@wular/coder 0.3.18 → 0.4.1

package/dist/sdk.js

@@ -1 +1 @@
-import{C as e,I as t,v as n,x as r}from"./app-server-CW93J9zJ.js";import{B as i,Dt as a,E as o,I as s,M as c,R as l,St as u}from"./runtime-D-U1DNkI.js";import{D as d,S as f,T as p,_ as m,b as h,c as g,d as _,f as v,g as y,i as b,l as x,m as S,n as C,o as w,s as T,u as E,y as D}from"./upgrade-DOj06r5b.js";import O from"./flow/index.js";import k from"node:process";import A from"node:path";function j(e){return e?A.resolve(e):k.cwd()}function M(t,n){let r=e(t,n);if(!r)throw Error(n?`No task found for "${n}".`:`No tasks found for this workspace.`);return r}const N={async run(e,t={}){let{taskId:n}=await s({prompt:e,cwd:j(t.cwd),agent:t.agent,model:t.model,effort:t.effort,permissions:t.permissions,name:t.name,system:t.system,resume:t.resume});return{taskId:n}},async result(e,t={}){let n=j(t.cwd),r=e??M(n).id;return t.wait?i(n,r,{tail:t.tail}):l(n,r,{tail:t.tail})},list(e={}){return h(j(e.cwd),e).jobs},async steer(e,t,n={}){let r=j(n.cwd);return p(r,M(r,e),t,{model:n.model,effort:n.effort,permissions:n.permissions})},async ask(e,t,n={}){let r=j(n.cwd),i=M(r,e),a=await f(r,i,t,{model:n.model,effort:n.effort});return{taskId:i.id,answer:a.finalMessage||null}},async stop(e,t={}){let n=j(t.cwd);return o(n,M(n,e))},archive(e,t={}){let r=j(t.cwd);return n(r,M(r,e)),{taskId:e,archived:!0}},delete(e,t={}){let n=j(t.cwd),i=M(n,e);if(i.status===`running`)throw Error(`Task ${i.id} is still running.`);D(i);let a=r(n,i.id);return{taskId:i.id,deleted:a}},approve(e,n,r={}){let i=j(r.cwd),a=M(i,e),o=r.deny?`decline`:`accept`;return u(t(i,a.id),n,o),{taskId:a.id,approvalId:n,decision:o}},approvals(e,n={}){let r=j(n.cwd),i=e?M(r,e):M(r);return a(t(r,i.id))},stream(e,t={}){let n=j(t.cwd);return d(n,e??M(n).id,{tail:t.tail})}},P={add:(e,t)=>w(j(t.cwd),e,t),update:(e,t)=>v(j(t.cwd),e,t),remove:(e,t={})=>x(j(t.cwd),e,t),list:(e={})=>g(j(e.cwd)),alias:(e,t,n={})=>T(j(n.cwd),e,t,n),unalias:(e,t={})=>_(j(t.cwd),e,t),disable:(e,t={})=>E(j(t.cwd),e,!0,t),enable:(e,t={})=>E(j(t.cwd),e,!1,t)},F={get:(e,t={})=>y(j(t.cwd),e),set:(e,t,n={})=>m(j(n.cwd),e,t,n)};function I(e=[],t={}){return S(j(t.cwd),{claude:e.includes(`claude`),codex:e.includes(`codex`),agents:e.includes(`agents`)})}function L(e={}){return C(e)}function R(e){return b(e)}var z={task:N,flow:O,model:P,config:F,setupHost:I,upgrade:L,docs:R};export{c as CoderError,F as config,z as default,R as docs,O as flow,P as model,I as setupHost,N as task,L as upgrade};
+import{T as e,X as t,Z as n,it as r,ot as i,rt as a,st as o,w as s,xt as c}from"./dispatch-BKeAch9E.js";import{n as l,r as u,s as ee,t as d}from"./remote-miQNTVRa.js";import{n as f}from"./executor-BvAA7Cgw.js";import{n as p}from"./agent-BsYx3Odz.js";import{t as m}from"./docs-BX65z2Iu.js";import{a as h,i as g,n as _,o as v,r as y,s as b,t as x}from"./models-_5LVGC3m.js";import{n as S}from"./task-C6VAg5WU.js";import C from"./flow/index.js";import{i as w,n as T,o as E,r as D,s as O,t as k}from"./runner-sUpWJ_k0.js";import{t as A}from"./serve-BTeomYxW.js";import{t as j}from"./github-actions-DwUzm4hC.js";import{n as M}from"./apps-CjfrZyM5.js";import{n as N,r as P}from"./maintenance-C5FklUw3.js";import{r as F,t as I}from"./serve-CQKZxzFE.js";import L from"node:path";import R from"node:process";function z(e){return e?L.resolve(e):R.cwd()}const B=S,V={add:(e,t)=>x(z(t.cwd),e,t),update:(e,t)=>b(z(t.cwd),e,t),remove:(e,t={})=>g(z(t.cwd),e,t),list:(e={})=>y(z(e.cwd)),alias:(e,t,n={})=>_(z(n.cwd),e,t,n),unalias:(e,t={})=>v(z(t.cwd),e,t),disable:(e,t={})=>h(z(t.cwd),e,!0,t),enable:(e,t={})=>h(z(t.cwd),e,!1,t)},H={get:(e,n={})=>t(z(n.cwd),e),set:(e,t,r={})=>n(z(r.cwd),e,t,r)},U={add:(e,t)=>a(z(t.cwd),e,t),addJson:(e,t,n={})=>r(z(n.cwd),e,t,n),list:(e={})=>i(z(e.cwd)),remove:(e,t={})=>o(z(t.cwd),e,t)};function W(e=[],t={}){return s(z(t.cwd),{hosts:e})}function G(t={}){return e(t)}function K(e,t={}){return m(e,t)}const q={async run(e={}){let t=await f(`review`,{cwd:e.cwd,args:e});return{...t.result,runId:t.runId}}},J=ee,Y={serve:I,migrate:N,rotateKey:P,workflow:()=>j,app:{create:M},handler:F},X={list:(e={})=>l(e).credentials.list(),add:d,remove:(e,t={})=>l(t).credentials.remove(e,t),default:(e,t={})=>l(t).credentials.setDefault(e,t),login:u},Z={list:(e={})=>l(e).folders.list(),check:(e,t={})=>l(t).folders.check(e)},Q={list:T,add:k,pair:D,update:O,default:(e,t={})=>O(e,{default:!0},t),test:E,rename:(e,t,n={})=>O(e,{name:t},n),remove:w,serve:A},$=p;var te={task:B,flow:C,model:V,config:H,mcp:U,setupHost:W,upgrade:G,docs:K,review:q,auth:J,agent:$,credentials:X,folders:Z,runner:Q,server:Y};export{c as CoderError,$ as agent,J as auth,H as config,X as credentials,te as default,K as docs,C as flow,Z as folders,U as mcp,V as model,q as review,Q as runner,Y as server,W as setupHost,B as task,G as upgrade};

package/dist/serve-BTeomYxW.js

@@ -0,0 +1 @@
+import{t as e}from"./rolldown-runtime-DT7IzrpZ.js";import{At as t,xt as n}from"./dispatch-BKeAch9E.js";import{n as r,o as i}from"./remote-miQNTVRa.js";import{u as a}from"./integrations-BAgdVDhj.js";import{t as o}from"./local-H3uvqEbq.js";import{s,t as c}from"./http-Bkg_OQ6r.js";import l from"node:path";import u from"node:fs";import{createHmac as d,randomBytes as f}from"node:crypto";import p from"node:os";import m from"node:http";var h=e({runnerController:()=>C,serveRunner:()=>b});const g=()=>t(`runners.json`);function _(){try{return JSON.parse(u.readFileSync(g(),`utf8`))}catch{return{}}}function v(e){u.mkdirSync(l.dirname(g()),{recursive:!0}),u.writeFileSync(g(),JSON.stringify(e,null,2),{mode:384})}const y=e=>[`cloudflared tunnel --url http://localhost:${e}`,`ngrok http ${e}`,`tailscale funnel ${e}`,`VS Code: forward port ${e} in the Ports view and set its visibility to Public`];async function b(e={}){let a=e.port??4100,l=e.token?e.runnerUrl??process.env.CODER_RUNNER_URL:e.url;if(!l)throw new n(`invalid-option`,e.token?`Expose this runner and set CODER_RUNNER_URL or --runner-url to its public HTTPS address.`:`Expose this runner with a tunnel, then pass its public URL with --url.`,{hint:y(a)});let u=e.token?i({...e,server:e.url??e.server,yes:!0}):i(e),d=_(),h=d[u]??{secret:f(32).toString(`base64url`)},g=new o(t(`runner`)),b=C({secret:h.secret,server:u,runner:g}),x=m.createServer(s(b,{limit:c}));await new Promise((e,t)=>{x.once(`error`,t),x.listen(a,`127.0.0.1`,e)});let S=()=>new Promise(e=>x.close(()=>e())),w=e.name??p.hostname(),T=async(e,t)=>{let r=await fetch(`${u}/runners/register`,{method:`POST`,redirect:`manual`,signal:AbortSignal.timeout(5e3),headers:{"content-type":`application/json`},body:JSON.stringify({...e?{token:e}:{id:h.id,organizationId:h.organizationId},name:w,url:l,secret:h.secret,...t?{offline:t}:{}})});if(!r.ok)throw new n(`server`,`Runner registration failed`,{status:r.status});return r.json()},E;try{if(e.token){let t=await T(e.token);E=t,h.organizationId=t.organizationId}else{let t=h.id&&h.organizationId?await T().catch(e=>{if(!(e instanceof n&&e.status===401))throw e}):void 0;if(t)E=t;else{let t=r(e),n=await t.me();E=await t.runners.add({kind:`http`,name:w,scope:e.workspace||!n.user?`workspace`:`personal`,config:{url:l,secret:h.secret}}),h.organizationId=n.organization?.id,h.id=E.id,E=await T()}}h.id=E.id,v({...d,[u]:h})}catch(e){throw await S(),e}let D=Promise.resolve(),O=setInterval(()=>{D=D.then(()=>T().then(()=>{})).catch(()=>{})},6e4);return{...E,port:a,server:u,close:async()=>{clearInterval(O),await D,await T(void 0,!0).catch(()=>{}),await S()}}}const x=3e5,S=(e,t=200)=>new Response(JSON.stringify(e),{status:t,headers:{"content-type":`application/json`}});function C(e){let t=e.now??Date.now,n=new Map,r=(r,i)=>{let o=r.headers.get(`x-coder-timestamp`)??``,s=r.headers.get(`x-coder-nonce`)??``,c=r.headers.get(`x-coder-signature`)??``,l=Number(o);if(!s||!Number.isFinite(l)||Math.abs(t()-l)>x)return!1;let u=d(`sha256`,e.secret).update(`${i}.${o}.${s}`).digest(`base64url`);if(!a(c,u))return!1;for(let[e,r]of n)r<t()&&n.delete(e);return!n.has(s)&&(n.set(s,l+x),!0)};return async t=>{let n=t.method===`GET`?``:await t.text();if(!r(t,n))return S({error:`Unauthorized`},401);let i=new URL(t.url),[,a,o]=i.pathname.split(`/`).map(decodeURIComponent);try{if(t.method===`POST`&&a===`start`&&!o){let t=JSON.parse(n);if(typeof t.task!=`string`||!t.env)return S({error:`Invalid start`},400);let r=t.env.CODER_TASK_TOKEN;if(typeof r!=`string`)return S({error:`Invalid start`},400);let i={CODER_SERVER:e.server,CODER_TASK_TOKEN:r,CODER_INBOX_MODE:e.runner.push?`push`:`poll`,...t.env.CODER_LOGIN===`claude`||t.env.CODER_LOGIN===`codex`?{CODER_LOGIN:t.env.CODER_LOGIN}:{}};return S({handle:await e.runner.start({id:t.task},i)})}if(t.method===`GET`&&a===`health`&&!o)return S({ok:!0});if(!o)return S({error:`Not found`},404);if(t.method===`POST`&&a===`messages`&&e.runner.push){let{entries:t}=JSON.parse(n);return!Array.isArray(t)||!t.length?S({error:`Invalid messages`},400):S(await e.runner.push(o,t))}return t.method===`GET`&&a===`status`?S(await e.runner.status(o)):t.method===`GET`&&a===`logs`?S(await e.runner.logs(o,Number(i.searchParams.get(`after`)??-1))):t.method===`POST`&&a===`stop`?(await e.runner.stop(o),new Response(null,{status:204})):S({error:`Not found`},404)}catch(e){return S({error:e instanceof Error?e.message:String(e)},400)}}}export{h as n,b as t};

package/dist/serve-CE8YV2e9.js

@@ -0,0 +1 @@
+import{i as e,t}from"./cli-BilSDkvE.js";import{p as n,s as r}from"./output-BKeyLbvt.js";import{n as i,o as a,s as o,t as s}from"./args-BOEEdpWk.js";import c from"node:process";import*as l from"zod/mini";const u=e({name:`runner serve`,help:{usage:`coder runner serve --url <public url> [--token <token>] [--runner-url <url>] [--port <n>] [--name <name>] [--workspace] [--server [url]] [--json]`,summary:`Run tasks on this machine with its own claude and codex logins. Expose the port with any tunnel (cloudflared, ngrok, Tailscale Funnel or a public VS Code port) and pass the tunnel's URL; each start registers the current URL, so a changing tunnel URL is fine. Choose a default with coder runner default. Tasks use their named runner, the agent setting, your default, the workspace default, then the server default.`,flags:[[`--url <public url>`,`the HTTPS address the server reaches this runner at`],[`--token <token>`,`one-use pairing token, --url is the Coder server`],[`--runner-url <url>`,`public tunnel address when pairing, or CODER_RUNNER_URL`],[`--port <n>`,`local port the tunnel forwards to (default 4100)`],[`--name <name>`,`shown in the dashboard (default: this machine's hostname)`],[`--workspace`,`run every member's tasks, not only yours (owners and admins)`],t],examples:[[`cloudflared tunnel --url http://localhost:4100`,`expose the port in one terminal`],[`coder runner serve --url https://abc.trycloudflare.com`,`then serve through it`]]},options:{...s,port:l.optional(l.coerce.number().check(l.int(),l.positive())),url:o,name:o,token:o,"runner-url":o,workspace:i,server:a,yes:i},async run({options:e}){let{serveRunner:t}=await import(`./serve-BTeomYxW.js`).then(e=>e.n),n=await t({...e,runnerUrl:e[`runner-url`]}),r=()=>void n.close().finally(()=>c.exit(0));return c.once(`SIGINT`,r),c.once(`SIGTERM`,r),n},json:({server:e,close:t,...n})=>({ok:!0,...n}),print:e=>c.stdout.write(`Runner ${n.bold(e.name)} serves ${e.server} at ${n.cyan(e.config.url??``)} (${e.scope}), listening on localhost:${e.port}.\n${r([`Tasks run here with this machine's own claude and codex logins`,`Stop with Ctrl-C; the server marks the runner offline`],n,n.cyan)}\n`)});export{u as commandRunnerServe};

package/dist/serve-CPnmrKyf.js

@@ -0,0 +1,2 @@
+import{qt as e,xt as t}from"./dispatch-BKeAch9E.js";import{i as n}from"./prompt-CEuBMNhk.js";import{i as r}from"./cli-BilSDkvE.js";import{p as i,s as a}from"./output-BKeyLbvt.js";import{n as o,s,t as c}from"./args-BOEEdpWk.js";import l from"node:process";import*as u from"zod/mini";function d(t){let r=i,o=[...t.publicUrl===t.address?[]:[[`public`,t.publicUrl]],[`store`,t.database??(t.mode===`local`?e():t.store)],[`runner`,t.runner],...t.signIn?[[`sign-in`,t.signIn]]:[],...t.mintedToken?[[`token`,t.mintedToken]]:[]],s=Math.max(...o.map(([e])=>e.length))+2;l.stdout.write(`${r.bold({local:`Coder local server`,memory:`Coder test server`,cloud:`Coder server`}[t.mode])} ${r.dim(`listening on ${t.address}`)}\n`);for(let[e,t]of o)l.stdout.write(`  ${r.light(e.padEnd(s))}${t}\n`);t.warnings.length&&l.stdout.write(`
+`);for(let e of t.warnings)l.stdout.write(`  ${r.yellow(`!`)} ${e}\n`);if(t.cacheMigration?.then(e=>{(e.tasks||e.flows||e.files)&&l.stdout.write(`\n  moved ${e.tasks.toLocaleString(`en-US`)} archived tasks to ${e.cache}\n`)}).catch(e=>l.stderr.write(`\n  Cache migration failed: ${e instanceof Error?e.message:String(e)}\n`)),t.mode===`memory`&&l.stdout.write(`\n${a([`the CLI reaches this server with its token in ADMIN_TOKEN: coder task list --server ${t.publicUrl}`],r)}\n`),t.dashboard){let e=l.stdout.isTTY&&n(t.dashboard);l.stdout.write(e?`\nOpening the dashboard in your browser. If it doesn't open, go to:\n  ${t.dashboard}\n`:`\n  ${r.light(`dashboard`)}  ${t.dashboard}\n`)}}const f=r({name:`server serve`,help:{usage:`coder server serve [--port <n>] [--host <address>] [--memory] [--runner <name>] [--json] [--cwd <dir>]`,summary:`Run the Coder server on Bun: the address platforms deliver events to, the dashboard, and the worker that runs tasks. With DATABASE_URL it is a full server with sign-in and workspaces. Without one it is the dashboard for this machine's CLI: its config, agents, tasks and engine logins, on loopback only. --memory makes a throwaway test server that keeps everything in memory. Configured through the environment; every variable is in coder docs self-host. It never migrates the database itself: coder server migrate does.`,flags:[[`--port <n>`,`listen port (default: PORT, else the port in a localhost PUBLIC_URL, else 8787)`],[`--host <address>`,`listen address (default: HOST, else 127.0.0.1 without a database, else every interface)`],[`--memory`,`a throwaway test server: everything in memory, no sign-in, admin token only`],[`--runner <name>`,`local, local-docker, vercel-sandbox, github-actions, or http`]],env:[[`PUBLIC_URL`,`the address platforms and browsers reach the server at (default http://localhost:<port>)`],[`PORT`,`listen port, as hosts set it (default 8787)`],[`HOST`,`listen address, as --host`],[`DATABASE_URL`,`Postgres, set up by coder server migrate; turns on sign-in and workspaces`],[`AUTH_WULAR_URL`,`the Wular Auth issuer people sign in with (default https://auth.wular.ai)`],[`SERVER_ENCRYPTION_KEY`,`encrypts stored secrets and derives the sign-in keys; required with DATABASE_URL (openssl rand -base64 32)`],[`RUNNER`,`where tasks run: local (default), local-docker, vercel-sandbox, github-actions, http`],[`MAX_TASKS, TASK_TIMEOUT, TASK_STALL, TASK_ATTEMPTS`,`runner capacity and lifecycle limits`],[`ADMIN_TOKEN`,`local and memory servers: the dashboard and CLI key; minted and shown when unset`],[`CODER_CACHE_HOME`,`archived tasks, flows and usage (default OS cache directory/wular-coder)`],[`WORK_DIR`,`where tasks check out repositories`],[`SERVER_NAME`,`what the dashboard calls this server (default Coder)`]],examples:[[`PUBLIC_URL=https://abc.ngrok.app coder server serve`,`receive GitHub and Slack events through a tunnel; the tunnel serves only their webhooks and callbacks`],[`PUBLIC_URL=https://agents.example.com DATABASE_URL=postgres://... coder server serve`,`on your own host, backed by Postgres`]]},options:{...c,port:u.optional(u.coerce.number().check(u.int(),u.positive())),host:s,runner:s,memory:o},async run({options:e,cwd:n}){let{rerunUnderBun:r}=await import(`./env-CRf6wkM2.js`).then(e=>e.t);if(await r(),e.memory&&!l.env.ADMIN_TOKEN&&!l.stdout.isTTY)throw new t(`invalid-option`,`Memory server needs an admin token: set ADMIN_TOKEN, or run in a terminal to get a printed one.`);let{serve:i}=await import(`./serve-CQKZxzFE.js`).then(e=>e.n),a=await i({cwd:n,port:e.port,...e.host?{host:e.host}:{},...e.runner?{runner:e.runner}:{},...e.memory?{memory:!0}:{}}),o=()=>void a.close().finally(()=>l.exit(0));return l.once(`SIGINT`,o),l.once(`SIGTERM`,o),a},json:e=>({ok:!0,address:e.address,publicUrl:e.publicUrl,runner:e.runner,store:e.store,mode:e.mode,maxTasks:e.maxTasks,...e.signIn?{signIn:e.signIn}:{},...e.mintedToken?{adminToken:e.mintedToken}:{},warnings:e.warnings}),print:d});export{f as commandServerServe};

package/dist/serve-CQKZxzFE.js

@@ -0,0 +1,4 @@
+import{t as e}from"./rolldown-runtime-DT7IzrpZ.js";import{$ as t,At as n,K as r,Qt as i,Tn as a,U as o,W as s,bn as c,dt as l,et as u,kt as d,lt as f,q as p,tt as m,vt as h,xt as g,zt as _}from"./dispatch-BKeAch9E.js";import{i as v,n as y,r as b,u as x}from"./load-BpEsAn51.js";import{c as S,d as C,l as ee,n as te}from"./integrations-BAgdVDhj.js";import{c as ne}from"./models-_5LVGC3m.js";import{o as w}from"./local-H3uvqEbq.js";import{a as T,d as E,f as re,l as D,n as ie,o as ae,p as O,r as k,s as oe,t as se,u as ce}from"./http-Bkg_OQ6r.js";import{$ as le,$t as ue,A as de,An as fe,At as pe,B as me,Bn as he,Bt as ge,C as _e,Cn as ve,Ct as ye,D as be,Dn as xe,Dt as Se,E as Ce,En as we,Et as Te,F as Ee,Fn as De,G as Oe,Gn as ke,Gt as Ae,H as je,Hn as Me,Ht as Ne,I as Pe,In as A,It as Fe,J as Ie,Jn as Le,Jt as Re,K as ze,Kn as j,Kt as Be,L as Ve,Lt as He,M as Ue,Mn as We,Mt as Ge,N as Ke,Nn as qe,Nt as Je,O as Ye,On as Xe,Ot as M,P as Ze,Pn as N,Pt as Qe,Q as $e,Qn as et,Qt as tt,R as nt,Rt as rt,S as it,Sn as at,St as ot,T as P,Tn as st,Tt as F,U as ct,Un as lt,Ut as ut,V as dt,Vn as ft,Vt as pt,W as mt,Wn as ht,Wt as gt,X as _t,Xn as I,Xt as vt,Y as yt,Yn as bt,Yt as xt,Z as St,Zn as L,Zt as Ct,_ as R,_n as wt,_t as Tt,an as Et,b as Dt,bn as Ot,bt as kt,cn as At,ct as jt,d as Mt,dt as Nt,en as Pt,et as Ft,f as It,fn as Lt,ft as Rt,g as zt,gn as Bt,gt as Vt,h as Ht,hn as z,ht as Ut,i as Wt,in as Gt,it as Kt,j as qt,jn as Jt,jt as Yt,k as Xt,kn as Zt,kt as Qt,l as $t,ln as en,m as tn,mn as nn,mt as rn,nn as an,o as on,on as sn,ot as cn,pn as B,pt as ln,qn as V,qt as un,r as dn,rn as fn,rt as pn,s as mn,sn as hn,st as gn,t as _n,tn as vn,u as yn,v as H,vn as U,vt as bn,w as xn,wn as Sn,wt as Cn,x as wn,xn as Tn,xt as En,y as W,yn as G,yt as K,z as Dn,zn as On,zt as kn}from"./store-DzqXS2wT.js";import{n as An,r as jn}from"./env-CRf6wkM2.js";import{l as Mn}from"./schema-CU2iFkp8.js";import{r as Nn,t as Pn}from"./migrate-N-85_N7J.js";import{n as Fn,r as In}from"./usage-BhqoCjvE.js";import q from"node:path";import J from"node:process";import*as Y from"zod/mini";import Ln from"node:fs";import{randomBytes as Rn,randomUUID as zn}from"node:crypto";import X from"node:fs/promises";import{isDeepStrictEqual as Bn}from"node:util";import Vn from"node:http";import{sql as Hn}from"drizzle-orm";async function Un(e){try{return await X.readdir(e,{withFileTypes:!0})}catch(e){if(e.code===`ENOENT`)return[];throw e}}async function Z(e){try{return await X.lstat(e),!0}catch(e){if(e.code===`ENOENT`)return!1;throw e}}async function Wn(e,t){if(e===t||!await Z(e))return 0;let n=await Un(e),r=n.filter(e=>e.isDirectory()).length;if(!await Z(t))return await a(e,t),r;for(let r of n)await a(q.join(e,r.name),q.join(t,r.name));return await X.rmdir(e),r}async function Gn(e){let t=q.dirname(e),n=q.basename(e);for(let e of await Un(t)){let r=e.name.startsWith(n)?e.name.slice(n.length):``;if(!e.isFile()||!(r===`.tmp`||/^\.\d+(?:\.[a-f0-9-]{36})?\.tmp$/.test(r)))continue;let i=Number(e.name.slice(n.length+1).split(`.`)[0]);if(Number.isInteger(i)&&i>0)try{process.kill(i,0);continue}catch(e){if(e.code!==`ESRCH`)continue}await X.unlink(q.join(t,e.name)).catch(e=>{if(e.code!==`ENOENT`)throw e})}}async function Kn(e,t){if(await Gn(e),e===t||!await Z(e))return 0;if(!await Z(t))return await a(e,t),1;let n=JSON.parse(await X.readFile(e,`utf8`)),r=JSON.parse(await X.readFile(t,`utf8`)),i={...n,...r,...n.rows||r.rows?{rows:{...n.rows,...r.rows}}:{}},o=`${t}.${process.pid}.${zn()}.tmp`;try{await X.writeFile(o,`${JSON.stringify(i)}\n`,{mode:384,flag:`wx`}),await X.rename(o,t),await X.unlink(e)}finally{await X.rm(o,{force:!0})}return 1}async function qn(){let e=d(),t=n(`state`),r=d(`archive`),i=d(`flows-archived`),a=d(`usage.json`),o=d(`runner`,`usage.json`),s={from:n(`checkouts`),to:d(`checkouts`)},c={from:n(`update-check.json`),to:d(`update-check.json`)},l={cache:e,tasks:0,flows:0,files:0},u=(await Un(t)).filter(e=>e.isDirectory()).map(e=>({archive:n(`state`,e.name,`archive`),flows:n(`state`,e.name,`flows-archived`),usage:n(`state`,e.name,`usage.json`),runnerUsage:n(`state`,e.name,`runner`,`usage.json`)}));await Gn(a),await Gn(o);for(let e of u)l.tasks+=await Wn(e.archive,r),l.flows+=await Wn(e.flows,i),l.files+=await Kn(e.usage,a),l.files+=await Kn(e.runnerUsage,o);return await Wn(s.from,s.to),l.files+=await Kn(c.from,c.to),l}async function Jn(e){let t=(e.now??Date.now)(),n=await e.store.list(`runner`);return{online:1+n.filter(({value:e})=>e.lastSeen!==void 0&&t-e.lastSeen<3e5).length,total:1+n.length}}async function Yn(e){let t=(e.now??Date.now)(),n=e.health,{body:r,status:i}=n&&t-n.at<5e3?n:await Xn(e);e.health=i===200?{at:n&&t-n.at<5e3?n.at:t,body:r,status:i}:void 0;let a=Math.max(0,t-(e.limits?.startedAt??t))/1e3;return T({...r,uptime:a},i,{"cache-control":`no-store`})}async function Xn(e){let t=e.config.store===`postgres`?`down`:`none`,n={online:0,total:0},r=!0;try{if(e.config.store===`postgres`){if(!e.databaseHealth)throw Error(`Database health probe is unavailable`);await e.databaseHealth(),t=`ok`}n=e.healthRunners?await e.healthRunners():await Jn(e)}catch{r=!1,e.config.store===`postgres`&&(t=`down`)}return{body:{ok:r,version:c(),db:t,runners:n},status:r?200:503}}async function Zn(e){let t=(e.now??Date.now)();if(e.queue.metrics&&!e.local)return{...await e.queue.metrics(e.organizationId,t-864e5),runnersOnline:(await Jn(e)).online,requests:e.limits?.requests??0,rateLimitRejections:e.limits?.rejections??0};let n=await e.queue.list(e.organizationId),r=e.local?[...It(e.local.cwd,!1),...It(e.local.cwd,!0)]:[],i=new Map([...r,...n.map(e=>e.status===`queued`?e:r.find(t=>t.task.id===e.task.id)??e)].map(e=>[e.task.id,e])),a={queued:0,running:0,waiting:0,completed:0,failed:0,cancelled:0},o=0;for(let e of i.values())e.createdAt>=t-864e5&&a[e.status]++,e.status===`queued`&&o++;return{tasks:a,queueDepth:o,runnersOnline:(await Jn(e)).online,requests:e.limits?.requests??0,rateLimitRejections:e.limits?.rejections??0}}async function Qn(e,t,n,r){if(!t.auth)return T({mode:Fe(t),organization:{id:t.organizationId},server:$n(t)});let i=t.session;return T({mode:Fe(t),user:i.user,organization:i.organizations.find(e=>e.id===i.organizationId)??null,organizations:i.organizations,manageMembersUrl:`${t.auth.issuer}/auth/onboarding`,server:$n(t)})}function $n(e){return{name:e.config.name??`Coder`,store:e.config.store,...e.config.publicUrl?{url:e.config.publicUrl}:{},subscriptions:{claude:!!e.config.subscriptions?.claude,codex:!!e.config.subscriptions?.codex}}}async function er(e,t,n,r){let i=e.headers.get(`content-type`)??``,a=i.includes(`application/json`)?await e.json().catch(()=>void 0):await e.formData().then(e=>Object.fromEntries(e.entries()),()=>void 0);if(!a||typeof a!=`object`)return T({error:`Send the workspace as a form or JSON body.`},400);let o=typeof a.organization==`string`?a.organization:``,s=o?await t.auth.setOrganization(e.headers,o):void 0;if(!s)return T({error:`You are not a member of that workspace.`},403);let{cookies:c,...l}=s,u=i.includes(`application/json`)?T({organization:l}):O(`/dash`,303);for(let e of c)u.headers.append(`set-cookie`,e);return u}async function tr(e,t,n,r){let i=t.session.user.id;n.id;let a=(await e.json().catch(()=>({}))).engine??``;if(!or.has(a)||!t.config.subscriptions?.[a])return T({error:`Sign in with ${a||`that engine`} is off on this server.`},403);let o=t.runners[t.config.runner];if(!o||o.kind===`github-actions`)return T({error:`Sign-in cannot run on the ${t.config.runner} runner.`},409);let s=`login-${Rn(12).toString(`base64url`)}`,c=he(s,t.organizationId,0),l={owner:i,engine:a,state:`starting`,tokenHash:c.hash,runner:o.kind,createdAt:sr(t),expiresAt:sr(t)+ar};await cr(t,s,l);let u;try{let e=await o.start({id:s},{CODER_SERVER:t.config.publicUrl??``,CODER_TASK_TOKEN:c.token,CODER_LOGIN:a}),n=await t.store.patchLogin(s,{handle:e},{tokenHash:l.tokenHash});if(!n)return await o.stop(e).catch(()=>{}),T({error:`This sign-in is gone. Start again.`},409);u=n}catch(e){return await t.store.delete(`login`,s),T({error:e instanceof Error?e.message:String(e)},502)}return T(lr(s,u),201)}async function nr(e,t,n,r){t.session.user.id;let i=n.id??``,a=i&&!i.includes(`/`)?await ur(t,i):void 0;return a?T(lr(i,a)):T({error:`This sign-in is gone. Start again.`},404)}async function rr(e,t,n,r){t.session.user.id;let i=n.id??``,a=i&&!i.includes(`/`)?await ur(t,i):void 0;if(!a)return T({error:`This sign-in is gone. Start again.`},404);let o=await e.json().catch(()=>({})),s=typeof o.code==`string`?o.code.trim():``;return a.engine!==`claude`||a.state!==`open`||!s||!await t.store.patchLogin(i,{state:`verifying`,input:A(t.config,s)},{state:`open`,tokenHash:a.tokenHash})?T({error:`This sign-in is not waiting for a code.`},409):T({ok:!0})}async function ir(e,t,n,r){t.session.user.id;let i=n.id??``,a=i&&!i.includes(`/`)?await ur(t,i):void 0;return a?(await t.store.delete(`login`,i),a.handle&&await t.runners[a.runner]?.stop(a.handle).catch(()=>{}),T({ok:!0})):T({error:`This sign-in is gone. Start again.`},404)}const ar=6e5,or=new Set([`claude`,`codex`]),sr=e=>(e.now??Date.now)();function cr(e,t,n){return e.store.put(`login`,t,n,{ttlMs:Math.max(1,n.expiresAt-sr(e))})}function lr(e,t){return{id:e,engine:t.engine,state:t.state,expiresAt:t.expiresAt,...t.url?{url:t.url}:{},...t.code?{code:t.code}:{},...t.error?{error:t.error}:{},...t.label?{label:t.label}:{}}}async function ur(e,t){let n=await e.store.get(`login`,t);return n&&n.owner===e.session?.user.id?n:void 0}async function dr(e,t,n,r){let i=n.id,a=t.callbackLogin,o=Date.now()+25e3;for(;!a.input&&Date.now()<o&&!e.signal.aborted;){await new Promise(e=>setTimeout(e,250));let e=await t.store.get(`login`,i);if(!e)return new Response(`Unauthorized`,{status:401});a=e}if(!a.input)return T({});let s=await t.store.patchLogin(i,{input:null},{input:a.input,tokenHash:a.tokenHash});return T(s?{code:N(t.config,a.input)}:{})}async function fr(e,t,n,r){n.id;let i=t.callbackLogin;return T({engine:i.engine})}async function pr(e,t,n,r){let i=n.id,a=t.callbackLogin,o=await e.json().catch(()=>({}));if(a.state===`done`||a.state===`failed`)return T({ok:!0});let s={state:[`starting`,`open`,`verifying`],tokenHash:a.tokenHash};if(typeof o.error==`string`)return await t.store.patchLogin(i,{state:`failed`,error:o.error.slice(0,500)},s),T({ok:!0});let c=o.result?.env;if(c){let e=a.engine===`claude`?`CLAUDE_CODE_OAUTH_TOKEN`:`CODEX_AUTH_JSON`;if(Object.keys(c).join()!==e||typeof c[e]!=`string`)return T({error:`Invalid sign-in result`},400);let n=`${a.engine}-subscription`,r=o.result?.account;return await t.store.completeLogin(i,a.tokenHash,n,{...De(t.config,{env:c}),engine:a.engine,createdAt:(t.now??Date.now)(),...r?.email||r?.plan?{account:{...typeof r.email==`string`?{email:r.email}:{},...typeof r.plan==`string`?{plan:r.plan}:{}}}:{}})?T({ok:!0}):T({error:`This sign-in changed. Try again.`},409)}let l={...typeof o.url==`string`&&/^https:\/\//.test(o.url)?{url:o.url}:{},...typeof o.code==`string`?{code:o.code.slice(0,64)}:{}};return(a.state===`starting`?await t.store.patchLogin(i,{...l,state:`open`},{state:`starting`,tokenHash:a.tokenHash})??await t.store.patchLogin(i,l,{...s,state:[`open`,`verifying`]}):await t.store.patchLogin(i,l,s))?T({ok:!0}):T({error:`This sign-in changed. Try again.`},409)}async function mr(e,t,n,r){let i=n.id,a=t.operatorApp??!1;if(!/^[a-z0-9_-]+$/.test(r.pathname.split(`/`)[2]))return;let o=a?`*`:t.session?.user.id??`anonymous`,s=t.integrations[i];if(!s)return j(`Unknown integration "${i}"; run coder agent integrations list to see them`,404);let c=t.config.publicUrl;if(!c)return j(`PUBLIC_URL is not set on this server; set it to the address platforms should call and restart`,400);t.fetch,t.now?.();let l=V(r.searchParams);if(!l)return j(`Setup link is missing or malformed; start again from the agent's Platforms tab`,400);if(!l.definition.integrations[i])return j(`This agent declares no ${i} integration in its agent.json`,400);if(l.state.public&&!a)return j(`Only the server operator creates public apps`,403);let u=lt(i,l.state),d=l.state.tx?await I(t,l.state.tx,`create`,o)===u?l.state.tx:void 0:await L(t,`create`,o,u);if(!d)return j(`This app creation link is invalid, expired, or already used`,403);let f={...l.state,tx:d};return s.app.createPage({publicUrl:c,state:f,definition:l.definition,encodedState:w(f)})}async function hr(e,t,n,r){let i=n.id,a=t.operatorApp??!1;if(!/^[a-z0-9_-]+$/.test(r.pathname.split(`/`)[2]))return;let o=a?`*`:t.session?.user.id??`anonymous`,s=t.integrations[i];if(!s)return j(`Unknown integration "${i}"; run coder agent integrations list to see them`,404);let c=t.config.publicUrl;if(!c)return j(`PUBLIC_URL is not set on this server; set it to the address platforms should call and restart`,400);let l=t.fetch??fetch,u=t.now?.()??Date.now(),d=k(r.searchParams.get(`state`)),f=V(r.searchParams)??(d&&V(new URLSearchParams(Object.entries(d).filter(([,e])=>e!==void 0))))??void 0;if(!f)return j(`Setup state was lost between the platform and this server; start again`,400);if(!f.state.tx||!await bt(t,f.state.tx,`create`,o,lt(i,f.state)))return j(`This app creation link is invalid, expired, or already used`,403);let p=await s.app.createCallback(e,{publicUrl:c,...f,fetch:l}).catch(e=>j(`Creating the ${i} app failed: ${e instanceof Error?e.message:e}`,400));if(p instanceof Response)return p;let m={id:`${i}:${p.platformAppId}`,integration:i,agent:f.state.agent,name:p.name,...f.state.repo?{agentsRepo:f.state.repo}:{},...f.state.repo?{branch:f.state.branch??`main`}:{},...a?{builtin:!0}:{},credentials:A(t.config,p.credentials),createdAt:u};if(await t.store.put(`app`,m.id,m),a)return j(`Created ${p.name}. Every workspace on this server can now connect it from its dashboard.`);let h=await L(t,`install`,o,m.id),g=`/dash/agents/${encodeURIComponent(m.agent)}/platforms`;return O(`${c}/install/${i}?app=${encodeURIComponent(m.id)}&state=${w({tx:h,back:g})}`)}async function gr(e,t,n,r){let i=n.id,a=t.operatorApp??!1;if(!/^[a-z0-9_-]+$/.test(r.pathname.split(`/`)[2]))return;let o=a?`*`:t.session?.user.id??`anonymous`,s=t.integrations[i];if(!s)return j(`Unknown integration "${i}"; run coder agent integrations list to see them`,404);let c=t.config.publicUrl;if(!c)return j(`PUBLIC_URL is not set on this server; set it to the address platforms should call and restart`,400);let l=t.fetch??fetch,u=t.now?.()??Date.now(),d=new URLSearchParams(await e.clone().text()),f=k(r.searchParams.get(`state`)),p=V(r.searchParams)??(f&&V(new URLSearchParams(Object.entries(f).filter(([,e])=>e!==void 0))))??(d&&V(d));if(!p)return j(`Setup state was lost between the platform and this server; start again`,400);if(!p.state.tx||!await bt(t,p.state.tx,`create`,o,lt(i,p.state)))return j(`This app creation link is invalid, expired, or already used`,403);let m=await s.app.createCallback(e,{publicUrl:c,...p,fetch:l}).catch(e=>j(`Creating the ${i} app failed: ${e instanceof Error?e.message:e}`,400));if(m instanceof Response)return m;let h={id:`${i}:${m.platformAppId}`,integration:i,agent:p.state.agent,name:m.name,...p.state.repo?{agentsRepo:p.state.repo}:{},...p.state.repo?{branch:p.state.branch??`main`}:{},...a?{builtin:!0}:{},credentials:A(t.config,m.credentials),createdAt:u};if(await t.store.put(`app`,h.id,h),a)return j(`Created ${m.name}. Every workspace on this server can now connect it from its dashboard.`);let g=await L(t,`install`,o,h.id),_=`/dash/agents/${encodeURIComponent(h.agent)}/platforms`;return O(`${c}/install/${i}?app=${encodeURIComponent(h.id)}&state=${w({tx:g,back:_})}`)}async function _r(e,t,n,r){let i=n.id,a=t.operatorApp??!1;if(!/^[a-z0-9_-]+$/.test(r.pathname.split(`/`)[2]))return;let o=a?`*`:t.session?.user.id??`anonymous`,s=t.integrations[i];if(!s)return j(`Unknown integration "${i}"; run coder agent integrations list to see them`,404);let c=t.config.publicUrl;if(!c)return j(`PUBLIC_URL is not set on this server; set it to the address platforms should call and restart`,400);t.fetch,t.now?.();let l=k(r.searchParams.get(`state`)),u=r.searchParams.get(`app`),d=l?.tx?await I(t,l.tx,`install`,o):void 0;if(!d||u&&u!==d)return j(`This installation link is invalid, expired, or already used`,403);let f=await t.store.get(`app`,u??d);if(!f)return j(`This app is not known to this server; create it first`,400);let p=N(t.config,f.credentials);return O(s.app.installUrl(f,p,{publicUrl:c,state:r.searchParams.get(`state`)??w({})}))}async function vr(e,t,n,r){let i=n.id,a=t.operatorApp??!1;if(!/^[a-z0-9_-]+$/.test(r.pathname.split(`/`)[2]))return;let o=a?`*`:t.session?.user.id??`anonymous`,s=t.integrations[i];if(!s)return j(`Unknown integration "${i}"; run coder agent integrations list to see them`,404);let c=t.config.publicUrl;if(!c)return j(`PUBLIC_URL is not set on this server; set it to the address platforms should call and restart`,400);let l=t.fetch??fetch,u=t.now?.()??Date.now(),d=k(r.searchParams.get(`state`)),f=r.searchParams.get(`app`),p=d?.tx?await I(t,d.tx,`install`,o):void 0;if(!p||f&&f!==p||!await bt(t,d.tx,`install`,o,p))return j(`This installation link is invalid, expired, or already used`,403);let m=await t.store.get(`app`,f??p),h=d?.link?await t.store.get(`installation`,d.link):void 0,g=m??(h&&await ke(t,h,i));if(!g)return d&&!d.link?j(`Connected.`):j(`This install does not match any app on this server; create the app first`,400);let _=N(t.config,g.credentials),v=await s.app.installCallback(e,{app:g,credentials:_,publicUrl:c,fetch:l,connect:Me(t,g,c)}).catch(e=>j(e instanceof Error?e.message:String(e),400));if(v instanceof Response)return v;let y=`${g.id}:${v.platformInstallId}`,b=t.session;v.user&&b&&t.auth&&await t.auth.link(b.user,i,v.user.id,{organizations:b.organizations.map(e=>e.id),...v.user.token?{token:A(t.config,v.user.token)}:{}});let x=await t.store.get(`installation`,y),S={...x,id:y,app:g.id,integration:i,account:v.account??x?.account??h?.account??{login:`unknown`},...v.token?{token:A(t.config,v.token)}:{},...v.installer?{installer:v.installer}:{},createdAt:x?.createdAt??u};delete S.deletedAt;let C=h&&!h.deletedAt?h:void 0;C&&(S=ht(S,C.integration,C.id));try{await t.store.put(`installation`,y,S)}catch{return j(`This ${i} installation is already connected to another workspace; disconnect it there first`,409)}if(C&&await t.store.put(`installation`,C.id,ht(C,i,y)),s.renew){let e=await(await import(`./store-DzqXS2wT.js`).then(e=>e.q)).renewInstallation({...t,fetch:l},g,v.platformInstallId).then(()=>void 0,e=>e instanceof Error?e.message:String(e));if(e)return j(`Connected, but ${i} did not start sending events yet. ${e}. Coder tries again within the hour.`,502)}let ee=ft(d?.back);return ee?O(`${c.replace(/\/$/,``)}${ee}`):v.response}const Q=(e,t=200)=>ee(`<title>Coder</title><p>${S(e)}</p>`,t);function yr(e,t,n){return n&&t.organizations.some(e=>e.id===n)?{...On(e,n),session:t}:void 0}async function br(e,t){let n=await e.store.get(`installation`,t);return n&&!n.deletedAt?e.store.get(`app`,n.app):void 0}async function xr(e,t,n,r){let i=t.linkContext,a=i.session,o=e=>{let t=et(i,e);return t&&a.organizations.some(e=>e.id===t)?{...On(i,t),session:a}:i},s=r.searchParams.get(`token`)??``,c=o(s);if(await I(c,s,`link`,a.user.id))return await At(e,void 0,t.dashboardHosts)??new Response(`UI is not built`,{status:503});let l=await Le(c,s,`link-start`,a.user.id);if(!l)return new Response(`This link is invalid or has expired.`,{status:400});let u=await L(c,`link`,a.user.id,l,3e5);return O(`/connect?token=${encodeURIComponent(u)}`)}async function Sr(e,t,n,r){let i=t.linkContext,a=i.session,o=e=>{let t=et(i,e);return t&&a.organizations.some(e=>e.id===t)?{...On(i,t),session:a}:i},s=await e.json().catch(()=>({})),c=typeof s.token==`string`?await Le(o(s.token),s.token,`link`,a.user.id):void 0;if(!c)return T({error:`This link is invalid or has expired.`},400);let l=JSON.parse(c);return await t.auth.link(a.user,l.platform,l.platformUserId,{organizations:a.organizations.map(e=>e.id)})===`taken`?T({error:`That platform account is connected to someone else.`},409):T({ok:!0,...l})}async function Cr(e,t,n,r){let i=t.integrations[n.integration].auth.user,a=t.config.publicUrl,o=t.linkContext.session,s=r.searchParams.get(`installation`)??``,c=yr(t,o,s?await t.installationOrganization?.(s):void 0);if(!c)return Q(`Only members of the workspace this agent works for can link here.`,403);let l=await br(c,s);if(!l)return Q(`This installation is no longer connected.`,404);let u=await L(c,`link-oauth`,o.user.id,s);return O(i.authorizeUrl(N(t.config,l.credentials),{publicUrl:a,state:u}))}async function wr(e,t,n,r){let i=t.integrations[n.integration],a=i.auth.user,o=t.config.publicUrl,s=t.linkContext.session,c=r.searchParams.get(`state`)??``,l=yr(t,s,et(t,c)),u=l&&await Le(l,c,`link-oauth`,s.user.id),d=l&&u?await br(l,u):void 0;if(!l||!d)return Q(`This link is invalid or has expired.`,400);let f=await a.exchange(e,N(t.config,d.credentials),{publicUrl:o,fetch:t.fetch??fetch}).catch(e=>e instanceof Error?e:Error(String(e)));return f instanceof Error?Q(f.message,400):await t.auth.link(s.user,i.id,f.id,{organizations:s.organizations.map(e=>e.id),...f.token?{token:A(t.config,f.token)}:{}})===`taken`?Q(`That ${i.id} account is connected to someone else.`,409):Q(`Linked ${f.login??f.id} on ${i.id} to your Coder account. Mention the agent again to start.`)}const Tr=Y.object({installation:Y.string().check(Y.minLength(1)),integration:Y.string().check(Y.minLength(1)),token:Y.string().check(Y.minLength(1)),account:Y.optional(Y.string())});async function Er(e,t){let n;try{n=await e.json()}catch{return new Response(`Invalid JSON`,{status:400})}let r=Tr.safeParse(n);if(!r.success)return new Response(`Invalid connection`,{status:400});let{installation:i,integration:a,token:o,account:s}=r.data,c=await t.store.get(`installation`,i);if(!c||c.deletedAt)return new Response(`Unknown installation`,{status:404});let l={kind:`oauth`,token:A(t.config,o),...s?{account:s}:{}};return await Wt(t.store,`installation`,i,{connections:{...c.connections,[a]:l}}),T({ok:!0})}async function Dr(e,t,n,r){let i=await t.store.get(`app`,n);if(!i)return T({error:`Unknown app`},404);let a=t.config.publicUrl;if(!a)return T({error:`PUBLIC_URL is not set on this server`},400);let o=await L(t,`install`,t.session?.user.id??`anonymous`,i.id),s=w({tx:o,...r?{back:r}:{}});return T({url:`${a.replace(/\/$/,``)}/install/${i.integration}?app=${encodeURIComponent(i.id)}&state=${s}`})}async function Or(e,t,n,r){let i=r.searchParams.get(`agent`),a=t.serverOrganizationId,[o,s]=await Promise.all([t.store.list(`app`),a!==void 0&&a!==t.organizationId&&t.scope?t.scope(a).store.list(`app`).then(e=>e.map(({id:e,value:t})=>({id:e,value:{...t,builtin:!0}}))):[]]),c=[...o,...s];return T(c.filter(({value:e})=>!i||e.agent===i).map(({id:e,value:t})=>{let{credentials:n,...r}=t;return{id:e,value:r}}))}async function kr(e,t,n,r){let i=r.searchParams.get(`agent`),[a,o]=await Promise.all([t.store.list(`installation`),i?t.store.list(`app`):[]]),s=new Set(o.filter(({value:e})=>e.agent===i).map(({id:e})=>e));return T(a.filter(({value:e})=>!i||s.has(e.app)).map(({id:e,value:t})=>{let{token:n,connections:r,...i}=t;return{id:e,value:i}}))}function Ar(e){return T(Object.values(e.integrations).map(e=>({id:e.id,name:e.name,brand:e.brand,description:e.description,installLabel:e.installLabel??`Connect ${e.id}`,organizationApps:e.organizationApps===!0,events:Object.fromEntries(Object.entries(e.events).map(([e,{description:t,noisy:n,addressed:r}])=>[e,{description:t,...n?{noisy:n}:{},...r?{addressed:r}:{}}])),presets:e.tools.presets,repositories:!!e.repos})))}async function jr(e){let t=new Map;for(let{value:n}of await e.store.list(`installation`)){let r=e.integrations[n.integration];if(n.deletedAt||!r?.repos)continue;let i=await e.store.get(`app`,n.app);if(i)try{let a=await r.auth.token(n.token?{...n,token:N(e.config,n.token)}:n,N(e.config,i.credentials));for(let e of await r.repos.list(n,a))t.has(e)||t.set(e,{repo:e,integration:r.id})}catch{}}return T([...t.values()].sort((e,t)=>e.repo.localeCompare(t.repo)))}async function Mr(e,t){let n=(await e.store.list(`installation`)).filter(({value:t})=>!t.deletedAt&&e.integrations[t.integration]?.repos),r=new Map((await dn(e.store,n.map(({value:e})=>e.app))).map(({id:e,value:t})=>[e,t]));for(let{value:i}of n){let n=e.integrations[i.integration];if(i.deletedAt||!n?.repos)continue;let a=r.get(i.app);if(!(!a||a.integration!==n.id))try{let r=i.token?{...i,token:N(e.config,i.token)}:i,o=await n.auth.token(r,N(e.config,a.credentials));if((await n.repos.list(r,o)).includes(t))return{contents:n,token:o,app:a,installation:i}}catch{}}}async function Nr(e,t,n){let r=await Mr(e,t);if(!r)return T({error:`No installed app can read ${t}`},400);let i=await r.contents.repos.listDir(t,ct,r.token,n).catch(()=>[]),a=await Promise.all(i.map(async i=>{let a=await r.contents.repos.readFile(t,`${ct}/${i}/agent.json`,r.token,n).catch(()=>void 0);if(a===void 0)return;let o={};try{o=JSON.parse(a)}catch{}let s=await U(e.store,i),c=s?.source===`repo`&&s.repo===t,l=c?await G(e.store,i):void 0;return{id:i,name:typeof o.name==`string`?o.name:i,...typeof o.description==`string`?{description:o.description}:{},...c?{version:s.currentVersion,...l?.source?{commit:l.source.commit}:{}}:{},...s&&!c?{taken:!0}:{}}}));return T({repo:t,agents:a.filter(Boolean)})}async function Pr(e,t,n,r){let i=r.searchParams.get(`repo`);return i?Nr(t,i,r.searchParams.get(`ref`)||`HEAD`):T({error:`repo is required`},400)}async function Fr(e,t,n,r){let i=await e.json().catch(()=>void 0),a=i?.agents;if(typeof i?.repo!=`string`||i.ref!==void 0&&typeof i.ref!=`string`||a!==void 0&&!(Array.isArray(a)&&a.every(e=>typeof e==`string`)))return T({error:`repo is required, ref must be a string and agents a list of ids`},400);try{let e=await Mr(t,i.repo);if(!e)return T({error:`No installed app can read ${i.repo}`},400);let n=i.ref??`HEAD`,r=a??await e.contents.repos.listDir(i.repo,`.coder/agents`,e.token,n);for(let e of r){let n=await U(t.store,e);if(n&&(n.source!==`repo`||n.repo!==i.repo))return T({error:`Agent id "${e}" is already taken`},409)}let o=await mt(t.store,e.contents,i.repo,n,e.token,(t.now??Date.now)(),{slugs:r});return await ze(t,o),T({imported:o.map(e=>e.agent)})}catch(e){return T({error:e instanceof Error?e.message:String(e)},400)}}async function Ir(e,t,n,r){if(t.source!==`repo`||!t.repo)return;let i=(await(r??e.store.list(`app`))).find(({value:e})=>e.agent===t.id&&e.agentsRepo===t.repo)?.value;return((i&&e.integrations[i.integration])??Object.values(e.integrations).find(e=>e.repos))?.repos?.url(t.repo,t.path,i?.branch??n?.commit)}async function Lr(e,t,n){let r=await Bt(e.store,t);return await Tn(e.store,n,t,r)?Bt(e.store,t):r}async function $(e,t){let n=(e.now??Date.now)(),r=e.local?await le(e.store,e.local.cwd,e.integrations,t).catch(()=>void 0):void 0;return{now:n,local:r,loadCurrent:()=>r?Promise.resolve(r.find(({record:e})=>e.id===t)??{}):Lr(e,t,n)}}async function Rr(e,t,n,r){let i=n.slug;if(n.version&&Number(n.version),n.version&&!/^\d+$/.test(r.pathname.split(`/`).at(-1)))return D();let{now:a,local:o,loadCurrent:s}=await $(t,i);if(!o&&t.store.listAgentSummaries&&(await at(t.store,a),re(r)))return T(await Ur(t,r));let c=o??(t.store.listAgentSummaries?await t.store.listAgentSummaries():await wt(t.store));if(!o&&!t.store.listAgentSummaries&&await at(t.store,a,c)&&(c=await wt(t.store)),re(r))return T(await Ur(t,r,c));let l;return T(await Promise.all(c.map(async({record:e,version:n})=>{e.source===`repo`&&e.repo&&(l??=t.store.list(`app`));let r=await Ir(t,e,n,l);return{...e,definition:n?.definition,...r?{sourceUrl:r}:{}}})))}async function zr(e,t,n,r){let i=n.slug;if(n.version&&Number(n.version),n.version&&!/^\d+$/.test(r.pathname.split(`/`).at(-1)))return D();let{now:a,local:o,loadCurrent:s}=await $(t,i),c=E(r,10,50),l=ie(r),[u,d]=await Promise.all([o?s().then(e=>e.record):U(t.store,i),o?Promise.resolve(o.flatMap(({version:e})=>e?[{value:e}]:[])):t.store.listVersions?.(i,c+1,l)]);return u?T(await Wr(t,u,c,l??u.currentVersion+1,d)):T({error:`No agent named "${i}"`},404)}async function Br(e,t,n,r){let i=n.slug,a=n.version?Number(n.version):void 0;if(n.version&&!/^\d+$/.test(r.pathname.split(`/`).at(-1)))return D();let{now:o,local:s,loadCurrent:c}=await $(t,i),l=s?s.find(({version:e})=>e?.version===a)?.version:await G(t.store,i,a);return l?T(l):T({error:`No version ${a} for agent "${i}"`},404)}async function Vr(e,t,n,r){let i=n.slug;if(n.version&&Number(n.version),n.version&&!/^\d+$/.test(r.pathname.split(`/`).at(-1)))return D();let{now:a,local:o,loadCurrent:s}=await $(t,i),c=r.searchParams.get(`versions`)!==`0`,l=r.searchParams.get(`content`)!==`0`,[{record:u,version:d},f]=await Promise.all([!l&&!o&&t.store.listAgentSummaries&&!v()[i]?t.store.listAgentSummaries({slug:i}).then(e=>e[0]??{}):s(),c?o?o.flatMap(({version:e})=>e?[{value:e}]:[]):t.store.listVersions?t.store.listVersions(i):t.store.list(`agentversion`,{prefix:`${i}:`}):[]]);if(!u)return T({error:`No agent named "${i}"`},404);let p=f.map(({value:e})=>{let{systemPrompt:t,files:n,...r}=e;return r}),m=await Ir(t,u,d);return T({...u,...d?{definition:d.definition,...l&&`systemPrompt`in d?{systemPrompt:d.systemPrompt,...d.files?{files:d.files}:{}}:{}}:{},...m?{sourceUrl:m}:{},...c?{versions:p}:{}})}const Hr={builtin:`builtin`,dashboard:`upload`,repository:`repo`};async function Ur(e,t,n){let r=E(t,24,100),i=ie(t),a=t.searchParams.get(`q`)?.trim().toLowerCase(),o=Hr[t.searchParams.get(`type`)??``],s=t.searchParams.get(`platform`),c=t.searchParams.get(`connect`)===`1`,l=e.serverOrganizationId,u=e.store.list(`app`),[d,f,p,m]=await Promise.all([u,e.store.list(`installation`),c&&l!==void 0&&l!==e.organizationId&&e.scope?e.scope(l).store.list(`app`):[],n?n.filter(({record:e})=>(!i||e.id>i)&&(!o||e.source===o)&&(!a||[e.id,e.name,e.description,e.repo].some(e=>e?.toLowerCase().includes(a)))):e.store.listAgentSummaries({after:i,source:o,q:a,platform:s??void 0,limit:r+1})]),h=new Set(f.filter(({value:e})=>!e.deletedAt).map(({value:e})=>e.app)),g=(e,t)=>{let n=d.filter(({value:n})=>n.agent===e&&n.integration===t);return n.length?n.some(({value:e})=>h.has(e.id))?`installed`:`created`:`none`},_=[];for(let{record:e,version:t}of m){let n=Object.keys(t?.definition?.integrations??{}).sort();if(!(s&&!n.includes(s))&&(_.push({record:e,version:t,ids:n}),_.length>r))break}let v=ce(_,r,e=>e.record.id);return{...v,...c?{connectable:[...d,...p.map(e=>({...e,value:{...e.value,builtin:!0}}))].filter(({value:e})=>e.builtin&&!h.has(e.id)).map(({value:e})=>({id:e.id,integration:e.integration}))}:{},items:await Promise.all(v.items.map(async({record:t,version:n,ids:r})=>{let i=await Ir(e,t,n,u);return{...t,definition:n?.definition,...i?{sourceUrl:i}:{},platforms:r.map(e=>({id:e,state:g(t.id,e)}))}}))}}async function Wr(e,t,n,r,i){let a=r-n-2,o=(i??await e.store.list(`agentversion`,{prefix:`${t.id}:`,...a>0?{after:st(t.id,a)}:{},limit:n+1})).map(({value:e})=>{let{systemPrompt:t,files:n,definition:r,...i}=e;return i}).filter(e=>e.version<r).reverse();return ce(o,n,e=>e.version)}function Gr(e){if(!e||Array.isArray(e)||typeof e!=`object`)return!1;let t=Object.entries(e);if(t.length>100)return!1;let n=0;for(let[e,r]of t){if(typeof r!=`string`||e.startsWith(`/`)||e.includes(`\\`)||e.includes(`\0`)||e.split(`/`).includes(`..`)||e===`agent.json`||e===`system.md`)return!1;n+=Buffer.byteLength(e)+Buffer.byteLength(r)}return n<=262144}async function Kr(e,t,n,r){let i=n.slug;if(n.version&&Number(n.version),n.version&&!/^\d+$/.test(r.pathname.split(`/`).at(-1)))return D();let{now:a,local:o,loadCurrent:s}=await $(t,i),c=await e.json().catch(()=>void 0);try{let e=x({[i]:c})[i];if(!e||typeof e!=`object`)throw Error(`settings must be an object`);let{record:n,version:r}=await s();if(!n||!r)throw Error(`No agent named "${i}".`);return Sn({...n,settings:void 0},r,e,t.integrations),t.local?(await xn(t,t=>{t.agents={...t.agents,[i]:e}}),await le(t.store,t.local.cwd,t.integrations),T(await U(t.store,i))):T(await ve(t.store,i,e,(t.now??Date.now)()))}catch(e){return T({error:e instanceof Error?e.message:String(e)},400)}}async function qr(e,t,n,r){let i=n.slug;if(n.version&&Number(n.version),n.version&&!/^\d+$/.test(r.pathname.split(`/`).at(-1)))return D();let{now:a,local:o,loadCurrent:s}=await $(t,i),{record:c}=await s();if(!c)return T({error:`No agent named "${i}"`},404);if(c.source===`builtin`)return T({error:`Built-in agents cannot be deleted.`},400);if(t.local&&!await $e(t.local.cwd,t.integrations,i))return T({error:`Delete .coder/agents/${i} in the repo`},409);for(let{id:e}of await t.store.list(`agentversion`,{prefix:`${i}:`}))await t.store.delete(`agentversion`,e);return await t.store.delete(`agent`,i),T({ok:!0})}async function Jr(e,t,n,r){let i=n.slug;if(n.version&&Number(n.version),n.version&&!/^\d+$/.test(r.pathname.split(`/`).at(-1)))return D();let{now:a,local:o,loadCurrent:s}=await $(t,i),c=await e.json().catch(()=>void 0);if(!c||typeof c.systemPrompt!=`string`||c.files!==void 0&&!Gr(c.files)||c.name!==void 0&&typeof c.name!=`string`||c.description!==void 0&&typeof c.description!=`string`)return T({error:`definition and systemPrompt are required; files must contain strings`},400);try{b([i]);let[e]=y({definitions:{[i]:{json:c.definition,builtin:!1}},usage:void 0},t.integrations);if(!e)throw Error(`No agent named "${i}".`);let n=t.local?await U(t.store,i):void 0,r=t.local&&n?await G(t.store,i):void 0,a=c.files;t.local&&(await Ft(t.local.cwd,t.integrations,i,{definition:{...c.definition,...c.name===void 0?{}:{name:c.name},...c.description===void 0?{}:{description:c.description}},systemPrompt:c.systemPrompt,...a?{files:a}:{}}),await le(t.store,t.local.cwd,t.integrations));let o=t.local?void 0:await Ot(t.store,{id:i,name:c.name??e.name,description:c.description??e.definition.description,source:`upload`,definition:e.definition,systemPrompt:c.systemPrompt,files:a,importedFrom:`upload`},(t.now??Date.now)()),s=o?.version??await G(t.store,i),l=o?.unchanged??Bn(r&&{...r,createdAt:0},{...s,createdAt:0});await ze(t,[s]);let u=o?.record??await U(t.store,i);return T({...u,definition:s.definition,version:s.version,unchanged:l})}catch(e){return T({error:e instanceof Error?e.message:String(e)},400)}}async function Yr(e,t,n,r){let a=n.id,o=Number(r.searchParams.get(`after`)??-1),s=Number.isFinite(o)?o:-1;r.searchParams.has(`limit`)&&E(r,500,2e3);let c=await t.store.get(`task`,a);if(!c||t.local&&c.handle?.startsWith(`cli:`)&&c.task.flow==="default"){let n=c?.task.cwd??t.local?.cwd;if(!n||!Mt(n,a,!1))return T({error:`No task "${a}"`},404);{let t=Number(e.headers.get(`last-event-id`)??s);return Qr(e,Number.isFinite(t)?t:s,async e=>{let t=Mt(n,a);if(!t)return;let r=_(n,a),o=Math.max(t.finishedAt??0,Date.parse(r?.resumedAt??r?.createdAt??``)||0),s=P.has(t.status)&&!t.error&&t.status!==`cancelled`&&(!t.result||(Ln.statSync(q.join(i(n,a),`result.json`),{throwIfNoEntry:!1})?.mtimeMs??0)<o);return{status:t,lines:yn(n,a,e,500),pendingResult:s}})}}let l=Number(e.headers.get(`last-event-id`)??s);return Qr(e,Number.isFinite(l)?l:s,async e=>{let n=await t.store.get(`task`,a);if(!n)return;let r=n.task.runner===`github-actions`&&n.handle,i=r&&P.has(n.status)?(await(await We(t,n.task))?.status(n.handle).catch(()=>void 0))?.state===`running`:!1;return{status:n,lines:([`running`,`waiting`].includes(n.status)||r)&&n.handle?await un(t,n,e,500).catch(()=>Re(t.store,a,e,500)):await Re(t.store,a,e,500),pendingLogs:i}})}const Xr=1e3;function Zr(e){let{status:t,approval:n,answer:r,result:i,error:a,startedAt:o,finishedAt:s}=e;return{status:t,approval:n??null,answer:r,result:i,error:a,startedAt:o,finishedAt:s,turns:Ze(e).turns}}function Qr(e,t,n){let r=new TextEncoder,i=Date.now()+5e4,a=t,o=``,s=!1,c=new ReadableStream({async start(t){let c=e=>t.enqueue(r.encode(e));c(`retry: ${Xr}\n\n`);try{for(;!s&&!e.signal.aborted&&Date.now()<i;){let e=await n(a);if(!e)break;let{status:t,lines:r,pendingLogs:i,pendingResult:s}=e;for(let e of r)c(`id: ${e.seq}\nevent: log\ndata: ${JSON.stringify(e)}\n\n`),a=e.seq;let l=JSON.stringify(Zr(t)),u=i||s||P.has(t.status)&&r.length===500;if(l!==o&&!u&&(c(`event: status\ndata: ${l}\n\n`),o=l),r.length!==500){if(P.has(t.status)&&!u){c(`event: end
+data: {}
+
+`);break}await new Promise(e=>setTimeout(e,Xr))}}}finally{s||t.close()}},cancel(){s=!0}});return new Response(c,{headers:{"content-type":`text/event-stream; charset=utf-8`,"cache-control":`no-cache, no-transform`}})}var $r=class{options;entries=new Map;pending=new Map;constructor(e={ttlMs:6e5,max:100}){this.options=e}get size(){return this.entries.size}get inFlight(){return this.pending.size}has(e){return this.entries.has(e)}keys(){return this.entries.keys()}async get(e,t){let n=this.options.now??Date.now,r=n(),i=this.entries.get(e);if(i&&r-i.at<this.options.ttlMs)return i.value;for(let[t,n]of this.entries)t!==e&&r-n.at>=this.options.ttlMs&&this.entries.delete(t);let a=this.pending.get(e);return a||(a=Promise.resolve().then(t).then(t=>{if(t===void 0)return i?.value;if(this.options.accept&&!this.options.accept(t))return i?.value??t;this.entries.set(e,{value:t,at:n()});let r=this.entries.keys().next().value;return this.entries.size>this.options.max&&r!==void 0&&this.entries.delete(r),t}).catch(()=>i?.value).finally(()=>this.pending.delete(e)),this.pending.set(e,a)),a}};const ei=/^[a-z0-9][a-z0-9-]*$/,ti=new Set([`openrouter.ai`,`ai-gateway.vercel.sh`,`api.groq.com`,`api.together.xyz`]);function ni(e){return{builtin:{codex:p,claude:s},models:e.models??{}}}async function ri(e,t){let{baseUrl:n,envKey:r,key:i}=await H(e);if(!n||!/^https?:\/\//.test(n)||!URL.canParse(n))return T({error:`An http or https base URL is required`},400);let a=!i&&r&&await ii(t,n,r)?await Kt(t,r):void 0,o=i||a,s=t.settings??={},c=s.probes??=new $r({ttlMs:6e5,max:100,now:t.now,accept:e=>e.reachable}),l=`${new URL(n).host}|${r??``}|${C(String(o??``))}`;return T(await c.get(l,()=>ne({baseUrl:n},{key:o,fetch:t.fetch})))}async function ii(e,t,n){let r=new URL(t).host;if(ti.has(r))return!0;let i=(await _e(e)).models??{};return Object.values(i).some(e=>`baseUrl`in e&&e.envKey===n&&new URL(e.baseUrl).host===r)}async function ai(e,t,n,r){return T(ni(await _e(t)))}async function oi(e,t,n,r){let{name:i=``,...a}=await H(e);return!ei.test(i)||u(i)?T({error:`Invalid model name "${i}"`},400):W(t,e=>{if(e.models?.[i])throw new R(`"${i}" already exists`);e.models={...e.models,[i]:a}})}async function si(e,t,n,r){let i=n.name;return W(t,e=>{if(!e.models?.[i])throw new R(`No model "${i}"`);l(e,i)})}async function ci(e,t,n,i){let a=n.name,{spec:c}=await H(e);return W(t,e=>{if(!ei.test(a))throw new R(`Invalid alias name "${a}"`);let t=e.models?.[a];if(t&&m(t))throw new R(`"${a}" is a custom model name`);let n=f(c,h(e));if(!n?.model||n.engine===`custom`)throw new R(`"${c}" does not name a codex or claude model`);let i=n.engine===`claude`?s:p,l=c.split(`:`).some(e=>r.has(e)||o.has(e));e.models={...e.models,[a]:{provider:n.engine,model:i[n.model]??n.model,...l&&n.effort?{effort:n.effort}:{}}}})}async function li(e,n,r,i){let a=r.name;return W(n,e=>{let n=e.models??={},r=n[a];r&&(m(r)||t(r))?r.disabled=!0:n[a]={disabled:!0}})}async function ui(e,n,r,i){let a=r.name;return W(n,e=>{let n=e.models??={},r=n[a];r&&(m(r)||t(r))?delete r.disabled:delete n[a]})}const di=/^[a-z0-9][a-z0-9_-]*$/i;async function fi(e,t,n,r){return T((await _e(t)).mcp??{})}async function pi(e,t,n,r){let{name:i=``,...a}=await H(e);return di.test(i)?W(t,e=>{e.mcp={...e.mcp,[i]:a}}):T({error:`Invalid server name "${i}"`},400)}async function mi(e,t,n,r){let i=n.name;return W(t,e=>{if(!e.mcp?.[i])throw new R(`No MCP server "${i}"`);delete e.mcp[i]})}const hi={npm:[`npx`,`-y`],pypi:[`uvx`],oci:[`docker`,`run`,`-i`,`--rm`]},gi=(e=[])=>e.map(({name:e,description:t,isRequired:n,isSecret:r,value:i,default:a})=>({name:e,...t?{description:t}:{},...i??a?{placeholder:i??a}:{},required:n===!0,secret:r===!0}));function _i(e=[],t,n){return e.flatMap((e,r)=>{let i=`${t}:${r}`,a=Object.entries(e.variables??{}),o=e.value??e.default,s=(e,t,r)=>{let[i]=gi([{...r,name:e}]);return n.push({...i,label:t}),`{${e}}`};if(a.length)for(let[e,t]of a)o=o?.replaceAll(`{${e}}`,s(`${i}:${e}`,e,t));else o===void 0&&(e.valueHint||e.isRequired)&&(o=s(i,e.valueHint??e.name??i,e));return[...e.type===`named`&&e.name?[e.name]:[],...o===void 0?[]:[o]]})}function vi(e){let t=e.remotes?.find(e=>e.type===`streamable-http`||e.type===`sse`);if(t)return{type:t.type===`sse`?`sse`:`http`,url:t.url,env:[],headers:gi(t.headers)};let n=e.packages?.find(e=>hi[e.registryType]&&(e.transport?.type??`stdio`)===`stdio`);if(!n)return;let[r,...i]=hi[n.registryType],a=[],o=_i(n.runtimeArguments,`runtime`,a),s=_i(n.packageArguments,`package`,a);return{type:`stdio`,command:n.runtimeHint??r,args:[...!n.runtimeHint||n.runtimeHint===r?i:[],...o,n.identifier,...s],...a.length?{argumentInputs:a}:{},env:gi(n.environmentVariables),headers:[]}}async function yi(e,t,n){let r=n.searchParams.get(`q`)?.trim()??``,i=t.settings??={},a=await(i.registry??=new $r({ttlMs:6e5,max:100,now:t.now})).get(r,()=>bi(t,r));return a?T(a):T({error:`The MCP registry did not answer. Try again.`},502)}async function bi(e,t){let n=new URLSearchParams({version:`latest`,limit:`30`});t&&n.set(`search`,t);try{let t=await(e.fetch??fetch)(`https://registry.modelcontextprotocol.io/v0.1/servers?${n}`,{headers:{accept:`application/json`},signal:AbortSignal.timeout(2e4)});if(!t.ok)return;let{servers:r=[]}=await t.json();return r.flatMap(({server:e})=>{let t=vi(e);return t?[{name:e.name,title:e.title??e.name.split(`/`).pop()??e.name,description:e.description??``,...t}]:[]})}catch{return}}const xi=`/api/auth/callback`,Si=`/.well-known/oauth-client.json`,Ci=`/.well-known/oauth-cli-client.json`,wi=`openid profile email offline_access organizations:read`;function Ti(e,t){return{client_id:`${e}${Si}`,client_name:`Coder at ${new URL(e).host}`,redirect_uris:[`${e}${xi}`],post_logout_redirect_uris:[`${e}/?signed_out=1`],grant_types:[`authorization_code`,`refresh_token`],response_types:[`code`],token_endpoint_auth_method:`private_key_jwt`,token_endpoint_auth_signing_alg:`ES256`,jwks:t,scope:wi}}function Ei(e){return{client_id:`${e}${Ci}`,client_name:`Coder CLI for ${new URL(e).host}`,redirect_uris:[`http://127.0.0.1/callback`],grant_types:[`authorization_code`,`refresh_token`,`urn:ietf:params:oauth:grant-type:device_code`],response_types:[`code`],token_endpoint_auth_method:`none`,scope:wi}}function Di(e,t){return{resource:new URL(e).origin,authorization_servers:[t],bearer_methods_supported:[`header`],scopes_supported:wi.split(` `)}}function Oi(e){let t=T(e);return t.headers.set(`cache-control`,`public, max-age=3600`),t}function ki(e,t,n,r){return t.config.publicUrl&&t.auth?Oi(Ti(t.config.publicUrl,t.auth.jwks)):void 0}function Ai(e,t,n,r){return t.config.publicUrl&&t.auth?Oi(Ei(t.config.publicUrl)):void 0}function ji(e,t,n,r){return t.config.publicUrl&&t.auth?Oi(Di(t.config.publicUrl,t.auth.issuer)):void 0}const Mi=[z(`GET`,Si,ki,pe),z(`GET`,Ci,Ai,pe),z(`GET`,`/.well-known/oauth-protected-resource`,ji,pe),z(`GET`,`/health`,(e,t)=>Yn(t)),z(`GET`,`/`,Et,Je),z(`GET`,`/login`,en,He),...nn(`/login`,sn,He).filter(e=>e.method!==`GET`),z(`POST`,`/dash/token`,Gt,ot),...nn(`/dash`,fn,En)],Ni=[z(`GET`,`/api/auth/capabilities`,(e,t)=>T({wular:t.auth?.issuer??null})),...nn(`/api/auth`,(e,t)=>t.auth.handler(e),Tt),z(`GET`,`/me`,Qn,rn),z(`POST`,`/me/organization`,er,Ge)],Pi=[...B(`/tasks`,[z(`GET`,`/:id/messages`,gt,Cn),z(`POST`,`/:id/ack`,pt,Cn),z(`POST`,`/:id/heartbeat`,Ne,Cn),z(`POST`,`/:id/result`,Be,bn),z(`POST`,`/:id/credential`,Ae,bn),z(`GET`,`/:id`,ut,kn)]),...B(`/logins`,[z(`GET`,`/:id/input`,dr,Qt),z(`GET`,`/:id`,fr,Qt),z(`POST`,`/:id`,pr,Qt)]),...B(`/runners`,[z(`POST`,`/register`,Pt)])],Fi=[...B(`/create`,[z(`GET`,`/:id`,mr,K),z(`POST`,`/:id`,mr,K),z(`GET`,`/:id/callback`,hr,K),z(`POST`,`/:id/callback`,gr,K)]),...B(`/install`,[z(`GET`,`/:id`,_r,F),z(`POST`,`/:id`,_r,F),z(`GET`,`/:id/callback`,vr,F),z(`POST`,`/:id/callback`,vr,F)])],Ii=B(`/connect`,[z(`GET`,``,xr,ge),z(`POST`,``,Sr,ge),z(`GET`,`/:integration`,Cr,Yt),z(`GET`,`/:integration/callback`,wr,Yt)]),Li=[...B(`/hooks`,[z(`POST`,`/*`,(e,t,n)=>nt(e,t,n[`*`]),(e,t,n)=>t.integrations[n[`*`]]?t:D())]),...Fi,...Ii],Ri=[z(`GET`,`/metrics`,async(e,t)=>T(await Zn(t),200,{"cache-control":`no-store`}),Vt),z(`GET`,`/usage`,Fn),z(`GET`,`/usage/totals`,In)],zi=B(``,[z(`GET`,`/folders`,(e,t)=>T(Xe(t.local.cwd))),z(`POST`,`/folders/check`,async(e,t)=>{let n=await e.json().catch(()=>void 0);return T(we(n?.path))}),z(`POST`,`/folders/clone`,async(e,t)=>{let n=await e.json().catch(()=>void 0);return T(await xe(n?.url))}),z(`POST`,`/folders/pick`,async(e,t)=>T(await Zt()))],Se),Bi=B(``,[z(`GET`,`/engines/status`,async(e,t)=>T(await $t())),z(`POST`,`/engines/:engine/login`,Nt),z(`POST`,`/engines/:engine/logout`,Rt)],ye),Vi=[z(`POST`,`/apps/:id/install`,(e,t,n,r)=>Dr(e,t,n.id,r.searchParams.get(`back`))),z(`GET`,`/apps`,Or),z(`GET`,`/installations`,kr),z(`POST`,`/connections`,(e,t)=>Er(e,t)),z(`GET`,`/integrations`,(e,t)=>Ar(t)),z(`GET`,`/repositories`,(e,t)=>jr(t))],Hi=[z(`GET`,`/agents/import`,Pr),z(`POST`,`/agents/import`,Fr),z(`GET`,`/agents`,Rr),z(`PATCH`,`/agents/:slug/settings`,Kr),z(`GET`,`/agents/:slug/versions`,zr),z(`GET`,`/agents/:slug/versions/:version`,Br),z(`GET`,`/agents/:slug`,Vr),z(`DELETE`,`/agents/:slug`,qr,(e,t)=>Qe(t,`Only an owner or admin can delete an agent.`)),z(`PUT`,`/agents/:slug`,Jr)],Ui=[z(`GET`,`/credentials`,jt),z(`POST`,`/credentials`,pn,kt),z(`POST`,`/credentials/:label/default`,cn),z(`DELETE`,`/credentials/:label`,gn),z(`POST`,`/logins`,tr,M),z(`GET`,`/logins/:id`,nr,M),z(`POST`,`/logins/:id`,rr,M),z(`DELETE`,`/logins/:id`,ir,M)],Wi=[z(`GET`,`/runners`,tt),z(`POST`,`/runners`,vt),z(`POST`,`/runners/pair`,ue),z(`POST`,`/runners/:id/test`,xt),z(`PATCH`,`/runners/:id`,vn),z(`DELETE`,`/runners/:id`,Ct)],Gi=[z(`GET`,`/tasks`,Ue),z(`POST`,`/tasks`,Ce),z(`GET`,`/tasks/:id`,Ke),z(`DELETE`,`/tasks/:id`,Ee),z(`GET`,`/tasks/:id/logs`,Ve),z(`GET`,`/tasks/:id/stream`,Yr),z(`POST`,`/tasks/:id/steer`,Pe),z(`POST`,`/tasks/:id/ask`,Xt),z(`POST`,`/tasks/:id/continue`,qt),z(`POST`,`/tasks/:id/approve`,be),z(`POST`,`/tasks/:id/cancel`,de),z(`POST`,`/tasks/:id/archive`,Ye)],Ki=[z(`GET`,`/config`,wn),z(`PATCH`,`/config`,Dt),z(`PUT`,`/config`,it)],qi=[z(`POST`,`/models/probe`,(e,t)=>ri(e,t)),z(`GET`,`/models`,ai),z(`POST`,`/models`,oi),z(`DELETE`,`/models/:name`,si),z(`POST`,`/models/:name/alias`,ci),z(`POST`,`/models/:name/disable`,li),z(`POST`,`/models/:name/enable`,ui)],Ji=[z(`GET`,`/mcp`,fi),z(`POST`,`/mcp`,pi),z(`DELETE`,`/mcp/:name`,mi),z(`GET`,`/mcp-registry`,(e,t,n,r)=>yi(e,t,r))],Yi=[z(`GET`,`/flows`,Dn),z(`GET`,`/pulls`,me),z(`POST`,`/flows/:name/run`,je),z(`POST`,`/review`,dt)],Xi=B(`/admin`,[...Ri,...zi,...Bi,...Vi,...Hi,...Ui,...Wi,...Gi,...Ki,...qi,...Ji,...Yi]).map(e=>({...e,guard:Ut(e.guard)})),Zi=[...Pi,...Xi,...Ni,...Li,...Mi];async function Qi(e,t,n){if(!Te(e,t))return D();let r=new URL(e.url);return n.scope instanceof Response?n.scope:(t=n.scope??t,await Lt(Zi,e,t,r)??hn(e,t,r))}const $i=`x-coder-request-scope`;function ea(e,{sessions:t,cookies:n}){let r=e.auth;return r?{...e,auth:{...r,session(e,i){let a=JSON.stringify([...[`cookie`,`authorization`,`x-coder-organization`].map(t=>e.get(t)),!!i]),o=t.get(a);return o||(o=r.session(e,i).then(e=>(e?.cookies&&n.push(...e.cookies),e)),t.set(a,o)),o}}}:e}function ta(e,t,n){let r=t.requestScopes??=new Map,i=e.headers.get($i),a=n&&i?r.get(i):void 0;if(a)return{req:e,ctx:ea(t,a),end(){}};let o=new Headers(e.headers);if(o.delete($i),!t.auth)return{req:i?new Request(e,{headers:o}):e,ctx:t,end(){}};let s=zn(),c={sessions:new Map,cookies:[]};return r.set(s,c),o.set($i,s),{req:new Request(e,{headers:o}),ctx:ea(t,c),cookies:c.cookies,end:()=>r.delete(s)}}async function na(e,t,n={}){t.limits??=new _t((t.now??Date.now)()),t.limits.requests++,t.settings??={},t.dashboardHosts??=new an;let r=()=>ra(e,t,n);return t.dbProfile?t.dbProfile.request(n.inProcess===!0,r):r()}async function ra(e,t,n){let r=await ae(e,se(new URL(e.url).pathname));if(r instanceof Response)return r;let i=ta(r,t,n.inProcess===!0),a=!1;try{let r=n.clientIp??`unknown`,o=await St(i.req,i.ctx,r),s=ia(o instanceof Response?o:await Qi(i.req,i.ctx,o),i.cookies),c=new URL(e.url).pathname.split(`/`),l=c[1]===`tasks`,u=c[1]===`admin`&&c[2]===`tasks`;return e.method!==`GET`&&s.ok&&![`hooks`,`tasks`,`logins`].includes(c[1])&&mn(t),e.method!==`GET`&&s.ok&&!(l&&c.length===4&&c[2]&&c[3]===`heartbeat`)&&!(u&&c.length===5&&c[3]&&[`steer`,`ask`,`approve`,`archive`].includes(c[4]))&&(l||u||c[1]===`admin`&&c[2]===`review`||c[1]===`admin`&&c[2]===`flows`&&c.length===5&&c[3]&&c[4]===`run`)&&yt(t,u&&c.length===3&&e.method===`POST`||u&&c.length===5&&!!c[3]&&c[4]===`continue`),a=!!s.body&&(s.headers.get(`content-type`)??``).includes(`text/html`),a?aa(s,i.end):s}finally{a||i.end()}}function ia(e,t=[]){if(!t.length)return e;let n=new Headers(e.headers);for(let e of t)n.append(`set-cookie`,e);return new Response(e.body,{status:e.status,statusText:e.statusText,headers:n})}function aa(e,t){let n=e.body.getReader(),r=new ReadableStream({async pull(e){try{let{done:r,value:i}=await n.read();r?(t(),e.close()):e.enqueue(i)}catch(n){t(),e.error(n)}},cancel(e){return t(),n.cancel(e)}});return new Response(r,e)}async function oa(e={}){let t=e.env??J.env,n=An(t,e.host??`node`),r=e.runner??n.runner;if((e.host===`vercel`||t.VERCEL)&&(r===`local`||r===`local-docker`))throw new g(`invalid-option`,`The ${r} runner cannot run on Vercel.`,{hint:`Leave RUNNER unset to use vercel-sandbox.`});if(n.store===`memory`&&r!==`local`&&r!==`local-docker`)throw new g(`invalid-option`,`The ${r} runner needs a database.`,{hint:`Set DATABASE_URL, or use RUNNER=local for a memory server.`});if(!n.publicUrl)throw new g(`invalid-option`,`PUBLIC_URL is required to start a Coder server.`,{hint:`Set PUBLIC_URL to the address platforms and browsers use.`});let i=[];if(n.store===`memory`&&!e.local&&i.push(`test server, not for production: everything is in memory, nothing survives a restart, no sign-in; set DATABASE_URL for a real deployment`),!t.SERVER_ENCRYPTION_KEY&&!e.local&&i.push(`secrets are stored unencrypted; set SERVER_ENCRYPTION_KEY (openssl rand -base64 32)`),n.store===`postgres`&&!n.encryptionKey)throw new g(`invalid-option`,`SERVER_ENCRYPTION_KEY is required for a Postgres server.`,{hint:`Set SERVER_ENCRYPTION_KEY (openssl rand -base64 32); sign-in keys derive from it.`});let a=te(n.integrations),o=n.store===`memory`&&!n.adminToken?Rn(18).toString(`base64url`):void 0;n.store===`postgres`&&n.adminToken&&i.push(`ADMIN_TOKEN is ignored with Postgres; owners and admins sign in with coder auth login`);let s={...n,...n.store===`postgres`?{adminToken:void 0}:{},...o?{adminToken:o}:{},...e.runner?{runner:e.runner}:{}},c=await _n(s,{local:!!e.local});if(c.connection)try{let e=await Nn(c.connection.db);if(!e.applied)throw new g(`server`,`The database is not set up yet.`,{hint:`Create the tables: coder server migrate`});e.pending&&i.push(`database is ${e.pending} migration${e.pending===1?``:`s`} behind; run coder server migrate`)}catch(e){throw await c.close(),e}try{s.store===`memory`&&await at(c.store(c.defaultOrganizationId),Date.now());let n=c.connection&&s.auth?await(await import(`./auth-BFny--17.js`)).createAuth(c.connection.db,s):void 0,r=e.cwd??J.cwd(),l=c.store(c.defaultOrganizationId),u=Jt({kind:s.runner,workDir:s.workDir,config:s.runnerConfig,local:!(e.host===`vercel`||t.VERCEL),sandbox:{region:qe(s.databaseUrl),snapshots:{get:e=>l.get(`snapshot`,e),put:(e,t)=>l.put(`snapshot`,e,t)}}});if(!u[s.runner])throw await c.close(),new g(`invalid-option`,`Runner ${s.runner} is not configured.`,{hint:`Set RUNNER_CONFIG to JSON containing url and secret.`});let d=new an,f=new _t,p=new Map,m=new Map,h=t=>{let i=p.get(t);if(i)return i;let o=c.store(t),l={limits:f,...c.connection?{databaseHealth:async()=>{await c.connection.db.execute(Hn`select 1`)},healthRunners:async()=>{let[e]=await c.connection.db.select({total:Hn`count(*)::int`,online:Hn`count(*) filter (where ${Mn.lastSeen} > clock_timestamp() - interval '5 minutes')::int`}).from(Mn);return e??{online:0,total:0}}}:{},config:s,settings:{},organizationId:t,integrations:a,runners:u,store:o,queue:c.queue,requestScopes:m,dashboardHosts:d,dbProfile:c.connection?.profile,chatState:c.chatState,loadAgent:Oe(a,{cwd:r,config:s,store:o}),...n?{auth:n}:{},scope:h,webhookTarget:(e,t)=>c.webhookTarget(e,t),appRecord:e=>c.appRecord(e),installationOrganization:e=>c.installationOrganization(e),installations:e=>c.installations(e),serverOrganizationId:c.defaultOrganizationId,taskOrganization:(e,t)=>c.taskOrganization(e,t),...e.local?{local:e.local}:{}};return p.set(t,l),l};globalThis.__coder={handle:e=>na(e,h(c.defaultOrganizationId),{inProcess:!0})};let _=h(c.defaultOrganizationId),v;return e.local&&(await tn(_),v=setImmediate(()=>{zt(_).catch(()=>void 0)})),{config:s,context:h,defaultContext:_,warnings:i,...o?{mintedToken:o}:{},sweep:c.sweep,close:async()=>{v&&clearImmediate(v),await _.local?.usageSync?.catch(()=>void 0),await Ht(_),await c.close()}}}catch(e){throw await c.close(),e}}var sa=e({serve:()=>da,serverHandler:()=>la});function ca(e){try{let t=new URL(e);return ln.has(t.hostname)?Number(t.port||(t.protocol===`https:`?443:80)):void 0}catch{return}}function la(e=J.env,t=e.VERCEL?`vercel`:`node`){jn();let n,r=()=>n??=oa({env:e,host:t}).catch(e=>{throw n=void 0,e});return Object.assign(async(t,n)=>{let i=await r(),a=n?e=>n(e):e=>void e.catch(()=>{}),o=e=>({...i.context(e),waitUntil:a,scope:o});return na(t,o(i.defaultContext.organizationId),{clientIp:e.VERCEL?t.headers.get(`x-forwarded-for`)?.split(`,`,1)[0]?.trim():void 0})},{scheduled:async()=>{let e=await r();await Promise.all([e.sweep(),import(`./store-DzqXS2wT.js`).then(e=>e.q).then(t=>t.renewInstallations(e.defaultContext)),Ie(e.defaultContext,!1,!0),on(e.defaultContext)])},close:async()=>{let e=n;n=void 0,await(await e)?.close()}})}async function ua(e={}){jn();let t=e.env??J.env;if(e.runner&&!fe.includes(e.runner))throw new g(`invalid-option`,`Invalid --runner value: use ${fe.join(`, `)}`);if(e.port!==void 0&&(!Number.isInteger(e.port)||e.port<1||e.port>65535))throw new g(`invalid-option`,`Invalid port: use 1 through 65535.`);let n=t.PORT&&/^\d+$/.test(t.PORT)?Number(t.PORT):void 0,r=ca(t.PUBLIC_URL),i=e.port??n??r??8787;if(!Number.isInteger(i)||i<1||i>65535)throw new g(`invalid-option`,`Invalid PORT: use 1 through 65535.`);let a=t.PUBLIC_URL?t:{...t,PUBLIC_URL:`http://localhost:${i}`},o=!!(t.DATABASE_URL||t.POSTGRES_URL);if(o&&e.memory)throw new g(`invalid-option`,`A memory server cannot use DATABASE_URL.`,{hint:`Unset DATABASE_URL, or drop --memory.`});let s=(e.host??t.HOST??(o?void 0:`127.0.0.1`))?.replace(/^\[(.*)\]$/,`$1`),c=!o&&!e.memory;if(c&&!ln.has(s))throw new g(`invalid-option`,`A local server listens on loopback only.`,{hint:`Reach it through a tunnel or a proxy on this machine; set DATABASE_URL for a deployment, or use --memory for a test server.`});if(e.memory&&t.VERCEL)throw new g(`invalid-option`,`A memory server cannot run on Vercel.`,{hint:`Set DATABASE_URL for a real deployment.`});let l,u,d=c?new Promise((e,t)=>{u=t,l=()=>{qn().then(e,t)}}):void 0,f=d?.then(()=>void 0).catch(()=>void 0),p=c?{cwd:e.cwd??J.cwd(),port:i,cacheMaintenance:f}:void 0,m=await oa({cwd:e.cwd,env:a,runner:e.runner,...p?{local:p}:{}}),h=m.defaultContext,_=()=>{m.sweep().catch(()=>{}),import(`./store-DzqXS2wT.js`).then(e=>e.q).then(e=>e.renewInstallations(h)).catch(()=>{})};_();let v=setInterval(_,36e5);v.unref();let y=setInterval(()=>{Ie(h,!1,!0).catch(()=>{}),on(h).catch(()=>{}),t.PUBLIC_URL||import(`./store-DzqXS2wT.js`).then(e=>e.q).then(e=>e.renewInstallations(h,`sync`)).catch(()=>{})},6e4);y.unref();let b=Vn.createServer(oe((e,t)=>na(e,h,{clientIp:t}),{limit:se,admit:e=>o||rt(e.socket.remoteAddress,e.url??`/`)})),x=m.config.publicUrl;r!==void 0&&r!==i&&m.warnings.push(`PUBLIC_URL points at port ${r} but the server listens on ${i}`),await new Promise((e,t)=>{b.once(`error`,t),b.listen(i,s,e)}).catch(async e=>{throw u?.(e),clearInterval(y),clearInterval(v),await m.close(),e});let S=l?setTimeout(l,0):void 0,C=!1,ee=async()=>{C||(C=!0,clearInterval(y),clearInterval(v),await new Promise((e,t)=>b.close(n=>n?t(n):e())),await f,S&&clearTimeout(S),await m.close())},te=h.auth?`Wular Auth (${h.auth.issuer})`:void 0,ne=`http://localhost:${i}`,w=Fe(h),T=w===`local`?ne:x,E=m.config.store===`memory`?m.mintedToken??t.ADMIN_TOKEN:void 0;return{address:ne,publicUrl:x,warnings:m.warnings,close:ee,runner:m.config.runner,store:m.config.store,mode:w,...d?{cacheMigration:d}:{},maxTasks:m.config.maxTasks??m.config.limits?.concurrentTasks??10,...te?{signIn:te}:{},...m.mintedToken?{mintedToken:m.mintedToken}:{},...m.config.store===`postgres`&&t.DATABASE_URL?{database:Pn(t.DATABASE_URL)}:{},...ln.has(new URL(T).hostname)?{dashboard:`${T}/dash${E?`#token=${encodeURIComponent(E)}`:``}`}:{}}}async function da(e={}){try{return await ua(e)}catch(e){if(e instanceof g)throw e;let t=e instanceof Error&&e.cause instanceof Error?`: ${e.cause.message}`:``;throw new g(`server`,`${e instanceof Error?e.message:String(e)}${t}`)}}export{wi as a,xi as i,sa as n,Si as o,la as r,da as t};

package/dist/serve-GmRO89s5.js

@@ -0,0 +1,12 @@
+import{En as e,G as t,On as n,Qt as r,Tt as i,b as a,bn as o,nt as s,tn as c,v as l,y as u,zt as d}from"./dispatch-BKeAch9E.js";import{i as f}from"./cli-BilSDkvE.js";import{s as p}from"./args-BOEEdpWk.js";import{n as m}from"./mcp-server-DGzme0YX.js";import h from"node:path";import g from"node:fs";import{spawn as _}from"node:child_process";import{randomUUID as v}from"node:crypto";function y(e){return h.join(e,`sidecar.json`)}function b(t){return e(y(t))??{sessionId:null,declineStreak:0}}async function x(e){let t=h.join(e,`sidecar.lock`),n=Date.now()+12e4;for(;;)try{return g.mkdirSync(t),()=>{try{g.rmdirSync(t)}catch{}}}catch{try{if(Date.now()-g.statSync(t).mtimeMs>9e4){g.rmdirSync(t);continue}}catch{continue}if(Date.now()>n)throw Error(`sidecar lock wait timed out`);await new Promise(e=>setTimeout(e,250))}}function S(e,n,r,i){return[`-p`,i,`--output-format`,`json`,`--model`,`sonnet`,`--effort`,`low`,r?`--resume`:`--session-id`,n,...t,`--add-dir`,e]}function C(e,t,n,r,i){let a=S(t,n,r,i);return new Promise((t,n)=>{let r=_(`claude`,a,{cwd:e,stdio:[`ignore`,`pipe`,`pipe`]}),i=``,o=``,s=setTimeout(()=>{r.kill(`SIGKILL`),n(Error(`sidecar call timed out`))},12e4);r.stdout.on(`data`,e=>i+=e),r.stderr.on(`data`,e=>o+=e),r.on(`error`,e=>{clearTimeout(s),n(e)}),r.on(`close`,e=>{if(clearTimeout(s),e!==0){n(Error(`sidecar claude exited ${e}: ${o.trim().slice(0,200)}`));return}try{let e=JSON.parse(i);if(e.is_error){n(Error(`sidecar turn errored: ${String(e.result??``).slice(0,200)}`));return}t(String(e.result??``))}catch{n(Error(`sidecar returned unparseable output`))}})})}function w(e){let t=e.match(/\{[^{}]*"decision"[^{}]*\}/);if(!t)return null;try{let e=JSON.parse(t[0]);if(e.decision===`accept`||e.decision===`decline`||e.decision===`escalate`)return{decision:e.decision,reason:String(e.reason??``)}}catch{}return null}async function T(e,t,r){let i=null;try{i=await x(t);let a=b(t);if(a.declineStreak>=3)return{decision:`escalate`,reason:`sidecar decline streak; needs human review`};if(!a.sessionId){let i=v();await C(e,t,i,!1,`You are the approval reviewer for a "coder" background coding task. The task runs inside an OS sandbox; you review only actions that escape it.
+
+Rules:
+- git stays read-only: decline any git write (commit/push/checkout/reset/...).
+- Decline anything destructive or system-level (sudo, rm -rf outside workspace, killing processes, changing system config, piping downloads to shells).
+- Temp locations (/tmp, \$TMPDIR, os temp dirs) and paths this task created are workspace scratch. They can be deleted after checking the progress log.
+- Accept actions clearly needed for the task goal (package installs in the workspace, running tests/builds/linters, reading system info, network to well-known package registries).
+- Escalate when genuinely uncertain, when the action is irreversible beyond the workspace, or when it touches credentials/secrets.
+
+You may Read/Grep workspace files and the task progress log to inform a decision. Do this only when the action line alone is not enough. Most decisions should not need it.
+
+Reply with ONLY one line of JSON: {"decision":"accept"|"decline"|"escalate","reason":"<short>"}. Acknowledge now with {"decision":"escalate","reason":"ready"}.${r.taskGoal?`\n\nTask goal: ${r.taskGoal.replace(/\s+/g,` `).slice(0,500)}`:``}${`\nTask progress log: ${h.join(t,`log.jsonl`)}`}`),a.sessionId=i,n(y(t),a)}let o=w(await C(e,t,a.sessionId,!0,`action: ${r.summary.slice(0,500)}`));return o?.decision===`decline`?a.declineStreak+=1:o?.decision===`accept`&&(a.declineStreak=0),n(y(t),a),o??{decision:`escalate`,reason:`sidecar verdict unparseable`}}catch(e){return{decision:`escalate`,reason:`sidecar unavailable: ${e instanceof Error?e.message:String(e)}`}}finally{i?.()}}const E=new Set([`Write`,`Edit`,`MultiEdit`,`NotebookEdit`]);async function D(e,t,n){let o=String(n.tool_name??``),f=n.input??n.tool_input??{},p=c(e),m=r(e,t),h=s(e),g=n=>i(e,t,n),_,v;if(o===`Bash`){let e=String(f.command??``);v=`run command: ${e||`(unknown command)`}`,_=l(e,{allowedNetworkHosts:h.approvals.allowedNetworkHosts})}else if(E.has(o)){let e=String(f.file_path??f.notebook_path??``);v=`${o}: ${e||`(unknown path)`}`,_=u(e?[e]:[],p)}else v=`${o||`(unknown tool)`}: ${JSON.stringify(f).slice(0,200)}`,_={decision:`escalate`,reason:`tool needs approval: ${o}`};g({kind:`approval-decision`,method:o,decision:_.decision,reason:_.reason,summary:v});let y=_.decision,b=_.reason;if(y===`escalate`){let n=await T(e,m,{taskGoal:d(e,t)?.prompt??null,summary:v});g({kind:`sidecar-decision`,decision:n.decision,reason:n.reason,summary:v}),n.decision===`escalate`?(y=await a(m,{method:`claude/${o}`,summary:v,params:{tool_name:o,input:f}},{timeoutMs:h.approvals.escalationTimeoutMs,onEvent:g}),b=`escalated for human review`):(y=n.decision,b=n.reason)}return y===`accept`?{behavior:`allow`,updatedInput:f}:{behavior:`deny`,message:`Denied by coder policy: ${b}`}}const O={approval_prompt:{description:`Coder approval policy for claude permission prompts.`,inputSchema:{type:`object`,additionalProperties:!0},handler:(e,{cwd:t,taskId:n})=>D(t,n,e).catch(e=>({behavior:`deny`,message:`coder mcp tool failed: ${e instanceof Error?e.message:String(e)}`}))}},k=f({name:`mcp serve`,options:{cwd:p},args:1,run:({args:e,cwd:t})=>m(`coder`,O,{cwd:t,taskId:e[0]},void 0,o())});export{k as commandMcp};

package/dist/server-Kb22cWfF.js

@@ -0,0 +1 @@
+import{s as e}from"./cli-BilSDkvE.js";const t=e(`server`,{serve:async()=>(await import(`./serve-CPnmrKyf.js`)).commandServerServe,migrate:async()=>(await import(`./migrate-C4vM7DQN.js`)).commandServerMigrate,"rotate-key":async()=>(await import(`./rotate-key-IdMYH7gg.js`)).commandServerRotateKey,app:async()=>(await import(`./app-BT5f7zL5.js`)).commandServerApp,workflow:async()=>(await import(`./workflow-Dcmdooi8.js`)).commandServerWorkflow},{menu:[{usage:`serve [--port <n>]`,blurb:`run the server`},{usage:`migrate`,blurb:`apply pending database migrations`},{usage:`rotate-key`,blurb:`re-seal secrets with SERVER_ENCRYPTION_KEY`},{usage:`app create <integration>`,blurb:`create the built-in agent's public app`},{usage:`workflow`,blurb:`print the GitHub Actions workflow for RUNNER=github-actions`}],description:[`Self-host Coder: the server your agents and platform apps talk to, with a dashboard and sign-in. We run one as the hosted service; you can run your own.`],exampleCommand:`server serve`},{nested:[`app`]});export{t as commandServer};

package/dist/setup-host-GFTUzzZJ.js

@@ -0,0 +1,6 @@
+import{w as e}from"./dispatch-BKeAch9E.js";import{i as t}from"./cli-BilSDkvE.js";import{f as n,p as r,t as i}from"./output-BKeyLbvt.js";import{n as a,t as o}from"./args-BOEEdpWk.js";import s from"node:process";const c=t({name:`setup-host`,help:{usage:`coder setup-host [claude] [codex] [agents] [--json]`,summary:`Set up coder in your host: check engines and auth, seed the config, and
+install the host plugin/skill for the named host(s). Claude Code gets its
+marketplace plugin; "agents" installs a skill into ~/.agents/skills for
+every host that reads the Agent Skills standard dir (Codex, Pi, OpenCode,
+...). "codex" is an alias for agents. With no host, checks and seeds.`,examples:[[`coder setup-host claude`,`install the Claude Code plugin`],[`coder setup-host agents`,`install the skill into ~/.agents/skills (Codex, Pi, OpenCode, ...)`]]},options:{...o,codex:a,claude:a,agents:a},args:1/0,run:({options:t,args:n,cwd:r})=>e(r,{...t,hosts:n},()=>t.json||l()),print:u});function l(){s.stdout.write(`${r.bold(`Coder host setup`)}\n\n`)}function u(e){let t=r.bold,a=r.dim,{codex:o,claude:c,codexUpdate:l,config:u,configFile:d,claudePlugin:f,agentsSkill:p,ready:m}=e,h=[],g=o.available?o.loggedIn?n(`codex   ${a(`${o.detail}; ${o.auth}`)}`):i(`codex   not logged in ${a(`(${o.auth})`)} - run: codex login`):i(`codex   CLI not installed - run: npm install -g @openai/codex`),_=c.available?c.loggedIn?n(`claude  ${a(`${c.detail}; ${c.auth}`)}`):i(`claude  not logged in - run: claude auth login`):i(`claude  CLI not installed - run: npm install -g @anthropic-ai/claude-code`);h.push(t(`Available Engines`),g,_,`  ${a(`custom models (local/provider endpoints): coder model --help`)}`),l?.updated?h.push(n(`codex   ${a(`updated ${l.from} -> ${o.detail} (GPT-6 support)`)}`)):l&&h.push(i(`codex   ${l.note}`)),h.push(``);let v=e=>{let t=u.engines?.[e]??{};return[t.model,t.effort,t.permissions].filter(Boolean).join(`/`)};h.push(t(`Config`),`  chain: ${(u.chain??[]).join(` -> `)}   codex: ${v(`codex`)}   claude: ${v(`claude`)}`,`  ${a(d)} ${a(`(coder config set <key> <value> to change)`)}`,``);let y=[[`claude plugin`,f??null],[`agents skill `,p??null]];for(let[e,t]of y)t&&h.push(t.installed?n(`${e} ${a(t.note)}`):i(`${e} ${t.note}`),``);h.push(m?n(`ready - try: coder run --wait "explain this repo's layout"`):i(`not ready - install an engine CLI to run tasks: codex (npm install -g @openai/codex, then codex login) or claude (npm install -g @anthropic-ai/claude-code, then claude auth login)`)),s.stdout.write(`${h.join(`
+`)}\n`)}export{c as commandSetupHost};

package/dist/shared-DVtzWhUT.js

@@ -0,0 +1 @@
+import{t as e}from"./rolldown-runtime-DT7IzrpZ.js";import{Rn as t}from"./store-DzqXS2wT.js";import{d as n,n as r,o as i,p as a,s as o,t as s}from"./schema-CU2iFkp8.js";import{and as c,eq as l,or as u}from"drizzle-orm";var d=e({UNSCOPED_ORGANIZATION:()=>``,addSecret:()=>N,agentRowId:()=>O,agentValue:()=>S,app:()=>m,appRowId:()=>D,date:()=>_,defined:()=>y,escapeLike:()=>v,install:()=>h,installationRowId:()=>k,ms:()=>g,opaque:()=>M,rows:()=>L,setSecret:()=>P,splitKey:()=>p,stateKey:()=>I,statePrefix:()=>F,taskRecord:()=>E,taskRowId:()=>A,versionColumns:()=>w,versionSummary:()=>T,versionValue:()=>C});const f=``;function p(e){let t=e.lastIndexOf(`:`),n=e.slice(t+1);return t>0&&/^\d+$/.test(n)?[e.slice(0,t),Number(n)]:void 0}const m=i,h=o,g=e=>e.getTime(),_=e=>new Date(e),v=e=>e.replace(/[\\%_]/g,`\\$&`),y=e=>Object.fromEntries(Object.entries(e).filter(([,e])=>e!=null)),b=e=>e?g(e):void 0,x=(e,t)=>{let n=/^repo:([^@]+)@(.+)$/.exec(e);return n&&t?{repo:n[1],ref:n[2],commit:t}:void 0},S=e=>y({id:e.slug,name:e.name,description:e.description,source:e.source,repo:e.repo,path:e.path,currentVersion:e.currentVersion,settings:e.settings,createdAt:g(e.createdAt),updatedAt:g(e.updatedAt)}),C=(e,t)=>y({agent:t,version:e.version,definition:e.definition,systemPrompt:e.systemPrompt,files:e.files,commit:e.commit,source:x(e.importedFrom,e.commit),importedFrom:e.importedFrom,createdAt:g(e.createdAt)}),w={id:r.id,agentId:r.agentId,version:r.version,definition:r.definition,commit:r.commit,importedFrom:r.importedFrom,createdAt:r.createdAt},T=(e,t)=>{let{systemPrompt:n,files:r,...i}=C({...e,systemPrompt:``,files:null},t);return i};function E(e){return y({task:y({id:e.publicId,source:e.source,agent:e.agent,flow:e.flow,runner:e.runner,permissions:e.permissions,event:e.event,prompt:e.prompt,args:e.args,mcp:e.mcp,author:e.author,definition:e.definition,credential:e.credential,requester:e.requester,runnerId:e.runnerId,usage:e.usage,tools:e.tools,toolScopes:e.toolScopes,context:e.context,files:e.files}),status:e.status,attempts:e.attempts,generation:e.generation,inboxSeq:e.inboxSeq,inboxAck:e.inboxAck<0?void 0:{generation:e.generation,seq:e.inboxAck},result:e.result,error:e.error,tokens:e.tokens,handle:e.handle,tokenHash:e.tokenHash,lastSeenAt:b(e.lastSeenAt),logCursor:e.logCursor??void 0,logSeq:e.logSeq??void 0,logBytes:e.logBytes??void 0,archivedAt:b(e.archivedAt),approval:e.approval,answer:Array.isArray(e.answer)?e.answer:void 0,createdAt:g(e.createdAt),startedAt:b(e.startedAt),finishedAt:b(e.finishedAt),cancelRequestedAt:b(e.cancelRequestedAt),updatedAt:g(e.updatedAt)})}async function D(e,t){let[n]=await e.db.select({id:m.id}).from(m).where(c(u(e.mine(m.organizationId),l(m.organizationId,``)),l(m.key,t)));if(!n)throw Error(`Unknown app "${t}".`);return n.id}async function O(e,t){let[n]=await e.db.select({id:s.id}).from(s).where(c(e.mine(s.organizationId),l(s.slug,t)));if(!n)throw Error(`Unknown agent "${t}".`);return n.id}async function k(e,t){let[n]=await e.db.select({id:h.id}).from(h).where(c(e.mine(h.organizationId),l(h.key,t)));if(!n)throw Error(`Unknown installation "${t}".`);return n.id}async function A(e,t){let[n]=await e.db.select({id:a.id}).from(a).where(c(e.mine(a.organizationId),l(a.publicId,t)));if(!n)throw Error(`Unknown task "${t}".`);return n.id}function j(e,n){if(n.startsWith(`plain.`))return{iv:`plain`,tag:``,ciphertext:n.slice(6),keyVersion:0};let[r,i,a]=n.split(`.`);if(!r||!i||!a)throw Error(`Invalid encrypted secret`);return{iv:r,tag:i,ciphertext:a,keyVersion:t(e.encryption,n)}}function M(e){return e.iv===`plain`?`plain.${e.ciphertext}`:`${e.iv}.${e.tag}.${e.ciphertext}`}async function N(e,t,r){let[i]=await e.db.insert(n).values({organizationId:e.organizationId,kind:t,...j(e,r)}).returning({id:n.id});return i.id}async function P(e,t,r){await e.db.update(n).set({...j(e,r),updatedAt:e.at()}).where(c(e.mine(n.organizationId),l(n.id,t)))}const F=(e,t)=>`o:${JSON.stringify([e,t])}:`,I=(e,t,n)=>F(e,t)+n;async function L(e,t){let n=await e.execute(t);return Array.isArray(n)?n:n.rows}export{T as C,w as S,p as _,m as a,E as b,y as c,k as d,g as f,d as g,P as h,S as i,v as l,L as m,N as n,D as o,M as p,O as r,_ as s,f as t,h as u,I as v,C as w,A as x,F as y};

package/dist/show-CMUg8SJu.js

@@ -0,0 +1 @@
+import{i as e,r as t}from"./cli-BilSDkvE.js";import{g as n,p as r}from"./output-BKeyLbvt.js";import{i,n as a,s as o,t as s}from"./args-BOEEdpWk.js";import{isLocal as c}from"./list-BYiG8Zav.js";import l from"node:path";import u from"node:process";const d={server:i,workspace:o,yes:a};function f(e,t){return c(e)?{id:e.id,name:e.name,source:e.builtin?`builtin`:`repo`,...e.dir&&!e.builtin?{dir:l.relative(t,e.dir)}:{},definition:e.definition,...e.usage?{usage:e.usage}:{}}:{id:e.id,name:e.name,source:e.source,definition:e.definition,...e.settings?{usage:e.settings}:{}}}function p(e){let t=r,{definition:i,usage:a}=e,o=`dir`in e?e.dir:void 0,s=[[`name`,e.name],[`source`,o?`${e.source} (${o})`:e.source],[`description`,i.description],[`permissions`,a?.permissions??i.permissions],[`engine`,a?.engine??i.engine],[`model`,a?.model??i.model],[`effort`,a?.effort??i.effort]],c=Math.max(...s.map(([e])=>e.length))+2;for(let[e,n]of s)n&&u.stdout.write(`${t.dim(e.padEnd(c))}${n}\n`);let l=Object.entries(i.integrations).map(([e,t])=>{let n=a?.integrations?.[e],r=Array.isArray(t.triggers)?t.triggers:Object.keys(t.triggers??{}),i=n?.allowedEvents?r.filter(e=>n.allowedEvents.includes(e)):r,o=n?.allowedTools??t.tools;return{id:e,events:i.join(`, `)||`-`,tools:Array.isArray(o)?o.join(`, `):o??`-`}});u.stdout.write(`\n${n([{header:`integration`,value:e=>e.id,paint:e=>t.cyan(e)},{header:`events`,value:e=>e.events},{header:`tools`,value:e=>e.tools}],l,{style:t,border:!0})}`)}const m=e({name:`agent show`,help:{usage:`coder agent show <id> [--server [url]] [--json] [--cwd <dir>]`,summary:`Describe one agent as it will run here, or its active version on a server: its settings and per-integration triggers and tools.`,flags:[t],examples:[[`coder agent show coder`,`what the built-in agent listens to and may do`]]},options:{...s,...d},args:1,run:async({options:e,args:[t],cwd:n})=>{let{agents:r}=await import(`./agent-BsYx3Odz.js`).then(e=>e.t);return r.show(t,{...e,cwd:n,organization:e.workspace})},json:(e,{cwd:t})=>f(e,t),print:(e,{cwd:t})=>p(f(e,t))});export{m as commandAgentShow};

package/dist/show-COTZEYgc.js

@@ -0,0 +1 @@
+import{i as e}from"./cli-BilSDkvE.js";import{g as t,p as n}from"./output-BKeyLbvt.js";import{n as r}from"./args-BOEEdpWk.js";import i from"node:process";function a(e){let r=n,a=[...Object.entries(e.events).map(([e,t])=>({kind:`event`,name:e,does:t})),...Object.entries(e.tools).map(([e,t])=>({kind:`tools`,name:e,does:t.join(`, `)}))];i.stdout.write(t([{header:`kind`,value:e=>e.kind,paint:e=>r.light(e)},{header:`name`,value:e=>e.name},{header:`does`,value:e=>e.does}],a,r))}const o=e({name:`agent integrations show`,globalFlags:{cwd:!1},help:{usage:`coder agent integrations show <id> [--json]`,summary:`Describe one integration: each event with what triggers it, and the tools each preset (observe, comment, write) allows.`,examples:[[`coder agent integrations show github`,`the GitHub integration in full`]]},options:{json:r},args:1,run:async({args:[e]})=>{let{agents:t}=await import(`./agent-BsYx3Odz.js`).then(e=>e.t);return t.integrations.show(e)},print:a});export{o as commandIntegrationsShow};

package/dist/status-D26U--p8.js

@@ -0,0 +1 @@
+import{i as e}from"./cli-BilSDkvE.js";import{g as t,p as n,s as r}from"./output-BKeyLbvt.js";import{n as i}from"./args-BOEEdpWk.js";import a from"node:process";const o=e({name:`auth status`,globalFlags:{cwd:!1},help:{usage:`coder auth status [--json]`,summary:`List saved sessions with their server, user, and workspace.`,env:[[`CODER_SERVER`,`the server to use instead of https://coder.wular.ai`]]},options:{json:i},run:async()=>{let{sessions:e}=await import(`./remote-miQNTVRa.js`).then(e=>e.c);return e.status()},print:e=>{let i=n,o=Object.entries(e);if(!o.length)return void a.stdout.write(`${i.dim(`Not signed in`)}\n\n${r([`Sign in: coder auth login`],i)}\n`);a.stdout.write(`${t([{header:`server`,value:([e])=>e,paint:e=>i.cyan(e)},{header:`user`,value:([,e])=>e.user.email},{header:`workspace`,value:([,e])=>e.organization?`${e.organization.name} (${e.organization.slug})`:`-`}],o,i)}\n`)}});export{o as commandStatus};

package/dist/steer-C6uARLp5.js

@@ -0,0 +1,4 @@
+import{xt as e}from"./dispatch-BKeAch9E.js";import{i as t,r as n}from"./cli-BilSDkvE.js";import{p as r,s as i}from"./output-BKeyLbvt.js";import{i as a,n as o,s,t as c}from"./args-BOEEdpWk.js";import l from"node:process";const u={server:a,workspace:s,yes:o};function d(t,n,r){let[i,...a]=t,o=a.join(` `).trim();if(!i||!o)throw new e(`invalid-option`,n,{hint:r});return{id:i,text:o}}function f(e,t=!1){let{taskId:n,steered:a}=e;if(a===`queued`){l.stdout.write(`${r.dim(`[coder]`)} follow-up queued for task ${r.cyan(n)}; it runs when the current turn finishes.\n`),t&&l.stdout.write(`\n${r.dim(`[coder] --wait is not available for a queued follow-up.`)}\n\n${i([`Wait for the answer: coder task result ${n} --wait`],r)}\n`);return}if(!t){l.stdout.write(a===`live`?`${r.dim(`[coder]`)} steered follow-up into running task ${r.cyan(n)}.\n`:`${r.dim(`[coder]`)} resumed task ${r.cyan(n)} with the follow-up (same thread, same id).\n`),l.stdout.write(`\n${i([`Wait for the answer: coder task result ${n} --wait`],r)}\n`);return}l.stdout.write(`\n${e.finalMessage||`(no final message)`}\n\n`),l.stderr.write(`${r.dim(`[coder] task=${n} status=${e.status??`unknown`}`)}\n`)}const p=t({name:`task steer`,help:{usage:`coder task steer <task-id> "<follow-up instructions>" [--wait] [--server [url]]`,summary:`Continue a task's thread with new instructions. They are injected into a live Codex or
+Claude turn at its next tool boundary and queued across a startup or completion race.
+A stopped task resumes on the same task id. It reuses the task's engine, model, and
+permissions unless overridden.`,flags:[[`--wait`,`run in the foreground and block until the answer is ready`],[`--model <alias|slug>`,`override the task's model for this follow-up`],[`--effort <low|medium|high>`,`override the task's reasoning effort`],[`--permissions <mode>`,`read-only · workspace-write · auto`],n],examples:[[`coder task steer task-abc "now add tests"`,`continue that task with a follow-up`]]},options:{...c,model:s,effort:s,permissions:s,background:o,wait:o,...u},args:1/0,async run({options:e,args:t}){let{tasks:n}=await import(`./task-C6VAg5WU.js`).then(e=>e.t),{id:r,text:i}=d(t,`Missing task id or follow-up text.`,[`Usage: coder task steer <task-id> "<follow-up>" [--wait]`,`Help: coder task steer --help`]);return n.steer(r,i,{...e,organization:e.workspace})},json(e,{options:t}){let n=e;return t.server!==void 0||!t.wait||n.steered===`queued`?e:{taskId:n.taskId,status:n.status??null,finalMessage:n.finalMessage??null}},print:(e,{options:t,args:[n]})=>t.server===void 0?f(e,t.wait):l.stdout.write(`Steered server task ${r.cyan(n)}.\n`),exit(e,{options:t}){let n=e;if(t.server===void 0&&t.wait&&n.steered!==`queued`)return n.status===`completed`?0:1}});export{p as commandSteer,d as idAndText};

package/dist/stop-BrGI3hSS.js

@@ -0,0 +1 @@
+import{i as e,r as t}from"./cli-BilSDkvE.js";import{p as n}from"./output-BKeyLbvt.js";import{i as r,n as i,s as a,t as o}from"./args-BOEEdpWk.js";import s from"node:process";const c={server:r,workspace:a,yes:i},l=e({name:`task stop`,help:{usage:`coder task stop <task-id> [--server [url]]`,summary:`Interrupt a running task and mark it cancelled.`,flags:[t]},options:{...o,...c},args:1,run:async({options:e,args:[t]})=>{let{tasks:n}=await import(`./task-C6VAg5WU.js`).then(e=>e.t);return n.stop(t,{...e,organization:e.workspace})},print:(e,{options:t,args:[r]})=>s.stdout.write(t.server===void 0?`Stopped task ${n.cyan(e.taskId)} ${n.dim(`(${e.interrupt})`)}\n`:`Stopped server task ${n.cyan(r)}.\n`)});export{l as commandStop};

package/dist/stop-ByCAlbmN.js

@@ -0,0 +1,3 @@
+import{i as e}from"./cli-BilSDkvE.js";import{m as t,p as n,s as r}from"./output-BKeyLbvt.js";import{n as i,t as a}from"./args-BOEEdpWk.js";import o from"node:process";const s=e({name:`flow stop`,help:{usage:`coder flow stop [run-id] [--keep-tasks] [--json]`,summary:`Stop a running flow: signal the orchestrator so it stops dispatching, stamp the
+run stopped, and stop its still-running tasks. Defaults to the most recent run;
+the journal stays ready for \`coder flow resume\`.`,flags:[[`--keep-tasks`,`leave the run's still-running tasks running`]]},options:{...a,"keep-tasks":i},args:1,run:async({options:e,args:[t]})=>{let{stopRun:n}=await import(`./executor-BvAA7Cgw.js`).then(e=>e.t);return n(t,{keepTasks:e[`keep-tasks`]})},print:c});function c(e){let i=n;e.status===`failed`?o.stdout.write(`${i.dim(`[flow]`)} Run ${i.cyan(e.runId)} orchestrator died. Marked ${t(`failed`)}.\n`):o.stdout.write(`${i.dim(`[flow]`)} run ${i.cyan(e.runId)} ${t(e.status)}.\n`),e.stoppedTasks.length&&o.stdout.write(`${i.dim(`[flow]`)} stopped tasks: ${e.stoppedTasks.join(`, `)}\n`),e.keptTasks.length&&o.stdout.write(`${i.dim(`[flow]`)} left running: ${e.keptTasks.join(`, `)}\n`),o.stdout.write(`\n${r([`Resume: coder flow resume ${e.runId}`],i)}\n`)}export{s as commandStop};

package/dist/store-B94tSate.js

@@ -0,0 +1,42 @@
+import{at as e,lt as t,nt as n,tt as r}from"./store-DzqXS2wT.js";import{a as i,d as a,g as o,h as s,i as c,l,m as u,n as d,p as f,r as p,t as m}from"./schema-CU2iFkp8.js";import{i as h}from"./client-D9IoAuDD.js";import{C as g,S as _,_ as v,a as y,b as ee,c as b,d as x,f as S,h as C,i as w,l as T,n as E,o as D,p as O,r as k,s as A,u as j,v as M,w as N,x as P,y as te}from"./shared-DVtzWhUT.js";import{i as ne,t as re}from"./usage-BhqoCjvE.js";import{isDeepStrictEqual as F}from"node:util";import{and as I,asc as L,desc as ie,eq as R,gt as z,gte as B,ilike as V,inArray as H,isNull as U,lt as W,lte as G,or as K,sql as q}from"drizzle-orm";import{alias as J}from"drizzle-orm/pg-core";function ae(e,t,n){return e.db.transaction(async r=>{let[i]=await r.insert(m).values({organizationId:e.organizationId,slug:t.id,name:t.name,description:t.description??null,source:t.source,repo:t.repo??null,path:t.path??null,currentVersion:0,createdAt:A(t.createdAt),updatedAt:A(t.updatedAt)}).onConflictDoUpdate({target:[m.organizationId,m.slug],set:{slug:t.id}}).returning(),a=w(i),[o]=a.currentVersion?await r.select().from(d).where(I(R(d.agentId,i.id),R(d.version,a.currentVersion))):[],s=o&&N(o,t.id),c=!!(s&&F(s.definition,n.definition)&&s.systemPrompt===n.systemPrompt&&F(s.files,n.files)),l=c?s:{...n,version:a.currentVersion+1},u={...t,currentVersion:l.version,createdAt:a.createdAt,...a.settings?{settings:a.settings}:{},updatedAt:a.updatedAt};if(c&&F(u,a))return{record:a,version:l,unchanged:c};u={...u,updatedAt:t.updatedAt};let f=c?q``:q`with published as (
+      insert into ${d} (agent_id, version, definition, system_prompt, files, commit, imported_from, created_at)
+      values (${i.id}, ${l.version}, ${JSON.stringify(l.definition)}::jsonb, ${l.systemPrompt},
+        ${l.files?JSON.stringify(l.files):null}::jsonb, ${l.commit??null}, ${l.importedFrom}, ${A(l.createdAt).toISOString()}::timestamptz)
+      returning version
+    )`;return await r.execute(q`${f} update ${m} set
+      name = ${u.name}, description = ${u.description??null}, source = ${u.source},
+      repo = ${u.repo??null}, path = ${u.path??null},
+      current_version = ${c?q`${l.version}`:q`(select version from published)`}, updated_at = ${A(u.updatedAt).toISOString()}::timestamptz
+      where id = ${i.id}`),{record:u,version:l,unchanged:c}})}function oe(e){let t=m;return{key:t.slug,rows:async(n,r)=>{let i=e.db.select().from(t).where(I(e.mine(t.organizationId),n)).orderBy(L(t.slug));return(await(r===void 0?i:i.limit(r))).map(e=>({id:e.slug,value:w(e)}))},put:async(n,r)=>{let i={name:r.name,description:r.description??null,source:r.source,repo:r.repo??null,path:r.path??null,currentVersion:r.currentVersion,settings:r.settings??null,createdAt:A(r.createdAt),updatedAt:A(r.updatedAt)};await e.db.insert(t).values({organizationId:e.organizationId,slug:n,...i}).onConflictDoUpdate({target:[t.organizationId,t.slug],set:i})},delete:async n=>{await e.db.delete(t).where(I(e.mine(t.organizationId),R(t.slug,n)))}}}async function Y(e,t,n){let r=t.lastIndexOf(`:`);return(await e.db.insert(d).values({agentId:await k(e,t.slice(0,r)),version:Number(t.slice(r+1)),definition:n.definition,systemPrompt:n.systemPrompt,files:n.files??null,commit:n.commit??null,importedFrom:n.importedFrom,createdAt:A(n.createdAt)}).onConflictDoNothing().returning({id:d.id})).length>0}function se(e){let t=d,n=q`${m.slug} || ':' || lpad(${t.version}::text, 6, '0')`;return{key:n,split:(e,n,r)=>I(R(m.slug,e),n===void 0?void 0:r?R(t.version,n):z(t.version,n)),rows:async(r,i)=>{let a=e.db.select({row:t,slug:m.slug,key:n}).from(t).innerJoin(m,R(m.id,t.agentId)).where(I(e.mine(m.organizationId),r)).orderBy(L(m.slug),L(t.version));return(await(i===void 0?a:a.limit(i))).map(({row:e,slug:t,key:n})=>({id:n,value:N(e,t)}))},put:async(t,n)=>{await Y(e,t,n)},delete:async n=>{let r=n.lastIndexOf(`:`),i=await k(e,n.slice(0,r)).catch(()=>void 0);i!==void 0&&await e.db.delete(t).where(I(R(t.agentId,i),R(t.version,Number(n.slice(r+1)))))}}}const X=(e,t)=>b({id:e.key,integration:e.integration,agent:e.agent,name:e.name,agentsRepo:e.agentsRepo,branch:e.branch,builtin:e.organizationId===``||void 0,credentials:O(t),createdAt:S(e.createdAt)});function ce(e){let t=y;return{key:t.key,rows:async(n,r)=>{let i=e.db.select({row:t,sealed:a}).from(t).innerJoin(a,R(a.id,t.credentialsSecretId)).where(I(e.mine(t.organizationId),n)).orderBy(L(t.key));return(await(r===void 0?i:i.limit(r))).map(({row:e,sealed:t})=>({id:e.key,value:X(e,t)}))},put:(n,r)=>e.transaction(`app:${n}`,async e=>{let[i]=await e.db.select({secretId:t.credentialsSecretId,sealed:a}).from(t).innerJoin(a,R(a.id,t.credentialsSecretId)).where(I(e.mine(t.organizationId),R(t.key,n))),o=i?.secretId??await E(e,`app`,r.credentials);i&&O(i.sealed)!==r.credentials&&await C(e,o,r.credentials);let s={integration:r.integration,platformAppId:n.slice(n.indexOf(`:`)+1),agent:r.agent,name:r.name,agentsRepo:r.agentsRepo??null,branch:r.branch??null,credentialsSecretId:o,createdAt:A(r.createdAt),updatedAt:e.at()};await e.db.insert(t).values({organizationId:e.organizationId,key:n,...s}).onConflictDoUpdate({target:[t.organizationId,t.key],set:s})}),delete:n=>e.transaction(`app:${n}`,async e=>{let[r]=await e.db.delete(t).where(I(e.mine(t.organizationId),R(t.key,n))).returning({secretId:t.credentialsSecretId});r&&await e.db.delete(a).where(R(a.id,r.secretId))})}}function Z(e,t,n){return b({id:e.key,app:t.key,integration:t.integration,account:e.account,token:n?O(n):void 0,installer:e.installer,connections:e.connections,settings:e.settings,createdAt:S(e.createdAt),deletedAt:e.deletedAt?S(e.deletedAt):void 0})}function le(e){let t=j;return{key:t.key,rows:async(n,r)=>{let i=e.db.select({row:t,app:{key:y.key,integration:y.integration},sealed:a}).from(t).innerJoin(y,R(y.id,t.appId)).leftJoin(a,R(a.id,t.tokenSecretId)).where(I(e.mine(t.organizationId),n)).orderBy(L(t.key));return(await(r===void 0?i:i.limit(r))).map(({row:e,app:t,sealed:n})=>({id:e.key,value:Z(e,t,n)}))},put:(n,r)=>e.transaction(`installation:${n}`,async e=>{let[i]=await e.db.select({secretId:t.tokenSecretId,organizationId:t.organizationId,sealed:a}).from(t).leftJoin(a,R(a.id,t.tokenSecretId)).where(R(t.key,n)),o=()=>Error(`Installation "${n}" belongs to another workspace.`);if(i&&i.organizationId!==e.organizationId)throw o();let s=i?.secretId??null;r.token&&(s?(!i?.sealed||O(i.sealed)!==r.token)&&await C(e,s,r.token):s=await E(e,`installation`,r.token));let c={appId:await D(e,r.app),platformInstallId:n.slice(r.app.length+1),account:r.account,tokenSecretId:r.token?s:null,installer:r.installer??null,connections:r.connections??null,settings:r.settings??null,createdAt:A(r.createdAt),updatedAt:e.at(),deletedAt:r.deletedAt===void 0?null:A(r.deletedAt)},[l]=await e.db.insert(t).values({organizationId:e.organizationId,key:n,...c}).onConflictDoUpdate({target:t.key,set:c,setWhere:e.mine(t.organizationId)}).returning({id:t.id});if(!l)throw o();!r.token&&i?.secretId&&await e.db.delete(a).where(R(a.id,i.secretId))}),delete:n=>e.transaction(`installation:${n}`,async e=>{let[r]=await e.db.delete(t).where(I(e.mine(t.organizationId),R(t.key,n))).returning({secretId:t.tokenSecretId});r?.secretId&&await e.db.delete(a).where(R(a.id,r.secretId))})}}async function ue(e,t){let n=J(j,`locked`),[r]=await e.db.select({row:n,app:{key:y.key,integration:y.integration},sealed:a}).from(n).innerJoin(y,R(y.id,n.appId)).leftJoin(a,R(a.id,n.tokenSecretId)).where(I(e.mine(n.organizationId),R(n.key,t))).for(`update`,{of:n});return r&&Z(r.row,r.app,r.sealed)}const Q=(e,t)=>b({iv:t.iv,tag:t.tag,ciphertext:t.ciphertext,engine:e.engine,owner:e.owner,account:e.account,isDefault:e.isDefault,createdAt:S(e.createdAt)}),de=(e,t)=>`credential:${JSON.stringify([e.organizationId,t??null])}`;async function fe(t,n){let r=i;return(await t.db.select({row:r,sealed:a}).from(r).innerJoin(a,R(a.id,r.secretId)).where(I(t.mine(r.organizationId),n?R(r.owner,n):U(r.owner))).orderBy(L(r.label)).for(`update`)).map(({row:t,sealed:n})=>({id:e(t.owner??void 0,t.label),value:Q(t,n),row:t,sealed:n}))}async function pe(e,n,r,o){let s=i;if(!o){if(!n)return;await e.db.delete(s).where(R(s.id,n.row.id)),await e.db.delete(a).where(R(a.id,n.row.secretId));return}let c=O(o),l={engine:o.engine,isDefault:o.isDefault??!1,account:o.account??null,createdAt:o.createdAt===void 0?n?.row.createdAt??e.at():A(o.createdAt),updatedAt:e.at()};if(n){O(n.sealed)!==c&&await C(e,n.row.secretId,c),await e.db.update(s).set(l).where(R(s.id,n.row.id));return}let{owner:u,label:d}=t(r);await e.db.insert(s).values({organizationId:e.organizationId,owner:u??null,label:d,secretId:await E(e,`engine`,c),...l})}function me(n){let r=i,o=(e,r)=>{let{owner:i}=t(e);return n.transaction(de(n,i),async t=>pe(t,(await fe(t,i)).find(t=>t.id===e),e,r))};return{key:q`coalesce(${r.owner} || '/', '') || ${r.label}`,rows:async(t,i)=>{let o=n.db.select({row:r,sealed:a}).from(r).innerJoin(a,R(a.id,r.secretId)).where(I(n.mine(r.organizationId),t)).orderBy(L(r.owner),L(r.label));return(await(i===void 0?o:o.limit(i))).map(({row:t,sealed:n})=>({id:e(t.owner??void 0,t.label),value:Q(t,n)}))},put:(e,t)=>o(e,t),delete:e=>o(e,null)}}function $(e,t){let n=c,r=te(e.organizationId,t),i=n.key;return{key:i,where:e=>I(e.id===void 0?q`${n.key} like ${`${T(r+(e.prefix??``))}%`}`:R(n.key,r+e.id),e.after===void 0?void 0:z(n.key,r+e.after)),rows:async(t,a)=>{let o=e.db.select({id:i,value:q`${n.value}`}).from(n).where(I(q`${n.key} like ${`${T(r)}%`}`,e.live(n.expiresAt),t)).orderBy(L(n.key));return(await(a===void 0?o:o.limit(a))).map(e=>({id:e.id.slice(r.length),value:e.value}))},put:async(i,a,o)=>{let s=t===`login`?o??e.at():o;await e.db.insert(n).values({key:r+(t===`config`?`workspace`:i),value:a,expiresAt:t===`config`?null:s}).onConflictDoUpdate({target:n.key,set:{value:a,expiresAt:t===`config`?null:t===`login`&&!o?q`${n.expiresAt}`:s}})},delete:async i=>{await e.db.delete(n).where(R(n.key,r+(t===`config`?`workspace`:i)))}}}function he(e){let t=l,n=n=>I(e.mine(t.organizationId),R(t.publicId,n));return{key:t.publicId,rows:async(n,r)=>{let i=e.db.select({row:t,sealed:a}).from(t).innerJoin(a,R(a.id,t.secretId)).where(I(e.mine(t.organizationId),n)).orderBy(L(t.publicId));return(await(r===void 0?i:i.limit(r))).map(({row:e,sealed:t})=>({id:e.publicId,value:b({name:e.name,owner:e.owner,kind:e.kind,scope:e.scope,config:e.config,createdBy:e.createdBy,default:e.isDefault,lastSeen:e.lastSeen?S(e.lastSeen):void 0,secret:O(t),createdAt:S(e.createdAt),updatedAt:S(e.updatedAt)})}))},put:(r,i)=>e.transaction(`runner:${e.organizationId}:${r}`,async e=>{let[o]=await e.db.select({id:t.id,secretId:t.secretId,sealed:a}).from(t).innerJoin(a,R(a.id,t.secretId)).where(n(r)),s={owner:i.owner??null,name:i.name,kind:i.kind,scope:i.scope,config:i.config,createdBy:i.createdBy??null,isDefault:i.default,lastSeen:i.lastSeen===void 0?null:A(i.lastSeen),updatedAt:A(i.updatedAt)};if(o){O(o.sealed)!==i.secret&&await C(e,o.secretId,i.secret),await e.db.update(t).set(s).where(R(t.id,o.id));return}await e.db.insert(t).values({organizationId:e.organizationId,publicId:r,secretId:await E(e,`runner`,i.secret),createdAt:A(i.createdAt),...s})}),delete:r=>e.transaction(`runner:${e.organizationId}:${r}`,async e=>{let[i]=await e.db.delete(t).where(n(r)).returning({secretId:t.secretId});i&&await e.db.delete(a).where(R(a.id,i.secretId))})}}function ge(e){let t=f;return{key:t.publicId,rows:async(n,r)=>{let i=e.db.select().from(t).where(I(e.mine(t.organizationId),n)).orderBy(L(t.publicId));return(await(r===void 0?i:i.limit(r))).map(e=>({id:e.publicId,value:ee(e)}))},put:async(n,r)=>{let{task:i}=r,a={source:i.source,status:r.status,agent:i.agent,flow:i.flow,runner:i.runner,permissions:i.permissions??null,appId:i.event?await D(e,i.event.appId):null,installationId:i.event?await x(e,`${i.event.appId}:${i.event.installationId}`):null,event:i.event??null,prompt:i.prompt??null,args:i.args??null,mcp:i.mcp??null,author:i.author??null,definition:i.definition,credential:i.credential??null,requester:i.requester??null,runnerId:i.runnerId??null,usage:i.usage??null,tools:i.tools,toolScopes:i.toolScopes??null,context:i.context??null,files:i.files??null,result:r.result??null,error:r.error??null,tokens:r.tokens??null,handle:r.handle??null,tokenHash:r.tokenHash??null,lastSeenAt:r.lastSeenAt===void 0?null:A(r.lastSeenAt),logCursor:r.logCursor??null,logSeq:r.logSeq??null,logBytes:r.logBytes??null,archivedAt:r.archivedAt===void 0?null:A(r.archivedAt),approval:r.approval??null,answer:r.answer??null,attempts:r.attempts,generation:r.generation??0,inboxSeq:r.inboxSeq??-1,inboxAck:r.inboxAck?.generation===(r.generation??0)?r.inboxAck.seq:-1,createdAt:A(r.createdAt),startedAt:r.startedAt===void 0?null:A(r.startedAt),finishedAt:r.finishedAt===void 0?null:A(r.finishedAt),cancelRequestedAt:r.cancelRequestedAt===void 0?null:A(r.cancelRequestedAt),updatedAt:A(r.updatedAt)};await e.db.insert(t).values({organizationId:e.organizationId,publicId:n,...a}).onConflictDoUpdate({target:[t.organizationId,t.publicId],set:{...a,archivedAt:q`coalesce(${t.archivedAt}, ${a.archivedAt})`}})},delete:async n=>{await e.db.delete(t).where(I(e.mine(t.organizationId),R(t.publicId,n)))}}}function _e(e){let t=s,n=q`${f.publicId} || ':' || lpad(${t.seq}::text, 6, '0')`;return{key:n,split:(n,r,i)=>I(e.mine(f.organizationId),R(f.publicId,n),r===void 0?void 0:i?R(t.seq,r):z(t.seq,r)),rows:async(r,i)=>{let a=e.db.select({row:t,key:n}).from(t).innerJoin(f,R(f.id,t.taskId)).where(I(e.mine(t.organizationId),r)).orderBy(L(f.publicId),L(t.seq));return(await(i===void 0?a:a.limit(i))).map(({row:e,key:t})=>({id:t,value:{at:S(e.at),level:e.level,line:e.line}}))},put:async(n,r)=>{let i=n.lastIndexOf(`:`),a={at:A(r.at),level:r.level,line:r.line};await e.db.insert(t).values({organizationId:e.organizationId,taskId:await P(e,n.slice(0,i)),seq:Number(n.slice(i+1)),...a}).onConflictDoUpdate({target:[t.taskId,t.seq],set:a})},delete:async n=>{let r=n.lastIndexOf(`:`),i=await P(e,n.slice(0,r)).catch(()=>void 0);i!==void 0&&await e.db.delete(t).where(I(R(t.taskId,i),R(t.seq,Number(n.slice(r+1)))))}}}function ve(e){let t=u,n=q`${f.publicId} || ':' || lpad(${t.seq}::text, 8, '0')`;return{key:n,split:(n,r,i)=>I(e.mine(f.organizationId),R(f.publicId,n),r===void 0?void 0:i?R(t.seq,r):z(t.seq,r)),rows:async(r,i)=>{let a=e.db.select({row:t,key:n}).from(t).innerJoin(f,R(f.id,t.taskId)).where(I(e.mine(t.organizationId),r)).orderBy(L(f.publicId),L(t.seq));return(await(i===void 0?a:a.limit(i))).map(({row:e,key:t})=>({id:t,value:{seq:e.seq,generation:e.generation,at:S(e.at),kind:e.kind,value:e.value}}))},put:async(n,r)=>{let i=n.lastIndexOf(`:`);await e.db.insert(t).values({organizationId:e.organizationId,taskId:await P(e,n.slice(0,i)),seq:r.seq,generation:r.generation,kind:r.kind,value:r.value,at:A(r.at)})},delete:async n=>{let r=n.lastIndexOf(`:`),i=await P(e,n.slice(0,r)).catch(()=>void 0);i!==void 0&&await e.db.delete(t).where(I(R(t.taskId,i),R(t.seq,Number(n.slice(r+1)))))}}}function ye(e){let t=o;return{key:f.publicId,rows:async(n,r)=>{let i=e.db.select({row:t,taskId:f.publicId,installationId:j.key}).from(t).innerJoin(f,R(f.id,t.taskId)).leftJoin(j,R(j.id,t.installationId)).where(I(e.mine(t.organizationId),n)).orderBy(L(f.publicId));return(await(r===void 0?i:i.limit(r))).map(({row:e,taskId:t,installationId:n})=>({id:t,value:b({installationId:n,taskId:t,agent:e.agent,target:e.target,engine:e.engine,model:e.model,credential:e.credential,runnerElapsedMs:e.runnerMs,tokens:e.tokens,at:S(e.at)})}))},put:async(n,r)=>{let i=await P(e,n),a={installationId:r.installationId?await x(e,r.installationId):null,agent:r.agent,target:r.target,engine:r.engine??null,model:r.model??null,credential:r.credential,runnerMs:r.runnerElapsedMs,tokens:r.tokens??null,at:A(r.at),updatedAt:e.at()};await e.db.insert(t).values({organizationId:e.organizationId,taskId:i,...a}).onConflictDoUpdate({target:t.taskId,set:a})},delete:async n=>{let r=await P(e,n).catch(()=>void 0);r!==void 0&&await e.db.delete(t).where(R(t.taskId,r))}}}var be=class u{db;organizationId;now;encryption;publishAgent=(e,t)=>ae(this,e,t);kinds;constructor(e,t,n=Date.now,r={}){this.db=e,this.organizationId=t,this.now=n,this.encryption=r,this.kinds={agent:oe(this),agentversion:se(this),app:ce(this),installation:le(this),credential:me(this),task:ge(this),tasklog:_e(this),inbox:ve(this),usage:ye(this),delivery:$(this,`delivery`),note:$(this,`note`),login:$(this,`login`),config:$(this,`config`),runner:he(this),snapshot:$(this,`snapshot`)}}static async webhookTarget(e,t,n){let r=J(a,`installation_secret`),[i]=await h(e,()=>e.select({app:y,credentials:a,installation:j,token:r}).from(y).innerJoin(a,R(a.id,y.credentialsSecretId)).leftJoin(j,I(R(j.appId,y.id),R(j.key,n??``),U(j.deletedAt))).leftJoin(r,R(r.id,j.tokenSecretId)).where(I(R(y.integration,t.slice(0,t.indexOf(`:`))),R(y.platformAppId,t.slice(t.indexOf(`:`)+1)))));return i&&{organizationId:i.app.organizationId,app:X(i.app,i.credentials),...i.installation?{bound:{organizationId:i.installation.organizationId,installation:Z(i.installation,i.app,i.token)}}:{}}}static async appRecord(e,t){let[n]=await h(e,()=>e.select({row:y,sealed:a}).from(y).innerJoin(a,R(a.id,y.credentialsSecretId)).where(I(R(y.integration,t.slice(0,t.indexOf(`:`))),R(y.platformAppId,t.slice(t.indexOf(`:`)+1)))));return n&&{organizationId:n.row.organizationId,app:X(n.row,n.sealed)}}static async installationOrganization(e,t){let[n]=await h(e,()=>e.select({organizationId:j.organizationId}).from(j).where(R(j.key,t)));return n?.organizationId}static async installations(e,t){return h(e,()=>e.select({key:j.key,organizationId:j.organizationId}).from(j).where(I(q`${j.key} like ${`${T(t)}:%`}`,U(j.deletedAt))))}static async taskOrganization(e,t,n){let[r]=await h(e,()=>e.select({organizationId:f.organizationId}).from(f).where(I(R(f.publicId,t),R(f.tokenHash,n))));return r?.organizationId}async getApps(e){return e.length?(await h(this.db,()=>this.db.select({row:y,sealed:a}).from(y).innerJoin(a,R(a.id,y.credentialsSecretId)).where(I(H(y.organizationId,[this.organizationId,``]),H(y.key,e))))).map(e=>({id:e.row.key,value:X(e.row,e.sealed)})):[]}async listCredentials(t){let n=i;return(await h(this.db,()=>this.db.select({row:n,sealed:a}).from(n).innerJoin(a,R(a.id,n.secretId)).where(I(this.mine(n.organizationId),t.owner?K(U(n.owner),R(n.owner,t.owner)):U(n.owner),t.engine?R(n.engine,t.engine):void 0)).orderBy(L(n.owner),L(n.label)))).map(({row:t,sealed:n})=>({id:e(t.owner??void 0,t.label),value:Q(t,n)}))}async updateMetadata(e,t,n){let r=e===`app`?y:e===`installation`?j:l,i=e===`app`?[`name`,`agentsRepo`,`branch`]:e===`installation`?[`account`,`connections`,`settings`,`deletedAt`]:[`name`,`config`,`lastSeen`,`updatedAt`];if(Object.keys(n).some(e=>!i.includes(e)))throw Error(`Invalid metadata fields`);let a=Object.fromEntries(Object.entries(n).map(([e,t])=>[e,t===void 0?null:[`deletedAt`,`updatedAt`,`lastSeen`].includes(e)?A(t):t])),o=e===`runner`?l.publicId:e===`app`?y.key:j.key,[s]=await this.db.update(r).set({...a,updatedAt:typeof n.updatedAt==`number`?A(n.updatedAt):this.at()}).where(I(this.mine(r.organizationId),R(o,t))).returning({id:r.id});return!!s}withAppLock(e,t){return this.transaction(`app:${e}`,t)}withConfigLock(e){return this.db.transaction(async t=>{let n=M(this.organizationId,`config`,`workspace`);return await t.insert(c).values({key:n,value:{},expiresAt:null}).onConflictDoNothing(),await t.select({key:c.key}).from(c).where(R(c.key,n)).for(`update`),e(new u(t,this.organizationId,this.now,this.encryption))})}transaction(e,t){return this.db.transaction(async n=>(await n.execute(q`select pg_advisory_xact_lock(3, hashtext(${e}))`),t(new u(n,this.organizationId,this.now,this.encryption))))}withCredential(e,n,i){if(e===`runner`)return this.withAppLock(`runners:${this.organizationId}`,e=>r(e,`runner`,n,i));if(e===`installation`)return this.transaction(`installation:${n}`,async e=>{let t=await ue(e,n),r=await i(t,t?[{id:n,value:t}]:[],e);for(let t of r??[])t.value===null?await e.delete(`installation`,t.id):await e.put(`installation`,t.id,t.value);return!!r?.length});let{owner:a}=t(n);return this.transaction(de(this,a),async e=>{let t=await fe(e,a),r=t.map(({id:e,value:t})=>({id:e,value:t})),o=await i(r.find(e=>e.id===n)?.value,r,e);for(let n of o??[])await pe(e,t.find(e=>e.id===n.id),n.id,n.value);return!!o?.length})}at(){return A(this.now())}live(e){return K(U(e),z(e,this.at()))}mine(e){return R(e,this.organizationId)}async get(e,t){let n=this.kinds[e],r=v(t),i=n.where?n.where({id:t}):n.split&&r?n.split(r[0],r[1],!0):q`${n.key} = ${t}`,a=(await h(this.db,async()=>await n.rows(i,1)))[0]?.value;return a||e!==`app`||this.organizationId===``?a:new u(this.db,``,this.now,this.encryption).get(e,t)}async patchLogin(e,t,n={}){let[r]=await this.db.update(c).set({value:q`jsonb_strip_nulls(${c.value} || ${JSON.stringify(t)}::jsonb)`}).where(I(R(c.key,M(this.organizationId,`login`,e)),this.live(c.expiresAt),q`(${c.value}->>'expiresAt')::bigint > ${this.now()}`,...Object.entries(n).map(([e,t])=>Array.isArray(t)?H(q`${c.value}->>${e}`,t):q`${c.value}->>${e} = ${t}`))).returning({value:q`${c.value}`});return r?.value}completeLogin(e,t,r,i){return n(this,e,t,r,i)}async taskInputs(t,n,r){let a=q`coalesce(${r??null}, ${m.settings}->>'engine', ${d.definition}->>'engine')`,o=this.db.select({owner:i.owner,label:i.label}).from(i).where(I(this.mine(i.organizationId),n?K(U(i.owner),R(i.owner,n)):U(i.owner),q`(${a} is null or ${i.engine} = ${a})`)).orderBy(q`${i.owner} is not null desc`,ie(i.isDefault),L(i.label)).limit(1).as(`selected_credential`),[s]=await h(this.db,()=>this.db.select({record:m,version:d,credentialLabel:o.label,credentialOwner:o.owner}).from(m).leftJoin(d,I(R(d.agentId,m.id),R(d.version,m.currentVersion))).leftJoinLateral(o,q`true`).where(I(this.mine(m.organizationId),R(m.slug,t))));return s?{record:w(s.record),...s.version?{version:N(s.version,s.record.slug)}:{},...s.credentialLabel?{credential:e(s.credentialOwner??void 0,s.credentialLabel)}:{}}:{}}async listAgentsWithVersions(e){return(await h(this.db,()=>this.db.select({record:m,version:d}).from(m).leftJoin(d,I(R(d.agentId,m.id),R(d.version,m.currentVersion))).where(I(this.mine(m.organizationId),e===void 0?void 0:R(m.slug,e))).orderBy(L(m.slug)))).map(({record:e,version:t})=>({record:w(e),...t?{version:N(t,e.slug)}:{}}))}async listAgentSummaries(e={}){let t=e.q?`%${T(e.q)}%`:void 0,n=this.db.select({record:m,version:_}).from(m).leftJoin(d,I(R(d.agentId,m.id),R(d.version,m.currentVersion))).where(I(this.mine(m.organizationId),e.slug===void 0?void 0:R(m.slug,e.slug),e.after?z(m.slug,e.after):void 0,e.source?R(m.source,e.source):void 0,t?K(V(m.slug,t),V(m.name,t),V(m.description,t),V(m.repo,t)):void 0,e.platform?q`${d.definition}->'integrations' ? ${e.platform}`:void 0)).orderBy(L(m.slug));return(await h(this.db,()=>e.limit===void 0?n:n.limit(e.limit))).map(({record:e,version:t})=>({record:w(e),...t?{version:g(t,e.slug)}:{}}))}async listVersions(e,t,n){let r=this.db.select({version:_}).from(d).innerJoin(m,R(m.id,d.agentId)).where(I(this.mine(m.organizationId),R(m.slug,e),n===void 0?t===void 0?void 0:G(d.version,m.currentVersion):W(d.version,n),t===void 0?void 0:B(d.version,n===void 0?q`${m.currentVersion} + 1 - ${t}`:n-t))).orderBy(L(d.version));return(await h(this.db,()=>r)).map(({version:t})=>({id:`${e}:${String(t.version).padStart(6,`0`)}`,value:g(t,e)}))}async put(e,t,n,r={}){let i=r.ttlMs===void 0?null:A(this.now()+r.ttlMs);await this.kinds[e].put(t,n,i)}async putMany(e,t){if(!t.length)return;if(e!==`tasklog`){await Promise.all(t.map(t=>this.put(e,t.id,t.value)));return}let n=t[0].id.lastIndexOf(`:`),r=t[0].id.slice(0,n),i=t.map(e=>{let t=e.id.lastIndexOf(`:`),n=e.value;if(e.id.slice(0,t)!==r)throw Error(`A log batch must belong to one task`);return{organizationId:this.organizationId,taskId:q`(select ${f.id} from ${f} where ${f.organizationId} = ${this.organizationId} and ${f.publicId} = ${r})`,seq:Number(e.id.slice(t+1)),at:A(n.at),level:n.level,line:n.line}});await this.db.insert(s).values(i).onConflictDoUpdate({target:[s.taskId,s.seq],set:{at:q`excluded.at`,level:q`excluded.level`,line:q`excluded.line`}})}async list(e,t={}){let n=this.kinds[e];if(n.where)return h(this.db,async()=>await n.rows(n.where(t),t.limit));let r=t.prefix?.endsWith(`:`)?t.prefix.slice(0,-1):void 0,i=t.after===void 0?void 0:v(t.after);if(n.split&&r&&!r.includes(`:`)&&(t.after===void 0||i?.[0]===r))return h(this.db,async()=>await n.rows(n.split(r,i?.[1]),t.limit));let a=t.prefix?q`${n.key} like ${`${T(t.prefix)}%`}`:void 0,o=t.after?q`${n.key} > ${t.after}`:void 0,s=a&&o?I(a,o):a??o;return h(this.db,async()=>await n.rows(s,t.limit))}async delete(e,t){await this.kinds[e].delete(t)}async create(e,t,n,r={}){if(e===`agentversion`)return Y(this,t,n);if(e!==`delivery`)throw Error(`Atomic create is not supported for ${e}`);let i=r.ttlMs===void 0?null:A(this.now()+r.ttlMs);return(await this.db.insert(c).values({key:M(this.organizationId,e,t),value:n,expiresAt:i}).onConflictDoUpdate({target:c.key,set:{value:n,expiresAt:i},setWhere:G(c.expiresAt,this.at())}).returning({key:c.key})).length>0}async claimDeliveryLease(e,t,n){let r=q`clock_timestamp() + ${n}::int * interval '1 millisecond'`,[i]=await this.db.insert(c).values({key:M(this.organizationId,`delivery`,e),value:{owner:t,failures:0},expiresAt:r}).onConflictDoUpdate({target:c.key,set:{value:q`${c.value} || ${JSON.stringify({owner:t})}::jsonb`,expiresAt:r},setWhere:q`${c.expiresAt} <= clock_timestamp()`}).returning({value:c.value});return i?i.value.failures:void 0}async updateDeliveryLease(e,t,n,r={ttlMs:3e4}){let i=I(R(c.key,M(this.organizationId,`delivery`,e)),q`${c.value}->>'owner' = ${t} and ${c.expiresAt} > clock_timestamp()`),a=q`clock_timestamp() + ${r.ttlMs}::int * interval '1 millisecond'`;return(n===void 0?await this.db.delete(c).where(i).returning({key:c.key}):await this.db.update(c).set({value:n.next===void 0?n:q`${JSON.stringify(n)}::jsonb || jsonb_build_object('next', floor(extract(epoch from (${a})) * 1000))`,expiresAt:a}).where(i).returning({key:c.key})).length>0}async updateDelivery(e,t,n,r={}){let i=I(R(c.key,M(this.organizationId,`delivery`,e)),q`${c.value}->>'owner' = ${t}`,this.live(c.expiresAt));return(n===void 0?await this.db.delete(c).where(i).returning({key:c.key}):await this.db.update(c).set({value:n,expiresAt:r.ttlMs===void 0?null:A(this.now()+r.ttlMs)}).where(i).returning({key:c.key})).length>0}async take(e,t){return e===`delivery`?(await this.db.delete(c).where(I(R(c.key,M(this.organizationId,e,t)),this.live(c.expiresAt))).returning({key:c.key})).length>0:await this.get(e,t)!==void 0&&(await this.delete(e,t),!0)}async usageTotals(e){let t=o,n=e.by===`agent`?q`${t.agent}`:e.by===`engine`?q`coalesce(${t.engine}, 'unknown')`:e.by===`installation`?q`coalesce(${j.key}, 'none')`:q`to_char(${t.at} at time zone ${ne(e.tz)}, 'YYYY-MM-DD')`,r=I(this.mine(t.organizationId),B(t.at,A(e.since)),e.until===void 0?void 0:W(t.at,A(e.until)),e.agent?R(t.agent,e.agent):void 0),i=q`coalesce(
+      case when jsonb_typeof(${t.tokens} -> 'total') = 'number' then (${t.tokens} ->> 'total')::numeric end,
+      (select sum((v #>> '{}')::numeric)
+        from jsonb_path_query(coalesce(${t.tokens}, 'null'::jsonb), 'strict $.**') v
+        where jsonb_typeof(v) = 'number')
+    )`,a={tasks:q`count(*)`,runnerMs:q`coalesce(sum(${t.runnerMs}), 0)`,tokenCount:q`coalesce(sum(${i}), 0)`},s=e.top?q`case when ${t.agent} in (
+          select ${t.agent} from ${t} where ${r} group by ${t.agent}
+          order by ${a[e.top.by]} desc, ${t.agent} limit ${e.top.count}
+        ) then ${t.agent} end`:e.parts?.length?q`case when ${H(t.agent,e.parts)} then ${t.agent} end`:q`null::text`,c=e.by===`installation`?q`left join ${j} on ${j.id} = ${t.installationId}`:q``,l=await h(this.db,()=>this.db.execute(q`
+      select ${n} as key, ${s} as part, ${a.tasks}::int as tasks,
+        ${a.runnerMs}::float8 as runner_ms,
+        ${a.tokenCount}::float8 as token_count
+      from ${t} ${c}
+      where ${r}
+      group by 1, 2
+    `)),u=Array.isArray(l)?l:l.rows,d=new Map;for(let e of u){let t={tasks:Number(e.tasks),runnerMs:Number(e.runner_ms),tokenCount:Number(e.token_count)},n=d.get(e.key)??{key:e.key,tasks:0,runnerMs:0,tokenCount:0};re(n,t),e.part&&((n.parts??={})[e.part]=t),d.set(e.key,n)}return[...d.values()].sort((e,t)=>e.key.localeCompare(t.key))}async sweep(e=1e3){if(!Number.isInteger(e)||e<1)throw Error(`Sweep batch must be positive`);let t=this.at().toISOString();await this.db.execute(q`
+      with expired_state as (
+        delete from ${c} where expires_at <= clock_timestamp() and key in (
+          select key from ${c} where expires_at <= clock_timestamp() order by expires_at limit ${e}
+        )
+      ), lists as (
+        select expired.key from ${p} as expired
+        where expired.key like 'k:%' and expired.expires_at <= ${t}::timestamptz
+          and not exists (select 1 from ${p} as newer where newer.key = expired.key and newer.seq > expired.seq)
+        order by expired.expires_at limit ${e}
+      ), expired_items as (
+        select key, seq from ${p} where key in (select key from lists) order by seq limit ${e}
+      ), expired_queue as (
+        select key, seq from ${p} where key like 'q:%' and expires_at <= ${t}::timestamptz order by expires_at limit ${e}
+      )
+      delete from ${p} where (key, seq) in (
+        select key, seq from expired_items union all select key, seq from expired_queue
+      )`)}};export{be as DrizzleStore};