,mcpClient:$.mcpClient,writer:$.writer,planMode:X,toolApprovalLevel:Y,subtaskParams:$.subtaskParams,resolveArgs:K,onToolCalled:U,onPrOpened:w,fullBuiltInParams:$.subagentBuiltInParams}),H=$.extraTools?{...F,...$.extraTools}:F,N=$.__streamText?void 0:h90($.provider,$.models.thinking),B=(E)=>{for(let L of E.toolCalls??[]){let z=L.input?.command;if(L.toolName==="bash"&&z&&r4$(z)){Av($.ctx,"in_review",$.currentThreadId);let j=(E.toolResults??[]).find((P)=>P.toolCallId===L.toolCallId);L90($.ctx,j?.output,null,$.currentThreadId);break}}return $.onStepFinish?.(E)},D=pJ$({model:N,systemMessages:W,messages:$.messages,tools:H,prepareStep:$.prepareStep,temperature:$.temperature,maxOutputTokens:v5$($.models.thinking.limits,o7(W)+o7($.messages)+o7(H)),stopWhen:DN(G),abortSignal:$.abortSignal,onStepFinish:B,streamText:$.__streamText,onError:(E,L)=>{if(console.error(`[runAgentLoop:${$.kind}:${$.virtualMcp.id}] Error`,E),Q.setStatus({code:ap0.ERROR,message:E}),L instanceof Error)Q.recordException(L)}});return Promise.resolve(D.result.finishReason).then(()=>{Q.setStatus({code:ap0.OK})}).catch((E)=>{let L=E instanceof Error?E.message:typeof E==="string"?E:`${E}`;Q.setStatus({code:ap0.ERROR,message:L})}).finally(()=>Q.end()),{result:D.result,error:D.error,span:Q,assembledSystemMessages:W}}var _N0=O(()=>{L6();Ki0();Xw();gD();v3$();xJ$();op0();aU();tJ$()});function mN0(){let $=[],Z=!1,G=null,X=()=>{let J=G;G=null,J?.()},Y=(J)=>{if(Z)return;$.push(J),X()},Q=async function*(){try{while(!Z||$.length>0){let J=$.shift();if(J){yield J;continue}await new Promise((W)=>{G=W})}}finally{Z=!0,X()}}();return{writer:{write:(J)=>Y(J),merge:async(J)=>{let W=J;if(typeof W[Symbol.asyncIterator]==="function"){for await(let U of W)Y(U);return}let K=J.getReader();try{while(!0){let{value:U,done:w}=await K.read();if(w)return;Y(U)}}finally{K.releaseLock()}},onError:()=>{}},stream:Q,close:()=>{Z=!0,X()}}}async function TU6($){let Z=$.getReader();try{while(!0){let{done:G}=await Z.read();if(G)return}}finally{Z.releaseLock()}}async function iN0($,Z){let{runId:G,fenceToken:X}=$,Y=$.fenceOk??(()=>!0),Q=$.initialAckSeq??0,J=new Set,W;async function*K(){try{for await(let{seq:F,chunk:H}of $.chunks){if(!await Y())continue;if(F<=Q||J.has(F))continue;if(!await Z.streamBuffer.publishRawChunk(G,H,{fenceToken:X,seq:F}))throw Error("publishRawChunk failed");J.add(F);let N=Q;while(J.has(Q+1))J.delete(Q+1),Q+=1;if(Q>N)$.onPublished?.(Q);yield H}}catch(F){throw W=F,F}}let{uiStream:U,whenComplete:w}=J90({chunks:K(),originalMessages:$.originalMessages,title:{...Z.title,persistTitle:async()=>{}},persistence:Z.persistence??AU6,hooks:Z.hooks,errorMessageId:$.errorMessageId});if(await TU6(U),await w,W!==void 0){if(W instanceof Error)W.lastAckSeq=Q;throw W}if(Q>0)await Z.streamBuffer.publishDone(G,X,Q)}var AU6;var sp0=O(()=>{Gm0();AU6={emitStepParts:async()=>{},emitFinal:async()=>{},emitError:async()=>{}}});import{DBOS as PV,DBOSClient as IU6}from"@dbos-inc/dbos-sdk";function aJ$($){ep0=$}function pN0(){if(!ep0)throw Error("[background-tool] DBOS runtime not initialized \u2014 setBackgroundToolRuntime() must run before workflows fire");return ep0}function RU6(){return rJ$??=IU6.create({systemDatabaseUrl:pN0().systemDatabaseUrl,systemDatabaseSchemaName:"dbos"}),rJ$}function nN0($){let Z=$.modelMeta.capabilities;return{id:$.modelId,title:$.modelMeta.title??$.modelId,provider:$.modelMeta.providerId??null,capabilities:Z&&Z.length>0?{vision:Z.includes("vision")||Z.includes("image")||void 0,text:Z.includes("text")||void 0,reasoning:Z.includes("reasoning")||void 0}:void 0,limits:$.modelMeta.limits?{contextWindow:$.modelMeta.limits.contextWindow,maxOutputTokens:$.modelMeta.limits.maxOutputTokens??void 0}:void 0}}async function $t0($){let[Z,G,X,Y]=await Promise.all([FJ($,"smart"),CQ($,"image"),CQ($,"web_search"),CQ($,"deep_research")]);return{credentialId:Z.credentialId,thinking:nN0(Z),...G?{image:{...nN0(G),credentialId:G.credentialId}}:{},...X?{webSearch:{...nN0(X),credentialId:X.credentialId}}:{},...Y?{deepResearch:{...nN0(Y),credentialId:Y.credentialId}}:{}}}async function tN0($){let Z=await pN0().studioContextFactory($.orgId,$.userId);if(!Z)throw Error(`[background-tool] studio context unavailable for org ${$.orgId} user ${$.userId}`);return Z}function sJ$($){return{target:_90({sandboxProviderKind:$?.sandbox_provider_kind??"agent-sandbox"}),harnessId:$?.harness_id??"decopilot"}}function eJ$($,Z){return{messages:[{id:`${$.jobId}:react-msg`,role:"user",metadata:{internal:!0},parts:[{type:"text",text:Z.nudge}]}],models:Z.models,agent:{id:$.agentId},temperature:$.temperature,toolApprovalLevel:$.toolApprovalLevel,mode:"default",organizationId:$.orgId,userId:$.userId,taskId:$.threadId,branch:$.branch??void 0,resumedFromBackground:!0,target:Z.target,harnessId:Z.harnessId??void 0}}function qU6($){return{ctx:$,studioContext:()=>tN0($),emitFinal:(Z)=>PV.runStep(()=>CU6($,Z),{name:"appendResult"})}}function kU6($){if(!$?.parts)return"";return $.parts.map((Z)=>Z&&typeof Z==="object"&&Z.type==="text"?Z.text??"":"").filter((Z)=>Z.trim().length>0).join("").trim()}async function SU6($){let Z=await tN0($),G=Z.organization;if(!G)throw Error(`[background-tool] organization context unavailable for subtask (org ${$.orgId})`);let X=$.input,Y=!X.agent_id||X.agent_id===$.agentId,Q=Y?$.agentId:X.agent_id,J=await $t0(Z),W=await Z.aiProviders.activate(J.credentialId,$.orgId),K={thinking:{...J.thinking,credentialId:J.credentialId},...J.image?{image:J.image}:{},...J.webSearch?{webSearch:J.webSearch}:{},...J.deepResearch?{deepResearch:J.deepResearch}:{}},{mcpClient:U,targetKind:w,targetRef:F}=await CN0(Z,$.orgId,Q,{superUser:Y}),H=K.image,N=K.webSearch,B=K.deepResearch,D=H?.credentialId?await Z.aiProviders.activate(H.credentialId,$.orgId):null,E=N?.credentialId?await Z.aiProviders.activate(N.credentialId,$.orgId):null,L=B?.credentialId?await Z.aiProviders.activate(B.credentialId,$.orgId):null,z={provider:W,imageProvider:D,webSearchProvider:E,deepResearchProvider:L,organization:G,models:K,toolApprovalLevel:$.toolApprovalLevel,isPlanMode:!1,passthroughClient:U,pendingImages:[],vmContext:w==="virtual-mcp"?{virtualMcpId:F.id,branch:F.repo?$.branch??`thread:${$.threadId}`:"ephemeral",userId:$.userId,threadId:$.threadId}:null,taskId:$.threadId,agentId:F.id,backgroundDispatcher:null},j=mN0(),P=Gi0($.threadId),A="",M="stop";try{let S=await av({kind:"subagent",ctx:Z,organization:G,virtualMcp:F,mcpClient:U,provider:W,models:K,messages:[{role:"user",content:X.prompt}],systemAgentInstructions:F.instructions,abortSignal:P.signal,stepLimit:yH,toolApprovalLevel:"auto",planMode:!1,writer:j.writer,subtaskParams:{provider:W,organization:G,models:K,needsApproval:!1},passthroughClient:U,subagentBuiltInParams:z}),R=0,V=S.result.toUIMessageStream({generateMessageId:()=>`${$.jobId}:msg:${R++}`,messageMetadata:({part:Z0})=>Z0.type==="start"?{subtaskJobId:$.jobId}:void 0}),i=0;async function*f(){let Z0=V.getReader();try{while(!0){let{done:o,value:B0}=await Z0.read();if(o)break;yield{seq:++i,chunk:B0}}}finally{Z0.releaseLock()}}let v=new bG({storage:Z.storage.threads.messageParts(),orgId:$.orgId,threadId:$.threadId,runId:$.jobId});return await iN0({runId:$.jobId,fenceToken:$.jobId,chunks:f()},{streamBuffer:pN0().streamBuffer,persistence:v,title:{threadId:$.threadId,currentThreadTitle:void 0,persistTitle:async()=>{}},hooks:{onFinish:async(Z0,o)=>{let B0=kU6(Z0);if(B0)A=B0;if(o)M=o}}}),{report:A,finishReason:M,models:J}}finally{j.close(),Xi0($.threadId,P),await U.close().catch(()=>{})}}async function VU6($){let Z=await $.studioContext(),G=await $t0(Z),X=G.image;if(!X?.credentialId)throw Error("[background-tool] no image model configured for org");let Y=await Z.aiProviders.activate(X.credentialId,$.ctx.orgId),Q=Gi0($.ctx.threadId);try{return{result:await Qi0($.ctx.input,{provider:Y,imageModelInfo:{id:X.id},objectStorage:Z.objectStorage,allowHttpExternalUrls:O1().localMode,abortSignal:Q.signal}),models:G}}finally{Xi0($.ctx.threadId,Q)}}async function CU6($,Z){let G=await tN0($);if(!await G.storage.threads.get($.threadId))throw Error(`[background-tool] thread ${$.threadId} not found`);await new bG({storage:G.storage.threads.messageParts(),orgId:$.orgId,threadId:$.threadId,runId:$.jobId}).emitFinal({id:`${$.jobId}:msg`,role:"assistant",parts:Z})}async function $W$($){let{snapshot:Z,jobId:G,report:X}=$,Y={...Z,jobId:G,toolName:"subtask",input:{},toolCallId:`${G}:deliver`},Q=await tN0(Y),J=X.trim().length>0;await new bG({storage:Q.storage.threads.messageParts(),orgId:Z.orgId,threadId:Z.threadId,runId:G}).emitFinal({id:`${G}:result`,role:"assistant",parts:[{type:"text",text:J?X:"_The subtask produced no output._"}],metadata:{subtaskJobId:G}});let K=await $t0(Q),{target:U,harnessId:w}=sJ$(await Q.storage.threads.get(Z.threadId)),F=J?`The background subtask you started has completed. Its result:
 ${X}
@@ -2656,7 +2656,7 @@ ${Y}`:X}}catch{let G=Z.split(`
 Return ONLY valid JSON with this shape:
 {"title":"Short imperative commit title (max 72 chars)","body":"1-3 sentence PR description explaining what changed and why"}
-Use sentence case for the title. No markdown fences.`;var OV$=O(()=>{L6();Nv()});function E84($){if(!$||$.includes(".."))return!1;return D84.test($)}function DV$($){let Z=typeof $.__resolveType==="string"?$.__resolveType:null;if(!Z||!E84(Z))return null;let{__resolveType:G,...X}=$;return{resolveType:Z,payload:X}}function EV$($,Z){return`${$.replace(/\/+$/,"")}/deco/invoke/${Z}`}var D84;var LV$=O(()=>{D84=/^[\w./@-]+$/});function d$1($){let Z;try{Z=new URL($)}catch{return null}if(!Z.hostname.endsWith(".localhost"))return null;let G=Z.host;return Z.hostname="127.0.0.1",{url:Z.toString(),hostHeader:G}}function zV$($,Z){let G=$?.githubRepo;if(!G?.owner||!G?.name)return null;if(!G.connectionId)return G;if(!Z.includes(G.connectionId))return null;return G}async function jV$($,Z,G,X){if(!X.connectionId)throw new kg("Push requires a connected GitHub account. Connect mcp-github for this project and restart the sandbox.");let Y=$.organization?.id;if(!Y)throw new kg(m7);await Vv({ctx:$,connectionId:X.connectionId,organizationId:Y,forceRefresh:!0,onLegacyMintError:(w)=>{let F=w instanceof Error?w.message:m7;throw new kg(F)}});let{cloneUrl:Q,gitUserName:J,gitUserEmail:W}=await SN(X.connectionId,X.owner,X.name,$.db,$.vault),K=bL0($),U=await Z.proxyDaemonRequest(G,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({git:{repository:{cloneUrl:Q},identity:{userName:J,userEmail:W}},...K?{operator:K}:{}})});if(!U.ok){let w=await U.text().catch(()=>U.statusText);throw Error(`Failed to refresh sandbox git credentials (${U.status}): ${w}`)}}var kg;var PV$=O(()=>{QN();y$1();Tn();kg=class kg extends Error{constructor($){super($);this.name="GitPushAuthError"}}});function z84($){let Z=$.startsWith("thread:")?$.slice(7):$;if(!Z||Z.length>255||Z.includes("..")||Z.startsWith("/")||Z.endsWith("/")||Z.endsWith(".lock")||!L84.test(Z))throw Error(`Invalid branch name: ${$}`)}function Sg($){return AbortSignal.any([$.req.raw.signal,AbortSignal.timeout(A84)])}function Vg($){let{runner:Z}=$.get("vmClaim");if(!Z)return $.json({error:"No sandbox runner configured"},503);return Z}async function z7($,Z,G){let X=Vg($);if(X instanceof Response)return X;let{claimName:Y,userId:Q,projectRef:J}=$.get("vmClaim"),W=G?.method??"POST",K=null,U=new Headers;if(G?.jsonBody!==void 0)K=G.jsonBody,U.set("content-type","application/json");else if(G?.forwardJsonBody)K=await $.req.text(),U.set("content-type","application/json");let w=G?.signal,F={method:W,headers:U,body:K,...w?{signal:w}:{}},H=async()=>{let N=await X.proxyDaemonRequest(Y,Z,F);if(G?.map404to410&&N.status===404){try{await N.body?.cancel()}catch{}if(await X.adoptLiveClaim?.({userId:Q,projectRef:J},Y))N=await X.proxyDaemonRequest(Y,Z,F);if(N.status===404){try{await N.body?.cancel()}catch{}return new Response(JSON.stringify({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."}),{status:410,headers:{"content-type":"application/json",...fw}})}}let B=await N.text(),D=G?.redactRepoDirUnlessDesktop&&X.kind!=="user-desktop"?I84(B):B,E=N.headers.get("content-type")??"application/json";return new Response(D,{status:N.status,headers:{"content-type":E,...fw}})};try{if(w){let N=H();return N.catch(()=>{}),await Promise.race([N,new Promise((D,E)=>{if(w.aborted)return E(w.reason);w.addEventListener("abort",()=>E(w.reason),{once:!0})})])}return await H()}catch(N){let B=N instanceof Error?N.message:String(N);return $.json({error:`Daemon unreachable: ${B}`},502)}}function I84($){try{let Z=JSON.parse($);if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&"repoDir"in Z)return JSON.stringify({...Z,repoDir:null})}catch{}return $}async function TV$($,Z,G,X="GET",Y){let Q=await $.proxyDaemonRequest(Z,G,{method:X,headers:new Headers,body:null});if(Q.status===404&&Y){try{await Q.body?.cancel()}catch{}if(await $.adoptLiveClaim?.(Y,Z))Q=await $.proxyDaemonRequest(Z,G,{method:X,headers:new Headers,body:null})}if(Q.status===404){try{await Q.body?.cancel()}catch{}throw Error("SANDBOX_GONE")}let J=await Q.text();if(!Q.ok)try{let W=JSON.parse(J);throw Error(W.error??`Daemon error (${Q.status})`)}catch(W){if(W instanceof Error&&W.message!==J)throw W;throw Error(`Daemon error (${Q.status})`)}return JSON.parse(J)}function R84($){return IV$.includes($)}var L84,j84=524288,P84=65536,A84=1e4,AV$=2000,T84,fw,IV$,RV$=()=>{let $=new b1;return $.use("/:virtualMcpId/:branch/*",T84),$.post("/:virtualMcpId/:branch/write",(Z)=>z7(Z,"/_sandbox/write",{forwardJsonBody:!0,signal:Sg(Z)})),$.post("/:virtualMcpId/:branch/unlink",(Z)=>z7(Z,"/_sandbox/unlink",{forwardJsonBody:!0,signal:Sg(Z)})),$.post("/:virtualMcpId/:branch/mkdir",(Z)=>z7(Z,"/_sandbox/mkdir",{forwardJsonBody:!0,signal:Sg(Z)})),$.post("/:virtualMcpId/:branch/rename",(Z)=>z7(Z,"/_sandbox/rename",{forwardJsonBody:!0,signal:Sg(Z)})),$.post("/:virtualMcpId/:branch/read",(Z)=>z7(Z,"/_sandbox/read",{forwardJsonBody:!0,signal:Sg(Z)})),$.post("/:virtualMcpId/:branch/glob",(Z)=>z7(Z,"/_sandbox/glob",{forwardJsonBody:!0,signal:Sg(Z)})),$.post("/:virtualMcpId/:branch/exec/:script",(Z)=>{let G=Z.req.param("script");if(!G)return Z.json({error:"missing script name"},400);return z7(Z,`/_sandbox/exec/${encodeURIComponent(G)}`)}),$.post("/:virtualMcpId/:branch/exec/:script/kill",(Z)=>{let G=Z.req.param("script");if(!G)return Z.json({error:"missing script name"},400);return z7(Z,`/_sandbox/exec/${encodeURIComponent(G)}/kill`)}),$.get("/:virtualMcpId/:branch/config",(Z)=>z7(Z,"/_sandbox/config",{method:"GET",map404to410:!0,redactRepoDirUnlessDesktop:!0})),$.put("/:virtualMcpId/:branch/config",(Z)=>z7(Z,"/_sandbox/config",{method:"PUT",forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/setup/:step",async(Z)=>{let G=Z.req.param("step");if(!G||!R84(G))return Z.json({error:`step must be one of: ${IV$.join(", ")}`},400);if(G==="start"){let X=Z.get("vmClaim");if(X.runner){let Y=O0(Z.var.studioContext),Q=zN0(X.virtualMcpMetadata);try{await PN0({ctx:Z.var.studioContext,runner:X.runner,handle:X.claimName,orgId:Y.id,userId:X.userId,entries:Q})}catch(J){let W=J instanceof Error?J.message:String(J);return Z.json({error:`Failed to push env to daemon: ${W}`},502)}}}return z7(Z,`/_sandbox/setup/${G}`,{signal:Z.req.raw.signal,map404to410:!0})}),$.get("/:virtualMcpId/:branch/events",(Z)=>{let G=Z.get("vmClaim");if(!G.runner)return tQ(Z,async(X)=>{await X.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:"No sandbox runner configured on this mesh."})})});return KV$(Z,{ctx:Z.var.studioContext,claimName:G.claimName,runner:G.runner,virtualMcpId:G.virtualMcpId,branch:G.branch,userId:G.userId,projectRef:G.projectRef,virtualMcpMetadata:G.virtualMcpMetadata})}),$.get("/:virtualMcpId/:branch/git/status",(Z)=>z7(Z,"/_sandbox/git/status",{method:"GET",map404to410:!0,signal:AbortSignal.any([Z.req.raw.signal,AbortSignal.timeout(AV$)])})),$.post("/:virtualMcpId/:branch/git/status",(Z)=>z7(Z,"/_sandbox/git/status",{map404to410:!0,signal:AbortSignal.any([Z.req.raw.signal,AbortSignal.timeout(AV$)])})),$.post("/:virtualMcpId/:branch/git/diff",(Z)=>z7(Z,"/_sandbox/git/diff",{forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/git/publish",async(Z)=>{let G=Vg(Z);if(G instanceof Response)return G;let{claimName:X,virtualMcpMetadata:Y,connectionIds:Q}=Z.get("vmClaim"),J=Z.var.studioContext;try{await g$1(J,G,X);let W=zV$(Y,Q);if(W)await jV$(J,G,X,W)}catch(W){if(W instanceof kg)return Z.json({error:W.message},403,fw);let K=W instanceof Error?W.message:String(W);return Z.json({error:K},502,fw)}return z7(Z,"/_sandbox/git/publish",{forwardJsonBody:!0,map404to410:!0})}),$.post("/:virtualMcpId/:branch/git/discard",(Z)=>z7(Z,"/_sandbox/git/discard",{forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/git/rebase",async(Z)=>{let G=Vg(Z);if(G instanceof Response)return G;let{claimName:X}=Z.get("vmClaim"),Y=Z.var.studioContext;try{await g$1(Y,G,X)}catch(Q){let J=Q instanceof Error?Q.message:String(Q);return Z.json({error:J},502,fw)}return z7(Z,"/_sandbox/git/rebase",{forwardJsonBody:!0,map404to410:!0})}),$.post("/:virtualMcpId/:branch/git/suggest-commit",hX({maxSize:j84,onError:(Z)=>Z.json({error:"Payload too large"},413,fw)}),async(Z)=>{let G=Vg(Z);if(G instanceof Response)return G;let{claimName:X,userId:Y,projectRef:Q}=Z.get("vmClaim"),J=Z.var.studioContext;try{let W=await Z.req.json().catch(()=>({})),K=W.status,U=W.diff,w=U!=null&&typeof U.diffs==="object"&&U.diffs!==null,[F,H]=HV$(K)&&w?[K,U]:await Promise.all([TV$(G,X,"/_sandbox/git/status","GET",{userId:Y,projectRef:Q}),TV$(G,X,"/_sandbox/git/diff","GET",{userId:Y,projectRef:Q})]),N=await BV$(J,F,H);return Z.json(N,200,fw)}catch(W){let K=W instanceof Error?W.message:String(W);if(K==="SANDBOX_GONE")return Z.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,fw);return Z.json({error:K},502,fw)}}),$.get("/:virtualMcpId/:branch/preview-fetch",async(Z)=>{let G=Vg(Z);if(G instanceof Response)return G;let{claimName:X}=Z.get("vmClaim"),Y=Z.req.query("path");if(Y!=="/.decofile")return Z.json({error:"Path not allowed"},403);let Q;try{Q=await G.getPreviewUrl(X)}catch{return Z.json({error:"Preview not available"},502)}if(!Q)return Z.json({error:"Preview not available"},502);let J=Q.replace(/\/+$/,""),W=d$1(`${J}${Y}`),K;try{K=await fetch(W?.url??`${J}${Y}`,{...W?{headers:{host:W.hostHeader}}:{}})}catch{return Z.json({error:"Preview unreachable"},502)}let U;try{U=await K.text()}catch{return Z.json({error:"Preview unreachable"},502)}return new Response(U,{status:K.status,headers:{"content-type":K.headers.get("content-type")??"application/json"}})}),$.post("/:virtualMcpId/:branch/preview-invoke",hX({maxSize:P84,onError:(Z)=>Z.json({error:"Payload too large"},413)}),async(Z)=>{let G=Vg(Z);if(G instanceof Response)return G;let{claimName:X}=Z.get("vmClaim"),Y;try{Y=await G.getPreviewUrl(X)}catch{return Z.json({error:"Preview not available"},502)}if(!Y)return Z.json({error:"Preview not available"},502);let Q;try{Q=await Z.req.json()}catch{return Z.json({error:"Invalid JSON body"},400)}if(!Q||typeof Q!=="object"||Array.isArray(Q))return Z.json({error:"Invalid JSON body"},400);let J=DV$(Q);if(!J)return Z.json({error:"Invalid or missing __resolveType"},400);let W=EV$(Y,J.resolveType),K=d$1(W),U;try{U=await fetch(K?.url??W,{method:"POST",headers:{"content-type":"application/json",...K?{host:K.hostHeader}:{}},body:JSON.stringify(J.payload),signal:AbortSignal.timeout(30000)})}catch{return Z.json({error:"Preview unreachable"},502)}let w;try{w=await U.text()}catch{return Z.json({error:"Preview unreachable"},502)}return new Response(w,{status:U.status,headers:{"content-type":U.headers.get("content-type")??"application/json"}})}),$};var qV$=O(()=>{F6();Fg();EC();JV$();MY();RE0();jV();WV$();UV$();kp0();pv();OV$();LV$();PV$();L84=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;T84=QV$(async($,Z)=>{let G=$.var.studioContext;try{M0(G)}catch{return $.json({error:"Unauthorized"},401)}let X=y1(G);if(!X)return $.json({error:"Unauthorized"},401);let Y;try{Y=O0(G)}catch{return $.json({error:"Organization scope required"},403)}let Q=$.req.param("virtualMcpId"),J=$.req.param("branch");if(!Q||!J)return $.json({error:"virtualMcpId and branch are required"},400);try{z84(J)}catch(H){let N=H instanceof Error?H.message:String(H);return $.json({error:N},400)}let W=await G.storage.virtualMcps.findById(Q);if(!W||W.organization_id!==Y.id)return $.json({error:"Virtual MCP not found"},404);let K=Zw({orgId:Y.id,virtualMcpId:Q,branch:J}),U=ey({userId:X,projectRef:K},J),w=W.metadata??null,F;try{F=(await _Y(G,{userId:X,branch:J,virtualMcpMetadata:w})).provider}catch{F=null}if(!F)return $.json({error:"No sandbox runner found"},404);return $.set("vmClaim",{claimName:U,runner:F,virtualMcpId:Q,branch:J,userId:X,projectRef:K,virtualMcpMetadata:w,connectionIds:W.connections?.map((H)=>H.connection_id)??[]}),Z()});fw={"Cache-Control":"no-store, no-cache, must-revalidate",Pragma:"no-cache"};IV$=["clone","install","start"]});var MV$=($)=>{let Z=new b1;if(Z.use("*",KC),Z.route("/",oE0()),Z.route("/",eq$()),Z.route("/",nS$()),Z.route("/",VL0()),Z.route("/tools",eS$()),Z.route("/",oS$()),Z.route("/",_S$({kvStorage:$.kvStorage})),Z.route("/",VS$()),Z.route("/fs",dS$({getConnection:$.getNatsConnection})),Z.route("/sandbox",RV$()),Z.route("/",mS$()),Z.route("/deco-sites",sE0()),Z.route("/sso",jE0()),Z.route("/",CL0({tokenStorage:$.tokenStorage,automationEventDispatcher:$.automationEventDispatcher})),Z.route("/webhooks",lq$()),$.mountDevAssets)Z.route("/dev-assets",eE0({orgFromPath:!0}));return Z.use("/mcp/:connectionId?",$.mcpAuth),Z.use("/mcp/:connectionId/ui-resource",$.mcpAuth),Z.use("/mcp/gateway/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/virtual-mcp/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/self",$.mcpAuth),Z.route("/",ra1()),Z.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",$.betterAuthProtectedResourceHandler),Z.route("/mcp",JB0()),Z.route("/mcp/self",SL0()),Z.route("/mcp",UB0()),Z.all("/oauth-proxy/:connectionId/*",$.oauthProxyHandler),Z.get("/watch",$.watchHandler),Z};var kV$=O(()=>{F6();X11();mq$();K11();$L0();H11();Z11();CS$();bS$();lS$();Ci();Q01();wB0();C$1();iS$();pS$();aS$();_$1();$V$();b$1();WB0();qV$()});async function SV$($,Z){let G=new Headers({authorization:`Bearer ${$}`,"X-MCP-Session-Auth":"true"}),X=await Z.getMcpSession({headers:G}).catch(()=>null);if(X?.userId)return X.userId;let Y=await Z.verifyApiKey({body:{key:$}}).catch(()=>null);if(Y?.valid&&Y.key?.userId)return Y.key.userId;return null}var q84,M84=($)=>{let Z="";for(let G of $)Z+=String.fromCharCode(G);return btoa(Z).replaceAll("+","-").replaceAll("/","_").replace(/=+$/u,"")},Qr=($)=>{if($.trim().length===0)throw TypeError("subject token value must not be empty");return M84(new TextEncoder().encode($))},VV$=($)=>{let Z=new URL($ instanceof Request?$.url:$);if(Z.protocol!=="tunnel:")throw TypeError(`expected tunnel: URL, got ${Z.protocol}`);if(Z.hostname.trim().length===0)throw TypeError("tunnel URL hostname must not be empty");return{url:Z,hostname:Z.hostname,pathWithSearch:`${Z.pathname}${Z.search}`}},CV$=($,Z)=>{if($.trim().length===0)throw TypeError("hostname must not be empty");if(!q84.test(Z))throw TypeError("invalid requestId: expected only A-Z, a-z, 0-9, '_' or '-'");let G=Qr($),X=`tunnel.v1.host.${G}`,Y=`${X}.req.${Z}`;return{hostToken:G,request:`${X}.request`,body:`${Y}.body`,reply:`${Y}.reply`,abort:`${Y}.abort`}};var fL0=O(()=>{q84=/^[A-Za-z0-9_-]+$/});function CJ($){return`user-${Qr($)}.link`}var Jr=O(()=>{fL0()});import{z as AB}from"zod";function _V$($){let Z=Qr($),G=`tunnel.v1.host.${Z}`;return{subscribe:{allow:[`${G}.request`,`${G}.req.*.body`,`${G}.req.*.abort`,`_INBOX.${Z}.>`]},publish:{allow:[`${G}.req.*.reply`,"decopilot.stream.*"]}}}function bV$({publicUrl:$,userId:Z,ttlSeconds:G,credentials:X,token:Y}){return{connection:{urls:$.split(",").map((Q)=>Q.trim()).filter(Boolean),...X?{credentials:X}:{},...Y?{token:Y}:{}},expiresAt:new Date(Date.now()+G*1000).toISOString(),tunnelHostname:CJ(Z)}}var C5Z;var fV$=O(()=>{fL0();Jr();C5Z=AB.object({connection:AB.object({urls:AB.array(AB.string().min(1)).min(1),credentials:AB.string().optional(),token:AB.string().optional()}),expiresAt:AB.string().min(1),tunnelHostname:AB.string().min(1)})});class vL0{static encode($){if(typeof $==="string")return btoa($);let Z=Array.from($);return btoa(String.fromCharCode(...Z))}static decode($,Z=!1){let G=atob($);if(!Z)return G;let X=new Uint8Array(G.length);for(let Y=0;Y<G.length;Y++)X[Y]=G.charCodeAt(Y);return X}}class xw{static encode($){return xw.toB64URLEncoding(vL0.encode($))}static decode($,Z=!1){return vL0.decode(xw.fromB64URLEncoding($),Z)}static toB64URLEncoding($){return $=$.replace(/=/g,""),$=$.replace(/\+/g,"-"),$.replace(/\//g,"_")}static fromB64URLEncoding($){return $=$.replace(/_/g,"/"),$=$.replace(/-/g,"+"),$}}function S84($){vV$=$}function rQ(){return vV$}class yL0{static encode($){let Z=0,G=0,X=new Uint8Array($),Y=new Uint8Array($.byteLength*2),Q=0;for(let J=0;J<X.byteLength;J++){G=G<<8|X[J],Z+=8;while(Z>=5){let W=G>>>Z-5&31;Y[Q++]=l$1.charAt(W).charCodeAt(0),Z-=5}}if(Z>0){let J=G<<5-Z&31;Y[Q++]=l$1.charAt(J).charCodeAt(0)}return Y.slice(0,Q)}static decode($){let Z=0,G=0,X=0,Y=new Uint8Array($),Q=new Uint8Array(Y.byteLength*5/8|0);for(let J=0;J<Y.byteLength;J++){let W=String.fromCharCode(Y[J]),K=l$1.indexOf(W);if(K===-1)throw Error("Illegal Base32 character: "+Y[J]);if(G=G<<5|K,Z+=5,Z>=8)Q[X++]=G>>>Z-8&255,Z-=8}return Q.slice(0,X)}}class Wr{static checksum($){let Z=0;for(let G=0;G<$.byteLength;G++){let X=$[G];Z=Z<<8&65535^V84[(Z>>8^X)&255]}return Z}static validate($,Z){return Wr.checksum($)==Z}}function yV$(){return C84(Z6.User)}class jC{static isValidPublicPrefix($){return $==Z6.Server||$==Z6.Operator||$==Z6.Cluster||$==Z6.Account||$==Z6.User||$==Z6.Curve}static startsWithValidPrefix($){let Z=$[0];return Z=="S"||Z=="P"||Z=="O"||Z=="N"||Z=="C"||Z=="A"||Z=="U"||Z=="X"}static isValidPrefix($){return this.parsePrefix($)!==Z6.Unknown}static parsePrefix($){switch($){case Z6.Seed:return Z6.Seed;case Z6.Private:return Z6.Private;case Z6.Operator:return Z6.Operator;case Z6.Server:return Z6.Server;case Z6.Cluster:return Z6.Cluster;case Z6.Account:return Z6.Account;case Z6.User:return Z6.User;case Z6.Curve:return Z6.Curve;default:return Z6.Unknown}}}class wZ{static encode($,Z){if(!Z||!(Z instanceof Uint8Array))throw new d$(u$.SerializationError);if(!jC.isValidPrefix($))throw new d$(u$.InvalidPrefixByte);return wZ._encode(!1,$,Z)}static encodeSeed($,Z){if(!Z)throw new d$(u$.ApiError);if(!jC.isValidPublicPrefix($))throw new d$(u$.InvalidPrefixByte);if(Z.byteLength!==32)throw new d$(u$.InvalidSeedLen);return wZ._encode(!0,$,Z)}static decode($,Z){if(!jC.isValidPrefix($))throw new d$(u$.InvalidPrefixByte);let G=wZ._decode(Z);if(G[0]!==$)throw new d$(u$.InvalidPrefixByte);return G.slice(1)}static decodeSeed($){let Z=wZ._decode($),G=wZ._decodePrefix(Z);if(G[0]!=Z6.Seed)throw new d$(u$.InvalidSeed);if(!jC.isValidPublicPrefix(G[1]))throw new d$(u$.InvalidPrefixByte);return{buf:Z.slice(2),prefix:G[1]}}static _encode($,Z,G){let X=$?2:1,Y=G.byteLength,Q=X+Y+2,J=X+Y,W=new Uint8Array(Q);if($){let w=wZ._encodePrefix(Z6.Seed,Z);W.set(w)}else W[0]=Z;W.set(G,X);let K=Wr.checksum(W.slice(0,J));return new DataView(W.buffer).setUint16(J,K,!0),yL0.encode(W)}static _decode($){if($.byteLength<4)throw new d$(u$.InvalidEncoding);let Z;try{Z=yL0.decode($)}catch(J){throw new d$(u$.InvalidEncoding,J)}let G=Z.byteLength-2,Y=new DataView(Z.buffer).getUint16(G,!0),Q=Z.slice(0,G);if(!Wr.validate(Q,Y))throw new d$(u$.InvalidChecksum);return Q}static _encodePrefix($,Z){let G=$|Z>>5,X=(Z&31)<<3;return new Uint8Array([G,X])}static _decodePrefix($){let Z=$[0]&248,G=($[0]&7)<<5|($[1]&248)>>3;return new Uint8Array([Z,G])}}class i$1{seed;constructor($){this.seed=$}getRawSeed(){if(!this.seed)throw new d$(u$.ClearedPair);return wZ.decodeSeed(this.seed).buf}getSeed(){if(!this.seed)throw new d$(u$.ClearedPair);return this.seed}getPublicKey(){if(!this.seed)throw new d$(u$.ClearedPair);let $=wZ.decodeSeed(this.seed),Z=rQ().fromSeed(this.getRawSeed()),G=wZ.encode($.prefix,Z.publicKey);return new TextDecoder().decode(G)}getPrivateKey(){if(!this.seed)throw new d$(u$.ClearedPair);let $=rQ().fromSeed(this.getRawSeed());return wZ.encode(Z6.Private,$.secretKey)}sign($){if(!this.seed)throw new d$(u$.ClearedPair);let Z=rQ().fromSeed(this.getRawSeed());return rQ().sign($,Z.secretKey)}verify($,Z){if(!this.seed)throw new d$(u$.ClearedPair);let G=rQ().fromSeed(this.getRawSeed());return rQ().verify($,Z,G.publicKey)}clear(){if(!this.seed)return;this.seed.fill(0),this.seed=void 0}seal($,Z,G){throw new d$(u$.InvalidNKeyOperation)}open($,Z){throw new d$(u$.InvalidNKeyOperation)}}class n$1{seed;constructor($){this.seed=$}clear(){if(!this.seed)return;this.seed.fill(0),this.seed=void 0}getPrivateKey(){if(!this.seed)throw new d$(u$.ClearedPair);return wZ.encode(Z6.Private,this.seed)}getPublicKey(){if(!this.seed)throw new d$(u$.ClearedPair);let $=rQ().scalarBaseMultiply(this.seed),Z=wZ.encode(Z6.Curve,$);return new TextDecoder().decode(Z)}getSeed(){if(!this.seed)throw new d$(u$.ClearedPair);return wZ.encodeSeed(Z6.Curve,this.seed)}sign(){throw new d$(u$.InvalidCurveOperation)}verify(){throw new d$(u$.InvalidCurveOperation)}decodePubCurveKey($){try{let Z=yL0.decode(new TextEncoder().encode($));if(Z.byteLength!==35)throw new d$(u$.InvalidCurveKey);if(Z[0]!==Z6.Curve)throw new d$(u$.InvalidPublicKey);let G=Z.byteLength-2,Y=new DataView(Z.buffer).getUint16(G,!0),Q=Z.slice(0,G);if(!Wr.validate(Q,Y))throw new d$(u$.InvalidChecksum);return Q.slice(1)}catch(Z){throw new d$(u$.InvalidRecipient,Z)}}seal($,Z,G){if(!this.seed)throw new d$(u$.ClearedPair);if(!G)G=rQ().randomBytes(xV$);let X=this.decodePubCurveKey(Z),Y=new Uint8Array(zC.length+24);Y.set(zC,0),Y.set(G,zC.length);let Q=rQ().seal($,G,X,this.seed),J=new Uint8Array(Y.length+Q.length);return J.set(Y),J.set(Q,Y.length),J}open($,Z){if(!this.seed)throw new d$(u$.ClearedPair);if($.length<=24+zC.length)throw new d$(u$.InvalidEncrypted);for(let Y=0;Y<zC.length;Y++)if($[Y]!==zC[Y])throw new d$(u$.InvalidEncrypted);let G=this.decodePubCurveKey(Z);$=$.slice(zC.length);let X=$.slice(0,24);return $=$.slice(xV$),rQ().open($,X,G,this.seed)}}function C84($){let Z=$===Z6.Curve?32:32,G=rQ().randomBytes(Z),X=wZ.encodeSeed($,new Uint8Array(G));return $===Z6.Curve?new n$1(new Uint8Array(G)):new i$1(X)}class gV${publicKey;constructor($){this.publicKey=$}getPublicKey(){if(!this.publicKey)throw new d$(u$.ClearedPair);return new TextDecoder().decode(this.publicKey)}getPrivateKey(){if(!this.publicKey)throw new d$(u$.ClearedPair);throw new d$(u$.PublicKeyOnly)}getSeed(){if(!this.publicKey)throw new d$(u$.ClearedPair);throw new d$(u$.PublicKeyOnly)}sign($){if(!this.publicKey)throw new d$(u$.ClearedPair);throw new d$(u$.CannotSign)}verify($,Z){if(!this.publicKey)throw new d$(u$.ClearedPair);let G=wZ._decode(this.publicKey);return rQ().verify($,Z,G.slice(1))}clear(){if(!this.publicKey)return;this.publicKey.fill(0),this.publicKey=void 0}seal($,Z,G){throw new d$(u$.InvalidNKeyOperation)}open($,Z){throw new d$(u$.InvalidNKeyOperation)}}function p$1($){let Z=new TextEncoder().encode($),G=wZ._decode(Z),X=jC.parsePrefix(G[0]);if(jC.isValidPublicPrefix(X))return new gV$(Z);throw new d$(u$.InvalidPublicKey)}function _84($){let Z=wZ.decodeSeed($);if(Z.prefix!==Z6.Curve)throw new d$(u$.InvalidCurveSeed);if(Z.buf.byteLength!==32)throw new d$(u$.InvalidSeedLen);return new n$1(Z.buf)}function t$1($){if(wZ.decodeSeed($).prefix===Z6.Curve)return _84($);return new i$1($)}function b84($){if($ instanceof Uint8Array)$=new TextDecoder().decode($);if($.charAt(0)==="S")return t$1(new TextEncoder().encode($));return p$1($)}function xL0($,Z="",G=!1){let X=typeof $==="string"||$ instanceof Uint8Array?b84($):$,Y=X.getPublicKey(),Q=[];if(!Array.isArray(Z)){if(Z!=="")Q.push(Z)}else Q.push(...Z);if(Z.length>0&&Q.indexOf(Y.charAt(0))===-1)throw Error(`unexpected type ${Y.charAt(0)} - wanted ${Q}`);if(G)X.getPrivateKey();return X}function f84($={}){return hV$({data:-1,payload:-1,subs:-1},$)}function hV$($,...Z){for(let G=0;G<Z.length;G++){let X=Z[G];Object.assign($,X)}return $}function x84($){let{exp:Z,nbf:G,aud:X}=$;return hV$({},{exp:Z,nbf:G,aud:X})}function v84($={}){if(!$.algorithm)$.algorithm=_J.v2;return $}async function cV$($,Z,G,X={},Y={}){G=xL0(G,"A",!Y.signer);let Q=G;if(Y.signer)Q=xL0(Y.signer,"A",!0);Z=xL0(Z,"U");let J=x84(Y);if(J.name=$,J.sub=Z.getPublicKey(),J.nats=Y.scopedUser?X:f84(X),Y.signer)J.nats.issuer_account=G.getPublicKey();let W=v84(Y);return y84(W.algorithm,m$1.User,J),await c84(W.algorithm,J,Q)}function y84($,Z,G){if(G.aud=G.aud||"NATS",$===_J.v2)G.nats.type=Z;else G.type=Z}function uV$($){let Z=$.split(".");if(Z.length!==3)throw Error(`invalid jwt - ${Z.length} chunks: ${$}`);let G=JSON.parse(xw.decode(Z[0]));if(G.typ!=="jwt"&&G.typ!=="JWT")throw Error(`not a nats jwt - typ ${G.type}`);if(G.alg!==_J.v1&&G.alg!==_J.v2)throw Error(`not a nats jwt - alg ${G.alg}`);let X=JSON.parse(xw.decode(Z[1])),Y=xL0(X.iss),Q=xw.decode(Z[2],!0),J=new TextEncoder,W=G.alg===_J.v2?`${Z[0]}.${Z[1]}`:Z[1];if(!Y.verify(J.encode(W),Q))throw Error("sig verification failed");return X}function g84($){for(let Z=0;Z<$.length;Z++)$[Z]=Math.floor(Math.random()*255)}function h84(){let $=new Uint8Array(12);g84($);let Z=Array.from($);return btoa(String.fromCharCode(...Z))}async function c84($,Z,G){Z.iss=G.getPublicKey(),Z.iat=Math.floor(Date.now()/1000);let X=Z;if($===_J.v2)X.nats.version=2;let Y=new TextEncoder,Q=Y.encode(JSON.stringify(Z));if(globalThis.crypto&&globalThis.crypto.subtle){let F=await globalThis.crypto.subtle.digest("SHA-512",Q);Z.jti=vL0.encode(new Uint8Array(F))}else Z.jti=h84();let J={typ:"JWT",alg:$},W=xw.encode(JSON.stringify(J)),K=xw.encode(JSON.stringify(Z)),U=$===_J.v2?`${W}.${K}`:K,w=xw.encode(G.sign(Y.encode(U)));return`${W}.${K}.${w}`}function dV$($,Z){let G=new TextDecoder().decode(Z.getSeed()),X=`-----BEGIN NATS USER JWT-----
+Use sentence case for the title. No markdown fences.`;var OV$=O(()=>{L6();Nv()});function E84($){if(!$||$.includes(".."))return!1;return D84.test($)}function DV$($){let Z=typeof $.__resolveType==="string"?$.__resolveType:null;if(!Z||!E84(Z))return null;let{__resolveType:G,...X}=$;return{resolveType:Z,payload:X}}function EV$($,Z){return`${$.replace(/\/+$/,"")}/deco/invoke/${Z}`}var D84;var LV$=O(()=>{D84=/^[\w./@-]+$/});function d$1($){let Z;try{Z=new URL($)}catch{return null}if(!Z.hostname.endsWith(".localhost"))return null;let G=Z.host;return Z.hostname="127.0.0.1",{url:Z.toString(),hostHeader:G}}function zV$($,Z){let G=$?.githubRepo;if(!G?.owner||!G?.name)return null;if(!G.connectionId)return G;if(!Z.includes(G.connectionId))return null;return G}async function jV$($,Z,G,X){if(!X.connectionId)throw new kg("Push requires a connected GitHub account. Connect mcp-github for this project and restart the sandbox.");let Y=$.organization?.id;if(!Y)throw new kg(m7);await Vv({ctx:$,connectionId:X.connectionId,organizationId:Y,forceRefresh:!0,onLegacyMintError:(w)=>{let F=w instanceof Error?w.message:m7;throw new kg(F)}});let{cloneUrl:Q,gitUserName:J,gitUserEmail:W}=await SN(X.connectionId,X.owner,X.name,$.db,$.vault),K=bL0($),U=await Z.proxyDaemonRequest(G,"/_sandbox/config",{method:"PUT",headers:new Headers({"content-type":"application/json"}),body:JSON.stringify({git:{repository:{cloneUrl:Q},identity:{userName:J,userEmail:W}},...K?{operator:K}:{}})});if(!U.ok){let w=await U.text().catch(()=>U.statusText);throw Error(`Failed to refresh sandbox git credentials (${U.status}): ${w}`)}}var kg;var PV$=O(()=>{QN();y$1();Tn();kg=class kg extends Error{constructor($){super($);this.name="GitPushAuthError"}}});function z84($){let Z=$.startsWith("thread:")?$.slice(7):$;if(!Z||Z.length>255||Z.includes("..")||Z.startsWith("/")||Z.endsWith("/")||Z.endsWith(".lock")||!L84.test(Z))throw Error(`Invalid branch name: ${$}`)}function Sg($){return AbortSignal.any([$.req.raw.signal,AbortSignal.timeout(A84)])}function Vg($){let{runner:Z}=$.get("vmClaim");if(!Z)return $.json({error:"No sandbox runner configured"},503);return Z}async function z7($,Z,G){let X=Vg($);if(X instanceof Response)return X;let{claimName:Y,userId:Q,projectRef:J}=$.get("vmClaim"),W=G?.method??"POST",K=null,U=new Headers;if(G?.jsonBody!==void 0)K=G.jsonBody,U.set("content-type","application/json");else if(G?.forwardJsonBody)K=await $.req.text(),U.set("content-type","application/json");let w=G?.signal,F={method:W,headers:U,body:K,...w?{signal:w}:{}},H=async()=>{let N=await X.proxyDaemonRequest(Y,Z,F);if(G?.map404to410&&N.status===404){try{await N.body?.cancel()}catch{}if(await X.adoptLiveClaim?.({userId:Q,projectRef:J},Y))N=await X.proxyDaemonRequest(Y,Z,F);if(N.status===404){try{await N.body?.cancel()}catch{}return new Response(JSON.stringify({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."}),{status:410,headers:{"content-type":"application/json",...fw}})}}let B=await N.text(),D=G?.redactRepoDirUnlessDesktop&&X.kind!=="user-desktop"?I84(B):B,E=N.headers.get("content-type")??"application/json";return new Response(D,{status:N.status,headers:{"content-type":E,...fw}})};try{if(w){let N=H();return N.catch(()=>{}),await Promise.race([N,new Promise((D,E)=>{if(w.aborted)return E(w.reason);w.addEventListener("abort",()=>E(w.reason),{once:!0})})])}return await H()}catch(N){let B=N instanceof Error?N.message:String(N);return $.json({error:`Daemon unreachable: ${B}`},502)}}function I84($){try{let Z=JSON.parse($);if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&"repoDir"in Z)return JSON.stringify({...Z,repoDir:null})}catch{}return $}async function TV$($,Z,G,X="GET",Y){let Q=await $.proxyDaemonRequest(Z,G,{method:X,headers:new Headers,body:null});if(Q.status===404&&Y){try{await Q.body?.cancel()}catch{}if(await $.adoptLiveClaim?.(Y,Z))Q=await $.proxyDaemonRequest(Z,G,{method:X,headers:new Headers,body:null})}if(Q.status===404){try{await Q.body?.cancel()}catch{}throw Error("SANDBOX_GONE")}let J=await Q.text();if(!Q.ok)try{let W=JSON.parse(J);throw Error(W.error??`Daemon error (${Q.status})`)}catch(W){if(W instanceof Error&&W.message!==J)throw W;throw Error(`Daemon error (${Q.status})`)}return JSON.parse(J)}function R84($){return IV$.includes($)}var L84,j84=524288,P84=65536,A84=1e4,AV$=2000,T84,fw,IV$,RV$=()=>{let $=new b1;return $.use("/:virtualMcpId/:branch/*",T84),$.post("/:virtualMcpId/:branch/write",(Z)=>z7(Z,"/_sandbox/write",{forwardJsonBody:!0,signal:Sg(Z)})),$.post("/:virtualMcpId/:branch/unlink",(Z)=>z7(Z,"/_sandbox/unlink",{forwardJsonBody:!0,signal:Sg(Z)})),$.post("/:virtualMcpId/:branch/mkdir",(Z)=>z7(Z,"/_sandbox/mkdir",{forwardJsonBody:!0,signal:Sg(Z)})),$.post("/:virtualMcpId/:branch/rename",(Z)=>z7(Z,"/_sandbox/rename",{forwardJsonBody:!0,signal:Sg(Z)})),$.post("/:virtualMcpId/:branch/read",(Z)=>z7(Z,"/_sandbox/read",{forwardJsonBody:!0,signal:Sg(Z)})),$.post("/:virtualMcpId/:branch/glob",(Z)=>z7(Z,"/_sandbox/glob",{forwardJsonBody:!0,signal:Sg(Z)})),$.post("/:virtualMcpId/:branch/exec/:script",(Z)=>{let G=Z.req.param("script");if(!G)return Z.json({error:"missing script name"},400);return z7(Z,`/_sandbox/exec/${encodeURIComponent(G)}`)}),$.post("/:virtualMcpId/:branch/exec/:script/kill",(Z)=>{let G=Z.req.param("script");if(!G)return Z.json({error:"missing script name"},400);return z7(Z,`/_sandbox/exec/${encodeURIComponent(G)}/kill`)}),$.get("/:virtualMcpId/:branch/config",(Z)=>z7(Z,"/_sandbox/config",{method:"GET",map404to410:!0,redactRepoDirUnlessDesktop:!0})),$.put("/:virtualMcpId/:branch/config",(Z)=>z7(Z,"/_sandbox/config",{method:"PUT",forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/setup/:step",async(Z)=>{let G=Z.req.param("step");if(!G||!R84(G))return Z.json({error:`step must be one of: ${IV$.join(", ")}`},400);if(G==="start"){let X=Z.get("vmClaim");if(X.runner){let Y=O0(Z.var.studioContext),Q=zN0(X.virtualMcpMetadata);try{await PN0({ctx:Z.var.studioContext,runner:X.runner,handle:X.claimName,orgId:Y.id,userId:X.userId,entries:Q})}catch(J){let W=J instanceof Error?J.message:String(J);return Z.json({error:`Failed to push env to daemon: ${W}`},502)}}}return z7(Z,`/_sandbox/setup/${G}`,{signal:Z.req.raw.signal,map404to410:!0})}),$.get("/:virtualMcpId/:branch/events",(Z)=>{let G=Z.get("vmClaim");if(!G.runner)return tQ(Z,async(X)=>{await X.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:"No sandbox runner configured on this studio instance."})})});return KV$(Z,{ctx:Z.var.studioContext,claimName:G.claimName,runner:G.runner,virtualMcpId:G.virtualMcpId,branch:G.branch,userId:G.userId,projectRef:G.projectRef,virtualMcpMetadata:G.virtualMcpMetadata})}),$.get("/:virtualMcpId/:branch/git/status",(Z)=>z7(Z,"/_sandbox/git/status",{method:"GET",map404to410:!0,signal:AbortSignal.any([Z.req.raw.signal,AbortSignal.timeout(AV$)])})),$.post("/:virtualMcpId/:branch/git/status",(Z)=>z7(Z,"/_sandbox/git/status",{map404to410:!0,signal:AbortSignal.any([Z.req.raw.signal,AbortSignal.timeout(AV$)])})),$.post("/:virtualMcpId/:branch/git/diff",(Z)=>z7(Z,"/_sandbox/git/diff",{forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/git/publish",async(Z)=>{let G=Vg(Z);if(G instanceof Response)return G;let{claimName:X,virtualMcpMetadata:Y,connectionIds:Q}=Z.get("vmClaim"),J=Z.var.studioContext;try{await g$1(J,G,X);let W=zV$(Y,Q);if(W)await jV$(J,G,X,W)}catch(W){if(W instanceof kg)return Z.json({error:W.message},403,fw);let K=W instanceof Error?W.message:String(W);return Z.json({error:K},502,fw)}return z7(Z,"/_sandbox/git/publish",{forwardJsonBody:!0,map404to410:!0})}),$.post("/:virtualMcpId/:branch/git/discard",(Z)=>z7(Z,"/_sandbox/git/discard",{forwardJsonBody:!0,map404to410:!0})),$.post("/:virtualMcpId/:branch/git/rebase",async(Z)=>{let G=Vg(Z);if(G instanceof Response)return G;let{claimName:X}=Z.get("vmClaim"),Y=Z.var.studioContext;try{await g$1(Y,G,X)}catch(Q){let J=Q instanceof Error?Q.message:String(Q);return Z.json({error:J},502,fw)}return z7(Z,"/_sandbox/git/rebase",{forwardJsonBody:!0,map404to410:!0})}),$.post("/:virtualMcpId/:branch/git/suggest-commit",hX({maxSize:j84,onError:(Z)=>Z.json({error:"Payload too large"},413,fw)}),async(Z)=>{let G=Vg(Z);if(G instanceof Response)return G;let{claimName:X,userId:Y,projectRef:Q}=Z.get("vmClaim"),J=Z.var.studioContext;try{let W=await Z.req.json().catch(()=>({})),K=W.status,U=W.diff,w=U!=null&&typeof U.diffs==="object"&&U.diffs!==null,[F,H]=HV$(K)&&w?[K,U]:await Promise.all([TV$(G,X,"/_sandbox/git/status","GET",{userId:Y,projectRef:Q}),TV$(G,X,"/_sandbox/git/diff","GET",{userId:Y,projectRef:Q})]),N=await BV$(J,F,H);return Z.json(N,200,fw)}catch(W){let K=W instanceof Error?W.message:String(W);if(K==="SANDBOX_GONE")return Z.json({error:"Sandbox handle is gone. The sandbox needs to be re-provisioned."},410,fw);return Z.json({error:K},502,fw)}}),$.get("/:virtualMcpId/:branch/preview-fetch",async(Z)=>{let G=Vg(Z);if(G instanceof Response)return G;let{claimName:X}=Z.get("vmClaim"),Y=Z.req.query("path");if(Y!=="/.decofile")return Z.json({error:"Path not allowed"},403);let Q;try{Q=await G.getPreviewUrl(X)}catch{return Z.json({error:"Preview not available"},502)}if(!Q)return Z.json({error:"Preview not available"},502);let J=Q.replace(/\/+$/,""),W=d$1(`${J}${Y}`),K;try{K=await fetch(W?.url??`${J}${Y}`,{...W?{headers:{host:W.hostHeader}}:{}})}catch{return Z.json({error:"Preview unreachable"},502)}let U;try{U=await K.text()}catch{return Z.json({error:"Preview unreachable"},502)}return new Response(U,{status:K.status,headers:{"content-type":K.headers.get("content-type")??"application/json"}})}),$.post("/:virtualMcpId/:branch/preview-invoke",hX({maxSize:P84,onError:(Z)=>Z.json({error:"Payload too large"},413)}),async(Z)=>{let G=Vg(Z);if(G instanceof Response)return G;let{claimName:X}=Z.get("vmClaim"),Y;try{Y=await G.getPreviewUrl(X)}catch{return Z.json({error:"Preview not available"},502)}if(!Y)return Z.json({error:"Preview not available"},502);let Q;try{Q=await Z.req.json()}catch{return Z.json({error:"Invalid JSON body"},400)}if(!Q||typeof Q!=="object"||Array.isArray(Q))return Z.json({error:"Invalid JSON body"},400);let J=DV$(Q);if(!J)return Z.json({error:"Invalid or missing __resolveType"},400);let W=EV$(Y,J.resolveType),K=d$1(W),U;try{U=await fetch(K?.url??W,{method:"POST",headers:{"content-type":"application/json",...K?{host:K.hostHeader}:{}},body:JSON.stringify(J.payload),signal:AbortSignal.timeout(30000)})}catch{return Z.json({error:"Preview unreachable"},502)}let w;try{w=await U.text()}catch{return Z.json({error:"Preview unreachable"},502)}return new Response(w,{status:U.status,headers:{"content-type":U.headers.get("content-type")??"application/json"}})}),$};var qV$=O(()=>{F6();Fg();EC();JV$();MY();RE0();jV();WV$();UV$();kp0();pv();OV$();LV$();PV$();L84=/^[a-zA-Z0-9][a-zA-Z0-9/._-]*$/;T84=QV$(async($,Z)=>{let G=$.var.studioContext;try{M0(G)}catch{return $.json({error:"Unauthorized"},401)}let X=y1(G);if(!X)return $.json({error:"Unauthorized"},401);let Y;try{Y=O0(G)}catch{return $.json({error:"Organization scope required"},403)}let Q=$.req.param("virtualMcpId"),J=$.req.param("branch");if(!Q||!J)return $.json({error:"virtualMcpId and branch are required"},400);try{z84(J)}catch(H){let N=H instanceof Error?H.message:String(H);return $.json({error:N},400)}let W=await G.storage.virtualMcps.findById(Q);if(!W||W.organization_id!==Y.id)return $.json({error:"Virtual MCP not found"},404);let K=Zw({orgId:Y.id,virtualMcpId:Q,branch:J}),U=ey({userId:X,projectRef:K},J),w=W.metadata??null,F;try{F=(await _Y(G,{userId:X,branch:J,virtualMcpMetadata:w})).provider}catch{F=null}if(!F)return $.json({error:"No sandbox runner found"},404);return $.set("vmClaim",{claimName:U,runner:F,virtualMcpId:Q,branch:J,userId:X,projectRef:K,virtualMcpMetadata:w,connectionIds:W.connections?.map((H)=>H.connection_id)??[]}),Z()});fw={"Cache-Control":"no-store, no-cache, must-revalidate",Pragma:"no-cache"};IV$=["clone","install","start"]});var MV$=($)=>{let Z=new b1;if(Z.use("*",KC),Z.route("/",oE0()),Z.route("/",eq$()),Z.route("/",nS$()),Z.route("/",VL0()),Z.route("/tools",eS$()),Z.route("/",oS$()),Z.route("/",_S$({kvStorage:$.kvStorage})),Z.route("/",VS$()),Z.route("/fs",dS$({getConnection:$.getNatsConnection})),Z.route("/sandbox",RV$()),Z.route("/",mS$()),Z.route("/deco-sites",sE0()),Z.route("/sso",jE0()),Z.route("/",CL0({tokenStorage:$.tokenStorage,automationEventDispatcher:$.automationEventDispatcher})),Z.route("/webhooks",lq$()),$.mountDevAssets)Z.route("/dev-assets",eE0({orgFromPath:!0}));return Z.use("/mcp/:connectionId?",$.mcpAuth),Z.use("/mcp/:connectionId/ui-resource",$.mcpAuth),Z.use("/mcp/gateway/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/virtual-mcp/:virtualMcpId?",$.mcpAuth),Z.use("/mcp/self",$.mcpAuth),Z.route("/",ra1()),Z.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",$.betterAuthProtectedResourceHandler),Z.route("/mcp",JB0()),Z.route("/mcp/self",SL0()),Z.route("/mcp",UB0()),Z.all("/oauth-proxy/:connectionId/*",$.oauthProxyHandler),Z.get("/watch",$.watchHandler),Z};var kV$=O(()=>{F6();X11();mq$();K11();$L0();H11();Z11();CS$();bS$();lS$();Ci();Q01();wB0();C$1();iS$();pS$();aS$();_$1();$V$();b$1();WB0();qV$()});async function SV$($,Z){let G=new Headers({authorization:`Bearer ${$}`,"X-MCP-Session-Auth":"true"}),X=await Z.getMcpSession({headers:G}).catch(()=>null);if(X?.userId)return X.userId;let Y=await Z.verifyApiKey({body:{key:$}}).catch(()=>null);if(Y?.valid&&Y.key?.userId)return Y.key.userId;return null}var q84,M84=($)=>{let Z="";for(let G of $)Z+=String.fromCharCode(G);return btoa(Z).replaceAll("+","-").replaceAll("/","_").replace(/=+$/u,"")},Qr=($)=>{if($.trim().length===0)throw TypeError("subject token value must not be empty");return M84(new TextEncoder().encode($))},VV$=($)=>{let Z=new URL($ instanceof Request?$.url:$);if(Z.protocol!=="tunnel:")throw TypeError(`expected tunnel: URL, got ${Z.protocol}`);if(Z.hostname.trim().length===0)throw TypeError("tunnel URL hostname must not be empty");return{url:Z,hostname:Z.hostname,pathWithSearch:`${Z.pathname}${Z.search}`}},CV$=($,Z)=>{if($.trim().length===0)throw TypeError("hostname must not be empty");if(!q84.test(Z))throw TypeError("invalid requestId: expected only A-Z, a-z, 0-9, '_' or '-'");let G=Qr($),X=`tunnel.v1.host.${G}`,Y=`${X}.req.${Z}`;return{hostToken:G,request:`${X}.request`,body:`${Y}.body`,reply:`${Y}.reply`,abort:`${Y}.abort`}};var fL0=O(()=>{q84=/^[A-Za-z0-9_-]+$/});function CJ($){return`user-${Qr($)}.link`}var Jr=O(()=>{fL0()});import{z as AB}from"zod";function _V$($){let Z=Qr($),G=`tunnel.v1.host.${Z}`;return{subscribe:{allow:[`${G}.request`,`${G}.req.*.body`,`${G}.req.*.abort`,`_INBOX.${Z}.>`]},publish:{allow:[`${G}.req.*.reply`,"decopilot.stream.*"]}}}function bV$({publicUrl:$,userId:Z,ttlSeconds:G,credentials:X,token:Y}){return{connection:{urls:$.split(",").map((Q)=>Q.trim()).filter(Boolean),...X?{credentials:X}:{},...Y?{token:Y}:{}},expiresAt:new Date(Date.now()+G*1000).toISOString(),tunnelHostname:CJ(Z)}}var C5Z;var fV$=O(()=>{fL0();Jr();C5Z=AB.object({connection:AB.object({urls:AB.array(AB.string().min(1)).min(1),credentials:AB.string().optional(),token:AB.string().optional()}),expiresAt:AB.string().min(1),tunnelHostname:AB.string().min(1)})});class vL0{static encode($){if(typeof $==="string")return btoa($);let Z=Array.from($);return btoa(String.fromCharCode(...Z))}static decode($,Z=!1){let G=atob($);if(!Z)return G;let X=new Uint8Array(G.length);for(let Y=0;Y<G.length;Y++)X[Y]=G.charCodeAt(Y);return X}}class xw{static encode($){return xw.toB64URLEncoding(vL0.encode($))}static decode($,Z=!1){return vL0.decode(xw.fromB64URLEncoding($),Z)}static toB64URLEncoding($){return $=$.replace(/=/g,""),$=$.replace(/\+/g,"-"),$.replace(/\//g,"_")}static fromB64URLEncoding($){return $=$.replace(/_/g,"/"),$=$.replace(/-/g,"+"),$}}function S84($){vV$=$}function rQ(){return vV$}class yL0{static encode($){let Z=0,G=0,X=new Uint8Array($),Y=new Uint8Array($.byteLength*2),Q=0;for(let J=0;J<X.byteLength;J++){G=G<<8|X[J],Z+=8;while(Z>=5){let W=G>>>Z-5&31;Y[Q++]=l$1.charAt(W).charCodeAt(0),Z-=5}}if(Z>0){let J=G<<5-Z&31;Y[Q++]=l$1.charAt(J).charCodeAt(0)}return Y.slice(0,Q)}static decode($){let Z=0,G=0,X=0,Y=new Uint8Array($),Q=new Uint8Array(Y.byteLength*5/8|0);for(let J=0;J<Y.byteLength;J++){let W=String.fromCharCode(Y[J]),K=l$1.indexOf(W);if(K===-1)throw Error("Illegal Base32 character: "+Y[J]);if(G=G<<5|K,Z+=5,Z>=8)Q[X++]=G>>>Z-8&255,Z-=8}return Q.slice(0,X)}}class Wr{static checksum($){let Z=0;for(let G=0;G<$.byteLength;G++){let X=$[G];Z=Z<<8&65535^V84[(Z>>8^X)&255]}return Z}static validate($,Z){return Wr.checksum($)==Z}}function yV$(){return C84(Z6.User)}class jC{static isValidPublicPrefix($){return $==Z6.Server||$==Z6.Operator||$==Z6.Cluster||$==Z6.Account||$==Z6.User||$==Z6.Curve}static startsWithValidPrefix($){let Z=$[0];return Z=="S"||Z=="P"||Z=="O"||Z=="N"||Z=="C"||Z=="A"||Z=="U"||Z=="X"}static isValidPrefix($){return this.parsePrefix($)!==Z6.Unknown}static parsePrefix($){switch($){case Z6.Seed:return Z6.Seed;case Z6.Private:return Z6.Private;case Z6.Operator:return Z6.Operator;case Z6.Server:return Z6.Server;case Z6.Cluster:return Z6.Cluster;case Z6.Account:return Z6.Account;case Z6.User:return Z6.User;case Z6.Curve:return Z6.Curve;default:return Z6.Unknown}}}class wZ{static encode($,Z){if(!Z||!(Z instanceof Uint8Array))throw new d$(u$.SerializationError);if(!jC.isValidPrefix($))throw new d$(u$.InvalidPrefixByte);return wZ._encode(!1,$,Z)}static encodeSeed($,Z){if(!Z)throw new d$(u$.ApiError);if(!jC.isValidPublicPrefix($))throw new d$(u$.InvalidPrefixByte);if(Z.byteLength!==32)throw new d$(u$.InvalidSeedLen);return wZ._encode(!0,$,Z)}static decode($,Z){if(!jC.isValidPrefix($))throw new d$(u$.InvalidPrefixByte);let G=wZ._decode(Z);if(G[0]!==$)throw new d$(u$.InvalidPrefixByte);return G.slice(1)}static decodeSeed($){let Z=wZ._decode($),G=wZ._decodePrefix(Z);if(G[0]!=Z6.Seed)throw new d$(u$.InvalidSeed);if(!jC.isValidPublicPrefix(G[1]))throw new d$(u$.InvalidPrefixByte);return{buf:Z.slice(2),prefix:G[1]}}static _encode($,Z,G){let X=$?2:1,Y=G.byteLength,Q=X+Y+2,J=X+Y,W=new Uint8Array(Q);if($){let w=wZ._encodePrefix(Z6.Seed,Z);W.set(w)}else W[0]=Z;W.set(G,X);let K=Wr.checksum(W.slice(0,J));return new DataView(W.buffer).setUint16(J,K,!0),yL0.encode(W)}static _decode($){if($.byteLength<4)throw new d$(u$.InvalidEncoding);let Z;try{Z=yL0.decode($)}catch(J){throw new d$(u$.InvalidEncoding,J)}let G=Z.byteLength-2,Y=new DataView(Z.buffer).getUint16(G,!0),Q=Z.slice(0,G);if(!Wr.validate(Q,Y))throw new d$(u$.InvalidChecksum);return Q}static _encodePrefix($,Z){let G=$|Z>>5,X=(Z&31)<<3;return new Uint8Array([G,X])}static _decodePrefix($){let Z=$[0]&248,G=($[0]&7)<<5|($[1]&248)>>3;return new Uint8Array([Z,G])}}class i$1{seed;constructor($){this.seed=$}getRawSeed(){if(!this.seed)throw new d$(u$.ClearedPair);return wZ.decodeSeed(this.seed).buf}getSeed(){if(!this.seed)throw new d$(u$.ClearedPair);return this.seed}getPublicKey(){if(!this.seed)throw new d$(u$.ClearedPair);let $=wZ.decodeSeed(this.seed),Z=rQ().fromSeed(this.getRawSeed()),G=wZ.encode($.prefix,Z.publicKey);return new TextDecoder().decode(G)}getPrivateKey(){if(!this.seed)throw new d$(u$.ClearedPair);let $=rQ().fromSeed(this.getRawSeed());return wZ.encode(Z6.Private,$.secretKey)}sign($){if(!this.seed)throw new d$(u$.ClearedPair);let Z=rQ().fromSeed(this.getRawSeed());return rQ().sign($,Z.secretKey)}verify($,Z){if(!this.seed)throw new d$(u$.ClearedPair);let G=rQ().fromSeed(this.getRawSeed());return rQ().verify($,Z,G.publicKey)}clear(){if(!this.seed)return;this.seed.fill(0),this.seed=void 0}seal($,Z,G){throw new d$(u$.InvalidNKeyOperation)}open($,Z){throw new d$(u$.InvalidNKeyOperation)}}class n$1{seed;constructor($){this.seed=$}clear(){if(!this.seed)return;this.seed.fill(0),this.seed=void 0}getPrivateKey(){if(!this.seed)throw new d$(u$.ClearedPair);return wZ.encode(Z6.Private,this.seed)}getPublicKey(){if(!this.seed)throw new d$(u$.ClearedPair);let $=rQ().scalarBaseMultiply(this.seed),Z=wZ.encode(Z6.Curve,$);return new TextDecoder().decode(Z)}getSeed(){if(!this.seed)throw new d$(u$.ClearedPair);return wZ.encodeSeed(Z6.Curve,this.seed)}sign(){throw new d$(u$.InvalidCurveOperation)}verify(){throw new d$(u$.InvalidCurveOperation)}decodePubCurveKey($){try{let Z=yL0.decode(new TextEncoder().encode($));if(Z.byteLength!==35)throw new d$(u$.InvalidCurveKey);if(Z[0]!==Z6.Curve)throw new d$(u$.InvalidPublicKey);let G=Z.byteLength-2,Y=new DataView(Z.buffer).getUint16(G,!0),Q=Z.slice(0,G);if(!Wr.validate(Q,Y))throw new d$(u$.InvalidChecksum);return Q.slice(1)}catch(Z){throw new d$(u$.InvalidRecipient,Z)}}seal($,Z,G){if(!this.seed)throw new d$(u$.ClearedPair);if(!G)G=rQ().randomBytes(xV$);let X=this.decodePubCurveKey(Z),Y=new Uint8Array(zC.length+24);Y.set(zC,0),Y.set(G,zC.length);let Q=rQ().seal($,G,X,this.seed),J=new Uint8Array(Y.length+Q.length);return J.set(Y),J.set(Q,Y.length),J}open($,Z){if(!this.seed)throw new d$(u$.ClearedPair);if($.length<=24+zC.length)throw new d$(u$.InvalidEncrypted);for(let Y=0;Y<zC.length;Y++)if($[Y]!==zC[Y])throw new d$(u$.InvalidEncrypted);let G=this.decodePubCurveKey(Z);$=$.slice(zC.length);let X=$.slice(0,24);return $=$.slice(xV$),rQ().open($,X,G,this.seed)}}function C84($){let Z=$===Z6.Curve?32:32,G=rQ().randomBytes(Z),X=wZ.encodeSeed($,new Uint8Array(G));return $===Z6.Curve?new n$1(new Uint8Array(G)):new i$1(X)}class gV${publicKey;constructor($){this.publicKey=$}getPublicKey(){if(!this.publicKey)throw new d$(u$.ClearedPair);return new TextDecoder().decode(this.publicKey)}getPrivateKey(){if(!this.publicKey)throw new d$(u$.ClearedPair);throw new d$(u$.PublicKeyOnly)}getSeed(){if(!this.publicKey)throw new d$(u$.ClearedPair);throw new d$(u$.PublicKeyOnly)}sign($){if(!this.publicKey)throw new d$(u$.ClearedPair);throw new d$(u$.CannotSign)}verify($,Z){if(!this.publicKey)throw new d$(u$.ClearedPair);let G=wZ._decode(this.publicKey);return rQ().verify($,Z,G.slice(1))}clear(){if(!this.publicKey)return;this.publicKey.fill(0),this.publicKey=void 0}seal($,Z,G){throw new d$(u$.InvalidNKeyOperation)}open($,Z){throw new d$(u$.InvalidNKeyOperation)}}function p$1($){let Z=new TextEncoder().encode($),G=wZ._decode(Z),X=jC.parsePrefix(G[0]);if(jC.isValidPublicPrefix(X))return new gV$(Z);throw new d$(u$.InvalidPublicKey)}function _84($){let Z=wZ.decodeSeed($);if(Z.prefix!==Z6.Curve)throw new d$(u$.InvalidCurveSeed);if(Z.buf.byteLength!==32)throw new d$(u$.InvalidSeedLen);return new n$1(Z.buf)}function t$1($){if(wZ.decodeSeed($).prefix===Z6.Curve)return _84($);return new i$1($)}function b84($){if($ instanceof Uint8Array)$=new TextDecoder().decode($);if($.charAt(0)==="S")return t$1(new TextEncoder().encode($));return p$1($)}function xL0($,Z="",G=!1){let X=typeof $==="string"||$ instanceof Uint8Array?b84($):$,Y=X.getPublicKey(),Q=[];if(!Array.isArray(Z)){if(Z!=="")Q.push(Z)}else Q.push(...Z);if(Z.length>0&&Q.indexOf(Y.charAt(0))===-1)throw Error(`unexpected type ${Y.charAt(0)} - wanted ${Q}`);if(G)X.getPrivateKey();return X}function f84($={}){return hV$({data:-1,payload:-1,subs:-1},$)}function hV$($,...Z){for(let G=0;G<Z.length;G++){let X=Z[G];Object.assign($,X)}return $}function x84($){let{exp:Z,nbf:G,aud:X}=$;return hV$({},{exp:Z,nbf:G,aud:X})}function v84($={}){if(!$.algorithm)$.algorithm=_J.v2;return $}async function cV$($,Z,G,X={},Y={}){G=xL0(G,"A",!Y.signer);let Q=G;if(Y.signer)Q=xL0(Y.signer,"A",!0);Z=xL0(Z,"U");let J=x84(Y);if(J.name=$,J.sub=Z.getPublicKey(),J.nats=Y.scopedUser?X:f84(X),Y.signer)J.nats.issuer_account=G.getPublicKey();let W=v84(Y);return y84(W.algorithm,m$1.User,J),await c84(W.algorithm,J,Q)}function y84($,Z,G){if(G.aud=G.aud||"NATS",$===_J.v2)G.nats.type=Z;else G.type=Z}function uV$($){let Z=$.split(".");if(Z.length!==3)throw Error(`invalid jwt - ${Z.length} chunks: ${$}`);let G=JSON.parse(xw.decode(Z[0]));if(G.typ!=="jwt"&&G.typ!=="JWT")throw Error(`not a nats jwt - typ ${G.type}`);if(G.alg!==_J.v1&&G.alg!==_J.v2)throw Error(`not a nats jwt - alg ${G.alg}`);let X=JSON.parse(xw.decode(Z[1])),Y=xL0(X.iss),Q=xw.decode(Z[2],!0),J=new TextEncoder,W=G.alg===_J.v2?`${Z[0]}.${Z[1]}`:Z[1];if(!Y.verify(J.encode(W),Q))throw Error("sig verification failed");return X}function g84($){for(let Z=0;Z<$.length;Z++)$[Z]=Math.floor(Math.random()*255)}function h84(){let $=new Uint8Array(12);g84($);let Z=Array.from($);return btoa(String.fromCharCode(...Z))}async function c84($,Z,G){Z.iss=G.getPublicKey(),Z.iat=Math.floor(Date.now()/1000);let X=Z;if($===_J.v2)X.nats.version=2;let Y=new TextEncoder,Q=Y.encode(JSON.stringify(Z));if(globalThis.crypto&&globalThis.crypto.subtle){let F=await globalThis.crypto.subtle.digest("SHA-512",Q);Z.jti=vL0.encode(new Uint8Array(F))}else Z.jti=h84();let J={typ:"JWT",alg:$},W=xw.encode(JSON.stringify(J)),K=xw.encode(JSON.stringify(Z)),U=$===_J.v2?`${W}.${K}`:K,w=xw.encode(G.sign(Y.encode(U)));return`${W}.${K}.${w}`}function dV$($,Z){let G=new TextDecoder().decode(Z.getSeed()),X=`-----BEGIN NATS USER JWT-----
 ${$}
 ------END NATS USER JWT------
@@ -2667,7 +2667,7 @@ NKEYs are sensitive and should be treated as secrets.
 -----BEGIN USER NKEY SEED-----
 ${G}
 ------END USER NKEY SEED------
-`;return new TextEncoder().encode(X)}var m$1,LC,k84,vV$,l$1="ABCDEFGHIJKLMNOPQRSTUVWXYZ234567",V84,d$,u$,Z6,xV$=24,zC,_J;var lV$=O(()=>{(function($){$.Operator="operator",$.Account="account",$.User="user",$.Activation="activation",$.AuthorizationResponse="authorization_response"})(m$1||(m$1={}));(function($){var Z=function(h,l){this.hi=h|0,this.lo=l|0},G=function(h){var l,c=new Float64Array(16);if(h)for(l=0;l<h.length;l++)c[l]=h[l];return c},X=function(){throw Error("no PRNG")},Y=new Uint8Array(16),Q=new Uint8Array(32);Q[0]=9;var J=G(),W=G([1]),K=G([56129,1]),U=G([30883,4953,19914,30187,55467,16705,2637,112,59544,30585,16505,36039,65139,11119,27886,20995]),w=G([61785,9906,39828,60374,45398,33411,5274,224,53552,61171,33010,6542,64743,22239,55772,9222]),F=G([54554,36645,11616,51542,42930,38181,51040,26924,56412,64982,57905,49316,21502,52590,14035,8553]),H=G([26200,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214]),N=G([41136,18958,6951,50414,58488,44335,6150,12099,55207,15867,153,11085,57099,20417,9344,11139]);function B(h,l){return h<<l|h>>>32-l}function D(h,l){var c=h[l+3]&255;return c=c<<8|h[l+2]&255,c=c<<8|h[l+1]&255,c<<8|h[l+0]&255}function E(h,l){var c=h[l]<<24|h[l+1]<<16|h[l+2]<<8|h[l+3],r=h[l+4]<<24|h[l+5]<<16|h[l+6]<<8|h[l+7];return new Z(c,r)}function L(h,l,c){var r;for(r=0;r<4;r++)h[l+r]=c&255,c>>>=8}function z(h,l,c){h[l]=c.hi>>24&255,h[l+1]=c.hi>>16&255,h[l+2]=c.hi>>8&255,h[l+3]=c.hi&255,h[l+4]=c.lo>>24&255,h[l+5]=c.lo>>16&255,h[l+6]=c.lo>>8&255,h[l+7]=c.lo&255}function j(h,l,c,r,X0){var W0,b0=0;for(W0=0;W0<X0;W0++)b0|=h[l+W0]^c[r+W0];return(1&b0-1>>>8)-1}function P(h,l,c,r){return j(h,l,c,r,16)}function A(h,l,c,r){return j(h,l,c,r,32)}function M(h,l,c,r,X0){var W0=new Uint32Array(16),b0=new Uint32Array(16),m0=new Uint32Array(16),P0=new Uint32Array(4),S0,j0,y0;for(S0=0;S0<4;S0++)b0[5*S0]=D(r,4*S0),b0[1+S0]=D(c,4*S0),b0[6+S0]=D(l,4*S0),b0[11+S0]=D(c,16+4*S0);for(S0=0;S0<16;S0++)m0[S0]=b0[S0];for(S0=0;S0<20;S0++){for(j0=0;j0<4;j0++){for(y0=0;y0<4;y0++)P0[y0]=b0[(5*j0+4*y0)%16];P0[1]^=B(P0[0]+P0[3]|0,7),P0[2]^=B(P0[1]+P0[0]|0,9),P0[3]^=B(P0[2]+P0[1]|0,13),P0[0]^=B(P0[3]+P0[2]|0,18);for(y0=0;y0<4;y0++)W0[4*j0+(j0+y0)%4]=P0[y0]}for(y0=0;y0<16;y0++)b0[y0]=W0[y0]}if(X0){for(S0=0;S0<16;S0++)b0[S0]=b0[S0]+m0[S0]|0;for(S0=0;S0<4;S0++)b0[5*S0]=b0[5*S0]-D(r,4*S0)|0,b0[6+S0]=b0[6+S0]-D(l,4*S0)|0;for(S0=0;S0<4;S0++)L(h,4*S0,b0[5*S0]),L(h,16+4*S0,b0[6+S0])}else for(S0=0;S0<16;S0++)L(h,4*S0,b0[S0]+m0[S0]|0)}function S(h,l,c,r){return M(h,l,c,r,!1),0}function R(h,l,c,r){return M(h,l,c,r,!0),0}var V=new Uint8Array([101,120,112,97,110,100,32,51,50,45,98,121,116,101,32,107]);function i(h,l,c,r,X0,W0,b0){var m0=new Uint8Array(16),P0=new Uint8Array(64),S0,j0;if(!X0)return 0;for(j0=0;j0<16;j0++)m0[j0]=0;for(j0=0;j0<8;j0++)m0[j0]=W0[j0];while(X0>=64){S(P0,m0,b0,V);for(j0=0;j0<64;j0++)h[l+j0]=(c?c[r+j0]:0)^P0[j0];S0=1;for(j0=8;j0<16;j0++)S0=S0+(m0[j0]&255)|0,m0[j0]=S0&255,S0>>>=8;if(X0-=64,l+=64,c)r+=64}if(X0>0){S(P0,m0,b0,V);for(j0=0;j0<X0;j0++)h[l+j0]=(c?c[r+j0]:0)^P0[j0]}return 0}function f(h,l,c,r,X0){return i(h,l,null,0,c,r,X0)}function v(h,l,c,r,X0){var W0=new Uint8Array(32);return R(W0,r,X0,V),f(h,l,c,r.subarray(16),W0)}function Z0(h,l,c,r,X0,W0,b0){var m0=new Uint8Array(32);return R(m0,W0,b0,V),i(h,l,c,r,X0,W0.subarray(16),m0)}function o(h,l){var c,r=0;for(c=0;c<17;c++)r=r+(h[c]+l[c]|0)|0,h[c]=r&255,r>>>=8}var B0=new Uint32Array([5,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,252]);function D0(h,l,c,r,X0,W0){var b0,m0,P0,S0,j0=new Uint32Array(17),y0=new Uint32Array(17),o0=new Uint32Array(17),Z1=new Uint32Array(17),U1=new Uint32Array(17);for(P0=0;P0<17;P0++)y0[P0]=o0[P0]=0;for(P0=0;P0<16;P0++)y0[P0]=W0[P0];y0[3]&=15,y0[4]&=252,y0[7]&=15,y0[8]&=252,y0[11]&=15,y0[12]&=252,y0[15]&=15;while(X0>0){for(P0=0;P0<17;P0++)Z1[P0]=0;for(P0=0;P0<16&&P0<X0;++P0)Z1[P0]=c[r+P0];Z1[P0]=1,r+=P0,X0-=P0,o(o0,Z1);for(m0=0;m0<17;m0++){j0[m0]=0;for(P0=0;P0<17;P0++)j0[m0]=j0[m0]+o0[P0]*(P0<=m0?y0[m0-P0]:320*y0[m0+17-P0]|0)|0|0}for(m0=0;m0<17;m0++)o0[m0]=j0[m0];S0=0;for(P0=0;P0<16;P0++)S0=S0+o0[P0]|0,o0[P0]=S0&255,S0>>>=8;S0=S0+o0[16]|0,o0[16]=S0&3,S0=5*(S0>>>2)|0;for(P0=0;P0<16;P0++)S0=S0+o0[P0]|0,o0[P0]=S0&255,S0>>>=8;S0=S0+o0[16]|0,o0[16]=S0}for(P0=0;P0<17;P0++)U1[P0]=o0[P0];o(o0,B0),b0=-(o0[16]>>>7)|0;for(P0=0;P0<17;P0++)o0[P0]^=b0&(U1[P0]^o0[P0]);for(P0=0;P0<16;P0++)Z1[P0]=W0[P0+16];Z1[16]=0,o(o0,Z1);for(P0=0;P0<16;P0++)h[l+P0]=o0[P0];return 0}function J0(h,l,c,r,X0,W0){var b0=new Uint8Array(16);return D0(b0,0,c,r,X0,W0),P(h,l,b0,0)}function Y0(h,l,c,r,X0){var W0;if(c<32)return-1;Z0(h,0,l,0,c,r,X0),D0(h,16,h,32,c-32,h);for(W0=0;W0<16;W0++)h[W0]=0;return 0}function a(h,l,c,r,X0){var W0,b0=new Uint8Array(32);if(c<32)return-1;if(v(b0,0,32,r,X0),J0(l,16,l,32,c-32,b0)!==0)return-1;Z0(h,0,l,0,c,r,X0);for(W0=0;W0<32;W0++)h[W0]=0;return 0}function A0(h,l){var c;for(c=0;c<16;c++)h[c]=l[c]|0}function U0(h){var l,c;for(c=0;c<16;c++)h[c]+=65536,l=Math.floor(h[c]/65536),h[(c+1)*(c<15?1:0)]+=l-1+37*(l-1)*(c===15?1:0),h[c]-=l*65536}function v0(h,l,c){var r,X0=~(c-1);for(var W0=0;W0<16;W0++)r=X0&(h[W0]^l[W0]),h[W0]^=r,l[W0]^=r}function d0(h,l){var c,r,X0,W0=G(),b0=G();for(c=0;c<16;c++)b0[c]=l[c];U0(b0),U0(b0),U0(b0);for(r=0;r<2;r++){W0[0]=b0[0]-65517;for(c=1;c<15;c++)W0[c]=b0[c]-65535-(W0[c-1]>>16&1),W0[c-1]&=65535;W0[15]=b0[15]-32767-(W0[14]>>16&1),X0=W0[15]>>16&1,W0[14]&=65535,v0(b0,W0,1-X0)}for(c=0;c<16;c++)h[2*c]=b0[c]&255,h[2*c+1]=b0[c]>>8}function i0(h,l){var c=new Uint8Array(32),r=new Uint8Array(32);return d0(c,h),d0(r,l),A(c,0,r,0)}function n0(h){var l=new Uint8Array(32);return d0(l,h),l[0]&1}function w0(h,l){var c;for(c=0;c<16;c++)h[c]=l[2*c]+(l[2*c+1]<<8);h[15]&=32767}function C0(h,l,c){var r;for(r=0;r<16;r++)h[r]=l[r]+c[r]|0}function T0(h,l,c){var r;for(r=0;r<16;r++)h[r]=l[r]-c[r]|0}function N0(h,l,c){var r,X0,W0=new Float64Array(31);for(r=0;r<31;r++)W0[r]=0;for(r=0;r<16;r++)for(X0=0;X0<16;X0++)W0[r+X0]+=l[r]*c[X0];for(r=0;r<15;r++)W0[r]+=38*W0[r+16];for(r=0;r<16;r++)h[r]=W0[r];U0(h),U0(h)}function Q0(h,l){N0(h,l,l)}function G0(h,l){var c=G(),r;for(r=0;r<16;r++)c[r]=l[r];for(r=253;r>=0;r--)if(Q0(c,c),r!==2&&r!==4)N0(c,c,l);for(r=0;r<16;r++)h[r]=c[r]}function V0(h,l){var c=G(),r;for(r=0;r<16;r++)c[r]=l[r];for(r=250;r>=0;r--)if(Q0(c,c),r!==1)N0(c,c,l);for(r=0;r<16;r++)h[r]=c[r]}function n(h,l,c){var r=new Uint8Array(32),X0=new Float64Array(80),W0,b0,m0=G(),P0=G(),S0=G(),j0=G(),y0=G(),o0=G();for(b0=0;b0<31;b0++)r[b0]=l[b0];r[31]=l[31]&127|64,r[0]&=248,w0(X0,c);for(b0=0;b0<16;b0++)P0[b0]=X0[b0],j0[b0]=m0[b0]=S0[b0]=0;m0[0]=j0[0]=1;for(b0=254;b0>=0;--b0)W0=r[b0>>>3]>>>(b0&7)&1,v0(m0,P0,W0),v0(S0,j0,W0),C0(y0,m0,S0),T0(m0,m0,S0),C0(S0,P0,j0),T0(P0,P0,j0),Q0(j0,y0),Q0(o0,m0),N0(m0,S0,m0),N0(S0,P0,y0),C0(y0,m0,S0),T0(m0,m0,S0),Q0(P0,m0),T0(S0,j0,o0),N0(m0,S0,K),C0(m0,m0,j0),N0(S0,S0,m0),N0(m0,j0,o0),N0(j0,P0,X0),Q0(P0,y0),v0(m0,P0,W0),v0(S0,j0,W0);for(b0=0;b0<16;b0++)X0[b0+16]=m0[b0],X0[b0+32]=S0[b0],X0[b0+48]=P0[b0],X0[b0+64]=j0[b0];var Z1=X0.subarray(32),U1=X0.subarray(16);return G0(Z1,Z1),N0(U1,U1,Z1),d0(h,U1),0}function e(h,l){return n(h,l,Q)}function t0(h,l){return X(l,32),e(h,l)}function R0(h,l,c){var r=new Uint8Array(32);return n(r,c,l),R(h,Y,r,V)}var q0=Y0,g=a;function H0(h,l,c,r,X0,W0){var b0=new Uint8Array(32);return R0(b0,X0,W0),q0(h,l,c,r,b0)}function f0(h,l,c,r,X0,W0){var b0=new Uint8Array(32);return R0(b0,X0,W0),g(h,l,c,r,b0)}function e0(){var h=0,l=0,c=0,r=0,X0=65535,W0,b0,m0;for(m0=0;m0<arguments.length;m0++)W0=arguments[m0].lo,b0=arguments[m0].hi,h+=W0&X0,l+=W0>>>16,c+=b0&X0,r+=b0>>>16;return l+=h>>>16,c+=l>>>16,r+=c>>>16,new Z(c&X0|r<<16,h&X0|l<<16)}function u0(h,l){return new Z(h.hi>>>l,h.lo>>>l|h.hi<<32-l)}function T1(){var h=0,l=0,c;for(c=0;c<arguments.length;c++)h^=arguments[c].lo,l^=arguments[c].hi;return new Z(l,h)}function e1(h,l){var c,r,X0=32-l;if(l<32)c=h.hi>>>l|h.lo<<X0,r=h.lo>>>l|h.hi<<X0;else if(l<64)c=h.lo>>>l|h.hi<<X0,r=h.hi>>>l|h.lo<<X0;return new Z(c,r)}function z6(h,l,c){var r=h.hi&l.hi^~h.hi&c.hi,X0=h.lo&l.lo^~h.lo&c.lo;return new Z(r,X0)}function J4(h,l,c){var r=h.hi&l.hi^h.hi&c.hi^l.hi&c.hi,X0=h.lo&l.lo^h.lo&c.lo^l.lo&c.lo;return new Z(r,X0)}function d5(h){return T1(e1(h,28),e1(h,34),e1(h,39))}function s(h){return T1(e1(h,14),e1(h,18),e1(h,41))}function K1(h){return T1(e1(h,1),e1(h,8),u0(h,7))}function a$(h){return T1(e1(h,19),e1(h,61),u0(h,6))}var s$=[new Z(1116352408,3609767458),new Z(1899447441,602891725),new Z(3049323471,3964484399),new Z(3921009573,2173295548),new Z(961987163,4081628472),new Z(1508970993,3053834265),new Z(2453635748,2937671579),new Z(2870763221,3664609560),new Z(3624381080,2734883394),new Z(310598401,1164996542),new Z(607225278,1323610764),new Z(1426881987,3590304994),new Z(1925078388,4068182383),new Z(2162078206,991336113),new Z(2614888103,633803317),new Z(3248222580,3479774868),new Z(3835390401,2666613458),new Z(4022224774,944711139),new Z(264347078,2341262773),new Z(604807628,2007800933),new Z(770255983,1495990901),new Z(1249150122,1856431235),new Z(1555081692,3175218132),new Z(1996064986,2198950837),new Z(2554220882,3999719339),new Z(2821834349,766784016),new Z(2952996808,2566594879),new Z(3210313671,3203337956),new Z(3336571891,1034457026),new Z(3584528711,2466948901),new Z(113926993,3758326383),new Z(338241895,168717936),new Z(666307205,1188179964),new Z(773529912,1546045734),new Z(1294757372,1522805485),new Z(1396182291,2643833823),new Z(1695183700,2343527390),new Z(1986661051,1014477480),new Z(2177026350,1206759142),new Z(2456956037,344077627),new Z(2730485921,1290863460),new Z(2820302411,3158454273),new Z(3259730800,3505952657),new Z(3345764771,106217008),new Z(3516065817,3606008344),new Z(3600352804,1432725776),new Z(4094571909,1467031594),new Z(275423344,851169720),new Z(430227734,3100823752),new Z(506948616,1363258195),new Z(659060556,3750685593),new Z(883997877,3785050280),new Z(958139571,3318307427),new Z(1322822218,3812723403),new Z(1537002063,2003034995),new Z(1747873779,3602036899),new Z(1955562222,1575990012),new Z(2024104815,1125592928),new Z(2227730452,2716904306),new Z(2361852424,442776044),new Z(2428436474,593698344),new Z(2756734187,3733110249),new Z(3204031479,2999351573),new Z(3329325298,3815920427),new Z(3391569614,3928383900),new Z(3515267271,566280711),new Z(3940187606,3454069534),new Z(4118630271,4000239992),new Z(116418474,1914138554),new Z(174292421,2731055270),new Z(289380356,3203993006),new Z(460393269,320620315),new Z(685471733,587496836),new Z(852142971,1086792851),new Z(1017036298,365543100),new Z(1126000580,2618297676),new Z(1288033470,3409855158),new Z(1501505948,4234509866),new Z(1607167915,987167468),new Z(1816402316,1246189591)];function A9(h,l,c){var r=[],X0=[],W0=[],b0=[],m0,P0,S0;for(P0=0;P0<8;P0++)r[P0]=W0[P0]=E(h,8*P0);var j0=0;while(c>=128){for(P0=0;P0<16;P0++)b0[P0]=E(l,8*P0+j0);for(P0=0;P0<80;P0++){for(S0=0;S0<8;S0++)X0[S0]=W0[S0];m0=e0(W0[7],s(W0[4]),z6(W0[4],W0[5],W0[6]),s$[P0],b0[P0%16]),X0[7]=e0(m0,d5(W0[0]),J4(W0[0],W0[1],W0[2])),X0[3]=e0(X0[3],m0);for(S0=0;S0<8;S0++)W0[(S0+1)%8]=X0[S0];if(P0%16===15)for(S0=0;S0<16;S0++)b0[S0]=e0(b0[S0],b0[(S0+9)%16],K1(b0[(S0+1)%16]),a$(b0[(S0+14)%16]))}for(P0=0;P0<8;P0++)W0[P0]=e0(W0[P0],r[P0]),r[P0]=W0[P0];j0+=128,c-=128}for(P0=0;P0<8;P0++)z(h,8*P0,r[P0]);return c}var lG=new Uint8Array([106,9,230,103,243,188,201,8,187,103,174,133,132,202,167,59,60,110,243,114,254,148,248,43,165,79,245,58,95,29,54,241,81,14,82,127,173,230,130,209,155,5,104,140,43,62,108,31,31,131,217,171,251,65,189,107,91,224,205,25,19,126,33,121]);function q8(h,l,c){var r=new Uint8Array(64),X0=new Uint8Array(256),W0,b0=c;for(W0=0;W0<64;W0++)r[W0]=lG[W0];A9(r,l,c),c%=128;for(W0=0;W0<256;W0++)X0[W0]=0;for(W0=0;W0<c;W0++)X0[W0]=l[b0-c+W0];X0[c]=128,c=256-128*(c<112?1:0),X0[c-9]=0,z(X0,c-8,new Z(b0/536870912|0,b0<<3)),A9(r,X0,c);for(W0=0;W0<64;W0++)h[W0]=r[W0];return 0}function _6(h,l){var c=G(),r=G(),X0=G(),W0=G(),b0=G(),m0=G(),P0=G(),S0=G(),j0=G();T0(c,h[1],h[0]),T0(j0,l[1],l[0]),N0(c,c,j0),C0(r,h[0],h[1]),C0(j0,l[0],l[1]),N0(r,r,j0),N0(X0,h[3],l[3]),N0(X0,X0,w),N0(W0,h[2],l[2]),C0(W0,W0,W0),T0(b0,r,c),T0(m0,W0,X0),C0(P0,W0,X0),C0(S0,r,c),N0(h[0],b0,m0),N0(h[1],S0,P0),N0(h[2],P0,m0),N0(h[3],b0,S0)}function Z5(h,l,c){var r;for(r=0;r<4;r++)v0(h[r],l[r],c)}function q5(h,l){var c=G(),r=G(),X0=G();G0(X0,l[2]),N0(c,l[0],X0),N0(r,l[1],X0),d0(h,r),h[31]^=n0(c)<<7}function J9(h,l,c){var r,X0;A0(h[0],J),A0(h[1],W),A0(h[2],W),A0(h[3],J);for(X0=255;X0>=0;--X0)r=c[X0/8|0]>>(X0&7)&1,Z5(h,l,r),_6(l,h),_6(h,h),Z5(h,l,r)}function T9(h,l){var c=[G(),G(),G(),G()];A0(c[0],F),A0(c[1],H),A0(c[2],W),N0(c[3],F,H),J9(h,c,l)}function x1(h,l,c){var r=new Uint8Array(64),X0=[G(),G(),G(),G()],W0;if(!c)X(l,32);q8(r,l,32),r[0]&=248,r[31]&=127,r[31]|=64,T9(X0,r),q5(h,X0);for(W0=0;W0<32;W0++)l[W0+32]=h[W0];return 0}var M8=new Float64Array([237,211,245,92,26,99,18,88,214,156,247,162,222,249,222,20,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,16]);function k8(h,l){var c,r,X0,W0;for(r=63;r>=32;--r){c=0;for(X0=r-32,W0=r-12;X0<W0;++X0)l[X0]+=c-16*l[r]*M8[X0-(r-32)],c=Math.floor((l[X0]+128)/256),l[X0]-=c*256;l[X0]+=c,l[r]=0}c=0;for(X0=0;X0<32;X0++)l[X0]+=c-(l[31]>>4)*M8[X0],c=l[X0]>>8,l[X0]&=255;for(X0=0;X0<32;X0++)l[X0]-=c*M8[X0];for(r=0;r<32;r++)l[r+1]+=l[r]>>8,h[r]=l[r]&255}function G6(h){var l=new Float64Array(64),c;for(c=0;c<64;c++)l[c]=h[c];for(c=0;c<64;c++)h[c]=0;k8(h,l)}function f$(h,l,c,r){var X0=new Uint8Array(64),W0=new Uint8Array(64),b0=new Uint8Array(64),m0,P0,S0=new Float64Array(64),j0=[G(),G(),G(),G()];q8(X0,r,32),X0[0]&=248,X0[31]&=127,X0[31]|=64;var y0=c+64;for(m0=0;m0<c;m0++)h[64+m0]=l[m0];for(m0=0;m0<32;m0++)h[32+m0]=X0[32+m0];q8(b0,h.subarray(32),c+32),G6(b0),T9(j0,b0),q5(h,j0);for(m0=32;m0<64;m0++)h[m0]=r[m0];q8(W0,h,c+64),G6(W0);for(m0=0;m0<64;m0++)S0[m0]=0;for(m0=0;m0<32;m0++)S0[m0]=b0[m0];for(m0=0;m0<32;m0++)for(P0=0;P0<32;P0++)S0[m0+P0]+=W0[m0]*X0[P0];return k8(h.subarray(32),S0),y0}function w8(h,l){var c=G(),r=G(),X0=G(),W0=G(),b0=G(),m0=G(),P0=G();if(A0(h[2],W),w0(h[1],l),Q0(X0,h[1]),N0(W0,X0,U),T0(X0,X0,h[2]),C0(W0,h[2],W0),Q0(b0,W0),Q0(m0,b0),N0(P0,m0,b0),N0(c,P0,X0),N0(c,c,W0),V0(c,c),N0(c,c,X0),N0(c,c,W0),N0(c,c,W0),N0(h[0],c,W0),Q0(r,h[0]),N0(r,r,W0),i0(r,X0))N0(h[0],h[0],N);if(Q0(r,h[0]),N0(r,r,W0),i0(r,X0))return-1;if(n0(h[0])===l[31]>>7)T0(h[0],J,h[0]);return N0(h[3],h[0],h[1]),0}function j7(h,l,c,r){var X0,W0=new Uint8Array(32),b0=new Uint8Array(64),m0=[G(),G(),G(),G()],P0=[G(),G(),G(),G()];if(c<64)return-1;if(w8(P0,r))return-1;for(X0=0;X0<c;X0++)h[X0]=l[X0];for(X0=0;X0<32;X0++)h[X0+32]=r[X0];if(q8(b0,h,c),G6(b0),J9(m0,P0,b0),T9(P0,l.subarray(32)),_6(m0,P0),q5(W0,m0),c-=64,A(l,0,W0,0)){for(X0=0;X0<c;X0++)h[X0]=0;return-1}for(X0=0;X0<c;X0++)h[X0]=l[X0+64];return c}var k$=32,n6=24,e6=32,r8=16,G5=32,C=32,d=32,u=32,I=32,t=n6,x0=e6,l0=r8,W1=64,F1=32,g1=64,_1=32,Y8=64;$.lowlevel={crypto_core_hsalsa20:R,crypto_stream_xor:Z0,crypto_stream:v,crypto_stream_salsa20_xor:i,crypto_stream_salsa20:f,crypto_onetimeauth:D0,crypto_onetimeauth_verify:J0,crypto_verify_16:P,crypto_verify_32:A,crypto_secretbox:Y0,crypto_secretbox_open:a,crypto_scalarmult:n,crypto_scalarmult_base:e,crypto_box_beforenm:R0,crypto_box_afternm:q0,crypto_box:H0,crypto_box_open:f0,crypto_box_keypair:t0,crypto_hash:q8,crypto_sign:f$,crypto_sign_keypair:x1,crypto_sign_open:j7,crypto_secretbox_KEYBYTES:k$,crypto_secretbox_NONCEBYTES:n6,crypto_secretbox_ZEROBYTES:e6,crypto_secretbox_BOXZEROBYTES:r8,crypto_scalarmult_BYTES:G5,crypto_scalarmult_SCALARBYTES:C,crypto_box_PUBLICKEYBYTES:d,crypto_box_SECRETKEYBYTES:u,crypto_box_BEFORENMBYTES:I,crypto_box_NONCEBYTES:t,crypto_box_ZEROBYTES:x0,crypto_box_BOXZEROBYTES:l0,crypto_sign_BYTES:W1,crypto_sign_PUBLICKEYBYTES:F1,crypto_sign_SECRETKEYBYTES:g1,crypto_sign_SEEDBYTES:_1,crypto_hash_BYTES:Y8,gf:G,D:U,L:M8,pack25519:d0,unpack25519:w0,M:N0,A:C0,S:Q0,Z:T0,pow2523:V0,add:_6,set25519:A0,modL:k8,scalarmult:J9,scalarbase:T9};function u1(h,l){if(h.length!==k$)throw Error("bad key size");if(l.length!==n6)throw Error("bad nonce size")}function z$(h,l){if(h.length!==d)throw Error("bad public key size");if(l.length!==u)throw Error("bad secret key size")}function Y$(){for(var h=0;h<arguments.length;h++)if(!(arguments[h]instanceof Uint8Array))throw TypeError("unexpected type, use Uint8Array")}function y$(h){for(var l=0;l<h.length;l++)h[l]=0}$.randomBytes=function(h){var l=new Uint8Array(h);return X(l,h),l},$.secretbox=function(h,l,c){Y$(h,l,c),u1(c,l);var r=new Uint8Array(e6+h.length),X0=new Uint8Array(r.length);for(var W0=0;W0<h.length;W0++)r[W0+e6]=h[W0];return Y0(X0,r,r.length,l,c),X0.subarray(r8)},$.secretbox.open=function(h,l,c){Y$(h,l,c),u1(c,l);var r=new Uint8Array(r8+h.length),X0=new Uint8Array(r.length);for(var W0=0;W0<h.length;W0++)r[W0+r8]=h[W0];if(r.length<32)return null;if(a(X0,r,r.length,l,c)!==0)return null;return X0.subarray(e6)},$.secretbox.keyLength=k$,$.secretbox.nonceLength=n6,$.secretbox.overheadLength=r8,$.scalarMult=function(h,l){if(Y$(h,l),h.length!==C)throw Error("bad n size");if(l.length!==G5)throw Error("bad p size");var c=new Uint8Array(G5);return n(c,h,l),c},$.scalarMult.base=function(h){if(Y$(h),h.length!==C)throw Error("bad n size");var l=new Uint8Array(G5);return e(l,h),l},$.scalarMult.scalarLength=C,$.scalarMult.groupElementLength=G5,$.box=function(h,l,c,r){var X0=$.box.before(c,r);return $.secretbox(h,l,X0)},$.box.before=function(h,l){Y$(h,l),z$(h,l);var c=new Uint8Array(I);return R0(c,h,l),c},$.box.after=$.secretbox,$.box.open=function(h,l,c,r){var X0=$.box.before(c,r);return $.secretbox.open(h,l,X0)},$.box.open.after=$.secretbox.open,$.box.keyPair=function(){var h=new Uint8Array(d),l=new Uint8Array(u);return t0(h,l),{publicKey:h,secretKey:l}},$.box.keyPair.fromSecretKey=function(h){if(Y$(h),h.length!==u)throw Error("bad secret key size");var l=new Uint8Array(d);return e(l,h),{publicKey:l,secretKey:new Uint8Array(h)}},$.box.publicKeyLength=d,$.box.secretKeyLength=u,$.box.sharedKeyLength=I,$.box.nonceLength=t,$.box.overheadLength=$.secretbox.overheadLength,$.sign=function(h,l){if(Y$(h,l),l.length!==g1)throw Error("bad secret key size");var c=new Uint8Array(W1+h.length);return f$(c,h,h.length,l),c},$.sign.open=function(h,l){if(Y$(h,l),l.length!==F1)throw Error("bad public key size");var c=new Uint8Array(h.length),r=j7(c,h,h.length,l);if(r<0)return null;var X0=new Uint8Array(r);for(var W0=0;W0<X0.length;W0++)X0[W0]=c[W0];return X0},$.sign.detached=function(h,l){var c=$.sign(h,l),r=new Uint8Array(W1);for(var X0=0;X0<r.length;X0++)r[X0]=c[X0];return r},$.sign.detached.verify=function(h,l,c){if(Y$(h,l,c),l.length!==W1)throw Error("bad signature size");if(c.length!==F1)throw Error("bad public key size");var r=new Uint8Array(W1+h.length),X0=new Uint8Array(W1+h.length),W0;for(W0=0;W0<W1;W0++)r[W0]=l[W0];for(W0=0;W0<h.length;W0++)r[W0+W1]=h[W0];return j7(X0,r,r.length,c)>=0},$.sign.keyPair=function(){var h=new Uint8Array(F1),l=new Uint8Array(g1);return x1(h,l),{publicKey:h,secretKey:l}},$.sign.keyPair.fromSecretKey=function(h){if(Y$(h),h.length!==g1)throw Error("bad secret key size");var l=new Uint8Array(F1);for(var c=0;c<l.length;c++)l[c]=h[32+c];return{publicKey:l,secretKey:new Uint8Array(h)}},$.sign.keyPair.fromSeed=function(h){if(Y$(h),h.length!==_1)throw Error("bad seed size");var l=new Uint8Array(F1),c=new Uint8Array(g1);for(var r=0;r<32;r++)c[r]=h[r];return x1(l,c,!0),{publicKey:l,secretKey:c}},$.sign.publicKeyLength=F1,$.sign.secretKeyLength=g1,$.sign.seedLength=_1,$.sign.signatureLength=W1,$.hash=function(h){Y$(h);var l=new Uint8Array(Y8);return q8(l,h,h.length),l},$.hash.hashLength=Y8,$.verify=function(h,l){if(Y$(h,l),h.length===0||l.length===0)return!1;if(h.length!==l.length)return!1;return j(h,0,l,0,h.length)===0?!0:!1},$.setPRNG=function(h){X=h},function(){var h=typeof globalThis<"u"?globalThis.crypto||globalThis.msCrypto:null;if(h&&h.getRandomValues){var l=65536;$.setPRNG(function(c,r){var X0,W0=new Uint8Array(r);for(X0=0;X0<r;X0+=l)h.getRandomValues(W0.subarray(X0,X0+Math.min(r-X0,l)));for(X0=0;X0<r;X0++)c[X0]=W0[X0];y$(W0)})}else if(h=c0("crypto"),h&&h.randomBytes)$.setPRNG(function(c,r){var X0,W0=h.randomBytes(r);for(X0=0;X0<r;X0++)c[X0]=W0[X0];y$(W0)})}()})(typeof Cg<"u"&&b5Z?b5Z:globalThis.nacl=globalThis.nacl||{});LC=typeof Cg<"u"&&b5Z?b5Z:globalThis.nacl,k84={fromSeed:LC.sign.keyPair.fromSeed,sign:LC.sign.detached,verify:LC.sign.detached.verify,randomBytes:LC.randomBytes,scalarBaseMultiply:LC.scalarMult.base,seal:LC.box,open:LC.box.open};V84=new Uint16Array([0,4129,8258,12387,16516,20645,24774,28903,33032,37161,41290,45419,49548,53677,57806,61935,4657,528,12915,8786,21173,17044,29431,25302,37689,33560,45947,41818,54205,50076,62463,58334,9314,13379,1056,5121,25830,29895,17572,21637,42346,46411,34088,38153,58862,62927,50604,54669,13907,9842,5649,1584,30423,26358,22165,18100,46939,42874,38681,34616,63455,59390,55197,51132,18628,22757,26758,30887,2112,6241,10242,14371,51660,55789,59790,63919,35144,39273,43274,47403,23285,19156,31415,27286,6769,2640,14899,10770,56317,52188,64447,60318,39801,35672,47931,43802,27814,31879,19684,23749,11298,15363,3168,7233,60846,64911,52716,56781,44330,48395,36200,40265,32407,28342,24277,20212,15891,11826,7761,3696,65439,61374,57309,53244,48923,44858,40793,36728,37256,33193,45514,41451,53516,49453,61774,57711,4224,161,12482,8419,20484,16421,28742,24679,33721,37784,41979,46042,49981,54044,58239,62302,689,4752,8947,13010,16949,21012,25207,29270,46570,42443,38312,34185,62830,58703,54572,50445,13538,9411,5280,1153,29798,25671,21540,17413,42971,47098,34713,38840,59231,63358,50973,55100,9939,14066,1681,5808,26199,30326,17941,22068,55628,51565,63758,59695,39368,35305,47498,43435,22596,18533,30726,26663,6336,2273,14466,10403,52093,56156,60223,64286,35833,39896,43963,48026,19061,23124,27191,31254,2801,6864,10931,14994,64814,60687,56684,52557,48554,44427,40424,36297,31782,27655,23652,19525,15522,11395,7392,3265,61215,65342,53085,57212,44955,49082,36825,40952,28183,32310,20053,24180,11923,16050,3793,7920]);d$=class d$ extends Error{name;code;chainedError;constructor($,Z){super($);this.name="NKeysError",this.code=$,this.chainedError=Z}};(function($){$.InvalidPrefixByte="nkeys: invalid prefix byte",$.InvalidKey="nkeys: invalid key",$.InvalidPublicKey="nkeys: invalid public key",$.InvalidSeedLen="nkeys: invalid seed length",$.InvalidSeed="nkeys: invalid seed",$.InvalidCurveSeed="nkeys: invalid curve seed",$.InvalidCurveKey="nkeys: not a valid curve key",$.InvalidCurveOperation="nkeys: curve key is not valid for sign/verify",$.InvalidNKeyOperation="keys: only curve key can seal/open",$.InvalidEncoding="nkeys: invalid encoded key",$.InvalidRecipient="nkeys: not a valid recipient public curve key",$.InvalidEncrypted="nkeys: encrypted input is not valid",$.CannotSign="nkeys: cannot sign, no private key available",$.PublicKeyOnly="nkeys: no seed or private key available",$.InvalidChecksum="nkeys: invalid checksum",$.SerializationError="nkeys: serialization error",$.ApiError="nkeys: api error",$.ClearedPair="nkeys: pair is cleared"})(u$||(u$={}));(function($){$[$.Unknown=-1]="Unknown",$[$.Seed=144]="Seed",$[$.Private=120]="Private",$[$.Operator=112]="Operator",$[$.Server=104]="Server",$[$.Cluster=16]="Cluster",$[$.Account=0]="Account",$[$.User=160]="User",$[$.Curve=184]="Curve"})(Z6||(Z6={}));zC=[120,107,118,49];S84(k84);(function($){$.v1="ed25519",$.v2="ed25519-nkey"})(_J||(_J={}))});function r$1($){try{$?.clear?.()}catch{}}async function mV$({accountJwt:$,accountSigningKey:Z,expiresAt:G,permissions:X,userId:Y,allowedConnectionTypes:Q=["WEBSOCKET"]}){let J=uV$($),W=p$1(J.sub),K=t$1(new TextEncoder().encode(Z)),U=yV$();try{let w=await cV$(Y,U,W,{pub:{allow:X.publish.allow},sub:{allow:X.subscribe.allow},allowed_connection_types:Q},{algorithm:_J.v2,exp:Math.floor(G.getTime()/1000),signer:K});return new TextDecoder().decode(dV$(w,U))}finally{r$1(U),r$1(K),r$1(W)}}var iV$=O(()=>{lV$()});function u84($){return/^wss?:\/\//i.test($.trim())?["WEBSOCKET"]:["STANDARD","WEBSOCKET"]}function nV$(){let $=new b1;return $.post("/links/session",async(Z)=>{let X=Z.get("studioContext").auth?.user?.id;if(!X)return Z.json({error:"Unauthorized"},401);let Y=O1();if(!Y.natsTunnelPublicEnabled)return Z.json(o$1(),503);if(!Y.natsPublicUrl)return Z.json(o$1(),503);if(!Y.natsAccountJwt||!Y.natsAccountSigningKey){if(!Y.localMode)return Z.json(o$1(),503)}let Q=CJ(X),J;if(Y.natsAccountJwt&&Y.natsAccountSigningKey){let W=new Date(Date.now()+Y.natsTunnelSessionTtlSeconds*1000);J=await mV$({accountJwt:Y.natsAccountJwt,accountSigningKey:Y.natsAccountSigningKey,expiresAt:W,permissions:_V$(Q),userId:X,allowedConnectionTypes:u84(Y.natsPublicUrl)})}return Z.json(bV$({publicUrl:Y.natsPublicUrl,userId:X,ttlSeconds:Y.natsTunnelSessionTtlSeconds,credentials:J}))}),$}var o$1=()=>({error:"link session unavailable"});var pV$=O(()=>{F6();F8();fV$();iV$()});async function m84($,Z){try{return!await $.alive(Z)}catch(G){return console.warn(`[vm-events] alive probe failed for ${Z}; assuming alive: ${G instanceof Error?G.message:String(G)}`),!1}}async function i84($){let{ctx:Z,runner:G,claimName:X,userId:Y,projectRef:Q,sandboxProviderKind:J}=$;try{await G.delete(X)}catch(W){console.warn(`[vm-events] runner.delete failed for ${X}: ${W instanceof Error?W.message:String(W)}`)}try{await new kN(Z.db).delete({userId:Y,projectRef:Q},J)}catch(W){console.warn(`[vm-events] sandbox_runner_state delete failed for ${Y}/${Q}/${J}: ${W instanceof Error?W.message:String(W)}`)}}async function n84($){let{stream:Z,claimName:G,runner:X,signal:Y}=$;return new Promise((Q)=>{let J=!1,W=!1,K=null,U=(H)=>{if(J)return;J=!0,clearTimeout(w),Y.removeEventListener("abort",F),K?.unsubscribe(),Q(H)},w=setTimeout(()=>{if(W||J)return;Z.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"claim-never-created",message:"Sandbox claim was never created. The SANDBOX_START call may have failed earlier \u2014 check the start error."})}).catch(()=>{}),U(!1)},d84),F=()=>U(!1);Y.addEventListener("abort",F,{once:!0}),K=rn(X,G,(H)=>{if(J)return;if(H.kind!=="claiming")W=!0;if(Z.writeSSE({event:"phase",data:JSON.stringify(H)}).catch(()=>{}),H.kind==="ready")U(!0);else if(H.kind==="failed")U(!1)})})}async function p84($){let{stream:Z,runner:G,claimName:X,signal:Y}=$,Q=Date.now(),J=null;while(!Y.aborted){let K=null;try{K=await G.proxyDaemonRequest(X,"/_sandbox/events",{method:"GET",headers:new Headers({accept:"text/event-stream"}),body:null,signal:Y})}catch(U){if(Y.aborted)return;if(Date.now()-Q<tV$){await O8(rV$,{signal:Y}).catch(()=>{});continue}let w=U instanceof Error?U.message:String(U);await Z.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:`Upstream daemon SSE error: ${w}`})}).catch(()=>{});return}if(K.status===404){try{await K.body?.cancel()}catch{}if(Date.now()-Q<tV$){await O8(rV$,{signal:Y}).catch(()=>{});continue}await Z.writeSSE({event:"gone",data:""}).catch(()=>{});return}if(!K.ok||!K.body){try{await K.body?.cancel()}catch{}await Z.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:`Upstream daemon SSE failed (${K.status}).`})}).catch(()=>{});return}J=K;break}if(!J||!J.body)return;let W=J.body.getReader();try{while(!Y.aborted){let{value:K,done:U}=await W.read();if(U)break;if(K)await Z.write(K)}}catch{}finally{try{W.releaseLock()}catch{}}}var d84=90000,l84=15000,oV$=()=>{let $=new b1;return $.get("/",async(Z)=>{let G=Z.var.studioContext;try{M0(G)}catch{return Z.json({error:"Unauthorized"},401)}let X=y1(G);if(!X)return Z.json({error:"Unauthorized"},401);let Y;try{Y=O0(G)}catch{return Z.json({error:"Organization scope required"},403)}let Q=Z.req.query("virtualMcpId"),J=Z.req.query("branch");if(!Q||!J)return Z.json({error:"virtualMcpId and branch are required"},400);let W=await G.storage.virtualMcps.findById(Q);if(!W||W.organization_id!==Y.id)return Z.json({error:"Virtual MCP not found"},404);let K=Zw({orgId:Y.id,virtualMcpId:Q,branch:J}),U=ey({userId:X,projectRef:K},J),w=W.metadata??null,F,H=null,N=null;try{let E=await _Y(G,{userId:X,branch:J,virtualMcpMetadata:w});F=E.provider,H=E.kind}catch(E){N=E instanceof Error?E:Error(String(E)),F=null}let B=H&&iW(F5(w),X,J,H),D=!!B&&B.sandboxHandle===U;if(!F)return tQ(Z,async(E)=>{await E.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:N?.message??"No sandbox runner configured on this mesh."})})});return Z.header("X-Accel-Buffering","no"),Z.header("Content-Encoding","identity"),tQ(Z,async(E)=>{let L=new AbortController,z=setInterval(()=>{E.writeSSE({event:"keepalive",data:""}).catch(()=>{clearInterval(z)})},l84);E.onAbort(()=>{L.abort(),clearInterval(z)});try{if(D&&H){if(await m84(F,U)){await i84({ctx:G,runner:F,claimName:U,userId:X,projectRef:K,sandboxProviderKind:H}),await E.writeSSE({event:"gone",data:""}).catch(()=>{});return}}if(!await n84({stream:E,claimName:U,runner:F,signal:L.signal})||L.signal.aborted)return;await p84({stream:E,runner:F,claimName:U,signal:L.signal})}finally{clearInterval(z)}})}),$},tV$=60000,rV$=500;var aV$=O(()=>{F6();EC();MY();l5();RE0();on();jV();i90();qX()});function r84($){return $.filter((Z)=>Z.vendors?.alias).map((Z)=>({name:Z.name,title:Z.title,description:Z.description,logo:Z.logo,category:Z.category,vendor:{alias:Z.vendors.alias,url:Z.vendors.url}}))}async function o84($,Z){let G=await fetch(`${$}/rest/v1/apps?select=name,title,description,logo,category,vendors(alias,url)`,{headers:{apikey:Z,Authorization:`Bearer ${Z}`,Accept:"application/json"},signal:AbortSignal.timeout(t84)});if(!G.ok){let X=await G.text().catch(()=>G.statusText);throw console.error(`[deco-apps] Supabase error (${G.status}): ${X.slice(0,200)}`),Error(`External service error (${G.status})`)}return await G.json()}var t84=1e4,a84=async($,Z)=>{if(!$.get("studioContext").auth.user?.id)return $.json({error:"Unauthorized"},401);return Z()},sV$=()=>{let $=new b1;return $.use("*",a84),$.get("/",async(Z)=>{let G=O1(),X=G.decoSupabaseUrl,Y=G.decoSupabaseServiceKey;if(!X||!Y)return Z.json({apps:[]});try{let Q=await o84(X,Y);return Z.json({apps:r84(Q)})}catch(Q){return console.error("[deco-apps] GET error:",Q),Z.json({error:"Failed to fetch apps"},502)}}),$};var eV$=O(()=>{F6();F8()});import{z as h1}from"zod";function zK($,Z="invalid_request_error",G=null,X=null){return{error:{message:$,type:Z,param:G,code:X}}}function W64($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let G=$.substring(0,Z),X=$.substring(Z+1);if(!G||!X)return null;return{credentialId:G,modelId:X}}function K64($,Z,G){try{return JSON.parse($)}catch{throw new GC$(`Invalid JSON in tool call arguments for function '${G}' (tool_call_id: ${Z}): ${$}`)}}function U64($){let Z={};for(let G of $)if(G.role==="assistant"&&G.tool_calls)for(let X of G.tool_calls)Z[X.id]=X.function.name;return $.map((G)=>{switch(G.role){case"system":return{role:"system",content:G.content};case"user":if(typeof G.content==="string")return{role:"user",content:G.content};return{role:"user",content:G.content.map((Y)=>{if(Y.type==="text")return{type:"text",text:Y.text};return{type:"image",image:Y.image_url.url}})};case"assistant":if(G.tool_calls&&G.tool_calls.length>0)return{role:"assistant",content:G.tool_calls.map((Y)=>({type:"tool-call",toolCallId:Y.id,toolName:Y.function.name,input:K64(Y.function.arguments,Y.id,Y.function.name)}))};return{role:"assistant",content:G.content??""};case"tool":let X=Z[G.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:G.tool_call_id,toolName:X,output:{type:"text",value:G.content}}]}}})}function w64($){let Z=$.map((G)=>{let X=G.function.parameters?OY(G.function.parameters):OY({type:"object",properties:{}});return[G.function.name,x$({description:G.function.description,inputSchema:X})]});return Object.fromEntries(Z)}function F64($){if(!$)return;return{openai:{response_format:$}}}function H64(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function $C$($,Z,G,X,Y,Q){let J={model:$,messages:Z,tools:G,temperature:X.temperature,maxTokens:X.max_tokens,topP:X.top_p,frequencyPenalty:X.frequency_penalty,presencePenalty:X.presence_penalty,stopSequences:X.stop?Array.isArray(X.stop)?X.stop:[X.stop]:void 0,abortSignal:Q};return Y?{...J,providerOptions:Y}:J}function ZC$($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var s84=256,e84,$64,Z64,G64,X64,Y64,Q64,J64,GC$,XC$,YC$;var QC$=O(()=>{L6();F6();EC();e84=h1.object({type:h1.literal("function"),function:h1.object({name:h1.string(),description:h1.string().optional(),parameters:h1.record(h1.string(),h1.unknown()).optional()})}),$64=h1.object({id:h1.string(),type:h1.literal("function"),function:h1.object({name:h1.string(),arguments:h1.string()})}),Z64=h1.discriminatedUnion("role",[h1.object({role:h1.literal("system"),content:h1.string(),name:h1.string().optional()}),h1.object({role:h1.literal("user"),content:h1.union([h1.string(),h1.array(h1.union([h1.object({type:h1.literal("text"),text:h1.string()}),h1.object({type:h1.literal("image_url"),image_url:h1.object({url:h1.string(),detail:h1.string().optional()})})]))]),name:h1.string().optional()}),h1.object({role:h1.literal("assistant"),content:h1.string().nullable().optional(),name:h1.string().optional(),tool_calls:h1.array($64).optional()}),h1.object({role:h1.literal("tool"),content:h1.string(),tool_call_id:h1.string()})]),G64=h1.object({type:h1.literal("text")}),X64=h1.object({type:h1.literal("json_object")}),Y64=h1.object({type:h1.literal("json_schema"),json_schema:h1.object({name:h1.string(),description:h1.string().optional(),schema:h1.record(h1.string(),h1.unknown()),strict:h1.boolean().optional()})}),Q64=h1.union([G64,X64,Y64]),J64=h1.object({model:h1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:h1.array(Z64),stream:h1.boolean().optional().default(!1),temperature:h1.number().min(0).max(2).optional(),max_tokens:h1.number().positive().optional(),top_p:h1.number().min(0).max(1).optional(),frequency_penalty:h1.number().min(-2).max(2).optional(),presence_penalty:h1.number().min(-2).max(2).optional(),stop:h1.union([h1.string(),h1.array(h1.string())]).optional(),tools:h1.array(e84).optional(),tool_choice:h1.union([h1.literal("auto"),h1.literal("none"),h1.literal("required"),h1.object({type:h1.literal("function"),function:h1.object({name:h1.string()})})]).optional(),response_format:Q64.optional(),user:h1.string().optional()});GC$=class GC$ extends Error{constructor($){super($);this.name="MessageConversionError"}};XC$=new b1;XC$.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("studioContext"),G=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(zK("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(zK("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==G)return $.json(zK("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let X=await $.req.json(),Y=J64.safeParse(X);if(!Y.success){let E=Y.error.issues[0]??{message:"Invalid request",path:[]};return $.json(zK(`Invalid request: ${E.message}`,"invalid_request_error",E.path.length>0?E.path.join("."):null),400)}let Q=Y.data,J=W64(Q.model);if(!J)return $.json(zK("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=J,{modelId:K}=J;if(!W){let E=await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id});if(E.length===0)return $.json(zK("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=E[0].id}let U;try{U=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(zK(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let w=U.aiSdk.languageModel(K),F=U64(Q.messages),H=Q.tools?w64(Q.tools):void 0,N=F64(Q.response_format),B=H64(),D=Math.floor(Date.now()/1000);if(Q.stream)return tQ($,async(E)=>{let L=$C$(w,F,H,Q,N,$.req.raw.signal);try{let z=bQ(L),j=!1,P=0,A="",M=async()=>{if(A.length===0)return;let S=A;A="",await E.writeSSE({data:JSON.stringify({id:B,object:"chat.completion.chunk",created:D,model:Q.model,choices:[{index:0,delta:{content:S},finish_reason:null}]})})};for await(let S of z.fullStream){if(!j&&(S.type==="text-delta"||S.type==="tool-call"))await E.writeSSE({data:JSON.stringify({id:B,object:"chat.completion.chunk",created:D,model:Q.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),j=!0;if(S.type==="text-delta"){if(A+=S.text,A.length>=s84)await M()}else if(S.type==="tool-call"){await M();let R=P++;await E.writeSSE({data:JSON.stringify({id:B,object:"chat.completion.chunk",created:D,model:Q.model,choices:[{index:0,delta:{tool_calls:[{index:R,id:S.toolCallId,type:"function",function:{name:S.toolName,arguments:JSON.stringify(S.input)}}]},finish_reason:null}]})})}else if(S.type==="finish")await M(),await E.writeSSE({data:JSON.stringify({id:B,object:"chat.completion.chunk",created:D,model:Q.model,choices:[{index:0,delta:{},finish_reason:ZC$(S.finishReason)}],usage:S.totalUsage?{prompt_tokens:S.totalUsage.inputTokens??0,completion_tokens:S.totalUsage.outputTokens??0,total_tokens:S.totalUsage.totalTokens??0}:void 0})})}await M(),await E.writeSSE({data:"[DONE]"})}catch(z){let j=z;console.error("[openai-compat:stream] Error:",j.message),await E.writeSSE({data:JSON.stringify({error:{message:j.message,type:"server_error"}})})}});else{let E=$C$(w,F,H,Q,N,$.req.raw.signal),L=await EN(E),z={role:"assistant",content:L.text||null};if(L.toolCalls&&L.toolCalls.length>0)z.tool_calls=L.toolCalls.map((j)=>({id:j.toolCallId,type:"function",function:{name:j.toolName,arguments:JSON.stringify("input"in j?j.input:{})}})),z.content=null;return $.json({id:B,object:"chat.completion",created:D,model:Q.model,choices:[{index:0,message:z,finish_reason:ZC$(L.finishReason)}],usage:{prompt_tokens:L.usage?.inputTokens??0,completion_tokens:L.usage?.outputTokens??0,total_tokens:L.usage?.totalTokens??0}})}}catch(X){let Y=X;if(Y.name==="AbortError")return $.json(zK("Request aborted","invalid_request_error"),400);if(Y.name==="MessageConversionError")return $.json(zK(Y.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",Y.message,Y.stack),$.json(zK(Y.message,"server_error"),500)}});YC$=XC$});var WC$;var JC$=O(()=>{WC$={name:"decocms",version:"4.76.83",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/mesh"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:'bun run migrate && concurrently "bun run dev:client" "bun run dev:server"',"dev:servers":'concurrently "bun run dev:client" "bun run dev:server"',"dev:client":"vite dev","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts","build:client":"bun --bun vite build","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","db:migrate":"bun run ./dist/server/migrate.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts",test:"bun test","test:ct":"playwright test -c playwright-ct.config.ts","test:ct:ui":"playwright test -c playwright-ct.config.ts --ui","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts","smoke:link":"bun run scripts/smoke-link.ts",prepublishOnly:"bun run build:client && bun run build:server"},optionalDependencies:{"@anthropic-ai/claude-agent-sdk":"^0.3.181","@duckdb/node-api":"^1.5.0-r.1","@openai/codex":"0.144.3","@openai/codex-darwin-arm64":"npm:@openai/codex@0.144.3-darwin-arm64","@openai/codex-darwin-x64":"npm:@openai/codex@0.144.3-darwin-x64","@openai/codex-linux-arm64":"npm:@openai/codex@0.144.3-linux-arm64","@openai/codex-linux-x64":"npm:@openai/codex@0.144.3-linux-x64","@openai/codex-win32-arm64":"npm:@openai/codex@0.144.3-win32-arm64","@openai/codex-win32-x64":"npm:@openai/codex@0.144.3-win32-x64"},dependencies:{"@ai-sdk/anthropic":"^3.0.85","@ai-sdk/google":"^3.0.83","@ai-sdk/openai":"^3.0.73","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@dnd-kit/core":"^6.3.1","@dnd-kit/sortable":"^10.0.0","@dnd-kit/utilities":"^3.2.2","@inkjs/ui":"^2.0.0","@modelcontextprotocol/ext-apps":"^1.7.1","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^2.9.1","@opentelemetry/core":"^2.6.0","@tanstack/react-virtual":"3.13.24","@tiptap/extension-text-align":"3.20.2","@xterm/addon-fit":"^0.11.0","@xterm/xterm":"^6.0.0",echarts:"^5.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","node-pty":"^1.0.0","posthog-js":"^1.371.1","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6","use-stick-to-bottom":"^1.1.6"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@ai-sdk/react":"^3.0.210","@better-auth/sso":"1.4.1","@daveyplate/better-auth-ui":"^3.2.7","@deco/ui":"workspace:*","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/harness":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/mesh-sdk":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/std":"workspace:*","@decocms/tunnel":"workspace:*","@floating-ui/react":"^0.27.16","@happy-dom/global-registrator":"^20.9.0","@hookform/resolvers":"^5.2.2","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@monaco-editor/react":"^4.7.0","@nats-io/jwt":"0.0.10-5","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@playwright/experimental-ct-react":"1.59.1","@playwright/test":"^1.58.2","@radix-ui/react-avatar":"^1.1.10","@radix-ui/react-checkbox":"^1.3.3","@radix-ui/react-dialog":"^1.1.15","@radix-ui/react-dropdown-menu":"^2.1.16","@radix-ui/react-label":"^2.1.7","@radix-ui/react-select":"^2.2.6","@radix-ui/react-separator":"^1.1.7","@radix-ui/react-slot":"^1.2.3","@radix-ui/react-tabs":"^1.1.13","@rjsf/shadcn":"^6.6.2","@rjsf/utils":"^6.6.2","@rjsf/validator-ajv8":"^6.6.2","@tailwindcss/vite":"^4.1.17","@tanstack/react-query":"5.100.10","@tanstack/react-router":"1.169.2","@testing-library/jest-dom":"^6.9.1","@testing-library/react":"^16.3.2","@tiptap/core":"3.20.2","@tiptap/extension-placeholder":"3.20.2","@tiptap/pm":"3.20.2","@tiptap/react":"3.20.2","@tiptap/starter-kit":"3.20.2","@tiptap/suggestion":"3.20.2","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@untitledui/icons":"^0.0.19","@vercel/nft":"^1.1.1","@vitejs/plugin-react":"^5.1.0",ai:"^6.0.208","babel-plugin-react-compiler":"^1.0.0","better-auth":"1.4.22","class-variance-authority":"^0.7.1",clsx:"^2.1.1",concurrently:"^9.2.1",croner:"^9.1.0","date-fns":"^4.1.0",degit:"^2.8.4",hono:"^4.10.7","input-otp":"^1.4.2",jose:"^6.0.11","lucide-react":"^0.468.0",marked:"^15.0.6",nanoid:"^5.1.6",pg:"^8.16.3",prettier:"^3.4.2","react-hook-form":"^7.66.0","react-markdown":"^10.1.0","react-resizable-panels":"^2.1.7","react-syntax-highlighter":"^15.6.1",recharts:"^3.6.0","rehype-raw":"^7.0.0","remark-gfm":"^4.0.0","sass-embedded":"^1.97.2",sonner:"^2.0.7","tailwind-merge":"^3.3.1",tailwindcss:"^4.1.17",typescript:"^5.9.3",vite:"^7.2.1","vite-tsconfig-paths":"^5.1.4",zod:"^4.0.0"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","mesh","tools"],license:"MIT",publishConfig:{access:"public"}}});function O64(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??B64}}var KC$,B64="https://ph.studio.decocms.com",UC$;var wC$=O(()=>{F6();sb0();nN();BG();F8();$01();JC$();KC$=new b1;KC$.get("/",($)=>{let Z={version:WC$.version,theme:Lb1(),...rO().logo&&{logo:rO().logo},...yQ()&&{internalUrl:$00()},...O1().enableDecoImport&&{enableDecoImport:!0},brandExtractEnabled:!!O1().firecrawlApiKey,auth:VI$(),posthog:O64(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:!yQ()&&O1().sandboxProviderKind==="agent-sandbox"}};return $.header("Cache-Control","no-store"),$.json({success:!0,config:Z})});UC$=KC$});function gL0($){let Z=($??"").trim().toLowerCase();return Z=Z.replace(/^https?:\/\//,""),Z=Z.replace(/^www\./,""),Z=Z.split(/[/?#]/)[0]??"",Z.replace(/\/+$/,"")}function HC$($){return(gL0($).split(".")[0]||$).replace(/[-_]/g," ").split(" ").filter(Boolean).map((G)=>G.charAt(0).toUpperCase()+G.slice(1)).join(" ")}function NC$($,Z=64){return`https://www.google.com/s2/favicons?domain=${encodeURIComponent(gL0($))}&sz=${Z}`}function FC$($,Z){let G=$.trim();if(G.length<=Z)return G;let X=G.slice(0,Z-1),Y=X.lastIndexOf(" ");return`${(Y>Z*0.6?X.slice(0,Y):X).trimEnd()}\u2026`}function BC$($){let{brand:Z,domain:G,score:X,verdict:Y}=$,Q=typeof X==="number"?`${Z} commerce report \u2014 ${Math.round(X)}/100 \xB7 decocms`:`${Z} commerce report \xB7 decocms`,J=`See the full ${Z} scorecard \u2014 SEO, performance, conversion & AEO signals scored by decocms.`,W=Y?.trim()?FC$(`${Y.trim().replace(/\s+/g," ")} \u2014 ${J}`,200):FC$(`How does ${G} really perform? ${J}`,200);return{title:Q,description:W}}import{join as D64}from"path";function vw($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function E64($){let Z=gL0($),G=HC$(Z),X=NC$(Z,128),Q=`${(O1().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(Z)}`,{title:J,description:W}=BC$({brand:G,domain:Z});return[`<title>${vw(J)}</title>`,`<meta name="description" content="${vw(W)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${vw(J)}" />`,`<meta property="og:description" content="${vw(W)}" />`,`<meta property="og:url" content="${vw(Q)}" />`,'<meta name="twitter:card" content="summary" />',`<meta name="twitter:title" content="${vw(J)}" />`,`<meta name="twitter:description" content="${vw(W)}" />`,`<link rel="canonical" href="${vw(Q)}" />`,`<link rel="icon" href="${vw(X)}" sizes="any" />`].join(`
+`;return new TextEncoder().encode(X)}var m$1,LC,k84,vV$,l$1="ABCDEFGHIJKLMNOPQRSTUVWXYZ234567",V84,d$,u$,Z6,xV$=24,zC,_J;var lV$=O(()=>{(function($){$.Operator="operator",$.Account="account",$.User="user",$.Activation="activation",$.AuthorizationResponse="authorization_response"})(m$1||(m$1={}));(function($){var Z=function(h,l){this.hi=h|0,this.lo=l|0},G=function(h){var l,c=new Float64Array(16);if(h)for(l=0;l<h.length;l++)c[l]=h[l];return c},X=function(){throw Error("no PRNG")},Y=new Uint8Array(16),Q=new Uint8Array(32);Q[0]=9;var J=G(),W=G([1]),K=G([56129,1]),U=G([30883,4953,19914,30187,55467,16705,2637,112,59544,30585,16505,36039,65139,11119,27886,20995]),w=G([61785,9906,39828,60374,45398,33411,5274,224,53552,61171,33010,6542,64743,22239,55772,9222]),F=G([54554,36645,11616,51542,42930,38181,51040,26924,56412,64982,57905,49316,21502,52590,14035,8553]),H=G([26200,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214]),N=G([41136,18958,6951,50414,58488,44335,6150,12099,55207,15867,153,11085,57099,20417,9344,11139]);function B(h,l){return h<<l|h>>>32-l}function D(h,l){var c=h[l+3]&255;return c=c<<8|h[l+2]&255,c=c<<8|h[l+1]&255,c<<8|h[l+0]&255}function E(h,l){var c=h[l]<<24|h[l+1]<<16|h[l+2]<<8|h[l+3],r=h[l+4]<<24|h[l+5]<<16|h[l+6]<<8|h[l+7];return new Z(c,r)}function L(h,l,c){var r;for(r=0;r<4;r++)h[l+r]=c&255,c>>>=8}function z(h,l,c){h[l]=c.hi>>24&255,h[l+1]=c.hi>>16&255,h[l+2]=c.hi>>8&255,h[l+3]=c.hi&255,h[l+4]=c.lo>>24&255,h[l+5]=c.lo>>16&255,h[l+6]=c.lo>>8&255,h[l+7]=c.lo&255}function j(h,l,c,r,X0){var W0,b0=0;for(W0=0;W0<X0;W0++)b0|=h[l+W0]^c[r+W0];return(1&b0-1>>>8)-1}function P(h,l,c,r){return j(h,l,c,r,16)}function A(h,l,c,r){return j(h,l,c,r,32)}function M(h,l,c,r,X0){var W0=new Uint32Array(16),b0=new Uint32Array(16),m0=new Uint32Array(16),P0=new Uint32Array(4),S0,j0,y0;for(S0=0;S0<4;S0++)b0[5*S0]=D(r,4*S0),b0[1+S0]=D(c,4*S0),b0[6+S0]=D(l,4*S0),b0[11+S0]=D(c,16+4*S0);for(S0=0;S0<16;S0++)m0[S0]=b0[S0];for(S0=0;S0<20;S0++){for(j0=0;j0<4;j0++){for(y0=0;y0<4;y0++)P0[y0]=b0[(5*j0+4*y0)%16];P0[1]^=B(P0[0]+P0[3]|0,7),P0[2]^=B(P0[1]+P0[0]|0,9),P0[3]^=B(P0[2]+P0[1]|0,13),P0[0]^=B(P0[3]+P0[2]|0,18);for(y0=0;y0<4;y0++)W0[4*j0+(j0+y0)%4]=P0[y0]}for(y0=0;y0<16;y0++)b0[y0]=W0[y0]}if(X0){for(S0=0;S0<16;S0++)b0[S0]=b0[S0]+m0[S0]|0;for(S0=0;S0<4;S0++)b0[5*S0]=b0[5*S0]-D(r,4*S0)|0,b0[6+S0]=b0[6+S0]-D(l,4*S0)|0;for(S0=0;S0<4;S0++)L(h,4*S0,b0[5*S0]),L(h,16+4*S0,b0[6+S0])}else for(S0=0;S0<16;S0++)L(h,4*S0,b0[S0]+m0[S0]|0)}function S(h,l,c,r){return M(h,l,c,r,!1),0}function R(h,l,c,r){return M(h,l,c,r,!0),0}var V=new Uint8Array([101,120,112,97,110,100,32,51,50,45,98,121,116,101,32,107]);function i(h,l,c,r,X0,W0,b0){var m0=new Uint8Array(16),P0=new Uint8Array(64),S0,j0;if(!X0)return 0;for(j0=0;j0<16;j0++)m0[j0]=0;for(j0=0;j0<8;j0++)m0[j0]=W0[j0];while(X0>=64){S(P0,m0,b0,V);for(j0=0;j0<64;j0++)h[l+j0]=(c?c[r+j0]:0)^P0[j0];S0=1;for(j0=8;j0<16;j0++)S0=S0+(m0[j0]&255)|0,m0[j0]=S0&255,S0>>>=8;if(X0-=64,l+=64,c)r+=64}if(X0>0){S(P0,m0,b0,V);for(j0=0;j0<X0;j0++)h[l+j0]=(c?c[r+j0]:0)^P0[j0]}return 0}function f(h,l,c,r,X0){return i(h,l,null,0,c,r,X0)}function v(h,l,c,r,X0){var W0=new Uint8Array(32);return R(W0,r,X0,V),f(h,l,c,r.subarray(16),W0)}function Z0(h,l,c,r,X0,W0,b0){var m0=new Uint8Array(32);return R(m0,W0,b0,V),i(h,l,c,r,X0,W0.subarray(16),m0)}function o(h,l){var c,r=0;for(c=0;c<17;c++)r=r+(h[c]+l[c]|0)|0,h[c]=r&255,r>>>=8}var B0=new Uint32Array([5,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,252]);function D0(h,l,c,r,X0,W0){var b0,m0,P0,S0,j0=new Uint32Array(17),y0=new Uint32Array(17),o0=new Uint32Array(17),Z1=new Uint32Array(17),U1=new Uint32Array(17);for(P0=0;P0<17;P0++)y0[P0]=o0[P0]=0;for(P0=0;P0<16;P0++)y0[P0]=W0[P0];y0[3]&=15,y0[4]&=252,y0[7]&=15,y0[8]&=252,y0[11]&=15,y0[12]&=252,y0[15]&=15;while(X0>0){for(P0=0;P0<17;P0++)Z1[P0]=0;for(P0=0;P0<16&&P0<X0;++P0)Z1[P0]=c[r+P0];Z1[P0]=1,r+=P0,X0-=P0,o(o0,Z1);for(m0=0;m0<17;m0++){j0[m0]=0;for(P0=0;P0<17;P0++)j0[m0]=j0[m0]+o0[P0]*(P0<=m0?y0[m0-P0]:320*y0[m0+17-P0]|0)|0|0}for(m0=0;m0<17;m0++)o0[m0]=j0[m0];S0=0;for(P0=0;P0<16;P0++)S0=S0+o0[P0]|0,o0[P0]=S0&255,S0>>>=8;S0=S0+o0[16]|0,o0[16]=S0&3,S0=5*(S0>>>2)|0;for(P0=0;P0<16;P0++)S0=S0+o0[P0]|0,o0[P0]=S0&255,S0>>>=8;S0=S0+o0[16]|0,o0[16]=S0}for(P0=0;P0<17;P0++)U1[P0]=o0[P0];o(o0,B0),b0=-(o0[16]>>>7)|0;for(P0=0;P0<17;P0++)o0[P0]^=b0&(U1[P0]^o0[P0]);for(P0=0;P0<16;P0++)Z1[P0]=W0[P0+16];Z1[16]=0,o(o0,Z1);for(P0=0;P0<16;P0++)h[l+P0]=o0[P0];return 0}function J0(h,l,c,r,X0,W0){var b0=new Uint8Array(16);return D0(b0,0,c,r,X0,W0),P(h,l,b0,0)}function Y0(h,l,c,r,X0){var W0;if(c<32)return-1;Z0(h,0,l,0,c,r,X0),D0(h,16,h,32,c-32,h);for(W0=0;W0<16;W0++)h[W0]=0;return 0}function a(h,l,c,r,X0){var W0,b0=new Uint8Array(32);if(c<32)return-1;if(v(b0,0,32,r,X0),J0(l,16,l,32,c-32,b0)!==0)return-1;Z0(h,0,l,0,c,r,X0);for(W0=0;W0<32;W0++)h[W0]=0;return 0}function A0(h,l){var c;for(c=0;c<16;c++)h[c]=l[c]|0}function U0(h){var l,c;for(c=0;c<16;c++)h[c]+=65536,l=Math.floor(h[c]/65536),h[(c+1)*(c<15?1:0)]+=l-1+37*(l-1)*(c===15?1:0),h[c]-=l*65536}function v0(h,l,c){var r,X0=~(c-1);for(var W0=0;W0<16;W0++)r=X0&(h[W0]^l[W0]),h[W0]^=r,l[W0]^=r}function d0(h,l){var c,r,X0,W0=G(),b0=G();for(c=0;c<16;c++)b0[c]=l[c];U0(b0),U0(b0),U0(b0);for(r=0;r<2;r++){W0[0]=b0[0]-65517;for(c=1;c<15;c++)W0[c]=b0[c]-65535-(W0[c-1]>>16&1),W0[c-1]&=65535;W0[15]=b0[15]-32767-(W0[14]>>16&1),X0=W0[15]>>16&1,W0[14]&=65535,v0(b0,W0,1-X0)}for(c=0;c<16;c++)h[2*c]=b0[c]&255,h[2*c+1]=b0[c]>>8}function i0(h,l){var c=new Uint8Array(32),r=new Uint8Array(32);return d0(c,h),d0(r,l),A(c,0,r,0)}function n0(h){var l=new Uint8Array(32);return d0(l,h),l[0]&1}function w0(h,l){var c;for(c=0;c<16;c++)h[c]=l[2*c]+(l[2*c+1]<<8);h[15]&=32767}function C0(h,l,c){var r;for(r=0;r<16;r++)h[r]=l[r]+c[r]|0}function T0(h,l,c){var r;for(r=0;r<16;r++)h[r]=l[r]-c[r]|0}function N0(h,l,c){var r,X0,W0=new Float64Array(31);for(r=0;r<31;r++)W0[r]=0;for(r=0;r<16;r++)for(X0=0;X0<16;X0++)W0[r+X0]+=l[r]*c[X0];for(r=0;r<15;r++)W0[r]+=38*W0[r+16];for(r=0;r<16;r++)h[r]=W0[r];U0(h),U0(h)}function Q0(h,l){N0(h,l,l)}function G0(h,l){var c=G(),r;for(r=0;r<16;r++)c[r]=l[r];for(r=253;r>=0;r--)if(Q0(c,c),r!==2&&r!==4)N0(c,c,l);for(r=0;r<16;r++)h[r]=c[r]}function V0(h,l){var c=G(),r;for(r=0;r<16;r++)c[r]=l[r];for(r=250;r>=0;r--)if(Q0(c,c),r!==1)N0(c,c,l);for(r=0;r<16;r++)h[r]=c[r]}function n(h,l,c){var r=new Uint8Array(32),X0=new Float64Array(80),W0,b0,m0=G(),P0=G(),S0=G(),j0=G(),y0=G(),o0=G();for(b0=0;b0<31;b0++)r[b0]=l[b0];r[31]=l[31]&127|64,r[0]&=248,w0(X0,c);for(b0=0;b0<16;b0++)P0[b0]=X0[b0],j0[b0]=m0[b0]=S0[b0]=0;m0[0]=j0[0]=1;for(b0=254;b0>=0;--b0)W0=r[b0>>>3]>>>(b0&7)&1,v0(m0,P0,W0),v0(S0,j0,W0),C0(y0,m0,S0),T0(m0,m0,S0),C0(S0,P0,j0),T0(P0,P0,j0),Q0(j0,y0),Q0(o0,m0),N0(m0,S0,m0),N0(S0,P0,y0),C0(y0,m0,S0),T0(m0,m0,S0),Q0(P0,m0),T0(S0,j0,o0),N0(m0,S0,K),C0(m0,m0,j0),N0(S0,S0,m0),N0(m0,j0,o0),N0(j0,P0,X0),Q0(P0,y0),v0(m0,P0,W0),v0(S0,j0,W0);for(b0=0;b0<16;b0++)X0[b0+16]=m0[b0],X0[b0+32]=S0[b0],X0[b0+48]=P0[b0],X0[b0+64]=j0[b0];var Z1=X0.subarray(32),U1=X0.subarray(16);return G0(Z1,Z1),N0(U1,U1,Z1),d0(h,U1),0}function e(h,l){return n(h,l,Q)}function t0(h,l){return X(l,32),e(h,l)}function R0(h,l,c){var r=new Uint8Array(32);return n(r,c,l),R(h,Y,r,V)}var q0=Y0,g=a;function H0(h,l,c,r,X0,W0){var b0=new Uint8Array(32);return R0(b0,X0,W0),q0(h,l,c,r,b0)}function f0(h,l,c,r,X0,W0){var b0=new Uint8Array(32);return R0(b0,X0,W0),g(h,l,c,r,b0)}function e0(){var h=0,l=0,c=0,r=0,X0=65535,W0,b0,m0;for(m0=0;m0<arguments.length;m0++)W0=arguments[m0].lo,b0=arguments[m0].hi,h+=W0&X0,l+=W0>>>16,c+=b0&X0,r+=b0>>>16;return l+=h>>>16,c+=l>>>16,r+=c>>>16,new Z(c&X0|r<<16,h&X0|l<<16)}function u0(h,l){return new Z(h.hi>>>l,h.lo>>>l|h.hi<<32-l)}function T1(){var h=0,l=0,c;for(c=0;c<arguments.length;c++)h^=arguments[c].lo,l^=arguments[c].hi;return new Z(l,h)}function e1(h,l){var c,r,X0=32-l;if(l<32)c=h.hi>>>l|h.lo<<X0,r=h.lo>>>l|h.hi<<X0;else if(l<64)c=h.lo>>>l|h.hi<<X0,r=h.hi>>>l|h.lo<<X0;return new Z(c,r)}function z6(h,l,c){var r=h.hi&l.hi^~h.hi&c.hi,X0=h.lo&l.lo^~h.lo&c.lo;return new Z(r,X0)}function J4(h,l,c){var r=h.hi&l.hi^h.hi&c.hi^l.hi&c.hi,X0=h.lo&l.lo^h.lo&c.lo^l.lo&c.lo;return new Z(r,X0)}function d5(h){return T1(e1(h,28),e1(h,34),e1(h,39))}function s(h){return T1(e1(h,14),e1(h,18),e1(h,41))}function K1(h){return T1(e1(h,1),e1(h,8),u0(h,7))}function a$(h){return T1(e1(h,19),e1(h,61),u0(h,6))}var s$=[new Z(1116352408,3609767458),new Z(1899447441,602891725),new Z(3049323471,3964484399),new Z(3921009573,2173295548),new Z(961987163,4081628472),new Z(1508970993,3053834265),new Z(2453635748,2937671579),new Z(2870763221,3664609560),new Z(3624381080,2734883394),new Z(310598401,1164996542),new Z(607225278,1323610764),new Z(1426881987,3590304994),new Z(1925078388,4068182383),new Z(2162078206,991336113),new Z(2614888103,633803317),new Z(3248222580,3479774868),new Z(3835390401,2666613458),new Z(4022224774,944711139),new Z(264347078,2341262773),new Z(604807628,2007800933),new Z(770255983,1495990901),new Z(1249150122,1856431235),new Z(1555081692,3175218132),new Z(1996064986,2198950837),new Z(2554220882,3999719339),new Z(2821834349,766784016),new Z(2952996808,2566594879),new Z(3210313671,3203337956),new Z(3336571891,1034457026),new Z(3584528711,2466948901),new Z(113926993,3758326383),new Z(338241895,168717936),new Z(666307205,1188179964),new Z(773529912,1546045734),new Z(1294757372,1522805485),new Z(1396182291,2643833823),new Z(1695183700,2343527390),new Z(1986661051,1014477480),new Z(2177026350,1206759142),new Z(2456956037,344077627),new Z(2730485921,1290863460),new Z(2820302411,3158454273),new Z(3259730800,3505952657),new Z(3345764771,106217008),new Z(3516065817,3606008344),new Z(3600352804,1432725776),new Z(4094571909,1467031594),new Z(275423344,851169720),new Z(430227734,3100823752),new Z(506948616,1363258195),new Z(659060556,3750685593),new Z(883997877,3785050280),new Z(958139571,3318307427),new Z(1322822218,3812723403),new Z(1537002063,2003034995),new Z(1747873779,3602036899),new Z(1955562222,1575990012),new Z(2024104815,1125592928),new Z(2227730452,2716904306),new Z(2361852424,442776044),new Z(2428436474,593698344),new Z(2756734187,3733110249),new Z(3204031479,2999351573),new Z(3329325298,3815920427),new Z(3391569614,3928383900),new Z(3515267271,566280711),new Z(3940187606,3454069534),new Z(4118630271,4000239992),new Z(116418474,1914138554),new Z(174292421,2731055270),new Z(289380356,3203993006),new Z(460393269,320620315),new Z(685471733,587496836),new Z(852142971,1086792851),new Z(1017036298,365543100),new Z(1126000580,2618297676),new Z(1288033470,3409855158),new Z(1501505948,4234509866),new Z(1607167915,987167468),new Z(1816402316,1246189591)];function A9(h,l,c){var r=[],X0=[],W0=[],b0=[],m0,P0,S0;for(P0=0;P0<8;P0++)r[P0]=W0[P0]=E(h,8*P0);var j0=0;while(c>=128){for(P0=0;P0<16;P0++)b0[P0]=E(l,8*P0+j0);for(P0=0;P0<80;P0++){for(S0=0;S0<8;S0++)X0[S0]=W0[S0];m0=e0(W0[7],s(W0[4]),z6(W0[4],W0[5],W0[6]),s$[P0],b0[P0%16]),X0[7]=e0(m0,d5(W0[0]),J4(W0[0],W0[1],W0[2])),X0[3]=e0(X0[3],m0);for(S0=0;S0<8;S0++)W0[(S0+1)%8]=X0[S0];if(P0%16===15)for(S0=0;S0<16;S0++)b0[S0]=e0(b0[S0],b0[(S0+9)%16],K1(b0[(S0+1)%16]),a$(b0[(S0+14)%16]))}for(P0=0;P0<8;P0++)W0[P0]=e0(W0[P0],r[P0]),r[P0]=W0[P0];j0+=128,c-=128}for(P0=0;P0<8;P0++)z(h,8*P0,r[P0]);return c}var lG=new Uint8Array([106,9,230,103,243,188,201,8,187,103,174,133,132,202,167,59,60,110,243,114,254,148,248,43,165,79,245,58,95,29,54,241,81,14,82,127,173,230,130,209,155,5,104,140,43,62,108,31,31,131,217,171,251,65,189,107,91,224,205,25,19,126,33,121]);function q8(h,l,c){var r=new Uint8Array(64),X0=new Uint8Array(256),W0,b0=c;for(W0=0;W0<64;W0++)r[W0]=lG[W0];A9(r,l,c),c%=128;for(W0=0;W0<256;W0++)X0[W0]=0;for(W0=0;W0<c;W0++)X0[W0]=l[b0-c+W0];X0[c]=128,c=256-128*(c<112?1:0),X0[c-9]=0,z(X0,c-8,new Z(b0/536870912|0,b0<<3)),A9(r,X0,c);for(W0=0;W0<64;W0++)h[W0]=r[W0];return 0}function _6(h,l){var c=G(),r=G(),X0=G(),W0=G(),b0=G(),m0=G(),P0=G(),S0=G(),j0=G();T0(c,h[1],h[0]),T0(j0,l[1],l[0]),N0(c,c,j0),C0(r,h[0],h[1]),C0(j0,l[0],l[1]),N0(r,r,j0),N0(X0,h[3],l[3]),N0(X0,X0,w),N0(W0,h[2],l[2]),C0(W0,W0,W0),T0(b0,r,c),T0(m0,W0,X0),C0(P0,W0,X0),C0(S0,r,c),N0(h[0],b0,m0),N0(h[1],S0,P0),N0(h[2],P0,m0),N0(h[3],b0,S0)}function Z5(h,l,c){var r;for(r=0;r<4;r++)v0(h[r],l[r],c)}function q5(h,l){var c=G(),r=G(),X0=G();G0(X0,l[2]),N0(c,l[0],X0),N0(r,l[1],X0),d0(h,r),h[31]^=n0(c)<<7}function J9(h,l,c){var r,X0;A0(h[0],J),A0(h[1],W),A0(h[2],W),A0(h[3],J);for(X0=255;X0>=0;--X0)r=c[X0/8|0]>>(X0&7)&1,Z5(h,l,r),_6(l,h),_6(h,h),Z5(h,l,r)}function T9(h,l){var c=[G(),G(),G(),G()];A0(c[0],F),A0(c[1],H),A0(c[2],W),N0(c[3],F,H),J9(h,c,l)}function x1(h,l,c){var r=new Uint8Array(64),X0=[G(),G(),G(),G()],W0;if(!c)X(l,32);q8(r,l,32),r[0]&=248,r[31]&=127,r[31]|=64,T9(X0,r),q5(h,X0);for(W0=0;W0<32;W0++)l[W0+32]=h[W0];return 0}var M8=new Float64Array([237,211,245,92,26,99,18,88,214,156,247,162,222,249,222,20,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,16]);function k8(h,l){var c,r,X0,W0;for(r=63;r>=32;--r){c=0;for(X0=r-32,W0=r-12;X0<W0;++X0)l[X0]+=c-16*l[r]*M8[X0-(r-32)],c=Math.floor((l[X0]+128)/256),l[X0]-=c*256;l[X0]+=c,l[r]=0}c=0;for(X0=0;X0<32;X0++)l[X0]+=c-(l[31]>>4)*M8[X0],c=l[X0]>>8,l[X0]&=255;for(X0=0;X0<32;X0++)l[X0]-=c*M8[X0];for(r=0;r<32;r++)l[r+1]+=l[r]>>8,h[r]=l[r]&255}function G6(h){var l=new Float64Array(64),c;for(c=0;c<64;c++)l[c]=h[c];for(c=0;c<64;c++)h[c]=0;k8(h,l)}function f$(h,l,c,r){var X0=new Uint8Array(64),W0=new Uint8Array(64),b0=new Uint8Array(64),m0,P0,S0=new Float64Array(64),j0=[G(),G(),G(),G()];q8(X0,r,32),X0[0]&=248,X0[31]&=127,X0[31]|=64;var y0=c+64;for(m0=0;m0<c;m0++)h[64+m0]=l[m0];for(m0=0;m0<32;m0++)h[32+m0]=X0[32+m0];q8(b0,h.subarray(32),c+32),G6(b0),T9(j0,b0),q5(h,j0);for(m0=32;m0<64;m0++)h[m0]=r[m0];q8(W0,h,c+64),G6(W0);for(m0=0;m0<64;m0++)S0[m0]=0;for(m0=0;m0<32;m0++)S0[m0]=b0[m0];for(m0=0;m0<32;m0++)for(P0=0;P0<32;P0++)S0[m0+P0]+=W0[m0]*X0[P0];return k8(h.subarray(32),S0),y0}function w8(h,l){var c=G(),r=G(),X0=G(),W0=G(),b0=G(),m0=G(),P0=G();if(A0(h[2],W),w0(h[1],l),Q0(X0,h[1]),N0(W0,X0,U),T0(X0,X0,h[2]),C0(W0,h[2],W0),Q0(b0,W0),Q0(m0,b0),N0(P0,m0,b0),N0(c,P0,X0),N0(c,c,W0),V0(c,c),N0(c,c,X0),N0(c,c,W0),N0(c,c,W0),N0(h[0],c,W0),Q0(r,h[0]),N0(r,r,W0),i0(r,X0))N0(h[0],h[0],N);if(Q0(r,h[0]),N0(r,r,W0),i0(r,X0))return-1;if(n0(h[0])===l[31]>>7)T0(h[0],J,h[0]);return N0(h[3],h[0],h[1]),0}function j7(h,l,c,r){var X0,W0=new Uint8Array(32),b0=new Uint8Array(64),m0=[G(),G(),G(),G()],P0=[G(),G(),G(),G()];if(c<64)return-1;if(w8(P0,r))return-1;for(X0=0;X0<c;X0++)h[X0]=l[X0];for(X0=0;X0<32;X0++)h[X0+32]=r[X0];if(q8(b0,h,c),G6(b0),J9(m0,P0,b0),T9(P0,l.subarray(32)),_6(m0,P0),q5(W0,m0),c-=64,A(l,0,W0,0)){for(X0=0;X0<c;X0++)h[X0]=0;return-1}for(X0=0;X0<c;X0++)h[X0]=l[X0+64];return c}var k$=32,n6=24,e6=32,r8=16,G5=32,C=32,d=32,u=32,I=32,t=n6,x0=e6,l0=r8,W1=64,F1=32,g1=64,_1=32,Y8=64;$.lowlevel={crypto_core_hsalsa20:R,crypto_stream_xor:Z0,crypto_stream:v,crypto_stream_salsa20_xor:i,crypto_stream_salsa20:f,crypto_onetimeauth:D0,crypto_onetimeauth_verify:J0,crypto_verify_16:P,crypto_verify_32:A,crypto_secretbox:Y0,crypto_secretbox_open:a,crypto_scalarmult:n,crypto_scalarmult_base:e,crypto_box_beforenm:R0,crypto_box_afternm:q0,crypto_box:H0,crypto_box_open:f0,crypto_box_keypair:t0,crypto_hash:q8,crypto_sign:f$,crypto_sign_keypair:x1,crypto_sign_open:j7,crypto_secretbox_KEYBYTES:k$,crypto_secretbox_NONCEBYTES:n6,crypto_secretbox_ZEROBYTES:e6,crypto_secretbox_BOXZEROBYTES:r8,crypto_scalarmult_BYTES:G5,crypto_scalarmult_SCALARBYTES:C,crypto_box_PUBLICKEYBYTES:d,crypto_box_SECRETKEYBYTES:u,crypto_box_BEFORENMBYTES:I,crypto_box_NONCEBYTES:t,crypto_box_ZEROBYTES:x0,crypto_box_BOXZEROBYTES:l0,crypto_sign_BYTES:W1,crypto_sign_PUBLICKEYBYTES:F1,crypto_sign_SECRETKEYBYTES:g1,crypto_sign_SEEDBYTES:_1,crypto_hash_BYTES:Y8,gf:G,D:U,L:M8,pack25519:d0,unpack25519:w0,M:N0,A:C0,S:Q0,Z:T0,pow2523:V0,add:_6,set25519:A0,modL:k8,scalarmult:J9,scalarbase:T9};function u1(h,l){if(h.length!==k$)throw Error("bad key size");if(l.length!==n6)throw Error("bad nonce size")}function z$(h,l){if(h.length!==d)throw Error("bad public key size");if(l.length!==u)throw Error("bad secret key size")}function Y$(){for(var h=0;h<arguments.length;h++)if(!(arguments[h]instanceof Uint8Array))throw TypeError("unexpected type, use Uint8Array")}function y$(h){for(var l=0;l<h.length;l++)h[l]=0}$.randomBytes=function(h){var l=new Uint8Array(h);return X(l,h),l},$.secretbox=function(h,l,c){Y$(h,l,c),u1(c,l);var r=new Uint8Array(e6+h.length),X0=new Uint8Array(r.length);for(var W0=0;W0<h.length;W0++)r[W0+e6]=h[W0];return Y0(X0,r,r.length,l,c),X0.subarray(r8)},$.secretbox.open=function(h,l,c){Y$(h,l,c),u1(c,l);var r=new Uint8Array(r8+h.length),X0=new Uint8Array(r.length);for(var W0=0;W0<h.length;W0++)r[W0+r8]=h[W0];if(r.length<32)return null;if(a(X0,r,r.length,l,c)!==0)return null;return X0.subarray(e6)},$.secretbox.keyLength=k$,$.secretbox.nonceLength=n6,$.secretbox.overheadLength=r8,$.scalarMult=function(h,l){if(Y$(h,l),h.length!==C)throw Error("bad n size");if(l.length!==G5)throw Error("bad p size");var c=new Uint8Array(G5);return n(c,h,l),c},$.scalarMult.base=function(h){if(Y$(h),h.length!==C)throw Error("bad n size");var l=new Uint8Array(G5);return e(l,h),l},$.scalarMult.scalarLength=C,$.scalarMult.groupElementLength=G5,$.box=function(h,l,c,r){var X0=$.box.before(c,r);return $.secretbox(h,l,X0)},$.box.before=function(h,l){Y$(h,l),z$(h,l);var c=new Uint8Array(I);return R0(c,h,l),c},$.box.after=$.secretbox,$.box.open=function(h,l,c,r){var X0=$.box.before(c,r);return $.secretbox.open(h,l,X0)},$.box.open.after=$.secretbox.open,$.box.keyPair=function(){var h=new Uint8Array(d),l=new Uint8Array(u);return t0(h,l),{publicKey:h,secretKey:l}},$.box.keyPair.fromSecretKey=function(h){if(Y$(h),h.length!==u)throw Error("bad secret key size");var l=new Uint8Array(d);return e(l,h),{publicKey:l,secretKey:new Uint8Array(h)}},$.box.publicKeyLength=d,$.box.secretKeyLength=u,$.box.sharedKeyLength=I,$.box.nonceLength=t,$.box.overheadLength=$.secretbox.overheadLength,$.sign=function(h,l){if(Y$(h,l),l.length!==g1)throw Error("bad secret key size");var c=new Uint8Array(W1+h.length);return f$(c,h,h.length,l),c},$.sign.open=function(h,l){if(Y$(h,l),l.length!==F1)throw Error("bad public key size");var c=new Uint8Array(h.length),r=j7(c,h,h.length,l);if(r<0)return null;var X0=new Uint8Array(r);for(var W0=0;W0<X0.length;W0++)X0[W0]=c[W0];return X0},$.sign.detached=function(h,l){var c=$.sign(h,l),r=new Uint8Array(W1);for(var X0=0;X0<r.length;X0++)r[X0]=c[X0];return r},$.sign.detached.verify=function(h,l,c){if(Y$(h,l,c),l.length!==W1)throw Error("bad signature size");if(c.length!==F1)throw Error("bad public key size");var r=new Uint8Array(W1+h.length),X0=new Uint8Array(W1+h.length),W0;for(W0=0;W0<W1;W0++)r[W0]=l[W0];for(W0=0;W0<h.length;W0++)r[W0+W1]=h[W0];return j7(X0,r,r.length,c)>=0},$.sign.keyPair=function(){var h=new Uint8Array(F1),l=new Uint8Array(g1);return x1(h,l),{publicKey:h,secretKey:l}},$.sign.keyPair.fromSecretKey=function(h){if(Y$(h),h.length!==g1)throw Error("bad secret key size");var l=new Uint8Array(F1);for(var c=0;c<l.length;c++)l[c]=h[32+c];return{publicKey:l,secretKey:new Uint8Array(h)}},$.sign.keyPair.fromSeed=function(h){if(Y$(h),h.length!==_1)throw Error("bad seed size");var l=new Uint8Array(F1),c=new Uint8Array(g1);for(var r=0;r<32;r++)c[r]=h[r];return x1(l,c,!0),{publicKey:l,secretKey:c}},$.sign.publicKeyLength=F1,$.sign.secretKeyLength=g1,$.sign.seedLength=_1,$.sign.signatureLength=W1,$.hash=function(h){Y$(h);var l=new Uint8Array(Y8);return q8(l,h,h.length),l},$.hash.hashLength=Y8,$.verify=function(h,l){if(Y$(h,l),h.length===0||l.length===0)return!1;if(h.length!==l.length)return!1;return j(h,0,l,0,h.length)===0?!0:!1},$.setPRNG=function(h){X=h},function(){var h=typeof globalThis<"u"?globalThis.crypto||globalThis.msCrypto:null;if(h&&h.getRandomValues){var l=65536;$.setPRNG(function(c,r){var X0,W0=new Uint8Array(r);for(X0=0;X0<r;X0+=l)h.getRandomValues(W0.subarray(X0,X0+Math.min(r-X0,l)));for(X0=0;X0<r;X0++)c[X0]=W0[X0];y$(W0)})}else if(h=c0("crypto"),h&&h.randomBytes)$.setPRNG(function(c,r){var X0,W0=h.randomBytes(r);for(X0=0;X0<r;X0++)c[X0]=W0[X0];y$(W0)})}()})(typeof Cg<"u"&&b5Z?b5Z:globalThis.nacl=globalThis.nacl||{});LC=typeof Cg<"u"&&b5Z?b5Z:globalThis.nacl,k84={fromSeed:LC.sign.keyPair.fromSeed,sign:LC.sign.detached,verify:LC.sign.detached.verify,randomBytes:LC.randomBytes,scalarBaseMultiply:LC.scalarMult.base,seal:LC.box,open:LC.box.open};V84=new Uint16Array([0,4129,8258,12387,16516,20645,24774,28903,33032,37161,41290,45419,49548,53677,57806,61935,4657,528,12915,8786,21173,17044,29431,25302,37689,33560,45947,41818,54205,50076,62463,58334,9314,13379,1056,5121,25830,29895,17572,21637,42346,46411,34088,38153,58862,62927,50604,54669,13907,9842,5649,1584,30423,26358,22165,18100,46939,42874,38681,34616,63455,59390,55197,51132,18628,22757,26758,30887,2112,6241,10242,14371,51660,55789,59790,63919,35144,39273,43274,47403,23285,19156,31415,27286,6769,2640,14899,10770,56317,52188,64447,60318,39801,35672,47931,43802,27814,31879,19684,23749,11298,15363,3168,7233,60846,64911,52716,56781,44330,48395,36200,40265,32407,28342,24277,20212,15891,11826,7761,3696,65439,61374,57309,53244,48923,44858,40793,36728,37256,33193,45514,41451,53516,49453,61774,57711,4224,161,12482,8419,20484,16421,28742,24679,33721,37784,41979,46042,49981,54044,58239,62302,689,4752,8947,13010,16949,21012,25207,29270,46570,42443,38312,34185,62830,58703,54572,50445,13538,9411,5280,1153,29798,25671,21540,17413,42971,47098,34713,38840,59231,63358,50973,55100,9939,14066,1681,5808,26199,30326,17941,22068,55628,51565,63758,59695,39368,35305,47498,43435,22596,18533,30726,26663,6336,2273,14466,10403,52093,56156,60223,64286,35833,39896,43963,48026,19061,23124,27191,31254,2801,6864,10931,14994,64814,60687,56684,52557,48554,44427,40424,36297,31782,27655,23652,19525,15522,11395,7392,3265,61215,65342,53085,57212,44955,49082,36825,40952,28183,32310,20053,24180,11923,16050,3793,7920]);d$=class d$ extends Error{name;code;chainedError;constructor($,Z){super($);this.name="NKeysError",this.code=$,this.chainedError=Z}};(function($){$.InvalidPrefixByte="nkeys: invalid prefix byte",$.InvalidKey="nkeys: invalid key",$.InvalidPublicKey="nkeys: invalid public key",$.InvalidSeedLen="nkeys: invalid seed length",$.InvalidSeed="nkeys: invalid seed",$.InvalidCurveSeed="nkeys: invalid curve seed",$.InvalidCurveKey="nkeys: not a valid curve key",$.InvalidCurveOperation="nkeys: curve key is not valid for sign/verify",$.InvalidNKeyOperation="keys: only curve key can seal/open",$.InvalidEncoding="nkeys: invalid encoded key",$.InvalidRecipient="nkeys: not a valid recipient public curve key",$.InvalidEncrypted="nkeys: encrypted input is not valid",$.CannotSign="nkeys: cannot sign, no private key available",$.PublicKeyOnly="nkeys: no seed or private key available",$.InvalidChecksum="nkeys: invalid checksum",$.SerializationError="nkeys: serialization error",$.ApiError="nkeys: api error",$.ClearedPair="nkeys: pair is cleared"})(u$||(u$={}));(function($){$[$.Unknown=-1]="Unknown",$[$.Seed=144]="Seed",$[$.Private=120]="Private",$[$.Operator=112]="Operator",$[$.Server=104]="Server",$[$.Cluster=16]="Cluster",$[$.Account=0]="Account",$[$.User=160]="User",$[$.Curve=184]="Curve"})(Z6||(Z6={}));zC=[120,107,118,49];S84(k84);(function($){$.v1="ed25519",$.v2="ed25519-nkey"})(_J||(_J={}))});function r$1($){try{$?.clear?.()}catch{}}async function mV$({accountJwt:$,accountSigningKey:Z,expiresAt:G,permissions:X,userId:Y,allowedConnectionTypes:Q=["WEBSOCKET"]}){let J=uV$($),W=p$1(J.sub),K=t$1(new TextEncoder().encode(Z)),U=yV$();try{let w=await cV$(Y,U,W,{pub:{allow:X.publish.allow},sub:{allow:X.subscribe.allow},allowed_connection_types:Q},{algorithm:_J.v2,exp:Math.floor(G.getTime()/1000),signer:K});return new TextDecoder().decode(dV$(w,U))}finally{r$1(U),r$1(K),r$1(W)}}var iV$=O(()=>{lV$()});function u84($){return/^wss?:\/\//i.test($.trim())?["WEBSOCKET"]:["STANDARD","WEBSOCKET"]}function nV$(){let $=new b1;return $.post("/links/session",async(Z)=>{let X=Z.get("studioContext").auth?.user?.id;if(!X)return Z.json({error:"Unauthorized"},401);let Y=O1();if(!Y.natsTunnelPublicEnabled)return Z.json(o$1(),503);if(!Y.natsPublicUrl)return Z.json(o$1(),503);if(!Y.natsAccountJwt||!Y.natsAccountSigningKey){if(!Y.localMode)return Z.json(o$1(),503)}let Q=CJ(X),J;if(Y.natsAccountJwt&&Y.natsAccountSigningKey){let W=new Date(Date.now()+Y.natsTunnelSessionTtlSeconds*1000);J=await mV$({accountJwt:Y.natsAccountJwt,accountSigningKey:Y.natsAccountSigningKey,expiresAt:W,permissions:_V$(Q),userId:X,allowedConnectionTypes:u84(Y.natsPublicUrl)})}return Z.json(bV$({publicUrl:Y.natsPublicUrl,userId:X,ttlSeconds:Y.natsTunnelSessionTtlSeconds,credentials:J}))}),$}var o$1=()=>({error:"link session unavailable"});var pV$=O(()=>{F6();F8();fV$();iV$()});async function m84($,Z){try{return!await $.alive(Z)}catch(G){return console.warn(`[vm-events] alive probe failed for ${Z}; assuming alive: ${G instanceof Error?G.message:String(G)}`),!1}}async function i84($){let{ctx:Z,runner:G,claimName:X,userId:Y,projectRef:Q,sandboxProviderKind:J}=$;try{await G.delete(X)}catch(W){console.warn(`[vm-events] runner.delete failed for ${X}: ${W instanceof Error?W.message:String(W)}`)}try{await new kN(Z.db).delete({userId:Y,projectRef:Q},J)}catch(W){console.warn(`[vm-events] sandbox_runner_state delete failed for ${Y}/${Q}/${J}: ${W instanceof Error?W.message:String(W)}`)}}async function n84($){let{stream:Z,claimName:G,runner:X,signal:Y}=$;return new Promise((Q)=>{let J=!1,W=!1,K=null,U=(H)=>{if(J)return;J=!0,clearTimeout(w),Y.removeEventListener("abort",F),K?.unsubscribe(),Q(H)},w=setTimeout(()=>{if(W||J)return;Z.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"claim-never-created",message:"Sandbox claim was never created. The SANDBOX_START call may have failed earlier \u2014 check the start error."})}).catch(()=>{}),U(!1)},d84),F=()=>U(!1);Y.addEventListener("abort",F,{once:!0}),K=rn(X,G,(H)=>{if(J)return;if(H.kind!=="claiming")W=!0;if(Z.writeSSE({event:"phase",data:JSON.stringify(H)}).catch(()=>{}),H.kind==="ready")U(!0);else if(H.kind==="failed")U(!1)})})}async function p84($){let{stream:Z,runner:G,claimName:X,signal:Y}=$,Q=Date.now(),J=null;while(!Y.aborted){let K=null;try{K=await G.proxyDaemonRequest(X,"/_sandbox/events",{method:"GET",headers:new Headers({accept:"text/event-stream"}),body:null,signal:Y})}catch(U){if(Y.aborted)return;if(Date.now()-Q<tV$){await O8(rV$,{signal:Y}).catch(()=>{});continue}let w=U instanceof Error?U.message:String(U);await Z.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:`Upstream daemon SSE error: ${w}`})}).catch(()=>{});return}if(K.status===404){try{await K.body?.cancel()}catch{}if(Date.now()-Q<tV$){await O8(rV$,{signal:Y}).catch(()=>{});continue}await Z.writeSSE({event:"gone",data:""}).catch(()=>{});return}if(!K.ok||!K.body){try{await K.body?.cancel()}catch{}await Z.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:`Upstream daemon SSE failed (${K.status}).`})}).catch(()=>{});return}J=K;break}if(!J||!J.body)return;let W=J.body.getReader();try{while(!Y.aborted){let{value:K,done:U}=await W.read();if(U)break;if(K)await Z.write(K)}}catch{}finally{try{W.releaseLock()}catch{}}}var d84=90000,l84=15000,oV$=()=>{let $=new b1;return $.get("/",async(Z)=>{let G=Z.var.studioContext;try{M0(G)}catch{return Z.json({error:"Unauthorized"},401)}let X=y1(G);if(!X)return Z.json({error:"Unauthorized"},401);let Y;try{Y=O0(G)}catch{return Z.json({error:"Organization scope required"},403)}let Q=Z.req.query("virtualMcpId"),J=Z.req.query("branch");if(!Q||!J)return Z.json({error:"virtualMcpId and branch are required"},400);let W=await G.storage.virtualMcps.findById(Q);if(!W||W.organization_id!==Y.id)return Z.json({error:"Virtual MCP not found"},404);let K=Zw({orgId:Y.id,virtualMcpId:Q,branch:J}),U=ey({userId:X,projectRef:K},J),w=W.metadata??null,F,H=null,N=null;try{let E=await _Y(G,{userId:X,branch:J,virtualMcpMetadata:w});F=E.provider,H=E.kind}catch(E){N=E instanceof Error?E:Error(String(E)),F=null}let B=H&&iW(F5(w),X,J,H),D=!!B&&B.sandboxHandle===U;if(!F)return tQ(Z,async(E)=>{await E.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:N?.message??"No sandbox runner configured on this studio instance."})})});return Z.header("X-Accel-Buffering","no"),Z.header("Content-Encoding","identity"),tQ(Z,async(E)=>{let L=new AbortController,z=setInterval(()=>{E.writeSSE({event:"keepalive",data:""}).catch(()=>{clearInterval(z)})},l84);E.onAbort(()=>{L.abort(),clearInterval(z)});try{if(D&&H){if(await m84(F,U)){await i84({ctx:G,runner:F,claimName:U,userId:X,projectRef:K,sandboxProviderKind:H}),await E.writeSSE({event:"gone",data:""}).catch(()=>{});return}}if(!await n84({stream:E,claimName:U,runner:F,signal:L.signal})||L.signal.aborted)return;await p84({stream:E,runner:F,claimName:U,signal:L.signal})}finally{clearInterval(z)}})}),$},tV$=60000,rV$=500;var aV$=O(()=>{F6();EC();MY();l5();RE0();on();jV();i90();qX()});function r84($){return $.filter((Z)=>Z.vendors?.alias).map((Z)=>({name:Z.name,title:Z.title,description:Z.description,logo:Z.logo,category:Z.category,vendor:{alias:Z.vendors.alias,url:Z.vendors.url}}))}async function o84($,Z){let G=await fetch(`${$}/rest/v1/apps?select=name,title,description,logo,category,vendors(alias,url)`,{headers:{apikey:Z,Authorization:`Bearer ${Z}`,Accept:"application/json"},signal:AbortSignal.timeout(t84)});if(!G.ok){let X=await G.text().catch(()=>G.statusText);throw console.error(`[deco-apps] Supabase error (${G.status}): ${X.slice(0,200)}`),Error(`External service error (${G.status})`)}return await G.json()}var t84=1e4,a84=async($,Z)=>{if(!$.get("studioContext").auth.user?.id)return $.json({error:"Unauthorized"},401);return Z()},sV$=()=>{let $=new b1;return $.use("*",a84),$.get("/",async(Z)=>{let G=O1(),X=G.decoSupabaseUrl,Y=G.decoSupabaseServiceKey;if(!X||!Y)return Z.json({apps:[]});try{let Q=await o84(X,Y);return Z.json({apps:r84(Q)})}catch(Q){return console.error("[deco-apps] GET error:",Q),Z.json({error:"Failed to fetch apps"},502)}}),$};var eV$=O(()=>{F6();F8()});import{z as h1}from"zod";function zK($,Z="invalid_request_error",G=null,X=null){return{error:{message:$,type:Z,param:G,code:X}}}function W64($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let G=$.substring(0,Z),X=$.substring(Z+1);if(!G||!X)return null;return{credentialId:G,modelId:X}}function K64($,Z,G){try{return JSON.parse($)}catch{throw new GC$(`Invalid JSON in tool call arguments for function '${G}' (tool_call_id: ${Z}): ${$}`)}}function U64($){let Z={};for(let G of $)if(G.role==="assistant"&&G.tool_calls)for(let X of G.tool_calls)Z[X.id]=X.function.name;return $.map((G)=>{switch(G.role){case"system":return{role:"system",content:G.content};case"user":if(typeof G.content==="string")return{role:"user",content:G.content};return{role:"user",content:G.content.map((Y)=>{if(Y.type==="text")return{type:"text",text:Y.text};return{type:"image",image:Y.image_url.url}})};case"assistant":if(G.tool_calls&&G.tool_calls.length>0)return{role:"assistant",content:G.tool_calls.map((Y)=>({type:"tool-call",toolCallId:Y.id,toolName:Y.function.name,input:K64(Y.function.arguments,Y.id,Y.function.name)}))};return{role:"assistant",content:G.content??""};case"tool":let X=Z[G.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:G.tool_call_id,toolName:X,output:{type:"text",value:G.content}}]}}})}function w64($){let Z=$.map((G)=>{let X=G.function.parameters?OY(G.function.parameters):OY({type:"object",properties:{}});return[G.function.name,x$({description:G.function.description,inputSchema:X})]});return Object.fromEntries(Z)}function F64($){if(!$)return;return{openai:{response_format:$}}}function H64(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function $C$($,Z,G,X,Y,Q){let J={model:$,messages:Z,tools:G,temperature:X.temperature,maxTokens:X.max_tokens,topP:X.top_p,frequencyPenalty:X.frequency_penalty,presencePenalty:X.presence_penalty,stopSequences:X.stop?Array.isArray(X.stop)?X.stop:[X.stop]:void 0,abortSignal:Q};return Y?{...J,providerOptions:Y}:J}function ZC$($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var s84=256,e84,$64,Z64,G64,X64,Y64,Q64,J64,GC$,XC$,YC$;var QC$=O(()=>{L6();F6();EC();e84=h1.object({type:h1.literal("function"),function:h1.object({name:h1.string(),description:h1.string().optional(),parameters:h1.record(h1.string(),h1.unknown()).optional()})}),$64=h1.object({id:h1.string(),type:h1.literal("function"),function:h1.object({name:h1.string(),arguments:h1.string()})}),Z64=h1.discriminatedUnion("role",[h1.object({role:h1.literal("system"),content:h1.string(),name:h1.string().optional()}),h1.object({role:h1.literal("user"),content:h1.union([h1.string(),h1.array(h1.union([h1.object({type:h1.literal("text"),text:h1.string()}),h1.object({type:h1.literal("image_url"),image_url:h1.object({url:h1.string(),detail:h1.string().optional()})})]))]),name:h1.string().optional()}),h1.object({role:h1.literal("assistant"),content:h1.string().nullable().optional(),name:h1.string().optional(),tool_calls:h1.array($64).optional()}),h1.object({role:h1.literal("tool"),content:h1.string(),tool_call_id:h1.string()})]),G64=h1.object({type:h1.literal("text")}),X64=h1.object({type:h1.literal("json_object")}),Y64=h1.object({type:h1.literal("json_schema"),json_schema:h1.object({name:h1.string(),description:h1.string().optional(),schema:h1.record(h1.string(),h1.unknown()),strict:h1.boolean().optional()})}),Q64=h1.union([G64,X64,Y64]),J64=h1.object({model:h1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:h1.array(Z64),stream:h1.boolean().optional().default(!1),temperature:h1.number().min(0).max(2).optional(),max_tokens:h1.number().positive().optional(),top_p:h1.number().min(0).max(1).optional(),frequency_penalty:h1.number().min(-2).max(2).optional(),presence_penalty:h1.number().min(-2).max(2).optional(),stop:h1.union([h1.string(),h1.array(h1.string())]).optional(),tools:h1.array(e84).optional(),tool_choice:h1.union([h1.literal("auto"),h1.literal("none"),h1.literal("required"),h1.object({type:h1.literal("function"),function:h1.object({name:h1.string()})})]).optional(),response_format:Q64.optional(),user:h1.string().optional()});GC$=class GC$ extends Error{constructor($){super($);this.name="MessageConversionError"}};XC$=new b1;XC$.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("studioContext"),G=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(zK("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(zK("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==G)return $.json(zK("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let X=await $.req.json(),Y=J64.safeParse(X);if(!Y.success){let E=Y.error.issues[0]??{message:"Invalid request",path:[]};return $.json(zK(`Invalid request: ${E.message}`,"invalid_request_error",E.path.length>0?E.path.join("."):null),400)}let Q=Y.data,J=W64(Q.model);if(!J)return $.json(zK("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=J,{modelId:K}=J;if(!W){let E=await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id});if(E.length===0)return $.json(zK("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=E[0].id}let U;try{U=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(zK(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let w=U.aiSdk.languageModel(K),F=U64(Q.messages),H=Q.tools?w64(Q.tools):void 0,N=F64(Q.response_format),B=H64(),D=Math.floor(Date.now()/1000);if(Q.stream)return tQ($,async(E)=>{let L=$C$(w,F,H,Q,N,$.req.raw.signal);try{let z=bQ(L),j=!1,P=0,A="",M=async()=>{if(A.length===0)return;let S=A;A="",await E.writeSSE({data:JSON.stringify({id:B,object:"chat.completion.chunk",created:D,model:Q.model,choices:[{index:0,delta:{content:S},finish_reason:null}]})})};for await(let S of z.fullStream){if(!j&&(S.type==="text-delta"||S.type==="tool-call"))await E.writeSSE({data:JSON.stringify({id:B,object:"chat.completion.chunk",created:D,model:Q.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),j=!0;if(S.type==="text-delta"){if(A+=S.text,A.length>=s84)await M()}else if(S.type==="tool-call"){await M();let R=P++;await E.writeSSE({data:JSON.stringify({id:B,object:"chat.completion.chunk",created:D,model:Q.model,choices:[{index:0,delta:{tool_calls:[{index:R,id:S.toolCallId,type:"function",function:{name:S.toolName,arguments:JSON.stringify(S.input)}}]},finish_reason:null}]})})}else if(S.type==="finish")await M(),await E.writeSSE({data:JSON.stringify({id:B,object:"chat.completion.chunk",created:D,model:Q.model,choices:[{index:0,delta:{},finish_reason:ZC$(S.finishReason)}],usage:S.totalUsage?{prompt_tokens:S.totalUsage.inputTokens??0,completion_tokens:S.totalUsage.outputTokens??0,total_tokens:S.totalUsage.totalTokens??0}:void 0})})}await M(),await E.writeSSE({data:"[DONE]"})}catch(z){let j=z;console.error("[openai-compat:stream] Error:",j.message),await E.writeSSE({data:JSON.stringify({error:{message:j.message,type:"server_error"}})})}});else{let E=$C$(w,F,H,Q,N,$.req.raw.signal),L=await EN(E),z={role:"assistant",content:L.text||null};if(L.toolCalls&&L.toolCalls.length>0)z.tool_calls=L.toolCalls.map((j)=>({id:j.toolCallId,type:"function",function:{name:j.toolName,arguments:JSON.stringify("input"in j?j.input:{})}})),z.content=null;return $.json({id:B,object:"chat.completion",created:D,model:Q.model,choices:[{index:0,message:z,finish_reason:ZC$(L.finishReason)}],usage:{prompt_tokens:L.usage?.inputTokens??0,completion_tokens:L.usage?.outputTokens??0,total_tokens:L.usage?.totalTokens??0}})}}catch(X){let Y=X;if(Y.name==="AbortError")return $.json(zK("Request aborted","invalid_request_error"),400);if(Y.name==="MessageConversionError")return $.json(zK(Y.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",Y.message,Y.stack),$.json(zK(Y.message,"server_error"),500)}});YC$=XC$});var WC$;var JC$=O(()=>{WC$={name:"decocms",version:"4.76.85",description:"Deco CMS \u2014 Self-hostable MCP Gateway for managing AI connections and tools",author:"Deco team",repository:{type:"git",url:"git+https://github.com/decocms/studio.git",directory:"apps/mesh"},bugs:{url:"https://github.com/decocms/studio/issues"},type:"module",bin:{deco:"./dist/server/cli.js"},files:["dist/**/*"],scripts:{dev:'bun run migrate && concurrently "bun run dev:client" "bun run dev:server"',"dev:servers":'concurrently "bun run dev:client" "bun run dev:server"',"dev:client":"vite dev","dev:server":"bun run --cwd=../../packages/sandbox build && NODE_ENV=development bun --env-file=.env --hot run src/index.ts","build:client":"bun --bun vite build","build:server":"bun run scripts/bundle-server-script.ts --dist ./dist/server","db:migrate":"bun run ./dist/server/migrate.js",check:"tsc --noEmit",start:"bun run ./dist/server/server.js",migrate:"bun run src/database/migrate.ts",test:"bun test","test:ct":"playwright test -c playwright-ct.config.ts","test:ct:ui":"playwright test -c playwright-ct.config.ts --ui","better-auth:migrate":"bunx --bun @better-auth/cli migrate -y --config src/auth/index.ts","smoke:link":"bun run scripts/smoke-link.ts",prepublishOnly:"bun run build:client && bun run build:server"},optionalDependencies:{"@anthropic-ai/claude-agent-sdk":"^0.3.181","@duckdb/node-api":"^1.5.0-r.1","@openai/codex":"0.144.3","@openai/codex-darwin-arm64":"npm:@openai/codex@0.144.3-darwin-arm64","@openai/codex-darwin-x64":"npm:@openai/codex@0.144.3-darwin-x64","@openai/codex-linux-arm64":"npm:@openai/codex@0.144.3-linux-arm64","@openai/codex-linux-x64":"npm:@openai/codex@0.144.3-linux-x64","@openai/codex-win32-arm64":"npm:@openai/codex@0.144.3-win32-arm64","@openai/codex-win32-x64":"npm:@openai/codex@0.144.3-win32-x64"},dependencies:{"@ai-sdk/anthropic":"^3.0.85","@ai-sdk/google":"^3.0.83","@ai-sdk/openai":"^3.0.73","@anthropic-ai/sdk":"^0.105.0","@aws-sdk/client-s3":"^3.1013.0","@aws-sdk/client-sts":"^3.1013.0","@aws-sdk/lib-storage":"^3.1013.0","@aws-sdk/s3-request-presigner":"^3.1013.0","@clickhouse/client":"^1.8.1","@dbos-inc/dbos-sdk":"^4.21.6","@dnd-kit/core":"^6.3.1","@dnd-kit/sortable":"^10.0.0","@dnd-kit/utilities":"^3.2.2","@inkjs/ui":"^2.0.0","@modelcontextprotocol/ext-apps":"^1.7.1","@nats-io/jetstream":"3.4.0","@nats-io/kv":"3.4.0","@nats-io/nats-core":"3.4.0","@nats-io/transport-node":"3.4.0","@openrouter/ai-sdk-provider":"^2.9.1","@opentelemetry/core":"^2.6.0","@tanstack/react-virtual":"3.13.24","@tiptap/extension-text-align":"3.20.2","@xterm/addon-fit":"^0.11.0","@xterm/xterm":"^6.0.0",echarts:"^5.6.0","embedded-postgres":"^18.3.0-beta.16",ink:"^6.8.0",kysely:"^0.28.12","node-pty":"^1.0.0","posthog-js":"^1.371.1","posthog-node":"^5.0.0",react:"^19.2.6","react-dom":"^19.2.6","use-stick-to-bottom":"^1.1.6"},devDependencies:{"@ai-sdk/provider":"^3.0.10","@ai-sdk/react":"^3.0.210","@better-auth/sso":"1.4.1","@daveyplate/better-auth-ui":"^3.2.7","@deco/ui":"workspace:*","@decocms/better-auth":"1.5.17","@decocms/bindings":"workspace:*","@decocms/harness":"workspace:*","@decocms/mcp-utils":"workspace:*","@decocms/mesh-sdk":"workspace:*","@decocms/runtime":"workspace:*","@decocms/sandbox":"workspace:*","@decocms/std":"workspace:*","@decocms/tunnel":"workspace:*","@floating-ui/react":"^0.27.16","@happy-dom/global-registrator":"^20.9.0","@hookform/resolvers":"^5.2.2","@jitl/quickjs-wasmfile-release-sync":"0.31.0","@modelcontextprotocol/sdk":"1.29.0","@monaco-editor/react":"^4.7.0","@nats-io/jwt":"0.0.10-5","@opentelemetry/api":"^1.9.0","@opentelemetry/api-logs":"^0.211.0","@opentelemetry/exporter-logs-otlp-proto":"^0.211.0","@opentelemetry/exporter-prometheus":"^0.208.0","@opentelemetry/exporter-trace-otlp-proto":"^0.207.0","@opentelemetry/instrumentation-runtime-node":"^0.24.0","@opentelemetry/resources":"^2.6.0","@opentelemetry/sdk-logs":"^0.211.0","@opentelemetry/sdk-metrics":"^2.2.0","@opentelemetry/sdk-node":"^0.207.0","@opentelemetry/sdk-trace-base":"^2.5.0","@playwright/experimental-ct-react":"1.59.1","@playwright/test":"^1.58.2","@radix-ui/react-avatar":"^1.1.10","@radix-ui/react-checkbox":"^1.3.3","@radix-ui/react-dialog":"^1.1.15","@radix-ui/react-dropdown-menu":"^2.1.16","@radix-ui/react-label":"^2.1.7","@radix-ui/react-select":"^2.2.6","@radix-ui/react-separator":"^1.1.7","@radix-ui/react-slot":"^1.2.3","@radix-ui/react-tabs":"^1.1.13","@rjsf/shadcn":"^6.6.2","@rjsf/utils":"^6.6.2","@rjsf/validator-ajv8":"^6.6.2","@tailwindcss/vite":"^4.1.17","@tanstack/react-query":"5.100.10","@tanstack/react-router":"1.169.2","@testing-library/jest-dom":"^6.9.1","@testing-library/react":"^16.3.2","@tiptap/core":"3.20.2","@tiptap/extension-placeholder":"3.20.2","@tiptap/pm":"3.20.2","@tiptap/react":"3.20.2","@tiptap/starter-kit":"3.20.2","@tiptap/suggestion":"3.20.2","@types/bun":"^1.3.1","@types/google.maps":"^3.65.2","@types/pg":"^8.15.6","@types/react-syntax-highlighter":"^15.5.13","@untitledui/icons":"^0.0.19","@vercel/nft":"^1.1.1","@vitejs/plugin-react":"^5.1.0",ai:"^6.0.208","babel-plugin-react-compiler":"^1.0.0","better-auth":"1.4.22","class-variance-authority":"^0.7.1",clsx:"^2.1.1",concurrently:"^9.2.1",croner:"^9.1.0","date-fns":"^4.1.0",degit:"^2.8.4",hono:"^4.10.7","input-otp":"^1.4.2",jose:"^6.0.11","lucide-react":"^0.468.0",marked:"^15.0.6",nanoid:"^5.1.6",pg:"^8.16.3",prettier:"^3.4.2","react-hook-form":"^7.66.0","react-markdown":"^10.1.0","react-resizable-panels":"^2.1.7","react-syntax-highlighter":"^15.6.1",recharts:"^3.6.0","rehype-raw":"^7.0.0","remark-gfm":"^4.0.0","sass-embedded":"^1.97.2",sonner:"^2.0.7","tailwind-merge":"^3.3.1",tailwindcss:"^4.1.17",typescript:"^5.9.3",vite:"^7.2.1","vite-tsconfig-paths":"^5.1.4",zod:"^4.0.0"},homepage:"https://github.com/decocms/studio",keywords:["mcp","model-context-protocol","ai","gateway","self-hosted","mesh","tools"],license:"MIT",publishConfig:{access:"public"}}});function O64(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??B64}}var KC$,B64="https://ph.studio.decocms.com",UC$;var wC$=O(()=>{F6();sb0();nN();BG();F8();$01();JC$();KC$=new b1;KC$.get("/",($)=>{let Z={version:WC$.version,theme:Lb1(),...rO().logo&&{logo:rO().logo},...yQ()&&{internalUrl:$00()},...O1().enableDecoImport&&{enableDecoImport:!0},brandExtractEnabled:!!O1().firecrawlApiKey,auth:VI$(),posthog:O64(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:!yQ()&&O1().sandboxProviderKind==="agent-sandbox"}};return $.header("Cache-Control","no-store"),$.json({success:!0,config:Z})});UC$=KC$});function gL0($){let Z=($??"").trim().toLowerCase();return Z=Z.replace(/^https?:\/\//,""),Z=Z.replace(/^www\./,""),Z=Z.split(/[/?#]/)[0]??"",Z.replace(/\/+$/,"")}function HC$($){return(gL0($).split(".")[0]||$).replace(/[-_]/g," ").split(" ").filter(Boolean).map((G)=>G.charAt(0).toUpperCase()+G.slice(1)).join(" ")}function NC$($,Z=64){return`https://www.google.com/s2/favicons?domain=${encodeURIComponent(gL0($))}&sz=${Z}`}function FC$($,Z){let G=$.trim();if(G.length<=Z)return G;let X=G.slice(0,Z-1),Y=X.lastIndexOf(" ");return`${(Y>Z*0.6?X.slice(0,Y):X).trimEnd()}\u2026`}function BC$($){let{brand:Z,domain:G,score:X,verdict:Y}=$,Q=typeof X==="number"?`${Z} commerce report \u2014 ${Math.round(X)}/100 \xB7 decocms`:`${Z} commerce report \xB7 decocms`,J=`See the full ${Z} scorecard \u2014 SEO, performance, conversion & AEO signals scored by decocms.`,W=Y?.trim()?FC$(`${Y.trim().replace(/\s+/g," ")} \u2014 ${J}`,200):FC$(`How does ${G} really perform? ${J}`,200);return{title:Q,description:W}}import{join as D64}from"path";function vw($){return $.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function E64($){let Z=gL0($),G=HC$(Z),X=NC$(Z,128),Q=`${(O1().baseUrl??"https://studio.decocms.com").replace(/\/+$/,"")}/report/${encodeURIComponent(Z)}`,{title:J,description:W}=BC$({brand:G,domain:Z});return[`<title>${vw(J)}</title>`,`<meta name="description" content="${vw(W)}" />`,'<meta name="robots" content="noindex, follow" />','<meta property="og:type" content="website" />','<meta property="og:site_name" content="decocms" />',`<meta property="og:title" content="${vw(J)}" />`,`<meta property="og:description" content="${vw(W)}" />`,`<meta property="og:url" content="${vw(Q)}" />`,'<meta name="twitter:card" content="summary" />',`<meta name="twitter:title" content="${vw(J)}" />`,`<meta name="twitter:description" content="${vw(W)}" />`,`<link rel="canonical" href="${vw(Q)}" />`,`<link rel="icon" href="${vw(X)}" sizes="any" />`].join(`
     `)}function L64($,Z){return $.replace(/<title>[\s\S]*?<\/title>\s*/i,"").replace(/<meta\s+name="(?:description|twitter:[^"]*)"[^>]*>\s*/gi,"").replace(/<meta\s+property="og:[^"]*"[^>]*>\s*/gi,"").replace(/<link\s+rel="icon"[^>]*>\s*/gi,"").replace("</head>",`    ${Z}
-  </head>`)}function OC$($){let Z=new b1;return Z.get("/:domain",async(G)=>{let X=G.req.param("domain"),Y=$?D64($,"index.html"):null,Q=Y?Bun.file(Y):null;if(!Q||!await Q.exists())return G.notFound();let J=await Q.text();try{let W=E64(X);return G.html(L64(J,W),200,{"Cache-Control":"public, max-age=0, s-maxage=300"})}catch{return G.html(J)}}),Z}var DC$=O(()=>{F6();F8()});import{z as Q1}from"zod";var PC,z64,j64,P64,A64,EC$;var LC$=O(()=>{PC=Q1.enum(["good","bad","neutral"]),z64=Q1.preprocess(($)=>{if(Array.isArray($))return{kind:"text",value:$.find((G)=>G!==null&&typeof G!=="object")??""};return $!==null&&typeof $==="object"?$:{kind:"text",value:$}},Q1.object({kind:Q1.enum(["text","number","sparkline","badge","score"]).catch("text"),value:Q1.coerce.string().optional(),tone:PC.optional(),muted:Q1.boolean().optional(),delta:Q1.coerce.string().optional(),deltaDir:Q1.enum(["up","down","neutral"]).optional(),points:Q1.array(Q1.coerce.number()).optional(),label:Q1.coerce.string().optional()}).transform(($)=>{if($.kind==="badge"&&$.label==null)$.label=$.value??"";if($.kind==="score"){let Z=Number($.value);if(Number.isNaN(Z))return{...$,kind:"text"}}return $})),j64=Q1.preprocess(($)=>{let Z=$;if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&Array.isArray(Z.cells))Z=Z.cells;if(Array.isArray(Z)&&Z.length===1&&Array.isArray(Z[0]))Z=Z[0];if(Array.isArray(Z))return Z;if(Z&&typeof Z==="object")return Object.values(Z);return Z},Q1.array(z64)),P64={key:Q1.coerce.string(),title:Q1.coerce.string(),eyebrow:Q1.coerce.string().optional(),headline:Q1.coerce.string(),annotation:Q1.coerce.string().optional(),methodology:Q1.coerce.string().optional(),sources:Q1.array(Q1.object({name:Q1.coerce.string(),logoUrl:Q1.coerce.string()})).optional()},A64=Q1.discriminatedUnion("template",[Q1.object({template:Q1.literal("cover"),score:Q1.object({value:Q1.coerce.number(),max:Q1.coerce.number().optional(),grade:Q1.coerce.string().optional(),label:Q1.coerce.string().optional()}).optional(),brandImage:Q1.coerce.string().optional(),screenshot:Q1.coerce.string().optional(),mobileScreenshot:Q1.coerce.string().optional()}),Q1.object({template:Q1.literal("cta"),ctaUrl:Q1.coerce.string().optional(),ctaLabel:Q1.coerce.string().optional(),bullets:Q1.array(Q1.coerce.string()).optional()}),Q1.object({template:Q1.literal("series"),points:Q1.array(Q1.coerce.number()).min(2),xLabels:Q1.array(Q1.coerce.string()).min(1),unit:Q1.coerce.string().optional(),callout:Q1.object({index:Q1.coerce.number(),value:Q1.coerce.string(),tone:PC.optional()})}),Q1.object({template:Q1.literal("threshold"),value:Q1.coerce.string().default(""),metricLabel:Q1.coerce.string().optional(),ratio:Q1.coerce.number(),thresholdRatio:Q1.coerce.number().optional(),thresholdLabel:Q1.coerce.string().default(""),tone:PC.optional()}),Q1.object({template:Q1.literal("stats"),stats:Q1.array(Q1.object({value:Q1.coerce.string(),label:Q1.coerce.string(),tone:PC.optional()})).min(1)}),Q1.object({template:Q1.literal("bars"),items:Q1.array(Q1.object({value:Q1.coerce.string(),label:Q1.coerce.string(),ratio:Q1.coerce.number(),tone:PC.optional()})).min(1)}),Q1.object({template:Q1.literal("gauges"),gauges:Q1.array(Q1.object({label:Q1.coerce.string(),value:Q1.coerce.string(),status:Q1.enum(["good","warn","bad"]).catch("warn"),caption:Q1.coerce.string().optional(),ratio:Q1.coerce.number().optional()})).min(1)}),Q1.object({template:Q1.literal("checklist"),checks:Q1.array(Q1.object({label:Q1.coerce.string(),status:Q1.enum(["pass","fail","warn"]).catch("fail"),value:Q1.coerce.string().optional()})).min(1)}),Q1.object({template:Q1.literal("table"),columns:Q1.array(Q1.object({label:Q1.coerce.string(),align:Q1.enum(["left","right"]).optional()})).min(1),rows:Q1.array(j64).min(1),highlightRow:Q1.coerce.number().optional()}),Q1.object({template:Q1.literal("products"),products:Q1.array(Q1.object({name:Q1.coerce.string(),price:Q1.coerce.string().optional(),image:Q1.coerce.string().optional(),url:Q1.coerce.string().optional()})).min(1)}),Q1.object({template:Q1.literal("list"),entries:Q1.array(Q1.object({label:Q1.coerce.string(),severity:Q1.enum(["error","warning","notice"]).catch("notice")})).min(1),moreCount:Q1.coerce.number().optional()}),Q1.object({template:Q1.literal("keywords"),volumeLabel:Q1.coerce.string().optional(),keywords:Q1.array(Q1.object({term:Q1.coerce.string(),volume:Q1.coerce.string(),position:Q1.coerce.number().catch(0)})).min(1)}),Q1.object({template:Q1.literal("competitor"),metricLabel:Q1.coerce.string().optional(),competitors:Q1.array(Q1.object({name:Q1.coerce.string(),value:Q1.coerce.string(),tone:PC.optional(),isYou:Q1.boolean().optional()})).min(1)}),Q1.object({template:Q1.literal("scorecard"),rivalLabel:Q1.coerce.string().optional(),dimensions:Q1.array(Q1.object({label:Q1.coerce.string(),you:Q1.coerce.string(),rival:Q1.coerce.string().optional(),rivalName:Q1.coerce.string().optional(),tone:PC.optional()})).min(1)})]),EC$=Q1.object({...P64,template:A64})});function zC$($){let Z=[],G=[...$.sections].sort((X,Y)=>X.position-Y.position).map((X)=>{let Y=EC$.safeParse(X.props);if(Y.success)return Y.data;let Q=Y.error.issues[0];return Z.push({section_type:X.section_type,position:X.position,reason:Q?`${Q.path.join(".")||"(root)"}: ${Q.message}`:"contract violation"}),null}).filter((X)=>X!==null);return{deck:{meta:{...$.meta,scores:$.summary?.scores},slides:G},drops:Z}}var jC$=O(()=>{LC$()});function Kr($,Z){return fetch(`${UD({})}${$}`,Z)}async function T64($,Z){let G=await Kr(`/api/v2/public/diagnostics/${encodeURIComponent($)}`+(Z?`?pw=${encodeURIComponent(Z)}`:""),{headers:{Accept:"application/json"}});if(G.status===404)return{status:"not_found",deck:null,scanned_at:null,drops:[]};if(!G.ok)throw Error(`report read HTTP ${G.status}`);let X=await G.json(),{deck:Y,drops:Q}=zC$(X);return{status:Y.slides.length?"ready":"empty",deck:Y,scanned_at:X.scanned_at,drops:Q}}var I64,AC,PC$;var AC$=O(()=>{F6();wJ();Jf();jC$();I64=new Set(["complete","errored","terminated","unknown"]),AC=new b1;AC.use("*",async($,Z)=>{let G=await d8.api.getSession({headers:$.req.raw.headers});if(!G?.user?.id)return $.json({error:"Authentication required"},401,{"Cache-Control":"private, no-store",Vary:"Cookie"});$.set("reportUser",{email:G.user.email}),await Z(),$.header("Cache-Control","private, no-store"),$.header("Vary","Cookie");return});AC.get("/site/:domain",async($)=>{let Z=$.req.param("domain").trim();if(!Z)return $.json({error:"domain is required"},400);let G=$.req.query("key")?.trim()||void 0;try{let X=await T64(Z,G);return $.header("Cache-Control","private, no-store"),$.json(X)}catch{return $.json({error:"report read failed"},502)}});AC.post("/run",async($)=>{let Z;try{Z=await $.req.json()}catch{return $.json({error:"invalid JSON"},400)}let G=typeof Z.domain==="string"?Z.domain.trim():"";if(!G)return $.json({error:"domain is required"},400);let X=$.get("reportUser").email,Y=typeof Z.distinctId==="string"&&Z.distinctId.trim()&&Z.distinctId.length<=200?Z.distinctId.trim():void 0;try{let Q=await Kr("/api/v2/diagnostics/run",{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${wD({})}`},body:JSON.stringify({url:G,email:X,distinct_id:Y})});if(!Q.ok)return $.json({error:`run HTTP ${Q.status}`},502);let J=await Q.json(),W=J.blocked?{state:"blocked"}:J.status==="fresh"?{state:"fresh"}:J.mode==="sync"?{state:"sync"}:{state:"running",id:J.id??null};return $.json(W)}catch{return $.json({error:"run failed"},502)}});AC.get("/status",async($)=>{let Z=$.req.query("id");if(!Z)return $.json({error:"id is required"},400);try{let G=await Kr(`/api/v2/diagnostics/status?id=${encodeURIComponent(Z)}`,{headers:{Authorization:`Bearer ${wD({})}`}});if(!G.ok)return $.json({error:`status HTTP ${G.status}`},502);let Y=(await G.json()).status??"unknown",Q={done:I64.has(Y),status:Y};return $.json(Q)}catch{return $.json({error:"status failed"},502)}});AC.get("/link-token/:id",async($)=>{let Z=$.req.param("id");try{let G=await Kr(`/api/v2/public/link-tokens/${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(G.status===404)return $.json(null);if(!G.ok)return $.json({error:`link token HTTP ${G.status}`},502);return $.json(await G.json())}catch{return $.json({error:"link token resolve failed"},502)}});AC.get("/suggest",async($)=>{let Z=($.req.query("q")??"").trim().slice(0,64);if(Z.length<2)return $.json({suggestions:[]});try{let G=await Kr(`/api/v2/public/suggest?q=${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(!G.ok)return $.json({suggestions:[]});let X=await G.json();return $.json({suggestions:Array.isArray(X.suggestions)?X.suggestions:[]})}catch{return $.json({suggestions:[]})}});PC$=AC});function TC$($,Z){if(Z.startsWith("text/html")||Z.startsWith("image/svg"))$.set("Content-Security-Policy","sandbox allow-scripts allow-modals allow-same-origin")}var IC$,R64,q64,RC$;var qC$=O(()=>{F6();f3();ev();bb();IC$=new b1,R64=["range","if-none-match","if-modified-since"],q64=["content-type","content-length","content-range","accept-ranges","etag","last-modified"];IC$.get("/:org/files/*",async($)=>{let Z=$.get("studioContext"),G=Z.organization?.id;if(!Z.auth?.user?.id){if(wg($))return $.redirect(`/login?next=${encodeURIComponent($.req.path)}`,302);throw new P$(401,{message:"Authentication required"})}if(!G)throw new P$(401,{message:"Organization context required"});let X=$.req.path.replace(/^.*\/files\//,"");if(!X)throw new P$(400,{message:"Missing file key"});let Y=await Qp(X,Z);if(!Y)throw new P$(503,{message:"Object storage not configured"});if(Y.startsWith("data:")&&b3()){let K=Y.match(/^data:([^;]+);base64,(.+)$/s);if(!K)throw new P$(500,{message:"Invalid data URL from storage"});let[,U,w]=K,F=Buffer.from(w,"base64"),H=new Headers({"Content-Type":U,"Cache-Control":"private, max-age=86400"});return TC$(H,U),new Response(F,{status:200,headers:H})}let Q=new Headers;for(let K of R64){let U=$.req.header(K);if(U)Q.set(K,U)}let J=await fetch(Y,{headers:Q});if(J.status===403||J.status===404)throw new P$(404,{message:"File not found"});if(!J.ok&&J.status!==304&&J.status!==416)throw console.error(`[files] upstream storage error ${J.status} for key:`,X),new P$(502,{message:"Upstream storage error"});let W=new Headers;for(let K of q64){let U=J.headers.get(K);if(U)W.set(K,U)}return W.set("Cache-Control","private, max-age=86400"),TC$(W,W.get("content-type")??""),new Response(J.body,{status:J.status,headers:W})});RC$=IC$});var Ur=_((TC)=>{var M64=TC&&TC.__createBinding||(Object.create?function($,Z,G,X){if(X===void 0)X=G;var Y=Object.getOwnPropertyDescriptor(Z,G);if(!Y||("get"in Y?!Z.__esModule:Y.writable||Y.configurable))Y={enumerable:!0,get:function(){return Z[G]}};Object.defineProperty($,X,Y)}:function($,Z,G,X){if(X===void 0)X=G;$[X]=Z[G]}),k64=TC&&TC.__exportStar||function($,Z){for(var G in $)if(G!=="default"&&!Object.prototype.hasOwnProperty.call(Z,G))M64(Z,$,G)};Object.defineProperty(TC,"__esModule",{value:!0});k64(rX(),TC)});var SC$=_((MC$)=>{Object.defineProperty(MC$,"__esModule",{value:!0});MC$.version=void 0;MC$.version="3.4.0"});var _C$=_((jK)=>{var S64=jK&&jK.__importDefault||function($){return $&&$.__esModule?$:{default:$}};Object.defineProperty(jK,"__esModule",{value:!0});jK.NodeTransport=jK.VERSION=void 0;jK.nodeResolveHost=x64;var n4=Ur(),V64=c0("net"),a$1=c0("tls"),C64=c0("path"),VC$=c0("fs"),_64=S64(c0("dns")),b64=SC$();jK.VERSION=b64.version;var f64="nats.js";class CC${socket;version;lang;yields=[];signal=(0,n4.deferred)();closedNotification=(0,n4.deferred)();options;connected=!1;tlsName="";done=!1;closeError;constructor(){this.lang=f64,this.version=jK.VERSION}async connect($,Z){this.tlsName=$.tlsName,this.options=Z;let{tls:G}=this.options,{handshakeFirst:X}=G||{};try{if(X===!0)this.socket=await this.tlsFirst($);else this.socket=await this.dial($);if(this.done)this.socket?.destroy();let Y=await this.peekInfo();(0,n4.checkOptions)(Y,Z);let{tls_required:Q,tls_available:J}=Y,W=J===!0&&Z.tls!==null;if(!X&&(Q||W))this.socket=await this.startTLS();if(this.done)this.socket?.destroy();if(Q&&this.socket.encrypted!==!0)throw n4.errors.InvalidArgumentError.format("tls","is not available on this server");return this.connected=!0,this.setupHandlers(),this.signal.resolve(),Promise.resolve()}catch(Y){let Q=Y;if(!Q)Q=new n4.errors.ConnectionError("error connecting - node provided an undefined error");let{code:J}=Q,W=J==="ECONNREFUSED"?new n4.errors.ConnectionError("connection refused",{cause:Q}):Q;throw this.socket?.destroy(),W}}dial($){let Z=(0,n4.deferred)(),G,X=(0,V64.createConnection)($.port,$.hostname,()=>{Z.resolve(X),X.removeAllListeners()});return X.on("error",(Y)=>{G=Y}),X.on("close",()=>{X.removeAllListeners(),Z.reject(G)}),X.setNoDelay(!0),Z}get isClosed(){return this.done}close($){return this._closed($,!1)}peekInfo(){let $=(0,n4.deferred)(),Z;return this.socket.on("data",(G)=>{this.yields.push(G);let X=n4.DataBuffer.concat(...this.yields),Y=(0,n4.extractProtocolMessage)(X);if(Y!=="")try{let Q=n4.INFO.exec(Y);if(!Q)throw Error("unexpected response from server");let J=JSON.parse(Q[1]);$.resolve(J)}catch(Q){$.reject(Q)}finally{this.socket.removeAllListeners()}}),this.socket.on("error",(G)=>{Z=G}),this.socket.on("close",()=>{this.socket.removeAllListeners(),$.reject(Z)}),$}loadFile($){if(!$)return Promise.resolve();let Z=(0,n4.deferred)();try{if($=(0,C64.resolve)($),!(0,VC$.existsSync)($))Z.reject(Error(`${$} doesn't exist`));(0,VC$.readFile)($,(G,X)=>{if(G)return Z.reject(G);Z.resolve(X)})}catch(G){Z.reject(G)}return Z}async loadClientCerts(){let $={},{certFile:Z,cert:G,caFile:X,ca:Y,keyFile:Q,key:J}=this.options.tls;try{if(Z){let W=await this.loadFile(Z);if(W)$.cert=W}else if(G)$.cert=G;if(Q){let W=await this.loadFile(Q);if(W)$.key=W}else if(J)$.key=J;if(X){let W=await this.loadFile(X);if(W)$.ca=[W]}else if(Y)$.ca=Y;return Promise.resolve($)}catch(W){return Promise.reject(W)}}async tlsFirst($){let Z,G={servername:this.tlsName,rejectUnauthorized:!0};if(this.socket)G.socket=this.socket;if(typeof this.options.tls==="object")try{let Y=await this.loadClientCerts()||{};G=(0,n4.extend)(G,this.options.tls,Y)}catch(Y){return Promise.reject(new n4.errors.ConnectionError(Y.message,{cause:Y}))}let X=(0,n4.deferred)();try{let Y=(0,a$1.connect)($.port,$.hostname,G,()=>{Y.removeAllListeners(),X.resolve(Y)});Y.on("error",(Q)=>{Z=Q}),Y.on("secureConnect",()=>{if(G.rejectUnauthorized===!1)return;if(!Y.authorized)throw Y.authorizationError}),Y.on("close",()=>{X.reject(Z),Y.removeAllListeners()}),Y.setNoDelay(!0)}catch(Y){X.reject(new n4.errors.ConnectionError(Y.message,{cause:Y}))}return X}async startTLS(){let $,Z={socket:this.socket,servername:this.tlsName,rejectUnauthorized:!0};if(typeof this.options.tls==="object")try{let X=await this.loadClientCerts()||{};Z=(0,n4.extend)(Z,this.options.tls,X)}catch(X){return Promise.reject(new n4.errors.ConnectionError(X.message,{cause:X}))}let G=(0,n4.deferred)();try{let X=(0,a$1.connect)(Z,()=>{X.removeAllListeners(),G.resolve(X)});X.on("error",(Y)=>{$=Y}),X.on("secureConnect",()=>{if(Z.rejectUnauthorized===!1)return;if(!X.authorized)throw X.authorizationError}),X.on("close",()=>{G.reject($),X.removeAllListeners()})}catch(X){G.reject(new n4.errors.ConnectionError(X.message,{cause:X}))}return G}setupHandlers(){let $;this.socket.on("data",(Z)=>{return this.yields.push(Z),this.signal.resolve()}),this.socket.on("error",(Z)=>{$=Z}),this.socket.on("end",()=>{if(this.socket?.destroyed)return;this.socket?.write(new Uint8Array(0),()=>{this.socket?.end()})}),this.socket.on("close",()=>{this._closed($,!1)})}[Symbol.asyncIterator](){return this.iterate()}async*iterate(){while(!0){if(this.yields.length===0)await this.signal;let $=this.yields;this.yields=[];for(let Z=0;Z<$.length;Z++){if(this.options.debug)console.info(`> ${(0,n4.render)($[Z])}`);yield $[Z]}if(this.done)break;else if(this.yields.length===0)$.length=0,this.yields=$,this.signal=(0,n4.deferred)()}}discard(){if(this.done=!0,this.socket)try{this.socket.removeAllListeners(),this.socket.destroy()}catch{}}disconnect(){this._closed(void 0,!0).then().catch()}isEncrypted(){return this.socket instanceof a$1.TLSSocket}_send($){if(this.isClosed||this.socket===void 0)return Promise.resolve();if(this.options.debug)console.info(`< ${(0,n4.render)($)}`);let Z=(0,n4.deferred)();try{this.socket.write($,(G)=>{if(G){if(this.options.debug)console.error(`!!! ${(0,n4.render)($)}: ${G}`);return Z.reject(G)}return Z.resolve()})}catch(G){if(this.options.debug)console.error(`!!! ${(0,n4.render)($)}: ${G}`);Z.reject(G)}return Z}send($){this._send($).catch((G)=>{})}async _closed($,Z=!0){if(!this.connected)return;if(this.done){this.socket?.destroy();return}if(this.closeError=$,!$&&this.socket&&Z)try{await this._send(new TextEncoder().encode(""))}catch(G){if(this.options.debug)console.log("transport close terminated with an error",G)}try{if(this.socket)this.socket.removeAllListeners(),this.socket?.destroy(),this.socket=void 0}catch(G){console.log(G)}this.done=!0,this.closedNotification.resolve(this.closeError)}closed(){return this.closedNotification}}jK.NodeTransport=CC$;function x64($){let Z=(0,n4.deferred)();return _64.default.lookup($,{all:!0},(G,X)=>{if(G){Z.reject(G);return}let Y=[];for(let Q of X)Y.push(Q.address);if(Y.length===0)Y.push($);Z.resolve(Y)}),Z}});var yC$=_((vC$)=>{Object.defineProperty(vC$,"__esModule",{value:!0});vC$.connect=v64;var bC$=_C$(),fC$=Ur(),xC$=Ur();function v64($={}){if((0,xC$.hasWsProtocol)($))return Promise.reject(xC$.errors.InvalidArgumentError.format("servers","node client doesn't support websockets, use the 'wsconnect' function instead"));return(0,fC$.setTransportFactory)({factory:()=>{return new bC$.NodeTransport},dnsResolveFn:bC$.nodeResolveHost}),fC$.NatsConnectionImpl.connect($)}});var gC$=_((yw)=>{var g64=yw&&yw.__createBinding||(Object.create?function($,Z,G,X){if(X===void 0)X=G;var Y=Object.getOwnPropertyDescriptor(Z,G);if(!Y||("get"in Y?!Z.__esModule:Y.writable||Y.configurable))Y={enumerable:!0,get:function(){return Z[G]}};Object.defineProperty($,X,Y)}:function($,Z,G,X){if(X===void 0)X=G;$[X]=Z[G]}),h64=yw&&yw.__exportStar||function($,Z){for(var G in $)if(G!=="default"&&!Object.prototype.hasOwnProperty.call(Z,G))g64(Z,$,G)};Object.defineProperty(yw,"__esModule",{value:!0});yw.connect=void 0;var c64=yC$();Object.defineProperty(yw,"connect",{enumerable:!0,get:function(){return c64.connect}});h64(Ur(),yw)});function dC$($){let Z=$?.connectFn??m64,G=null,X=null,Y=!1,Q=!1,J=!1,W=[];function K(){return G!==null&&!G.isClosed()&&!G.isDraining()&&!J}function U(){console.log(`[NatsProvider] fireReady: ${W.length} callbacks`);for(let H of W)try{H()}catch{}}function w(H){(async()=>{for await(let N of H.status())if(N.type==="disconnect")console.log("[NatsProvider] Disconnected"),J=!0;else if(N.type==="reconnect")console.log("[NatsProvider] Reconnected, re-firing ready callbacks"),J=!1,X=null,U()})().catch(()=>{})}async function F(H,N){let B=0;while(!Q)try{G=await Z({servers:H,timeout:l64,reconnect:!0,maxReconnectAttempts:-1,...N?{authenticator:N}:{}}),console.log(`[NatsProvider] Connected to ${G.getServer()} after ${B} attempt(s)`),X=null,J=!1,w(G),U();return}catch{B++;let D=mX(d64,u64,B-1,2,0.5);await O8(D)}}return{init(H,N){if(Y)return;Y=!0,Q=!1;let B=N?.creds?hC$.credsAuthenticator(new TextEncoder().encode(N.creds)):void 0;F(H,B).catch(()=>{})},isConnected(){return K()},getConnection(){return K()?G:null},getJetStream(){if(!K())return null;if(!X)X=uC$.jetstream(G);return X},onReady(H){if(W.push(H),K())try{H()}catch{}},async drain(){if(Q=!0,Y=!1,X=null,J=!1,G){let H=G;G=null,await H.drain().catch(()=>{})}}}}function m64($){return cC$.connect($)}var hC$,cC$,uC$,u64=100,d64=3000,l64=3000;var lC$=O(()=>{l5();hC$=k(Qh(),1),cC$=k(gC$(),1),uC$=k(cB(),1)});function _g($){let Z=$?.ttlMs??60000,G=$?.maxSize??1e4,X=$?.updateRecencyOnGet??!1,Y=new Map;function Q(){if(Y.size<=G)return;let J=Date.now();for(let[W,K]of Y)if(K.expiresAt<=J)Y.delete(W);while(Y.size>G){let W=Y.keys().next().value;if(W===void 0)break;Y.delete(W)}}return{get(J){let W=Y.get(J);if(!W)return;if(W.expiresAt<=Date.now()){Y.delete(J);return}if(X)Y.delete(J),Y.set(J,W);return W.value},set(J,W){Y.delete(J),Y.set(J,{value:W,expiresAt:Date.now()+Z}),Q()},delete(J){Y.delete(J)},clear(){Y.clear()},size(){return Y.size}}}function s$1($,Z){return`${$}.${Z}`}class e$1{cache;constructor($){this.cache=_g({ttlMs:$?.ttlMs??i64,maxSize:$?.maxSize??n64})}async get($,Z){return this.cache.get(s$1($,Z))??null}async set($,Z,G){this.cache.set(s$1($,Z),G)}async invalidate($,Z){this.cache.delete(s$1($,Z))}teardown(){this.cache.clear()}}var i64=600000,n64=5000;var mC$=()=>{};function hL0($,Z){return`${$}:${Z}`}function $81($){let Z=_g({ttlMs:$?.ttlMs??p64,maxSize:$?.maxSize??t64}),G=$?.getConnection,X=crypto.randomUUID(),Y=new TextEncoder,Q=new TextDecoder,J=null;function W(K,U){let w=G?.();if(!w)return;try{w.publish(iC$,Y.encode(JSON.stringify({organizationId:K,keyId:U,originId:X})))}catch(F){console.warn("[ProviderKeyCache] Publish failed (non-critical):",F)}}return{get(K,U){return Z.get(hL0(K,U))},set(K,U,w){Z.set(hL0(K,U),w)},invalidate(K,U){Z.delete(hL0(K,U)),W(K,U)},start(){if(J)return;let K=G?.();if(!K)return;J=K.subscribe(iC$),(async()=>{for await(let U of J)try{let w=JSON.parse(Q.decode(U.data));if(w.originId===X)continue;Z.delete(hL0(w.organizationId,w.keyId))}catch{}})().catch(console.error)},teardown(){J?.unsubscribe(),J=null,Z.clear()}}}var iC$="studio.ai-provider-keys.invalidate",p64=30000,t64=5000;var nC$=()=>{};class Z81{options;sub=null;onCancel=null;encoder=new TextEncoder;originId=crypto.randomUUID();constructor($){this.options=$}async start($){if($)this.onCancel=$;if(this.sub)return;if(!this.onCancel)return;let Z=this.options.getConnection();if(!Z)return;this.sub=Z.subscribe("mesh.decopilot.cancel");let G=new TextDecoder;(async()=>{for await(let X of this.sub)try{let Y=JSON.parse(G.decode(X.data));if(Y.originId===this.originId)continue;this.onCancel?.(Y.taskId)}catch{}})().catch(console.error)}broadcast($){if(/[.*>\s]/.test($)){console.warn("[NatsCancelBroadcast] Invalid threadId, skipping broadcast");return}this.onCancel?.($);try{let Z=this.options.getConnection();if(!Z)return;Z.publish("mesh.decopilot.cancel",this.encoder.encode(JSON.stringify({taskId:$,originId:this.originId})))}catch(Z){console.warn("[NatsCancelBroadcast] Publish failed (non-critical):",Z)}}publishControlFrame($,Z){}async stop(){this.sub?.unsubscribe(),this.sub=null,this.onCancel=null}}var pC$=($)=>{let Z;return()=>Z??=$()},G81,X81;var tC$=O(()=>{B5();G81=pC$(()=>D8.createHistogram("decopilot.stream.encode_ms",{description:"Per-chunk JSON.stringify+encode time for decopilot stream",unit:"ms"})),X81=pC$(()=>D8.createCounter("decopilot.stream.published_chunks",{description:"Logical decopilot stream chunks published to JetStream",unit:"{chunks}"}))});function Z44(){return{name:rU,subjects:[`${Xm0}.>`],storage:bJ.StorageType.File,max_age:a64,max_bytes:e64,max_msgs_per_subject:$44,discard:bJ.DiscardPolicy.Old,retention:bJ.RetentionPolicy.Limits,duplicate_window:s64,num_replicas:1}}class aC${chunks=0;encodeMs=0;maxMs=0;bytes=0;windowStart=performance.now();constructor(){setInterval(()=>this.flush(),1e4).unref?.()}record($,Z){if(this.chunks++,this.encodeMs+=$,$>this.maxMs)this.maxMs=$;this.bytes+=Z}flush(){let $=performance.now(),Z=$-this.windowStart;if(this.chunks>0&&Z>0)console.warn(JSON.stringify({msg:"stream-encode-trace",windowMs:Math.round(Z),chunks:this.chunks,encodeMs:Math.round(this.encodeMs),pctOfLoop:+(this.encodeMs/Z*100).toFixed(1),maxChunkMs:+this.maxMs.toFixed(2),mbEncoded:+(this.bytes/1048576).toFixed(2)}));this.chunks=0,this.encodeMs=0,this.maxMs=0,this.bytes=0,this.windowStart=$}}function rC$($){let Z=oC$.headers();for(let[G,X]of Object.entries($))Z.set(G,X);return Z}function Q44($,Z){let G=0;return{publish(X,Y,Q,J){X.publish(Y,Q,J?{headers:J}:void 0).catch((W)=>{if(G++,o64().add(1,{"org.id":Z??"unknown"}),G===1||G%100===0)console.warn(`[Decopilot] JetStream publish failed for thread ${$} (${G} total):`,W)})},get errorCount(){return G}}}class Y81{options;js=null;jsm=null;constructor($){this.options=$}async init(){let $=this.options.getConnection();if(!$){console.log("[Decopilot] StreamBuffer.init skipped: NATS not connected yet");return}let Z=this.options.getJetStreamManager?await this.options.getJetStreamManager():await bJ.jetstreamManager($),G=Z44();try{await Z.streams.info(rU),await Z.streams.update(rU,G)}catch(X){if(X instanceof Error&&X.message.includes("stream not found"))await Z.streams.add(G);else if(X instanceof Error&&/can ?not change.*storage|storage type/i.test(X.message))await Z.streams.delete(rU),await Z.streams.add(G);else throw X}this.js=this.options.getJetStream(),this.jsm=Z,console.log(`[Decopilot] StreamBuffer.init ${this.js?"ready":"degraded (js=null)"}`)}pump($,Z,G,X){let Y=this.js;if(!Y)return console.warn(`[Decopilot] pump: JetStream client unavailable for thread ${Z}; chunks NOT published to NATS`),Promise.resolve();let Q=Q44(Z,X),J=!1,W=()=>{if(J)return;J=!0;let U=W4$(Z);Y.publish(U.subject,U.data).catch(()=>{})};G.addEventListener("abort",W,{once:!0});let K=(U)=>{let w=performance.now(),F=Qm0(U,{runId:Z}),H=performance.now()-w;if(G81().record(H),X81().add(1,{"org.id":X??"unknown"}),Y44?.record(H,F.reduce((N,B)=>N+B.data.length,0)),F.length===0){console.warn(`[Decopilot] dropping oversized stream chunk for thread ${Z}`);return}for(let N of F)Q.publish(Y,N.subject,N.data,N.headers?rC$(N.headers):void 0)};return(async()=>{let U=$.getReader(),w=0,F=0,H;try{while(!0){let{done:N,value:B}=await U.read();if(N)break;if(K(B),F++,++w>=64)w=0,await new Promise((D)=>setImmediate(D))}}catch(N){H=N,console.warn(`[Decopilot] stream pump error for thread ${Z}:`,N?.message??N)}finally{if(U.releaseLock(),W(),X44)console.warn(JSON.stringify({msg:"decopilot-stream-diag",event:"pump-done",taskId:Z,publishedChunks:F,publishErrors:Q.errorCount}))}if(H!==void 0)throw H})()}async publishRawChunk($,Z,G){let X=this.js;if(!X)return!1;let Y=performance.now(),Q=Qm0(Z,{runId:$,dedup:G});if(G81().record(performance.now()-Y),X81().add(1),Q.length===0)return console.warn(`[Decopilot] dropping oversized raw chunk for thread ${$} (> MAX_CHUNKED_BYTES)`),!0;for(let J of Q)await X.publish(J.subject,J.data,{...J.headers?{headers:rC$(J.headers)}:{},...J.msgId?{msgID:J.msgId}:{}});return!0}async publishDone($,Z,G){let X=this.js;if(!X)return!1;let Y=J4$({runId:$,fenceToken:Z,finalSeq:G});return await X.publish(Y.subject,Y.data,{msgID:Y.msgId}),!0}async createTailStream($,Z,G){let X=this.js;if(!X)return console.warn(`[Decopilot] createTailStream: JetStream client unavailable for thread ${$}; no live tail`),null;let Y=G?.deliverPolicy==="new"?bJ.DeliverPolicy.New:bJ.DeliverPolicy.All,Q=G?.closeOnDone??!1,J=zN($),W;try{W=await(await X.consumers.get(rU,{filter_subjects:J,deliver_policy:Y})).consume()}catch(D){return console.warn("[Decopilot] JetStream tail unavailable (non-critical):",D?.message??D),null}let w=w90({messages:async function*(){try{for await(let D of W)yield{subject:D.subject,data:D.data,headers:D.headers}}finally{W.stop()}}(),onCancel:()=>W.stop()}).pipeThrough(W90()).pipeThrough(K90()).getReader(),F=!1,H=()=>{if(F)return;F=!0;try{w.releaseLock()}catch{}},N=!1,B=()=>{if(N)return;N=!0,W.stop(),w.cancel().catch(()=>{}),H()};return Z?.addEventListener("abort",B,{once:!0}),new ReadableStream({async pull(D){for(;;){let{done:E,value:L}=await w.read();if(E){B(),D.close();return}let z=L;if(z.kind==="done"){if(Q){B(),D.close();return}continue}D.enqueue(z.chunk);return}},cancel(){B()}})}purge($){if(!this.jsm)return;this.jsm.streams.purge(rU,{filter:zN($)}).catch(()=>{})}teardown(){this.js=null,this.jsm=null}}var bJ,oC$,r64=($)=>{let Z;return()=>Z??=$()},o64,a64=86400000000000,s64=120000000000,e64=4294967296,$44=500000,G44,X44,Y44;var sC$=O(()=>{Wm0();F90();Jm0();B5();tC$();bJ=k(cB(),1),oC$=k(Qh(),1),o64=r64(()=>D8.createCounter("decopilot.stream.publish_errors",{description:"Number of JetStream publish failures for decopilot stream chunks",unit:"{errors}"}));G44=process.env.STREAM_ENCODE_TRACE==="1",X44=process.env.DECOPILOT_STREAM_TRACE==="1";Y44=G44?new aC$:null});import{z as X8}from"zod";var eC$,$_$,PK,Q81,Z_$,G_$,X_$,Y_$,J44,Q_$,J_$,W_$,K_$,U_$,W44,w_$,QZZ,K44,U44=($)=>{return $.issues.map((Z)=>{return`${Z.path.length>0?Z.path.join("."):"frame"}: ${Z.message}`}).join("; ")},F_$=($)=>{return new TextEncoder().encode(JSON.stringify($))},H_$=($)=>{let Z;try{Z=JSON.parse(new TextDecoder().decode($))}catch(Q){throw TypeError("malformed JSON in tunnel frame",{cause:Q})}if(Z===null||typeof Z!=="object"||Array.isArray(Z))throw TypeError("frame must be an object");if(!("type"in Z))throw TypeError("frame type missing");let G=Z.type,X=typeof G==="string"?K44[G]:void 0;if(!X)throw TypeError(`unknown frame type: ${String(G)}`);let Y=X.safeParse(Z);if(!Y.success)throw TypeError(`invalid tunnel frame: ${U44(Y.error)}`);return Y.data};var N_$=O(()=>{eC$=X8.string().regex(/^[A-Za-z0-9_-]*$/u),$_$=X8.array(X8.tuple([X8.string(),X8.string()])),PK=X8.string().regex(/^[A-Za-z0-9_-]+$/u),Q81=X8.string().min(1),Z_$=X8.object({type:X8.literal("request.start"),protocol:X8.literal("tunnel.v1"),requestId:PK,method:X8.string().min(1),url:X8.string().min(1),headers:$_$,replySubject:Q81,bodySubject:Q81.optional(),abortSubject:Q81,deadlineUnixMs:X8.number().int().nonnegative().optional()}),G_$=X8.object({type:X8.literal("request.chunk"),requestId:PK,seq:X8.number().int().nonnegative(),data:eC$}),X_$=X8.object({type:X8.literal("request.end"),requestId:PK,seq:X8.number().int().nonnegative()}),Y_$=X8.object({type:X8.literal("request.error"),requestId:PK,code:X8.string().min(1),message:X8.string()}),J44=X8.union([G_$,X_$,Y_$]),Q_$=X8.object({type:X8.literal("response.ack"),requestId:PK}),J_$=X8.object({type:X8.literal("response.start"),requestId:PK,status:X8.number().int().min(100).max(599),statusText:X8.string().optional(),headers:$_$}),W_$=X8.object({type:X8.literal("response.chunk"),requestId:PK,seq:X8.number().int().nonnegative(),data:eC$}),K_$=X8.object({type:X8.literal("response.end"),requestId:PK,seq:X8.number().int().nonnegative()}),U_$=X8.object({type:X8.literal("response.error"),requestId:PK,code:X8.string().min(1),message:X8.string()}),W44=X8.union([Q_$,J_$,W_$,K_$,U_$]),w_$=X8.object({type:X8.literal("abort"),requestId:PK,reason:X8.string().optional()}),QZZ=X8.union([Z_$,J44,W44,w_$]),K44={"request.start":Z_$,"request.chunk":G_$,"request.end":X_$,"request.error":Y_$,"response.ack":Q_$,"response.start":J_$,"response.chunk":W_$,"response.end":K_$,"response.error":U_$,abort:w_$}});var w44=($)=>{return $.replaceAll("+","-").replaceAll("/","_").replaceAll("=","")},F44=($)=>{let Z=$.replaceAll("-","+").replaceAll("_","/"),G=(4-Z.length%4)%4;return Z+"=".repeat(G)},H44=($)=>{let Z=[];for(let G=0;G<$.length;G+=32768)Z.push(String.fromCharCode(...$.subarray(G,G+32768)));return Z.join("")},N44=($)=>{let Z=new Uint8Array($.length);for(let G=0;G<$.length;G+=32768){let X=$.slice(G,G+32768);Z.set(Uint8Array.from(X,(Y)=>Y.charCodeAt(0)),G)}return Z},B_$=($)=>{return w44(btoa(H44($)))},O_$=($)=>{return N44(atob(F44($)))},B44;var D_$=O(()=>{B44=class B44{#$=[];#Z;#G=!1;#Q=new Set;push($){if(this.#G)return;let Z=this.#Y();if(Z){Z.resolve({value:$,done:!1});return}this.#$.push($)}close(){if(this.#G)return;this.#G=!0,this.#X()}fail($){if(this.#G)return;this.#Z=$,this.#G=!0,this.#J($)}[Symbol.asyncIterator](){let $=!1,Z=new Set;return{next:()=>{if($)return Promise.resolve({value:void 0,done:!0});if(this.#$.length>0)return Promise.resolve({value:this.#$.shift(),done:!1});if(this.#Z)return Promise.reject(this.#Z);if(this.#G)return Promise.resolve({value:void 0,done:!0});return new Promise((G,X)=>{let Y;Y={resolve:(Q)=>{Z.delete(Y),G(Q)},reject:(Q)=>{Z.delete(Y),X(Q)}},Z.add(Y),this.#Q.add(Y)})},return:()=>{$=!0;for(let G of Z)this.#Q.delete(G),G.resolve({value:void 0,done:!0});return Z.clear(),Promise.resolve({value:void 0,done:!0})}}}#Y(){for(let $ of this.#Q)return this.#Q.delete($),$;return}#X(){for(let $ of this.#Q)$.resolve({value:void 0,done:!0});this.#Q.clear()}#J($){for(let Z of this.#Q)Z.reject($);this.#Q.clear()}}});function*I44($,Z){for(let G=0;G<$.length;G+=Z)yield $.subarray(G,G+Z)}class _44{maxSize;ttlMs;now;#$=new Map;constructor($,Z,G=Date.now){this.maxSize=$;this.ttlMs=Z;this.now=G}get($){let Z=this.#$.get($);if(!Z)return;if(Z.expiresAt<=this.now()){this.#$.delete($);return}return Z.value}has($){return this.get($)!==void 0}set($,Z){let G=this.now();this.prune(G),this.#$.delete($),this.#$.set($,{value:Z,expiresAt:G+this.ttlMs});while(this.#$.size>this.maxSize){let X=this.#$.keys().next().value;if(X===void 0)return;this.#$.delete(X)}}take($){let Z=this.get($);return this.#$.delete($),Z}clear(){this.#$.clear()}prune($){for(let[Z,G]of this.#$)if(G.expiresAt<=$)this.#$.delete(Z)}}var O44=30000,D44=1000,E44=65536,oQ,L44=($)=>{return"connection"in $},z44=($)=>{let Z=L44($)?$:{connection:$};return{connection:Z.connection,timeoutMs:Z.timeoutMs??0,firstFrameTimeoutMs:Z.firstFrameTimeoutMs??O44,idleTimeoutMs:Z.idleTimeoutMs??0,republishIntervalMs:Z.republishIntervalMs??D44,maxChunkBytes:Z.maxChunkBytes??E44,diagnostics:Z.diagnostics}},E_$=($)=>{return Array.from($.entries())},j44=($)=>{return $!==void 0&&!($ instanceof Headers)&&typeof $!=="function"&&typeof $[Symbol.iterator]==="function"},P44=($,Z,G)=>{if(j44(Z?.headers))return Array.from(Z?.headers,([X,Y])=>[String(X),String(Y)]);if($ instanceof Request)return E_$(G.headers);return E_$(G.headers)},L_$=($)=>{let Z=new Headers;for(let[G,X]of $)Z.append(G,X);return Z},A44=()=>{return crypto.randomUUID().replaceAll("-","")},T44=($)=>{try{$?.unsubscribe()}catch{}},R44=($)=>{if(!Number.isSafeInteger($)||$<1)throw TypeError("maxChunkBytes must be a positive safe integer")},q44=($,Z)=>{return $==="HEAD"||Z===204||Z===205||Z===304},TB=($,Z,G)=>{$.publish(Z,F_$(G))},M44=($)=>{return $.type.startsWith("response.")},J81=($)=>{let Z=$.reason;if(Z instanceof Error)return Z.message;if(typeof Z==="string")return Z;return"aborted"},k44=($)=>{if($==="idle")return new oQ("tunnel_idle_timeout","no response frame within idleTimeoutMs");return new oQ("tunnel_no_first_frame","no response frame arrived before firstFrameTimeoutMs")},z_$=async($,Z,G,X,Y="first_frame")=>{while(!0){let Q,J;try{let W=await Promise.race([$.next(),new Promise((U,w)=>{if(X.aborted){w(X.reason);return}let F=()=>w(X.reason);J=()=>{X.removeEventListener("abort",F)},X.addEventListener("abort",F,{once:!0})}),...G>0?[new Promise((U,w)=>{Q=setTimeout(()=>{w(k44(Y))},G)})]:[]]);if(W.done)return{value:void 0,done:!0};let K=H_$(W.value.data);if(!M44(K)||K.requestId!==Z)continue;return{value:K,done:!1}}finally{if(J?.(),Q)clearTimeout(Q)}}},S44=async($)=>{let Z=!1;while(!0){let G=await z_$($.iterator,$.requestId,Z?0:$.firstFrameTimeoutMs,$.signal);if(G.done)throw new oQ("tunnel_response_closed","response subscription closed before response.start");if(!Z)Z=!0,$.onFirstResponseFrame();if(G.value.type==="response.ack")continue;if(G.value.type==="response.start")return G.value;if(G.value.type==="response.error")throw new oQ(G.value.code,G.value.message);throw new oQ("tunnel_unexpected_response_frame",`expected response.start, got ${G.value.type}`)}},V44=async($)=>{let Z=$.body.getReader(),G=0,X=!1,Y=()=>{X=!0,Z.cancel($.signal.reason).catch(()=>{})};try{if($.signal.aborted){Y();return}$.signal.addEventListener("abort",Y,{once:!0});while(!0){let{done:Q,value:J}=await Z.read();if(X)return;if(Q){TB($.connection,$.subject,{type:"request.end",requestId:$.requestId,seq:G});return}for(let W of I44(J,$.maxChunkBytes)){if(X)return;TB($.connection,$.subject,{type:"request.chunk",requestId:$.requestId,seq:G,data:B_$(W)}),G++}}}catch(Q){if(X)return;TB($.connection,$.subject,{type:"request.error",requestId:$.requestId,code:"tunnel_request_body_error",message:Q instanceof Error?Q.message:String(Q)})}finally{$.signal.removeEventListener("abort",Y),Z.releaseLock()}},C44=($)=>{return new ReadableStream({async pull(Z){while(!0)try{let G=await z_$($.iterator,$.requestId,$.idleTimeoutMs,$.signal,"idle");if(G.done){Z.error(new oQ("tunnel_response_closed","response subscription closed before response.end")),$.cleanup();return}let X=G.value;if(X.type==="response.ack"||X.type==="response.start")continue;if(X.type==="response.chunk"){Z.enqueue(O_$(X.data));return}if(X.type==="response.end"){Z.close(),$.cleanup();return}Z.error(new oQ(X.code,X.message)),$.cleanup();return}catch(G){Z.error(G),$.cleanup();return}},cancel(){TB($.connection,$.abortSubject,{type:"abort",requestId:$.requestId,reason:"response_body_cancelled"}),$.cleanup()}},{highWaterMark:0})},IB=($)=>{let Z=z44($);return R44(Z.maxChunkBytes),async(G,X)=>{let Y=VV$(G),Q=new Request(G,X),J=A44(),W=CV$(Y.hostname,J),K=new AbortController,U=new AbortController,w=!1,F,H,N,B,D=!1,E=(P=new oQ("tunnel_closed","tunnel request closed"))=>{if(w)return;if(w=!0,T44(F),Q.body&&!D)Q.body.cancel(P).catch(()=>{});if(U.abort(P),K.abort(P),N)clearInterval(N);if(B)clearTimeout(B);Q.signal.removeEventListener("abort",L)},L=()=>{let P=new oQ("tunnel_aborted",J81(Q.signal));TB(Z.connection,W.abort,{type:"abort",requestId:J,reason:J81(Q.signal)}),K.abort(P),E(P)};if(Q.signal.aborted)throw new oQ("tunnel_aborted",J81(Q.signal));if(F=Z.connection.subscribe(W.reply),H=F[Symbol.asyncIterator](),Q.signal.addEventListener("abort",L,{once:!0}),Z.timeoutMs>0)B=setTimeout(()=>{let P=new oQ("tunnel_timeout",`tunnel request timed out after ${Z.timeoutMs}ms`);TB(Z.connection,W.abort,{type:"abort",requestId:J,reason:"tunnel_timeout"}),K.abort(P),E(P)},Z.timeoutMs);let z={type:"request.start",protocol:"tunnel.v1",requestId:J,method:Q.method,url:Y.pathWithSearch,headers:P44(G,X,Q),replySubject:W.reply,abortSubject:W.abort,...Q.body?{bodySubject:W.body}:{},...Z.timeoutMs>0?{deadlineUnixMs:Date.now()+Z.timeoutMs}:{}};TB(Z.connection,W.request,z),N=Z.republishIntervalMs>0?setInterval(()=>{if(!D)TB(Z.connection,W.request,z)},Z.republishIntervalMs):void 0;let j=()=>{if(D)return;D=!0,(Q.body?V44({connection:Z.connection,subject:W.body,requestId:J,body:Q.body,maxChunkBytes:Z.maxChunkBytes,signal:U.signal}):void 0)?.catch((A)=>{Z.diagnostics?.({event:"request_body_error",requestId:J,subject:W.body,error:A instanceof Error?A.message:String(A)})})};try{let P=await S44({iterator:H,requestId:J,firstFrameTimeoutMs:Z.firstFrameTimeoutMs,signal:K.signal,onFirstResponseFrame:()=>{if(N)clearInterval(N);j()}});if(q44(Q.method,P.status))return E(),new Response(null,{status:P.status,statusText:P.statusText,headers:L_$(P.headers)});return new Response(C44({connection:Z.connection,abortSubject:W.abort,iterator:H,requestId:J,idleTimeoutMs:Z.idleTimeoutMs,signal:K.signal,cleanup:E}),{status:P.status,statusText:P.statusText,headers:L_$(P.headers)})}catch(P){throw E(P instanceof Error?P:Error(String(P))),P}}};var j_$=O(()=>{N_$();D_$();fL0();oQ=class oQ extends Error{code;constructor($,Z,G){super(`${$}: ${Z}`,G);this.code=$;this.name="TunnelTransportError"}}});var cL0=O(()=>{j_$()});function P_$($){let Z=$.createFetch??b44,G=$.timeoutMs??2000;return async(X)=>{try{let Y=$.getConnection();if(!Y)return W81;let Q=CJ(X),W=await Z(Y,G)(`tunnel://${Q}/api/links/status`,{method:"GET"});if(!W.ok)return W81;let K=await W.json();return{online:!0,hostname:K.hostname,capabilities:K.capabilities??[],cliVersion:K.cliVersion}}catch{return W81}}}var W81,b44=($,Z)=>IB({connection:$,firstFrameTimeoutMs:Z});var A_$=O(()=>{cL0();Jr();W81={online:!1,capabilities:[]}});async function*f44($){if(!$.body){yield{headers:{status:$.status,headers:Object.fromEntries($.headers.entries())}};return}let Z=$.body.getReader(),G=!1;try{yield{headers:{status:$.status,headers:Object.fromEntries($.headers.entries())}};while(!0){let{done:X,value:Y}=await Z.read();if(X){G=!0;return}yield{data:Buffer.from(Y).toString("base64")}}}finally{try{if(!G)await Z.cancel()}catch{}finally{Z.releaseLock()}}}function T_$($){let Z=$.createFetch??((G)=>IB({connection:G,idleTimeoutMs:x44}));return async function*(X,Y,Q){let J=$.getConnection();if(!J)throw Error("link_unavailable: NATS unavailable");let W=CJ(X),K=Z(J),U={method:Y.method,headers:Y.headers,signal:Q?.signal};if(Y.body!=null)U.body=Y.body;let w=await K(`tunnel://${W}${Y.path}`,U);yield*f44(w)}}var x44=45000;var I_$=O(()=>{cL0();Jr()});import{z as fJ}from"zod";function R_$($){return JSON.stringify($)}var fZZ;var q_$=O(()=>{fZZ=fJ.discriminatedUnion("type",[fJ.object({type:fJ.literal("cancel"),runId:fJ.string()}),fJ.object({type:fJ.literal("cancel_req"),reqId:fJ.string()}),fJ.object({type:fJ.literal("keep_alive")}),fJ.object({type:fJ.literal("shutdown")})])});function M_$($){let Z=$.createFetch??((G)=>IB({connection:G,idleTimeoutMs:v44}));return{async publish(G,X,Y){let Q=$.getConnection();if(!Q)throw Error("link_unavailable: NATS unavailable");let J=CJ(G),K=await Z(Q)(`tunnel://${J}/api/links/work`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(X),signal:Y?.signal});if(!K.ok){let U=await K.text().catch(()=>"");throw Error(`tunnel work publish failed (${K.status})${U?`: ${U}`:""}`)}await K.body?.cancel().catch(()=>{})}}}function k_$($){let Z=$.createFetch??IB;return{async publishControlFrame(G,X,Y){let Q=$.getConnection();if(!Q)throw Error("link_unavailable: NATS unavailable");let J=CJ(G),K=await Z(Q)(`tunnel://${J}/api/links/control`,{method:"POST",headers:{"content-type":"application/json"},body:R_$(X),signal:Y?.signal});if(!K.ok){let U=await K.text().catch(()=>"");throw Error(`tunnel control publish failed (${K.status})${U?`: ${U}`:""}`)}await K.body?.cancel().catch(()=>{})}}}var v44=45000;var S_$=O(()=>{cL0();q_$();Jr()});function uL0($,Z,G,X){if(!X)return!1;return $.emit(Z,_3(G,X.status,{title:X.title??void 0,virtualMcpId:X.virtual_mcp_id??void 0,createdBy:X.created_by??void 0,triggerId:X.trigger_id??null,branch:X.branch??null,createdAt:X.created_at,updatedAt:X.updated_at})),!0}var V_$=O(()=>{f8()});class K81{storage;options;timer=null;constructor($,Z={}){this.storage=$;this.options=Z}start(){if(this.timer)return;let $=this.options.intervalMs??300000;this.timer=setInterval(()=>{this.runOnce()},$)}async runOnce(){let $=this.options.staleAfterMs??3600000;try{let Z=await this.storage.sweepAbandoned($);if(Z>0)console.log(`[async-research-sweeper] marked ${Z} stale jobs as abandoned`);return Z}catch(Z){return console.error("[async-research-sweeper] sweep failed",Z),0}}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}import{readdir as y44,rm as dL0}from"fs/promises";import{join as lL0}from"path";async function mL0($){let Z=new Date;Z.setUTCDate(Z.getUTCDate()-g44),Z.setUTCHours(0,0,0,0);let G=0;try{let X=await IC($);for(let Y of X)if(/^\d{4}$/.test(Y))G+=await C_$($,Y,Z);else if(!Y.startsWith(".")){let Q=lL0($,Y),J=await IC(Q);for(let K of J){if(!/^\d{4}$/.test(K))continue;G+=await C_$(Q,K,Z)}if((await IC(Q)).length===0)await dL0(Q,{recursive:!0,force:!0})}}catch(X){console.warn("monitoring retention cleanup failed:",X)}return G}async function C_$($,Z,G){let X=0,Y=lL0($,Z),Q=await IC(Y);for(let W of Q){if(!/^\d{2}$/.test(W))continue;let K=lL0(Y,W),U=await IC(K);for(let F of U){if(!/^\d{2}$/.test(F))continue;let H=new Date(`${Z}-${W}-${F}T00:00:00Z`);if(isNaN(H.getTime()))continue;if(H<G){let N=lL0(K,F);await dL0(N,{recursive:!0,force:!0}),X++}}if((await IC(K)).length===0)await dL0(K,{recursive:!0,force:!0})}if((await IC(Y)).length===0)await dL0(Y,{recursive:!0,force:!0});return X}async function IC($){try{return(await y44($)).filter((G)=>!G.startsWith("."))}catch{return[]}}var g44=30;var U81=()=>{};import{DBOS as w81,SchedulerMode as h44}from"@dbos-inc/dbos-sdk";async function u44(){let $=[eQ(),qC(),RK()],Z=0;for(let G of $)try{Z+=await mL0(G)}catch(X){console.error("[monitoring-retention] cleanup failed:",X)}return console.log(`[monitoring-retention] deleted ${Z} day-dir(s) across ${$.length} signal dir(s)`),{deleted:Z,dirs:$.length}}async function d44($,Z){await w81.runStep(()=>u44(),{name:"monitoringRetention"})}function b_$(){if(__$)return;__$=!0;let $=w81.registerWorkflow(d44,{name:"monitoringRetentionWorkflow"});w81.registerScheduled($,{name:"monitoringRetentionWorkflow",crontab:c44,mode:h44.ExactlyOncePerIntervalWhenActive})}var c44="23 4 * * *",__$=!1;var f_$=O(()=>{iX();U81()});function x_$($){return async(Z,G)=>{let X=await $.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.role","organization.id as orgId","organization.slug as orgSlug","organization.name as orgName"]).where("member.userId","=",G).where("member.organizationId","=",Z).executeTakeFirst();if(!X)return console.warn(`[automationContextFactory] User ${G} not found in org ${Z} \u2014 returning null`),null;let Y=await XN.create();Y.auth.user={id:G,role:X.role},Y.organization={id:X.orgId,slug:X.orgSlug,name:X.orgName};let Q=await Iu0($.db,Z,X.role);return Y.boundAuth=Tu0({auth:Y.authInstance,headers:new Headers,role:X.role,permissions:Q,userId:G}),Y.access=new vD(G,void 0,Y.boundAuth,X.role,"self"),i40(Y,{id:X.orgId,slug:X.orgSlug}),Y}}var v_$=O(()=>{yD();ki()});function l44(){return{services:[{name:"Postgres",status:"pending",port:0},{name:"NATS",status:"pending",port:0}],migrationsStatus:"pending",serverUrl:null,logs:[]}}function i44(){for(let $ of m44)$()}function y_$($){let Z=[...F81.logs,$];F81={...F81,logs:Z.length>500?Z.slice(-500):Z},i44()}function H81(){return n44}var F81,m44,n44=!1;var N81=O(()=>{F81=l44(),m44=new Set});import{EventEmitter as p44}from"events";var B81;var g_$=O(()=>{N81();B81=new p44;B81.on("request",($)=>{y_$($)})});function h_$(){return async($,Z)=>{let G=Date.now(),X=$.req.method,Y=$.req.path;if(Y==="/api/auth/get-session"||Y.includes("favicon")){await Z();return}let Q="",J=!1;if(Y.startsWith("/mcp")&&X==="POST"){J=!0;try{if($.req.header("Content-Type")?.includes("application/json")){let H=await $.req.raw.clone().json();if(H.method==="tools/call"&&H.params?.name){let N=bg(H.params.name),B=H.params.arguments||{},D=Object.keys(B).map((L)=>bg(L)),E=D.length>0?D.slice(0,3).join(",")+(D.length>3?"\u2026":""):"";Q=`${$5.tool}${N}${$5.dim}(${E})${$5.reset}`}else if(H.method)Q=`${$5.dim}${bg(H.method)}${$5.reset}`}}catch{}}let W=bg(Y);if(Y.startsWith("/mcp/conn_")){let w=Y.split("/")[2]??"";W=`/mcp/${$5.mcp}${bg(w.slice(0,12))}\u2026${$5.reset}`}else if(Y==="/mcp")W=`${$5.mcp}/mcp${$5.reset}`;else if(Y==="/mcp/registry")W=`${$5.mcp}/mcp/registry${$5.reset}`;let K=r44(X),U=J?"\u25C0":"\u2190";if(!H81())console.log(`${$5.dim}${U}${$5.reset} ${K}${X}${$5.reset} ${W}${Q?` ${Q}`:""}`);try{await Z()}finally{let w=Date.now()-G,F=$.res.status,H=t44(F),N=w<1000?`${w}ms`:`${(w/1000).toFixed(1)}s`,B=J?"\u25B6":"\u2192";if(!H81())console.log(`${$5.dim}${B}${$5.reset} ${K}${X}${$5.reset} ${W}${Q?` ${Q}`:""} ${H}${F}${$5.reset} ${$5.duration}${N}${$5.reset}`);B81.emit("request",{method:X,path:bg(Y),status:F,duration:w,timestamp:new Date})}}}var $5,t44=($)=>{if($>=500)return $5.serverError;if($>=400)return $5.clientError;if($>=300)return $5.redirect;return $5.ok},r44=($)=>{return $5[$]||$5.reset},bg=($)=>{return $.replace(/\r/g,"").replace(/\n/g,"").replace(/\x1b\[[0-9;]*m/g,"").replace(/[\x00-\x1f\x7f-\x9f]/g,"")};var c_$=O(()=>{N81();g_$();$5={reset:"\x1B[0m",dim:"\x1B[2m",bold:"\x1B[1m",GET:"\x1B[36m",POST:"\x1B[33m",PUT:"\x1B[35m",DELETE:"\x1B[31m",ok:"\x1B[32m",redirect:"\x1B[36m",clientError:"\x1B[33m",serverError:"\x1B[31m",mcp:"\x1B[35m",tool:"\x1B[96m",duration:"\x1B[90m"}});import{createHmac as m_$}from"crypto";import{mkdir as o44,readdir as a44,rm as u_$,stat as i_$}from"fs/promises";import{join as D81,relative as s44}from"path";import{z as T$}from"zod";function p_$($){let Z=$.replace(/[^a-zA-Z0-9_-]/g,"_");return D81(e44,Z)}function t_$($){return $.replace(/^\/+/,"").replace(/\.\./g,"")}function O81($,Z){let G=p_$($),X=t_$(Z);return D81(G,X)}function $54($,Z,G,X){let Y=O1().encryptionKey||"dev-secret",Q=`${$}:${Z}:${G}:${X}`;return m_$("sha256",Y).update(Q).digest("hex")}function l_$($,Z,G,X,Y){let Q=Math.floor(Date.now()/1000)+X,J=$54(Z,G,Q,Y),W=new URL(`/api/dev-assets/${Z}/${t_$(G)}`,$);return W.searchParams.set("expires",Q.toString()),W.searchParams.set("signature",J),W.searchParams.set("method",Y),W.toString()}function r_$($,Z,G){let X=`${$}:${Z.getTime()}:${G}`;return`"${m_$("md5","etag").update(X).digest("hex")}"`}async function o_$($,Z,G,X,Y){try{let Q=await a44($,{withFileTypes:!0});for(let J of Q){let W=D81($,J.name),U=s44(Z,W).replace(/\\/g,"/");if(G&&!U.startsWith(G))continue;if(J.isDirectory())if(X){let w=U+"/";if(!G||w.startsWith(G)){if(!(G?U.slice(G.length):U).includes("/"))Y.commonPrefixes.add(w)}}else await o_$(W,Z,G,X,Y);else if(J.isFile()){if(X&&G){let w=U.slice(G.length);if(w.includes(X)){let F=w.indexOf(X),H=G+w.slice(0,F+1);Y.commonPrefixes.add(H);continue}}try{let w=await i_$(W);Y.objects.push({key:U,size:w.size,lastModified:w.mtime.toISOString(),etag:r_$(W,w.mtime,w.size)})}catch{}}}}catch{}}function a_$($,Z){let X=O0($).id;return[{name:"LIST_OBJECTS",description:"List objects in the local assets directory with pagination support",inputSchema:T$.object({prefix:T$.string().optional(),maxKeys:T$.number().optional().default(1000),continuationToken:T$.string().optional(),delimiter:T$.string().optional()}),outputSchema:T$.object({objects:T$.array(T$.object({key:T$.string(),size:T$.number(),lastModified:T$.string(),etag:T$.string()})),nextContinuationToken:T$.string().optional(),isTruncated:T$.boolean(),commonPrefixes:T$.array(T$.string()).optional()}),handler:async(Y)=>{let Q=Y,J=Q.prefix||"",W=Q.maxKeys??1000,K=Q.delimiter,U=Q.continuationToken,w=p_$(X);await o44(w,{recursive:!0});let F={objects:[],commonPrefixes:new Set};await o_$(w,w,J,K,F),F.objects.sort((E,L)=>E.key.localeCompare(L.key));let H=0;if(U){if(H=F.objects.findIndex((E)=>E.key>U),H===-1)H=F.objects.length}let N=F.objects.slice(H,H+W),B=H+W<F.objects.length,D=B?N[N.length-1]?.key:void 0;return{objects:N,isTruncated:B,nextContinuationToken:D,commonPrefixes:Array.from(F.commonPrefixes).sort()}}},{name:"GET_OBJECT_METADATA",description:"Get metadata for a file in the local assets directory",inputSchema:T$.object({key:T$.string()}),outputSchema:T$.object({contentType:T$.string().optional(),contentLength:T$.number(),lastModified:T$.string(),etag:T$.string(),metadata:T$.record(T$.string(),T$.string()).optional()}),handler:async(Y)=>{let Q=Y,J=O81(X,Q.key),W=await i_$(J);return{contentType:U11(Q.key),contentLength:W.size,lastModified:W.mtime.toISOString(),etag:r_$(J,W.mtime,W.size)}}},{name:"GET_PRESIGNED_URL",description:"Generate a presigned URL for downloading a file from local storage",inputSchema:T$.object({key:T$.string(),expiresIn:T$.number().optional()}),outputSchema:T$.object({url:T$.string(),expiresIn:T$.number()}),handler:async(Y)=>{let Q=Y,J=Q.expiresIn??d_$;return{url:l_$(Z,X,Q.key,J,"GET"),expiresIn:J}}},{name:"PUT_PRESIGNED_URL",description:"Generate a presigned URL for uploading a file to local storage",inputSchema:T$.object({key:T$.string(),expiresIn:T$.number().optional(),contentType:T$.string().optional()}),outputSchema:T$.object({url:T$.string(),expiresIn:T$.number()}),handler:async(Y)=>{let Q=Y,J=Q.expiresIn??d_$;return{url:l_$(Z,X,Q.key,J,"PUT"),expiresIn:J}}},{name:"DELETE_OBJECT",description:"Delete a single file from local storage",inputSchema:T$.object({key:T$.string()}),outputSchema:T$.object({success:T$.boolean(),key:T$.string()}),handler:async(Y)=>{let Q=Y,J=O81(X,Q.key);try{return await u_$(J),{success:!0,key:Q.key}}catch{return{success:!1,key:Q.key}}}},{name:"DELETE_OBJECTS",description:"Delete multiple files from local storage",inputSchema:T$.object({keys:T$.array(T$.string()).max(1000)}),outputSchema:T$.object({deleted:T$.array(T$.string()),errors:T$.array(T$.object({key:T$.string(),message:T$.string()}))}),handler:async(Y)=>{let Q=Y,J=[],W=[];return await Promise.all(Q.keys.map(async(K)=>{let U=O81(X,K);try{await u_$(U),J.push(K)}catch(w){W.push({key:K,message:w instanceof Error?w.message:"Unknown error"})}})),{deleted:J,errors:W}}}]}async function E81($,Z,G){let X=a_$(Z,G),Y=new NU({name:"dev-assets-mcp",version:"1.0.0"},{capabilities:{tools:{}},jsonSchemaValidator:z5});for(let J of X){let W="shape"in J.inputSchema?J.inputSchema.shape:T$.object({}).shape,K=J.outputSchema&&"shape"in J.outputSchema?J.outputSchema.shape:T$.object({}).shape;Y.registerTool(J.name,{description:J.description??"",inputSchema:W,outputSchema:K,annotations:J.annotations,_meta:J._meta},async(U)=>{try{let w=await J.handler(U);return{content:[{type:"text",text:JSON.stringify(w)}],structuredContent:w}}catch(w){return{content:[{type:"text",text:`Error: ${w.message}`}],isError:!0}}})}let Q=new vY({enableJsonResponse:$.headers.get("Accept")?.includes("application/json")??!1});return await Y.connect(Q),sW(Y,Q,$,"mcp:dev-assets")}async function s_$($,Z,G,X){let Q=a_$(G,X).find((J)=>J.name===$);if(!Q)return{content:[{type:"text",text:`Tool not found: ${$}`}],isError:!0};try{let J=await Q.handler(Z);return{content:[{type:"text",text:JSON.stringify(J)}]}}catch(J){return{content:[{type:"text",text:J instanceof Error?J.message:String(J)}],isError:!0}}}var e44="./data/assets",d_$=3600,n_$,e_$;var $b$=O(()=>{F8();Up();F6();vu();Xy();jG();$L0();n_$=new b1;n_$.all("/",async($)=>{let Z=$.get("studioContext"),G=new URL($.req.url),X=`${G.protocol}//${G.host}`;return E81($.req.raw,Z,X)});e_$=n_$});var Zb$={};X6(Zb$,{mountDevRoutes:()=>Z54});function Z54($,Z){$.all("/mcp/:connectionId{.*_dev-assets$}",Z,async(X)=>{let Y=X.get("studioContext"),Q=new URL(X.req.url),J=`${Q.protocol}//${Q.host}`;return E81(X.req.raw,Y,J)}),$.all("/mcp/:connectionId{.*_dev-assets$}/call-tool/:toolName",Z,async(X)=>{let Y=X.get("studioContext"),Q=new URL(X.req.url),J=`${Q.protocol}//${Q.host}`,W=X.req.param("toolName");if(!W)return X.json({error:"Missing tool name"},400);let K=await X.req.json(),U=await s_$(W,K,Y,J);if(U.isError)return X.json(U.content,500);return X.json(U.content)}),$.use("/mcp/dev-assets",Z),$.route("/mcp/dev-assets",e_$);let G=new b1;G.use("*",pQ({mountPath:"/api/dev-assets"})),G.route("/",eE0({orgFromPath:!1})),$.route("/api/dev-assets",G)}var Gb$=O(()=>{F6();G11();$L0();$b$()});var Xb$=O(()=>{nu0();pu0();EE()});var iL0=O(()=>{Xb$()});var Qb$={};X6(Qb$,{streamAgent:()=>Yb$,createDecopilotClient:()=>X54});async function G54($){let{parseJsonEventStream:Z,uiMessageChunkSchema:G}=await Promise.resolve().then(() => (L6(),el0));return Z({stream:$,schema:G}).pipeThrough(new TransformStream({transform(X,Y){if(!X.success)throw X.error;Y.enqueue(X.value)}}))}async function Yb$($,Z,G,X,Y){let{readUIMessageStream:Q}=await Promise.resolve().then(() => (L6(),el0)),J=G.value??G.id;if(!J)throw Error("Agent binding has no id or value \u2014 cannot resolve agent");let W=X.credentialId??G.credentialId,K=X.thinking??G.thinking,U=K?.id,w={messages:X.messages,...U?{models:{credentialId:W,thinking:K,...X.fast??G.fast?{fast:X.fast??G.fast}:{}}}:{},agent:{id:J},temperature:X.temperature??G.temperature,toolApprovalLevel:X.toolApprovalLevel??G.toolApprovalLevel,mode:X.mode??G.mode??"default",...X.memory?{memory:X.memory}:{},...X.thread_id?{thread_id:X.thread_id}:{}},F=await fetch($,{method:"POST",headers:{"Content-Type":"application/json","x-mesh-token":Z,Authorization:`Bearer ${Z}`},body:JSON.stringify(w),signal:Y?.signal});if(!F.ok){let N=await F.text().catch(()=>""),B=`HTTP ${F.status}`;try{let D=JSON.parse(N);if(D?.error)B=D.error}catch{if(N)B=N}throw Error(B)}if(!F.body)throw Error("Empty response body from decopilot stream");let H=await G54(F.body);return Q({stream:H})}function X54($){let{baseUrl:Z,orgSlug:G,token:X}=$,Y=`${Z}/${G}/decopilot/runtime/stream`;return{stream(Q,J){let W={__type:"@deco/agent",id:Q.agent.id,credentialId:Q.credentialId??"",thinking:Q.thinking??{id:"",title:""},fast:Q.fast,toolApprovalLevel:Q.toolApprovalLevel,mode:Q.mode,temperature:Q.temperature};return Yb$(Y,X,W,Q,J)}}}import{z as dX}from"zod";function Jb$($){let Z=$.properties;if(!Z)return $;for(let G of Object.values(Z)){let X=G.properties;if(!X?.__type?.const)continue;let Y=X.__type.const,Q=Y54.get(Y);if(!Q)continue;let J=Q.map((W)=>({name:String(W.name),...W.inputSchema&&{inputSchema:dX.toJSONSchema(W.inputSchema)},...W.outputSchema&&{outputSchema:dX.toJSONSchema(W.outputSchema)}}));X.__binding={const:J}}return $}var Y54,C7Z,Q54=($)=>{return typeof $==="object"&&$!==null&&$.__type==="@deco/agent"},z81=($)=>{return typeof $==="object"&&$!==null&&typeof $.__type==="string"&&$.__type!=="@deco/agent"&&typeof $.value==="string"},nL0=($,Z,G)=>{let X=G?{"x-caller-app":G}:void 0;if(Z.cookie)X??={},X.cookie=Z.cookie;if(Z.token)X??={},X["x-mesh-token"]=Z.token;return{type:"HTTP",url:new URL(`/mcp/${$}`,Z.meshUrl).href,token:Z.token,headers:X}},J54=($,Z,G)=>{let X=nL0($,Z,G);return new Proxy(Yv.forConnection(X),{get(Y,Q){if(Q==="value")return $;if(Q==="__type")return G;return Y[Q]}})},W54=($,Z)=>{let G=Z.organizationSlug;if(!G)throw Error("organizationSlug is required for agent bindings");let X=`${Z.meshUrl}/api/${G}/decopilot/runtime/stream`;return{STREAM:async(Y,Q)=>{let{streamAgent:J}=await Promise.resolve().then(() => Qb$);return J(X,Z.token,$,Y,Q)}}},L81=($,Z)=>{if($===null||$===void 0)return $;if(Array.isArray($))return $.map((G)=>L81(G,Z));if(typeof $==="object"){if(Q54($))return W54($,Z);if(z81($))return J54($.value,Z,$.__type);let G={};for(let[X,Y]of Object.entries($))G[X]=L81(Y,Z);return G}return $},Wb$=($)=>{return L81($.state,$)};var fg=O(()=>{iL0();Y54=new Map;C7Z=dX.object({id:dX.string(),title:dX.string(),capabilities:dX.object({vision:dX.boolean().optional(),text:dX.boolean().optional(),tools:dX.boolean().optional(),reasoning:dX.boolean().optional()}).passthrough().optional(),provider:dX.string().optional().nullable(),limits:dX.object({contextWindow:dX.number().optional(),maxOutputTokens:dX.number().optional()}).passthrough().optional()})});var K54,Kb$=($,Z,G)=>{if(!Z)return null;if($===void 0||$==="*")return"*";if(typeof $==="string")return $===Z?$:null;if(Array.isArray($))return $.includes(Z)?Z:null;if(typeof $==="function")return $(Z,G)??null;return null},U54=($,Z,G)=>{let X=Z.headers.get("Origin"),Y=Kb$(G.origin,X,Z);if(Y)$.set("Access-Control-Allow-Origin",Y);if(G.credentials)$.set("Access-Control-Allow-Credentials","true");if(G.exposeHeaders?.length)$.set("Access-Control-Expose-Headers",G.exposeHeaders.join(", "))},Ub$=($,Z)=>{let G=new Headers,X=$.headers.get("Origin"),Y=Kb$(Z.origin,X,$);if(Y)G.set("Access-Control-Allow-Origin",Y);if(Z.credentials)G.set("Access-Control-Allow-Credentials","true");let Q=Z.allowMethods??K54;G.set("Access-Control-Allow-Methods",Q.join(", "));let J=$.headers.get("Access-Control-Request-Headers");if(Z.allowHeaders?.length)G.set("Access-Control-Allow-Headers",Z.allowHeaders.join(", "));else if(J)G.set("Access-Control-Allow-Headers",J);if(Z.maxAge!==void 0)G.set("Access-Control-Max-Age",Z.maxAge.toString());return new Response(null,{status:204,headers:G})},wb$=($,Z,G)=>{let X=new Headers($.headers);return U54(X,Z,G),new Response($.body,{status:$.status,statusText:$.statusText,headers:X})};var Fb$=O(()=>{K54=["GET","HEAD","PUT","POST","DELETE","PATCH"]});function Hb$($=32){let G=new Uint8Array($);return crypto.getRandomValues(G),Array.from(G,(X)=>"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"[X%62]).join("")}function w54($){try{let Z=new URL($);return Z.protocol==="https:"||Z.hostname==="localhost"||Z.hostname.endsWith(".localhost")||Z.hostname==="127.0.0.1"||!Z.protocol.startsWith("http")}catch{return!1}}function Nb$($){return btoa(JSON.stringify($)).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function Bb$($){try{let Z=$.replace(/-/g,"+").replace(/_/g,"/");return JSON.parse(atob(Z))}catch{return null}}function Ob$($){return{handleProtectedResourceMetadata:(U)=>{let w=AK(new URL(U.url)),F=`${w.origin}/mcp`;return Response.json({resource:F,authorization_servers:[w.origin],scopes_supported:["*"],bearer_methods_supported:["header"],resource_signing_alg_values_supported:["RS256","none"]})},handleAuthorizationServerMetadata:(U)=>{let F=AK(new URL(U.url)).origin;return Response.json({issuer:F,authorization_endpoint:`${F}/authorize`,token_endpoint:`${F}/token`,registration_endpoint:`${F}/register`,scopes_supported:["*"],response_types_supported:["code"],response_modes_supported:["query"],grant_types_supported:["authorization_code","refresh_token"],token_endpoint_auth_methods_supported:["none","client_secret_post"],code_challenge_methods_supported:["S256","plain"]})},handleAuthorize:(U)=>{let w=AK(new URL(U.url)),F=w.searchParams.get("redirect_uri"),H=w.searchParams.get("response_type"),N=w.searchParams.get("state"),B=w.searchParams.get("code_challenge"),D=w.searchParams.get("code_challenge_method");if(!F)return Response.json({error:"invalid_request",error_description:"redirect_uri required"},{status:400});if(H!=="code")return Response.json({error:"unsupported_response_type",error_description:"Only 'code' is supported"},{status:400});let E=AK(new URL(`${w.origin}/oauth/callback`)),L=E.toString(),j=Nb$({redirectUri:F,clientState:N??void 0,codeChallenge:B??void 0,codeChallengeMethod:D??void 0,oauthCallbackUri:L});E.searchParams.set("state",j);let P=$.authorizationUrl(E.toString());return Response.redirect(P,302)},handleOAuthCallback:async(U)=>{let w=AK(new URL(U.url)),F=w.searchParams.get("code"),H=w.searchParams.get("state"),N=w.searchParams.get("error"),B=H?Bb$(H):null;if(N){let D=w.searchParams.get("error_description")??"Authorization failed";if(B?.redirectUri){let E=AK(new URL(B.redirectUri));if(E.searchParams.set("error",N),E.searchParams.set("error_description",D),B.clientState)E.searchParams.set("state",B.clientState);return Response.redirect(E.toString(),302)}return Response.json({error:N,error_description:D},{status:400})}if(!F||!B)return Response.json({error:"invalid_request",error_description:"Missing code or state"},{status:400});try{let D=B.oauthCallbackUri??AK(new URL(`${w.origin}/oauth/callback`)).toString(),E={code:F,redirect_uri:D},L=await $.exchangeCode(E),z={accessToken:L.access_token,tokenType:L.token_type,refreshToken:L.refresh_token,expiresIn:L.expires_in,scope:L.scope,codeChallenge:B.codeChallenge,codeChallengeMethod:B.codeChallengeMethod},j=Nb$(z),P=AK(new URL(B.redirectUri));if(P.searchParams.set("code",j),B.clientState)P.searchParams.set("state",B.clientState);return Response.redirect(P.toString(),302)}catch(D){console.error("OAuth callback error:",D);let E=AK(new URL(B.redirectUri));if(E.searchParams.set("error","server_error"),E.searchParams.set("error_description","Failed to exchange authorization code"),B.clientState)E.searchParams.set("state",B.clientState);return Response.redirect(E.toString(),302)}},handleToken:async(U)=>{try{let w=U.headers.get("content-type")??"",F;if(w.includes("application/x-www-form-urlencoded")){let z=await U.formData();F=Object.fromEntries(z.entries())}else{let z=await U.json();if(typeof z!=="object"||z===null||Array.isArray(z))return Response.json({error:"invalid_request",error_description:"Request body must be a JSON object"},{status:400});F=z}let{code:H,code_verifier:N,grant_type:B,refresh_token:D}=F;if(B==="refresh_token"){if(typeof D!=="string"||!D)return Response.json({error:"invalid_request",error_description:"refresh_token is required and must be a string"},{status:400});if(!$.refreshToken)return Response.json({error:"unsupported_grant_type",error_description:"refresh_token grant not supported"},{status:400});let z;try{z=await $.refreshToken(D)}catch(P){if(P instanceof j81)return Response.json({error:P.error,...P.errorDescription?{error_description:P.errorDescription}:{}},{status:400});throw P}let j={access_token:z.access_token,token_type:z.token_type};if(z.refresh_token)j.refresh_token=z.refresh_token;if(z.expires_in!==void 0)j.expires_in=z.expires_in;if(z.scope)j.scope=z.scope;return Response.json(j,{headers:{"Cache-Control":"no-store",Pragma:"no-cache"}})}if(B!=="authorization_code")return Response.json({error:"unsupported_grant_type",error_description:"Only authorization_code and refresh_token supported"},{status:400});if(typeof H!=="string"||!H)return Response.json({error:"invalid_request",error_description:"code is required and must be a string"},{status:400});let E=Bb$(H);if(!E||!E.accessToken)return Response.json({error:"invalid_grant",error_description:"Invalid or expired code"},{status:400});if(E.codeChallenge){if(typeof N!=="string"||!N)return Response.json({error:"invalid_grant",error_description:"code_verifier required and must be a string"},{status:400});let z;if(E.codeChallengeMethod==="S256"){let P=new TextEncoder().encode(N),A=await crypto.subtle.digest("SHA-256",P);z=btoa(String.fromCharCode(...new Uint8Array(A))).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}else z=N;if(z!==E.codeChallenge)return Response.json({error:"invalid_grant",error_description:"Invalid code_verifier"},{status:400})}let L={access_token:E.accessToken,token_type:E.tokenType};if(E.refreshToken)L.refresh_token=E.refreshToken;if(E.expiresIn!==void 0)L.expires_in=E.expiresIn;if(E.scope)L.scope=E.scope;return Response.json(L,{headers:{"Cache-Control":"no-store",Pragma:"no-cache"}})}catch(w){return console.error("Token exchange error:",w),Response.json({error:"server_error",error_description:"Failed to process token request"},{status:500})}},handleClientRegistration:async(U)=>{try{let w=await U.json();if(!w.redirect_uris||w.redirect_uris.length===0)return Response.json({error:"invalid_redirect_uri",error_description:"At least one redirect_uri is required"},{status:400});for(let D of w.redirect_uris)if(!w54(D))return Response.json({error:"invalid_redirect_uri",error_description:`Invalid redirect URI: ${D}`},{status:400});let F=Hb$(32),H=w.token_endpoint_auth_method!=="none"?Hb$(32):void 0,N=Math.floor(Date.now()/1000),B={client_id:F,client_secret:H,client_name:w.client_name,redirect_uris:w.redirect_uris,grant_types:w.grant_types??["authorization_code"],response_types:w.response_types??["code"],token_endpoint_auth_method:w.token_endpoint_auth_method??"client_secret_post",scope:w.scope,client_id_issued_at:N,client_secret_expires_at:0};if($.persistence)await $.persistence.saveClient(B);return new Response(JSON.stringify(B),{status:201,headers:{"Content-Type":"application/json","Cache-Control":"no-store",Pragma:"no-cache"}})}catch(w){return console.error("Client registration error:",w),Response.json({error:"invalid_client_metadata",error_description:"Invalid client registration request"},{status:400})}},createUnauthorizedResponse:(U)=>{let H=`Bearer resource_metadata="${`${AK(new URL(U.url)).origin}/.well-known/oauth-protected-resource`}", scope="*"`;return Response.json({jsonrpc:"2.0",error:{code:-32000,message:"Unauthorized: Authentication required"},id:null},{status:401,headers:{"WWW-Authenticate":H,"Access-Control-Expose-Headers":"WWW-Authenticate"}})},hasAuth:(U)=>U.headers.has("Authorization")}}var j81,AK=($)=>{if(!($.hostname==="localhost"||$.hostname.endsWith(".localhost")||$.hostname==="127.0.0.1"))$.protocol="https:";return $};var P81=O(()=>{j81=class j81 extends Error{error;errorDescription;constructor($="invalid_grant",Z){super(Z??$);this.name="OAuthInvalidGrantError",this.error=$,this.errorDescription=Z}}});import{AsyncLocalStorage as F54}from"async_hooks";var Db$,wr;var A81=O(()=>{Db$=new F54,wr={getStore:()=>{return Db$.getStore()},run:($,Z,...G)=>Db$.run($,Z,...G)}});var Lb$="SELF",tL0=($)=>{return typeof $==="object"&&$!==null&&"handler"in $&&"events"in $&&typeof $.handler==="function"&&Array.isArray($.events)},zb$=($)=>{return typeof $==="object"&&$!==null&&"handler"in $&&"events"in $&&typeof $.handler==="function"&&Array.isArray($.events)},Eb$="::",jb$=($)=>{let Z=$.indexOf(Eb$);if(Z===-1)return null;let G=$.substring(0,Z),X=$.substring(Z+Eb$.length);return[G,X]},H54=($)=>{if(!$.startsWith("cron/"))return null;let Z=$.substring(5),G=Z.indexOf("/");if(G===-1)return null;let X=Z.substring(0,G),Y=Z.substring(G+1);return[X,Y]},Pb$=($)=>{if(tL0($))return[];return Object.keys($)},N54=($,Z)=>{if(tL0($))return $.events;let G=$[Z];if(!G)return[];if(zb$(G))return G.events;return Object.keys(G)},pL0=($,Z,G)=>{if($===Lb$){if(!G)return console.warn("[Event] SELF binding used but no connectionId available"),null;return G}let X=Z[$];if(!z81(X))return console.warn(`[Event] Binding "${$}" not found in state`),null;return X.value},B54=($,Z,G)=>{let X=Z;if(tL0($)){let Q=[];for(let J of $.events){let W=jb$(J);if(!W){console.warn(`[Event] Global handler event "${J}" must be prefixed with BINDING:: (e.g., "SELF::${J}" or "DATABASE::${J}")`);continue}let[K,U]=W,w=pL0(K,X,G);if(!w)continue;Q.push({eventType:U,publisher:w})}return Q}let Y=[];for(let Q of Pb$($)){let J=pL0(Q,X,G);if(!J)continue;let W=N54($,Q);for(let K of W)Y.push({eventType:K,publisher:J})}return Y},O54=($)=>{let Z=new Map;for(let G of $){let X=G.source,Y=Z.get(X)||[];Y.push(G),Z.set(X,Y)}return Z},D54=($)=>{let Z=new Map;for(let G of $){let X=G.type,Y=Z.get(X)||[];Y.push(G),Z.set(X,Y)}return Z},E54=($)=>{let Z={},G={},X=!1,Y=0,Q=[];for(let J of $){if(J.results)Object.assign(G,J.results);if(J.success===!1){if(X=!0,J.error)Q.push(J.error)}if(J.processedCount!==void 0)Y+=J.processedCount}if(Object.keys(G).length>0)Z.results=G;if(Z.success=!X,Q.length>0)Z.error=Q.join("; ");if(Y>0)Z.processedCount=Y;return Z},L54=async($,Z,G,X,Y)=>{let Q=X;if(tL0($)){let w=new Set;for(let H of $.events){let N=jb$(H);if(!N)continue;let[B,D]=N,E=pL0(B,Q,Y);if(!E)continue;w.add(`${E}:${D}`)}let F=Z.filter((H)=>{let N=`${H.source}:${H.type}`;return w.has(N)});if(F.length===0)return{success:!0};try{return await $.handler({events:F},G)}catch(H){return{success:!1,error:H instanceof Error?H.message:String(H)}}}let J=new Map;for(let w of Pb$($)){let F=pL0(w,Q,Y);if(F)J.set(F,w)}let W=O54(Z),K=[];for(let[w,F]of W){let H=J.get(w);if(!H)continue;let N=$[H];if(!N)continue;if(zb$(N)){K.push((async()=>{try{return await N.handler({events:F},G)}catch(E){let L={};for(let z of F)L[z.id]={success:!1,error:E instanceof Error?E.message:String(E)};return{results:L}}})());continue}let B=N,D=D54(F);for(let[E,L]of D){let z=B[E];if(!z)continue;K.push((async()=>{try{let j=await z({events:L},G),P={};for(let A of L)P[A.id]=j;return{results:P}}catch(j){let P={};for(let A of L)P[A.id]={success:!1,error:j instanceof Error?j.message:String(j)};return{results:P}}})())}}let U=await Promise.all(K);if(U.length===0)return{success:!0};return E54(U)},Ab$;var T81=O(()=>{fg();Ab$={subscriptions:B54,execute:L54,parseCron:H54}});function z54($,Z){let G=nL0("self",{meshUrl:$,token:Z});return Yv.forConnection(G)}function j54($,Z){switch(Z.type){case"cron":return{automation_id:$,type:"cron",cron_expression:Z.cron};case"event":return{automation_id:$,type:"event",connection_id:Z.connectionId,event_type:Z.eventType,params:Z.params};case"webhook":return{automation_id:$,type:"webhook"}}}function Tb$($,Z,G){return async(X)=>{if(!$)throw Error("createAgent: missing meshUrl in MESH_REQUEST_CONTEXT");let Y=z54($,Z),J=(await Y.COLLECTION_VIRTUAL_MCP_LIST({where:{operator:"and",conditions:[{field:["title"],operator:"eq",value:X.name}]},limit:1})).items.find((w)=>w.title===X.name);if(J)return{id:J.id,automations:[],automationIds:[],alreadyExisted:!0};let W=X.tools&&X.tools.length>0?X.tools.map((w)=>({connection_id:w.connectionId,selected_tools:w.tools??null,selected_resources:null,selected_prompts:null})):G?[{connection_id:G,selected_tools:null,selected_resources:null,selected_prompts:null}]:[],{item:K}=await Y.COLLECTION_VIRTUAL_MCP_CREATE({data:{title:X.name,description:X.description,metadata:X.instructions?{instructions:X.instructions}:void 0,connections:W}}),U=[];for(let w of X.automations??[]){let F=await Y.AUTOMATION_CREATE({name:w.name,virtual_mcp_id:K.id,messages:w.messages,models:w.models,tools:w.tools,active:w.active??!0}),H=[];for(let N of w.triggers??[])try{let B=await Y.AUTOMATION_TRIGGER_ADD(j54(F.id,N));H.push({type:N.type,ok:!0,id:B.id,webhook:B.webhook??void 0})}catch(B){H.push({type:N.type,ok:!1,error:B instanceof Error?B.message:String(B)})}U.push({id:F.id,name:w.name,triggers:H})}return{id:K.id,automations:U,automationIds:U.map((w)=>w.id),alreadyExisted:!1}}}var I81=O(()=>{fg();iL0()});import{z as FZ}from"zod";function gw($){return{...$,execute:(Z)=>{let G=Fr(Z.runtimeContext);return $.execute({...Z,runtimeContext:G},G)}}}var Fr=($)=>{let Z=wr.getStore();if(!Z){if($)return $;throw Error("Missing context, did you forget to call State.bind?")}return Z},Ib$=($)=>{let Z=$.runtimeContext.env.MESH_REQUEST_CONTEXT;return{connectionId:Z?.connectionId,meshUrl:Z?.meshUrl,token:Z?.token}},P54=({events:$,configuration:{state:Z,scopes:G,onChange:X,onInstall:Y}={}}={})=>{let Q=Z?Jb$(FZ.toJSONSchema(Z)):{type:"object",properties:{}};return[...X||Y||$?[gw({id:"ON_MCP_CONFIGURATION",description:"MCP Configuration On Change",inputSchema:FZ.object({state:Z??FZ.unknown(),scopes:FZ.array(FZ.string()).describe("Array of scopes in format 'KEY::SCOPE' (e.g., 'GMAIL::GetCurrentUser')"),firstRun:FZ.boolean().optional().describe("True on the first configuration save for this connection \u2014 fires onInstall."),vault:FZ.object({baseUrl:FZ.string(),org:FZ.string(),subjectConnectionId:FZ.string(),token:FZ.string()}).optional()}),outputSchema:FZ.object({}),execute:async(J)=>{let W=J.context.state,K=J.context.vault;if(await X?.(J.runtimeContext.env,{state:W,scopes:J.context.scopes,vault:K}),Y&&J.context.firstRun){let{meshUrl:U,token:w,connectionId:F}=Ib$(J);await Y(J.runtimeContext.env,{createAgent:Tb$(U,w,F),vault:K})}return Promise.resolve({})}})]:[],...$?.handlers?[gw({id:"ON_EVENTS",description:"Receive and process CloudEvents from the event bus. Returns per-event or batch results.",inputSchema:E50,outputSchema:L50,execute:async(J)=>{let W=J.runtimeContext.env,K=W.MESH_REQUEST_CONTEXT?.state,{connectionId:U}=Ib$(J);return Ab$.execute($.handlers,J.context.events,W,K,U)}})]:[],gw({id:"MCP_CONFIGURATION",description:"MCP Configuration",inputSchema:FZ.object({}),outputSchema:FZ.object({stateSchema:FZ.unknown(),scopes:FZ.array(FZ.string()).optional()}),execute:()=>{return Promise.resolve({stateSchema:Q,scopes:[...G??[]]})}})]},Rb$=($)=>{let Z=null,G=null,X=null,Y=!1,Q=()=>{if(!Y)console.warn("[runtime] Passing factory functions to tools/prompts/resources is deprecated. Pass createTool()/createPrompt()/createResource() instances directly."),Y=!0},J=(N)=>typeof N==="object"&&N!==null&&(("id"in N)||("name"in N)||("uri"in N));async function W(N,B){if(!N)return[];return(await Promise.all(N.flatMap(async(D)=>{if(J(D))return[D];Q();let E=await D(B);if(Array.isArray(E))return E;return[E]}))).flat()}let K=async(N)=>{if(Z)return Z;if(G)return G;return G=(async()=>{try{let B;if(typeof $.tools==="function")Q(),B=await $.tools(N);else B=await W($.tools,N);B.push(...P54({...$}));let D;if(typeof $.prompts==="function")Q(),D=await $.prompts(N);else D=await W($.prompts,N);let E;if(typeof $.resources==="function")Q(),E=await $.resources(N);else E=await W($.resources,N);let L={tools:B,prompts:D,resources:E};return Z=L,L}catch(B){throw G=null,B}})(),G},U=(N,B)=>{for(let D of B.tools)N.registerTool(D.id,{_meta:D._meta,title:D.title,description:D.description,annotations:D.annotations,inputSchema:D.inputSchema&&"shape"in D.inputSchema?D.inputSchema:FZ.object({}),outputSchema:D.outputSchema&&typeof D.outputSchema==="object"&&"shape"in D.outputSchema?D.outputSchema:void 0},async(E)=>{let L=Fr(),z=await D.execute({context:E,runtimeContext:L},L);if(z!=null&&typeof z==="object"&&"content"in z&&Array.isArray(z.content)&&z.content.every((j)=>j!=null&&typeof j==="object"&&("type"in j)&&typeof j.type==="string"))return z;return{structuredContent:z,content:[{type:"text",text:JSON.stringify(z)}]}});for(let D of B.prompts)N.registerPrompt(D.name,{title:D.title,description:D.description,argsSchema:D.argsSchema?D.argsSchema:FZ.object({}).shape},async(E)=>{let L=Fr();return await D.execute({args:E,runtimeContext:L},L)});for(let D of B.resources)N.resource(D.name,D.uri,{description:D.description,mimeType:D.mimeType},async(E)=>{let L=Fr(),z=await D.read({uri:E,runtimeContext:L},L),j=z._meta??void 0;if(z.text!==void 0)return{contents:[{uri:z.uri,mimeType:z.mimeType,text:z.text,...j!==void 0?{_meta:j}:{}}]};else if(z.blob!==void 0)return{contents:[{uri:z.uri,mimeType:z.mimeType,blob:z.blob,...j!==void 0?{_meta:j}:{}}]};return{contents:[{uri:z.uri,mimeType:z.mimeType,text:""}]}})},w=async(N)=>{await $.before?.(N);let{instructions:B,...D}=$.serverInfo??{},E=new NU({...D,name:D.name??"@deco/mcp-api",version:D.version??"1.0.0"},{capabilities:{tools:{},prompts:{},resources:{}},jsonSchemaValidator:z5,...B&&{instructions:B}}),L=await K(N);U(E,L);let z="tools/list",j=E.server._requestHandlers,P=j.get(z);if(P)j.set(z,async(A,M)=>{if(!X)X=await P(A,M);return X});return{server:E,...L}};return{fetch:async(N,B)=>{let{server:D}=await w(B),E=new vY;await D.connect(E);let L=()=>{try{E.close?.()}catch{}try{D.close?.()}catch{}};try{let z=await E.handleRequest(N),j=z.headers.get("content-type");if(!(j?.includes("text/event-stream")||j?.includes("application/json-rpc"))||!z.body)return L(),z;let{readable:A,writable:M}=new TransformStream;return z.body.pipeTo(M).catch(()=>{}).finally(L),new Response(A,{status:z.status,statusText:z.statusText,headers:z.headers})}catch(z){throw L(),z}},callTool:async({toolCallId:N,toolCallInput:B})=>{let D=wr.getStore();if(!D)throw Error("Missing state, did you forget to call State.bind?");let E=D?.env,{tools:L}=await K(E),j=L.find((A)=>A.id===N)?.execute;if(!j)throw Error(`Tool ${N} not found or does not have an execute function`);let P=Fr();return j({context:B,runtimeContext:P},P)}}};var rL0=O(()=>{au0();jG();vu();Xy();fg();T81();A81();I81();T81();I81()});import{decodeJwt as qb$}from"jose";var A54=({env:$,server:Z,url:G})=>{$.SELF=new Proxy({},{get:(X,Y)=>{if(Y==="toJSON")return null;return async(Q)=>{return await Z.callTool({toolCallId:Y,toolCallInput:Q})}}}),$.IS_LOCAL=(G?.startsWith("http://localhost")||G?.startsWith("http://127.0.0.1"))??!1},Mb$=($)=>()=>{return{...$??{}}},T54=({env:$,server:Z,tokenOrContext:G,url:X,authToken:Y})=>{let Q=$,J=Y?Y.split(" ")[1]:void 0,W;if(typeof G==="string"){let K=qb$(G),U=K.metadata??{};W={authorization:J,state:K.state??U.state??{},token:G,meshUrl:K.meshUrl??U.meshUrl,connectionId:K.connectionId??U.connectionId,organizationId:K.organizationId??U.organizationId,organizationName:K.organizationName??U.organizationName,organizationSlug:K.organizationSlug??U.organizationSlug,ensureAuthenticated:Mb$(K.user??K.sub)}}else if(typeof G==="object"){W=G;let K=qb$(G.token),U=K.metadata??{},w=K.appName;W.authorization??=J,W.callerApp=w,W.connectionId??=K.connectionId??U.connectionId,W.organizationId??=K.organizationId??U.organizationId,W.organizationName??=K.organizationName??U.organizationName,W.organizationSlug??=K.organizationSlug??U.organizationSlug,W.ensureAuthenticated=Mb$(K.user??K.sub)}else W={state:{},authorization:J,token:void 0,meshUrl:void 0,connectionId:void 0,ensureAuthenticated:()=>{throw Error("Unauthorized")}};return Q.MESH_REQUEST_CONTEXT=W,W.state=Wb$(W),A54({env:Q,server:Z,url:X}),Q},I54,kb$=($)=>{let Z=Rb$($),G=$.cors??I54,X=$.oauth,Y=X?Ob$(X):null,Q=async(J,W,K)=>{let U=new URL(J.url);if(Y){if(U.pathname==="/.well-known/oauth-protected-resource"||U.pathname==="/mcp/.well-known/oauth-protected-resource")return Y.handleProtectedResourceMetadata(J);if(U.pathname==="/.well-known/oauth-authorization-server")return Y.handleAuthorizationServerMetadata(J);if(U.pathname==="/authorize")return Y.handleAuthorize(J);if(U.pathname==="/oauth/callback")return Y.handleOAuthCallback(J);if(U.pathname==="/token"&&J.method==="POST")return Y.handleToken(J);if((U.pathname==="/register"||U.pathname==="/mcp/register")&&J.method==="POST")return Y.handleClientRegistration(J)}if(U.pathname==="/mcp"){if(J.method==="GET")return new Response("Method not allowed",{status:405});if(Y&&!Y.hasAuth(J)){let w=J.clone();try{if((await w.json())?.method!=="tools/list")return Y.createUnauthorizedResponse(J)}catch{return Y.createUnauthorizedResponse(J)}}return Z.fetch(J,W,K)}if(U.pathname.startsWith("/mcp/call-tool")){let w=U.pathname.split("/").pop();if(!w)return new Response("Not found",{status:404});let F=await J.json(),H=await Z.callTool({toolCallId:w,toolCallInput:F});return new Response(JSON.stringify(H),{headers:{"Content-Type":"application/json"}})}return $.fetch?.(J,W,K)||new Response("Not found",{status:404})};return{fetch:async(J,W,K)=>{if(new URL(J.url).pathname==="/_healthcheck")return new Response("OK",{status:200});if(G!==!1&&J.method==="OPTIONS")return Ub$(J,G??{});let U=T54({authToken:J.headers.get("authorization")??null,env:{...process.env,...W},server:Z,tokenOrContext:J.headers.get("x-mesh-token")??void 0,url:J.url}),w=await wr.run({req:J,env:U,ctx:K},async()=>await Q(J,U,K));if(G!==!1)return wb$(w,J,G??{});return w}}};var Sb$=O(()=>{fg();Fb$();P81();P81();A81();rL0();rL0();fg();iL0();I54={origin:($)=>{if($.includes("localhost")||$.includes("127.0.0.1"))return $;return $},credentials:!0,allowMethods:["GET","POST","PUT","DELETE","OPTIONS"],allowHeaders:["Content-Type","Authorization","mcp-protocol-version"]}});import{z as R81}from"zod";function M54($,Z){let G=gw({id:"COLLECTION_REGISTRY_APP_LIST",description:"List public registry items",annotations:{readOnlyHint:!0,idempotentHint:!0},inputSchema:ty,outputSchema:ry,execute:async({context:W})=>{let K={limit:W.limit,offset:W.offset,cursor:W.cursor,tags:W.tags,categories:W.categories,where:W.where},U=`${Z}:${JSON.stringify(K)}`,w=Vb$.get(U);if(w)return w;let F=await $.listPublic(Z,K);return Vb$.set(U,F),F}}),X=gw({id:"COLLECTION_REGISTRY_APP_GET",description:"Get a public registry item by ID or name",annotations:{readOnlyHint:!0,idempotentHint:!0},inputSchema:FK,outputSchema:GC,execute:async({context:W})=>{let K=W.id??W.name;if(!K)return{item:null};let U=await $.findByIdOrName(Z,K);if(U&&U.is_public)return{item:U};return{item:null}}}),Y=gw({id:"COLLECTION_REGISTRY_APP_VERSIONS",description:"Get available versions of a public registry item",annotations:{readOnlyHint:!0,idempotentHint:!0},inputSchema:FK,outputSchema:R81.object({versions:R81.array(GC.shape.item)}),execute:async({context:W})=>{let K=W.id??W.name;if(!K)return{versions:[]};let U=await $.findByIdOrName(Z,K);if(U&&U.is_public)return{versions:[U]};return{versions:[]}}}),Q=gw({id:"COLLECTION_REGISTRY_APP_SEARCH",description:"Search public registry items returning minimal data (id, title, tags, categories, is_public). Use this instead of LIST when you need to find items efficiently without loading full details.",annotations:{readOnlyHint:!0,idempotentHint:!0},inputSchema:QE0,outputSchema:JE0,execute:async({context:W})=>{return await $.search(Z,W,{publicOnly:!0})}}),J=gw({id:"COLLECTION_REGISTRY_APP_FILTERS",description:"Get available tags and categories for public registry items",annotations:{readOnlyHint:!0,idempotentHint:!0},inputSchema:R81.object({}),outputSchema:oy,execute:async()=>{return await $.getFilters(Z,{publicOnly:!0})}});return[G,Q,X,Y,J]}function Cb$($){let Z=$.db,G=new Jx(Z);return async(X)=>{let Y=X.req.param("orgSlug")??X.req.param("org");if(!Y)return X.json({error:"Organization not found"},404);let Q=await Z.selectFrom("organization").select(["id","slug","name"]).where("slug","=",Y).executeTakeFirst();if(!Q)return X.json({error:"Organization not found"},404);let J=M54(G,Q.id),W=kb$({tools:J}),K=new URL(X.req.url),U=X.req.path.indexOf("/registry"),w=U>=0?X.req.path.slice(U+9):"",F=new URL(w||"/",K.origin);K.searchParams.forEach((B,D)=>{F.searchParams.set(D,B)});let H=new Request(F.toString(),{method:X.req.method,headers:X.req.raw.headers,body:X.req.method!=="GET"&&X.req.method!=="HEAD"?X.req.raw.body:void 0}),N={organizationId:Q.id,db:Z,MESH_REQUEST_CONTEXT:{},MESH_APP_DEPLOYMENT_ID:"public-registry",IS_LOCAL:!1};return await W.fetch(H,N,X)}}var R54=3600000,q54=500,Vb$;var _b$=O(()=>{Sb$();rL0();oy0();Q9();Vb$=_g({ttlMs:R54,maxSize:q54,updateRecencyOnGet:!0})});import{sql as k54}from"kysely";import{randomUUID as bb$}from"crypto";import{z as S54}from"zod";async function C54($){let Z=new Date().toISOString(),G=bb$(),X=G4.SELF($.organizationId),Y="registry.publish_request.created",Q={requestId:$.request.id,requestedId:$.request.requested_id,title:$.request.title,status:$.request.status,createdAt:$.request.created_at,requester:{name:$.request.requester_name,email:$.request.requester_email}};await $.db.insertInto("events").values({id:G,organization_id:$.organizationId,type:"registry.publish_request.created",source:X,specversion:"1.0",subject:$.request.id,time:Z,datacontenttype:"application/json",dataschema:null,data:JSON.stringify(Q),cron:null,status:"pending",attempts:0,last_error:null,next_retry_at:null,created_at:Z,updated_at:Z}).execute();let J=await $.db.selectFrom("event_subscriptions").select(["id"]).where("organization_id","=",$.organizationId).where("enabled","=",1).where("event_type","=","registry.publish_request.created").where((W)=>W.or([W("publisher","is",null),W("publisher","=",X)])).execute();if(J.length>0)await $.db.insertInto("event_deliveries").values(J.map((W)=>({id:bb$(),event_id:G,subscription_id:W.id,status:"pending",attempts:0,last_error:null,delivered_at:null,next_retry_at:null,created_at:Z}))).execute();try{await k54`SELECT pg_notify('mesh_events', ${G})`.execute($.db)}catch{}}async function _54($,Z){let X=(await $.selectFrom("organization").select(["id"]).where("id","=",Z).execute())[0];if(X?.id)return X.id;return(await $.selectFrom("organization").select(["id"]).where("slug","=",Z).execute())[0]?.id??null}async function b54($,Z){let G=await $.selectFrom("virtual_mcp_plugin_configs").innerJoin("connections","connections.id","virtual_mcp_plugin_configs.virtual_mcp_id").select(["virtual_mcp_plugin_configs.settings as settings"]).where("connections.organization_id","=",Z).where("virtual_mcp_plugin_configs.plugin_id","=",XC).execute();for(let X of G){let Y=X.settings,Q=typeof Y==="string"?(()=>{try{return JSON.parse(Y)}catch{return{}}})():Y??{};if(Q.acceptPublishRequests===!0){let J=Q.rateLimitWindow==="minute"?"minute":"hour",W=Q.rateLimitMax,K=typeof W==="number"&&Number.isFinite(W)&&W>=1?Math.floor(W):xb$;return{acceptPublishRequests:!0,requireApiToken:Q.requireApiToken===!0,rateLimitEnabled:Q.rateLimitEnabled===void 0?fb$:Q.rateLimitEnabled===!0,rateLimitWindow:J,rateLimitMax:K}}}return{acceptPublishRequests:!1,requireApiToken:!1,rateLimitEnabled:fb$,rateLimitWindow:V54,rateLimitMax:xb$}}async function f54($,Z,G){let X=G==="minute"?60000:3600000,Y=new Date(Date.now()-X).toISOString(),Q=await $.selectFrom("private_registry_publish_request").select((J)=>J.fn.countAll().as("count")).where("organization_id","=",Z).where("created_at",">=",Y).executeTakeFirst();return Number(Q?.count??0)}async function x54($,Z,G,X){let Y=await $.selectFrom("private_registry_item").select(["id","title"]).where("organization_id","=",Z).where((Q)=>Q.or([Q("id","=",G),Q("title","=",X)])).executeTakeFirst();return Y?{id:String(Y.id),title:String(Y.title)}:null}function vb$($){let{db:Z,db:G}=$,X=new Wx(G),Y=new Kx(G);return async(Q)=>{let J=Q.req.param("orgRef")??Q.req.param("org");if(!J)return Q.json({error:"Organization not found"},404);let W=await _54(Z,J);if(!W)return Q.json({error:"Organization not found"},404);let K=await b54(Z,W);if(!K.acceptPublishRequests)return Q.json({error:"Publish requests are not enabled for this registry."},403);if(K.requireApiToken){let N=Q.req.header("Authorization"),B=N?.startsWith("Bearer ")?N.slice(7).trim():null;if(!B)return Q.json({error:"API key required. Use Authorization: Bearer <key>"},401);if(!await Y.validate(W,B))return Q.json({error:"Invalid API key"},401)}if(K.rateLimitEnabled){if(await f54(G,W,K.rateLimitWindow)>=K.rateLimitMax)return Q.json({error:"Too many publish requests. Please try again later.",retryAfterSeconds:K.rateLimitWindow==="minute"?60:3600},429)}let U;try{U=await Q.req.json()}catch{return Q.json({error:"Invalid JSON body"},400)}let w=fP$.safeParse(U);if(!w.success)return Q.json({error:"Invalid publish request payload",details:S54.treeifyError(w.error)},400);let F=await x54(G,W,w.data.data.id,w.data.data.title);if(F)return Q.json({error:"A registry item with the same id or title already exists. Please use a different name/id.",conflict:F},409);let H=await X.createOrUpdate({organization_id:W,requested_id:w.data.data.id,title:w.data.data.title,description:w.data.data.description??null,_meta:w.data.data._meta,server:w.data.data.server,requester_name:w.data.requester?.name??null,requester_email:w.data.requester?.email??null});try{await C54({db:Z,organizationId:W,request:H})}catch(N){console.warn("[private-registry] failed to emit publish-request event:",N)}return i1.capture({distinctId:w.data.requester?.email??`org:${W}`,event:"registry_publish_request_submitted",groups:{organization:W},properties:{organization_id:W,request_id:H.id,requested_id:H.requested_id,title:w.data.data.title,requester_email:w.data.requester?.email??null}}),Q.json({id:H.id,requested_id:H.requested_id,status:H.status},201)}}var fb$=!0,V54="hour",xb$=100;var yb$=O(()=>{q4();f8();ay();ay0();sy0();Q9()});var gb$={};X6(gb$,{createPublishRequestHandler:()=>vb$,createPublicMCPHandler:()=>Cb$});var hb$=O(()=>{_b$();yb$()});var Rp0={};X6(Rp0,{watchHandler:()=>mb$,getProxyDispatch:()=>h54,createApp:()=>t54});import{readFileSync as v54}from"fs";import{PrometheusSerializer as y54}from"@opentelemetry/exporter-prometheus";import{DBOS as xg}from"@dbos-inc/dbos-sdk";import{oAuthDiscoveryMetadata as l54,oAuthProtectedResourceMetadata as m54}from"better-auth/plugins";async function g54($){let Z=$.connect(),G;try{G=await Promise.race([Z,ub$(cb$)])}catch{return Z.then((X)=>X.release(!0)).catch(()=>{}),!1}try{return await Promise.race([G.query("SELECT 1"),ub$(cb$)]),G.release(),!0}catch{return G.release(!0),!1}}function ub$($){return new Promise((Z,G)=>setTimeout(()=>G(Error("pg health-check timeout")),$))}function h54(){if(!q81)throw Error("getProxyDispatch() called before createApp() or without NATS \u2014 proxy dispatch unavailable");return q81}async function c54($,Z){let{items:G}=await $.storage.connections.list(Z,{where:{field:["connection_url"],operator:"like",value:`${T_1}%`},limit:1}),X=G[0];if(!X?.configuration_state)return null;return X.configuration_state.project_locator}function u54($){let Z=new URLSearchParams;if($){let[G,X]=$.split("/");if(G)Z.set("workspace_hint",G);if(X)Z.set("project_hint",X)}else Z.set("auto_personal","true");return Z.set("force_new","true"),Z}async function t54($={}){let Z=$.database??H6(),G=!1;Z9.stop().catch((g)=>{console.error("[SSEHub] Error stopping previous broadcast (HMR cleanup):",g)});let X,Y,Q=new e$1,J,W,K,U,w,F=null;if($.disableNats)J=$81(),X={get:async()=>null,set:async()=>{},invalidate:async()=>{},teardown:()=>{}},Y=new wp,W={start:async()=>{},broadcast:()=>{},publishControlFrame:()=>{},stop:async()=>{}},w=void 0,K={init:async()=>{},pump:(g)=>{return(async()=>{let H0=g.getReader();try{while(!0){let{done:f0}=await H0.read();if(f0)break}}catch{}finally{H0.releaseLock()}})()},publishRawChunk:async()=>!1,publishDone:async()=>!1,createTailStream:async()=>null,purge:()=>{},teardown:()=>{}};else{F=dC$();let g=O1().natsCredsPath,H0;if(g)try{H0=v54(g,"utf8")}catch(e1){console.error(`[app] failed to read NATS_CREDS at ${g}; connecting anonymously`,e1)}F.init(O1().natsUrls,H0?{creds:H0}:void 0);let f0=Yg0()?new rx0({getJetStream:()=>F.getJetStream()}):null;f0?.init().catch(()=>{}),X=f0;let e0=new Pt0({getJetStream:()=>F.getJetStream()});e0.init().catch(()=>{}),Y=e0,J=$81({getConnection:()=>F.getConnection()}),W=new Z81({getConnection:()=>F.getConnection()}),K=new Y81({getConnection:()=>F.getConnection(),getJetStream:()=>F.getJetStream()}),U=P_$({getConnection:()=>F.getConnection()}),w=M_$({getConnection:()=>F.getConnection()});let u0=k_$({getConnection:()=>F.getConnection()}),T1=W;W={start:(e1)=>T1.start(e1),broadcast:(e1)=>T1.broadcast(e1),publishControlFrame:(e1,z6)=>{u0.publishControlFrame(e1,z6).catch((J4)=>{console.warn("[TunnelControl] publishControlFrame failed (non-critical):",J4)})},stop:()=>T1.stop()},wI$(F),F.onReady(()=>{f0?.init().catch((e1)=>{console.error("[McpListCache] Deferred init failed:",e1)}),e0.init().catch((e1)=>{console.error("[ConnectionCircuitStore] Deferred init failed:",e1)}),J.start(),Oi1(()=>F.getConnection()),K.init().catch((e1)=>{console.warn("[Decopilot] StreamBuffer init failed (late-join disabled):",e1)})})}if(vg)await vg();ox0(X),At0(Y);let N={storage:new Ox(Z.db),sseHub:Z9},B=new Em0(N),D=new $m(Z.db),E=new K81(D);E.start(),W.start((g)=>{b90(g),B.execute({type:"CANCEL",taskId:g}).catch((H0)=>{console.error("[Decopilot] CancelBroadcast execute failed:",H0)})}).catch((g)=>{console.error("[Decopilot] CancelBroadcast start failed:",g)}),F?.onReady(()=>{W.start().catch((g)=>{console.error("[CancelBroadcast] Deferred start failed:",g)})}),K.init().catch((g)=>{console.warn("[Decopilot] StreamBuffer init failed, attach/late-join disabled:",g)}),vg=async()=>{await B.stopAll(),B.dispose(),E.dispose(),W.stop().catch(()=>{}),K.teardown(),X?.teardown(),Q.teardown(),J.teardown(),Di1(),Y.teardown(),ox0(null),At0(null)};let L=new b1;if(L.use("*",nb0({enabled:(g)=>vb(g,"debug")==="1"})),L.use("*",Bz0),L.use("/*",Kb1({origin:(g)=>{if(g.includes("localhost")||g.includes("127.0.0.1"))return g;return g},credentials:!0,allowMethods:["GET","POST","PUT","DELETE","OPTIONS"],allowHeaders:["Content-Type","Authorization","mcp-protocol-version"],exposeHeaders:["WWW-Authenticate"]})),L.use("*",async(g,H0)=>{if(await H0(),g.req.path.includes("/files/"))return;if(g.req.path.includes("/fs/")&&g.req.path.endsWith("/read"))return;g.header("X-Frame-Options","DENY"),g.header("Content-Security-Policy","frame-ancestors 'none'")}),!O1().noTui)L.use("*",h_$());L.use("*",async(g,H0)=>{if(await H0(),cg(g.req.path))return;if(g.res.status>=500){let e0=await g.res.clone().text();console.error(`[5xx Response] ${g.req.method} ${g.req.path} - ${g.res.status}:`,e0)}}),L.get(xZ.HEALTH,(g)=>{if(G)return g.json({status:"shutting_down"},503);return g.json({status:"ok"})}),L.get(xZ.HEALTH_LIVE,(g)=>{return g.json({status:"ok"})}),L.get(xZ.HEALTH_READY,async(g)=>{if(G)return g.json({status:"shutting_down"},503);let H0={};if(H0.postgres={status:await g54(Z.pool)?"up":"down"},F)H0.nats=F.isConnected()?{status:"up"}:{status:"down"};else H0.nats={status:"down"};let f0=H0.postgres.status==="up",e0=f0?200:503;return g.json({status:f0?"ready":"not_ready",services:H0},e0)}),L.get(xZ.METRICS,async(g)=>{try{let H0=await Lz0.collect(),f0=d54.serialize(H0.resourceMetrics);return g.text(f0,200,{"Content-Type":"text/plain; version=0.0.4; charset=utf-8"})}catch(H0){return console.error("Failed to collect metrics:",H0),g.text("# Error collecting metrics",500)}}),L.get(`${xZ.DBOS_QUEUE_DEPTH_PREFIX}:queueName`,async(g)=>{let H0=g.req.param("queueName");if(!i54.has(H0))return g.json({error:`Unknown queue: ${H0}`},404);let f0=await xg.listQueuedWorkflows({queueName:H0,status:"ENQUEUED"});return g.json({queue_length:f0.length})}),L.get(xZ.HOSTED_RUN_PENDING,(g)=>{let{active:H0,pending:f0,max:e0}=x4$();return g.json({pending:f0,active:H0,max:e0})}),L.route("/api/config",UC$),L.route("/api/_reports",PC$),L.route("/report",OC$($.clientDir)),L.route("/api/auth/custom",CI$),L.all("/api/auth/admin/*",fI$),L.all("/api/auth/*",async(g)=>{return await d8.handler(g.req.raw)});let z=ta1();z.use("/.well-known/oauth-protected-resource/mcp/:connectionId",WC),z.use("/mcp/:connectionId/.well-known/oauth-protected-resource",WC),L.route("/",z),L.get("/.well-known/oauth-protected-resource/api/:org/mcp/:connectionId",Si),L.route("/",sa1()),L.use("/oauth-proxy/:connectionId/*",WC),L.all("/oauth-proxy/:connectionId/*",db$);let j=async(g)=>{let f0=await n54()(g.req.raw),e0=await f0.json();return Response.json(e0,f0)};L.use("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",WC),L.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",j);let P=async(g)=>{let f0=await p54()(g.req.raw),e0=await f0.json();return Response.json(e0,f0)};L.get("/.well-known/oauth-authorization-server/*/:gateway?/:connectionId?",P);let A=UI$({ttlMs:120000}),M=await fa1({db:Z.db,auth:d8,encryption:{key:O1().encryptionKey},observability:{tracer:cw,meter:D8},modelListCache:Q,providerKeyCache:J,memberRoleCache:A,linkStatusProbe:U,publishLinkControlFrame:(g,H0)=>W.publishControlFrame(g,H0)});XN.set(M);let S=new jU(O1().encryptionKey);O21({db:Z.db,baseUrl:j3()});let R=Y60(Z.db),V=new nl(Z.db),i=x_$({db:Z.db});Dt0({storage:R,studioContextFactory:i}),Cm0({studioContextFactory:i,deps:{runRegistry:B,cancelBroadcast:W,streamBuffer:K,sseHub:Z9},prepareLinkWorkFn:qq$,workPublisher:w}),qm0({dispatchRunFn:Iq$,studioContextFactory:i,deps:{runRegistry:B,cancelBroadcast:W,streamBuffer:K,sseHub:Z9}});let f=new Ox(Z.db),v=new Zm(Z.db);L4$({getJetStream:()=>F?.getJetStream()??null,getJetStreamManager:async()=>{let g=F?.getConnection();return g?await lb$.jetstreamManager(g):null},messageParts:f.messageParts(),resolveRun:async(g)=>{let H0=await Z.db.selectFrom("threads").select(["organization_id","created_by","message_storage_version","status","run_fence_token","title"]).where("id","=",g).executeTakeFirst();return H0?{orgId:H0.organization_id,createdBy:H0.created_by,version:H0.message_storage_version??1,status:H0.status,runFenceToken:H0.run_fence_token,title:H0.title??null}:null},completeRunIfNotCompleted:async(g,H0)=>{let f0=await f.completeRunIfNotCompleted(g,H0);if(uL0(Z9,H0,g,f0),f0)await Tm0(v,g,H0);return f0},markRunRequiresAction:async(g,H0)=>{let f0=await f.requiresActionIfInProgress(g,H0);return uL0(Z9,H0,g,f0),f0},markRunFailed:async(g,H0,f0,e0)=>{let u0=await f.markRunFailed(g,H0,f0,e0);if(uL0(Z9,H0,g,u0),u0)await Tm0(v,g,H0);return u0},clearSynthesizedError:async(g,H0)=>{await f.messageParts().replaceMessageParts(g,jN(g,H0),[])},persistTitle:(g,H0,f0)=>f.update(g,H0,{title:f0}),onTitleUpdated:async({runId:g,orgId:H0,title:f0})=>{let e0=await f.get(g,H0).catch(()=>null);Z9.emit(H0,_3(g,e0?.status??"in_progress",{title:f0,virtualMcpId:e0?.virtual_mcp_id??void 0,createdBy:e0?.created_by,triggerId:e0?.trigger_id,branch:e0?.branch??null,createdAt:e0?.created_at,updatedAt:e0?.updated_at}))},bumpProgress:async({runId:g,orgId:H0})=>{await f.bumpProgress(g,H0)},recordCompleted:async({runId:g,orgId:H0,distinctId:f0,usage:e0})=>{i1.capture({distinctId:f0,event:"chat_message_completed",groups:{organization:H0},properties:{organization_id:H0,thread_id:g,transport:"projector",input_tokens:e0.inputTokens,output_tokens:e0.outputTokens,total_tokens:e0.totalTokens}})},recordFailed:async({runId:g,orgId:H0,distinctId:f0,reason:e0,kind:u0})=>{i1.capture({distinctId:f0,event:"chat_message_failed",groups:{organization:H0},properties:{organization_id:H0,thread_id:g,transport:"projector",error_category:u0,error_message:e0}})},purgeRun:async(g)=>{K.purge(g)}}),aJ$({studioContextFactory:i,systemDatabaseUrl:_x1(O1().databaseUrl,O1().databasePgSsl),streamBuffer:K}),b_$(),D21();let Z0=async(g,H0,f0)=>{let e0=await R.findById(g,H0);if(!e0)throw Error("Automation not found");return zt0({automationId:e0.id,organizationId:e0.organization_id,triggerId:null})},o=new Hg(R,({automation:g,trigger:H0,contextMessages:f0,idempotencyKey:e0})=>Kp({automationId:g.id,organizationId:g.organization_id,triggerId:H0.id,contextMessages:f0},{idempotencyKey:e0})),B0=[eQ(),qC(),RK()];for(let g of B0)mL0(g).then(()=>{}).catch((H0)=>console.error("[monitoring] Retention cleanup failed:",H0));let D0=()=>Z.db.deleteFrom("apikey").where("expiresAt","<",new Date).execute().then(()=>{}).catch((g)=>console.error("[auth] Expired API key cleanup failed:",g));D0(),setInterval(D0,86400000).unref(),L.use("*",async(g,H0)=>{if(Hz0(g.req.path))return H0();let f0={measure:async(u0,T1)=>{UQ(g,u0);try{return await T1()}finally{JY(g,u0)}}},e0=await XN.create(g.req.raw,{timings:f0});e0.automationRunner=Z0,g.set("studioContext",e0);try{await H0()}finally{let u0=e0.pendingRevalidations;if(u0.length>0)Promise.race([Promise.allSettled(u0),O8(30000)]).catch((e1)=>console.error("[mesh] revalidation cleanup error:",e1))}}),L.use("/api/:org/decopilot/*",KC),L.use("/api/:org/v1/*",KC),L.use("/api/:org/files/*",KC),L.use("*",async(g,H0)=>{let f0=g.req.path;if(f0.startsWith("/api/org-sso/")||f0.startsWith("/api/auth/")||f0.startsWith("/api/tools/management")||f0.startsWith("/oauth-proxy/")||f0.startsWith(`${Z01}/`))return H0();let e0=g.get("studioContext");if(!e0?.organization?.id||!e0?.auth?.user?.id)return H0();if(!(await e0.storage.orgSsoConfig.getByOrgId(e0.organization.id))?.enforced)return H0();if(!await e0.storage.orgSsoSessions.isValid(e0.auth.user.id,e0.organization.id))return g.json({error:"SSO authentication required for this organization"},403);return H0()});let J0=new b1;J0.use("*",pQ({mountPath:"/api/org-sso"})),J0.route("/",jE0()),L.route("/api/org-sso",J0),L.get("/api/tools/management",(g)=>{return g.json({tools:tb0,grouped:tO()})}),L.use("/mcp/*",async(g,H0)=>{UQ(g,"mcp");try{return await H0()}finally{JY(g,"mcp")}});let Y0=async(g,H0)=>{let f0=g.var.studioContext;if(!f0.auth.user?.id&&!f0.auth.apiKey?.id){let e0=new URL(g.req.url);return g.res=new Response(null,{status:401,headers:{"WWW-Authenticate":`Bearer realm="mcp",resource_metadata="${e0.origin}${e0.pathname}/.well-known/oauth-protected-resource"`}})}return await H0()};if(L.use("/mcp/:connectionId?",Y0),L.use("/mcp/gateway/:virtualMcpId?",Y0),L.use("/mcp/virtual-mcp/:virtualMcpId?",Y0),L.use("/mcp/self",Y0),b3()){let{mountDevRoutes:g}=(Gb$(),Zz0(Zb$));g(L,Y0)}let a=new b1;a.use("*",pQ({mountPath:"/mcp"})),a.route("/",JB0()),L.route("/mcp",a);let A0=new b1;A0.use("*",pQ({mountPath:"/mcp/self"})),A0.route("/",SL0()),L.route("/mcp/self",A0);let U0=new b1;U0.use("*",pQ({mountPath:"/mcp"})),U0.route("/",UB0()),L.route("/mcp",U0),L.use("/api/:org/models/*",async(g,H0)=>{UQ(g,"llm_models");try{return await H0()}finally{JY(g,"llm_models")}});let v0=$11({cancelBroadcast:W,streamBuffer:K,runRegistry:B,linkStatusProbe:U});if(L.route("/api",v0),F!=null)q81=T_$({getConnection:()=>F?.getConnection()??null});L.route("/api",nV$()),L.get("/api/links/me",async(g)=>{try{let H0=g.req.header("authorization")??"",f0=/^Bearer\s+(.+)$/i.exec(H0),e0=null;if(f0){let T1=(f0[1]??"").trim();e0=await SV$(T1,d8.api)}else e0=g.get("studioContext")?.auth?.user?.id??null;if(!e0)return g.json({error:"unauthorized"},401);let u0=U?await U(e0):{online:!1,capabilities:[]};if(!u0.online)return g.json(null);return g.json({hostname:u0.hostname,cliVersion:u0.cliVersion})}catch(H0){return console.error("[links/me] presence probe failed; reporting offline:",H0 instanceof Error?H0.message:String(H0)),g.json(null)}}),L.use("/api/:org/files/*",KC),L.route("/api",RC$);let d0=new b1;d0.use("*",pQ({mountPath:"/api"})),d0.route("/",VL0()),L.route("/api",d0),L.route("/api",YC$);let i0=new b1;i0.use("*",pQ({mountPath:"/api"})),i0.route("/",CL0({tokenStorage:V,automationEventDispatcher:o})),L.route("/api",i0);let n0=new tl(Z.db),w0=new b1;w0.use("*",pQ({mountPath:"/api"})),w0.route("/",oE0()),L.route("/api",w0),L.route("/api/deco-sites",tq$()),L.route("/api/deco-apps",sV$());let C0=new b1;C0.use("*",pQ({mountPath:"/api/deco-sites"})),C0.route("/",sE0()),L.route("/api/deco-sites",C0);let T0=new b1;T0.use("*",pQ({mountPath:"/api/vm-events"})),T0.route("/",oV$()),L.route("/api/vm-events",T0);let{createPublishRequestHandler:N0,createPublicMCPHandler:Q0}=await Promise.resolve().then(() => (hb$(),gb$)),G0={db:Z.db,vault:{encrypt:(g)=>S.encrypt(g),decrypt:(g)=>S.decrypt(g)}},V0=N0(G0),n=Q0(G0);L.use("/org/:orgRef/registry/publish-request",WC),L.post("/org/:orgRef/registry/publish-request",V0),L.use("/org/:orgSlug/registry/*",WC),L.all("/org/:orgSlug/registry/*",n),L.post("/api/:org/registry/publish-request",V0),L.all("/api/:org/registry/*",n),L.route(Z01,xI$());let e=MV$({kvStorage:n0,runRegistry:B,streamBuffer:K,sseHub:Z9,cancelBroadcast:W,tokenStorage:V,automationEventDispatcher:o,mountDevAssets:b3(),mcpAuth:Y0,oauthProxyHandler:db$,watchHandler:mb$,betterAuthProtectedResourceHandler:j,getNatsConnection:()=>F?.getConnection()??null});return L.route("/api/:org",e),L.notFound((g)=>{return g.json({error:"Not Found",path:g.req.path},404)}),L.onError(xq$),Object.assign(L,{markShuttingDown:()=>{G=!0},shutdown:async()=>{if(console.log("[shutdown] Stopping workers..."),await Promise.allSettled([Z9.stop(),vg?Promise.resolve(vg()).finally(()=>{vg=null}):Promise.resolve()]),F)await F.drain().catch((g)=>console.error("[shutdown] NATS drain error:",g));console.log("[shutdown] Flushing telemetry..."),await lY().catch((g)=>console.error("[shutdown] Telemetry flush error:",g)),console.log("[shutdown] Closing database..."),await fx1(Z).catch((g)=>console.error("[shutdown] Database close error:",g)),console.log("[shutdown] Cleanup complete.")},initDbos:async()=>{await xg.registerQueue(dY,{partitionQueue:!0,concurrency:Nt0,minPollingIntervalMs:Bt0}),await xg.registerQueue(sQ,{partitionQueue:!0,concurrency:Vm0}),await xg.registerQueue(IK,{partitionQueue:!0,concurrency:Rm0}),await xg.registerQueue(hw,{partitionQueue:!0,concurrency:oJ$}),await Y11(R),await Promise.allSettled(["automations-gate","automations-global"].map((g)=>xg.deleteQueue(g))),await Ot0(Z.pool),Yh1().catch((g)=>{console.error("[studio-pack-backfill] failed:",g)}),E21().catch((g)=>{console.error("[org-fs] public-sets boot sync kick failed:",g)})}})}var lb$,cb$=5000,q81=null,vg=null,db$=async($)=>{let Z=$.req.param("connectionId");if(!Z)return $.json({error:"Missing connectionId"},400);let G=$.req.path.split("/").filter(Boolean),X=G[G.length-1],Y=$.get("studioContext");if(!Y)Y=await XN.create($.req.raw),$.set("studioContext",Y);let Q=$.req.param("org")?Y.organization?.id:void 0,J=await Y.storage.connections.findById(Z,Q);if(!J?.connection_url)return $.json({error:"Connection not found"},404);let W=await sx(J.connection_url),K,U=new URL(J.connection_url);if(W.ok)K=(await W.json()).authorization_servers?.[0];if(!K)K=U.origin;let w=await Vi(K);if(!w.ok)return $.json({error:"Failed to get auth server metadata"},502);let F=await w.json(),H;if(X==="authorize")H=F.authorization_endpoint;else if(X==="token")H=F.token_endpoint;else if(X==="register")H=F.registration_endpoint;if(!H)return $.json({error:`Unknown OAuth endpoint: ${X}`},404);let N=new URL(H),B=new URL($.req.url);if(N.search=B.search,X==="authorize"){let R=N.searchParams.get("redirect_uri");if(R){let V=O1().baseUrl??B.origin;try{let i=new URL(R),f=new URL(V);if(!(i.origin===f.origin||i.hostname==="localhost"))return $.json({error:"invalid_request",error_description:"redirect_uri is not allowed"},400)}catch{return $.json({error:"invalid_request",error_description:"redirect_uri is malformed"},400)}N.searchParams.set("redirect_uri",R)}if(N.searchParams.has("resource"))N.searchParams.set("resource",J.connection_url);if(I_1(J.connection_url))try{let V=await c54(Y,J.organization_id),i=u54(V);for(let[f,v]of i)N.searchParams.set(f,v)}catch(V){console.warn("[oauth-proxy] Failed to get smart OAuth params, proceeding without:",V)}return $.redirect(N.toString(),302)}let D={Accept:$.req.header("Accept")||"application/json"},E=$.req.header("Content-Type");if(E)D["Content-Type"]=E;let L=$.req.header("Authorization");if(L)D.Authorization=L;let z,j=null,P=null;if($.req.method!=="GET"&&$.req.method!=="HEAD")if(X==="token"&&E?.includes("application/x-www-form-urlencoded")){if(L?.toLowerCase().startsWith("basic "))try{let v=atob(L.slice(6).trim()),Z0=v.indexOf(":");if(Z0!==-1){let o=decodeURIComponent(v.slice(0,Z0)),B0=decodeURIComponent(v.slice(Z0+1));j=o||null,P=B0||null}}catch{}let R=await $.req.formData();if(R.has("resource"))R.set("resource",J.connection_url);let V=R.get("client_id"),i=R.get("client_secret");if(typeof V==="string"&&V)j=V;if(typeof i==="string"&&i)P=i;let f=new URLSearchParams;for(let[v,Z0]of R.entries())f.append(v,Z0.toString());z=f.toString()}else if(X==="register"&&E?.toLowerCase().includes("application/json")){let R=await Y.db.selectFrom("organization").select(["id","slug","name"]).where("id","=",J.organization_id).executeTakeFirst(),V=await $.req.text(),i={};try{i=V?JSON.parse(V):{}}catch{z=V}let f=typeof i==="object"&&i!==null&&!Array.isArray(i);if(z===void 0&&!f)z=V;if(z===void 0){let v=i,Z0=v.metadata&&typeof v.metadata==="object"?v.metadata:{};v.metadata={...Z0,organization_id:J.organization_id,...R?.slug?{organization_slug:R.slug}:{},...R?.name?{organization_name:R.name}:{}},z=JSON.stringify(v),D["Content-Type"]="application/json"}}else z=$.req.raw.body??void 0;let A=await fetch(N.toString(),{method:$.req.method,headers:D,body:z,duplex:"half",redirect:"manual"}),M=new Headers,S=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];for(let[R,V]of A.headers.entries())if(!S.includes(R.toLowerCase()))M.set(R,V);if(X==="token"&&A.ok){let R=await A.text();try{let V=JSON.parse(R);if(typeof V.access_token==="string"&&V.access_token){let i=typeof V.expires_in==="number"?new Date(Date.now()+V.expires_in*1000):null,f=null;try{f=await ex(J.connection_url)??H}catch{f=H}let v={connectionId:Z,accessToken:V.access_token,refreshToken:typeof V.refresh_token==="string"?V.refresh_token:null,scope:typeof V.scope==="string"?V.scope:null,expiresAt:i,clientId:j,clientSecret:P,tokenEndpoint:f};await new b5(Y.db,Y.vault).upsert(v)}}catch(V){console.error("[oauth-proxy] failed to persist downstream token:",V)}return new Response(R,{status:A.status,statusText:A.statusText,headers:M})}return new Response(A.body,{status:A.status,statusText:A.statusText,headers:M})},mb$=async($)=>{let Z=$.var.studioContext;if(!(Z.auth.user?.id??Z.auth.apiKey?.userId))return $.json({error:"Unauthorized"},401);let X=Z.organization?.id;if(!X)return $.json({error:"organization id missing"},400);let Y=$.req.query("types"),Q=Y?Y.split(",").map((W)=>W.trim()).filter(Boolean):null,J=crypto.randomUUID();return tQ($,async(W)=>{if(await W.writeSSE({event:"connected",data:JSON.stringify({listenerId:J,organizationId:X,typePatterns:Q,connectedAt:new Date().toISOString()})}),!Z9.add({id:J,organizationId:X,typePatterns:Q?.length?Q:null,push:(w)=>{W.writeSSE({id:w.id,event:w.type,data:JSON.stringify(w)}).catch(()=>{Z9.remove(X,J)})}})){await W.writeSSE({event:"error",data:JSON.stringify({error:"Too many connections",message:"SSE connection limit reached. Try again later."})});return}let U=setInterval(()=>{W.writeSSE({event:"keepalive",data:""}).catch(()=>{clearInterval(U)})},30000);await new Promise((w)=>{W.onAbort(()=>{clearInterval(U),Z9.remove(X,J),w()})})})},d54,i54,n54=()=>m54(d8),p54=()=>l54(d8);var qp0=O(()=>{l5();F8();L21();BG();bb();f8();F6();Z$0();Ub1();pb0();wJ();ki();pe0();HQ();B5();q4();$01();vI$();Q01();bq$();Z11();YJ();n40();G11();vq$();X11();kV$();pV$();aV$();K11();eV$();WB0();Ci();QC$();wB0();b$1();wC$();DC$();AC$();qC$();_$1();C$1();Ar();Bd();lC$();UY();A60();ol();It0();mC$();nC$();sC$();A_$();I_$();S_$();Lm0();V_$();Eg0();Vg0();aU();Ag0();f_$();o$0();U81();iX();Q11();Iv();Am0();Om0();o$0();o01();uy0();dy0();v_$();yb();c_$();EC();pe0();$y();f90();lb$=k(cB(),1);d54=new y54,i54=new Set([dY,sQ,IK,hw])});var tb$={};X6(tb$,{resolveClientDir:()=>Z94,resolveAssetPathWithTraversalCheck:()=>pb$,isPathWithinDirectory:()=>nb$,createAssetHandler:()=>G94});import{resolve as Hr,dirname as r54,join as o54,extname as a54,basename as s54,sep as ib$}from"path";function e54($,Z){if($===Z||s54($)==="index.html")return{"Cache-Control":"no-cache"};if($.includes(`${ib$}assets${ib$}`))return{"Cache-Control":"public, max-age=31536000, immutable"};return{}}function nb$($,Z){let G=Hr(Z),X=Hr($);return X===G||X.startsWith(G+"/")}function pb$({requestPath:$,clientDir:Z}){let G=$.startsWith("/")?$.slice(1):$,X=Hr(Z,G);if(!nb$(X,Z))return null;return X}function Z94($,Z="../client"){let G=new URL($),X=r54(G.pathname);return Hr(X,Z)}function G94($={}){let{env:Z="production",clientDir:G=$94,isServerPath:X=()=>!1}=$;if(Z==="development")return async function(Q){return null};return async function(Q){if(Q.method!=="GET")return null;let J=new URL(Q.url),W;try{W=decodeURIComponent(J.pathname)}catch{return null}if(X(W))return null;let K=pb$({requestPath:W,clientDir:G});if(!K)return null;let U=o54(K,"index.html"),w=Hr(G,"index.html"),F=Q.headers.get("accept"),N=F?.includes("text/html")||F?.includes("*/*")&&["",".html"].includes(a54(K))?[U,w]:[];for(let B of[K,...N])try{let D=Bun.file(B);if(await D.exists())return new Response(D,{headers:e54(B,w)})}catch{}if(W.includes("/assets/"))return new Response("Not Found",{status:404,headers:{"Cache-Control":"no-store"}});return null}}var $94="./dist/client";var rb$=()=>{};var ob$={};X6(ob$,{tryUpgradePreviewWs:()=>U94,tryHandlePreviewHttp:()=>K94,previewWebSocketHandler:()=>w94,parsePreviewBaseDomain:()=>W94,isPreviewWsData:()=>oL0,extractHandleFromHost:()=>M81});function Q94($){if($.method!=="GET")return!1;return($.headers.get("accept")??"").includes("text/html")}function J94(){return new Response(Y94,{status:503,headers:{"content-type":"text/html; charset=utf-8","cache-control":"no-store","retry-after":"1","access-control-allow-origin":"*"}})}function W94($){if(!$||$.trim()==="")return null;let Z=$.includes("{handle}")?$.replace("{handle}","__handle__"):$,G;try{G=new URL(Z)}catch{return null}let X=G.hostname;if($.includes("{handle}")){let Y=X.indexOf(".");if(Y<=0||Y===X.length-1)return null;return X.slice(Y+1)}return X}function M81($,Z){if(!$||!Z)return null;let G=$.indexOf(":"),X=(G>=0?$.slice(0,G):$).toLowerCase(),Q=`.${Z.toLowerCase().replace(/^\.+|\.+$/g,"")}`;if(!X.endsWith(Q))return null;let J=X.slice(0,X.length-Q.length);if(!J||J.includes("."))return null;return J}async function K94($,Z){let G=M81($.headers.get("host"),Z.baseDomain);if(!G)return null;let X=await Z.getRunner();if(!X)return Br(503,"preview proxy not configured");let Y=await X.proxyPreviewRequest(G,$);if(Y.headers.get(zV)&&Q94($))return J94();return Y.headers.delete(zV),Y}function Br($,Z){return new Response(JSON.stringify({error:Z}),{status:$,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function oL0($){return typeof $==="object"&&$!==null&&$.kind==="preview"}async function U94($,Z,G){if(($.headers.get("upgrade")??"").toLowerCase()!=="websocket")return null;let X=M81($.headers.get("host"),G.baseDomain);if(!X)return null;let Y=await G.getRunner();if(!Y)return Br(503,"preview proxy not configured");let Q=await Y.resolvePreviewUpstreamUrl(X);if(!Q)return Br(404,"sandbox not found");let J=new URL($.url);if(J.pathname.startsWith("/_sandbox")||J.pathname.startsWith("/_decopilot_vm"))return Br(404,"not found");let W=`${Q.replace(/^http/,"ws")}${J.pathname}${J.search}`,K=$.headers.get("sec-websocket-protocol"),U=K?K.split(",").map((H)=>H.trim()).filter(Boolean):[],w={kind:"preview",upstreamUrl:W,upstreamProtocols:U,pending:[],upstream:null,closed:!1};if(!Z.upgrade($,{data:w}))return Br(426,"upgrade failed");return}function Nr($,Z,G,X){if(Z.closed)return;Z.closed=!0;try{$.close(G,X)}catch{}try{Z.upstream?.close()}catch{}}var X94=256,Y94='<!DOCTYPE html><html><head><meta charset="utf-8"><title>Connecting\u2026</title><style>body{font-family:system-ui,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0;background:#fafafa;color:#555}div{text-align:center;max-width:420px;padding:24px}h3{margin:0 0 8px}p{margin:0;font-size:14px;color:#999;line-height:1.5}</style></head><body><div><h3>Connecting to sandbox\u2026</h3><p>Waiting for the sandbox to come online. This page refreshes automatically.</p></div><script>setTimeout(function(){window.location.reload()},1500)</script></body></html>',w94;var ab$=O(()=>{Pp0();w94={open($){let Z=$.data;if(!oL0(Z))return;let G;try{G=Z.upstreamProtocols.length>0?new WebSocket(Z.upstreamUrl,Z.upstreamProtocols):new WebSocket(Z.upstreamUrl)}catch(X){console.warn(`[preview-ws] failed to dial upstream ${Z.upstreamUrl}: ${X instanceof Error?X.message:String(X)}`),Nr($,Z,1011,"upstream connect failed");return}G.binaryType="arraybuffer",Z.upstream=G,G.addEventListener("open",()=>{while(Z.pending.length>0){let X=Z.pending.shift();if(X!==void 0)G.send(X)}}),G.addEventListener("message",(X)=>{if(Z.closed)return;$.send(X.data)}),G.addEventListener("close",(X)=>{Nr($,Z,X.code||1000,X.reason||"")}),G.addEventListener("error",()=>{Nr($,Z,1011,"upstream error")})},message($,Z){let G=$.data;if(!oL0(G))return;let X=G.upstream;if(X&&X.readyState===WebSocket.OPEN){X.send(Z);return}if(G.pending.length>=X94){Nr($,G,1011,"preview ws backlog overflow");return}G.pending.push(Z)},close($){let Z=$.data;if(!oL0(Z))return;Nr($,Z,1000,"")}}});var Zf$={};X6(Zf$,{printBanner:()=>H94,bannerLines:()=>$f$,BANNER_LINES:()=>sb$,BANNER_GRADIENT:()=>eb$});function F94($){let Z=Number.parseInt($.slice(1),16);return[Z>>16&255,Z>>8&255,Z&255]}function $f$($){let Z=sb$.map((G,X)=>{let[Y,Q,J]=F94(eb$[X]);return`\x1B[38;2;${Y};${Q};${J}m${G}\x1B[39m`});if($!==void 0)Z.push(`\x1B[2m  v${$}\x1B[22m`);return Z}function H94($){console.log("");for(let Z of $f$($))console.log(Z);console.log("")}var sb$,eb$;var Gf$=O(()=>{sb$=[" \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588     \u2588\u2588\u2588\u2588\u2588\u2588\u2588   ","\u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588 "," \u2591\u2588\u2588\u2588   \u2591\u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588  \u2588 \u2591  \u2588\u2588\u2588     \u2591\u2591\u2591  \u2588\u2588\u2588     \u2591\u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2588\u2588\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2591\u2591\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2588\u2588\u2588  \u2591\u2588\u2588\u2588 \u2591   \u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588 "," \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588  \u2591\u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2591  ","\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591     \u2591\u2591\u2591\u2591\u2591\u2591\u2591   "],eb$=["#00ff64","#00ee5e","#00dc56","#00c84e","#00b444","#00a03c","#008832","#006e28"]});var Yf$={};X6(Yf$,{bootstrapDevLinkSession:()=>P94});import{existsSync as N94}from"fs";import{chmod as B94,mkdir as O94,rename as D94,writeFile as E94}from"fs/promises";import{dirname as L94,join as Xf$}from"path";function z94($){return Xf$($,"dev-link")}function j94($){let Z=process.env.DEV_LINK_SESSION_PATH;if(Z&&Z.trim()!=="")return Z;return Xf$(z94($),"session.json")}async function P94($,Z){let G=j94($),X=H6().db,Y=yQ()?await Yp():await X.selectFrom("user").select(["id","email","name"]).orderBy("createdAt","desc").executeTakeFirst();if(!Y?.id)return null;if(N94(G))try{let U=await Bun.file(G).json(),w=U.user?.sub,F=U.accessToken;if(w===Y.id&&typeof F==="string"){if(await d8.api.verifyApiKey({body:{key:F}}).then((N)=>N?.valid===!0).catch(()=>!1))return{path:G,userSub:w}}}catch{}let Q=null;try{Q=await d8.api.createApiKey({body:{name:"dev-link (auto-minted by bun run dev)",userId:Y.id,permissions:{"*":["*"]},expiresIn:2592000,rateLimitEnabled:!1}})}catch(K){return console.warn("[dev-link] failed to mint API key:",K instanceof Error?K.message:String(K)),null}if(!Q?.key)return null;let J={target:Z,clientId:"dev-link",user:{sub:Y.id,...Y.email?{email:Y.email}:{},...Y.name?{name:Y.name}:{}},accessToken:Q.key,createdAt:new Date().toISOString()};await O94(L94(G),{recursive:!0});let W=`${G}.tmp`;return await E94(W,JSON.stringify(J,null,2),{mode:384}),await B94(W,384),await D94(W,G),{path:G,userSub:Y.id}}var Qf$=O(()=>{HQ();wJ();nN()});l5();var g81="4";function h81($){return{name:"decocms",systemDatabaseUrl:$.systemDatabaseUrl,systemDatabaseSchemaName:"dbos",systemDatabasePoolSize:$.poolSize,runAdminServer:!1,executorID:$.executorID,applicationVersion:g81,...$.listenQueues!==void 0?{listenQueues:$.listenQueues}:{}}}F8();Xz0();B5();function zx$(){let $=(process.env.BUN_OPTIONS??"").split(/\s+/).filter(Boolean);return[...process.argv.slice(1),...$]}function Az0($,Z){for(let G=0;G<$.length;G++){let X=$[G];if(X===void 0)continue;if(X===Z)return $[G+1];if(X.startsWith(`${Z}=`))return X.slice(Z.length+1)}return}function j61(){let $=zx$();if($.includes("--cpu-prof")){console.log(JSON.stringify({msg:"cpu-profiling-active",dir:Az0($,"--cpu-prof-dir")??process.cwd(),name:Az0($,"--cpu-prof-name"),markdown:$.includes("--cpu-prof-md"),intervalUs:Number(Az0($,"--cpu-prof-interval")??1000),note:"profile is written on process exit"}));return}if(process.env.CPU_PROFILE)console.warn(JSON.stringify({msg:"cpu-profiling-requested-but-inactive",hint:'CPU profiling is a Bun launch flag. Set BUN_OPTIONS="--cpu-prof --cpu-prof-md --cpu-prof-dir=/tmp" before starting the process.'}))}Rz0();var Rr;function S61(){if(process.env.HEAP_WATCH!=="1")return()=>{};let $=Number(process.env.HEAP_WATCH_INTERVAL_MS??60000),Z=async()=>{let G=MB();if(!G)return;let X={};try{let{heapStats:Y}=await import("bun:jsc"),Q=Y(),J=Object.entries(Q.objectTypeCounts).sort((W,K)=>K[1]-W[1]).slice(0,20);X={objectCount:Q.objectCount,heapSize:Q.heapSize,top:Object.fromEntries(J)}}catch{}console.log(JSON.stringify({msg:"heap-watch",ts:new Date().toISOString(),uptimeS:Math.round(process.uptime()),rss:G.rss,heapUsed:G.heapUsed,heapTotal:G.heapTotal,external:G.external,arrayBuffers:G.arrayBuffers,...X}))};return Z().catch(()=>{}),Rr=setInterval(()=>void Z().catch(()=>{}),$),Rr.unref?.(),process.on("SIGUSR2",()=>{try{let G=Bun.generateHeapSnapshot("v8"),X=typeof G==="string"?G:JSON.stringify(G),Y=`/tmp/heap-${process.pid}-${Date.now()}.heapsnapshot`;Bun.write(Y,X),console.log(JSON.stringify({msg:"heap-snapshot-written",path:Y}))}catch(G){console.error("[heap-watch] snapshot failed:",G)}}),()=>{if(Rr)clearInterval(Rr)}}import*as Ax$ from"bun:jsc";var{startSamplingProfiler:Tx$,samplingProfilerStackTraces:Ix$}=Ax$;function V61(){if(process.env.STALL_WATCHDOG!=="1")return()=>{};let $=Number(process.env.STALL_WATCHDOG_MS??100),Z=Number(process.env.STALL_WATCHDOG_TICK_MS??50);try{Tx$()}catch(Q){return console.error("[stall-watchdog] failed to start sampling profiler:",Q),()=>{}}let G,X=performance.now()+Z,Y=()=>{let Q=performance.now(),J=Q-X;X=Q+Z;let W=[];try{W=Ix$()?.traces??[]}catch{}if(J>$&&W.length>0){let K=new Map;for(let w of W){let F=w.frames.find((B)=>B.sourceURL&&!/Unknown Executable/.test(B.category??""))??w.frames[0];if(!F)continue;let H=(F.sourceURL??"?").replace(/^.*\/node_modules\//,"node_modules/"),N=`${F.name??"?"} @ ${H}:${F.line??"?"}`;K.set(N,(K.get(N)??0)+1)}let U=[...K.entries()].sort((w,F)=>F[1]-w[1]).slice(0,8).map(([w,F])=>({frame:w,count:F}));console.warn(JSON.stringify({msg:"stall-stack",ts:new Date().toISOString(),lagMs:Math.round(J),samplesInWindow:W.length,top:U}))}G=setTimeout(Y,Z),G.unref?.()};return G=setTimeout(Y,Z),G.unref?.(),()=>{if(G)clearTimeout(G)}}function C61(){j61();let $=[S61(),k61(),V61()];return()=>{for(let Z of $)Z()}}import{existsSync as S94}from"fs";var lX=O1();L61();var{DBOS:Or,DBOSClient:A94}=await import("@dbos-inc/dbos-sdk");function wf$($,Z){if(!Z)return $;let G=new URL($);if(!G.searchParams.has("sslmode"))G.searchParams.set("sslmode","verify-full");return G.toString()}var T94=[dY,sQ,IK,hw],I94=lX.dispatchRole==="worker"?T94:lX.dispatchRole==="api"?[]:void 0;Or.setConfig(h81({systemDatabaseUrl:wf$(lX.databaseUrl,lX.databasePgSsl),poolSize:Number(process.env.DBOS_POOL_SIZE??5),executorID:lX.podName,listenQueues:I94}));var{createApp:R94}=await Promise.resolve().then(() => (qp0(),Rp0)),{isServerPath:q94}=await Promise.resolve().then(() => (Ar(),Z61)),{createAssetHandler:M94,resolveClientDir:Ff$}=await Promise.resolve().then(() => (rb$(),tb$)),k94=lX.port,Jf$=Ff$(import.meta.url,"../client"),Hf$=S94(Jf$)?Jf$:Ff$(import.meta.url,"../dist/client"),V94=M94({clientDir:Hf$,isServerPath:q94}),C94={"X-Frame-Options":"DENY","Content-Security-Policy":"frame-ancestors 'none'"};function _94($){let Z=new Headers($.headers);for(let[G,X]of Object.entries(C94))Z.set(G,X);return new Response($.body,{status:$.status,statusText:$.statusText,headers:Z})}var{parsePreviewBaseDomain:b94,tryHandlePreviewHttp:f94,tryUpgradePreviewWs:x94,previewWebSocketHandler:k81,isPreviewWsData:S81}=await Promise.resolve().then(() => (ab$(),ob$)),{getOrInitSharedRunner:v94}=await Promise.resolve().then(() => (on(),X3$)),Nf$=b94(process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN),Wf$={baseDomain:Nf$??"",getRunner:v94},aL0=await R94({clientDir:Hf$}),V81=process.env.DBOS_CONDUCTOR_KEY?.trim(),Kf$=process.env.DBOS_CONDUCTOR_URL?.trim();await Or.launch({...V81?{conductorKey:V81}:{},...V81&&Kf$?{conductorURL:Kf$}:{}});console.log(`[dbos] application version: ${Or.applicationVersion}`);var C81=5,_81=0;await aQ(async()=>{_81++;try{return await aL0.initDbos()}catch($){let Z=_81>=C81?"giving up":"retrying";throw console.warn(`[dbos] initDbos attempt ${_81}/${C81} failed, ${Z}`,$),$}},{maxAttempts:C81,minTimeout:1000,maxTimeout:1e4,jitter:0.5});if(!lX.isCli){let{bannerLines:$}=await Promise.resolve().then(() => (Gf$(),Zf$));console.log("");for(let Z of $())console.log(Z)}var y94=Bun.serve({idleTimeout:0,port:k94,hostname:"0.0.0.0",fetch:async($,Z)=>{if(Nf$){let X=await x94($,Z,Wf$);if(X===void 0)return;if(X)return X;let Y=await f94($,Wf$);if(Y)return Y}let G=await V94($);if(G)return _94(G);return aL0.fetch($,{server:Z})},websocket:{open($){if(S81($.data))k81.open($)},message($,Z){if(S81($.data))k81.message($,Z)},close($){if(S81($.data))k81.close($)}},development:!1}),g94=C61();if(lX.localMode)Promise.resolve().then(() => (nN(),cN0)).then(async({seedLocalMode:$,markSeedComplete:Z})=>{try{let G=await $();if(process.env.DEV_LINK_SESSION_PATH)try{let{bootstrapDevLinkSession:X}=await Promise.resolve().then(() => (Qf$(),Yf$)),Y=lX.baseUrl??`http://localhost:${lX.port}`,Q=await X(lX.dataDir,Y);if(Q)console.log(`[dev-link] session ready at ${Q.path} (userSub=${Q.userSub})`);else console.warn("[dev-link] no admin user yet \u2014 skipping session bootstrap. The auto-spawned link will refuse to start until an admin exists.")}catch(X){console.error("[dev-link] bootstrap failed:",X)}}catch(G){console.error("Failed to seed local mode:",G)}finally{Z()}}).catch(async($)=>{console.error("Failed to load local-mode module:",$);try{let{markSeedComplete:Z}=await Promise.resolve().then(() => (nN(),cN0));Z()}catch{}});var Uf$=!1;async function h94($){let Z;try{Z=await A94.create({systemDatabaseUrl:wf$(lX.databaseUrl,lX.databasePgSsl),systemDatabaseSchemaName:"dbos"});let G=await Z.listWorkflows({status:"PENDING",queueName:sQ,executorId:$,loadInput:!1,loadOutput:!1});if(G.length===0){console.log(`[shutdown] no in-flight thread-gate gates to hand off (executor ${$})`);return}let X=G.map((Y)=>Y.workflowID);await Z.resumeWorkflows(X,{queueName:sQ}),console.log(`[shutdown] re-enqueued ${X.length} in-flight thread-gate gate(s) for re-adoption by a live executor (from ${$}):`,X)}catch(G){console.error("[shutdown] thread-gate handoff failed:",G)}finally{await Z?.destroy().catch(()=>{})}}async function sL0($){if(Uf$)return;Uf$=!0,console.log(`
+  </head>`)}function OC$($){let Z=new b1;return Z.get("/:domain",async(G)=>{let X=G.req.param("domain"),Y=$?D64($,"index.html"):null,Q=Y?Bun.file(Y):null;if(!Q||!await Q.exists())return G.notFound();let J=await Q.text();try{let W=E64(X);return G.html(L64(J,W),200,{"Cache-Control":"public, max-age=0, s-maxage=300"})}catch{return G.html(J)}}),Z}var DC$=O(()=>{F6();F8()});import{z as Q1}from"zod";var PC,z64,j64,P64,A64,EC$;var LC$=O(()=>{PC=Q1.enum(["good","bad","neutral"]),z64=Q1.preprocess(($)=>{if(Array.isArray($))return{kind:"text",value:$.find((G)=>G!==null&&typeof G!=="object")??""};return $!==null&&typeof $==="object"?$:{kind:"text",value:$}},Q1.object({kind:Q1.enum(["text","number","sparkline","badge","score"]).catch("text"),value:Q1.coerce.string().optional(),tone:PC.optional(),muted:Q1.boolean().optional(),delta:Q1.coerce.string().optional(),deltaDir:Q1.enum(["up","down","neutral"]).optional(),points:Q1.array(Q1.coerce.number()).optional(),label:Q1.coerce.string().optional()}).transform(($)=>{if($.kind==="badge"&&$.label==null)$.label=$.value??"";if($.kind==="score"){let Z=Number($.value);if(Number.isNaN(Z))return{...$,kind:"text"}}return $})),j64=Q1.preprocess(($)=>{let Z=$;if(Z&&typeof Z==="object"&&!Array.isArray(Z)&&Array.isArray(Z.cells))Z=Z.cells;if(Array.isArray(Z)&&Z.length===1&&Array.isArray(Z[0]))Z=Z[0];if(Array.isArray(Z))return Z;if(Z&&typeof Z==="object")return Object.values(Z);return Z},Q1.array(z64)),P64={key:Q1.coerce.string(),title:Q1.coerce.string(),eyebrow:Q1.coerce.string().optional(),headline:Q1.coerce.string(),annotation:Q1.coerce.string().optional(),methodology:Q1.coerce.string().optional(),sources:Q1.array(Q1.object({name:Q1.coerce.string(),logoUrl:Q1.coerce.string()})).optional()},A64=Q1.discriminatedUnion("template",[Q1.object({template:Q1.literal("cover"),score:Q1.object({value:Q1.coerce.number(),max:Q1.coerce.number().optional(),grade:Q1.coerce.string().optional(),label:Q1.coerce.string().optional()}).optional(),brandImage:Q1.coerce.string().optional(),screenshot:Q1.coerce.string().optional(),mobileScreenshot:Q1.coerce.string().optional()}),Q1.object({template:Q1.literal("cta"),ctaUrl:Q1.coerce.string().optional(),ctaLabel:Q1.coerce.string().optional(),bullets:Q1.array(Q1.coerce.string()).optional()}),Q1.object({template:Q1.literal("series"),points:Q1.array(Q1.coerce.number()).min(2),xLabels:Q1.array(Q1.coerce.string()).min(1),unit:Q1.coerce.string().optional(),callout:Q1.object({index:Q1.coerce.number(),value:Q1.coerce.string(),tone:PC.optional()})}),Q1.object({template:Q1.literal("threshold"),value:Q1.coerce.string().default(""),metricLabel:Q1.coerce.string().optional(),ratio:Q1.coerce.number(),thresholdRatio:Q1.coerce.number().optional(),thresholdLabel:Q1.coerce.string().default(""),tone:PC.optional()}),Q1.object({template:Q1.literal("stats"),stats:Q1.array(Q1.object({value:Q1.coerce.string(),label:Q1.coerce.string(),tone:PC.optional()})).min(1)}),Q1.object({template:Q1.literal("bars"),items:Q1.array(Q1.object({value:Q1.coerce.string(),label:Q1.coerce.string(),ratio:Q1.coerce.number(),tone:PC.optional()})).min(1)}),Q1.object({template:Q1.literal("gauges"),gauges:Q1.array(Q1.object({label:Q1.coerce.string(),value:Q1.coerce.string(),status:Q1.enum(["good","warn","bad"]).catch("warn"),caption:Q1.coerce.string().optional(),ratio:Q1.coerce.number().optional()})).min(1)}),Q1.object({template:Q1.literal("checklist"),checks:Q1.array(Q1.object({label:Q1.coerce.string(),status:Q1.enum(["pass","fail","warn"]).catch("fail"),value:Q1.coerce.string().optional()})).min(1)}),Q1.object({template:Q1.literal("table"),columns:Q1.array(Q1.object({label:Q1.coerce.string(),align:Q1.enum(["left","right"]).optional()})).min(1),rows:Q1.array(j64).min(1),highlightRow:Q1.coerce.number().optional()}),Q1.object({template:Q1.literal("products"),products:Q1.array(Q1.object({name:Q1.coerce.string(),price:Q1.coerce.string().optional(),image:Q1.coerce.string().optional(),url:Q1.coerce.string().optional()})).min(1)}),Q1.object({template:Q1.literal("list"),entries:Q1.array(Q1.object({label:Q1.coerce.string(),severity:Q1.enum(["error","warning","notice"]).catch("notice")})).min(1),moreCount:Q1.coerce.number().optional()}),Q1.object({template:Q1.literal("keywords"),volumeLabel:Q1.coerce.string().optional(),keywords:Q1.array(Q1.object({term:Q1.coerce.string(),volume:Q1.coerce.string(),position:Q1.coerce.number().catch(0)})).min(1)}),Q1.object({template:Q1.literal("competitor"),metricLabel:Q1.coerce.string().optional(),competitors:Q1.array(Q1.object({name:Q1.coerce.string(),value:Q1.coerce.string(),tone:PC.optional(),isYou:Q1.boolean().optional()})).min(1)}),Q1.object({template:Q1.literal("scorecard"),rivalLabel:Q1.coerce.string().optional(),dimensions:Q1.array(Q1.object({label:Q1.coerce.string(),you:Q1.coerce.string(),rival:Q1.coerce.string().optional(),rivalName:Q1.coerce.string().optional(),tone:PC.optional()})).min(1)})]),EC$=Q1.object({...P64,template:A64})});function zC$($){let Z=[],G=[...$.sections].sort((X,Y)=>X.position-Y.position).map((X)=>{let Y=EC$.safeParse(X.props);if(Y.success)return Y.data;let Q=Y.error.issues[0];return Z.push({section_type:X.section_type,position:X.position,reason:Q?`${Q.path.join(".")||"(root)"}: ${Q.message}`:"contract violation"}),null}).filter((X)=>X!==null);return{deck:{meta:{...$.meta,scores:$.summary?.scores},slides:G},drops:Z}}var jC$=O(()=>{LC$()});function Kr($,Z){return fetch(`${UD({})}${$}`,Z)}async function T64($,Z){let G=await Kr(`/api/v2/public/diagnostics/${encodeURIComponent($)}`+(Z?`?pw=${encodeURIComponent(Z)}`:""),{headers:{Accept:"application/json"}});if(G.status===404)return{status:"not_found",deck:null,scanned_at:null,drops:[]};if(!G.ok)throw Error(`report read HTTP ${G.status}`);let X=await G.json(),{deck:Y,drops:Q}=zC$(X);return{status:Y.slides.length?"ready":"empty",deck:Y,scanned_at:X.scanned_at,drops:Q}}var I64,AC,PC$;var AC$=O(()=>{F6();wJ();Jf();jC$();I64=new Set(["complete","errored","terminated","unknown"]),AC=new b1;AC.use("*",async($,Z)=>{let G=await d8.api.getSession({headers:$.req.raw.headers});if(!G?.user?.id)return $.json({error:"Authentication required"},401,{"Cache-Control":"private, no-store",Vary:"Cookie"});$.set("reportUser",{email:G.user.email}),await Z(),$.header("Cache-Control","private, no-store"),$.header("Vary","Cookie");return});AC.get("/site/:domain",async($)=>{let Z=$.req.param("domain").trim();if(!Z)return $.json({error:"domain is required"},400);let G=$.req.query("key")?.trim()||void 0;try{let X=await T64(Z,G);return $.header("Cache-Control","private, no-store"),$.json(X)}catch{return $.json({error:"report read failed"},502)}});AC.post("/run",async($)=>{let Z;try{Z=await $.req.json()}catch{return $.json({error:"invalid JSON"},400)}let G=typeof Z.domain==="string"?Z.domain.trim():"";if(!G)return $.json({error:"domain is required"},400);let X=$.get("reportUser").email,Y=typeof Z.distinctId==="string"&&Z.distinctId.trim()&&Z.distinctId.length<=200?Z.distinctId.trim():void 0;try{let Q=await Kr("/api/v2/diagnostics/run",{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${wD({})}`},body:JSON.stringify({url:G,email:X,distinct_id:Y})});if(!Q.ok)return $.json({error:`run HTTP ${Q.status}`},502);let J=await Q.json(),W=J.blocked?{state:"blocked"}:J.status==="fresh"?{state:"fresh"}:J.mode==="sync"?{state:"sync"}:{state:"running",id:J.id??null};return $.json(W)}catch{return $.json({error:"run failed"},502)}});AC.get("/status",async($)=>{let Z=$.req.query("id");if(!Z)return $.json({error:"id is required"},400);try{let G=await Kr(`/api/v2/diagnostics/status?id=${encodeURIComponent(Z)}`,{headers:{Authorization:`Bearer ${wD({})}`}});if(!G.ok)return $.json({error:`status HTTP ${G.status}`},502);let Y=(await G.json()).status??"unknown",Q={done:I64.has(Y),status:Y};return $.json(Q)}catch{return $.json({error:"status failed"},502)}});AC.get("/link-token/:id",async($)=>{let Z=$.req.param("id");try{let G=await Kr(`/api/v2/public/link-tokens/${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(G.status===404)return $.json(null);if(!G.ok)return $.json({error:`link token HTTP ${G.status}`},502);return $.json(await G.json())}catch{return $.json({error:"link token resolve failed"},502)}});AC.get("/suggest",async($)=>{let Z=($.req.query("q")??"").trim().slice(0,64);if(Z.length<2)return $.json({suggestions:[]});try{let G=await Kr(`/api/v2/public/suggest?q=${encodeURIComponent(Z)}`,{headers:{Accept:"application/json"}});if(!G.ok)return $.json({suggestions:[]});let X=await G.json();return $.json({suggestions:Array.isArray(X.suggestions)?X.suggestions:[]})}catch{return $.json({suggestions:[]})}});PC$=AC});function TC$($,Z){if(Z.startsWith("text/html")||Z.startsWith("image/svg"))$.set("Content-Security-Policy","sandbox allow-scripts allow-modals allow-same-origin")}var IC$,R64,q64,RC$;var qC$=O(()=>{F6();f3();ev();bb();IC$=new b1,R64=["range","if-none-match","if-modified-since"],q64=["content-type","content-length","content-range","accept-ranges","etag","last-modified"];IC$.get("/:org/files/*",async($)=>{let Z=$.get("studioContext"),G=Z.organization?.id;if(!Z.auth?.user?.id){if(wg($))return $.redirect(`/login?next=${encodeURIComponent($.req.path)}`,302);throw new P$(401,{message:"Authentication required"})}if(!G)throw new P$(401,{message:"Organization context required"});let X=$.req.path.replace(/^.*\/files\//,"");if(!X)throw new P$(400,{message:"Missing file key"});let Y=await Qp(X,Z);if(!Y)throw new P$(503,{message:"Object storage not configured"});if(Y.startsWith("data:")&&b3()){let K=Y.match(/^data:([^;]+);base64,(.+)$/s);if(!K)throw new P$(500,{message:"Invalid data URL from storage"});let[,U,w]=K,F=Buffer.from(w,"base64"),H=new Headers({"Content-Type":U,"Cache-Control":"private, max-age=86400"});return TC$(H,U),new Response(F,{status:200,headers:H})}let Q=new Headers;for(let K of R64){let U=$.req.header(K);if(U)Q.set(K,U)}let J=await fetch(Y,{headers:Q});if(J.status===403||J.status===404)throw new P$(404,{message:"File not found"});if(!J.ok&&J.status!==304&&J.status!==416)throw console.error(`[files] upstream storage error ${J.status} for key:`,X),new P$(502,{message:"Upstream storage error"});let W=new Headers;for(let K of q64){let U=J.headers.get(K);if(U)W.set(K,U)}return W.set("Cache-Control","private, max-age=86400"),TC$(W,W.get("content-type")??""),new Response(J.body,{status:J.status,headers:W})});RC$=IC$});var Ur=_((TC)=>{var M64=TC&&TC.__createBinding||(Object.create?function($,Z,G,X){if(X===void 0)X=G;var Y=Object.getOwnPropertyDescriptor(Z,G);if(!Y||("get"in Y?!Z.__esModule:Y.writable||Y.configurable))Y={enumerable:!0,get:function(){return Z[G]}};Object.defineProperty($,X,Y)}:function($,Z,G,X){if(X===void 0)X=G;$[X]=Z[G]}),k64=TC&&TC.__exportStar||function($,Z){for(var G in $)if(G!=="default"&&!Object.prototype.hasOwnProperty.call(Z,G))M64(Z,$,G)};Object.defineProperty(TC,"__esModule",{value:!0});k64(rX(),TC)});var SC$=_((MC$)=>{Object.defineProperty(MC$,"__esModule",{value:!0});MC$.version=void 0;MC$.version="3.4.0"});var _C$=_((jK)=>{var S64=jK&&jK.__importDefault||function($){return $&&$.__esModule?$:{default:$}};Object.defineProperty(jK,"__esModule",{value:!0});jK.NodeTransport=jK.VERSION=void 0;jK.nodeResolveHost=x64;var n4=Ur(),V64=c0("net"),a$1=c0("tls"),C64=c0("path"),VC$=c0("fs"),_64=S64(c0("dns")),b64=SC$();jK.VERSION=b64.version;var f64="nats.js";class CC${socket;version;lang;yields=[];signal=(0,n4.deferred)();closedNotification=(0,n4.deferred)();options;connected=!1;tlsName="";done=!1;closeError;constructor(){this.lang=f64,this.version=jK.VERSION}async connect($,Z){this.tlsName=$.tlsName,this.options=Z;let{tls:G}=this.options,{handshakeFirst:X}=G||{};try{if(X===!0)this.socket=await this.tlsFirst($);else this.socket=await this.dial($);if(this.done)this.socket?.destroy();let Y=await this.peekInfo();(0,n4.checkOptions)(Y,Z);let{tls_required:Q,tls_available:J}=Y,W=J===!0&&Z.tls!==null;if(!X&&(Q||W))this.socket=await this.startTLS();if(this.done)this.socket?.destroy();if(Q&&this.socket.encrypted!==!0)throw n4.errors.InvalidArgumentError.format("tls","is not available on this server");return this.connected=!0,this.setupHandlers(),this.signal.resolve(),Promise.resolve()}catch(Y){let Q=Y;if(!Q)Q=new n4.errors.ConnectionError("error connecting - node provided an undefined error");let{code:J}=Q,W=J==="ECONNREFUSED"?new n4.errors.ConnectionError("connection refused",{cause:Q}):Q;throw this.socket?.destroy(),W}}dial($){let Z=(0,n4.deferred)(),G,X=(0,V64.createConnection)($.port,$.hostname,()=>{Z.resolve(X),X.removeAllListeners()});return X.on("error",(Y)=>{G=Y}),X.on("close",()=>{X.removeAllListeners(),Z.reject(G)}),X.setNoDelay(!0),Z}get isClosed(){return this.done}close($){return this._closed($,!1)}peekInfo(){let $=(0,n4.deferred)(),Z;return this.socket.on("data",(G)=>{this.yields.push(G);let X=n4.DataBuffer.concat(...this.yields),Y=(0,n4.extractProtocolMessage)(X);if(Y!=="")try{let Q=n4.INFO.exec(Y);if(!Q)throw Error("unexpected response from server");let J=JSON.parse(Q[1]);$.resolve(J)}catch(Q){$.reject(Q)}finally{this.socket.removeAllListeners()}}),this.socket.on("error",(G)=>{Z=G}),this.socket.on("close",()=>{this.socket.removeAllListeners(),$.reject(Z)}),$}loadFile($){if(!$)return Promise.resolve();let Z=(0,n4.deferred)();try{if($=(0,C64.resolve)($),!(0,VC$.existsSync)($))Z.reject(Error(`${$} doesn't exist`));(0,VC$.readFile)($,(G,X)=>{if(G)return Z.reject(G);Z.resolve(X)})}catch(G){Z.reject(G)}return Z}async loadClientCerts(){let $={},{certFile:Z,cert:G,caFile:X,ca:Y,keyFile:Q,key:J}=this.options.tls;try{if(Z){let W=await this.loadFile(Z);if(W)$.cert=W}else if(G)$.cert=G;if(Q){let W=await this.loadFile(Q);if(W)$.key=W}else if(J)$.key=J;if(X){let W=await this.loadFile(X);if(W)$.ca=[W]}else if(Y)$.ca=Y;return Promise.resolve($)}catch(W){return Promise.reject(W)}}async tlsFirst($){let Z,G={servername:this.tlsName,rejectUnauthorized:!0};if(this.socket)G.socket=this.socket;if(typeof this.options.tls==="object")try{let Y=await this.loadClientCerts()||{};G=(0,n4.extend)(G,this.options.tls,Y)}catch(Y){return Promise.reject(new n4.errors.ConnectionError(Y.message,{cause:Y}))}let X=(0,n4.deferred)();try{let Y=(0,a$1.connect)($.port,$.hostname,G,()=>{Y.removeAllListeners(),X.resolve(Y)});Y.on("error",(Q)=>{Z=Q}),Y.on("secureConnect",()=>{if(G.rejectUnauthorized===!1)return;if(!Y.authorized)throw Y.authorizationError}),Y.on("close",()=>{X.reject(Z),Y.removeAllListeners()}),Y.setNoDelay(!0)}catch(Y){X.reject(new n4.errors.ConnectionError(Y.message,{cause:Y}))}return X}async startTLS(){let $,Z={socket:this.socket,servername:this.tlsName,rejectUnauthorized:!0};if(typeof this.options.tls==="object")try{let X=await this.loadClientCerts()||{};Z=(0,n4.extend)(Z,this.options.tls,X)}catch(X){return Promise.reject(new n4.errors.ConnectionError(X.message,{cause:X}))}let G=(0,n4.deferred)();try{let X=(0,a$1.connect)(Z,()=>{X.removeAllListeners(),G.resolve(X)});X.on("error",(Y)=>{$=Y}),X.on("secureConnect",()=>{if(Z.rejectUnauthorized===!1)return;if(!X.authorized)throw X.authorizationError}),X.on("close",()=>{G.reject($),X.removeAllListeners()})}catch(X){G.reject(new n4.errors.ConnectionError(X.message,{cause:X}))}return G}setupHandlers(){let $;this.socket.on("data",(Z)=>{return this.yields.push(Z),this.signal.resolve()}),this.socket.on("error",(Z)=>{$=Z}),this.socket.on("end",()=>{if(this.socket?.destroyed)return;this.socket?.write(new Uint8Array(0),()=>{this.socket?.end()})}),this.socket.on("close",()=>{this._closed($,!1)})}[Symbol.asyncIterator](){return this.iterate()}async*iterate(){while(!0){if(this.yields.length===0)await this.signal;let $=this.yields;this.yields=[];for(let Z=0;Z<$.length;Z++){if(this.options.debug)console.info(`> ${(0,n4.render)($[Z])}`);yield $[Z]}if(this.done)break;else if(this.yields.length===0)$.length=0,this.yields=$,this.signal=(0,n4.deferred)()}}discard(){if(this.done=!0,this.socket)try{this.socket.removeAllListeners(),this.socket.destroy()}catch{}}disconnect(){this._closed(void 0,!0).then().catch()}isEncrypted(){return this.socket instanceof a$1.TLSSocket}_send($){if(this.isClosed||this.socket===void 0)return Promise.resolve();if(this.options.debug)console.info(`< ${(0,n4.render)($)}`);let Z=(0,n4.deferred)();try{this.socket.write($,(G)=>{if(G){if(this.options.debug)console.error(`!!! ${(0,n4.render)($)}: ${G}`);return Z.reject(G)}return Z.resolve()})}catch(G){if(this.options.debug)console.error(`!!! ${(0,n4.render)($)}: ${G}`);Z.reject(G)}return Z}send($){this._send($).catch((G)=>{})}async _closed($,Z=!0){if(!this.connected)return;if(this.done){this.socket?.destroy();return}if(this.closeError=$,!$&&this.socket&&Z)try{await this._send(new TextEncoder().encode(""))}catch(G){if(this.options.debug)console.log("transport close terminated with an error",G)}try{if(this.socket)this.socket.removeAllListeners(),this.socket?.destroy(),this.socket=void 0}catch(G){console.log(G)}this.done=!0,this.closedNotification.resolve(this.closeError)}closed(){return this.closedNotification}}jK.NodeTransport=CC$;function x64($){let Z=(0,n4.deferred)();return _64.default.lookup($,{all:!0},(G,X)=>{if(G){Z.reject(G);return}let Y=[];for(let Q of X)Y.push(Q.address);if(Y.length===0)Y.push($);Z.resolve(Y)}),Z}});var yC$=_((vC$)=>{Object.defineProperty(vC$,"__esModule",{value:!0});vC$.connect=v64;var bC$=_C$(),fC$=Ur(),xC$=Ur();function v64($={}){if((0,xC$.hasWsProtocol)($))return Promise.reject(xC$.errors.InvalidArgumentError.format("servers","node client doesn't support websockets, use the 'wsconnect' function instead"));return(0,fC$.setTransportFactory)({factory:()=>{return new bC$.NodeTransport},dnsResolveFn:bC$.nodeResolveHost}),fC$.NatsConnectionImpl.connect($)}});var gC$=_((yw)=>{var g64=yw&&yw.__createBinding||(Object.create?function($,Z,G,X){if(X===void 0)X=G;var Y=Object.getOwnPropertyDescriptor(Z,G);if(!Y||("get"in Y?!Z.__esModule:Y.writable||Y.configurable))Y={enumerable:!0,get:function(){return Z[G]}};Object.defineProperty($,X,Y)}:function($,Z,G,X){if(X===void 0)X=G;$[X]=Z[G]}),h64=yw&&yw.__exportStar||function($,Z){for(var G in $)if(G!=="default"&&!Object.prototype.hasOwnProperty.call(Z,G))g64(Z,$,G)};Object.defineProperty(yw,"__esModule",{value:!0});yw.connect=void 0;var c64=yC$();Object.defineProperty(yw,"connect",{enumerable:!0,get:function(){return c64.connect}});h64(Ur(),yw)});function dC$($){let Z=$?.connectFn??m64,G=null,X=null,Y=!1,Q=!1,J=!1,W=[];function K(){return G!==null&&!G.isClosed()&&!G.isDraining()&&!J}function U(){console.log(`[NatsProvider] fireReady: ${W.length} callbacks`);for(let H of W)try{H()}catch{}}function w(H){(async()=>{for await(let N of H.status())if(N.type==="disconnect")console.log("[NatsProvider] Disconnected"),J=!0;else if(N.type==="reconnect")console.log("[NatsProvider] Reconnected, re-firing ready callbacks"),J=!1,X=null,U()})().catch(()=>{})}async function F(H,N){let B=0;while(!Q)try{G=await Z({servers:H,timeout:l64,reconnect:!0,maxReconnectAttempts:-1,...N?{authenticator:N}:{}}),console.log(`[NatsProvider] Connected to ${G.getServer()} after ${B} attempt(s)`),X=null,J=!1,w(G),U();return}catch{B++;let D=mX(d64,u64,B-1,2,0.5);await O8(D)}}return{init(H,N){if(Y)return;Y=!0,Q=!1;let B=N?.creds?hC$.credsAuthenticator(new TextEncoder().encode(N.creds)):void 0;F(H,B).catch(()=>{})},isConnected(){return K()},getConnection(){return K()?G:null},getJetStream(){if(!K())return null;if(!X)X=uC$.jetstream(G);return X},onReady(H){if(W.push(H),K())try{H()}catch{}},async drain(){if(Q=!0,Y=!1,X=null,J=!1,G){let H=G;G=null,await H.drain().catch(()=>{})}}}}function m64($){return cC$.connect($)}var hC$,cC$,uC$,u64=100,d64=3000,l64=3000;var lC$=O(()=>{l5();hC$=k(Qh(),1),cC$=k(gC$(),1),uC$=k(cB(),1)});function _g($){let Z=$?.ttlMs??60000,G=$?.maxSize??1e4,X=$?.updateRecencyOnGet??!1,Y=new Map;function Q(){if(Y.size<=G)return;let J=Date.now();for(let[W,K]of Y)if(K.expiresAt<=J)Y.delete(W);while(Y.size>G){let W=Y.keys().next().value;if(W===void 0)break;Y.delete(W)}}return{get(J){let W=Y.get(J);if(!W)return;if(W.expiresAt<=Date.now()){Y.delete(J);return}if(X)Y.delete(J),Y.set(J,W);return W.value},set(J,W){Y.delete(J),Y.set(J,{value:W,expiresAt:Date.now()+Z}),Q()},delete(J){Y.delete(J)},clear(){Y.clear()},size(){return Y.size}}}function s$1($,Z){return`${$}.${Z}`}class e$1{cache;constructor($){this.cache=_g({ttlMs:$?.ttlMs??i64,maxSize:$?.maxSize??n64})}async get($,Z){return this.cache.get(s$1($,Z))??null}async set($,Z,G){this.cache.set(s$1($,Z),G)}async invalidate($,Z){this.cache.delete(s$1($,Z))}teardown(){this.cache.clear()}}var i64=600000,n64=5000;var mC$=()=>{};function hL0($,Z){return`${$}:${Z}`}function $81($){let Z=_g({ttlMs:$?.ttlMs??p64,maxSize:$?.maxSize??t64}),G=$?.getConnection,X=crypto.randomUUID(),Y=new TextEncoder,Q=new TextDecoder,J=null;function W(K,U){let w=G?.();if(!w)return;try{w.publish(iC$,Y.encode(JSON.stringify({organizationId:K,keyId:U,originId:X})))}catch(F){console.warn("[ProviderKeyCache] Publish failed (non-critical):",F)}}return{get(K,U){return Z.get(hL0(K,U))},set(K,U,w){Z.set(hL0(K,U),w)},invalidate(K,U){Z.delete(hL0(K,U)),W(K,U)},start(){if(J)return;let K=G?.();if(!K)return;J=K.subscribe(iC$),(async()=>{for await(let U of J)try{let w=JSON.parse(Q.decode(U.data));if(w.originId===X)continue;Z.delete(hL0(w.organizationId,w.keyId))}catch{}})().catch(console.error)},teardown(){J?.unsubscribe(),J=null,Z.clear()}}}var iC$="studio.ai-provider-keys.invalidate",p64=30000,t64=5000;var nC$=()=>{};class Z81{options;sub=null;onCancel=null;encoder=new TextEncoder;originId=crypto.randomUUID();constructor($){this.options=$}async start($){if($)this.onCancel=$;if(this.sub)return;if(!this.onCancel)return;let Z=this.options.getConnection();if(!Z)return;this.sub=Z.subscribe("mesh.decopilot.cancel");let G=new TextDecoder;(async()=>{for await(let X of this.sub)try{let Y=JSON.parse(G.decode(X.data));if(Y.originId===this.originId)continue;this.onCancel?.(Y.taskId)}catch{}})().catch(console.error)}broadcast($){if(/[.*>\s]/.test($)){console.warn("[NatsCancelBroadcast] Invalid threadId, skipping broadcast");return}this.onCancel?.($);try{let Z=this.options.getConnection();if(!Z)return;Z.publish("mesh.decopilot.cancel",this.encoder.encode(JSON.stringify({taskId:$,originId:this.originId})))}catch(Z){console.warn("[NatsCancelBroadcast] Publish failed (non-critical):",Z)}}publishControlFrame($,Z){}async stop(){this.sub?.unsubscribe(),this.sub=null,this.onCancel=null}}var pC$=($)=>{let Z;return()=>Z??=$()},G81,X81;var tC$=O(()=>{B5();G81=pC$(()=>D8.createHistogram("decopilot.stream.encode_ms",{description:"Per-chunk JSON.stringify+encode time for decopilot stream",unit:"ms"})),X81=pC$(()=>D8.createCounter("decopilot.stream.published_chunks",{description:"Logical decopilot stream chunks published to JetStream",unit:"{chunks}"}))});function Z44(){return{name:rU,subjects:[`${Xm0}.>`],storage:bJ.StorageType.File,max_age:a64,max_bytes:e64,max_msgs_per_subject:$44,discard:bJ.DiscardPolicy.Old,retention:bJ.RetentionPolicy.Limits,duplicate_window:s64,num_replicas:1}}class aC${chunks=0;encodeMs=0;maxMs=0;bytes=0;windowStart=performance.now();constructor(){setInterval(()=>this.flush(),1e4).unref?.()}record($,Z){if(this.chunks++,this.encodeMs+=$,$>this.maxMs)this.maxMs=$;this.bytes+=Z}flush(){let $=performance.now(),Z=$-this.windowStart;if(this.chunks>0&&Z>0)console.warn(JSON.stringify({msg:"stream-encode-trace",windowMs:Math.round(Z),chunks:this.chunks,encodeMs:Math.round(this.encodeMs),pctOfLoop:+(this.encodeMs/Z*100).toFixed(1),maxChunkMs:+this.maxMs.toFixed(2),mbEncoded:+(this.bytes/1048576).toFixed(2)}));this.chunks=0,this.encodeMs=0,this.maxMs=0,this.bytes=0,this.windowStart=$}}function rC$($){let Z=oC$.headers();for(let[G,X]of Object.entries($))Z.set(G,X);return Z}function Q44($,Z){let G=0;return{publish(X,Y,Q,J){X.publish(Y,Q,J?{headers:J}:void 0).catch((W)=>{if(G++,o64().add(1,{"org.id":Z??"unknown"}),G===1||G%100===0)console.warn(`[Decopilot] JetStream publish failed for thread ${$} (${G} total):`,W)})},get errorCount(){return G}}}class Y81{options;js=null;jsm=null;constructor($){this.options=$}async init(){let $=this.options.getConnection();if(!$){console.log("[Decopilot] StreamBuffer.init skipped: NATS not connected yet");return}let Z=this.options.getJetStreamManager?await this.options.getJetStreamManager():await bJ.jetstreamManager($),G=Z44();try{await Z.streams.info(rU),await Z.streams.update(rU,G)}catch(X){if(X instanceof Error&&X.message.includes("stream not found"))await Z.streams.add(G);else if(X instanceof Error&&/can ?not change.*storage|storage type/i.test(X.message))await Z.streams.delete(rU),await Z.streams.add(G);else throw X}this.js=this.options.getJetStream(),this.jsm=Z,console.log(`[Decopilot] StreamBuffer.init ${this.js?"ready":"degraded (js=null)"}`)}pump($,Z,G,X){let Y=this.js;if(!Y)return console.warn(`[Decopilot] pump: JetStream client unavailable for thread ${Z}; chunks NOT published to NATS`),Promise.resolve();let Q=Q44(Z,X),J=!1,W=()=>{if(J)return;J=!0;let U=W4$(Z);Y.publish(U.subject,U.data).catch(()=>{})};G.addEventListener("abort",W,{once:!0});let K=(U)=>{let w=performance.now(),F=Qm0(U,{runId:Z}),H=performance.now()-w;if(G81().record(H),X81().add(1,{"org.id":X??"unknown"}),Y44?.record(H,F.reduce((N,B)=>N+B.data.length,0)),F.length===0){console.warn(`[Decopilot] dropping oversized stream chunk for thread ${Z}`);return}for(let N of F)Q.publish(Y,N.subject,N.data,N.headers?rC$(N.headers):void 0)};return(async()=>{let U=$.getReader(),w=0,F=0,H;try{while(!0){let{done:N,value:B}=await U.read();if(N)break;if(K(B),F++,++w>=64)w=0,await new Promise((D)=>setImmediate(D))}}catch(N){H=N,console.warn(`[Decopilot] stream pump error for thread ${Z}:`,N?.message??N)}finally{if(U.releaseLock(),W(),X44)console.warn(JSON.stringify({msg:"decopilot-stream-diag",event:"pump-done",taskId:Z,publishedChunks:F,publishErrors:Q.errorCount}))}if(H!==void 0)throw H})()}async publishRawChunk($,Z,G){let X=this.js;if(!X)return!1;let Y=performance.now(),Q=Qm0(Z,{runId:$,dedup:G});if(G81().record(performance.now()-Y),X81().add(1),Q.length===0)return console.warn(`[Decopilot] dropping oversized raw chunk for thread ${$} (> MAX_CHUNKED_BYTES)`),!0;for(let J of Q)await X.publish(J.subject,J.data,{...J.headers?{headers:rC$(J.headers)}:{},...J.msgId?{msgID:J.msgId}:{}});return!0}async publishDone($,Z,G){let X=this.js;if(!X)return!1;let Y=J4$({runId:$,fenceToken:Z,finalSeq:G});return await X.publish(Y.subject,Y.data,{msgID:Y.msgId}),!0}async createTailStream($,Z,G){let X=this.js;if(!X)return console.warn(`[Decopilot] createTailStream: JetStream client unavailable for thread ${$}; no live tail`),null;let Y=G?.deliverPolicy==="new"?bJ.DeliverPolicy.New:bJ.DeliverPolicy.All,Q=G?.closeOnDone??!1,J=zN($),W;try{W=await(await X.consumers.get(rU,{filter_subjects:J,deliver_policy:Y})).consume()}catch(D){return console.warn("[Decopilot] JetStream tail unavailable (non-critical):",D?.message??D),null}let w=w90({messages:async function*(){try{for await(let D of W)yield{subject:D.subject,data:D.data,headers:D.headers}}finally{W.stop()}}(),onCancel:()=>W.stop()}).pipeThrough(W90()).pipeThrough(K90()).getReader(),F=!1,H=()=>{if(F)return;F=!0;try{w.releaseLock()}catch{}},N=!1,B=()=>{if(N)return;N=!0,W.stop(),w.cancel().catch(()=>{}),H()};return Z?.addEventListener("abort",B,{once:!0}),new ReadableStream({async pull(D){for(;;){let{done:E,value:L}=await w.read();if(E){B(),D.close();return}let z=L;if(z.kind==="done"){if(Q){B(),D.close();return}continue}D.enqueue(z.chunk);return}},cancel(){B()}})}purge($){if(!this.jsm)return;this.jsm.streams.purge(rU,{filter:zN($)}).catch(()=>{})}teardown(){this.js=null,this.jsm=null}}var bJ,oC$,r64=($)=>{let Z;return()=>Z??=$()},o64,a64=86400000000000,s64=120000000000,e64=4294967296,$44=500000,G44,X44,Y44;var sC$=O(()=>{Wm0();F90();Jm0();B5();tC$();bJ=k(cB(),1),oC$=k(Qh(),1),o64=r64(()=>D8.createCounter("decopilot.stream.publish_errors",{description:"Number of JetStream publish failures for decopilot stream chunks",unit:"{errors}"}));G44=process.env.STREAM_ENCODE_TRACE==="1",X44=process.env.DECOPILOT_STREAM_TRACE==="1";Y44=G44?new aC$:null});import{z as X8}from"zod";var eC$,$_$,PK,Q81,Z_$,G_$,X_$,Y_$,J44,Q_$,J_$,W_$,K_$,U_$,W44,w_$,QZZ,K44,U44=($)=>{return $.issues.map((Z)=>{return`${Z.path.length>0?Z.path.join("."):"frame"}: ${Z.message}`}).join("; ")},F_$=($)=>{return new TextEncoder().encode(JSON.stringify($))},H_$=($)=>{let Z;try{Z=JSON.parse(new TextDecoder().decode($))}catch(Q){throw TypeError("malformed JSON in tunnel frame",{cause:Q})}if(Z===null||typeof Z!=="object"||Array.isArray(Z))throw TypeError("frame must be an object");if(!("type"in Z))throw TypeError("frame type missing");let G=Z.type,X=typeof G==="string"?K44[G]:void 0;if(!X)throw TypeError(`unknown frame type: ${String(G)}`);let Y=X.safeParse(Z);if(!Y.success)throw TypeError(`invalid tunnel frame: ${U44(Y.error)}`);return Y.data};var N_$=O(()=>{eC$=X8.string().regex(/^[A-Za-z0-9_-]*$/u),$_$=X8.array(X8.tuple([X8.string(),X8.string()])),PK=X8.string().regex(/^[A-Za-z0-9_-]+$/u),Q81=X8.string().min(1),Z_$=X8.object({type:X8.literal("request.start"),protocol:X8.literal("tunnel.v1"),requestId:PK,method:X8.string().min(1),url:X8.string().min(1),headers:$_$,replySubject:Q81,bodySubject:Q81.optional(),abortSubject:Q81,deadlineUnixMs:X8.number().int().nonnegative().optional()}),G_$=X8.object({type:X8.literal("request.chunk"),requestId:PK,seq:X8.number().int().nonnegative(),data:eC$}),X_$=X8.object({type:X8.literal("request.end"),requestId:PK,seq:X8.number().int().nonnegative()}),Y_$=X8.object({type:X8.literal("request.error"),requestId:PK,code:X8.string().min(1),message:X8.string()}),J44=X8.union([G_$,X_$,Y_$]),Q_$=X8.object({type:X8.literal("response.ack"),requestId:PK}),J_$=X8.object({type:X8.literal("response.start"),requestId:PK,status:X8.number().int().min(100).max(599),statusText:X8.string().optional(),headers:$_$}),W_$=X8.object({type:X8.literal("response.chunk"),requestId:PK,seq:X8.number().int().nonnegative(),data:eC$}),K_$=X8.object({type:X8.literal("response.end"),requestId:PK,seq:X8.number().int().nonnegative()}),U_$=X8.object({type:X8.literal("response.error"),requestId:PK,code:X8.string().min(1),message:X8.string()}),W44=X8.union([Q_$,J_$,W_$,K_$,U_$]),w_$=X8.object({type:X8.literal("abort"),requestId:PK,reason:X8.string().optional()}),QZZ=X8.union([Z_$,J44,W44,w_$]),K44={"request.start":Z_$,"request.chunk":G_$,"request.end":X_$,"request.error":Y_$,"response.ack":Q_$,"response.start":J_$,"response.chunk":W_$,"response.end":K_$,"response.error":U_$,abort:w_$}});var w44=($)=>{return $.replaceAll("+","-").replaceAll("/","_").replaceAll("=","")},F44=($)=>{let Z=$.replaceAll("-","+").replaceAll("_","/"),G=(4-Z.length%4)%4;return Z+"=".repeat(G)},H44=($)=>{let Z=[];for(let G=0;G<$.length;G+=32768)Z.push(String.fromCharCode(...$.subarray(G,G+32768)));return Z.join("")},N44=($)=>{let Z=new Uint8Array($.length);for(let G=0;G<$.length;G+=32768){let X=$.slice(G,G+32768);Z.set(Uint8Array.from(X,(Y)=>Y.charCodeAt(0)),G)}return Z},B_$=($)=>{return w44(btoa(H44($)))},O_$=($)=>{return N44(atob(F44($)))},B44;var D_$=O(()=>{B44=class B44{#$=[];#Z;#G=!1;#Q=new Set;push($){if(this.#G)return;let Z=this.#Y();if(Z){Z.resolve({value:$,done:!1});return}this.#$.push($)}close(){if(this.#G)return;this.#G=!0,this.#X()}fail($){if(this.#G)return;this.#Z=$,this.#G=!0,this.#J($)}[Symbol.asyncIterator](){let $=!1,Z=new Set;return{next:()=>{if($)return Promise.resolve({value:void 0,done:!0});if(this.#$.length>0)return Promise.resolve({value:this.#$.shift(),done:!1});if(this.#Z)return Promise.reject(this.#Z);if(this.#G)return Promise.resolve({value:void 0,done:!0});return new Promise((G,X)=>{let Y;Y={resolve:(Q)=>{Z.delete(Y),G(Q)},reject:(Q)=>{Z.delete(Y),X(Q)}},Z.add(Y),this.#Q.add(Y)})},return:()=>{$=!0;for(let G of Z)this.#Q.delete(G),G.resolve({value:void 0,done:!0});return Z.clear(),Promise.resolve({value:void 0,done:!0})}}}#Y(){for(let $ of this.#Q)return this.#Q.delete($),$;return}#X(){for(let $ of this.#Q)$.resolve({value:void 0,done:!0});this.#Q.clear()}#J($){for(let Z of this.#Q)Z.reject($);this.#Q.clear()}}});function*I44($,Z){for(let G=0;G<$.length;G+=Z)yield $.subarray(G,G+Z)}class _44{maxSize;ttlMs;now;#$=new Map;constructor($,Z,G=Date.now){this.maxSize=$;this.ttlMs=Z;this.now=G}get($){let Z=this.#$.get($);if(!Z)return;if(Z.expiresAt<=this.now()){this.#$.delete($);return}return Z.value}has($){return this.get($)!==void 0}set($,Z){let G=this.now();this.prune(G),this.#$.delete($),this.#$.set($,{value:Z,expiresAt:G+this.ttlMs});while(this.#$.size>this.maxSize){let X=this.#$.keys().next().value;if(X===void 0)return;this.#$.delete(X)}}take($){let Z=this.get($);return this.#$.delete($),Z}clear(){this.#$.clear()}prune($){for(let[Z,G]of this.#$)if(G.expiresAt<=$)this.#$.delete(Z)}}var O44=30000,D44=1000,E44=65536,oQ,L44=($)=>{return"connection"in $},z44=($)=>{let Z=L44($)?$:{connection:$};return{connection:Z.connection,timeoutMs:Z.timeoutMs??0,firstFrameTimeoutMs:Z.firstFrameTimeoutMs??O44,idleTimeoutMs:Z.idleTimeoutMs??0,republishIntervalMs:Z.republishIntervalMs??D44,maxChunkBytes:Z.maxChunkBytes??E44,diagnostics:Z.diagnostics}},E_$=($)=>{return Array.from($.entries())},j44=($)=>{return $!==void 0&&!($ instanceof Headers)&&typeof $!=="function"&&typeof $[Symbol.iterator]==="function"},P44=($,Z,G)=>{if(j44(Z?.headers))return Array.from(Z?.headers,([X,Y])=>[String(X),String(Y)]);if($ instanceof Request)return E_$(G.headers);return E_$(G.headers)},L_$=($)=>{let Z=new Headers;for(let[G,X]of $)Z.append(G,X);return Z},A44=()=>{return crypto.randomUUID().replaceAll("-","")},T44=($)=>{try{$?.unsubscribe()}catch{}},R44=($)=>{if(!Number.isSafeInteger($)||$<1)throw TypeError("maxChunkBytes must be a positive safe integer")},q44=($,Z)=>{return $==="HEAD"||Z===204||Z===205||Z===304},TB=($,Z,G)=>{$.publish(Z,F_$(G))},M44=($)=>{return $.type.startsWith("response.")},J81=($)=>{let Z=$.reason;if(Z instanceof Error)return Z.message;if(typeof Z==="string")return Z;return"aborted"},k44=($)=>{if($==="idle")return new oQ("tunnel_idle_timeout","no response frame within idleTimeoutMs");return new oQ("tunnel_no_first_frame","no response frame arrived before firstFrameTimeoutMs")},z_$=async($,Z,G,X,Y="first_frame")=>{while(!0){let Q,J;try{let W=await Promise.race([$.next(),new Promise((U,w)=>{if(X.aborted){w(X.reason);return}let F=()=>w(X.reason);J=()=>{X.removeEventListener("abort",F)},X.addEventListener("abort",F,{once:!0})}),...G>0?[new Promise((U,w)=>{Q=setTimeout(()=>{w(k44(Y))},G)})]:[]]);if(W.done)return{value:void 0,done:!0};let K=H_$(W.value.data);if(!M44(K)||K.requestId!==Z)continue;return{value:K,done:!1}}finally{if(J?.(),Q)clearTimeout(Q)}}},S44=async($)=>{let Z=!1;while(!0){let G=await z_$($.iterator,$.requestId,Z?0:$.firstFrameTimeoutMs,$.signal);if(G.done)throw new oQ("tunnel_response_closed","response subscription closed before response.start");if(!Z)Z=!0,$.onFirstResponseFrame();if(G.value.type==="response.ack")continue;if(G.value.type==="response.start")return G.value;if(G.value.type==="response.error")throw new oQ(G.value.code,G.value.message);throw new oQ("tunnel_unexpected_response_frame",`expected response.start, got ${G.value.type}`)}},V44=async($)=>{let Z=$.body.getReader(),G=0,X=!1,Y=()=>{X=!0,Z.cancel($.signal.reason).catch(()=>{})};try{if($.signal.aborted){Y();return}$.signal.addEventListener("abort",Y,{once:!0});while(!0){let{done:Q,value:J}=await Z.read();if(X)return;if(Q){TB($.connection,$.subject,{type:"request.end",requestId:$.requestId,seq:G});return}for(let W of I44(J,$.maxChunkBytes)){if(X)return;TB($.connection,$.subject,{type:"request.chunk",requestId:$.requestId,seq:G,data:B_$(W)}),G++}}}catch(Q){if(X)return;TB($.connection,$.subject,{type:"request.error",requestId:$.requestId,code:"tunnel_request_body_error",message:Q instanceof Error?Q.message:String(Q)})}finally{$.signal.removeEventListener("abort",Y),Z.releaseLock()}},C44=($)=>{return new ReadableStream({async pull(Z){while(!0)try{let G=await z_$($.iterator,$.requestId,$.idleTimeoutMs,$.signal,"idle");if(G.done){Z.error(new oQ("tunnel_response_closed","response subscription closed before response.end")),$.cleanup();return}let X=G.value;if(X.type==="response.ack"||X.type==="response.start")continue;if(X.type==="response.chunk"){Z.enqueue(O_$(X.data));return}if(X.type==="response.end"){Z.close(),$.cleanup();return}Z.error(new oQ(X.code,X.message)),$.cleanup();return}catch(G){Z.error(G),$.cleanup();return}},cancel(){TB($.connection,$.abortSubject,{type:"abort",requestId:$.requestId,reason:"response_body_cancelled"}),$.cleanup()}},{highWaterMark:0})},IB=($)=>{let Z=z44($);return R44(Z.maxChunkBytes),async(G,X)=>{let Y=VV$(G),Q=new Request(G,X),J=A44(),W=CV$(Y.hostname,J),K=new AbortController,U=new AbortController,w=!1,F,H,N,B,D=!1,E=(P=new oQ("tunnel_closed","tunnel request closed"))=>{if(w)return;if(w=!0,T44(F),Q.body&&!D)Q.body.cancel(P).catch(()=>{});if(U.abort(P),K.abort(P),N)clearInterval(N);if(B)clearTimeout(B);Q.signal.removeEventListener("abort",L)},L=()=>{let P=new oQ("tunnel_aborted",J81(Q.signal));TB(Z.connection,W.abort,{type:"abort",requestId:J,reason:J81(Q.signal)}),K.abort(P),E(P)};if(Q.signal.aborted)throw new oQ("tunnel_aborted",J81(Q.signal));if(F=Z.connection.subscribe(W.reply),H=F[Symbol.asyncIterator](),Q.signal.addEventListener("abort",L,{once:!0}),Z.timeoutMs>0)B=setTimeout(()=>{let P=new oQ("tunnel_timeout",`tunnel request timed out after ${Z.timeoutMs}ms`);TB(Z.connection,W.abort,{type:"abort",requestId:J,reason:"tunnel_timeout"}),K.abort(P),E(P)},Z.timeoutMs);let z={type:"request.start",protocol:"tunnel.v1",requestId:J,method:Q.method,url:Y.pathWithSearch,headers:P44(G,X,Q),replySubject:W.reply,abortSubject:W.abort,...Q.body?{bodySubject:W.body}:{},...Z.timeoutMs>0?{deadlineUnixMs:Date.now()+Z.timeoutMs}:{}};TB(Z.connection,W.request,z),N=Z.republishIntervalMs>0?setInterval(()=>{if(!D)TB(Z.connection,W.request,z)},Z.republishIntervalMs):void 0;let j=()=>{if(D)return;D=!0,(Q.body?V44({connection:Z.connection,subject:W.body,requestId:J,body:Q.body,maxChunkBytes:Z.maxChunkBytes,signal:U.signal}):void 0)?.catch((A)=>{Z.diagnostics?.({event:"request_body_error",requestId:J,subject:W.body,error:A instanceof Error?A.message:String(A)})})};try{let P=await S44({iterator:H,requestId:J,firstFrameTimeoutMs:Z.firstFrameTimeoutMs,signal:K.signal,onFirstResponseFrame:()=>{if(N)clearInterval(N);j()}});if(q44(Q.method,P.status))return E(),new Response(null,{status:P.status,statusText:P.statusText,headers:L_$(P.headers)});return new Response(C44({connection:Z.connection,abortSubject:W.abort,iterator:H,requestId:J,idleTimeoutMs:Z.idleTimeoutMs,signal:K.signal,cleanup:E}),{status:P.status,statusText:P.statusText,headers:L_$(P.headers)})}catch(P){throw E(P instanceof Error?P:Error(String(P))),P}}};var j_$=O(()=>{N_$();D_$();fL0();oQ=class oQ extends Error{code;constructor($,Z,G){super(`${$}: ${Z}`,G);this.code=$;this.name="TunnelTransportError"}}});var cL0=O(()=>{j_$()});function P_$($){let Z=$.createFetch??b44,G=$.timeoutMs??2000;return async(X)=>{try{let Y=$.getConnection();if(!Y)return W81;let Q=CJ(X),W=await Z(Y,G)(`tunnel://${Q}/api/links/status`,{method:"GET"});if(!W.ok)return W81;let K=await W.json();return{online:!0,hostname:K.hostname,capabilities:K.capabilities??[],cliVersion:K.cliVersion}}catch{return W81}}}var W81,b44=($,Z)=>IB({connection:$,firstFrameTimeoutMs:Z});var A_$=O(()=>{cL0();Jr();W81={online:!1,capabilities:[]}});async function*f44($){if(!$.body){yield{headers:{status:$.status,headers:Object.fromEntries($.headers.entries())}};return}let Z=$.body.getReader(),G=!1;try{yield{headers:{status:$.status,headers:Object.fromEntries($.headers.entries())}};while(!0){let{done:X,value:Y}=await Z.read();if(X){G=!0;return}yield{data:Buffer.from(Y).toString("base64")}}}finally{try{if(!G)await Z.cancel()}catch{}finally{Z.releaseLock()}}}function T_$($){let Z=$.createFetch??((G)=>IB({connection:G,idleTimeoutMs:x44}));return async function*(X,Y,Q){let J=$.getConnection();if(!J)throw Error("link_unavailable: NATS unavailable");let W=CJ(X),K=Z(J),U={method:Y.method,headers:Y.headers,signal:Q?.signal};if(Y.body!=null)U.body=Y.body;let w=await K(`tunnel://${W}${Y.path}`,U);yield*f44(w)}}var x44=45000;var I_$=O(()=>{cL0();Jr()});import{z as fJ}from"zod";function R_$($){return JSON.stringify($)}var fZZ;var q_$=O(()=>{fZZ=fJ.discriminatedUnion("type",[fJ.object({type:fJ.literal("cancel"),runId:fJ.string()}),fJ.object({type:fJ.literal("cancel_req"),reqId:fJ.string()}),fJ.object({type:fJ.literal("keep_alive")}),fJ.object({type:fJ.literal("shutdown")})])});function M_$($){let Z=$.createFetch??((G)=>IB({connection:G,idleTimeoutMs:v44}));return{async publish(G,X,Y){let Q=$.getConnection();if(!Q)throw Error("link_unavailable: NATS unavailable");let J=CJ(G),K=await Z(Q)(`tunnel://${J}/api/links/work`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(X),signal:Y?.signal});if(!K.ok){let U=await K.text().catch(()=>"");throw Error(`tunnel work publish failed (${K.status})${U?`: ${U}`:""}`)}await K.body?.cancel().catch(()=>{})}}}function k_$($){let Z=$.createFetch??IB;return{async publishControlFrame(G,X,Y){let Q=$.getConnection();if(!Q)throw Error("link_unavailable: NATS unavailable");let J=CJ(G),K=await Z(Q)(`tunnel://${J}/api/links/control`,{method:"POST",headers:{"content-type":"application/json"},body:R_$(X),signal:Y?.signal});if(!K.ok){let U=await K.text().catch(()=>"");throw Error(`tunnel control publish failed (${K.status})${U?`: ${U}`:""}`)}await K.body?.cancel().catch(()=>{})}}}var v44=45000;var S_$=O(()=>{cL0();q_$();Jr()});function uL0($,Z,G,X){if(!X)return!1;return $.emit(Z,_3(G,X.status,{title:X.title??void 0,virtualMcpId:X.virtual_mcp_id??void 0,createdBy:X.created_by??void 0,triggerId:X.trigger_id??null,branch:X.branch??null,createdAt:X.created_at,updatedAt:X.updated_at})),!0}var V_$=O(()=>{f8()});class K81{storage;options;timer=null;constructor($,Z={}){this.storage=$;this.options=Z}start(){if(this.timer)return;let $=this.options.intervalMs??300000;this.timer=setInterval(()=>{this.runOnce()},$)}async runOnce(){let $=this.options.staleAfterMs??3600000;try{let Z=await this.storage.sweepAbandoned($);if(Z>0)console.log(`[async-research-sweeper] marked ${Z} stale jobs as abandoned`);return Z}catch(Z){return console.error("[async-research-sweeper] sweep failed",Z),0}}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}import{readdir as y44,rm as dL0}from"fs/promises";import{join as lL0}from"path";async function mL0($){let Z=new Date;Z.setUTCDate(Z.getUTCDate()-g44),Z.setUTCHours(0,0,0,0);let G=0;try{let X=await IC($);for(let Y of X)if(/^\d{4}$/.test(Y))G+=await C_$($,Y,Z);else if(!Y.startsWith(".")){let Q=lL0($,Y),J=await IC(Q);for(let K of J){if(!/^\d{4}$/.test(K))continue;G+=await C_$(Q,K,Z)}if((await IC(Q)).length===0)await dL0(Q,{recursive:!0,force:!0})}}catch(X){console.warn("monitoring retention cleanup failed:",X)}return G}async function C_$($,Z,G){let X=0,Y=lL0($,Z),Q=await IC(Y);for(let W of Q){if(!/^\d{2}$/.test(W))continue;let K=lL0(Y,W),U=await IC(K);for(let F of U){if(!/^\d{2}$/.test(F))continue;let H=new Date(`${Z}-${W}-${F}T00:00:00Z`);if(isNaN(H.getTime()))continue;if(H<G){let N=lL0(K,F);await dL0(N,{recursive:!0,force:!0}),X++}}if((await IC(K)).length===0)await dL0(K,{recursive:!0,force:!0})}if((await IC(Y)).length===0)await dL0(Y,{recursive:!0,force:!0});return X}async function IC($){try{return(await y44($)).filter((G)=>!G.startsWith("."))}catch{return[]}}var g44=30;var U81=()=>{};import{DBOS as w81,SchedulerMode as h44}from"@dbos-inc/dbos-sdk";async function u44(){let $=[eQ(),qC(),RK()],Z=0;for(let G of $)try{Z+=await mL0(G)}catch(X){console.error("[monitoring-retention] cleanup failed:",X)}return console.log(`[monitoring-retention] deleted ${Z} day-dir(s) across ${$.length} signal dir(s)`),{deleted:Z,dirs:$.length}}async function d44($,Z){await w81.runStep(()=>u44(),{name:"monitoringRetention"})}function b_$(){if(__$)return;__$=!0;let $=w81.registerWorkflow(d44,{name:"monitoringRetentionWorkflow"});w81.registerScheduled($,{name:"monitoringRetentionWorkflow",crontab:c44,mode:h44.ExactlyOncePerIntervalWhenActive})}var c44="23 4 * * *",__$=!1;var f_$=O(()=>{iX();U81()});function x_$($){return async(Z,G)=>{let X=await $.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.role","organization.id as orgId","organization.slug as orgSlug","organization.name as orgName"]).where("member.userId","=",G).where("member.organizationId","=",Z).executeTakeFirst();if(!X)return console.warn(`[automationContextFactory] User ${G} not found in org ${Z} \u2014 returning null`),null;let Y=await XN.create();Y.auth.user={id:G,role:X.role},Y.organization={id:X.orgId,slug:X.orgSlug,name:X.orgName};let Q=await Iu0($.db,Z,X.role);return Y.boundAuth=Tu0({auth:Y.authInstance,headers:new Headers,role:X.role,permissions:Q,userId:G}),Y.access=new vD(G,void 0,Y.boundAuth,X.role,"self"),i40(Y,{id:X.orgId,slug:X.orgSlug}),Y}}var v_$=O(()=>{yD();ki()});function l44(){return{services:[{name:"Postgres",status:"pending",port:0},{name:"NATS",status:"pending",port:0}],migrationsStatus:"pending",serverUrl:null,logs:[]}}function i44(){for(let $ of m44)$()}function y_$($){let Z=[...F81.logs,$];F81={...F81,logs:Z.length>500?Z.slice(-500):Z},i44()}function H81(){return n44}var F81,m44,n44=!1;var N81=O(()=>{F81=l44(),m44=new Set});import{EventEmitter as p44}from"events";var B81;var g_$=O(()=>{N81();B81=new p44;B81.on("request",($)=>{y_$($)})});function h_$(){return async($,Z)=>{let G=Date.now(),X=$.req.method,Y=$.req.path;if(Y==="/api/auth/get-session"||Y.includes("favicon")){await Z();return}let Q="",J=!1;if(Y.startsWith("/mcp")&&X==="POST"){J=!0;try{if($.req.header("Content-Type")?.includes("application/json")){let H=await $.req.raw.clone().json();if(H.method==="tools/call"&&H.params?.name){let N=bg(H.params.name),B=H.params.arguments||{},D=Object.keys(B).map((L)=>bg(L)),E=D.length>0?D.slice(0,3).join(",")+(D.length>3?"\u2026":""):"";Q=`${$5.tool}${N}${$5.dim}(${E})${$5.reset}`}else if(H.method)Q=`${$5.dim}${bg(H.method)}${$5.reset}`}}catch{}}let W=bg(Y);if(Y.startsWith("/mcp/conn_")){let w=Y.split("/")[2]??"";W=`/mcp/${$5.mcp}${bg(w.slice(0,12))}\u2026${$5.reset}`}else if(Y==="/mcp")W=`${$5.mcp}/mcp${$5.reset}`;else if(Y==="/mcp/registry")W=`${$5.mcp}/mcp/registry${$5.reset}`;let K=r44(X),U=J?"\u25C0":"\u2190";if(!H81())console.log(`${$5.dim}${U}${$5.reset} ${K}${X}${$5.reset} ${W}${Q?` ${Q}`:""}`);try{await Z()}finally{let w=Date.now()-G,F=$.res.status,H=t44(F),N=w<1000?`${w}ms`:`${(w/1000).toFixed(1)}s`,B=J?"\u25B6":"\u2192";if(!H81())console.log(`${$5.dim}${B}${$5.reset} ${K}${X}${$5.reset} ${W}${Q?` ${Q}`:""} ${H}${F}${$5.reset} ${$5.duration}${N}${$5.reset}`);B81.emit("request",{method:X,path:bg(Y),status:F,duration:w,timestamp:new Date})}}}var $5,t44=($)=>{if($>=500)return $5.serverError;if($>=400)return $5.clientError;if($>=300)return $5.redirect;return $5.ok},r44=($)=>{return $5[$]||$5.reset},bg=($)=>{return $.replace(/\r/g,"").replace(/\n/g,"").replace(/\x1b\[[0-9;]*m/g,"").replace(/[\x00-\x1f\x7f-\x9f]/g,"")};var c_$=O(()=>{N81();g_$();$5={reset:"\x1B[0m",dim:"\x1B[2m",bold:"\x1B[1m",GET:"\x1B[36m",POST:"\x1B[33m",PUT:"\x1B[35m",DELETE:"\x1B[31m",ok:"\x1B[32m",redirect:"\x1B[36m",clientError:"\x1B[33m",serverError:"\x1B[31m",mcp:"\x1B[35m",tool:"\x1B[96m",duration:"\x1B[90m"}});import{createHmac as m_$}from"crypto";import{mkdir as o44,readdir as a44,rm as u_$,stat as i_$}from"fs/promises";import{join as D81,relative as s44}from"path";import{z as T$}from"zod";function p_$($){let Z=$.replace(/[^a-zA-Z0-9_-]/g,"_");return D81(e44,Z)}function t_$($){return $.replace(/^\/+/,"").replace(/\.\./g,"")}function O81($,Z){let G=p_$($),X=t_$(Z);return D81(G,X)}function $54($,Z,G,X){let Y=O1().encryptionKey||"dev-secret",Q=`${$}:${Z}:${G}:${X}`;return m_$("sha256",Y).update(Q).digest("hex")}function l_$($,Z,G,X,Y){let Q=Math.floor(Date.now()/1000)+X,J=$54(Z,G,Q,Y),W=new URL(`/api/dev-assets/${Z}/${t_$(G)}`,$);return W.searchParams.set("expires",Q.toString()),W.searchParams.set("signature",J),W.searchParams.set("method",Y),W.toString()}function r_$($,Z,G){let X=`${$}:${Z.getTime()}:${G}`;return`"${m_$("md5","etag").update(X).digest("hex")}"`}async function o_$($,Z,G,X,Y){try{let Q=await a44($,{withFileTypes:!0});for(let J of Q){let W=D81($,J.name),U=s44(Z,W).replace(/\\/g,"/");if(G&&!U.startsWith(G))continue;if(J.isDirectory())if(X){let w=U+"/";if(!G||w.startsWith(G)){if(!(G?U.slice(G.length):U).includes("/"))Y.commonPrefixes.add(w)}}else await o_$(W,Z,G,X,Y);else if(J.isFile()){if(X&&G){let w=U.slice(G.length);if(w.includes(X)){let F=w.indexOf(X),H=G+w.slice(0,F+1);Y.commonPrefixes.add(H);continue}}try{let w=await i_$(W);Y.objects.push({key:U,size:w.size,lastModified:w.mtime.toISOString(),etag:r_$(W,w.mtime,w.size)})}catch{}}}}catch{}}function a_$($,Z){let X=O0($).id;return[{name:"LIST_OBJECTS",description:"List objects in the local assets directory with pagination support",inputSchema:T$.object({prefix:T$.string().optional(),maxKeys:T$.number().optional().default(1000),continuationToken:T$.string().optional(),delimiter:T$.string().optional()}),outputSchema:T$.object({objects:T$.array(T$.object({key:T$.string(),size:T$.number(),lastModified:T$.string(),etag:T$.string()})),nextContinuationToken:T$.string().optional(),isTruncated:T$.boolean(),commonPrefixes:T$.array(T$.string()).optional()}),handler:async(Y)=>{let Q=Y,J=Q.prefix||"",W=Q.maxKeys??1000,K=Q.delimiter,U=Q.continuationToken,w=p_$(X);await o44(w,{recursive:!0});let F={objects:[],commonPrefixes:new Set};await o_$(w,w,J,K,F),F.objects.sort((E,L)=>E.key.localeCompare(L.key));let H=0;if(U){if(H=F.objects.findIndex((E)=>E.key>U),H===-1)H=F.objects.length}let N=F.objects.slice(H,H+W),B=H+W<F.objects.length,D=B?N[N.length-1]?.key:void 0;return{objects:N,isTruncated:B,nextContinuationToken:D,commonPrefixes:Array.from(F.commonPrefixes).sort()}}},{name:"GET_OBJECT_METADATA",description:"Get metadata for a file in the local assets directory",inputSchema:T$.object({key:T$.string()}),outputSchema:T$.object({contentType:T$.string().optional(),contentLength:T$.number(),lastModified:T$.string(),etag:T$.string(),metadata:T$.record(T$.string(),T$.string()).optional()}),handler:async(Y)=>{let Q=Y,J=O81(X,Q.key),W=await i_$(J);return{contentType:U11(Q.key),contentLength:W.size,lastModified:W.mtime.toISOString(),etag:r_$(J,W.mtime,W.size)}}},{name:"GET_PRESIGNED_URL",description:"Generate a presigned URL for downloading a file from local storage",inputSchema:T$.object({key:T$.string(),expiresIn:T$.number().optional()}),outputSchema:T$.object({url:T$.string(),expiresIn:T$.number()}),handler:async(Y)=>{let Q=Y,J=Q.expiresIn??d_$;return{url:l_$(Z,X,Q.key,J,"GET"),expiresIn:J}}},{name:"PUT_PRESIGNED_URL",description:"Generate a presigned URL for uploading a file to local storage",inputSchema:T$.object({key:T$.string(),expiresIn:T$.number().optional(),contentType:T$.string().optional()}),outputSchema:T$.object({url:T$.string(),expiresIn:T$.number()}),handler:async(Y)=>{let Q=Y,J=Q.expiresIn??d_$;return{url:l_$(Z,X,Q.key,J,"PUT"),expiresIn:J}}},{name:"DELETE_OBJECT",description:"Delete a single file from local storage",inputSchema:T$.object({key:T$.string()}),outputSchema:T$.object({success:T$.boolean(),key:T$.string()}),handler:async(Y)=>{let Q=Y,J=O81(X,Q.key);try{return await u_$(J),{success:!0,key:Q.key}}catch{return{success:!1,key:Q.key}}}},{name:"DELETE_OBJECTS",description:"Delete multiple files from local storage",inputSchema:T$.object({keys:T$.array(T$.string()).max(1000)}),outputSchema:T$.object({deleted:T$.array(T$.string()),errors:T$.array(T$.object({key:T$.string(),message:T$.string()}))}),handler:async(Y)=>{let Q=Y,J=[],W=[];return await Promise.all(Q.keys.map(async(K)=>{let U=O81(X,K);try{await u_$(U),J.push(K)}catch(w){W.push({key:K,message:w instanceof Error?w.message:"Unknown error"})}})),{deleted:J,errors:W}}}]}async function E81($,Z,G){let X=a_$(Z,G),Y=new NU({name:"dev-assets-mcp",version:"1.0.0"},{capabilities:{tools:{}},jsonSchemaValidator:z5});for(let J of X){let W="shape"in J.inputSchema?J.inputSchema.shape:T$.object({}).shape,K=J.outputSchema&&"shape"in J.outputSchema?J.outputSchema.shape:T$.object({}).shape;Y.registerTool(J.name,{description:J.description??"",inputSchema:W,outputSchema:K,annotations:J.annotations,_meta:J._meta},async(U)=>{try{let w=await J.handler(U);return{content:[{type:"text",text:JSON.stringify(w)}],structuredContent:w}}catch(w){return{content:[{type:"text",text:`Error: ${w.message}`}],isError:!0}}})}let Q=new vY({enableJsonResponse:$.headers.get("Accept")?.includes("application/json")??!1});return await Y.connect(Q),sW(Y,Q,$,"mcp:dev-assets")}async function s_$($,Z,G,X){let Q=a_$(G,X).find((J)=>J.name===$);if(!Q)return{content:[{type:"text",text:`Tool not found: ${$}`}],isError:!0};try{let J=await Q.handler(Z);return{content:[{type:"text",text:JSON.stringify(J)}]}}catch(J){return{content:[{type:"text",text:J instanceof Error?J.message:String(J)}],isError:!0}}}var e44="./data/assets",d_$=3600,n_$,e_$;var $b$=O(()=>{F8();Up();F6();vu();Xy();jG();$L0();n_$=new b1;n_$.all("/",async($)=>{let Z=$.get("studioContext"),G=new URL($.req.url),X=`${G.protocol}//${G.host}`;return E81($.req.raw,Z,X)});e_$=n_$});var Zb$={};X6(Zb$,{mountDevRoutes:()=>Z54});function Z54($,Z){$.all("/mcp/:connectionId{.*_dev-assets$}",Z,async(X)=>{let Y=X.get("studioContext"),Q=new URL(X.req.url),J=`${Q.protocol}//${Q.host}`;return E81(X.req.raw,Y,J)}),$.all("/mcp/:connectionId{.*_dev-assets$}/call-tool/:toolName",Z,async(X)=>{let Y=X.get("studioContext"),Q=new URL(X.req.url),J=`${Q.protocol}//${Q.host}`,W=X.req.param("toolName");if(!W)return X.json({error:"Missing tool name"},400);let K=await X.req.json(),U=await s_$(W,K,Y,J);if(U.isError)return X.json(U.content,500);return X.json(U.content)}),$.use("/mcp/dev-assets",Z),$.route("/mcp/dev-assets",e_$);let G=new b1;G.use("*",pQ({mountPath:"/api/dev-assets"})),G.route("/",eE0({orgFromPath:!1})),$.route("/api/dev-assets",G)}var Gb$=O(()=>{F6();G11();$L0();$b$()});var Xb$=O(()=>{nu0();pu0();EE()});var iL0=O(()=>{Xb$()});var Qb$={};X6(Qb$,{streamAgent:()=>Yb$,createDecopilotClient:()=>X54});async function G54($){let{parseJsonEventStream:Z,uiMessageChunkSchema:G}=await Promise.resolve().then(() => (L6(),el0));return Z({stream:$,schema:G}).pipeThrough(new TransformStream({transform(X,Y){if(!X.success)throw X.error;Y.enqueue(X.value)}}))}async function Yb$($,Z,G,X,Y){let{readUIMessageStream:Q}=await Promise.resolve().then(() => (L6(),el0)),J=G.value??G.id;if(!J)throw Error("Agent binding has no id or value \u2014 cannot resolve agent");let W=X.credentialId??G.credentialId,K=X.thinking??G.thinking,U=K?.id,w={messages:X.messages,...U?{models:{credentialId:W,thinking:K,...X.fast??G.fast?{fast:X.fast??G.fast}:{}}}:{},agent:{id:J},temperature:X.temperature??G.temperature,toolApprovalLevel:X.toolApprovalLevel??G.toolApprovalLevel,mode:X.mode??G.mode??"default",...X.memory?{memory:X.memory}:{},...X.thread_id?{thread_id:X.thread_id}:{}},F=await fetch($,{method:"POST",headers:{"Content-Type":"application/json","x-mesh-token":Z,Authorization:`Bearer ${Z}`},body:JSON.stringify(w),signal:Y?.signal});if(!F.ok){let N=await F.text().catch(()=>""),B=`HTTP ${F.status}`;try{let D=JSON.parse(N);if(D?.error)B=D.error}catch{if(N)B=N}throw Error(B)}if(!F.body)throw Error("Empty response body from decopilot stream");let H=await G54(F.body);return Q({stream:H})}function X54($){let{baseUrl:Z,orgSlug:G,token:X}=$,Y=`${Z}/${G}/decopilot/runtime/stream`;return{stream(Q,J){let W={__type:"@deco/agent",id:Q.agent.id,credentialId:Q.credentialId??"",thinking:Q.thinking??{id:"",title:""},fast:Q.fast,toolApprovalLevel:Q.toolApprovalLevel,mode:Q.mode,temperature:Q.temperature};return Yb$(Y,X,W,Q,J)}}}import{z as dX}from"zod";function Jb$($){let Z=$.properties;if(!Z)return $;for(let G of Object.values(Z)){let X=G.properties;if(!X?.__type?.const)continue;let Y=X.__type.const,Q=Y54.get(Y);if(!Q)continue;let J=Q.map((W)=>({name:String(W.name),...W.inputSchema&&{inputSchema:dX.toJSONSchema(W.inputSchema)},...W.outputSchema&&{outputSchema:dX.toJSONSchema(W.outputSchema)}}));X.__binding={const:J}}return $}var Y54,C7Z,Q54=($)=>{return typeof $==="object"&&$!==null&&$.__type==="@deco/agent"},z81=($)=>{return typeof $==="object"&&$!==null&&typeof $.__type==="string"&&$.__type!=="@deco/agent"&&typeof $.value==="string"},nL0=($,Z,G)=>{let X=G?{"x-caller-app":G}:void 0;if(Z.cookie)X??={},X.cookie=Z.cookie;if(Z.token)X??={},X["x-mesh-token"]=Z.token;return{type:"HTTP",url:new URL(`/mcp/${$}`,Z.meshUrl).href,token:Z.token,headers:X}},J54=($,Z,G)=>{let X=nL0($,Z,G);return new Proxy(Yv.forConnection(X),{get(Y,Q){if(Q==="value")return $;if(Q==="__type")return G;return Y[Q]}})},W54=($,Z)=>{let G=Z.organizationSlug;if(!G)throw Error("organizationSlug is required for agent bindings");let X=`${Z.meshUrl}/api/${G}/decopilot/runtime/stream`;return{STREAM:async(Y,Q)=>{let{streamAgent:J}=await Promise.resolve().then(() => Qb$);return J(X,Z.token,$,Y,Q)}}},L81=($,Z)=>{if($===null||$===void 0)return $;if(Array.isArray($))return $.map((G)=>L81(G,Z));if(typeof $==="object"){if(Q54($))return W54($,Z);if(z81($))return J54($.value,Z,$.__type);let G={};for(let[X,Y]of Object.entries($))G[X]=L81(Y,Z);return G}return $},Wb$=($)=>{return L81($.state,$)};var fg=O(()=>{iL0();Y54=new Map;C7Z=dX.object({id:dX.string(),title:dX.string(),capabilities:dX.object({vision:dX.boolean().optional(),text:dX.boolean().optional(),tools:dX.boolean().optional(),reasoning:dX.boolean().optional()}).passthrough().optional(),provider:dX.string().optional().nullable(),limits:dX.object({contextWindow:dX.number().optional(),maxOutputTokens:dX.number().optional()}).passthrough().optional()})});var K54,Kb$=($,Z,G)=>{if(!Z)return null;if($===void 0||$==="*")return"*";if(typeof $==="string")return $===Z?$:null;if(Array.isArray($))return $.includes(Z)?Z:null;if(typeof $==="function")return $(Z,G)??null;return null},U54=($,Z,G)=>{let X=Z.headers.get("Origin"),Y=Kb$(G.origin,X,Z);if(Y)$.set("Access-Control-Allow-Origin",Y);if(G.credentials)$.set("Access-Control-Allow-Credentials","true");if(G.exposeHeaders?.length)$.set("Access-Control-Expose-Headers",G.exposeHeaders.join(", "))},Ub$=($,Z)=>{let G=new Headers,X=$.headers.get("Origin"),Y=Kb$(Z.origin,X,$);if(Y)G.set("Access-Control-Allow-Origin",Y);if(Z.credentials)G.set("Access-Control-Allow-Credentials","true");let Q=Z.allowMethods??K54;G.set("Access-Control-Allow-Methods",Q.join(", "));let J=$.headers.get("Access-Control-Request-Headers");if(Z.allowHeaders?.length)G.set("Access-Control-Allow-Headers",Z.allowHeaders.join(", "));else if(J)G.set("Access-Control-Allow-Headers",J);if(Z.maxAge!==void 0)G.set("Access-Control-Max-Age",Z.maxAge.toString());return new Response(null,{status:204,headers:G})},wb$=($,Z,G)=>{let X=new Headers($.headers);return U54(X,Z,G),new Response($.body,{status:$.status,statusText:$.statusText,headers:X})};var Fb$=O(()=>{K54=["GET","HEAD","PUT","POST","DELETE","PATCH"]});function Hb$($=32){let G=new Uint8Array($);return crypto.getRandomValues(G),Array.from(G,(X)=>"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"[X%62]).join("")}function w54($){try{let Z=new URL($);return Z.protocol==="https:"||Z.hostname==="localhost"||Z.hostname.endsWith(".localhost")||Z.hostname==="127.0.0.1"||!Z.protocol.startsWith("http")}catch{return!1}}function Nb$($){return btoa(JSON.stringify($)).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function Bb$($){try{let Z=$.replace(/-/g,"+").replace(/_/g,"/");return JSON.parse(atob(Z))}catch{return null}}function Ob$($){return{handleProtectedResourceMetadata:(U)=>{let w=AK(new URL(U.url)),F=`${w.origin}/mcp`;return Response.json({resource:F,authorization_servers:[w.origin],scopes_supported:["*"],bearer_methods_supported:["header"],resource_signing_alg_values_supported:["RS256","none"]})},handleAuthorizationServerMetadata:(U)=>{let F=AK(new URL(U.url)).origin;return Response.json({issuer:F,authorization_endpoint:`${F}/authorize`,token_endpoint:`${F}/token`,registration_endpoint:`${F}/register`,scopes_supported:["*"],response_types_supported:["code"],response_modes_supported:["query"],grant_types_supported:["authorization_code","refresh_token"],token_endpoint_auth_methods_supported:["none","client_secret_post"],code_challenge_methods_supported:["S256","plain"]})},handleAuthorize:(U)=>{let w=AK(new URL(U.url)),F=w.searchParams.get("redirect_uri"),H=w.searchParams.get("response_type"),N=w.searchParams.get("state"),B=w.searchParams.get("code_challenge"),D=w.searchParams.get("code_challenge_method");if(!F)return Response.json({error:"invalid_request",error_description:"redirect_uri required"},{status:400});if(H!=="code")return Response.json({error:"unsupported_response_type",error_description:"Only 'code' is supported"},{status:400});let E=AK(new URL(`${w.origin}/oauth/callback`)),L=E.toString(),j=Nb$({redirectUri:F,clientState:N??void 0,codeChallenge:B??void 0,codeChallengeMethod:D??void 0,oauthCallbackUri:L});E.searchParams.set("state",j);let P=$.authorizationUrl(E.toString());return Response.redirect(P,302)},handleOAuthCallback:async(U)=>{let w=AK(new URL(U.url)),F=w.searchParams.get("code"),H=w.searchParams.get("state"),N=w.searchParams.get("error"),B=H?Bb$(H):null;if(N){let D=w.searchParams.get("error_description")??"Authorization failed";if(B?.redirectUri){let E=AK(new URL(B.redirectUri));if(E.searchParams.set("error",N),E.searchParams.set("error_description",D),B.clientState)E.searchParams.set("state",B.clientState);return Response.redirect(E.toString(),302)}return Response.json({error:N,error_description:D},{status:400})}if(!F||!B)return Response.json({error:"invalid_request",error_description:"Missing code or state"},{status:400});try{let D=B.oauthCallbackUri??AK(new URL(`${w.origin}/oauth/callback`)).toString(),E={code:F,redirect_uri:D},L=await $.exchangeCode(E),z={accessToken:L.access_token,tokenType:L.token_type,refreshToken:L.refresh_token,expiresIn:L.expires_in,scope:L.scope,codeChallenge:B.codeChallenge,codeChallengeMethod:B.codeChallengeMethod},j=Nb$(z),P=AK(new URL(B.redirectUri));if(P.searchParams.set("code",j),B.clientState)P.searchParams.set("state",B.clientState);return Response.redirect(P.toString(),302)}catch(D){console.error("OAuth callback error:",D);let E=AK(new URL(B.redirectUri));if(E.searchParams.set("error","server_error"),E.searchParams.set("error_description","Failed to exchange authorization code"),B.clientState)E.searchParams.set("state",B.clientState);return Response.redirect(E.toString(),302)}},handleToken:async(U)=>{try{let w=U.headers.get("content-type")??"",F;if(w.includes("application/x-www-form-urlencoded")){let z=await U.formData();F=Object.fromEntries(z.entries())}else{let z=await U.json();if(typeof z!=="object"||z===null||Array.isArray(z))return Response.json({error:"invalid_request",error_description:"Request body must be a JSON object"},{status:400});F=z}let{code:H,code_verifier:N,grant_type:B,refresh_token:D}=F;if(B==="refresh_token"){if(typeof D!=="string"||!D)return Response.json({error:"invalid_request",error_description:"refresh_token is required and must be a string"},{status:400});if(!$.refreshToken)return Response.json({error:"unsupported_grant_type",error_description:"refresh_token grant not supported"},{status:400});let z;try{z=await $.refreshToken(D)}catch(P){if(P instanceof j81)return Response.json({error:P.error,...P.errorDescription?{error_description:P.errorDescription}:{}},{status:400});throw P}let j={access_token:z.access_token,token_type:z.token_type};if(z.refresh_token)j.refresh_token=z.refresh_token;if(z.expires_in!==void 0)j.expires_in=z.expires_in;if(z.scope)j.scope=z.scope;return Response.json(j,{headers:{"Cache-Control":"no-store",Pragma:"no-cache"}})}if(B!=="authorization_code")return Response.json({error:"unsupported_grant_type",error_description:"Only authorization_code and refresh_token supported"},{status:400});if(typeof H!=="string"||!H)return Response.json({error:"invalid_request",error_description:"code is required and must be a string"},{status:400});let E=Bb$(H);if(!E||!E.accessToken)return Response.json({error:"invalid_grant",error_description:"Invalid or expired code"},{status:400});if(E.codeChallenge){if(typeof N!=="string"||!N)return Response.json({error:"invalid_grant",error_description:"code_verifier required and must be a string"},{status:400});let z;if(E.codeChallengeMethod==="S256"){let P=new TextEncoder().encode(N),A=await crypto.subtle.digest("SHA-256",P);z=btoa(String.fromCharCode(...new Uint8Array(A))).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}else z=N;if(z!==E.codeChallenge)return Response.json({error:"invalid_grant",error_description:"Invalid code_verifier"},{status:400})}let L={access_token:E.accessToken,token_type:E.tokenType};if(E.refreshToken)L.refresh_token=E.refreshToken;if(E.expiresIn!==void 0)L.expires_in=E.expiresIn;if(E.scope)L.scope=E.scope;return Response.json(L,{headers:{"Cache-Control":"no-store",Pragma:"no-cache"}})}catch(w){return console.error("Token exchange error:",w),Response.json({error:"server_error",error_description:"Failed to process token request"},{status:500})}},handleClientRegistration:async(U)=>{try{let w=await U.json();if(!w.redirect_uris||w.redirect_uris.length===0)return Response.json({error:"invalid_redirect_uri",error_description:"At least one redirect_uri is required"},{status:400});for(let D of w.redirect_uris)if(!w54(D))return Response.json({error:"invalid_redirect_uri",error_description:`Invalid redirect URI: ${D}`},{status:400});let F=Hb$(32),H=w.token_endpoint_auth_method!=="none"?Hb$(32):void 0,N=Math.floor(Date.now()/1000),B={client_id:F,client_secret:H,client_name:w.client_name,redirect_uris:w.redirect_uris,grant_types:w.grant_types??["authorization_code"],response_types:w.response_types??["code"],token_endpoint_auth_method:w.token_endpoint_auth_method??"client_secret_post",scope:w.scope,client_id_issued_at:N,client_secret_expires_at:0};if($.persistence)await $.persistence.saveClient(B);return new Response(JSON.stringify(B),{status:201,headers:{"Content-Type":"application/json","Cache-Control":"no-store",Pragma:"no-cache"}})}catch(w){return console.error("Client registration error:",w),Response.json({error:"invalid_client_metadata",error_description:"Invalid client registration request"},{status:400})}},createUnauthorizedResponse:(U)=>{let H=`Bearer resource_metadata="${`${AK(new URL(U.url)).origin}/.well-known/oauth-protected-resource`}", scope="*"`;return Response.json({jsonrpc:"2.0",error:{code:-32000,message:"Unauthorized: Authentication required"},id:null},{status:401,headers:{"WWW-Authenticate":H,"Access-Control-Expose-Headers":"WWW-Authenticate"}})},hasAuth:(U)=>U.headers.has("Authorization")}}var j81,AK=($)=>{if(!($.hostname==="localhost"||$.hostname.endsWith(".localhost")||$.hostname==="127.0.0.1"))$.protocol="https:";return $};var P81=O(()=>{j81=class j81 extends Error{error;errorDescription;constructor($="invalid_grant",Z){super(Z??$);this.name="OAuthInvalidGrantError",this.error=$,this.errorDescription=Z}}});import{AsyncLocalStorage as F54}from"async_hooks";var Db$,wr;var A81=O(()=>{Db$=new F54,wr={getStore:()=>{return Db$.getStore()},run:($,Z,...G)=>Db$.run($,Z,...G)}});var Lb$="SELF",tL0=($)=>{return typeof $==="object"&&$!==null&&"handler"in $&&"events"in $&&typeof $.handler==="function"&&Array.isArray($.events)},zb$=($)=>{return typeof $==="object"&&$!==null&&"handler"in $&&"events"in $&&typeof $.handler==="function"&&Array.isArray($.events)},Eb$="::",jb$=($)=>{let Z=$.indexOf(Eb$);if(Z===-1)return null;let G=$.substring(0,Z),X=$.substring(Z+Eb$.length);return[G,X]},H54=($)=>{if(!$.startsWith("cron/"))return null;let Z=$.substring(5),G=Z.indexOf("/");if(G===-1)return null;let X=Z.substring(0,G),Y=Z.substring(G+1);return[X,Y]},Pb$=($)=>{if(tL0($))return[];return Object.keys($)},N54=($,Z)=>{if(tL0($))return $.events;let G=$[Z];if(!G)return[];if(zb$(G))return G.events;return Object.keys(G)},pL0=($,Z,G)=>{if($===Lb$){if(!G)return console.warn("[Event] SELF binding used but no connectionId available"),null;return G}let X=Z[$];if(!z81(X))return console.warn(`[Event] Binding "${$}" not found in state`),null;return X.value},B54=($,Z,G)=>{let X=Z;if(tL0($)){let Q=[];for(let J of $.events){let W=jb$(J);if(!W){console.warn(`[Event] Global handler event "${J}" must be prefixed with BINDING:: (e.g., "SELF::${J}" or "DATABASE::${J}")`);continue}let[K,U]=W,w=pL0(K,X,G);if(!w)continue;Q.push({eventType:U,publisher:w})}return Q}let Y=[];for(let Q of Pb$($)){let J=pL0(Q,X,G);if(!J)continue;let W=N54($,Q);for(let K of W)Y.push({eventType:K,publisher:J})}return Y},O54=($)=>{let Z=new Map;for(let G of $){let X=G.source,Y=Z.get(X)||[];Y.push(G),Z.set(X,Y)}return Z},D54=($)=>{let Z=new Map;for(let G of $){let X=G.type,Y=Z.get(X)||[];Y.push(G),Z.set(X,Y)}return Z},E54=($)=>{let Z={},G={},X=!1,Y=0,Q=[];for(let J of $){if(J.results)Object.assign(G,J.results);if(J.success===!1){if(X=!0,J.error)Q.push(J.error)}if(J.processedCount!==void 0)Y+=J.processedCount}if(Object.keys(G).length>0)Z.results=G;if(Z.success=!X,Q.length>0)Z.error=Q.join("; ");if(Y>0)Z.processedCount=Y;return Z},L54=async($,Z,G,X,Y)=>{let Q=X;if(tL0($)){let w=new Set;for(let H of $.events){let N=jb$(H);if(!N)continue;let[B,D]=N,E=pL0(B,Q,Y);if(!E)continue;w.add(`${E}:${D}`)}let F=Z.filter((H)=>{let N=`${H.source}:${H.type}`;return w.has(N)});if(F.length===0)return{success:!0};try{return await $.handler({events:F},G)}catch(H){return{success:!1,error:H instanceof Error?H.message:String(H)}}}let J=new Map;for(let w of Pb$($)){let F=pL0(w,Q,Y);if(F)J.set(F,w)}let W=O54(Z),K=[];for(let[w,F]of W){let H=J.get(w);if(!H)continue;let N=$[H];if(!N)continue;if(zb$(N)){K.push((async()=>{try{return await N.handler({events:F},G)}catch(E){let L={};for(let z of F)L[z.id]={success:!1,error:E instanceof Error?E.message:String(E)};return{results:L}}})());continue}let B=N,D=D54(F);for(let[E,L]of D){let z=B[E];if(!z)continue;K.push((async()=>{try{let j=await z({events:L},G),P={};for(let A of L)P[A.id]=j;return{results:P}}catch(j){let P={};for(let A of L)P[A.id]={success:!1,error:j instanceof Error?j.message:String(j)};return{results:P}}})())}}let U=await Promise.all(K);if(U.length===0)return{success:!0};return E54(U)},Ab$;var T81=O(()=>{fg();Ab$={subscriptions:B54,execute:L54,parseCron:H54}});function z54($,Z){let G=nL0("self",{meshUrl:$,token:Z});return Yv.forConnection(G)}function j54($,Z){switch(Z.type){case"cron":return{automation_id:$,type:"cron",cron_expression:Z.cron};case"event":return{automation_id:$,type:"event",connection_id:Z.connectionId,event_type:Z.eventType,params:Z.params};case"webhook":return{automation_id:$,type:"webhook"}}}function Tb$($,Z,G){return async(X)=>{if(!$)throw Error("createAgent: missing meshUrl in MESH_REQUEST_CONTEXT");let Y=z54($,Z),J=(await Y.COLLECTION_VIRTUAL_MCP_LIST({where:{operator:"and",conditions:[{field:["title"],operator:"eq",value:X.name}]},limit:1})).items.find((w)=>w.title===X.name);if(J)return{id:J.id,automations:[],automationIds:[],alreadyExisted:!0};let W=X.tools&&X.tools.length>0?X.tools.map((w)=>({connection_id:w.connectionId,selected_tools:w.tools??null,selected_resources:null,selected_prompts:null})):G?[{connection_id:G,selected_tools:null,selected_resources:null,selected_prompts:null}]:[],{item:K}=await Y.COLLECTION_VIRTUAL_MCP_CREATE({data:{title:X.name,description:X.description,metadata:X.instructions?{instructions:X.instructions}:void 0,connections:W}}),U=[];for(let w of X.automations??[]){let F=await Y.AUTOMATION_CREATE({name:w.name,virtual_mcp_id:K.id,messages:w.messages,models:w.models,tools:w.tools,active:w.active??!0}),H=[];for(let N of w.triggers??[])try{let B=await Y.AUTOMATION_TRIGGER_ADD(j54(F.id,N));H.push({type:N.type,ok:!0,id:B.id,webhook:B.webhook??void 0})}catch(B){H.push({type:N.type,ok:!1,error:B instanceof Error?B.message:String(B)})}U.push({id:F.id,name:w.name,triggers:H})}return{id:K.id,automations:U,automationIds:U.map((w)=>w.id),alreadyExisted:!1}}}var I81=O(()=>{fg();iL0()});import{z as FZ}from"zod";function gw($){return{...$,execute:(Z)=>{let G=Fr(Z.runtimeContext);return $.execute({...Z,runtimeContext:G},G)}}}var Fr=($)=>{let Z=wr.getStore();if(!Z){if($)return $;throw Error("Missing context, did you forget to call State.bind?")}return Z},Ib$=($)=>{let Z=$.runtimeContext.env.MESH_REQUEST_CONTEXT;return{connectionId:Z?.connectionId,meshUrl:Z?.meshUrl,token:Z?.token}},P54=({events:$,configuration:{state:Z,scopes:G,onChange:X,onInstall:Y}={}}={})=>{let Q=Z?Jb$(FZ.toJSONSchema(Z)):{type:"object",properties:{}};return[...X||Y||$?[gw({id:"ON_MCP_CONFIGURATION",description:"MCP Configuration On Change",inputSchema:FZ.object({state:Z??FZ.unknown(),scopes:FZ.array(FZ.string()).describe("Array of scopes in format 'KEY::SCOPE' (e.g., 'GMAIL::GetCurrentUser')"),firstRun:FZ.boolean().optional().describe("True on the first configuration save for this connection \u2014 fires onInstall."),vault:FZ.object({baseUrl:FZ.string(),org:FZ.string(),subjectConnectionId:FZ.string(),token:FZ.string()}).optional()}),outputSchema:FZ.object({}),execute:async(J)=>{let W=J.context.state,K=J.context.vault;if(await X?.(J.runtimeContext.env,{state:W,scopes:J.context.scopes,vault:K}),Y&&J.context.firstRun){let{meshUrl:U,token:w,connectionId:F}=Ib$(J);await Y(J.runtimeContext.env,{createAgent:Tb$(U,w,F),vault:K})}return Promise.resolve({})}})]:[],...$?.handlers?[gw({id:"ON_EVENTS",description:"Receive and process CloudEvents from the event bus. Returns per-event or batch results.",inputSchema:E50,outputSchema:L50,execute:async(J)=>{let W=J.runtimeContext.env,K=W.MESH_REQUEST_CONTEXT?.state,{connectionId:U}=Ib$(J);return Ab$.execute($.handlers,J.context.events,W,K,U)}})]:[],gw({id:"MCP_CONFIGURATION",description:"MCP Configuration",inputSchema:FZ.object({}),outputSchema:FZ.object({stateSchema:FZ.unknown(),scopes:FZ.array(FZ.string()).optional()}),execute:()=>{return Promise.resolve({stateSchema:Q,scopes:[...G??[]]})}})]},Rb$=($)=>{let Z=null,G=null,X=null,Y=!1,Q=()=>{if(!Y)console.warn("[runtime] Passing factory functions to tools/prompts/resources is deprecated. Pass createTool()/createPrompt()/createResource() instances directly."),Y=!0},J=(N)=>typeof N==="object"&&N!==null&&(("id"in N)||("name"in N)||("uri"in N));async function W(N,B){if(!N)return[];return(await Promise.all(N.flatMap(async(D)=>{if(J(D))return[D];Q();let E=await D(B);if(Array.isArray(E))return E;return[E]}))).flat()}let K=async(N)=>{if(Z)return Z;if(G)return G;return G=(async()=>{try{let B;if(typeof $.tools==="function")Q(),B=await $.tools(N);else B=await W($.tools,N);B.push(...P54({...$}));let D;if(typeof $.prompts==="function")Q(),D=await $.prompts(N);else D=await W($.prompts,N);let E;if(typeof $.resources==="function")Q(),E=await $.resources(N);else E=await W($.resources,N);let L={tools:B,prompts:D,resources:E};return Z=L,L}catch(B){throw G=null,B}})(),G},U=(N,B)=>{for(let D of B.tools)N.registerTool(D.id,{_meta:D._meta,title:D.title,description:D.description,annotations:D.annotations,inputSchema:D.inputSchema&&"shape"in D.inputSchema?D.inputSchema:FZ.object({}),outputSchema:D.outputSchema&&typeof D.outputSchema==="object"&&"shape"in D.outputSchema?D.outputSchema:void 0},async(E)=>{let L=Fr(),z=await D.execute({context:E,runtimeContext:L},L);if(z!=null&&typeof z==="object"&&"content"in z&&Array.isArray(z.content)&&z.content.every((j)=>j!=null&&typeof j==="object"&&("type"in j)&&typeof j.type==="string"))return z;return{structuredContent:z,content:[{type:"text",text:JSON.stringify(z)}]}});for(let D of B.prompts)N.registerPrompt(D.name,{title:D.title,description:D.description,argsSchema:D.argsSchema?D.argsSchema:FZ.object({}).shape},async(E)=>{let L=Fr();return await D.execute({args:E,runtimeContext:L},L)});for(let D of B.resources)N.resource(D.name,D.uri,{description:D.description,mimeType:D.mimeType},async(E)=>{let L=Fr(),z=await D.read({uri:E,runtimeContext:L},L),j=z._meta??void 0;if(z.text!==void 0)return{contents:[{uri:z.uri,mimeType:z.mimeType,text:z.text,...j!==void 0?{_meta:j}:{}}]};else if(z.blob!==void 0)return{contents:[{uri:z.uri,mimeType:z.mimeType,blob:z.blob,...j!==void 0?{_meta:j}:{}}]};return{contents:[{uri:z.uri,mimeType:z.mimeType,text:""}]}})},w=async(N)=>{await $.before?.(N);let{instructions:B,...D}=$.serverInfo??{},E=new NU({...D,name:D.name??"@deco/mcp-api",version:D.version??"1.0.0"},{capabilities:{tools:{},prompts:{},resources:{}},jsonSchemaValidator:z5,...B&&{instructions:B}}),L=await K(N);U(E,L);let z="tools/list",j=E.server._requestHandlers,P=j.get(z);if(P)j.set(z,async(A,M)=>{if(!X)X=await P(A,M);return X});return{server:E,...L}};return{fetch:async(N,B)=>{let{server:D}=await w(B),E=new vY;await D.connect(E);let L=()=>{try{E.close?.()}catch{}try{D.close?.()}catch{}};try{let z=await E.handleRequest(N),j=z.headers.get("content-type");if(!(j?.includes("text/event-stream")||j?.includes("application/json-rpc"))||!z.body)return L(),z;let{readable:A,writable:M}=new TransformStream;return z.body.pipeTo(M).catch(()=>{}).finally(L),new Response(A,{status:z.status,statusText:z.statusText,headers:z.headers})}catch(z){throw L(),z}},callTool:async({toolCallId:N,toolCallInput:B})=>{let D=wr.getStore();if(!D)throw Error("Missing state, did you forget to call State.bind?");let E=D?.env,{tools:L}=await K(E),j=L.find((A)=>A.id===N)?.execute;if(!j)throw Error(`Tool ${N} not found or does not have an execute function`);let P=Fr();return j({context:B,runtimeContext:P},P)}}};var rL0=O(()=>{au0();jG();vu();Xy();fg();T81();A81();I81();T81();I81()});import{decodeJwt as qb$}from"jose";var A54=({env:$,server:Z,url:G})=>{$.SELF=new Proxy({},{get:(X,Y)=>{if(Y==="toJSON")return null;return async(Q)=>{return await Z.callTool({toolCallId:Y,toolCallInput:Q})}}}),$.IS_LOCAL=(G?.startsWith("http://localhost")||G?.startsWith("http://127.0.0.1"))??!1},Mb$=($)=>()=>{return{...$??{}}},T54=({env:$,server:Z,tokenOrContext:G,url:X,authToken:Y})=>{let Q=$,J=Y?Y.split(" ")[1]:void 0,W;if(typeof G==="string"){let K=qb$(G),U=K.metadata??{};W={authorization:J,state:K.state??U.state??{},token:G,meshUrl:K.meshUrl??U.meshUrl,connectionId:K.connectionId??U.connectionId,organizationId:K.organizationId??U.organizationId,organizationName:K.organizationName??U.organizationName,organizationSlug:K.organizationSlug??U.organizationSlug,ensureAuthenticated:Mb$(K.user??K.sub)}}else if(typeof G==="object"){W=G;let K=qb$(G.token),U=K.metadata??{},w=K.appName;W.authorization??=J,W.callerApp=w,W.connectionId??=K.connectionId??U.connectionId,W.organizationId??=K.organizationId??U.organizationId,W.organizationName??=K.organizationName??U.organizationName,W.organizationSlug??=K.organizationSlug??U.organizationSlug,W.ensureAuthenticated=Mb$(K.user??K.sub)}else W={state:{},authorization:J,token:void 0,meshUrl:void 0,connectionId:void 0,ensureAuthenticated:()=>{throw Error("Unauthorized")}};return Q.MESH_REQUEST_CONTEXT=W,W.state=Wb$(W),A54({env:Q,server:Z,url:X}),Q},I54,kb$=($)=>{let Z=Rb$($),G=$.cors??I54,X=$.oauth,Y=X?Ob$(X):null,Q=async(J,W,K)=>{let U=new URL(J.url);if(Y){if(U.pathname==="/.well-known/oauth-protected-resource"||U.pathname==="/mcp/.well-known/oauth-protected-resource")return Y.handleProtectedResourceMetadata(J);if(U.pathname==="/.well-known/oauth-authorization-server")return Y.handleAuthorizationServerMetadata(J);if(U.pathname==="/authorize")return Y.handleAuthorize(J);if(U.pathname==="/oauth/callback")return Y.handleOAuthCallback(J);if(U.pathname==="/token"&&J.method==="POST")return Y.handleToken(J);if((U.pathname==="/register"||U.pathname==="/mcp/register")&&J.method==="POST")return Y.handleClientRegistration(J)}if(U.pathname==="/mcp"){if(J.method==="GET")return new Response("Method not allowed",{status:405});if(Y&&!Y.hasAuth(J)){let w=J.clone();try{if((await w.json())?.method!=="tools/list")return Y.createUnauthorizedResponse(J)}catch{return Y.createUnauthorizedResponse(J)}}return Z.fetch(J,W,K)}if(U.pathname.startsWith("/mcp/call-tool")){let w=U.pathname.split("/").pop();if(!w)return new Response("Not found",{status:404});let F=await J.json(),H=await Z.callTool({toolCallId:w,toolCallInput:F});return new Response(JSON.stringify(H),{headers:{"Content-Type":"application/json"}})}return $.fetch?.(J,W,K)||new Response("Not found",{status:404})};return{fetch:async(J,W,K)=>{if(new URL(J.url).pathname==="/_healthcheck")return new Response("OK",{status:200});if(G!==!1&&J.method==="OPTIONS")return Ub$(J,G??{});let U=T54({authToken:J.headers.get("authorization")??null,env:{...process.env,...W},server:Z,tokenOrContext:J.headers.get("x-mesh-token")??void 0,url:J.url}),w=await wr.run({req:J,env:U,ctx:K},async()=>await Q(J,U,K));if(G!==!1)return wb$(w,J,G??{});return w}}};var Sb$=O(()=>{fg();Fb$();P81();P81();A81();rL0();rL0();fg();iL0();I54={origin:($)=>{if($.includes("localhost")||$.includes("127.0.0.1"))return $;return $},credentials:!0,allowMethods:["GET","POST","PUT","DELETE","OPTIONS"],allowHeaders:["Content-Type","Authorization","mcp-protocol-version"]}});import{z as R81}from"zod";function M54($,Z){let G=gw({id:"COLLECTION_REGISTRY_APP_LIST",description:"List public registry items",annotations:{readOnlyHint:!0,idempotentHint:!0},inputSchema:ty,outputSchema:ry,execute:async({context:W})=>{let K={limit:W.limit,offset:W.offset,cursor:W.cursor,tags:W.tags,categories:W.categories,where:W.where},U=`${Z}:${JSON.stringify(K)}`,w=Vb$.get(U);if(w)return w;let F=await $.listPublic(Z,K);return Vb$.set(U,F),F}}),X=gw({id:"COLLECTION_REGISTRY_APP_GET",description:"Get a public registry item by ID or name",annotations:{readOnlyHint:!0,idempotentHint:!0},inputSchema:FK,outputSchema:GC,execute:async({context:W})=>{let K=W.id??W.name;if(!K)return{item:null};let U=await $.findByIdOrName(Z,K);if(U&&U.is_public)return{item:U};return{item:null}}}),Y=gw({id:"COLLECTION_REGISTRY_APP_VERSIONS",description:"Get available versions of a public registry item",annotations:{readOnlyHint:!0,idempotentHint:!0},inputSchema:FK,outputSchema:R81.object({versions:R81.array(GC.shape.item)}),execute:async({context:W})=>{let K=W.id??W.name;if(!K)return{versions:[]};let U=await $.findByIdOrName(Z,K);if(U&&U.is_public)return{versions:[U]};return{versions:[]}}}),Q=gw({id:"COLLECTION_REGISTRY_APP_SEARCH",description:"Search public registry items returning minimal data (id, title, tags, categories, is_public). Use this instead of LIST when you need to find items efficiently without loading full details.",annotations:{readOnlyHint:!0,idempotentHint:!0},inputSchema:QE0,outputSchema:JE0,execute:async({context:W})=>{return await $.search(Z,W,{publicOnly:!0})}}),J=gw({id:"COLLECTION_REGISTRY_APP_FILTERS",description:"Get available tags and categories for public registry items",annotations:{readOnlyHint:!0,idempotentHint:!0},inputSchema:R81.object({}),outputSchema:oy,execute:async()=>{return await $.getFilters(Z,{publicOnly:!0})}});return[G,Q,X,Y,J]}function Cb$($){let Z=$.db,G=new Jx(Z);return async(X)=>{let Y=X.req.param("orgSlug")??X.req.param("org");if(!Y)return X.json({error:"Organization not found"},404);let Q=await Z.selectFrom("organization").select(["id","slug","name"]).where("slug","=",Y).executeTakeFirst();if(!Q)return X.json({error:"Organization not found"},404);let J=M54(G,Q.id),W=kb$({tools:J}),K=new URL(X.req.url),U=X.req.path.indexOf("/registry"),w=U>=0?X.req.path.slice(U+9):"",F=new URL(w||"/",K.origin);K.searchParams.forEach((B,D)=>{F.searchParams.set(D,B)});let H=new Request(F.toString(),{method:X.req.method,headers:X.req.raw.headers,body:X.req.method!=="GET"&&X.req.method!=="HEAD"?X.req.raw.body:void 0}),N={organizationId:Q.id,db:Z,MESH_REQUEST_CONTEXT:{},MESH_APP_DEPLOYMENT_ID:"public-registry",IS_LOCAL:!1};return await W.fetch(H,N,X)}}var R54=3600000,q54=500,Vb$;var _b$=O(()=>{Sb$();rL0();oy0();Q9();Vb$=_g({ttlMs:R54,maxSize:q54,updateRecencyOnGet:!0})});import{sql as k54}from"kysely";import{randomUUID as bb$}from"crypto";import{z as S54}from"zod";async function C54($){let Z=new Date().toISOString(),G=bb$(),X=G4.SELF($.organizationId),Y="registry.publish_request.created",Q={requestId:$.request.id,requestedId:$.request.requested_id,title:$.request.title,status:$.request.status,createdAt:$.request.created_at,requester:{name:$.request.requester_name,email:$.request.requester_email}};await $.db.insertInto("events").values({id:G,organization_id:$.organizationId,type:"registry.publish_request.created",source:X,specversion:"1.0",subject:$.request.id,time:Z,datacontenttype:"application/json",dataschema:null,data:JSON.stringify(Q),cron:null,status:"pending",attempts:0,last_error:null,next_retry_at:null,created_at:Z,updated_at:Z}).execute();let J=await $.db.selectFrom("event_subscriptions").select(["id"]).where("organization_id","=",$.organizationId).where("enabled","=",1).where("event_type","=","registry.publish_request.created").where((W)=>W.or([W("publisher","is",null),W("publisher","=",X)])).execute();if(J.length>0)await $.db.insertInto("event_deliveries").values(J.map((W)=>({id:bb$(),event_id:G,subscription_id:W.id,status:"pending",attempts:0,last_error:null,delivered_at:null,next_retry_at:null,created_at:Z}))).execute();try{await k54`SELECT pg_notify('mesh_events', ${G})`.execute($.db)}catch{}}async function _54($,Z){let X=(await $.selectFrom("organization").select(["id"]).where("id","=",Z).execute())[0];if(X?.id)return X.id;return(await $.selectFrom("organization").select(["id"]).where("slug","=",Z).execute())[0]?.id??null}async function b54($,Z){let G=await $.selectFrom("virtual_mcp_plugin_configs").innerJoin("connections","connections.id","virtual_mcp_plugin_configs.virtual_mcp_id").select(["virtual_mcp_plugin_configs.settings as settings"]).where("connections.organization_id","=",Z).where("virtual_mcp_plugin_configs.plugin_id","=",XC).execute();for(let X of G){let Y=X.settings,Q=typeof Y==="string"?(()=>{try{return JSON.parse(Y)}catch{return{}}})():Y??{};if(Q.acceptPublishRequests===!0){let J=Q.rateLimitWindow==="minute"?"minute":"hour",W=Q.rateLimitMax,K=typeof W==="number"&&Number.isFinite(W)&&W>=1?Math.floor(W):xb$;return{acceptPublishRequests:!0,requireApiToken:Q.requireApiToken===!0,rateLimitEnabled:Q.rateLimitEnabled===void 0?fb$:Q.rateLimitEnabled===!0,rateLimitWindow:J,rateLimitMax:K}}}return{acceptPublishRequests:!1,requireApiToken:!1,rateLimitEnabled:fb$,rateLimitWindow:V54,rateLimitMax:xb$}}async function f54($,Z,G){let X=G==="minute"?60000:3600000,Y=new Date(Date.now()-X).toISOString(),Q=await $.selectFrom("private_registry_publish_request").select((J)=>J.fn.countAll().as("count")).where("organization_id","=",Z).where("created_at",">=",Y).executeTakeFirst();return Number(Q?.count??0)}async function x54($,Z,G,X){let Y=await $.selectFrom("private_registry_item").select(["id","title"]).where("organization_id","=",Z).where((Q)=>Q.or([Q("id","=",G),Q("title","=",X)])).executeTakeFirst();return Y?{id:String(Y.id),title:String(Y.title)}:null}function vb$($){let{db:Z,db:G}=$,X=new Wx(G),Y=new Kx(G);return async(Q)=>{let J=Q.req.param("orgRef")??Q.req.param("org");if(!J)return Q.json({error:"Organization not found"},404);let W=await _54(Z,J);if(!W)return Q.json({error:"Organization not found"},404);let K=await b54(Z,W);if(!K.acceptPublishRequests)return Q.json({error:"Publish requests are not enabled for this registry."},403);if(K.requireApiToken){let N=Q.req.header("Authorization"),B=N?.startsWith("Bearer ")?N.slice(7).trim():null;if(!B)return Q.json({error:"API key required. Use Authorization: Bearer <key>"},401);if(!await Y.validate(W,B))return Q.json({error:"Invalid API key"},401)}if(K.rateLimitEnabled){if(await f54(G,W,K.rateLimitWindow)>=K.rateLimitMax)return Q.json({error:"Too many publish requests. Please try again later.",retryAfterSeconds:K.rateLimitWindow==="minute"?60:3600},429)}let U;try{U=await Q.req.json()}catch{return Q.json({error:"Invalid JSON body"},400)}let w=fP$.safeParse(U);if(!w.success)return Q.json({error:"Invalid publish request payload",details:S54.treeifyError(w.error)},400);let F=await x54(G,W,w.data.data.id,w.data.data.title);if(F)return Q.json({error:"A registry item with the same id or title already exists. Please use a different name/id.",conflict:F},409);let H=await X.createOrUpdate({organization_id:W,requested_id:w.data.data.id,title:w.data.data.title,description:w.data.data.description??null,_meta:w.data.data._meta,server:w.data.data.server,requester_name:w.data.requester?.name??null,requester_email:w.data.requester?.email??null});try{await C54({db:Z,organizationId:W,request:H})}catch(N){console.warn("[private-registry] failed to emit publish-request event:",N)}return i1.capture({distinctId:w.data.requester?.email??`org:${W}`,event:"registry_publish_request_submitted",groups:{organization:W},properties:{organization_id:W,request_id:H.id,requested_id:H.requested_id,title:w.data.data.title,requester_email:w.data.requester?.email??null}}),Q.json({id:H.id,requested_id:H.requested_id,status:H.status},201)}}var fb$=!0,V54="hour",xb$=100;var yb$=O(()=>{q4();f8();ay();ay0();sy0();Q9()});var gb$={};X6(gb$,{createPublishRequestHandler:()=>vb$,createPublicMCPHandler:()=>Cb$});var hb$=O(()=>{_b$();yb$()});var Rp0={};X6(Rp0,{watchHandler:()=>mb$,getProxyDispatch:()=>h54,createApp:()=>t54});import{readFileSync as v54}from"fs";import{PrometheusSerializer as y54}from"@opentelemetry/exporter-prometheus";import{DBOS as xg}from"@dbos-inc/dbos-sdk";import{oAuthDiscoveryMetadata as l54,oAuthProtectedResourceMetadata as m54}from"better-auth/plugins";async function g54($){let Z=$.connect(),G;try{G=await Promise.race([Z,ub$(cb$)])}catch{return Z.then((X)=>X.release(!0)).catch(()=>{}),!1}try{return await Promise.race([G.query("SELECT 1"),ub$(cb$)]),G.release(),!0}catch{return G.release(!0),!1}}function ub$($){return new Promise((Z,G)=>setTimeout(()=>G(Error("pg health-check timeout")),$))}function h54(){if(!q81)throw Error("getProxyDispatch() called before createApp() or without NATS \u2014 proxy dispatch unavailable");return q81}async function c54($,Z){let{items:G}=await $.storage.connections.list(Z,{where:{field:["connection_url"],operator:"like",value:`${T_1}%`},limit:1}),X=G[0];if(!X?.configuration_state)return null;return X.configuration_state.project_locator}function u54($){let Z=new URLSearchParams;if($){let[G,X]=$.split("/");if(G)Z.set("workspace_hint",G);if(X)Z.set("project_hint",X)}else Z.set("auto_personal","true");return Z.set("force_new","true"),Z}async function t54($={}){let Z=$.database??H6(),G=!1;Z9.stop().catch((g)=>{console.error("[SSEHub] Error stopping previous broadcast (HMR cleanup):",g)});let X,Y,Q=new e$1,J,W,K,U,w,F=null;if($.disableNats)J=$81(),X={get:async()=>null,set:async()=>{},invalidate:async()=>{},teardown:()=>{}},Y=new wp,W={start:async()=>{},broadcast:()=>{},publishControlFrame:()=>{},stop:async()=>{}},w=void 0,K={init:async()=>{},pump:(g)=>{return(async()=>{let H0=g.getReader();try{while(!0){let{done:f0}=await H0.read();if(f0)break}}catch{}finally{H0.releaseLock()}})()},publishRawChunk:async()=>!1,publishDone:async()=>!1,createTailStream:async()=>null,purge:()=>{},teardown:()=>{}};else{F=dC$();let g=O1().natsCredsPath,H0;if(g)try{H0=v54(g,"utf8")}catch(e1){console.error(`[app] failed to read NATS_CREDS at ${g}; connecting anonymously`,e1)}F.init(O1().natsUrls,H0?{creds:H0}:void 0);let f0=Yg0()?new rx0({getJetStream:()=>F.getJetStream()}):null;f0?.init().catch(()=>{}),X=f0;let e0=new Pt0({getJetStream:()=>F.getJetStream()});e0.init().catch(()=>{}),Y=e0,J=$81({getConnection:()=>F.getConnection()}),W=new Z81({getConnection:()=>F.getConnection()}),K=new Y81({getConnection:()=>F.getConnection(),getJetStream:()=>F.getJetStream()}),U=P_$({getConnection:()=>F.getConnection()}),w=M_$({getConnection:()=>F.getConnection()});let u0=k_$({getConnection:()=>F.getConnection()}),T1=W;W={start:(e1)=>T1.start(e1),broadcast:(e1)=>T1.broadcast(e1),publishControlFrame:(e1,z6)=>{u0.publishControlFrame(e1,z6).catch((J4)=>{console.warn("[TunnelControl] publishControlFrame failed (non-critical):",J4)})},stop:()=>T1.stop()},wI$(F),F.onReady(()=>{f0?.init().catch((e1)=>{console.error("[McpListCache] Deferred init failed:",e1)}),e0.init().catch((e1)=>{console.error("[ConnectionCircuitStore] Deferred init failed:",e1)}),J.start(),Oi1(()=>F.getConnection()),K.init().catch((e1)=>{console.warn("[Decopilot] StreamBuffer init failed (late-join disabled):",e1)})})}if(vg)await vg();ox0(X),At0(Y);let N={storage:new Ox(Z.db),sseHub:Z9},B=new Em0(N),D=new $m(Z.db),E=new K81(D);E.start(),W.start((g)=>{b90(g),B.execute({type:"CANCEL",taskId:g}).catch((H0)=>{console.error("[Decopilot] CancelBroadcast execute failed:",H0)})}).catch((g)=>{console.error("[Decopilot] CancelBroadcast start failed:",g)}),F?.onReady(()=>{W.start().catch((g)=>{console.error("[CancelBroadcast] Deferred start failed:",g)})}),K.init().catch((g)=>{console.warn("[Decopilot] StreamBuffer init failed, attach/late-join disabled:",g)}),vg=async()=>{await B.stopAll(),B.dispose(),E.dispose(),W.stop().catch(()=>{}),K.teardown(),X?.teardown(),Q.teardown(),J.teardown(),Di1(),Y.teardown(),ox0(null),At0(null)};let L=new b1;if(L.use("*",nb0({enabled:(g)=>vb(g,"debug")==="1"})),L.use("*",Bz0),L.use("/*",Kb1({origin:(g)=>{if(g.includes("localhost")||g.includes("127.0.0.1"))return g;return g},credentials:!0,allowMethods:["GET","POST","PUT","DELETE","OPTIONS"],allowHeaders:["Content-Type","Authorization","mcp-protocol-version"],exposeHeaders:["WWW-Authenticate"]})),L.use("*",async(g,H0)=>{if(await H0(),g.req.path.includes("/files/"))return;if(g.req.path.includes("/fs/")&&g.req.path.endsWith("/read"))return;g.header("X-Frame-Options","DENY"),g.header("Content-Security-Policy","frame-ancestors 'none'")}),!O1().noTui)L.use("*",h_$());L.use("*",async(g,H0)=>{if(await H0(),cg(g.req.path))return;if(g.res.status>=500){let e0=await g.res.clone().text();console.error(`[5xx Response] ${g.req.method} ${g.req.path} - ${g.res.status}:`,e0)}}),L.get(xZ.HEALTH,(g)=>{if(G)return g.json({status:"shutting_down"},503);return g.json({status:"ok"})}),L.get(xZ.HEALTH_LIVE,(g)=>{return g.json({status:"ok"})}),L.get(xZ.HEALTH_READY,async(g)=>{if(G)return g.json({status:"shutting_down"},503);let H0={};if(H0.postgres={status:await g54(Z.pool)?"up":"down"},F)H0.nats=F.isConnected()?{status:"up"}:{status:"down"};else H0.nats={status:"down"};let f0=H0.postgres.status==="up",e0=f0?200:503;return g.json({status:f0?"ready":"not_ready",services:H0},e0)}),L.get(xZ.METRICS,async(g)=>{try{let H0=await Lz0.collect(),f0=d54.serialize(H0.resourceMetrics);return g.text(f0,200,{"Content-Type":"text/plain; version=0.0.4; charset=utf-8"})}catch(H0){return console.error("Failed to collect metrics:",H0),g.text("# Error collecting metrics",500)}}),L.get(`${xZ.DBOS_QUEUE_DEPTH_PREFIX}:queueName`,async(g)=>{let H0=g.req.param("queueName");if(!i54.has(H0))return g.json({error:`Unknown queue: ${H0}`},404);let f0=await xg.listQueuedWorkflows({queueName:H0,status:"ENQUEUED"});return g.json({queue_length:f0.length})}),L.get(xZ.HOSTED_RUN_PENDING,(g)=>{let{active:H0,pending:f0,max:e0}=x4$();return g.json({pending:f0,active:H0,max:e0})}),L.route("/api/config",UC$),L.route("/api/_reports",PC$),L.route("/report",OC$($.clientDir)),L.route("/api/auth/custom",CI$),L.all("/api/auth/admin/*",fI$),L.all("/api/auth/*",async(g)=>{return await d8.handler(g.req.raw)});let z=ta1();z.use("/.well-known/oauth-protected-resource/mcp/:connectionId",WC),z.use("/mcp/:connectionId/.well-known/oauth-protected-resource",WC),L.route("/",z),L.get("/.well-known/oauth-protected-resource/api/:org/mcp/:connectionId",Si),L.route("/",sa1()),L.use("/oauth-proxy/:connectionId/*",WC),L.all("/oauth-proxy/:connectionId/*",db$);let j=async(g)=>{let f0=await n54()(g.req.raw),e0=await f0.json();return Response.json(e0,f0)};L.use("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",WC),L.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",j);let P=async(g)=>{let f0=await p54()(g.req.raw),e0=await f0.json();return Response.json(e0,f0)};L.get("/.well-known/oauth-authorization-server/*/:gateway?/:connectionId?",P);let A=UI$({ttlMs:120000}),M=await fa1({db:Z.db,auth:d8,encryption:{key:O1().encryptionKey},observability:{tracer:cw,meter:D8},modelListCache:Q,providerKeyCache:J,memberRoleCache:A,linkStatusProbe:U,publishLinkControlFrame:(g,H0)=>W.publishControlFrame(g,H0)});XN.set(M);let S=new jU(O1().encryptionKey);O21({db:Z.db,baseUrl:j3()});let R=Y60(Z.db),V=new nl(Z.db),i=x_$({db:Z.db});Dt0({storage:R,studioContextFactory:i}),Cm0({studioContextFactory:i,deps:{runRegistry:B,cancelBroadcast:W,streamBuffer:K,sseHub:Z9},prepareLinkWorkFn:qq$,workPublisher:w}),qm0({dispatchRunFn:Iq$,studioContextFactory:i,deps:{runRegistry:B,cancelBroadcast:W,streamBuffer:K,sseHub:Z9}});let f=new Ox(Z.db),v=new Zm(Z.db);L4$({getJetStream:()=>F?.getJetStream()??null,getJetStreamManager:async()=>{let g=F?.getConnection();return g?await lb$.jetstreamManager(g):null},messageParts:f.messageParts(),resolveRun:async(g)=>{let H0=await Z.db.selectFrom("threads").select(["organization_id","created_by","message_storage_version","status","run_fence_token","title"]).where("id","=",g).executeTakeFirst();return H0?{orgId:H0.organization_id,createdBy:H0.created_by,version:H0.message_storage_version??1,status:H0.status,runFenceToken:H0.run_fence_token,title:H0.title??null}:null},completeRunIfNotCompleted:async(g,H0)=>{let f0=await f.completeRunIfNotCompleted(g,H0);if(uL0(Z9,H0,g,f0),f0)await Tm0(v,g,H0);return f0},markRunRequiresAction:async(g,H0)=>{let f0=await f.requiresActionIfInProgress(g,H0);return uL0(Z9,H0,g,f0),f0},markRunFailed:async(g,H0,f0,e0)=>{let u0=await f.markRunFailed(g,H0,f0,e0);if(uL0(Z9,H0,g,u0),u0)await Tm0(v,g,H0);return u0},clearSynthesizedError:async(g,H0)=>{await f.messageParts().replaceMessageParts(g,jN(g,H0),[])},persistTitle:(g,H0,f0)=>f.update(g,H0,{title:f0}),onTitleUpdated:async({runId:g,orgId:H0,title:f0})=>{let e0=await f.get(g,H0).catch(()=>null);Z9.emit(H0,_3(g,e0?.status??"in_progress",{title:f0,virtualMcpId:e0?.virtual_mcp_id??void 0,createdBy:e0?.created_by,triggerId:e0?.trigger_id,branch:e0?.branch??null,createdAt:e0?.created_at,updatedAt:e0?.updated_at}))},bumpProgress:async({runId:g,orgId:H0})=>{await f.bumpProgress(g,H0)},recordCompleted:async({runId:g,orgId:H0,distinctId:f0,usage:e0})=>{i1.capture({distinctId:f0,event:"chat_message_completed",groups:{organization:H0},properties:{organization_id:H0,thread_id:g,transport:"projector",input_tokens:e0.inputTokens,output_tokens:e0.outputTokens,total_tokens:e0.totalTokens}})},recordFailed:async({runId:g,orgId:H0,distinctId:f0,reason:e0,kind:u0})=>{i1.capture({distinctId:f0,event:"chat_message_failed",groups:{organization:H0},properties:{organization_id:H0,thread_id:g,transport:"projector",error_category:u0,error_message:e0}})},purgeRun:async(g)=>{K.purge(g)}}),aJ$({studioContextFactory:i,systemDatabaseUrl:_x1(O1().databaseUrl,O1().databasePgSsl),streamBuffer:K}),b_$(),D21();let Z0=async(g,H0,f0)=>{let e0=await R.findById(g,H0);if(!e0)throw Error("Automation not found");return zt0({automationId:e0.id,organizationId:e0.organization_id,triggerId:null})},o=new Hg(R,({automation:g,trigger:H0,contextMessages:f0,idempotencyKey:e0})=>Kp({automationId:g.id,organizationId:g.organization_id,triggerId:H0.id,contextMessages:f0},{idempotencyKey:e0})),B0=[eQ(),qC(),RK()];for(let g of B0)mL0(g).then(()=>{}).catch((H0)=>console.error("[monitoring] Retention cleanup failed:",H0));let D0=()=>Z.db.deleteFrom("apikey").where("expiresAt","<",new Date).execute().then(()=>{}).catch((g)=>console.error("[auth] Expired API key cleanup failed:",g));D0(),setInterval(D0,86400000).unref(),L.use("*",async(g,H0)=>{if(Hz0(g.req.path))return H0();let f0={measure:async(u0,T1)=>{UQ(g,u0);try{return await T1()}finally{JY(g,u0)}}},e0=await XN.create(g.req.raw,{timings:f0});e0.automationRunner=Z0,g.set("studioContext",e0);try{await H0()}finally{let u0=e0.pendingRevalidations;if(u0.length>0)Promise.race([Promise.allSettled(u0),O8(30000)]).catch((e1)=>console.error("[studio] revalidation cleanup error:",e1))}}),L.use("/api/:org/decopilot/*",KC),L.use("/api/:org/v1/*",KC),L.use("/api/:org/files/*",KC),L.use("*",async(g,H0)=>{let f0=g.req.path;if(f0.startsWith("/api/org-sso/")||f0.startsWith("/api/auth/")||f0.startsWith("/api/tools/management")||f0.startsWith("/oauth-proxy/")||f0.startsWith(`${Z01}/`))return H0();let e0=g.get("studioContext");if(!e0?.organization?.id||!e0?.auth?.user?.id)return H0();if(!(await e0.storage.orgSsoConfig.getByOrgId(e0.organization.id))?.enforced)return H0();if(!await e0.storage.orgSsoSessions.isValid(e0.auth.user.id,e0.organization.id))return g.json({error:"SSO authentication required for this organization"},403);return H0()});let J0=new b1;J0.use("*",pQ({mountPath:"/api/org-sso"})),J0.route("/",jE0()),L.route("/api/org-sso",J0),L.get("/api/tools/management",(g)=>{return g.json({tools:tb0,grouped:tO()})}),L.use("/mcp/*",async(g,H0)=>{UQ(g,"mcp");try{return await H0()}finally{JY(g,"mcp")}});let Y0=async(g,H0)=>{let f0=g.var.studioContext;if(!f0.auth.user?.id&&!f0.auth.apiKey?.id){let e0=new URL(g.req.url);return g.res=new Response(null,{status:401,headers:{"WWW-Authenticate":`Bearer realm="mcp",resource_metadata="${e0.origin}${e0.pathname}/.well-known/oauth-protected-resource"`}})}return await H0()};if(L.use("/mcp/:connectionId?",Y0),L.use("/mcp/gateway/:virtualMcpId?",Y0),L.use("/mcp/virtual-mcp/:virtualMcpId?",Y0),L.use("/mcp/self",Y0),b3()){let{mountDevRoutes:g}=(Gb$(),Zz0(Zb$));g(L,Y0)}let a=new b1;a.use("*",pQ({mountPath:"/mcp"})),a.route("/",JB0()),L.route("/mcp",a);let A0=new b1;A0.use("*",pQ({mountPath:"/mcp/self"})),A0.route("/",SL0()),L.route("/mcp/self",A0);let U0=new b1;U0.use("*",pQ({mountPath:"/mcp"})),U0.route("/",UB0()),L.route("/mcp",U0),L.use("/api/:org/models/*",async(g,H0)=>{UQ(g,"llm_models");try{return await H0()}finally{JY(g,"llm_models")}});let v0=$11({cancelBroadcast:W,streamBuffer:K,runRegistry:B,linkStatusProbe:U});if(L.route("/api",v0),F!=null)q81=T_$({getConnection:()=>F?.getConnection()??null});L.route("/api",nV$()),L.get("/api/links/me",async(g)=>{try{let H0=g.req.header("authorization")??"",f0=/^Bearer\s+(.+)$/i.exec(H0),e0=null;if(f0){let T1=(f0[1]??"").trim();e0=await SV$(T1,d8.api)}else e0=g.get("studioContext")?.auth?.user?.id??null;if(!e0)return g.json({error:"unauthorized"},401);let u0=U?await U(e0):{online:!1,capabilities:[]};if(!u0.online)return g.json(null);return g.json({hostname:u0.hostname,cliVersion:u0.cliVersion})}catch(H0){return console.error("[links/me] presence probe failed; reporting offline:",H0 instanceof Error?H0.message:String(H0)),g.json(null)}}),L.use("/api/:org/files/*",KC),L.route("/api",RC$);let d0=new b1;d0.use("*",pQ({mountPath:"/api"})),d0.route("/",VL0()),L.route("/api",d0),L.route("/api",YC$);let i0=new b1;i0.use("*",pQ({mountPath:"/api"})),i0.route("/",CL0({tokenStorage:V,automationEventDispatcher:o})),L.route("/api",i0);let n0=new tl(Z.db),w0=new b1;w0.use("*",pQ({mountPath:"/api"})),w0.route("/",oE0()),L.route("/api",w0),L.route("/api/deco-sites",tq$()),L.route("/api/deco-apps",sV$());let C0=new b1;C0.use("*",pQ({mountPath:"/api/deco-sites"})),C0.route("/",sE0()),L.route("/api/deco-sites",C0);let T0=new b1;T0.use("*",pQ({mountPath:"/api/vm-events"})),T0.route("/",oV$()),L.route("/api/vm-events",T0);let{createPublishRequestHandler:N0,createPublicMCPHandler:Q0}=await Promise.resolve().then(() => (hb$(),gb$)),G0={db:Z.db,vault:{encrypt:(g)=>S.encrypt(g),decrypt:(g)=>S.decrypt(g)}},V0=N0(G0),n=Q0(G0);L.use("/org/:orgRef/registry/publish-request",WC),L.post("/org/:orgRef/registry/publish-request",V0),L.use("/org/:orgSlug/registry/*",WC),L.all("/org/:orgSlug/registry/*",n),L.post("/api/:org/registry/publish-request",V0),L.all("/api/:org/registry/*",n),L.route(Z01,xI$());let e=MV$({kvStorage:n0,runRegistry:B,streamBuffer:K,sseHub:Z9,cancelBroadcast:W,tokenStorage:V,automationEventDispatcher:o,mountDevAssets:b3(),mcpAuth:Y0,oauthProxyHandler:db$,watchHandler:mb$,betterAuthProtectedResourceHandler:j,getNatsConnection:()=>F?.getConnection()??null});return L.route("/api/:org",e),L.notFound((g)=>{return g.json({error:"Not Found",path:g.req.path},404)}),L.onError(xq$),Object.assign(L,{markShuttingDown:()=>{G=!0},shutdown:async()=>{if(console.log("[shutdown] Stopping workers..."),await Promise.allSettled([Z9.stop(),vg?Promise.resolve(vg()).finally(()=>{vg=null}):Promise.resolve()]),F)await F.drain().catch((g)=>console.error("[shutdown] NATS drain error:",g));console.log("[shutdown] Flushing telemetry..."),await lY().catch((g)=>console.error("[shutdown] Telemetry flush error:",g)),console.log("[shutdown] Closing database..."),await fx1(Z).catch((g)=>console.error("[shutdown] Database close error:",g)),console.log("[shutdown] Cleanup complete.")},initDbos:async()=>{await xg.registerQueue(dY,{partitionQueue:!0,concurrency:Nt0,minPollingIntervalMs:Bt0}),await xg.registerQueue(sQ,{partitionQueue:!0,concurrency:Vm0}),await xg.registerQueue(IK,{partitionQueue:!0,concurrency:Rm0}),await xg.registerQueue(hw,{partitionQueue:!0,concurrency:oJ$}),await Y11(R),await Promise.allSettled(["automations-gate","automations-global"].map((g)=>xg.deleteQueue(g))),await Ot0(Z.pool),Yh1().catch((g)=>{console.error("[studio-pack-backfill] failed:",g)}),E21().catch((g)=>{console.error("[org-fs] public-sets boot sync kick failed:",g)})}})}var lb$,cb$=5000,q81=null,vg=null,db$=async($)=>{let Z=$.req.param("connectionId");if(!Z)return $.json({error:"Missing connectionId"},400);let G=$.req.path.split("/").filter(Boolean),X=G[G.length-1],Y=$.get("studioContext");if(!Y)Y=await XN.create($.req.raw),$.set("studioContext",Y);let Q=$.req.param("org")?Y.organization?.id:void 0,J=await Y.storage.connections.findById(Z,Q);if(!J?.connection_url)return $.json({error:"Connection not found"},404);let W=await sx(J.connection_url),K,U=new URL(J.connection_url);if(W.ok)K=(await W.json()).authorization_servers?.[0];if(!K)K=U.origin;let w=await Vi(K);if(!w.ok)return $.json({error:"Failed to get auth server metadata"},502);let F=await w.json(),H;if(X==="authorize")H=F.authorization_endpoint;else if(X==="token")H=F.token_endpoint;else if(X==="register")H=F.registration_endpoint;if(!H)return $.json({error:`Unknown OAuth endpoint: ${X}`},404);let N=new URL(H),B=new URL($.req.url);if(N.search=B.search,X==="authorize"){let R=N.searchParams.get("redirect_uri");if(R){let V=O1().baseUrl??B.origin;try{let i=new URL(R),f=new URL(V);if(!(i.origin===f.origin||i.hostname==="localhost"))return $.json({error:"invalid_request",error_description:"redirect_uri is not allowed"},400)}catch{return $.json({error:"invalid_request",error_description:"redirect_uri is malformed"},400)}N.searchParams.set("redirect_uri",R)}if(N.searchParams.has("resource"))N.searchParams.set("resource",J.connection_url);if(I_1(J.connection_url))try{let V=await c54(Y,J.organization_id),i=u54(V);for(let[f,v]of i)N.searchParams.set(f,v)}catch(V){console.warn("[oauth-proxy] Failed to get smart OAuth params, proceeding without:",V)}return $.redirect(N.toString(),302)}let D={Accept:$.req.header("Accept")||"application/json"},E=$.req.header("Content-Type");if(E)D["Content-Type"]=E;let L=$.req.header("Authorization");if(L)D.Authorization=L;let z,j=null,P=null;if($.req.method!=="GET"&&$.req.method!=="HEAD")if(X==="token"&&E?.includes("application/x-www-form-urlencoded")){if(L?.toLowerCase().startsWith("basic "))try{let v=atob(L.slice(6).trim()),Z0=v.indexOf(":");if(Z0!==-1){let o=decodeURIComponent(v.slice(0,Z0)),B0=decodeURIComponent(v.slice(Z0+1));j=o||null,P=B0||null}}catch{}let R=await $.req.formData();if(R.has("resource"))R.set("resource",J.connection_url);let V=R.get("client_id"),i=R.get("client_secret");if(typeof V==="string"&&V)j=V;if(typeof i==="string"&&i)P=i;let f=new URLSearchParams;for(let[v,Z0]of R.entries())f.append(v,Z0.toString());z=f.toString()}else if(X==="register"&&E?.toLowerCase().includes("application/json")){let R=await Y.db.selectFrom("organization").select(["id","slug","name"]).where("id","=",J.organization_id).executeTakeFirst(),V=await $.req.text(),i={};try{i=V?JSON.parse(V):{}}catch{z=V}let f=typeof i==="object"&&i!==null&&!Array.isArray(i);if(z===void 0&&!f)z=V;if(z===void 0){let v=i,Z0=v.metadata&&typeof v.metadata==="object"?v.metadata:{};v.metadata={...Z0,organization_id:J.organization_id,...R?.slug?{organization_slug:R.slug}:{},...R?.name?{organization_name:R.name}:{}},z=JSON.stringify(v),D["Content-Type"]="application/json"}}else z=$.req.raw.body??void 0;let A=await fetch(N.toString(),{method:$.req.method,headers:D,body:z,duplex:"half",redirect:"manual"}),M=new Headers,S=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];for(let[R,V]of A.headers.entries())if(!S.includes(R.toLowerCase()))M.set(R,V);if(X==="token"&&A.ok){let R=await A.text();try{let V=JSON.parse(R);if(typeof V.access_token==="string"&&V.access_token){let i=typeof V.expires_in==="number"?new Date(Date.now()+V.expires_in*1000):null,f=null;try{f=await ex(J.connection_url)??H}catch{f=H}let v={connectionId:Z,accessToken:V.access_token,refreshToken:typeof V.refresh_token==="string"?V.refresh_token:null,scope:typeof V.scope==="string"?V.scope:null,expiresAt:i,clientId:j,clientSecret:P,tokenEndpoint:f};await new b5(Y.db,Y.vault).upsert(v)}}catch(V){console.error("[oauth-proxy] failed to persist downstream token:",V)}return new Response(R,{status:A.status,statusText:A.statusText,headers:M})}return new Response(A.body,{status:A.status,statusText:A.statusText,headers:M})},mb$=async($)=>{let Z=$.var.studioContext;if(!(Z.auth.user?.id??Z.auth.apiKey?.userId))return $.json({error:"Unauthorized"},401);let X=Z.organization?.id;if(!X)return $.json({error:"organization id missing"},400);let Y=$.req.query("types"),Q=Y?Y.split(",").map((W)=>W.trim()).filter(Boolean):null,J=crypto.randomUUID();return tQ($,async(W)=>{if(await W.writeSSE({event:"connected",data:JSON.stringify({listenerId:J,organizationId:X,typePatterns:Q,connectedAt:new Date().toISOString()})}),!Z9.add({id:J,organizationId:X,typePatterns:Q?.length?Q:null,push:(w)=>{W.writeSSE({id:w.id,event:w.type,data:JSON.stringify(w)}).catch(()=>{Z9.remove(X,J)})}})){await W.writeSSE({event:"error",data:JSON.stringify({error:"Too many connections",message:"SSE connection limit reached. Try again later."})});return}let U=setInterval(()=>{W.writeSSE({event:"keepalive",data:""}).catch(()=>{clearInterval(U)})},30000);await new Promise((w)=>{W.onAbort(()=>{clearInterval(U),Z9.remove(X,J),w()})})})},d54,i54,n54=()=>m54(d8),p54=()=>l54(d8);var qp0=O(()=>{l5();F8();L21();BG();bb();f8();F6();Z$0();Ub1();pb0();wJ();ki();pe0();HQ();B5();q4();$01();vI$();Q01();bq$();Z11();YJ();n40();G11();vq$();X11();kV$();pV$();aV$();K11();eV$();WB0();Ci();QC$();wB0();b$1();wC$();DC$();AC$();qC$();_$1();C$1();Ar();Bd();lC$();UY();A60();ol();It0();mC$();nC$();sC$();A_$();I_$();S_$();Lm0();V_$();Eg0();Vg0();aU();Ag0();f_$();o$0();U81();iX();Q11();Iv();Am0();Om0();o$0();o01();uy0();dy0();v_$();yb();c_$();EC();pe0();$y();f90();lb$=k(cB(),1);d54=new y54,i54=new Set([dY,sQ,IK,hw])});var tb$={};X6(tb$,{resolveClientDir:()=>Z94,resolveAssetPathWithTraversalCheck:()=>pb$,isPathWithinDirectory:()=>nb$,createAssetHandler:()=>G94});import{resolve as Hr,dirname as r54,join as o54,extname as a54,basename as s54,sep as ib$}from"path";function e54($,Z){if($===Z||s54($)==="index.html")return{"Cache-Control":"no-cache"};if($.includes(`${ib$}assets${ib$}`))return{"Cache-Control":"public, max-age=31536000, immutable"};return{}}function nb$($,Z){let G=Hr(Z),X=Hr($);return X===G||X.startsWith(G+"/")}function pb$({requestPath:$,clientDir:Z}){let G=$.startsWith("/")?$.slice(1):$,X=Hr(Z,G);if(!nb$(X,Z))return null;return X}function Z94($,Z="../client"){let G=new URL($),X=r54(G.pathname);return Hr(X,Z)}function G94($={}){let{env:Z="production",clientDir:G=$94,isServerPath:X=()=>!1}=$;if(Z==="development")return async function(Q){return null};return async function(Q){if(Q.method!=="GET")return null;let J=new URL(Q.url),W;try{W=decodeURIComponent(J.pathname)}catch{return null}if(X(W))return null;let K=pb$({requestPath:W,clientDir:G});if(!K)return null;let U=o54(K,"index.html"),w=Hr(G,"index.html"),F=Q.headers.get("accept"),N=F?.includes("text/html")||F?.includes("*/*")&&["",".html"].includes(a54(K))?[U,w]:[];for(let B of[K,...N])try{let D=Bun.file(B);if(await D.exists())return new Response(D,{headers:e54(B,w)})}catch{}if(W.includes("/assets/"))return new Response("Not Found",{status:404,headers:{"Cache-Control":"no-store"}});return null}}var $94="./dist/client";var rb$=()=>{};var ob$={};X6(ob$,{tryUpgradePreviewWs:()=>U94,tryHandlePreviewHttp:()=>K94,previewWebSocketHandler:()=>w94,parsePreviewBaseDomain:()=>W94,isPreviewWsData:()=>oL0,extractHandleFromHost:()=>M81});function Q94($){if($.method!=="GET")return!1;return($.headers.get("accept")??"").includes("text/html")}function J94(){return new Response(Y94,{status:503,headers:{"content-type":"text/html; charset=utf-8","cache-control":"no-store","retry-after":"1","access-control-allow-origin":"*"}})}function W94($){if(!$||$.trim()==="")return null;let Z=$.includes("{handle}")?$.replace("{handle}","__handle__"):$,G;try{G=new URL(Z)}catch{return null}let X=G.hostname;if($.includes("{handle}")){let Y=X.indexOf(".");if(Y<=0||Y===X.length-1)return null;return X.slice(Y+1)}return X}function M81($,Z){if(!$||!Z)return null;let G=$.indexOf(":"),X=(G>=0?$.slice(0,G):$).toLowerCase(),Q=`.${Z.toLowerCase().replace(/^\.+|\.+$/g,"")}`;if(!X.endsWith(Q))return null;let J=X.slice(0,X.length-Q.length);if(!J||J.includes("."))return null;return J}async function K94($,Z){let G=M81($.headers.get("host"),Z.baseDomain);if(!G)return null;let X=await Z.getRunner();if(!X)return Br(503,"preview proxy not configured");let Y=await X.proxyPreviewRequest(G,$);if(Y.headers.get(zV)&&Q94($))return J94();return Y.headers.delete(zV),Y}function Br($,Z){return new Response(JSON.stringify({error:Z}),{status:$,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function oL0($){return typeof $==="object"&&$!==null&&$.kind==="preview"}async function U94($,Z,G){if(($.headers.get("upgrade")??"").toLowerCase()!=="websocket")return null;let X=M81($.headers.get("host"),G.baseDomain);if(!X)return null;let Y=await G.getRunner();if(!Y)return Br(503,"preview proxy not configured");let Q=await Y.resolvePreviewUpstreamUrl(X);if(!Q)return Br(404,"sandbox not found");let J=new URL($.url);if(J.pathname.startsWith("/_sandbox")||J.pathname.startsWith("/_decopilot_vm"))return Br(404,"not found");let W=`${Q.replace(/^http/,"ws")}${J.pathname}${J.search}`,K=$.headers.get("sec-websocket-protocol"),U=K?K.split(",").map((H)=>H.trim()).filter(Boolean):[],w={kind:"preview",upstreamUrl:W,upstreamProtocols:U,pending:[],upstream:null,closed:!1};if(!Z.upgrade($,{data:w}))return Br(426,"upgrade failed");return}function Nr($,Z,G,X){if(Z.closed)return;Z.closed=!0;try{$.close(G,X)}catch{}try{Z.upstream?.close()}catch{}}var X94=256,Y94='<!DOCTYPE html><html><head><meta charset="utf-8"><title>Connecting\u2026</title><style>body{font-family:system-ui,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0;background:#fafafa;color:#555}div{text-align:center;max-width:420px;padding:24px}h3{margin:0 0 8px}p{margin:0;font-size:14px;color:#999;line-height:1.5}</style></head><body><div><h3>Connecting to sandbox\u2026</h3><p>Waiting for the sandbox to come online. This page refreshes automatically.</p></div><script>setTimeout(function(){window.location.reload()},1500)</script></body></html>',w94;var ab$=O(()=>{Pp0();w94={open($){let Z=$.data;if(!oL0(Z))return;let G;try{G=Z.upstreamProtocols.length>0?new WebSocket(Z.upstreamUrl,Z.upstreamProtocols):new WebSocket(Z.upstreamUrl)}catch(X){console.warn(`[preview-ws] failed to dial upstream ${Z.upstreamUrl}: ${X instanceof Error?X.message:String(X)}`),Nr($,Z,1011,"upstream connect failed");return}G.binaryType="arraybuffer",Z.upstream=G,G.addEventListener("open",()=>{while(Z.pending.length>0){let X=Z.pending.shift();if(X!==void 0)G.send(X)}}),G.addEventListener("message",(X)=>{if(Z.closed)return;$.send(X.data)}),G.addEventListener("close",(X)=>{Nr($,Z,X.code||1000,X.reason||"")}),G.addEventListener("error",()=>{Nr($,Z,1011,"upstream error")})},message($,Z){let G=$.data;if(!oL0(G))return;let X=G.upstream;if(X&&X.readyState===WebSocket.OPEN){X.send(Z);return}if(G.pending.length>=X94){Nr($,G,1011,"preview ws backlog overflow");return}G.pending.push(Z)},close($){let Z=$.data;if(!oL0(Z))return;Nr($,Z,1000,"")}}});var Zf$={};X6(Zf$,{printBanner:()=>H94,bannerLines:()=>$f$,BANNER_LINES:()=>sb$,BANNER_GRADIENT:()=>eb$});function F94($){let Z=Number.parseInt($.slice(1),16);return[Z>>16&255,Z>>8&255,Z&255]}function $f$($){let Z=sb$.map((G,X)=>{let[Y,Q,J]=F94(eb$[X]);return`\x1B[38;2;${Y};${Q};${J}m${G}\x1B[39m`});if($!==void 0)Z.push(`\x1B[2m  v${$}\x1B[22m`);return Z}function H94($){console.log("");for(let Z of $f$($))console.log(Z);console.log("")}var sb$,eb$;var Gf$=O(()=>{sb$=[" \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588     \u2588\u2588\u2588\u2588\u2588\u2588\u2588   ","\u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588 "," \u2591\u2588\u2588\u2588   \u2591\u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588  \u2588 \u2591  \u2588\u2588\u2588     \u2591\u2591\u2591  \u2588\u2588\u2588     \u2591\u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2588\u2588\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2591\u2591\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2588\u2588\u2588  \u2591\u2588\u2588\u2588 \u2591   \u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588 "," \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588  \u2591\u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2591  ","\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591     \u2591\u2591\u2591\u2591\u2591\u2591\u2591   "],eb$=["#00ff64","#00ee5e","#00dc56","#00c84e","#00b444","#00a03c","#008832","#006e28"]});var Yf$={};X6(Yf$,{bootstrapDevLinkSession:()=>P94});import{existsSync as N94}from"fs";import{chmod as B94,mkdir as O94,rename as D94,writeFile as E94}from"fs/promises";import{dirname as L94,join as Xf$}from"path";function z94($){return Xf$($,"dev-link")}function j94($){let Z=process.env.DEV_LINK_SESSION_PATH;if(Z&&Z.trim()!=="")return Z;return Xf$(z94($),"session.json")}async function P94($,Z){let G=j94($),X=H6().db,Y=yQ()?await Yp():await X.selectFrom("user").select(["id","email","name"]).orderBy("createdAt","desc").executeTakeFirst();if(!Y?.id)return null;if(N94(G))try{let U=await Bun.file(G).json(),w=U.user?.sub,F=U.accessToken;if(w===Y.id&&typeof F==="string"){if(await d8.api.verifyApiKey({body:{key:F}}).then((N)=>N?.valid===!0).catch(()=>!1))return{path:G,userSub:w}}}catch{}let Q=null;try{Q=await d8.api.createApiKey({body:{name:"dev-link (auto-minted by bun run dev)",userId:Y.id,permissions:{"*":["*"]},expiresIn:2592000,rateLimitEnabled:!1}})}catch(K){return console.warn("[dev-link] failed to mint API key:",K instanceof Error?K.message:String(K)),null}if(!Q?.key)return null;let J={target:Z,clientId:"dev-link",user:{sub:Y.id,...Y.email?{email:Y.email}:{},...Y.name?{name:Y.name}:{}},accessToken:Q.key,createdAt:new Date().toISOString()};await O94(L94(G),{recursive:!0});let W=`${G}.tmp`;return await E94(W,JSON.stringify(J,null,2),{mode:384}),await B94(W,384),await D94(W,G),{path:G,userSub:Y.id}}var Qf$=O(()=>{HQ();wJ();nN()});l5();var g81="4";function h81($){return{name:"decocms",systemDatabaseUrl:$.systemDatabaseUrl,systemDatabaseSchemaName:"dbos",systemDatabasePoolSize:$.poolSize,runAdminServer:!1,executorID:$.executorID,applicationVersion:g81,...$.listenQueues!==void 0?{listenQueues:$.listenQueues}:{}}}F8();Xz0();B5();function zx$(){let $=(process.env.BUN_OPTIONS??"").split(/\s+/).filter(Boolean);return[...process.argv.slice(1),...$]}function Az0($,Z){for(let G=0;G<$.length;G++){let X=$[G];if(X===void 0)continue;if(X===Z)return $[G+1];if(X.startsWith(`${Z}=`))return X.slice(Z.length+1)}return}function j61(){let $=zx$();if($.includes("--cpu-prof")){console.log(JSON.stringify({msg:"cpu-profiling-active",dir:Az0($,"--cpu-prof-dir")??process.cwd(),name:Az0($,"--cpu-prof-name"),markdown:$.includes("--cpu-prof-md"),intervalUs:Number(Az0($,"--cpu-prof-interval")??1000),note:"profile is written on process exit"}));return}if(process.env.CPU_PROFILE)console.warn(JSON.stringify({msg:"cpu-profiling-requested-but-inactive",hint:'CPU profiling is a Bun launch flag. Set BUN_OPTIONS="--cpu-prof --cpu-prof-md --cpu-prof-dir=/tmp" before starting the process.'}))}Rz0();var Rr;function S61(){if(process.env.HEAP_WATCH!=="1")return()=>{};let $=Number(process.env.HEAP_WATCH_INTERVAL_MS??60000),Z=async()=>{let G=MB();if(!G)return;let X={};try{let{heapStats:Y}=await import("bun:jsc"),Q=Y(),J=Object.entries(Q.objectTypeCounts).sort((W,K)=>K[1]-W[1]).slice(0,20);X={objectCount:Q.objectCount,heapSize:Q.heapSize,top:Object.fromEntries(J)}}catch{}console.log(JSON.stringify({msg:"heap-watch",ts:new Date().toISOString(),uptimeS:Math.round(process.uptime()),rss:G.rss,heapUsed:G.heapUsed,heapTotal:G.heapTotal,external:G.external,arrayBuffers:G.arrayBuffers,...X}))};return Z().catch(()=>{}),Rr=setInterval(()=>void Z().catch(()=>{}),$),Rr.unref?.(),process.on("SIGUSR2",()=>{try{let G=Bun.generateHeapSnapshot("v8"),X=typeof G==="string"?G:JSON.stringify(G),Y=`/tmp/heap-${process.pid}-${Date.now()}.heapsnapshot`;Bun.write(Y,X),console.log(JSON.stringify({msg:"heap-snapshot-written",path:Y}))}catch(G){console.error("[heap-watch] snapshot failed:",G)}}),()=>{if(Rr)clearInterval(Rr)}}import*as Ax$ from"bun:jsc";var{startSamplingProfiler:Tx$,samplingProfilerStackTraces:Ix$}=Ax$;function V61(){if(process.env.STALL_WATCHDOG!=="1")return()=>{};let $=Number(process.env.STALL_WATCHDOG_MS??100),Z=Number(process.env.STALL_WATCHDOG_TICK_MS??50);try{Tx$()}catch(Q){return console.error("[stall-watchdog] failed to start sampling profiler:",Q),()=>{}}let G,X=performance.now()+Z,Y=()=>{let Q=performance.now(),J=Q-X;X=Q+Z;let W=[];try{W=Ix$()?.traces??[]}catch{}if(J>$&&W.length>0){let K=new Map;for(let w of W){let F=w.frames.find((B)=>B.sourceURL&&!/Unknown Executable/.test(B.category??""))??w.frames[0];if(!F)continue;let H=(F.sourceURL??"?").replace(/^.*\/node_modules\//,"node_modules/"),N=`${F.name??"?"} @ ${H}:${F.line??"?"}`;K.set(N,(K.get(N)??0)+1)}let U=[...K.entries()].sort((w,F)=>F[1]-w[1]).slice(0,8).map(([w,F])=>({frame:w,count:F}));console.warn(JSON.stringify({msg:"stall-stack",ts:new Date().toISOString(),lagMs:Math.round(J),samplesInWindow:W.length,top:U}))}G=setTimeout(Y,Z),G.unref?.()};return G=setTimeout(Y,Z),G.unref?.(),()=>{if(G)clearTimeout(G)}}function C61(){j61();let $=[S61(),k61(),V61()];return()=>{for(let Z of $)Z()}}import{existsSync as S94}from"fs";var lX=O1();L61();var{DBOS:Or,DBOSClient:A94}=await import("@dbos-inc/dbos-sdk");function wf$($,Z){if(!Z)return $;let G=new URL($);if(!G.searchParams.has("sslmode"))G.searchParams.set("sslmode","verify-full");return G.toString()}var T94=[dY,sQ,IK,hw],I94=lX.dispatchRole==="worker"?T94:lX.dispatchRole==="api"?[]:void 0;Or.setConfig(h81({systemDatabaseUrl:wf$(lX.databaseUrl,lX.databasePgSsl),poolSize:Number(process.env.DBOS_POOL_SIZE??5),executorID:lX.podName,listenQueues:I94}));var{createApp:R94}=await Promise.resolve().then(() => (qp0(),Rp0)),{isServerPath:q94}=await Promise.resolve().then(() => (Ar(),Z61)),{createAssetHandler:M94,resolveClientDir:Ff$}=await Promise.resolve().then(() => (rb$(),tb$)),k94=lX.port,Jf$=Ff$(import.meta.url,"../client"),Hf$=S94(Jf$)?Jf$:Ff$(import.meta.url,"../dist/client"),V94=M94({clientDir:Hf$,isServerPath:q94}),C94={"X-Frame-Options":"DENY","Content-Security-Policy":"frame-ancestors 'none'"};function _94($){let Z=new Headers($.headers);for(let[G,X]of Object.entries(C94))Z.set(G,X);return new Response($.body,{status:$.status,statusText:$.statusText,headers:Z})}var{parsePreviewBaseDomain:b94,tryHandlePreviewHttp:f94,tryUpgradePreviewWs:x94,previewWebSocketHandler:k81,isPreviewWsData:S81}=await Promise.resolve().then(() => (ab$(),ob$)),{getOrInitSharedRunner:v94}=await Promise.resolve().then(() => (on(),X3$)),Nf$=b94(process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN),Wf$={baseDomain:Nf$??"",getRunner:v94},aL0=await R94({clientDir:Hf$}),V81=process.env.DBOS_CONDUCTOR_KEY?.trim(),Kf$=process.env.DBOS_CONDUCTOR_URL?.trim();await Or.launch({...V81?{conductorKey:V81}:{},...V81&&Kf$?{conductorURL:Kf$}:{}});console.log(`[dbos] application version: ${Or.applicationVersion}`);var C81=5,_81=0;await aQ(async()=>{_81++;try{return await aL0.initDbos()}catch($){let Z=_81>=C81?"giving up":"retrying";throw console.warn(`[dbos] initDbos attempt ${_81}/${C81} failed, ${Z}`,$),$}},{maxAttempts:C81,minTimeout:1000,maxTimeout:1e4,jitter:0.5});if(!lX.isCli){let{bannerLines:$}=await Promise.resolve().then(() => (Gf$(),Zf$));console.log("");for(let Z of $())console.log(Z)}var y94=Bun.serve({idleTimeout:0,port:k94,hostname:"0.0.0.0",fetch:async($,Z)=>{if(Nf$){let X=await x94($,Z,Wf$);if(X===void 0)return;if(X)return X;let Y=await f94($,Wf$);if(Y)return Y}let G=await V94($);if(G)return _94(G);return aL0.fetch($,{server:Z})},websocket:{open($){if(S81($.data))k81.open($)},message($,Z){if(S81($.data))k81.message($,Z)},close($){if(S81($.data))k81.close($)}},development:!1}),g94=C61();if(lX.localMode)Promise.resolve().then(() => (nN(),cN0)).then(async({seedLocalMode:$,markSeedComplete:Z})=>{try{let G=await $();if(process.env.DEV_LINK_SESSION_PATH)try{let{bootstrapDevLinkSession:X}=await Promise.resolve().then(() => (Qf$(),Yf$)),Y=lX.baseUrl??`http://localhost:${lX.port}`,Q=await X(lX.dataDir,Y);if(Q)console.log(`[dev-link] session ready at ${Q.path} (userSub=${Q.userSub})`);else console.warn("[dev-link] no admin user yet \u2014 skipping session bootstrap. The auto-spawned link will refuse to start until an admin exists.")}catch(X){console.error("[dev-link] bootstrap failed:",X)}}catch(G){console.error("Failed to seed local mode:",G)}finally{Z()}}).catch(async($)=>{console.error("Failed to load local-mode module:",$);try{let{markSeedComplete:Z}=await Promise.resolve().then(() => (nN(),cN0));Z()}catch{}});var Uf$=!1;async function h94($){let Z;try{Z=await A94.create({systemDatabaseUrl:wf$(lX.databaseUrl,lX.databasePgSsl),systemDatabaseSchemaName:"dbos"});let G=await Z.listWorkflows({status:"PENDING",queueName:sQ,executorId:$,loadInput:!1,loadOutput:!1});if(G.length===0){console.log(`[shutdown] no in-flight thread-gate gates to hand off (executor ${$})`);return}let X=G.map((Y)=>Y.workflowID);await Z.resumeWorkflows(X,{queueName:sQ}),console.log(`[shutdown] re-enqueued ${X.length} in-flight thread-gate gate(s) for re-adoption by a live executor (from ${$}):`,X)}catch(G){console.error("[shutdown] thread-gate handoff failed:",G)}finally{await Z?.destroy().catch(()=>{})}}async function sL0($){if(Uf$)return;Uf$=!0,console.log(`
 [shutdown] Received ${$}, shutting down gracefully...`);let Z=Number(process.env.SHUTDOWN_GRACE_SECONDS??60)*1000,G=Math.max(Z-5000,1e4),X=setTimeout(()=>{console.error(`[shutdown] Timed out after ${G}ms, forcing exit.`),process.exit(1)},G);X.unref?.();let Y=0;try{g94(),aL0.markShuttingDown();let Q=u81(lX.dispatchRole,G,process.env.SHUTDOWN_DRAIN_MS);await O8(Q),await y94.stop(!0);let J=Or.executorID;await Or.shutdown(),await h94(J),await aL0.shutdown()}catch(Q){console.error("[shutdown] Error during shutdown:",Q),Y=1}clearTimeout(X),process.exit(Y)}process.on("SIGTERM",()=>sL0("SIGTERM"));process.on("SIGINT",()=>sL0("SIGINT"));process.on("SIGHUP",()=>sL0("SIGHUP"));process.on("unhandledRejection",($)=>{console.error("[process] Unhandled rejection:",$)});process.on("uncaughtException",($)=>{console.error("[process] Uncaught exception:",$),sL0("uncaughtException")});