@wular/coder 0.4.10 → 0.4.12

package/dist/apps-6BgpUsFh.js

@@ -1,372 +0,0 @@
-import{Ft as e,Rt as t,en as n,qi as r}from"./core-DwsAMCnL.js";import{$ as i,$n as a,Ar as o,Bn as s,Bt as c,Cr as l,Dn as u,Dr as d,Et as f,G as p,Gn as m,Hn as h,Ht as g,In as _,Jt as v,Kt as y,Or as b,P as ee,Pt as te,Rn as ne,Sr as re,Tr as ie,Tt as ae,U as oe,Un as se,Vt as x,W as ce,Wn as le,Wt as ue,Yt as de,Zn as fe,Zt as pe,_r as me,_t as he,br as ge,c as _e,cr as ve,ct as ye,dt as be,er as xe,f as Se,fn as Ce,fr as we,gr as Te,gt as Ee,hn as De,hr as Oe,ht as ke,in as Ae,ir as je,it as Me,kt as Ne,mt as Pe,nn as Fe,nr as Ie,nt as Le,pn as Re,qn as ze,rn as Be,rr as Ve,sn as He,tn as Ue,tr as We,tt as Ge,un as Ke,ur as qe,v as Je,vt as Ye,wt as Xe,x as Ze,yr as Qe,yt as $e,zn as et,zt as tt}from"./prompts-CEf7z4i_.js";import{A as nt,U as rt,a as it,c as at,l as ot,m as st,r as ct,u as lt,x as ut,y as dt}from"./dispatch-BJZqI7sj.js";import{a as ft,d as pt,f as mt,i as ht,l as gt,n as _t,o as vt,r as yt,t as bt,u as xt}from"./load-C-GZnuok.js";import{d as St,m as Ct,p as wt}from"./slack-Kpj-G9FE.js";import{i as Tt,n as Et,t as Dt}from"./integrations-DPxWtNnS.js";import{t as Ot}from"./dist-DAnSqY1s.js";import{c as kt,i as At,o as jt,s as Mt,t as Nt}from"./actions-C3Mgpl9J.js";import{a as Pt,i as Ft,v as It,y as Lt}from"./executor-LkokKTTd.js";import{n as Rt}from"./log-view-CL3_S0IQ.js";import{r as zt,s as Bt}from"./mcp-B-hy3eM-.js";import{c as Vt,n as Ht,o as Ut,r as Wt,t as Gt,u as Kt}from"./exec-DcWxZar6.js";import{f as qt,r as Jt}from"./task-CQmx_2SI.js";import{t as Yt}from"./match-BfjPZ7gJ.js";import{a as S,c as Xt,d as Zt,f as Qt,i as $t,l as en,m as tn,n as nn,p as C,r as rn,u as an,v as on,y as sn}from"./http-CXaW1e7x.js";import{n as cn}from"./env-DSddo-fz.js";import{C as w,S as ln,T as un,_ as dn,b as fn,c as pn,d as mn,f as hn,h as gn,l as _n,p as vn,r as yn,s as bn,t as xn,u as Sn,w as Cn,x as T}from"./runners-vsoGeyuc.js";import{C as wn,S as Tn,c as En,d as Dn,g as On,i as kn,l as An,m as jn,o as Mn,p as Nn,s as Pn,t as Fn,u as In,v as Ln,w as Rn,y as zn}from"./local-Fs-dx_dP.js";import{n as Bn,t as Vn}from"./chat-bwKd3y6V.js";import{A as Hn,B as Un,E as Wn,F as Gn,H as Kn,I as E,L as qn,M as D,N as Jn,P as Yn,R as O,T as Xn,U as Zn,V as Qn,W as $n,X as k,_ as er,c as tr,d as A,g as nr,h as j,i as M,j as N,k as P,l as rr,m as ir,n as F,o as ar,p as I,r as or,s as sr,t as L,u as cr,v as lr}from"./schema-Brm7WIKd.js";import{a as R,i as ur,t as dr}from"./client-DzwzCsue.js";import z from"node:path";import fr from"node:process";import{fileURLToPath as pr,pathToFileURL as mr}from"node:url";import B,{accessSync as hr,constants as gr,existsSync as _r,readFileSync as vr,statSync as yr}from"node:fs";import{execFile as br,spawn as xr}from"node:child_process";import{createHash as Sr,createHmac as Cr,randomBytes as wr,randomUUID as Tr}from"node:crypto";import Er from"node:os";import Dr from"node:net";import{isDeepStrictEqual as Or,promisify as kr}from"node:util";import{brotliDecompressSync as Ar,constants as jr,createGzip as Mr,gunzipSync as Nr,gzipSync as Pr,inflateSync as Fr}from"node:zlib";const Ir=e=>`nonce:${Ct(e)}`;function Lr(e){let t=e.config.encryptionKey??e.config.adminToken;if(!t)throw Error(`A server secret is required to issue browser transactions.`);return t}function Rr(e,t){return Cr(`sha256`,Lr(e)).update(t).digest(`base64url`)}async function zr(e,t,n,r,i=6e5){let a=(e.now??Date.now)(),o={kind:t,user:n,organization:e.organizationId,nonce:wr(18).toString(`base64url`),exp:a+i},s=sn(o),c=`${s}.${Rr(e,s)}`;return await e.store.put(`delivery`,Ir(c),{at:a,target:r},{ttlMs:i}),c}function Br(e,t){let[n,r,i]=t.split(`.`);if(!(!n||!r||i!==void 0)&&wt(Rr(e,n),r))try{return on(n)}catch{return}}async function Vr(e,t){let n=await e.store.get(`delivery`,Ir(t));return n&&`target`in n?n.target:void 0}function Hr(e,t){return Br(e,t)?.organization}function Ur(e,t){return Br(e,t)?.user}function Wr(e,t,n,r,i=!0){let a=Br(e,t);return a&&a.kind===n&&(a.user===r||i&&a.user===`*`)&&a.organization===e.organizationId&&a.exp>=(e.now??Date.now)()?a:void 0}async function Gr(e,t,n,r,i){if(!Wr(e,t,n,r,!1))return!1;let a=await e.store.take(`delivery`,Ir(t),{target:i});return!!a&&`target`in a&&a.target===i}async function Kr(e,t,n,r){if(!Wr(e,t,n,r))return;let i=await e.store.take(`delivery`,Ir(t));return i&&`target`in i?i.target:void 0}async function qr(e,t,n,r){return Wr(e,t,n,r)?Vr(e,t):void 0}const Jr=[`GET`,`POST`,`PUT`,`PATCH`,`DELETE`];function Yr(e,t,n,r){return{method:e,pattern:t,handler:n,...r?{guard:r}:{}}}function Xr(e,t,n){return t.map(t=>({...t,pattern:e+t.pattern,...n&&!t.guard?{guard:n}:{}}))}function Zr(e,t,n){return[e,`${e}/*`].flatMap(e=>Jr.map(r=>Yr(r,e,t,n)))}function Qr(e,t){let[n,r]=[e.split(`/`),t.split(`/`)],i=n.at(-1)===`*`;if(i?r.length<n.length:r.length!==n.length)return;let a={};for(let e=0;e<n.length;e++){let[t,o]=[n[e],r[e]];if(t===`*`&&i){a[`*`]=r.slice(e).join(`/`);break}if(t[0]===`:`){if(!o)return;a[t.slice(1)]=o}else if(t!==o)return}return a}async function $r(e,t,n,r){for(let i of e){let a=Qr(i.pattern,r.pathname);if(!a)continue;for(let e of Object.keys(a))e!==`*`&&(a[e]=decodeURIComponent(a[e]));let o=e.filter(e=>e.pattern===i.pattern),s=o.find(e=>e.method===t.method),c=(s??i).guard;if(c){let e=await c(t,n,a,r);if(e instanceof Response)return e;n=e}if(s)return s.handler(t,n,a,r);let l=Xt();return l.headers.set(`allow`,[...new Set(o.map(e=>e.method))].join(`, `)),l}}const ei=`coder`;function ti(e,t){let n=e??`/dash`;try{let e=new URL(n,t);return e.origin===t&&!n.includes(`\\`)&&!/^\/[/\\]/.test(e.pathname)?`${e.pathname}${e.search}${e.hash}`:`/dash`}catch{return`/dash`}}const ni=[`default-src 'self'`,`style-src 'self' 'unsafe-inline'`,`img-src 'self' data:`,`connect-src 'self'`,`object-src 'none'`,`base-uri 'none'`,`frame-ancestors 'none'`,`form-action ${[`'self'`,...new Set(Object.values(Dt).flatMap(e=>e.app.postOrigins??[]))].join(` `)}`];function ri(e){let t=z.dirname(pr(e));for(;;){let e=z.join(t,`package.json`);if(_r(e))try{if(JSON.parse(vr(e,`utf8`)).name===`@wular/coder`)return t}catch{}let n=z.dirname(t);if(n===t)break;t=n}throw Error(`Cannot locate the Coder package root.`)}function ii(e=import.meta.url){let t=z.dirname(pr(e)),n=ri(e),r=pr(new URL(`./dash/standalone/server/entry.js`,import.meta.url));return[z.resolve(r,`../../..`),z.join(n,`dist/dash`),z.join(t,`../dash`)].find(e=>_r(ai(e)))}const ai=e=>z.join(e,`standalone/server/manifest.json`);function oi(e){let t=z.join(e,`standalone/server/entry.js`);if(!_r(t))throw Error(`The Coder dashboard server bundle is missing.`);return t}async function si(e){let t=JSON.parse(vr(ai(e),`utf8`));return{handler:await(await import(mr(oi(e)).href)).createRequestHandler({root:z.join(e,`standalone`)}),manifest:t}}var ci=class{moduleUrl;root;loaded;constructor(e=import.meta.url){this.moduleUrl=e}host(){let e=Date.now(),t=this.loaded;if(t&&e-t.checked<1e3)return t.host;if(this.root??=ii(this.moduleUrl),!this.root)return;let n;try{n=yr(ai(this.root)).mtimeMs}catch{}if(t&&(t.checked=e,n===void 0||n===t.build))return t.host;let r={build:n,checked:e,host:si(this.root)};return r.host.catch(()=>{this.loaded===r&&(this.loaded=void 0)}),this.loaded=r,r.host}};const li=e=>e.length>1&&e.endsWith(`/`)?e.slice(0,-1):e;function ui(e,t){let n=li(e);return!!(Qr(`/assets/*`,n)||Qr(`/dash/*`,n)||t.routes.some(e=>Qr(e.route,n)))}async function di(e,t=new ci){return!!(await t.host()?.catch(()=>void 0))?.manifest.routes.some(t=>Qr(t.route,li(e)))}const fi=/<script(?![^>]*\bsrc=)[^>]*>([\s\S]*?)<\/script>/gi,pi=e=>`'sha256-${Sr(`sha256`).update(e).digest(`base64`)}'`;function mi(e){let t=[...e.matchAll(fi)].map(e=>pi(e[1]));return[...ni,`script-src 'self' ${t.join(` `)}`.trim()].join(`; `)}function hi(e,t){return t===`gzip`?Nr(e).toString(`utf8`):t===`br`?Ar(e).toString(`utf8`):t===`deflate`?Fr(e).toString(`utf8`):e.toString(`utf8`)}const gi=e=>(e.headers.get(`accept-encoding`)??``).split(`,`).some(e=>{let[t,...n]=e.split(`;`).map(e=>e.trim()),r=n.find(e=>e.startsWith(`q=`));return t===`gzip`&&(!r||Number(r.slice(2))>0)});function _i(e){e.set(`content-encoding`,`gzip`),/accept-encoding/i.test(e.get(`vary`)??``)||e.append(`vary`,`accept-encoding`)}function vi(e){let t=Mr(),n=e=>new Promise(n=>{t.write(e),t.flush(jr.Z_SYNC_FLUSH,()=>n())}),r=!1;return new ReadableStream({start(e){t.on(`data`,t=>e.enqueue(new Uint8Array(t))),t.on(`end`,()=>e.close()),t.on(`error`,t=>e.error(t))},async pull(){if(r)return;let{done:i,value:a}=await e.read();if(!i)return n(a);r=!0,t.end()},cancel(n){return t.destroy(),e.cancel(n)}})}function yi(e,t,n,r){n.set(`content-security-policy`,[...ni,`script-src 'self' 'nonce-${r}'`].join(`; `));let i=t.body;return gi(e)&&(_i(n),i=vi(i.getReader())),new Response(i,{status:t.status,statusText:t.statusText,headers:n})}async function bi(e,t,n){let r=new Headers(t.headers);if(r.set(`x-content-type-options`,`nosniff`),!(r.get(`content-type`)??``).includes(`text/html`))return new Response(t.body,{status:t.status,statusText:t.statusText,headers:r});r.set(`cache-control`,`no-store`),r.delete(`content-length`);let i=r.get(`content-encoding`);if(!i&&t.body)return yi(e,t,r,n);let a=Buffer.from(await t.arrayBuffer()),o=hi(a,i);r.set(`content-security-policy`,mi(o));let s=i?new Uint8Array(a):o;return!i&&o.length>1024&&gi(e)&&(s=new Uint8Array(Pr(o)),_i(r)),new Response(s,{status:t.status,statusText:t.statusText,headers:r})}async function xi(e,t=new ci){let n=await t.host();if(!n||!ui(new URL(e.url).pathname,n.manifest))return;let r=wr(16).toString(`base64`),i=new Headers(e.headers);return i.set(`content-security-policy`,`script-src 'nonce-${r}'`),bi(e,await n.handler(new Request(e,{headers:i})),r)}const Si=(e,t,n=!1)=>`coder_admin=${encodeURIComponent(t)}; HttpOnly; SameSite=Strict; Path=/${new URL(e.url).protocol===`https:`?`; Secure`:``}${n?`; Max-Age=0`:``}`;function Ci(e,t){let n=e.headers.get(`x-forwarded-host`)?.split(`,`,1)[0]?.trim();if(!n)return t.origin;let r=e.headers.get(`x-forwarded-proto`)?.split(`,`,1)[0]?.trim()??t.protocol.slice(0,-1);try{return new URL(`${r}://${n}`).origin}catch{return t.origin}}async function wi(e,t,n,r){let i=await e.formData(),a=i.get(`token`),o=i.get(`return`),s=ti(typeof o==`string`&&o.startsWith(`/`)?o:null,new URL(e.url).origin);return typeof a==`string`?a?bm(a,t.config.adminToken)?new Response(null,{status:303,headers:{location:s,"set-cookie":Si(e,a)}}):C(`/dash?token=rejected`,303):new Response(null,{status:303,headers:{location:s,"set-cookie":Si(e,``,!0)}}):C(`/dash?token=rejected`,303)}async function Ti(e,t,n,r){return C(!t.auth||t.session?`/dash`:r.searchParams.has(`signed_out`)?`/login?signed_out=1`:`/login`)}async function Ei(e,t,n,r){let i=`/api/auth/sign-in?return=${encodeURIComponent(ti(r,n.origin))}`,a=t.config.publicUrl;return a&&new URL(Ci(e,n)).host!==new URL(a).host?C(new URL(i,a).href):t.auth.handler(new Request(`${n.origin}${i}`))}async function Di(e,t,n,r){return t.auth?!r.searchParams.has(`signed_out`)&&!r.searchParams.has(`error`)?Ei(e,t,r,r.searchParams.get(`return`)):ji(e,t):C(`/dash`)}function Oi(e,t){let n=new Headers(e.headers);n.set(`x-coder-mode`,wm(t));let r=t.session?.organizations.find(e=>e.id===t.organizationId);return r?n.set(`x-coder-organization`,r.slug):n.delete(`x-coder-organization`),new Request(e,{headers:n})}const ki=()=>new Response(`UI is not built`,{status:503}),Ai=e=>async(t,n)=>await xi(Oi(t,n),n.dashboardHosts)??e(),ji=Ai(ki),Mi=Ai(en);function Ni(e,t){let n=e.organizations.find(e=>e.slug===t||e.id===t);return n?{...e,organizationId:n.id,role:n.role}:{...e,organizationId:void 0,role:void 0,organizationDenied:!0}}function V(e,t){return t===e.organizationId||!e.scope?e:e.scope(t)}async function Pi(e,t){if(!e.appRecord){let n=await e.store.get(`app`,t);return n&&{ctx:e,app:n}}let n=await e.appRecord(t);return n&&{ctx:V(e,n.organizationId),app:n.app}}async function Fi(e,t){if(e.boundInstallation?.installation.id===t)return{...V(e,e.boundInstallation.organizationId),boundInstallation:e.boundInstallation};if(!e.installationOrganization)return e;let n=await e.installationOrganization(t);return n===void 0?void 0:V(e,n)}function Ii(e,t,n){let r=n&&t.organizations.find(e=>e.id===n);return r?{...V(e,r.id),session:{...t,organizationId:r.id,role:r.id===t.organizationId?t.role:r.role}}:void 0}async function Li(e,t){let n=await e.store.get(`installation`,t);return n&&!n.deletedAt?e.store.get(`app`,n.app):void 0}async function Ri(e,t,n,r){let i=t.session,a=r.searchParams.get(`token`)??``,o=Ii(t,i,Hr(t,a))??t;if(await qr(o,a,`link`,i.user.id))return await xi(e,t.dashboardHosts)??ki();let s=await Kr(o,a,`link-start`,i.user.id);if(!s)return new Response(`This link is invalid or has expired.`,{status:400});let c=await zr(o,`link`,i.user.id,s,3e5);return C(`/connect?token=${encodeURIComponent(c)}`)}async function zi(e,t,n,r){let i=t.session,a=await e.json().catch(()=>({})),o=typeof a.token==`string`?await Kr(Ii(t,i,Hr(t,a.token))??t,a.token,`link`,i.user.id):void 0;if(!o)return S({error:`This link is invalid or has expired.`},400);let s=JSON.parse(o);return await t.auth.link(i.user,s.platform,s.platformUserId,{organizations:i.organizations.map(e=>e.id)})===`taken`?S({error:`That platform account is connected to someone else.`},409):S({ok:!0,...s})}async function Bi(e,t,n,r){let i=t.integrations[n.integration],a=i.auth.user,o=t.config.publicUrl,s=t.session,c=r.searchParams.get(`connection`);if(c){let e=Ii(t,s,r.searchParams.get(`organization`)??s.organizationId),n=e&&await e.store.get(`connection`,c);if(!e||!n||n.provider!==i.id||n.auth!==`oauth`||n.owner&&n.owner!==s.user.id)return S({error:`Unknown OAuth connection`},404);if(!n.owner){let t=ym(e,`Only workspace owners and admins can authorize workspace connections`);if(t instanceof Response)return t}let l=await Bf(e,i.id);if(!l)return S({error:`No OAuth client is available for ${i.name}.`},400);let u=await zr(e,`native-oauth`,s.user.id,JSON.stringify({connection:n,app:l.id,attempt:r.searchParams.get(`attempt`)}));return C(a.authorizeUrl(T(t.config,l.credentials),{publicUrl:o,state:u,access:n.access??`write`}))}let l=r.searchParams.get(`installation`)??``,u=Ii(t,s,l?await t.installationOrganization?.(l):void 0),d=u??{...t,session:s};if(!u)return $(d,`not-member`,{platform:i.id});let f=await Li(u,l);if(!f||f.integration!==i.id)return $(d,`disconnected`,{platform:i.id});let p=await zr(u,`link-oauth`,s.user.id,l);return C(a.authorizeUrl(T(t.config,f.credentials),{publicUrl:o,state:p}))}async function Vi(e,t,n,r){let i=t.integrations[n.integration],a=i.auth.user,o=t.config.publicUrl,s=t.session,c=r.searchParams.get(`state`)??``,l=Ii(t,s,Hr(t,c)),u=l??{...t,session:s},d=l&&await Kr(l,c,`native-oauth`,s.user.id);if(l&&d){let n=JSON.parse(d),r=n.connection;if(r.provider!==i.id)return $(u,`link-expired`,{platform:i.id});if(!r.owner){let e=ym(l,`Only workspace owners and admins can authorize workspace connections`);if(e instanceof Response)return e}else if(r.owner!==s.user.id)return $(u,`link-expired`,{platform:i.id});let c=await Bf(l,i.id,n.app);return c?l.store.withAppLock(`connection:${r.id}`,async d=>{let f=await d.get(`connection`,r.id);if(!f||JSON.stringify(f)!==JSON.stringify(r))return $(u,`link-expired`,{platform:i.id});let p=await a.exchange(e,T(t.config,c.credentials),{publicUrl:o,access:f.access??`write`,fetch:((e,n)=>(t.fetch??fetch)(e,{...n,redirect:`manual`,signal:AbortSignal.timeout(5e3)}))}).catch(e=>{console.error(`coder server: ${i.id} connection sign-in failed`,e)});return p?.token?f.owner&&await t.auth.link(s.user,i.id,p.id,{organizations:s.organizations.map(e=>e.id),token:w(t.config,{app:c.id,token:p.token})},d)===`taken`?$(u,`account-taken`,{platform:i.id}):(await d.put(`connection`,f.id,{...f,account:f.owner?p.id:p.login??p.id,oauthApp:f.owner?c.id:void 0,secret:f.owner?void 0:w(t.config,{app:c.id,token:p.token}),broken:void 0,updatedAt:(t.now??Date.now)()}),n.attempt&&await Ki({...l,store:d},f,n.attempt),$(u,`linked`,{platform:i.id,account:p.login??p.id})):$(u,`failed`,{platform:i.id})}):$(u,`link-expired`,{platform:i.id})}let f=l&&await Kr(l,c,`link-oauth`,s.user.id),p=l&&f?await Li(l,f):void 0;if(!l||!p||p.integration!==i.id)return $(u,`link-expired`,{platform:i.id});let m=await a.exchange(e,T(t.config,p.credentials),{publicUrl:o,fetch:t.fetch??fetch}).catch(e=>e instanceof Error?e:Error(String(e)));return m instanceof St?$(u,m.code,{platform:i.id,error:m.error}):m instanceof Error?(console.error(`coder server: ${i.id} sign-in failed`,m),$(u,`failed`,{platform:i.id})):await t.auth.link(s.user,i.id,m.id,{organizations:s.organizations.map(e=>e.id),...m.token?{token:w(t.config,{app:p.id,token:m.token})}:{}})===`taken`?$(u,`account-taken`,{platform:i.id}):(await Lf(l,s.user.id,i.id,m.id),$(u,`linked`,{platform:i.id,account:m.login??m.id}))}const Hi=`/connections/oauth/client.json`,Ui=`/connections/oauth/callback`,Wi=6e5,Gi=e=>`connection-oauth:${e}`;async function Ki(e,t,n){await e.store.put(`delivery`,`connection-authorized:${Sr(`sha256`).update(n).digest(`hex`)}`,{at:(e.now??Date.now)(),target:`${t.id}:${t.createdAt}`},{ttlMs:Wi})}const H=b().check(t(1)),qi=re({resource:H,authorization_servers:Te(H).check(t(1)),scopes_supported:l(Te(H))}),Ji=re({issuer:H,authorization_endpoint:H,token_endpoint:H,registration_endpoint:l(H),userinfo_endpoint:l(H),scopes_supported:l(Te(H)),code_challenge_methods_supported:l(Te(H)),client_id_metadata_document_supported:l(me()),authorization_response_iss_parameter_supported:l(me())}),Yi=Oe([`none`,`client_secret_basic`,`client_secret_post`]),Xi=re({client_id:H,client_secret:l(H),token_endpoint_auth_method:l(Yi),redirect_uris:l(Te(H))}),Zi=re({name:l(H),preferred_username:l(H),email:l(H)});function Qi(e,t){let n=Ie(t);if(!m(n,!!e.local))throw Error(`OAuth endpoint is not allowed.`);return n}async function $i(e,t,n,r=!1){for(let i of[...new Set(n)]){Qi(e,i);let n=await We(t,i,{headers:{accept:`application/json`}});if(n.status!==404&&n.status!==405&&!(r&&(n.status===401||n.status===403))){if(!n.ok)throw Error(`OAuth metadata discovery failed.`);return n.json()}}if(!r)throw Error(`OAuth metadata is unavailable.`)}function ea(e){let t={},n=``;for(let r of e?.matchAll(/(?:^|,)\s*(?:([\w-]+)\s+)?([\w-]+)\s*=\s*(?:"((?:[^"\\]|\\.)*)"|([^\s,]+))/g)??[]){if(r[1]){if(n===`bearer`)break;n=r[1].toLowerCase()}n===`bearer`&&(t[r[2].toLowerCase()]=r[3]?.replace(/\\(.)/g,`$1`)??r[4])}return t}async function ta(e,t,n=!1,r){let i=Qi(e,t),a=e.fetch??fetch;if(r===void 0){let e=await We(a,i.href);r=e.status===401?e.headers.get(`www-authenticate`)??``:``,await e.body?.cancel()}let o=ea(r),s=await $i(e,a,o.resource_metadata?[o.resource_metadata]:[i.origin+`/.well-known/oauth-protected-resource`+(i.pathname===`/`?``:i.pathname),i.origin+`/.well-known/oauth-protected-resource`],n&&!o.resource_metadata);if(s===void 0)return;let c=qi.parse(s);if(Qi(e,c.resource).origin!==i.origin)throw Error(`OAuth resource changed origin.`);return{resource:c,params:o}}function na(e){if(e.local)return`http://localhost:${e.local.port}`;if(e.config.publicUrl)return Ie(e.config.publicUrl).origin;throw Error(`PUBLIC_URL or a local server is required for OAuth.`)}function ra(e){let t=na(e);return{client_name:e.config.name??`Coder`,redirect_uris:[t+Ui],grant_types:[`authorization_code`,`refresh_token`],response_types:[`code`],token_endpoint_auth_method:`none`}}function ia(e,t){return!t.config.publicUrl||Ie(t.config.publicUrl).protocol!==`https:`?en():S({client_id:Ie(t.config.publicUrl).origin+Hi,...ra(t)})}function aa(e){if(e.session)return e.session.user.id;if(e.local&&!e.auth)return`local`;throw Error(`Sign in before authorizing a connection.`)}function oa(e,t){if(!e||e.createdAt!==t.createdAt||e.owner!==t.owner||e.auth!==`oauth`||e.provider!==`mcp`||JSON.stringify(e.endpoint)!==JSON.stringify(t.endpoint))throw Error(`The connection changed during authorization.`)}async function sa(e,t,n){let r=await e.get(`delivery`,Gi(t));if(!r||!(`target`in r)||r.target!==n)throw Error(`The authorization attempt was superseded or expired.`)}async function ca(e,t,n){let r=aa(e);if(t.auth!==`oauth`||t.provider!==`mcp`||!t.endpoint||!(`url`in t.endpoint)||typeof t.endpoint.url!=`string`||t.owner&&t.owner!==r)throw Error(`This connection cannot be authorized.`);let i=e.fetch??fetch,{resource:a,params:o}=n??await ta(e,t.endpoint.url),s=a.authorization_servers[0],c=Qi(e,s);if(c.search)throw Error(`OAuth issuer cannot contain a query.`);let l=c.pathname.replace(/\/$/,``),u=Ji.parse(await $i(e,i,[c.origin+`/.well-known/oauth-authorization-server`+l,c.origin+`/.well-known/openid-configuration`+l,c.origin+l+`/.well-known/openid-configuration`]));if(u.issuer!==s)throw Error(`OAuth issuer mismatch.`);if(!u.code_challenge_methods_supported?.includes(`S256`))throw Error(`OAuth server does not support PKCE S256.`);Qi(e,u.authorization_endpoint),Qi(e,u.token_endpoint),u.registration_endpoint&&Qi(e,u.registration_endpoint),u.userinfo_endpoint&&Qi(e,u.userinfo_endpoint);let d=t.secret?T(e.config,t.secret):void 0,f=d?.issuer===s&&d.clientId?{clientId:d.clientId,clientSecret:d.clientSecret,tokenEndpointAuthMethod:d.tokenEndpointAuthMethod}:void 0;if(!f&&u.client_id_metadata_document_supported&&e.config.publicUrl&&Ie(e.config.publicUrl).protocol===`https:`&&(f={clientId:Ie(e.config.publicUrl).origin+Hi,tokenEndpointAuthMethod:`none`}),!f){if(!u.registration_endpoint)throw Error(`OAuth server does not support client registration.`);let t=await We(i,u.registration_endpoint,{method:`POST`,headers:{"content-type":`application/json`,accept:`application/json`},body:JSON.stringify(ra(e))});if(!t.ok)throw Error(`OAuth client registration failed.`);let n=Xi.parse(await t.json()),r=n.token_endpoint_auth_method??`client_secret_basic`;if(r!==`none`&&!n.client_secret)throw Error(`OAuth registration omitted the client secret.`);if(n.redirect_uris&&!n.redirect_uris.includes(na(e)+Ui))throw Error(`OAuth registration changed the redirect URI.`);f={clientId:n.client_id,clientSecret:n.client_secret,tokenEndpointAuthMethod:r}}let p={issuer:s,authorizationEndpoint:u.authorization_endpoint,tokenEndpoint:u.token_endpoint,resource:a.resource,...f,scope:o.scope??a.scopes_supported?.join(` `)??u.scopes_supported?.join(` `)},m=w(e.config,p),h=wr(18).toString(`base64url`);await e.store.withAppLock(`connection:${t.id}`,async n=>{oa(await n.get(`connection`,t.id),t),await n.put(`delivery`,Gi(t.id),{at:(e.now??Date.now)(),target:h},{ttlMs:Wi})});let g=wr(32).toString(`base64url`),_=await zr(e,`connection-oauth`,r,w(e.config,{id:t.id,attempt:h,secret:m,createdAt:t.createdAt,endpoint:t.endpoint,owner:t.owner,verifier:g,redirectUri:na(e)+Ui,userinfo:u.userinfo_endpoint,requireIssuer:u.authorization_response_iss_parameter_supported===!0}),Wi),v=new URL(p.authorizationEndpoint),y={response_type:`code`,client_id:p.clientId,redirect_uri:na(e)+Ui,state:_,code_challenge:Sr(`sha256`).update(g).digest(`base64url`),code_challenge_method:`S256`,resource:p.resource};for(let[e,t]of Object.entries(y))v.searchParams.set(e,t);return p.scope!==void 0&&v.searchParams.set(`scope`,p.scope),v.href}async function la(e,t,n){let r=t,i=e=>C(`${mh(fh(r),`/settings/connections`)}?outcome=${e}`);try{let e=n.searchParams.get(`state`)??``,a=Hr(t,e);if(t.auth&&(!a||!t.session?.organizations.some(e=>e.id===a)))return i(`invalid-state`);let o=t.session?Ii(t,t.session,a)??t:t;r=o;let s=await Kr(o,e,`connection-oauth`,aa(o));if(!s)return i(`invalid-state`);let c=T(o.config,s);if(!c.owner&&!vm(o))return i(`failed`);let l=T(o.config,c.secret),u=n.searchParams.get(`iss`);if((c.requireIssuer||u!==null)&&u!==l.issuer)return i(`failed`);if(n.searchParams.has(`error`))return i(n.searchParams.get(`error`)===`access_denied`?`denied`:`failed`);let d=n.searchParams.get(`code`);if(!d)return i(`failed`);oa(await o.store.get(`connection`,c.id),c),await sa(o.store,c.id,c.attempt);let f=o.fetch??fetch,p=await Ve(f,l,new URLSearchParams({grant_type:`authorization_code`,code:d,redirect_uri:c.redirectUri,code_verifier:c.verifier})),m=p.preferred_username??p.email??p.name;if(!m&&c.userinfo)try{let e=await We(f,c.userinfo,{headers:{authorization:`Bearer ${p.access_token}`,accept:`application/json`}});if(e.ok){let t=Zi.parse(await e.json());m=t.preferred_username??t.email??t.name}}catch(e){console.error(`coder server: OAuth userinfo failed`,e)}return await o.store.withAppLock(`connection:${c.id}`,async t=>{let n=await t.get(`connection`,c.id);oa(n,c),await sa(t,c.id,c.attempt),await t.put(`connection`,n.id,{...n,secret:w(o.config,je(l,p,(o.now??Date.now)())),account:m??n.account,broken:void 0,updatedAt:(o.now??Date.now)()}),await t.delete(`delivery`,Gi(c.id)),await Ki({...o,store:t},n,e)}),i(`connected`)}catch(e){return console.error(`coder server: connection OAuth callback failed`,e),i(`failed`)}}async function ua(e,t,n){return(await Ff(e,t)).filter(e=>n===void 0||n.includes(e.id)).map(e=>e.id)}function da(e){if(typeof e!=`string`||!e)return{ok:!1,detail:`A folder path is required`};let t=e===`~`?Er.homedir():e.startsWith(`~/`)?z.join(Er.homedir(),e.slice(2)):e;if(!z.isAbsolute(t))return{ok:!1,detail:`The folder path must be absolute`};let n=z.normalize(t);try{return B.statSync(n).isDirectory()?(B.accessSync(n,B.constants.R_OK),{ok:!0,folder:{path:n,name:z.basename(n)}}):{ok:!1,detail:`The path is not a directory`}}catch{return{ok:!1,detail:`The folder does not exist or is not readable`}}}function fa(e){let t=new Map,n=[...c(e),...tt(e,{migrate:!1})].sort((e,t)=>Date.parse(t.createdAt)-Date.parse(e.createdAt));for(let e of n){let n=da(e.cwd);if(!(!n.ok||t.has(n.folder.path))&&(t.set(n.folder.path,{...n.folder,recent:Date.parse(e.createdAt)}),t.size===8))break}return{current:{path:e,name:z.basename(e)},recent:[...t.values()],picker:!!ma()}}const pa=e=>(process.env.PATH??``).split(z.delimiter).some(t=>t&&B.existsSync(z.join(t,e)));function ma(){let e=`Choose a folder for the task`;if(process.platform===`darwin`)return[`osascript`,[`-e`,`tell application "System Events"`,`-e`,`activate`,`-e`,`POSIX path of (choose folder with prompt "${e}")`,`-e`,`end tell`]];if(process.platform===`win32`)return[`powershell`,[`-NoProfile`,`-Command`,`Add-Type -AssemblyName System.Windows.Forms; $d = New-Object System.Windows.Forms.FolderBrowserDialog; $d.Description = '${e}'; if ($d.ShowDialog() -eq 'OK') { $d.SelectedPath }`]];if(pa(`zenity`))return[`zenity`,[`--file-selection`,`--directory`,`--title=${e}`]];if(pa(`kdialog`))return[`kdialog`,[`--getexistingdirectory`,Er.homedir(),`--title`,e]]}async function ha(){let e=ma();if(!e)return{ok:!1,detail:`This machine has no folder dialog; type a path instead`};try{let{stdout:t}=await kr(br)(e[0],e[1],{timeout:6e5}),n=t.trim().replace(/(.)[\\/]+$/,`$1`);return n?da(n):{ok:!1,detail:``}}catch{return{ok:!1,detail:``}}}function ga(e){let t=/^\w[\w.-]*@([\w.-]+):(?!\/)([^?#]+)$/.exec(e),n=t||!URL.canParse(e)?void 0:new URL(e);if(!t&&(!n||![`https:`,`ssh:`].includes(n.protocol)||n.password||n.search||n.hash))return;let[r,i]=t?[t[1],t[2]]:[n.port?`${n.hostname}_${n.port}`:n.hostname,n.pathname],a=i.replace(/(\.git)?\/?$/,``).split(`/`).filter(Boolean);if(!(!/^[a-z0-9][a-z0-9._-]*$/i.test(r)||a.length<2||!a.every(e=>/^[\w.-]+$/.test(e)&&!/^\.+$/.test(e))))return[r.toLowerCase(),...a]}async function _a(e){let t=typeof e==`string`?e.trim():``,n=ga(t);if(!n)return{ok:!1,detail:`Use an https or ssh git URL, like https://github.com/owner/repo`};let r=Ne(`checkouts`,...n),i=AbortSignal.timeout(6e5),a={...process.env,GIT_TERMINAL_PROMPT:`0`,GIT_SSH_COMMAND:process.env.GIT_SSH_COMMAND??`ssh -o BatchMode=yes`},o=e=>kr(br)(`git`,e,{env:a,signal:i,maxBuffer:67108864});try{await qt(r,async()=>{if(B.existsSync(z.join(r,`.git`))){await o([`-C`,r,`remote`,`set-url`,`origin`,t]),await o([`-C`,r,`fetch`,`origin`]);return}let e=await B.promises.mkdtemp(`${r}-clone-`);try{await o([`clone`,`--`,t,e]),await B.promises.rename(e,r)}finally{await B.promises.rm(e,{recursive:!0,force:!0})}})}catch(e){let t=e;if(i.aborted)return{ok:!1,detail:`The clone took longer than 10 minutes`};if(t.code===`ENOENT`&&!t.stderr)return{ok:!1,detail:`Git is not installed on this machine`};let n=String(t.stderr??t.message).split(`
-`).map(e=>e.trim()).filter(Boolean),r=(n.find(e=>e.startsWith(`fatal:`))??n.at(-1)??`The clone failed`).replace(/^fatal:\s*/,``);return{ok:!1,detail:r[0].toUpperCase()+r.slice(1)}}return{ok:!0,folder:{path:r,name:n.at(-1),url:t}}}const va=e=>`app-token:${e}:`;async function ya(e,t){return(await e.store.list(`snapshot`,{prefix:va(t)})).flatMap(({id:t,value:n})=>{if(!(`secret`in n))return[];let r=T(e.config,n.secret);return r.unusable?[]:[{id:t,token:r}]}).sort((e,t)=>t.token.lastUsedAt-e.token.lastUsedAt).map(({id:e,token:t})=>({id:e,label:`${t.workspaceName} · saved by ${t.savedBy}`}))}function ba(e,t){let n=()=>(e.now??Date.now)();return{async put(r){let i=va(t)+Ct(JSON.stringify([r.workspace,r.user]));return await e.store.withAppLock(`${e.organizationId}:${i}`,t=>t.put(`snapshot`,i,{secret:w(e.config,{...r,savedBy:e.session?.user.name||`Server operator`,lastUsedAt:n()})})),i},async use(r,i){if(!r.startsWith(va(t)))throw new St(`invalid-field`,`token`,`Choose a saved configuration token or paste a new one.`);let a=await e.store.withAppLock(`${e.organizationId}:${r}`,async t=>{let a=await t.get(`snapshot`,r),o=a&&T(e.config,a.secret);if(!o||o.unusable)return{error:new St(`invalid-field`,`token`,`This configuration token is unavailable. Paste a new token.`)};let s=()=>t.put(`snapshot`,r,{secret:w(e.config,o)});try{let e=await i(o.credentials,async(e,t)=>{t&&(o.workspaceName=t),o.credentials=e,await s()},async()=>{o.unusable=!0,await s()});return o.lastUsedAt=n(),await s(),{value:e}}catch(e){return{error:e}}});if(`error`in a)throw a.error;return a.value}}}const xa=`.coder/agents`,Sa=2592e6;function Ca(e){return e.repo?`${e.repo.owner}/${e.repo.name}`:void 0}const wa=(e,t,n)=>`repo-file:${e}@${t}@${n}:`;function Ta(e,t,n){let r=Tt(e),i=n.integration===r?.id?t.id:t.connections?.[r?.id??``]?.id,a=Ca(n),o=t.settings?.configRepo;return!r||!i?[]:[...a&&n.integration===r.id?[wa(i,a,n.repo?.defaultBranch??``)]:[],...o?[wa(i,o,``)]:[]]}const Ea=(e,t,n)=>`repo-push:${e}@${t}@${n}`;function Da(e,t,n,r,i,a){let o=`${wa(n.installation,r,a??``)}${i}`,s=e.fileReads??=new Map,c=s.get(o);if(!c){let l=AbortSignal.timeout(1e4),u=new Promise((e,t)=>l.addEventListener(`abort`,()=>t(l.reason),{once:!0}));c=Promise.race([Oa(e.store,t,n,r,i,a,o,l),u]).catch(e=>{throw l.aborted&&console.error(`coder server: repository file read timed out for ${r}/${i}`,e),e}).finally(()=>s.delete(o)),s.set(o,c)}return c}async function Oa(e,t,n,r,i,a,o,s){let c=await e.get(`snapshot`,o);s.throwIfAborted();let l=/^[0-9a-f]{40}$/i.test(a??``),u=Date.now();if(c&&!c.stale&&(l||u-(c.readAt??0)<6e5))return c.text;let d=Ea(n.installation,r,a??``),[f,p]=await Promise.all([n.token(r),l?void 0:e.get(`snapshot`,d)]);if(s.throwIfAborted(),!f||!t.repos)return;let m=t.repos.revalidate?await t.repos.revalidate(r,i,f,{...a?{ref:a}:{},...c?.etag?{etag:c.etag}:{},fetch:((e,t)=>n.fetch(e,{...t,signal:s}))}):{text:await t.repos.readFile(r,i,f,a)};s.throwIfAborted();let{stale:h,...g}=c??{},_={...m===`unchanged`?g:m,...l?{}:{readAt:u}};return await e.put(`snapshot`,o,_,{ttlMs:Sa}),!l&&(await e.get(`snapshot`,d))?.push!==p?.push&&await e.put(`snapshot`,o,{..._,stale:!0},{ttlMs:Sa}),_.text}async function ka(e,t){let n=[t.branch,...t.branch===t.defaultBranch?[``]:[]];for(let r of n){await e.put(`snapshot`,Ea(t.installation,t.repo,r),{push:Tr()},{ttlMs:36e5});for(let{id:n,value:i}of await e.list(`snapshot`,{prefix:wa(t.installation,t.repo,r)}))i.stale||await e.put(`snapshot`,n,{...i,stale:!0},{ttlMs:Sa})}}async function Aa(e,t,n,r,i){let a=await Da(e,t,n,r,`.coder/config.json`,i);return a===void 0?void 0:JSON.parse(a).agents}async function ja(e,t,n,r,i=async()=>void 0){for(let t of Object.values(e)){if(!r.repo&&t.id===r.integration||!t.repos)continue;let e=await(await i(t.id))?.token(n);if(e)return{contents:t,token:e}}let[a,o]=n.split(`/`);for(let{value:r}of await t.store.list(`app`)){if(r.agentsRepo!==n)continue;let i=e[r.integration];if(!i?.repos)continue;let s=(await t.store.list(`installation`,{prefix:`${r.id}:`})).find(e=>!e.value.deletedAt)?.value;if(s)try{let e=s.token?{...s,token:T(t.config,s.token)}:s;return{contents:i,token:await i.auth.token(e,T(t.config,r.credentials),{...a&&o?{repo:{owner:a,name:o}}:{},tools:i.tools.presets.read}),app:r,installation:s}}catch(e){console.error(`coder server: repository access for ${s.id} failed`,e);continue}}}function Ma(e,t){let n=t.cwd,r=t.now??Date.now;async function i(t,n,r,i){let a=Tt(e),o=a?.repos&&await i(a.id);if(!a||!o)return;let s=Ca(r);if(r.integration===a.id&&s)return Aa(t,a,o,s,r.repo?.defaultBranch);let c=n.settings?.configRepo;if(c)return Aa(t,a,o,c)}async function a(n,a,o,s,c){let l={store:c?.store??t.store,fileReads:t.fileReads},u=c??await Nn(t.store,n.agent);u.record?.source===`builtin`&&!t.settings?.builtinAgents&&(await jn(t,r()),u=await Nn(t.store,n.agent));let{record:d,version:f}=u;if(!d)return;if(d.problems?.length)throw new bt(d.problems.join(`
-`));if(!f)throw Error(`No version ${d.currentVersion} for agent "${d.id}".`);let p=await i(l,a,o,s),m=p&&typeof p==`object`?p[n.agent]:void 0;if(m===!1||m?.disabled)throw Error(`Agent "${n.agent}" is disabled in ${Ca(o)??a.settings?.configRepo??n.agentsRepo}.`);return Tn(d,f,m&&typeof m==`object`?m:void 0,e)}return async(i,o,s,c,l)=>{let u=n?(await vt(n,e)).find(e=>e.id===i.agent&&!e.builtin):void 0;if(u)return u;let d=await a(i,o,s,c,l);if(d)return d;if(i.agentsRepo){let n=await ja(e,t,i.agentsRepo,s,c);if(n){await Na(t.store,n.contents,i.agentsRepo,Ca(s)===i.agentsRepo?s.repo?.defaultBranch??`HEAD`:`HEAD`,n.token,r());let e=await a(i,o,s,c);if(e)return e;throw Error(`No agent "${i.agent}" in ${i.agentsRepo}.`)}}if(await zn(t.store,r(),i.agent,{})){let e=await a(i,o,s,c);if(e)return e}throw Error(i.agentsRepo?`No agent named "${i.agent}".`:`No built-in agent "${i.agent}".`)}}async function Na(e,t,n,r,i,a,o={}){let s=o.path??`.coder/agents`,c=/^[0-9a-f]{40}$/i.test(r)?r:await t.repos.commit(n,r,i)??r,l={repo:n,ref:o.branch??r,commit:c};r=c;let u=await t.repos.tree(n,s,i,r),d=o.slugs??[...new Set(u.filter(e=>/^[^/]+\/agent\.json$/.test(e)).map(e=>e.split(`/`)[0]))];return yt(d),(await Promise.all(d.map(async o=>{let d=`${s}/${o}`,f=u.filter(e=>e.startsWith(`${o}/`)&&e.split(`/`).length<=22),p=Object.fromEntries(await Promise.all(f.map(async e=>[e.slice(o.length+1),await t.repos.readFile(n,`${s}/${e}`,i,r)]))),m=p[`agent.json`];if(m===void 0)return;let h;try{[h]=_t({definitions:{[o]:{json:JSON.parse(m),builtin:!1}},usage:void 0},{...Dt,[t.id]:t})}catch(t){if(!(t instanceof bt||t instanceof SyntaxError))throw t;console.error(`coder server: could not load agent ${o}`,t);let r=await e.get(`agent`,o);await e.put(`agent`,o,{id:o,name:o,source:`repo`,repo:n,path:d,currentVersion:0,createdAt:a,...r,problems:[t.message],updatedAt:a});return}if(!h)return;let{"agent.json":g,"system.md":_,...v}=p;return Ln(e,{id:o,name:h.name,description:h.definition.description,source:`repo`,repo:n,path:d,definition:h.definition,systemPrompt:_??``,files:Object.fromEntries(Object.entries(v).filter(e=>e[1]!==void 0)),commit:c,origin:l,importedFrom:`repo:${n}@${l.ref}`},a)}))).filter(e=>!!e)}const Pa=e=>`app-sync:${e}`,Fa=(e,t,n,r)=>e.manifest?.(t,{publicUrl:n,definition:r})??r,Ia=(e,t,n)=>!!(e&&!e.pending&&e.version>=t&&Or(e.manifest,n));async function La(e,t,n,r){let i=e.integrations[n.integration]?.app,a=e.config.publicUrl,o=await t.get(`delivery`,Pa(n.id));if(i?.values){let e=i.values(n,{publicUrl:a,definition:r.definition}),s=o?.manifest??[],c=e.lines.map(e=>s.some(t=>t.text===e.text&&t.copy===e.copy)?e:{...e,changed:!0}),l=c.some(e=>`changed`in e);return l!==o?.changed&&await t.put(`delivery`,Pa(n.id),{...o,version:r.version,changed:l}),{...e,lines:c,changed:l,confirm:!0}}if(!i?.drift)return;let s=await i.drift(n,T(e.config,n.credentials),{publicUrl:a,definition:r.definition,fetch:e.fetch??fetch}),c=s.lines.length>0;return await t.put(`delivery`,Pa(n.id),{version:r.version,changed:c}),{...s,changed:c}}async function Ra(e,t,n){let r=e.config.publicUrl;if(!r||!t.length)return[];let i=new Map(t.map(e=>[e.agent,e])),a=await e.store.list(`app`);return(await Promise.all(a.filter(({id:e,value:t})=>i.has(t.agent)&&(!n||e===n)).map(async({id:t})=>e.store.withAppLock(t,async a=>{let o=await a.get(`app`,t);if(!o||!i.has(o.agent))return;let s=await On(a,o.agent)??i.get(o.agent),c=e.integrations[o.integration]?.app;if(!c||!s.definition.integrations[o.integration]||!c.update&&(o.builtin||o.shared))return;if(!c.update)return La(e,a,o,s).then(e=>e&&{app:o,check:e},e=>(console.error(`coder server: checking ${o.id} on its platform failed`,e),{app:o,error:e instanceof Error?e.message:String(e)}));let{update:l}=c,u=Fa(c,o,r,s.definition),d=Pa(t),f=await a.get(`delivery`,d);if(!n&&Ia(f,s.version,u)||f&&f.version>s.version)return;let p={version:s.version,manifest:u,pending:!0};await a.put(`delivery`,d,p);try{let t=await l(o,T(e.config,o.credentials),{publicUrl:r,definition:s.definition,fetch:e.fetch??fetch,tokens:ba({...e,store:a},o.integration),saveCredentials:async t=>{await a.put(`app`,o.id,{...o,credentials:w(e.config,t)})}});return t&&await a.put(`app`,o.id,{...o,credentials:w(e.config,t)}),await a.put(`delivery`,d,{...p,pending:!1}),{app:o}}catch(e){let t=`Could not sync ${o.integration} app ${o.id}. ${e instanceof Error?e.message:String(e)}`;return await a.put(`delivery`,d,{...p,error:t}),{app:o,error:t}}})))).filter(e=>e!==void 0)}async function za(e,t){let n=(await Ra(e,t)).flatMap(({app:t,error:n})=>n&&e.integrations[t.integration]?.app.update?[n]:[]);if(n.length)throw Error(n.join(`
-`))}function Ba(){return{integration:`source`,type:`import`,appId:``,installationId:``,deliveryId:``,actor:{id:`admin`},text:``}}async function Va(e,t,n,r=Ba(),i){let a=await ja(e.integrations,{config:e.config,store:e.store},t,r);if(!a)return;let o=await Na(e.store,a.contents,t,n,a.token,(e.now??Date.now)(),i?{branch:i}:{});return await za(e,o),o}const Ha=`default`;async function Ua(e){if(!e.databaseUrl)throw Error(`DATABASE_URL is required for the Postgres store`);let{connect:t}=await import(`./client-DzwzCsue.js`).then(e=>e.n);return t(e.databaseUrl,e.databasePool)}async function Wa(e,t={}){if(e.store!==`postgres`){let e=t.local?new Fn:new Mn;return{store:()=>e,queue:new Ap(e),chatState:new Vn(t.local?z.join(Ue(``),`chat.json`):void 0),defaultOrganizationId:Ha,webhookTarget:async(t,n)=>{let r=await e.get(`app`,t),i=n?await e.get(`installation`,n):void 0;if(r&&n&&(!i||i.deletedAt))for(let{value:r}of await e.list(`app`,{prefix:`${t}/`})){let i=await e.get(`installation`,`${r.id}${n.slice(t.length)}`);if(i&&!i.deletedAt)return{organizationId:Ha,app:r,bound:{organizationId:Ha,installation:i}}}return r&&{organizationId:Ha,app:r,...i&&i.app===t&&!i.deletedAt?{bound:{organizationId:Ha,installation:i}}:{}}},appRecord:async t=>{let n=await e.get(`app`,t);return n&&{organizationId:Ha,app:n}},apps:async t=>(await e.list(`app`,{prefix:`${t}:`})).map(e=>({organizationId:Ha,app:e.value})),installationOrganization:async t=>await e.get(`installation`,t)?Ha:void 0,installations:async t=>(await e.list(`installation`,{prefix:`${t}:`})).filter(e=>!e.value.deletedAt).map(e=>({key:e.id,organizationId:Ha})),taskOrganization:async(t,n)=>(await e.get(`task`,t))?.tokenHash===n?Ha:void 0,sweep:async()=>{},close:async()=>{}}}let n=await Ua(e),[{DrizzleStore:r},{DrizzleQueue:i},{UNSCOPED_ORGANIZATION:a},{PgChatState:o}]=await Promise.all([Promise.resolve().then(()=>Zs),Promise.resolve().then(()=>nc),Promise.resolve().then(()=>es),import(`./chat-AbW-LOHo.js`)]);return{store:t=>new r(n.db,t,Date.now,e),queue:new i(n.db),chatState:new o(n.db),defaultOrganizationId:a,webhookTarget:(e,t)=>r.webhookTarget(n.db,e,t),appRecord:e=>r.appRecord(n.db,e),apps:e=>r.apps(n.db,e),installationOrganization:e=>r.installationOrganization(n.db,e),installations:e=>r.installations(n.db,e),taskOrganization:(e,t)=>r.taskOrganization(n.db,e,t),connection:n,sweep:e=>new r(n.db,a).sweep(e),close:()=>n.close()}}async function Ga(e,t,n,r){return e.updateMetadata(t,n,r)}async function Ka(e,t){return e.getApps([...new Set(t)])}async function qa(e,t,n,r,i){let a=await t.store.get(`app`,n);if(!a)return S({error:`Unknown app`},404);let o=t.config.publicUrl;if(!o)return S({error:`PUBLIC_URL is not set on this server`},400);let s=await zr(t,`install`,t.session?.user.id??`anonymous`,a.id),c=sn({tx:s,...r?{back:r}:{},...i?{link:i}:{}});return S({url:`${o.replace(/\/$/,``)}/install/${a.integration}?app=${encodeURIComponent(a.id)}&state=${c}`})}async function Ja(e,t){let n=e.serverOrganizationId,[r,i]=await Promise.all([e.store.list(`app`),n!==void 0&&n!==e.organizationId&&e.scope?e.scope(n).store.list(`app`).then(t=>t.filter(({value:t})=>t.builtin&&e.integrations[t.integration]?.app.builtin===`shared`)):[]]);return[...r,...i].filter(({value:n})=>(!n.builtin||e.integrations[n.integration]?.app.builtin===`shared`)&&(!t||n.agent===t))}function Ya(e,t){let{credentials:n,...r}=t,i=t.builtin?void 0:e.integrations[t.integration]?.app.settingsUrl?.(t,T(e.config,n));return{...r,...i?{settingsUrl:i}:{}}}async function Xa(e,t){let n=e.config.publicUrl,r=t.filter(t=>!t.builtin&&!t.shared&&e.integrations[t.integration]?.app);if(!n||!r.length)return new Set;let[i,a]=await Promise.all([e.store.list(`delivery`,{ids:r.map(e=>Pa(e.id))}),e.store.listAgentsWithVersions([...new Set(r.map(e=>e.agent))])]),o=e=>i.find(t=>t.id===Pa(e))?.value;return new Set(r.filter(t=>{let r=e.integrations[t.integration].app,i=a.find(e=>e.record.id===t.agent)?.version;return i?.definition.integrations[t.integration]?r.update?!Ia(o(t.id),i.version,Fa(r,t,n,i.definition)):o(t.id)?.changed===!0:!1}).map(e=>e.id))}async function Za(e,t,n,r){let i=await Ja(t,r.searchParams.get(`agent`)),a=await Xa(t,i.map(({value:e})=>e));return S(i.map(({id:e,value:n})=>({id:e,value:{...Ya(t,n),...a.has(e)?{changed:!0}:{}}})))}async function Qa(e,t,n){let r=await t.store.get(`app`,n.id);if(!r)return S({error:`Unknown app`},404);if(r.builtin)return S({error:`Only whoever runs this server can remove its shared apps.`},403);let i=t.now?.()??Date.now(),a=await t.store.list(`installation`),o=new Set(a.filter(({value:e})=>e.app===r.id).map(({id:e})=>e));for(let{id:e,value:n}of a){if(o.has(e)){n.deletedAt||await Ga(t.store,`installation`,e,{deletedAt:i});continue}let r=Object.entries(n.connections??{}),a=r.filter(([,e])=>!o.has(e.id));a.length<r.length&&await Ga(t.store,`installation`,e,{connections:a.length?Object.fromEntries(a):void 0})}return await t.store.delete(`app`,r.id),await Gu(t.store,r.id),S({ok:!0})}async function $a(e,t){let n=await e.store.get(`app`,t);if(!n)return S({error:`Unknown app`},404);if(n.builtin||n.shared)return S({error:`Only whoever runs this server can update its shared apps.`},403);if(!e.config.publicUrl)return S({error:`PUBLIC_URL is not set on this server`},400);let r=e.integrations[n.integration];if(!r||!(r.app.update||r.app.drift||r.app.values))return S({error:`Coder cannot update ${r?.name??n.integration} apps.`},400);let i=await On(e.store,n.agent);return i?.definition.integrations[n.integration]?{app:n,version:i,integration:r}:S({error:`The agent no longer listens on ${r.name}.`},400)}async function eo(e,t,n){let r=await $a(t,n.id);if(r instanceof Response)return r;if(r.integration.app.update)return S({error:`Coder updates ${r.integration.name} apps itself.`},400);try{return S(await La(t,t.store,r.app,r.version))}catch(e){return console.error(`coder server: reading ${r.app.id} on ${r.integration.name} failed`,e),S({error:e instanceof Error?e.message:String(e)},502)}}async function to(e,t,n){let r=await $a(t,n.id);if(r instanceof Response)return r;let{app:i,version:a,integration:o}=r;if(o.app.values){let{lines:e}=o.app.values(i,{publicUrl:t.config.publicUrl,definition:a.definition});return await t.store.put(`delivery`,Pa(i.id),{version:a.version,manifest:e,changed:!1}),S({updated:!0})}if(!o.app.update)return S({error:`Change the app on ${o.name}; Coder cannot.`},400);let[s]=await Ra(t,[a],i.id);return s?.error?S({error:s.error},502):S({updated:!0})}async function no(e,t,n,r){let i=r.searchParams.get(`agent`),a=await t.store.list(`installation`,{...i?{agent:i}:{},...r.searchParams.get(`active`)===`1`?{active:!0,includeUninstalled:!0}:{},limit:Zt(r,200)});return S(a.map(({id:e,value:n})=>{let{token:r,connections:i,...a}=n,o=n.account.url??t.integrations[n.integration]?.app.accountUrl?.(n.account);return{id:e,value:{...a,account:{...a.account,...o?{url:o}:{}}}}}))}async function ro(e,t){let n=e.config.publicUrl,r=n?Sm.has(new URL(n).hostname):!1,i=r?`https://<public address>`:n,a=t.searchParams.get(`agent`),o=e.store.list(`app`),[s,c,l]=await Promise.all([a?Nn(e.store,a):void 0,Th(e,o),o]),u=s?.record,d=new Set(c.map(e=>e.integration));return S(await Promise.all(Object.values(e.integrations).map(async n=>{let a=typeof n.use==`function`?n.use(xt(s?.version?.definition.integrations[n.id])):n.use;return{id:n.id,name:n.name,brand:n.brand,description:n.description,installLabel:n.installLabel??`Connect ${n.id}`,...a?{use:a}:{},...n.covered?{covered:n.covered}:{},...n.featured?{featured:!0}:{},builtinApp:n.app.builtin,...n.auth.user?{personal:!0}:{},...await Bf(e,n.id,void 0,[...c,...l.map(e=>e.value)])?{connectable:!0}:{},organizationApps:n.organizationApps===!0,publicApps:n.publicApps===!0,events:Object.fromEntries(Object.entries(n.events).map(([e,{description:t,noisy:n,addressed:r}])=>[e,{description:t,...n?{noisy:n}:{},...r?{addressed:r}:{}}])),repositories:!!n.repos,...n.app.createStep&&i?{create:n.app.createStep(i,{saved:await ya(e,n.id),name:u?.name,shared:d.has(n.id),public:n.publicApps===!0&&t.searchParams.get(`public`)===`1`})}:{},...r?{unreachable:!0}:{},...n.app.update?{appUpdate:`push`}:n.app.drift?{appUpdate:`drift`}:n.app.values?{appUpdate:`confirm`}:{}}})))}async function io(e,t,n=!1,r){let i=t;if(i.deletedAt)return;if(!n&&i.repos!=null&&(!r||i.repos.includes(r.repo)))return i;let a=e.integrations[i.integration];if(!a?.repos)return i;let o=e.repositoryLists??=new Map,s=o.get(i.id);return s||(s=ao(e,a,i,r).finally(()=>o.delete(i.id)),o.set(i.id,s)),s}async function ao(e,t,n,r){let i=r?.app??await e.store.get(`app`,n.app);if(!i)throw Error(`Missing app for installation ${n.id}`);let a=r?.token??await qu(e,t,n,T(e.config,i.credentials)),o=await t.repos.list(Uu(e,n),a,e.fetch??fetch);return e.store.withAppLock(`repositories:${n.id}`,async e=>{let t=await e.get(`installation`,n.id);if(!(!t||t.deletedAt))return JSON.stringify(t.repos)===JSON.stringify(n.repos)?(await Ga(e,`installation`,t.id,{repos:o}),{...t,repos:o}):{...t,repos:t.repos??o}})}async function oo(e,t=!1){let n=new Map,r=(await e.store.list(`installation`,{active:!0})).filter(({value:t})=>e.integrations[t.integration]?.repos),i=Array(r.length),a=0;await Promise.all(Array.from({length:Math.min(4,r.length)},async()=>{for(let n=a++;n<r.length;n=a++){let a=r[n].value;i[n]=t||a.repos==null?await io(e,a,t).catch(e=>(console.error(`coder server: repositories for installation ${a.id} failed`,e),a)):a}}));for(let e of i)if(!(!e||e.deletedAt))for(let t of e.repos??[])n.has(t)||n.set(t,{repo:t,integration:e.integration});return S([...n.values()].sort((e,t)=>e.repo.localeCompare(t.repo)))}var U=class extends Error{status;fix;constructor(e,t=400,n){super(e),this.status=t,this.fix=n}};function so(e,t,n){if(n?.problems?.length)throw new U(n.problems.join(`
-`),409);if(n?.settings?.disabled)throw new U(`Agent "${t}" is disabled in this workspace. Enable it in its settings to start tasks.`,409,`${e.config.publicUrl?.replace(/\/$/,``)??``}${mh(fh(e),`/agents/${encodeURIComponent(t)}/settings`)}`)}function co(e,t){if(t.cwd===void 0)return;if(!e.local)throw new U(`cwd is available on a local server only`);let n=da(t.cwd);if(!n.ok)throw new U(n.detail);return n.folder.path}const lo=/^[a-z0-9][a-z0-9_-]*$/i,uo=new Set([`claude`,`codex`,`custom`]),fo=new Set([`low`,`medium`,`high`]);function po(e){let t=e.flow??`default`;if(!lo.test(t))throw new U(`Invalid flow "${t}"`);if(e.prompt!==void 0&&typeof e.prompt!=`string`)throw new U(`prompt must be text`);if(t==="default"&&!e.prompt?.trim())throw new U(`prompt is required`);if((e.prompt?.length??0)>65536)throw new U(`prompt is longer than 64 KB`);if(e.repo!==void 0&&!/^[\w.-]+\/[\w.-]+$/.test(e.repo))throw new U(`repo must be owner/name`);if(e.pr!==void 0&&(!Number.isInteger(e.pr)||e.pr<1||!e.repo))throw new U(`pr needs a repo and a pull request number`);if(e.engine!==void 0&&!uo.has(e.engine))throw new U(`Unknown engine "${e.engine}"`);if(e.effort!==void 0&&!fo.has(e.effort))throw new U(`Unknown effort "${e.effort}"`);if(e.permissions!==void 0&&!(e.permissions in ee))throw new U(`Unknown permissions "${e.permissions}"`);if(e.mcp!==void 0&&(!Array.isArray(e.mcp)||!e.mcp.every(e=>lo.test(e))))throw new U(`mcp must list server names`);if(e.connections!==void 0&&(!Array.isArray(e.connections)||!e.connections.every(e=>typeof e==`string`&&e.length>0)))throw new U(`connections must list connection ids`);if(e.outputSchema!==void 0&&(!e.outputSchema||typeof e.outputSchema!=`object`||Array.isArray(e.outputSchema)))throw new U(`outputSchema must be an object`);if(e.args!==void 0&&(typeof e.args!=`object`||Array.isArray(e.args)))throw new U(`args must be an object`)}async function mo(e,t){let n=(await e.store.list(`installation`)).filter(({value:t})=>!t.deletedAt&&e.integrations[t.integration]?.repos).sort((e,n)=>Number(n.value.repos?.includes(t)??!1)-Number(e.value.repos?.includes(t)??!1)),r=new Map((await Ka(e.store,n.map(({value:e})=>e.app))).map(({id:e,value:t})=>[e,t]));for(let{value:i}of n){let n=e.integrations[i.integration];if(i.deletedAt||!n?.repos)continue;let a=r.get(i.app);if(a)try{let r=await qu(e,n,i,T(e.config,a.credentials)),o=i.repos?.includes(t)?i:await io(e,i,!1,{app:a,token:r,repo:t});if(!o?.repos?.includes(t))continue;return{integration:n,installation:o,app:a,token:r}}catch(e){console.error(`coder server: repository token for ${i.id} failed`,e)}}throw new U(`No install in this workspace reaches ${t}`,404)}async function ho(e,t,n,r){let i=n.repo,{integration:a,installation:o,app:s,token:c}=await mo(e,i),l=await a.repos.get(i,c);return{event:{integration:a.id,type:n.pr?`pull_request`:`task`,appId:s.id,installationId:o.id.slice(s.id.length+1),deliveryId:t,actor:{id:r??``},text:n.prompt??``,...n.pr?{chat:{thread:a.repos.pullRequestThread(i,n.pr)}}:{},repo:l},author:a.author?.(s.name)??s.name}}async function go(e,t,n){po(n);let r=co(e,n),i=(e.now??Date.now)(),a=e.session?.user.id,o=n.agent||ft();if(!o)throw new U(`Name an agent: this server has no default agent.`);o===ft()&&await jn(e,i),e.local&&await kn(e.store,e.local.cwd,e.integrations);let{record:s,version:c}=await Nn(e.store,o),l=await yn(e,{requester:a,runner:n.runner,agent:c?.definition.runner}).catch(e=>{throw new U(e.message)});if(!s||!c)throw new U(`No agent "${o}"`,404);so(e,o,s);let u={...n.engine?{engine:n.engine}:{},...n.model?{model:n.model}:{},...n.effort?{effort:n.effort}:{},...n.permissions?{permissions:n.permissions}:{}},d=Tn(s,c,u,e.integrations),f=pt(d),{engine:p,credential:m,usable:h,chain:g,credentials:_}=await of(e,f,a);if(!h&&l.runner!==`http`)throw new U(`No ${p} credential is connected`,409,await vf(e,p));let v=`${i.toString(36)}-${wr(4).toString(`hex`)}`,y=n.repo?await ho(e,v,n,a):void 0,b={id:v,source:t,agent:d.id,flow:n.flow??`default`,...l,permissions:f.permissions,...y?{event:y.event,author:y.author}:{},...r&&!y?{cwd:r}:{},...n.prompt?{prompt:n.prompt}:{},...n.args?{args:n.args}:{},...n.mcp?.length?{mcp:n.mcp}:{},definition:d.definition,engineChain:g,engineCredentials:_,...m?{credential:m}:{},...a?{requester:a}:{},...d.files?{files:d.files}:{},usage:{...d.usage,engine:p},tools:{},connections:await ua(e,a,fe(d.usage?.connections,n.connections)),...e.session||n.outputSchema?{context:{...e.session?{user:{name:e.session.user.name,email:e.session.user.email}}:{},...n.outputSchema?{outputSchema:n.outputSchema}:{}}}:{}};return e.local&&l.runner===`local`&&!l.runnerId?Ed(e,b):(await e.queue.enqueue(e.organizationId,b,i,void 0,e.config.maxQueued??1e3),{task:b,status:`queued`,attempts:0,createdAt:i,updatedAt:i})}function _o(e){return e.turns?e.turns:[...e.task.context?.turns??[],{prompt:e.task.prompt??e.task.event?.text??e.task.name??``,result:e.result,error:e.error,finishedAt:e.finishedAt,...[`completed`,`failed`,`cancelled`].includes(e.status)?{logSeq:e.logSeq}:{}}]}async function vo(e,t,n,r,i={}){if(r!==void 0&&(!r||typeof r!=`object`||Array.isArray(r)))throw new U(`outputSchema must be an object`);if(!n.trim())throw new U(`text is required`);if(n.length>65536)throw new U(`text is longer than 64 KB`);let{model:a,effort:o,permissions:s}=i;if(a!==void 0&&(typeof a!=`string`||!a.trim()))throw new U(`model must be text`);if(o!==void 0&&!fo.has(o))throw new U(`Unknown effort "${o}"`);if(s!==void 0&&!(s in ee))throw new U(`Unknown permissions "${s}"`);let c=e=>Object.keys(ee).indexOf(e??`auto`);if(s!==void 0&&c(s)>c(t.task.permissions))throw new U(`permissions can only be lowered on a resumed task (it runs ${t.task.permissions??`auto`})`);if(e.session&&t.task.requester&&t.task.requester!==e.session.user.id)throw new U(`Only the member who asked can continue this task`,403);let l=(e.now??Date.now)(),u=t.task.context?.messages??[],d=String(t.finishedAt??l),f=[...u,{user:`user`,text:t.task.prompt??t.task.event?.text??``,ts:String(t.createdAt)},{user:`agent`,text:t.result?.output??t.error??``,ts:d}].slice(-20),p=t.task.context??{},m=_o(t);m.at(-1).finishedAt??=l;let h={task:{...t.task,prompt:n,...a||o?{usage:{...t.task.usage,...a?{model:a}:{},...o?{effort:o}:{}}}:{},...s?{permissions:s}:{},context:{...p,...r?{outputSchema:r}:{},messages:f,turns:m}},status:`queued`,attempts:0,generation:(t.generation??0)+1,...t.logSeq===void 0?{}:{logSeq:t.logSeq},...t.logBytes===void 0?{}:{logBytes:t.logBytes},createdAt:t.createdAt,updatedAt:l};if(!await e.queue.continueTask(e.organizationId,t.task.id,h.task,l,{attempts:t.attempts,tokenHash:t.tokenHash??null,generation:t.generation??0}))throw new U(`Task is already active`,409);return h}const yo={principalPerMinute:300,ipPerMinute:60,authPerMinute:20,registerPerMinute:10,pairingPerMinute:5,concurrentTasks:10};var bo=class{buckets=new Map;sweptAt;startedAt;requests=0;rejections=0;constructor(e=Date.now()){this.startedAt=this.sweptAt=e}consume(e,t,n){if(n-this.sweptAt>=6e4){for(let[e,t]of this.buckets)n-t.at>=6e4&&this.buckets.delete(e);this.sweptAt=n}let r=this.buckets.get(e),i=r?Math.min(t,r.tokens+Math.max(0,n-r.at)*t/6e4):t,a=i<1;if(this.buckets.set(e,{tokens:a?i:i-1,at:n}),!a)return;this.rejections++;let o=Math.max(1,Math.ceil((1-i)*60/t));return S({error:`Too many requests. Try again in ${o} seconds.`},429,{"retry-after":String(o)})}};const xo=[[e=>e===`/admin/runners/pair`,`pairing`],[e=>e===`/runners/register`,`register`],[e=>e.startsWith(`/admin/`)||e.startsWith(`/runners/`)],[e=>e.startsWith(`/api/auth`)||e===`/login`||e===`/dash/token`,`auth`]];async function So(e,t,n){let r=new URL(e.url).pathname,i=xo.find(([e])=>e(r));if(!i)return(r===`/dash`||r.startsWith(`/dash/`))&&t.auth&&!await t.auth.session(e.headers)?Co(t,void 0,n,`auth`)??{}:{};let a=r.startsWith(`/admin/`)?await jm(e,t):void 0;return Co(t,r===`/runners/register`?await Nm(e,t):a&&!(a instanceof Response)?a.session?`user:${a.session.user.id}`:`admin`:void 0,n,i[1])??{scope:a}}function Co(e,t,n,r){let i=e.limits??=new bo((e.now??Date.now)()),a={...yo,...e.config.limits},o=(e.now??Date.now)(),s=t??`ip:${n}`,c=i.consume(s,t?a.principalPerMinute:a.ipPerMinute,o);return c||!r?c:r===`pairing`?i.consume(`pair:${s}`,a.pairingPerMinute,o):i.consume(`${r}:ip:${n}`,r===`auth`?a.authPerMinute:a.registerPerMinute,o)}const wo=Symbol(`miss`);function To(e,t){return new Proxy(e,{get(e,n){let r=Reflect.get(e,n,e);if(typeof r!=`function`)return r;let i=r.bind(e),a=t[n];return a?async(...e)=>{let t=a(...e);return t===wo?i(...e):t}:i}})}const Eo=(e,t)=>e.length===t.length&&e.every((e,n)=>e===t[n]);function Do(e,t,n){let r=t.task,i=r.event,a=e=>e in n,o=`connections:${r.id}:${t.generation??0}:${t.attempts}:`;return To(e,{get:(e,t)=>e===`app`&&a(`app`)&&t===i?.appId?n.app:e===`installation`&&a(`installation`)&&t===`${i?.appId}:${i?.installationId}`?n.installation:e===`credential`&&a(`credential`)&&t===r.credential?n.credential:e===`config`&&a(`config`)&&t===`workspace`?n.config:e===`runner`&&a(`runner`)&&t===r.runnerId?n.runner:e===`snapshot`&&a(`secrets`)&&t===`connection-secrets:${r.id}`?n.secrets?.old:e===`snapshot`&&a(`resolved`)&&t.startsWith(o)?n.resolved?.id===t?n.resolved.value:void 0:wo,list:(e,t)=>e===`snapshot`&&a(`secrets`)&&t?.prefix===`connection-secrets:${r.id}:`?n.secrets.rows.map((e,n)=>({id:`${t.prefix}${n}`,value:{secret:e}})):wo,listCredentials:e=>a(`credentials`)&&e.owner===r.requester&&e.limit===void 0?n.credentials??[]:wo,heldTokens:(e,t)=>a(`tokens`)&&n.installation&&Eo(e,[n.installation.id])&&Eo(t,[n.installation.app])?n.tokens:wo})}function Oo(e,t,n){let r=e=>e===void 0||e===t.requester,i=(e,t)=>!e.owner||e.owner===t,a=Object.values(n.installation.connections??{}).flatMap(e=>e.kind===`installation`?[e.id]:[]),o=[n.installation.id,...a],s=[n.installation.app,...t.linked.map(e=>e.app.id)];return To(e,{get:(e,r)=>e===`agent`&&r===n.agent?t.record:e===`snapshot`&&n.files.some(e=>r.startsWith(e))?t.files[r]:wo,installationApp:e=>a.includes(e)?t.linked.find(t=>t.installation.id===e):wo,conversationState:e=>e===n.conversation?t.conversation:wo,listCredentials:e=>r(e.owner)&&e.limit===void 0?t.credentials.filter(t=>i(t.value,e.owner)):wo,list:(e,n)=>e===`runner`&&n?.defaults&&!n.runner&&r(n.visibleTo)?t.runners.filter(e=>i(e.value,n.visibleTo)):e===`connection`&&!n?.ids&&!n?.secrets&&r(n?.visibleTo)?t.connections.filter(e=>i(e,n?.visibleTo)).map(e=>({id:e.id,value:e})):wo,heldTokens:(e,n)=>e.every(e=>o.includes(e))&&n.every(e=>s.includes(e))?t.tokens:wo})}function ko(e,t,n){let r;return Promise.race([e,new Promise((e,i)=>{r=setTimeout(()=>i(Error(`${n} timed out`)),t),r.unref?.()})]).finally(()=>clearTimeout(r))}async function Ao(e,t,n,r){try{await ko(t.stop(n),e.runnerTimeoutMs??1e4,`runner stop`)}catch(e){return console.error(`coder server: runner stop ${r} failed`,e),!1}return!0}async function jo(e,t,n,r={}){let i=t.handle?await pn(e,t.task):void 0,a=await e.queue.finish(e.organizationId,t.task.id,{status:`failed`,error:n},(e.now??Date.now)(),{attempts:t.attempts,tokenHash:t.tokenHash??null,generation:t.generation??0,...r});return a&&await Po(e,t,!0,i),a}async function Mo(e,t,n){if(e.local&&t.handle?.startsWith(`cli:`))return bd(e,t,n);let r=t.handle?await pn(e,t.task):void 0,i={handle:t.handle??null,lastSeenAt:t.lastSeenAt??null,updatedAt:t.updatedAt};if(t.cancelRequestedAt!==void 0&&n-t.cancelRequestedAt>=3e4){let i=await e.queue.finish(e.organizationId,t.task.id,{status:`cancelled`,error:`The runner did not acknowledge cancellation within 30 seconds`},n,{attempts:t.attempts,tokenHash:t.tokenHash,generation:t.generation??0});return i&&await Po(e,t,!0,r),i}if(!t.handle)return n-(t.lastSeenAt??t.startedAt??t.updatedAt)<(e.config.taskStallMs??3e5)?!1:t.attempts>=(e.config.taskAttempts??2)?jo(e,t,`runner start was interrupted`,i):e.queue.requeue(e.organizationId,t.task.id,n,{generation:t.generation??0,attempts:t.attempts,tokenHash:t.tokenHash??null,...i});if(t.startedAt!==void 0&&n-t.startedAt>=e.config.taskTimeoutMs)return jo(e,t,`timeout`);if(!r||n-(t.lastSeenAt??t.startedAt??t.updatedAt)<Math.min(e.config.taskStallMs??6e4,6e4)||!await e.store.withAppLock(`runner-status:${e.organizationId}:${t.task.id}`,async e=>{let r=`runner-status:${t.task.id}:${t.generation??0}:${t.attempts}`,i=await e.get(`delivery`,r);return i&&`at`in i&&i.at!==void 0&&n-i.at<3e4?!1:(await e.put(`delivery`,r,{at:n},{ttlMs:6e4}),!0)}))return!1;let a=await ko(r.status(t.handle),e.runnerTimeoutMs??1e4,`runner status`);return a.state===`exited`?jo(e,t,`runner exited${a.code===void 0?``:` with code ${a.code}`}`,{handle:t.handle,lastSeenAt:t.lastSeenAt??null}):jo(e,t,`The runner stopped reporting heartbeats`,{handle:t.handle,lastSeenAt:t.lastSeenAt??null})}async function No(e,t){return[`running`,`waiting`].includes(t.status)&&await Mo(e,t,(e.now??Date.now)()).catch(()=>!1)?await e.store.get(`task`,t.task.id)??t:t}async function Po(e,t,n=!1,r){let i=`${e.organizationId}:${t.task.id}:${t.attempts}`,a=e.settings?.cancelChecks?.get(i);if(a&&(clearTimeout(a.timer),a.finish(),e.settings.cancelChecks.delete(i)),!t.handle||t.logsComplete)return;let o=r??await pn(e,t.task);o&&(n||o.kind===`vercel-sandbox`||o.kind===`local-docker`)&&!await Ao(e,o,t.handle,t.task.id)||await e.queue.patchTask(e.organizationId,t.task.id,{logsComplete:!0},(e.now??Date.now)(),{attempts:t.attempts,tokenHash:t.tokenHash,generation:t.generation??0,handle:t.handle})}function Fo(e,t){let n=`${e.organizationId}:${t.task.id}:${t.attempts}`,r=(e.settings??={}).cancelChecks??=new Map;if(r.has(n))return;let i=new Promise(e=>{let t=setTimeout(e,3e4);r.set(n,{timer:t,finish:e})}).then(async()=>{r.delete(n);let i=await e.store.get(`task`,t.task.id);i&&i.attempts===t.attempts&&i.tokenHash===t.tokenHash&&await No(e,i)}).catch(e=>console.error(`coder server: cancellation check failed`,e));e.waitUntil&&e.waitUntil(i)}async function Io(e,t,n){let r=e.now??Date.now,i=e.config.limits?.concurrentTasks??yo.concurrentTasks,a=e.config.store===`postgres`?e.config.maxTasks:Math.min(i,e.config.maxTasks??i);{t&&e.local?await gd(e,e.local.cwd):t&&await e.queue.archiveStopped(void 0,r());let n=await e.queue.running(),i=0;for(let t of n)await Mo(V(e,t.organizationId),t.status,r()).catch(()=>!1)&&i++;if(a!==void 0&&n.length-i>=a)return}let o=[];for(;;){let t=e.local?hd(e.local.cwd,!1).filter(e=>e.status===`running`||e.status===`waiting`):[],s=t.length?new Set((await e.queue.running()).flatMap(e=>[e.status.task.id,...e.status.handle?.startsWith(`cli:`)?[e.status.handle.slice(4)]:[]])):new Set,c=t.filter(t=>!s.has(t.task.id)&&!s.has(x(t.task.cwd??e.local.cwd,t.task.id)?.flowRunId??``)).length,l=a===void 0?void 0:a-c;if(l!==void 0&&l<=0)break;let u=await e.queue.claim(r(),l,n,i);if(n=!1,!u)break;let d=u.status,f=V(e,u.organizationId),p=u.loaded&&f.store?{...f,store:Do(f.store,d,u.loaded)}:f;if(await yd(p,d,u.token)){if(n=u.more,!u.more)break;continue}let m=await pn(p,d.task);if(!m){await jo(p,d,`No runner available: ${d.task.runner}`);continue}let h=d,g={generation:d.generation??0,attempts:d.attempts,tokenHash:d.tokenHash??null,statuses:[`running`,`waiting`]},_;try{let e=m.kind===`vercel-sandbox`?await id(p,d.task):void 0,t=e?[e,...(await ad(p,d.task)).map(e=>e.credential)]:[],i=await Promise.all(t.map(e=>cd(p,d.task,e))),a=m.start(d.task,{CODER_SERVER:p.local&&m.kind===`local`?`http://localhost:${p.local.port}`:p.config.publicUrl??``,CODER_TASK_TOKEN:u.token,CODER_INBOX_MODE:m.push?`push`:`poll`},e?Object.assign({},...t.map(e=>e.env).reverse()):void 0,{timeoutMs:p.config.taskTimeoutMs+6e4,waitUntil:p.waitUntil,...e?{hosts:i.some(e=>e===void 0)?void 0:[...new Set(i.flatMap(e=>e??[]))],brokered:await ku(p.store).then(e=>t.flatMap(t=>sd(e,d.task,t)))}:{}});if(_=await ko(a,p.runnerTimeoutMs??3e4,`runner start`).catch(e=>{throw a.then(e=>Ao(p,m,e,d.task.id),()=>{}),e}),await p.queue.patchTask(u.organizationId,d.task.id,{handle:_},r(),g)||await Ao(p,m,_,d.task.id),n=u.more,!u.more)break}catch(e){_!==void 0&&await Ao(p,m,_,d.task.id);let t=e instanceof Error?e.message:String(e);if(d.attempts<(p.config.taskAttempts??2)){o.push({...u,status:h});continue}await jo(p,h,t)}}for(let t of o)await V(e,t.organizationId).queue.requeue(t.organizationId,t.status.task.id,r(),{attempts:t.status.attempts,tokenHash:t.status.tokenHash})}function Lo(e,t=!1,n=!1,r=!1){let i=e.queue.scheduler??={},a=t?i.waiting:void 0;if(a)return a;let o=i.running??Promise.resolve(),s=()=>(i.waiting===c&&delete i.waiting,Io(e,n,r)),c=o.then(s,s);return i.waiting=c,i.running=c.catch(()=>{}),c}function Ro(e,t=!1){let n=Lo(e,!0,!1,t).catch(()=>{});e.waitUntil&&e.waitUntil(n)}var zo=r({addUsage:()=>Ho,leaders:()=>Go,readUsage:()=>Qo,readUsageTotals:()=>$o,sumUsageTotals:()=>Wo,timeZone:()=>Vo,usageReport:()=>Zo,usageSummary:()=>Jo,usageTotals:()=>Uo});function Bo(e){return typeof e==`number`?e:!e||typeof e!=`object`||Array.isArray(e)?0:`total`in e&&typeof e.total==`number`?e.total:Object.values(e).reduce((e,t)=>e+Bo(t),0)}function Vo(e){if(!e)return`UTC`;try{return new Intl.DateTimeFormat(`en`,{timeZone:e}),e}catch{return`UTC`}}const Ho=(e,t)=>{e.tasks+=t.tasks,e.runnerMs+=t.runnerMs,e.tokenCount+=t.tokenCount};async function Uo(e,t){return e.usageTotals(t)}async function Wo(e,t){if(t.top){let{top:n,...r}=t,i=(await Uo(e,{...r,by:`agent`,parts:void 0})).sort((e,t)=>t[n.by]-e[n.by]||e.key.localeCompare(t.key)).slice(0,n.count).map(e=>e.key);return Uo(e,{...r,parts:i})}let n=Vo(t.tz),r=new Intl.DateTimeFormat(`en-CA`,{timeZone:n,year:`numeric`,month:`2-digit`,day:`2-digit`}),i=new Set(t.parts),a=new Map;for(let{value:n}of await e.list(`usage`)){if(n.at<t.since||t.until!==void 0&&n.at>=t.until||t.agent&&n.agent!==t.agent)continue;let e=t.by===`agent`?n.agent:t.by===`installation`?n.installationId??`none`:t.by===`engine`?n.engine??`unknown`:r.format(n.at),o={tasks:1,runnerMs:n.runnerElapsedMs,tokenCount:Bo(n.tokens)},s=a.get(e)??{key:e,tasks:0,runnerMs:0,tokenCount:0};Ho(s,o),i.has(n.agent)&&(s.parts??={},Ho(s.parts[n.agent]??={tasks:0,runnerMs:0,tokenCount:0},o)),a.set(e,s)}return[...a.values()].sort((e,t)=>e.key.localeCompare(t.key))}function Go(e,t){let n=new Map;for(let r of e)for(let[e,i]of Object.entries(r.parts??{}))n.set(e,(n.get(e)??0)+i[t]);return[...n].sort((e,t)=>t[1]-e[1]||e[0].localeCompare(t[0])).map(([e])=>e)}function Ko(e,t){if(typeof t==`number`)return(typeof e==`number`?e:0)+t;if(!t||typeof t!=`object`||Array.isArray(t))return e;let n=e&&typeof e==`object`&&!Array.isArray(e)?{...e}:{};for(let[e,r]of Object.entries(t))n[e]=Ko(n[e],r);return n}function qo(e,t){let n=new Map;for(let r of e){let e=t===`agent`?r.agent:t===`installation`?r.installationId??`none`:r.engine??`unknown`,i=n.get(e)??{key:e,tasks:0,runnerMs:0};i.tasks++,i.runnerMs+=r.runnerElapsedMs,r.tokens!==void 0&&(i.tokens=Ko(i.tokens,r.tokens)),n.set(e,i)}return[...n.values()].sort((e,t)=>e.key.localeCompare(t.key))}function Jo(e,t,n){let r=e.filter(e=>e.at>=t);return{since:t,totals:n?qo(r,n):{agent:qo(r,`agent`),installation:qo(r,`installation`),engine:qo(r,`engine`)}}}const Yo={tasks:`tasks`,runner:`runnerMs`,tokens:`tokenCount`},Xo={tokens:e=>e.tokenCount,tasks:e=>e.tasks,runner:e=>e.runnerMs,name:e=>e.key};async function Zo(e,t){let n=e=>t.searchParams.get(e),r=Number(n(`since`)??0),i=n(`until`)===null?void 0:Number(n(`until`)),a=n(`by`)??`agent`;if(!Number.isFinite(r)||i!==void 0&&!Number.isFinite(i)||![`agent`,`installation`,`engine`,`day`].includes(a))return S({error:`Invalid usage query`},400);let o=n(`parts`)?.split(`,`).filter(Boolean),s=Math.min(Number(n(`top`)??0),8),c=Yo[n(`sort`)??`tokens`]??`tokenCount`,l=await Uo(e.store,{by:a,since:r,...i===void 0?{}:{until:i},...n(`agent`)?{agent:n(`agent`)}:{},...a===`day`?{tz:Vo(n(`tz`))}:{},...o?.length?{parts:o.slice(0,20)}:{},...s>0?{top:{count:s,by:c}}:{}}),u={since:r,...i===void 0?{}:{until:i}};if(a===`agent`){let t=new Set(e.local?(await vt(e.local.cwd,e.integrations)).map(e=>e.id):(await e.store.list(`agent`)).map(e=>e.id));for(let e of Object.keys(ht()))t.add(e);for(let e of l)t.has(e.key)||(e.deleted=!0)}if(s>0)return S({...u,totals:l,top:Go(l,c)});if(!Qt(t)||a!==`agent`)return S({...u,totals:l});let d=Xo[n(`sort`)??`tokens`]??Xo.tokens,f=n(`sort`)===`name`,p=n(`q`)?.trim().toLowerCase(),m=([e,t],[n,r])=>(e<n?-1:+(e>n))*(f?1:-1)||t.localeCompare(r),h=e=>[d(e),e.key],g=nn(t),_=l.filter(e=>!p||e.key.toLowerCase().includes(p)).filter(e=>!g||m(h(e),g)>0).sort((e,t)=>m(h(e),h(t))),v=Zt(t),y=e=>l.reduce((t,n)=>t+e(n),0);return S({...u,...an(_.slice(0,v+1),v,h),summary:{agents:l.length,tasks:y(e=>e.tasks),runnerMs:y(e=>e.runnerMs),tokenCount:y(e=>e.tokenCount)}})}async function Qo(e,t,n,r){t.local&&await Fd(t);let i=r.searchParams.get(`installation`),a=await t.store.list(`usage`,{limit:Zt(r,200),...i?{installation:i}:{}});return S(i?a.filter(e=>e.value.installationId===i):a)}async function $o(e,t,n,r){t.local&&await Fd(t);let i=Number(r.searchParams.get(`since`)??0),a=r.searchParams.get(`by`);return[`until`,`agent`,`tz`,`parts`,`top`,`cursor`].some(e=>r.searchParams.has(e))||a===`day`?Zo(t,r):!Number.isFinite(i)||a&&![`agent`,`installation`,`engine`].includes(a)?S({error:`Invalid usage query`},400):S({since:i,totals:await t.store.usageSummary(i,a)})}var es=r({UNSCOPED_ORGANIZATION:()=>``,addSecret:()=>hs,agentValue:()=>cs,app:()=>W,date:()=>q,defined:()=>as,escapeLike:()=>is,fromJson:()=>J,install:()=>G,ms:()=>K,opaque:()=>ms,readTaskContext:()=>ns,rows:()=>vs,setSecret:()=>gs,splitKey:()=>rs,stateKey:()=>Y,statePrefix:()=>_s,storedTaskContext:()=>ts,taskRecord:()=>fs,versionColumns:()=>us,versionSummary:()=>ds,versionValue:()=>ls});function ts(e){return e.connections===void 0&&!e.engineChain&&!e.engineCredentials?e.context:{...e.context,connections:e.connections,engineChain:e.engineChain,engineCredentials:e.engineCredentials}}function ns(e){let{connections:t,runnerLogs:n,engineChain:r,engineCredentials:i,...a}=e??{};return{connections:t,runnerLogs:n,engineChain:r,engineCredentials:i,context:Object.keys(a).length?a:void 0}}function rs(e){let t=e.lastIndexOf(`:`),n=e.slice(t+1);return t>0&&/^\d+$/.test(n)?[e.slice(0,t),Number(n)]:void 0}const W=sr,G=tr,K=e=>e.getTime(),q=e=>new Date(e),is=e=>e.replace(/[\\%_]/g,`\\$&`),as=e=>Object.fromEntries(Object.entries(e).filter(([,e])=>e!=null)),os=e=>e?K(e):void 0,ss=(e,t)=>{let n=/^repo:([^@]+)@(.+)$/.exec(e);return n&&t?{repo:n[1],ref:n[2],commit:t}:void 0},cs=e=>as({id:e.slug,name:e.name,description:e.description,problems:e.problems,source:e.source,repo:e.repo,path:e.path,currentVersion:e.currentVersion,settings:e.settings,createdAt:K(e.createdAt),updatedAt:K(e.updatedAt)}),ls=(e,t)=>as({agent:t,version:e.version,definition:e.definition,systemPrompt:e.systemPrompt,files:e.files,commit:e.commit,source:ss(e.importedFrom,e.commit),importedFrom:e.importedFrom,createdAt:K(e.createdAt)}),us={id:F.id,agentId:F.agentId,version:F.version,definition:F.definition,commit:F.commit,importedFrom:F.importedFrom,createdAt:F.createdAt},ds=(e,t)=>{let{systemPrompt:n,files:r,...i}=ls({...e,systemPrompt:``,files:null},t);return i};function J(e,t){let n=new Xn(dr);return Object.fromEntries(Object.entries($n(e)).map(([e,r])=>{let i=t[n.getColumnCasing(r)];return[e,i==null?null:r.mapFromDriverValue(i)]}))}function fs(e){let t=ns(e.context);return as({task:as({id:e.publicId,source:e.source,agent:e.agent,flow:e.flow,runner:e.runner,permissions:e.permissions,event:e.event,prompt:e.prompt,args:e.args,mcp:e.mcp,connections:t.connections,author:e.author,definition:e.definition,credential:e.credential,engineChain:t.engineChain,engineCredentials:t.engineCredentials,requester:e.requester,runnerId:e.runnerId,usage:e.usage,tools:e.tools,toolScopes:e.toolScopes,context:t.context,files:e.files}),status:e.status,attempts:e.attempts,generation:e.generation,inboxSeq:e.inboxSeq,inboxAck:e.inboxAck<0?void 0:{generation:e.generation,seq:e.inboxAck},result:e.result,error:e.error,tokens:e.tokens,handle:e.handle,tokenHash:e.tokenHash,lastSeenAt:os(e.lastSeenAt),logCursor:e.logCursor??void 0,logSeq:e.logSeq??void 0,logBytes:e.logBytes??void 0,...(t.runnerLogs?.handle??null)===e.handle&&t.runnerLogs?.attempts===e.attempts&&t.runnerLogs?.generation===e.generation?{logsComplete:t.runnerLogs?.complete}:{},archivedAt:os(e.archivedAt),approval:e.approval,answer:Array.isArray(e.answer)?e.answer:void 0,createdAt:K(e.createdAt),startedAt:os(e.startedAt),finishedAt:os(e.finishedAt),cancelRequestedAt:os(e.cancelRequestedAt),updatedAt:K(e.updatedAt)})}function ps(e,t){if(t.startsWith(`plain.`))return{iv:`plain`,tag:``,ciphertext:t.slice(6),keyVersion:0};let[n,r,i]=t.split(`.`);if(!n||!r||!i)throw Error(`Invalid encrypted secret`);return{iv:n,tag:r,ciphertext:i,keyVersion:un(e.encryption,t)}}function ms(e){return e.iv===`plain`?`plain.${e.ciphertext}`:`${e.iv}.${e.tag}.${e.ciphertext}`}async function hs(e,t,n){let[r]=await e.db.insert(A).values({organizationId:e.organizationId,kind:t,...ps(e,n)}).returning({id:A.id});return r.id}async function gs(e,t,n){await e.db.update(A).set({...ps(e,n),updatedAt:e.at()}).where(N(e.mine(A.organizationId),D(A.id,t)))}const _s=(e,t)=>`o:${JSON.stringify([e,t])}:`,Y=(e,t,n)=>_s(e,t)+n;async function vs(e,t){let n=await e.execute(t);return Array.isArray(n)?n:n.rows}function ys(e,t,n){return e.db.transaction(async r=>{let[i]=await r.insert(L).values({organizationId:e.organizationId,slug:t.id,name:t.name,description:t.description??null,source:t.source,repo:t.repo??null,path:t.path??null,currentVersion:0,createdAt:q(t.createdAt),updatedAt:q(t.updatedAt)}).onConflictDoUpdate({target:[L.organizationId,L.slug],set:{slug:t.id}}).returning(),a=cs(i),[o]=a.currentVersion?await r.select().from(F).where(N(D(F.agentId,i.id),D(F.version,a.currentVersion))):[],s=o&&ls(o,t.id),c=!!(s&&Or(s.definition,n.definition)&&s.systemPrompt===n.systemPrompt&&Or(s.files,n.files)),l=c?s:{...n,version:a.currentVersion+1},u={...t,currentVersion:l.version,createdAt:a.createdAt,...a.settings?{settings:a.settings}:{},updatedAt:a.updatedAt};if(c&&Or(u,a))return{record:a,version:l,unchanged:c};u={...u,updatedAt:t.updatedAt};let d=c?k``:k`with published as (
-      insert into ${F} (agent_id, version, definition, system_prompt, files, commit, imported_from, created_at)
-      values (${i.id}, ${l.version}, ${JSON.stringify(l.definition)}::jsonb, ${l.systemPrompt},
-        ${l.files?JSON.stringify(l.files):null}::jsonb, ${l.commit??null}, ${l.importedFrom}, ${q(l.createdAt).toISOString()}::timestamptz)
-      returning version
-    )`;return await r.execute(k`${d} update ${L} set
-      name = ${u.name}, description = ${u.description??null}, problems = null, source = ${u.source},
-      repo = ${u.repo??null}, path = ${u.path??null},
-      current_version = ${c?k`${l.version}`:k`(select version from published)`}, updated_at = ${q(u.updatedAt).toISOString()}::timestamptz
-      where id = ${i.id}`),{record:u,version:l,unchanged:c}})}function bs(e){let t=L;return{key:t.slug,rows:async(n,r)=>{let i=e.db.select().from(t).where(N(e.mine(t.organizationId),n)).orderBy(P(t.slug));return(await(r===void 0?i:i.limit(r))).map(e=>({id:e.slug,value:cs(e)}))},put:async(n,r)=>{let i={name:r.name,description:r.description??null,problems:r.problems??null,source:r.source,repo:r.repo??null,path:r.path??null,currentVersion:r.currentVersion,settings:r.settings??null,createdAt:q(r.createdAt),updatedAt:q(r.updatedAt)};await e.db.insert(t).values({organizationId:e.organizationId,slug:n,...i}).onConflictDoUpdate({target:[t.organizationId,t.slug],set:i})},delete:async n=>{await e.db.delete(t).where(N(e.mine(t.organizationId),D(t.slug,n)))}}}async function xs(e,t,n){let r=t.lastIndexOf(`:`);return(await e.db.insert(F).values({agentId:k`(select id from ${L} where organization_id = ${e.organizationId} and slug = ${t.slice(0,r)})`,version:Number(t.slice(r+1)),definition:n.definition,systemPrompt:n.systemPrompt,files:n.files??null,commit:n.commit??null,importedFrom:n.importedFrom,createdAt:q(n.createdAt)}).onConflictDoNothing().returning({id:F.id})).length>0}function Ss(e){let t=F,n=k`${L.slug} || ':' || lpad(${t.version}::text, 6, '0')`;return{key:n,split:(e,n,r)=>N(D(L.slug,e),n===void 0?void 0:r?D(t.version,n):Jn(t.version,n)),rows:async(r,i)=>{let a=e.db.select({row:t,slug:L.slug,key:n}).from(t).innerJoin(L,D(L.id,t.agentId)).where(N(e.mine(L.organizationId),r)).orderBy(P(L.slug),P(t.version));return(await(i===void 0?a:a.limit(i))).map(({row:e,slug:t,key:n})=>({id:n,value:ls(e,t)}))},put:async(t,n)=>{await xs(e,t,n)},delete:async n=>{let r=n.lastIndexOf(`:`),i=k`(select id from ${L} where organization_id = ${e.organizationId} and slug = ${n.slice(0,r)})`;await e.db.delete(t).where(N(D(t.agentId,i),D(t.version,Number(n.slice(r+1)))))}}}const Cs=(e,t)=>as({id:e.key,integration:e.integration,agent:e.agent,name:e.name,agentsRepo:e.agentsRepo,branch:e.branch,builtin:e.organizationId===``||void 0,credentials:ms(t),createdAt:K(e.createdAt)});function ws(e){let t=W;return{key:t.key,rows:async(n,r)=>{let i=e.db.select({row:t,sealed:A}).from(t).innerJoin(A,D(A.id,t.credentialsSecretId)).where(N(e.mine(t.organizationId),n)).orderBy(P(t.key));return(await(r===void 0?i:i.limit(r))).map(({row:e,sealed:t})=>({id:e.key,value:Cs(e,t)}))},put:(n,r)=>e.transaction(`app:${n}`,async e=>{let[i]=await e.db.select({secretId:t.credentialsSecretId,sealed:A}).from(t).innerJoin(A,D(A.id,t.credentialsSecretId)).where(N(e.mine(t.organizationId),D(t.key,n))),[a]=r.shared?await e.db.select({secretId:t.credentialsSecretId}).from(t).where(N(D(t.organizationId,``),D(t.key,r.shared))):[];if(r.shared&&!a)throw Error(`No shared app ${r.shared}`);let o=i?.secretId??a?.secretId??await hs(e,`app`,r.credentials);i&&!r.shared&&ms(i.sealed)!==r.credentials&&await gs(e,o,r.credentials);let s={integration:r.integration,platformAppId:n.slice(n.indexOf(`:`)+1),agent:r.agent,name:r.name,agentsRepo:r.agentsRepo??null,branch:r.branch??null,credentialsSecretId:o,createdAt:q(r.createdAt),updatedAt:e.at()};await e.db.insert(t).values({organizationId:e.organizationId,key:n,...s}).onConflictDoUpdate({target:[t.organizationId,t.key],set:s})}),delete:n=>e.transaction(`app:${n}`,async e=>{let[r]=await e.db.delete(t).where(N(e.mine(t.organizationId),D(t.key,n))).returning({secretId:t.credentialsSecretId});r&&await e.db.delete(A).where(N(D(A.id,r.secretId),e.mine(A.organizationId)))})}}function Ts(e,t,n){return as({id:e.key,app:t.key,integration:t.integration,account:e.account,token:n?ms(n):void 0,installer:e.installer,self:e.self,covers:e.covers,repos:e.repos,connections:e.connections,settings:e.settings,createdAt:K(e.createdAt),deletedAt:e.deletedAt?K(e.deletedAt):void 0,uninstalled:e.uninstalled||void 0})}function Es(e,t,n){let r=n.app.split(`/`)[0],i=[t.slice(n.app.length+1),...n.covers??[]],a=k`array[${k.join(i.map(e=>k`${e}`),k`, `)}]::text[]`;return e.transaction(`binding:${r}`,async e=>{let[n]=await e.db.select({id:G.id}).from(G).innerJoin(W,D(W.id,G.appId)).where(N(Zn(E(G.platformInstallId,i),k`${G.covers} ?| ${a}`),O(G.deletedAt),Kn(G.key,t),Zn(D(W.key,r),k`left(${W.key}, ${r.length+1}) = ${`${r}/`}`))).limit(1);if(n)throw new Dn(`Installation "${t}" is bound through another app.`)})}function Ds(e){let t=G;return{key:t.key,rows:async(n,r)=>{let i=e.db.select({row:t,app:{key:W.key,integration:W.integration},sealed:A}).from(t).innerJoin(W,D(W.id,t.appId)).leftJoin(A,D(A.id,t.tokenSecretId)).where(N(e.mine(t.organizationId),n)).orderBy(P(t.key));return(await(r===void 0?i:i.limit(r))).map(({row:e,app:t,sealed:n})=>({id:e.key,value:Ts(e,t,n)}))},put:(n,r)=>e.transaction(`installation:${n}`,async e=>{let[i]=await e.db.select({row:t,sealed:A,appKey:W.key,parent:k`(select id from ${W} where organization_id in (${e.organizationId}, ${``}) and key = ${r.app} order by organization_id desc limit 1)`}).from(k`(select 1) as anchor`).leftJoin(t,D(t.key,n)).leftJoin(W,D(W.id,t.appId)).leftJoin(A,D(A.id,t.tokenSecretId)),a=i?.row?{secretId:i.row.tokenSecretId,organizationId:i.row.organizationId,covers:i.row.covers,deletedAt:i.row.deletedAt,appKey:i.appKey,sealed:i.sealed}:void 0,o=()=>Error(`Installation "${n}" belongs to another workspace.`);if(a&&a.organizationId!==e.organizationId)throw o();if(!i?.parent)throw Error(`Unknown app "${r.app}".`);r.deletedAt===void 0&&(!a||a.appKey!==r.app||a.deletedAt!==null||JSON.stringify(a.covers??[])!==JSON.stringify(r.covers??[]))&&await Es(e,n,r);let s=a?.secretId??null;r.token&&(s?(!a?.sealed||ms(a.sealed)!==r.token)&&await gs(e,s,r.token):s=await hs(e,`installation`,r.token));let c={appId:i.parent,platformInstallId:n.slice(r.app.length+1),account:r.account,tokenSecretId:r.token?s:null,installer:r.installer??null,self:r.self??null,covers:r.covers??null,repos:r.repos??null,connections:r.connections??null,settings:r.settings??null,createdAt:q(r.createdAt),updatedAt:e.at(),deletedAt:r.deletedAt===void 0?null:q(r.deletedAt),uninstalled:r.uninstalled??null},[l]=await e.db.insert(t).values({organizationId:e.organizationId,key:n,...c}).onConflictDoUpdate({target:t.key,set:c,setWhere:e.mine(t.organizationId)}).returning({id:t.id});if(!l)throw o();!r.token&&a?.secretId&&await e.db.delete(A).where(D(A.id,a.secretId))}),delete:n=>e.transaction(`installation:${n}`,async e=>{let[r]=await e.db.delete(t).where(N(e.mine(t.organizationId),D(t.key,n))).returning({secretId:t.tokenSecretId});r?.secretId&&await e.db.delete(A).where(D(A.id,r.secretId))})}}async function Os(e,t){let n=Wn(G,`locked`),[r]=await e.db.select({row:n,app:{key:W.key,integration:W.integration},sealed:A}).from(n).innerJoin(W,D(W.id,n.appId)).leftJoin(A,D(A.id,n.tokenSecretId)).where(N(e.mine(n.organizationId),D(n.key,t))).for(`update`,{of:n});return r&&Ts(r.row,r.app,r.sealed)}const ks=(e,t)=>as({iv:t.iv,tag:t.tag,ciphertext:t.ciphertext,owner:e.owner,account:e.account,createdAt:K(e.createdAt)}),As=(e,t)=>`credential:${JSON.stringify([e.organizationId,t??null])}`;async function js(e,t){let n=ar;return(await e.db.select({row:n,sealed:A}).from(n).innerJoin(A,D(A.id,n.secretId)).where(N(e.mine(n.organizationId),t?D(n.owner,t):O(n.owner))).orderBy(P(n.label)).for(`update`)).map(({row:e,sealed:t})=>({id:Xd(e.owner??void 0,e.label),value:ks(e,t),row:e,sealed:t}))}async function Ms(e,t,n,r){let i=ar;if(!r){if(!t)return;await e.db.delete(i).where(D(i.id,t.row.id)),await e.db.delete(A).where(D(A.id,t.row.secretId));return}let a=ms(r),o={account:r.account??null,createdAt:r.createdAt===void 0?t?.row.createdAt??e.at():q(r.createdAt),updatedAt:e.at()};if(t){ms(t.sealed)!==a&&await gs(e,t.row.secretId,a),await e.db.update(i).set(o).where(D(i.id,t.row.id));return}let{owner:s,name:c}=Zd(n);await e.db.insert(i).values({organizationId:e.organizationId,owner:s??null,label:c,secretId:await hs(e,`engine`,a),...o})}function Ns(e){let t=ar,n=(t,n)=>{let{owner:r}=Zd(t);return e.transaction(As(e,r),async e=>Ms(e,(await js(e,r)).find(e=>e.id===t),t,n))};return{key:k`coalesce(${t.owner} || '/', '') || ${t.label}`,rows:async(n,r)=>{let i=e.db.select({row:t,sealed:A}).from(t).innerJoin(A,D(A.id,t.secretId)).where(N(e.mine(t.organizationId),n)).orderBy(P(k`coalesce(${t.owner} || '/', '') || ${t.label}`));return(await(r===void 0?i:i.limit(r))).map(({row:e,sealed:t})=>({id:Xd(e.owner??void 0,e.label),value:ks(e,t)}))},put:(e,t)=>n(e,t),delete:e=>n(e,null)}}const Ps=(e,t)=>k`jsonb_build_object('row', to_jsonb(${e}), 'sealed', to_jsonb(${t}))`,Fs=e=>{let t=J(ar,e.row);return{id:Xd(t.owner??void 0,t.label),value:ks(t,J(A,e.sealed))}},Is=e=>{let t=J(cr,e.row);return{id:t.publicId,value:Hs(t,J(A,e.sealed))}},Ls=e=>{let t=J(W,e.app);return{installation:Ts(J(G,e.row),t,e.sealed?J(A,e.sealed):null),app:Cs(t,J(A,e.credentials))}};function Rs(e,t,n,r){let i=M,a=t.map(t=>`${is(Y(e,`snapshot`,Rn(t)))}%`),o=[...t,...n].map(t=>Y(e,`snapshot`,wn(t)));return k`(select coalesce(jsonb_object_agg(${i.key}, ${i.value}), '{}'::jsonb) from ${i}
-    where (${i.expiresAt} is null or ${i.expiresAt} > clock_timestamp()) and (${i.key} like any(${k.param(a)}::text[])
-      or ${i.key} in (select unnest(${k.param(o)}::text[])${r?k` union all ${r}`:k``})))`}function zs(e,t){let n=_s(e,`snapshot`),r={held:new Map,drops:new Map};for(let[e,i]of Object.entries(t)){let t=e.slice(n.length);t.startsWith(`token-drop:`)?r.drops.set(t,i.drop):r.held.set(t,i)}return r}function Bs(e){let t=k`coalesce((${M.value}->>'version')::bigint, jsonb_array_length(${M.value}->'messages') + (${M.value}->>'more')::bigint)`,n=k`greatest(coalesce((${M.value}->>'acknowledged')::bigint, 0), least(${e}, ${t}))`;return k`(select ${M.value} || jsonb_build_object('version', ${t}, 'acknowledged', ${n},
-        'messages', remaining, 'more', ${t} - ${n} - jsonb_array_length(remaining))
-        from (select coalesce(jsonb_agg(item order by n) filter (where coalesce((item->>'sequence')::bigint, n) > ${n}), '[]'::jsonb) as remaining
-          from jsonb_array_elements(${M.value}->'messages') with ordinality e(item,n)) as pending)`}function Vs(e,t){let n=M,r=_s(e.organizationId,t),i=n.key;return{key:i,where:e=>N(e.id===void 0?k`${n.key} like ${`${is(r+(e.prefix??``))}%`}`:D(n.key,r+e.id),e.after===void 0?void 0:Jn(n.key,r+e.after)),rows:async(t,a)=>{let o=e.db.select({id:i,value:k`${n.value}`}).from(n).where(N(k`${n.key} like ${`${is(r)}%`}`,e.live(n.expiresAt),t)).orderBy(P(n.key));return(await(a===void 0?o:o.limit(a))).map(e=>({id:e.id.slice(r.length),value:e.value}))},put:async(i,a,o)=>{let s=t===`login`?o??e.at():o,c=e.db.insert(n).values({key:r+(t===`config`?`workspace`:i),value:a,expiresAt:t===`config`?null:s}).onConflictDoUpdate({target:n.key,set:{value:a,expiresAt:t===`config`?null:t===`login`&&!o?k`${n.expiresAt}`:s}}),l=t===`delivery`&&i.startsWith(`connection-authorized:`)?e.notification(t,i):void 0;await(l?c.returning(l):c)},delete:async i=>{await e.db.delete(n).where(D(n.key,r+(t===`config`?`workspace`:i)))}}}const Hs=(e,t)=>as({name:e.name,owner:e.owner,kind:e.kind,scope:e.scope,config:e.config,createdBy:e.createdBy,default:e.isDefault,lastSeen:e.lastSeen?K(e.lastSeen):void 0,secret:ms(t),createdAt:K(e.createdAt),updatedAt:K(e.updatedAt)});function Us(e){let t=cr,n=n=>N(e.mine(t.organizationId),D(t.publicId,n));return{key:t.publicId,rows:async(n,r)=>{let i=e.db.select({row:t,sealed:A}).from(t).innerJoin(A,D(A.id,t.secretId)).where(N(e.mine(t.organizationId),n)).orderBy(P(t.publicId));return(await(r===void 0?i:i.limit(r))).map(({row:e,sealed:t})=>({id:e.publicId,value:Hs(e,t)}))},put:(r,i)=>e.transaction(`runner:${e.organizationId}:${r}`,async e=>{let[a]=await e.db.select({id:t.id,secretId:t.secretId,sealed:A}).from(t).innerJoin(A,D(A.id,t.secretId)).where(n(r)),o={owner:i.owner??null,name:i.name,kind:i.kind,scope:i.scope,config:i.config,createdBy:i.createdBy??null,isDefault:i.default,lastSeen:i.lastSeen===void 0?null:q(i.lastSeen),updatedAt:q(i.updatedAt)};if(a){ms(a.sealed)!==i.secret&&await gs(e,a.secretId,i.secret),await e.db.update(t).set(o).where(D(t.id,a.id));return}await e.db.insert(t).values({organizationId:e.organizationId,publicId:r,secretId:await hs(e,`runner`,i.secret),createdAt:q(i.createdAt),...o})}),delete:r=>e.transaction(`runner:${e.organizationId}:${r}`,async e=>{let[i]=await e.db.delete(t).where(n(r)).returning({secretId:t.secretId});i&&await e.db.delete(A).where(D(A.id,i.secretId))})}}function Ws(e,t){let n=Y(e,`snapshot`,`connection-secrets:${t}`),r=t=>k`${M.key} like ${`${is(Y(e,`snapshot`,t))}%`}`;return k`(${M.key} = ${n} or ${r(`connection-secrets:${t}:`)} or ${r(`connections:${t}:`)})`}function Gs(e){let t=I;return{key:t.publicId,rows:async(n,r)=>{let i=e.db.select().from(t).where(N(e.mine(t.organizationId),n)).orderBy(P(t.publicId));return(await(r===void 0?i:i.limit(r))).map(e=>({id:e.publicId,value:fs(e)}))},put:async(n,r,i,a={})=>{let{task:o}=r,s={source:o.source,status:r.status,agent:o.agent,flow:o.flow,reviewKey:Cp(o)??null,runner:o.runner,permissions:o.permissions??null,appId:o.event?k`(select id from ${W} where organization_id in (${e.organizationId}, ${``}) and key = ${o.event.appId} order by organization_id desc limit 1)`:null,installationId:o.event?k`(select id from ${G} where organization_id = ${e.organizationId} and key = ${`${o.event.appId}:${o.event.installationId}`})`:null,event:o.event??null,prompt:o.prompt??null,args:o.args??null,mcp:o.mcp??null,author:o.author??null,definition:o.definition,credential:o.credential??null,requester:o.requester??null,runnerId:o.runnerId??null,usage:o.usage??null,tools:o.tools,toolScopes:o.toolScopes??null,context:r.logsComplete===void 0?ts(o)??null:{...ts(o),runnerLogs:{complete:r.logsComplete,handle:r.handle,attempts:r.attempts,generation:r.generation??0}},files:o.files??null,result:r.result??null,error:r.error??null,tokens:r.tokens??null,handle:r.handle??null,tokenHash:r.tokenHash??null,lastSeenAt:r.lastSeenAt===void 0?null:q(r.lastSeenAt),logCursor:r.logCursor??null,logSeq:r.logSeq??null,logBytes:r.logBytes??null,archivedAt:r.archivedAt===void 0?null:q(r.archivedAt),approval:r.approval??null,answer:r.answer??null,attempts:r.attempts,generation:r.generation??0,inboxSeq:r.inboxSeq??-1,inboxAck:r.inboxAck?.generation===(r.generation??0)?r.inboxAck.seq:-1,createdAt:q(r.createdAt),startedAt:r.startedAt===void 0?null:q(r.startedAt),finishedAt:r.finishedAt===void 0?null:q(r.finishedAt),cancelRequestedAt:r.cancelRequestedAt===void 0?null:q(r.cancelRequestedAt),updatedAt:q(r.updatedAt)};await e.db.insert(t).values({organizationId:e.organizationId,publicId:n,...s}).onConflictDoUpdate({target:[t.organizationId,t.publicId],set:{...s,archivedAt:a.unarchive?s.archivedAt:k`coalesce(${t.archivedAt}, ${s.archivedAt})`}})},delete:async n=>{await e.db.delete(t).where(N(e.mine(t.organizationId),D(t.publicId,n)))}}}async function Ks(e,t){return(await e.db.select({engine:ir.engine,conversation:ir.conversation,savedAt:ir.savedAt}).from(ir).innerJoin(I,D(I.id,ir.taskId)).where(N(e.mine(ir.organizationId),e.mine(I.organizationId),D(I.publicId,t))).orderBy(P(ir.savedAt))).map(e=>({...e,savedAt:K(e.savedAt)}))}function qs(e){let t=ir,n=k`${I.publicId} || ':' || ${t.conversation}`,r=e=>[e.slice(0,e.indexOf(`:`)),e.slice(e.indexOf(`:`)+1)];return{key:n,where:({id:n,prefix:i})=>{let[a,o]=r(n??i??``);return N(e.mine(I.organizationId),D(I.publicId,a),n===void 0?void 0:D(t.conversation,o))},rows:async(r,i)=>{let a=e.db.select({row:t,key:n}).from(t).innerJoin(I,D(I.id,t.taskId)).where(N(e.mine(t.organizationId),r)).orderBy(P(t.savedAt));return(await(i===void 0?a:a.limit(i))).map(({row:e,key:t})=>({id:t,value:as({engine:e.engine,conversation:e.conversation,data:e.data,state:e.state,savedAt:K(e.savedAt)})}))},put:async(n,i)=>{let a={engine:i.engine,data:i.data,state:i.state??null,savedAt:q(i.savedAt)};await e.db.insert(t).values({organizationId:e.organizationId,taskId:k`(select id from ${I} where organization_id = ${e.organizationId} and public_id = ${r(n)[0]})`,conversation:i.conversation,...a}).onConflictDoUpdate({target:[t.taskId,t.conversation],set:a})},delete:async n=>{let[i,a]=r(n),o=k`(select id from ${I} where organization_id = ${e.organizationId} and public_id = ${i})`;await e.db.delete(t).where(N(D(t.taskId,o),D(t.conversation,a)))}}}function Js(e){let t=nr,n=k`${I.publicId} || ':' || lpad(${t.seq}::text, 6, '0')`;return{key:n,split:(n,r,i)=>N(e.mine(I.organizationId),D(I.publicId,n),r===void 0?void 0:i?D(t.seq,r):Jn(t.seq,r)),rows:async(r,i)=>{let a=e.db.select({row:t,key:n}).from(t).innerJoin(I,D(I.id,t.taskId)).where(N(e.mine(t.organizationId),r)).orderBy(P(I.publicId),P(t.seq));return(await(i===void 0?a:a.limit(i))).map(({row:e,key:t})=>({id:t,value:{at:K(e.at),level:e.level,line:e.line}}))},put:async(n,r)=>{let i=n.lastIndexOf(`:`),a={at:q(r.at),level:r.level,line:r.line};await e.db.insert(t).values({organizationId:e.organizationId,taskId:k`(select id from ${I} where organization_id = ${e.organizationId} and public_id = ${n.slice(0,i)})`,seq:Number(n.slice(i+1)),...a}).onConflictDoUpdate({target:[t.taskId,t.seq],set:a})},delete:async n=>{let r=n.lastIndexOf(`:`),i=k`(select id from ${I} where organization_id = ${e.organizationId} and public_id = ${n.slice(0,r)})`;await e.db.delete(t).where(N(D(t.taskId,i),D(t.seq,Number(n.slice(r+1)))))}}}function Ys(e){let t=j,n=k`${I.publicId} || ':' || lpad(${t.seq}::text, 8, '0')`;return{key:n,split:(n,r,i)=>N(e.mine(I.organizationId),D(I.publicId,n),r===void 0?void 0:i?D(t.seq,r):Jn(t.seq,r)),rows:async(r,i)=>{let a=e.db.select({row:t,key:n}).from(t).innerJoin(I,D(I.id,t.taskId)).where(N(e.mine(t.organizationId),r)).orderBy(P(I.publicId),P(t.seq));return(await(i===void 0?a:a.limit(i))).map(({row:e,key:t})=>({id:t,value:{seq:e.seq,generation:e.generation,at:K(e.at),kind:e.kind,value:e.value}}))},put:async(n,r)=>{let i=n.lastIndexOf(`:`);await e.db.insert(t).values({organizationId:e.organizationId,taskId:k`(select id from ${I} where organization_id = ${e.organizationId} and public_id = ${n.slice(0,i)})`,seq:r.seq,generation:r.generation,kind:r.kind,value:r.value,at:q(r.at)})},delete:async n=>{let r=n.lastIndexOf(`:`),i=k`(select id from ${I} where organization_id = ${e.organizationId} and public_id = ${n.slice(0,r)})`;await e.db.delete(t).where(N(D(t.taskId,i),D(t.seq,Number(n.slice(r+1)))))}}}function Xs(e){let t=lr;return{key:I.publicId,rows:async(n,r)=>{let i=e.db.select({row:t,taskId:I.publicId,installationId:G.key}).from(t).innerJoin(I,D(I.id,t.taskId)).leftJoin(G,D(G.id,t.installationId)).where(N(e.mine(t.organizationId),n)).orderBy(P(I.publicId));return(await(r===void 0?i:i.limit(r))).map(({row:e,taskId:t,installationId:n})=>({id:t,value:as({installationId:n,taskId:t,agent:e.agent,target:e.target,engine:e.engine,model:e.model,credential:e.credential,runnerElapsedMs:e.runnerMs,tokens:e.tokens,at:K(e.at)})}))},put:async(n,r)=>{let i=k`(select id from ${I} where organization_id = ${e.organizationId} and public_id = ${n})`,a={installationId:r.installationId?k`(select id from ${G} where organization_id = ${e.organizationId} and key = ${r.installationId})`:null,agent:r.agent,target:r.target,engine:r.engine??null,model:r.model??null,credential:r.credential,runnerMs:r.runnerElapsedMs,tokens:r.tokens??null,at:q(r.at),updatedAt:e.at()};await e.db.insert(t).values({organizationId:e.organizationId,taskId:i,...a}).onConflictDoUpdate({target:t.taskId,set:a})},delete:async n=>{let r=k`(select id from ${I} where organization_id = ${e.organizationId} and public_id = ${n})`;await e.db.delete(t).where(D(t.taskId,r))}}}var Zs=r({DrizzleStore:()=>Qs}),Qs=class e{db;organizationId;now;encryption;inTransaction;notifications;recordChannel(e,t){return`record_${Sr(`sha256`).update(JSON.stringify([this.organizationId,e,t])).digest(`hex`).slice(0,48)}`}notification(e,t){return this.notifications?{notified:k`pg_notify(${this.recordChannel(e,t)}, '')`}:void 0}async watch(e,t){let n=qe(),r=this.db.$client,i=r?.listen?await r.listen(this.recordChannel(e,t),n.notify,n.notify).catch(()=>void 0):void 0;return{...n,close(){i?.unlisten().catch(()=>{}),n.close()}}}publishAgent=(e,t)=>ys(this,e,t);kinds;constructor(e,t,n=Date.now,r={},i=!1,a=!!e.$client?.unsafe){this.db=e,this.organizationId=t,this.now=n,this.encryption=r,this.inTransaction=i,this.notifications=a,this.kinds={agent:bs(this),agentversion:Ss(this),app:ws(this),installation:Ds(this),credential:Ns(this),task:Gs(this),history:qs(this),tasklog:Js(this),inbox:Ys(this),usage:Xs(this),delivery:Vs(this,`delivery`),login:Vs(this,`login`),config:Vs(this,`config`),runner:Us(this),snapshot:Vs(this,`snapshot`),connection:Vs(this,`connection`)}}static async webhookTarget(e,t,n){let r=Wn(A,`installation_secret`),[i]=await R(e,()=>e.select({app:W,credentials:A,installation:G,token:r}).from(W).innerJoin(A,D(A.id,W.credentialsSecretId)).leftJoin(G,N(D(G.appId,W.id),D(G.key,n??``),O(G.deletedAt))).leftJoin(r,D(r.id,G.tokenSecretId)).where(N(D(W.integration,t.slice(0,t.indexOf(`:`))),D(W.platformAppId,t.slice(t.indexOf(`:`)+1)))));if(i&&!i.installation&&n){let a=`${i.app.platformAppId}/`,[o]=await R(e,()=>e.select({app:W,credentials:A,installation:G,token:r}).from(G).innerJoin(W,D(W.id,G.appId)).innerJoin(A,D(A.id,W.credentialsSecretId)).leftJoin(r,D(r.id,G.tokenSecretId)).where(N(D(W.integration,i.app.integration),k`left(${W.platformAppId}, ${a.length}) = ${a}`,D(G.platformInstallId,n.slice(t.length+1)),O(G.deletedAt))).limit(1));if(o)return{organizationId:o.app.organizationId,app:Cs(o.app,o.credentials),bound:{organizationId:o.installation.organizationId,installation:Ts(o.installation,o.app,o.token)}}}return i&&{organizationId:i.app.organizationId,app:Cs(i.app,i.credentials),...i.installation?{bound:{organizationId:i.installation.organizationId,installation:Ts(i.installation,i.app,i.token)}}:{}}}static async appRecord(e,t){let[n]=await R(e,()=>e.select({row:W,sealed:A}).from(W).innerJoin(A,D(A.id,W.credentialsSecretId)).where(N(D(W.integration,t.slice(0,t.indexOf(`:`))),D(W.platformAppId,t.slice(t.indexOf(`:`)+1)))));return n&&{organizationId:n.row.organizationId,app:Cs(n.row,n.sealed)}}static async apps(e,t){return(await R(e,()=>e.select({row:W,sealed:A}).from(W).innerJoin(A,D(A.id,W.credentialsSecretId)).where(D(W.integration,t)))).map(({row:e,sealed:t})=>({organizationId:e.organizationId,app:Cs(e,t)}))}static async installationOrganization(e,t){let[n]=await R(e,()=>e.select({organizationId:G.organizationId}).from(G).where(D(G.key,t)));return n?.organizationId}static async installations(e,t){return R(e,()=>e.select({key:G.key,organizationId:G.organizationId}).from(G).where(N(k`${G.key} like ${`${is(t)}:%`}`,O(G.deletedAt))))}static async taskOrganization(e,t,n){let[r]=await R(e,()=>e.select({organizationId:I.organizationId}).from(I).where(N(D(I.publicId,t),D(I.tokenHash,n))));return r?.organizationId}async getApps(e){return e.length?(await R(this.db,()=>this.db.select({row:W,sealed:A}).from(W).innerJoin(A,D(A.id,W.credentialsSecretId)).where(N(E(W.organizationId,[this.organizationId,``]),E(W.key,e))))).map(e=>({id:e.row.key,value:Cs(e.row,e.sealed)})):[]}async listCredentials(e){let t=ar,n=this.db.select({row:t,sealed:A}).from(t).innerJoin(A,D(A.id,t.secretId)).where(N(this.mine(t.organizationId),e.owner?Zn(O(t.owner),D(t.owner,e.owner)):O(t.owner))).orderBy(P(k`case when ${t.owner} is null then 'workspace' else 'personal' end`),P(t.label));return(await R(this.db,()=>e.limit===void 0?n:n.limit(e.limit))).map(({row:e,sealed:t})=>({id:Xd(e.owner??void 0,e.label),value:ks(e,t)}))}async updateMetadata(e,t,n){return e===`installation`&&(`covers`in n||`deletedAt`in n)?this.transaction(`installation:${t}`,async r=>{let i=await r.get(`installation`,t);if(!i)return!1;let a={...i,...n};return a.deletedAt===void 0&&await Es(r,t,a),r.writeMetadata(e,t,n)}):this.writeMetadata(e,t,n)}async writeMetadata(e,t,n){let r=e===`app`?W:e===`installation`?G:cr,i=e===`app`?[`name`,`agentsRepo`,`branch`]:e===`installation`?[`account`,`self`,`covers`,`repos`,`connections`,`settings`,`deletedAt`,`uninstalled`]:[`name`,`config`,`lastSeen`,`updatedAt`];if(Object.keys(n).some(e=>!i.includes(e)))throw Error(`Invalid metadata fields`);let a=Object.fromEntries(Object.entries(n).map(([e,t])=>[e,t===void 0?null:[`deletedAt`,`updatedAt`,`lastSeen`].includes(e)?q(t):t])),o=e===`runner`?cr.publicId:e===`app`?W.key:G.key,[s]=await this.db.update(r).set({...a,updatedAt:typeof n.updatedAt==`number`?q(n.updatedAt):this.at()}).where(N(this.mine(r.organizationId),D(o,t))).returning({id:r.id});return!!s}withAppLock(e,t){let n=/^connections?[:-]/.test(e)?`${this.organizationId}:${e}`:e;return this.transaction(`app:${n}`,t)}withConfigLock(e){return this.transaction(`config:${this.organizationId}`,e)}async transaction(t,n){let r=k`select pg_advisory_xact_lock(3, hashtext(${t}))`;return this.inTransaction?(await this.db.execute(r),n(this)):this.db.transaction(async t=>(await t.execute(r),n(new e(t,this.organizationId,this.now,this.encryption,!0,this.notifications))))}withCredential(e,t,n){if(e===`runner`)return this.withAppLock(`runners:${this.organizationId}`,e=>An(e,`runner`,t,n));if(e===`installation`)return this.transaction(`installation:${t}`,async e=>{let r=await Os(e,t),i=await n(r,r?[{id:t,value:r}]:[],e);for(let t of i??[])t.value===null?await e.delete(`installation`,t.id):await e.put(`installation`,t.id,t.value);return!!i?.length});let{owner:r}=Zd(t);return this.transaction(As(this,r),async e=>{let i=await js(e,r),a=i.map(({id:e,value:t})=>({id:e,value:t})),o=await n(a.find(e=>e.id===t)?.value,a,e);for(let t of o??[])await Ms(e,i.find(e=>e.id===t.id),t.id,t.value);return!!o?.length})}at(){return q(this.now())}live(e){return Zn(O(e),Jn(e,this.at()))}mine(e){return D(e,this.organizationId)}async get(e,t){if(e===`app`)return(await this.getApps([t]))[0]?.value;let n=this.kinds[e],r=rs(t),i=n.where?n.where({id:t}):n.split&&r?n.split(r[0],r[1],!0):k`${n.key} = ${t}`;return(await R(this.db,async()=>await n.rows(i,1)))[0]?.value}async patchLogin(e,t,n={}){let[r]=await this.db.update(M).set({value:k`jsonb_strip_nulls(${M.value} || ${JSON.stringify(t)}::jsonb)`}).where(N(D(M.key,Y(this.organizationId,`login`,e)),this.live(M.expiresAt),k`(${M.value}->>'expiresAt')::bigint > ${this.now()}`,...Object.entries(n).map(([e,t])=>Array.isArray(t)?E(k`${M.value}->>${e}`,t):k`${M.value}->>${e} = ${t}`))).returning({value:k`${M.value}`,...this.notification(`login`,e)});return r?.value}completeLogin(e,t,n){return df(this,e,t,n)}async listAgentsWithVersions(e){return(await R(this.db,()=>this.db.select({record:L,version:F}).from(L).leftJoin(F,N(D(F.agentId,L.id),D(F.version,L.currentVersion))).where(N(this.mine(L.organizationId),e===void 0?void 0:Array.isArray(e)?e.length?E(L.slug,e):k`false`:D(L.slug,e))).orderBy(P(L.slug)))).map(({record:e,version:t})=>({record:cs(e),...t?{version:ls(t,e.slug)}:{}}))}async listAgentSummaries(e={}){let t=e.q?`%${is(e.q)}%`:void 0,n=this.db.select({record:L,version:us}).from(L).leftJoin(F,N(D(F.agentId,L.id),D(F.version,L.currentVersion))).where(N(this.mine(L.organizationId),e.slug===void 0?void 0:D(L.slug,e.slug),e.after?Jn(L.slug,e.after):void 0,e.source?D(L.source,e.source):void 0,t?Zn(Gn(L.slug,t),Gn(L.name,t),Gn(L.description,t),Gn(L.repo,t)):void 0,e.platform?k`${F.definition}->'integrations' ? ${e.platform}`:void 0)).orderBy(P(L.slug));return(await R(this.db,()=>e.limit===void 0?n:n.limit(e.limit))).map(({record:e,version:t})=>({record:cs(e),...t?{version:ds(t,e.slug)}:{}}))}async listVersions(e,t,n){let r=this.db.select({version:us}).from(F).innerJoin(L,D(L.id,F.agentId)).where(N(this.mine(L.organizationId),D(L.slug,e),n===void 0?t===void 0?void 0:Qn(F.version,L.currentVersion):Un(F.version,n),t===void 0?void 0:Yn(F.version,n===void 0?k`${L.currentVersion} + 1 - ${t}`:n-t))).orderBy(P(F.version));return(await R(this.db,()=>r)).map(({version:t})=>({id:`${e}:${String(t.version).padStart(6,`0`)}`,value:ds(t,e)}))}async put(e,t,n,r={}){let i=r.ttlMs===void 0?null:q(this.now()+r.ttlMs);await this.kinds[e].put(t,n,i,r)}async putMany(e,t,n={}){if(!t.length)return;if(e===`delivery`){await this.db.insert(M).values(t.map(({id:t,value:r})=>({key:Y(this.organizationId,e,t),value:r,expiresAt:n.ttlMs===void 0?null:q(this.now()+n.ttlMs)}))).onConflictDoUpdate({target:M.key,set:{value:k`excluded.value`,expiresAt:k`excluded.expires_at`}});return}if(e!==`tasklog`){await Promise.all(t.map(t=>this.put(e,t.id,t.value,n)));return}let r=t[0].id.lastIndexOf(`:`),i=t[0].id.slice(0,r),a=t.map(e=>{let t=e.id.lastIndexOf(`:`),n=e.value;if(e.id.slice(0,t)!==i)throw Error(`A log batch must belong to one task`);return{organizationId:this.organizationId,taskId:k`(select ${I.id} from ${I} where ${I.organizationId} = ${this.organizationId} and ${I.publicId} = ${i})`,seq:Number(e.id.slice(t+1)),at:q(n.at),level:n.level,line:n.line}});await this.db.insert(nr).values(a).onConflictDoUpdate({target:[nr.taskId,nr.seq],set:{at:k`excluded.at`,level:k`excluded.level`,line:k`excluded.line`}})}async list(e,t={}){let n=this.kinds[e],r=[];if(t.ids&&r.push(t.ids.length?E(k`${n.key}`,t.ids.map(t=>n.where?Y(this.organizationId,e,t):t)):k`false`),t.runner&&r.push(e===`runner`?Zn(D(cr.publicId,t.runner),D(cr.name,t.runner)):k`false`),t.defaults&&r.push(e===`runner`?D(cr.isDefault,!0):k`false`),t.installation&&r.push(e===`usage`?D(G.key,t.installation):k`false`),t.agent&&r.push(e===`app`||e===`installation`?D(W.agent,t.agent):e===`agent`?D(L.slug,t.agent):k`false`),t.active&&r.push(e===`installation`?Zn(O(G.deletedAt),...t.includeUninstalled?[D(G.uninstalled,!0)]:[]):void 0),t.apps&&r.push(e===`installation`&&t.apps.length?E(W.key,t.apps):k`false`),Object.hasOwn(t,`visibleTo`)){let n=e===`runner`?cr.owner:e===`credential`?ar.owner:k`${M.value}->>'owner'`;r.push(Zn(O(n),t.visibleTo?D(k`${n}`,t.visibleTo):void 0))}if(n.where)return R(this.db,async()=>await n.rows(N(n.where(t),...r),t.limit));let i=t.prefix?.endsWith(`:`)?t.prefix.slice(0,-1):void 0,a=t.after===void 0?void 0:rs(t.after);if(n.split&&i&&!i.includes(`:`)&&(t.after===void 0||a?.[0]===i))return R(this.db,async()=>await n.rows(n.split(i,a?.[1]),t.limit));let o=t.prefix?k`${n.key} like ${`${is(t.prefix)}%`}`:void 0,s=t.after?k`${n.key} > ${t.after}`:void 0,c=N(o,s,...r);return R(this.db,async()=>await n.rows(c,t.limit))}async delete(e,t){let n=e===`login`?this.notification(e,t):void 0;if(n){await this.db.delete(M).where(D(M.key,Y(this.organizationId,e,t))).returning(n);return}await this.kinds[e].delete(t)}async create(e,t,n,r={}){if(e===`agentversion`)return xs(this,t,n);if(e!==`delivery`&&e!==`connection`)throw Error(`Atomic create is not supported for ${e}`);let i=r.ttlMs===void 0?null:q(this.now()+r.ttlMs);return(await this.db.insert(M).values({key:Y(this.organizationId,e,t),value:n,expiresAt:i}).onConflictDoUpdate({target:M.key,set:{value:n,expiresAt:i},setWhere:Qn(M.expiresAt,this.at())}).returning({key:M.key})).length>0}async claimDeliveryLease(e,t,n){let r=k`clock_timestamp() + ${n}::int * interval '1 millisecond'`,[i]=await this.db.insert(M).values({key:Y(this.organizationId,`delivery`,e),value:{owner:t,failures:0},expiresAt:r}).onConflictDoUpdate({target:M.key,set:{value:k`${M.value} || ${JSON.stringify({owner:t})}::jsonb`,expiresAt:r},setWhere:k`${M.expiresAt} <= clock_timestamp()`}).returning({value:M.value});return i?i.value.failures:void 0}async updateDeliveryLease(e,t,n,r={ttlMs:3e4}){let i=N(D(M.key,Y(this.organizationId,`delivery`,e)),k`${M.value}->>'owner' = ${t} and ${M.expiresAt} > clock_timestamp()`),a=k`clock_timestamp() + ${r.ttlMs}::int * interval '1 millisecond'`;return(n===void 0?await this.db.delete(M).where(i).returning({key:M.key}):await this.db.update(M).set({value:n.next===void 0?n:k`${JSON.stringify(n)}::jsonb || jsonb_build_object('next', floor(extract(epoch from (${a})) * 1000))`,expiresAt:a}).where(i).returning({key:M.key})).length>0}async updateDelivery(e,t,n,r={}){let i=N(D(M.key,Y(this.organizationId,`delivery`,e)),k`${M.value}->>'owner' = ${t}`,this.live(M.expiresAt));return(n===void 0?await this.db.delete(M).where(i).returning({key:M.key}):await this.db.update(M).set({value:n,expiresAt:r.ttlMs===void 0?null:q(this.now()+r.ttlMs)}).where(i).returning({key:M.key})).length>0}listHistory(e){return Ks(this,e)}async installationApp(e){let t=Wn(A,`installation_secret`),[n]=await R(this.db,()=>this.db.select({installation:G,app:W,credentials:A,token:t}).from(G).innerJoin(W,N(D(W.id,G.appId),E(W.organizationId,[this.organizationId,``]))).innerJoin(A,D(A.id,W.credentialsSecretId)).leftJoin(t,N(D(t.id,G.tokenSecretId),this.mine(t.organizationId))).where(N(this.mine(G.organizationId),D(G.key,e),O(G.deletedAt))));return n&&{installation:Ts(n.installation,n.app,n.token),app:Cs(n.app,n.credentials)}}async conversationState(e){let t=Wn(M,`unseen`),n=Wn(M,`batch`),[r]=await R(this.db,()=>this.db.select({record:M.value,unseen:t.value,batch:n.value,task:I}).from(k`(select 1) as anchor`).leftJoin(M,N(D(M.key,Y(this.organizationId,`delivery`,e)),this.live(M.expiresAt))).leftJoin(t,N(D(t.key,Y(this.organizationId,`delivery`,`since:${e}`)),this.live(t.expiresAt))).leftJoin(n,N(D(n.key,Y(this.organizationId,`delivery`,`batch:${e}`)),this.live(n.expiresAt))).leftJoin(I,N(this.mine(I.organizationId),D(I.publicId,k`${M.value}->>'taskId'`),D(I.flow,`default`))));return{...r?.record?{record:r.record}:{},...r?.unseen?{unseen:r.unseen}:{},...r?.batch?{batch:r.batch}:{},...r?.task?{status:fs(r.task)}:{}}}async heldTokens(e,t){let[n]=await R(this.db,()=>vs(this.db,k`select ${Rs(this.organizationId,e,t)} as tokens`));return zs(this.organizationId,n?.tokens??{})}async holdToken(e){let t=M,n=e=>Y(this.organizationId,`snapshot`,e);await this.db.execute(k`insert into ${t} (key, value, expires_at)
-      select ${n(e.key)}, ${JSON.stringify(e.value)}::jsonb, ${q(this.now()+e.ttlMs).toISOString()}::timestamptz
-      where ${k.join(e.drops.map(e=>k`coalesce((select ${t.value}->>'drop' from ${t} where ${t.key} = ${n(e.key)} and ${this.live(t.expiresAt)}), '') = ${e.drop??``}`),k` and `)}
-      on conflict (key) do update set value = excluded.value, expires_at = excluded.expires_at`)}async saveTaskSecrets(e,t){let[n]=await ur(this.db,[k`select pg_advisory_xact_lock(3, hashtext(${`app:${this.organizationId}:connections:${e}`}))`],k`with active as (select 1 from ${I} where ${this.mine(I.organizationId)} and ${I.publicId} = ${e} and ${I.status} in ('queued', 'running', 'waiting')),
-        kept as (insert into ${M} (key, value, expires_at)
-          select key, value, expires_at from (values ${k.join(t.map(e=>k`(${Y(this.organizationId,`snapshot`,e.id)}, ${JSON.stringify({secret:e.value,expiresAt:e.expiresAt})}::jsonb, ${q(e.expiresAt).toISOString()}::timestamptz)`),k`, `)}) as row(key, value, expires_at) where exists (select 1 from active) on conflict (key) do nothing)
-        select exists (select 1 from active) as active`);return!!n?.active}async dispatchState(e){let t=M,n=e=>Y(this.organizationId,`delivery`,e),r=e.conversation??``,i=e=>k`(select ${t.value} from ${t} where ${t.key} = ${n(e)} and ${this.live(t.expiresAt)})`,a=e=>k`(${e} is null or ${e} = (select requester from member))`,o=e=>k`${e} = ${this.organizationId}`,s=e=>k`(select coalesce(jsonb_agg(${Ps(k`r`,k`s`)}), '[]'::jsonb) from ${e})`,c=Object.values(e.installation.connections??{}).flatMap(e=>e.kind===`installation`?[e.id]:[]),l=_s(this.organizationId,`snapshot`),u=e.files.map(e=>`${is(l+e)}%`),[d]=await vs(this.db,k`
-      with claim as (
-        insert into ${t} (key, value, expires_at)
-        values (${n(e.delivery.key)}, ${JSON.stringify({at:e.delivery.at,owner:e.delivery.owner,pending:!0})}::jsonb, ${q(e.delivery.at+e.delivery.ttlMs).toISOString()}::timestamptz)
-        on conflict (key) do update set value = excluded.value, expires_at = excluded.expires_at
-          where ${t.expiresAt} <= ${this.at().toISOString()}::timestamptz
-        returning key
-      ), conversation as (select ${i(r)} as value),
-      member as (select ${rr.userId} as requester from ${rr}
-        where ${rr.platform} = ${e.actor?.platform??null}::text and ${rr.platformUserId} = ${e.actor?.id??null}::text
-          and ${rr.organizations} ? ${this.organizationId} limit 1),
-      linked as (select i.*, a.key as app_key, ${Ps(k`i`,k`s`)} || jsonb_build_object('app', to_jsonb(a), 'credentials', to_jsonb(c)) as row
-        from ${G} i join ${W} a on a.id = i.app_id and a.organization_id in (${this.organizationId}, ${``})
-        join ${A} c on c.id = a.credentials_secret_id left join ${A} s on s.id = i.token_secret_id
-        where ${o(k`i.organization_id`)} and i.deleted_at is null and i.key = any(${k.param(c)}::text[]))
-      select exists (select 1 from claim) as claimed,
-        (select to_jsonb(a) from ${L} a where ${o(k`a.organization_id`)} and a.slug = ${e.agent}) as record,
-        (select to_jsonb(v) from ${F} v join ${L} a on a.id = v.agent_id and v.version = a.current_version
-          where ${o(k`a.organization_id`)} and a.slug = ${e.agent}) as version,
-        (select value from conversation) as conversation,
-        ${i(`since:${r}`)} as unseen,
-        ${i(`batch:${r}`)} as batch,
-        (select to_jsonb(t) from ${I} t, conversation c where ${o(k`t.organization_id`)} and t.public_id = c.value->>'taskId' and t.flow = 'default') as task,
-        (select requester from member) as requester,
-        ${s(k`${ar} r join ${A} s on s.id = r.secret_id where ${o(k`r.organization_id`)} and ${a(k`r.owner`)}`)} as credentials,
-        ${s(k`${cr} r join ${A} s on s.id = r.secret_id where ${o(k`r.organization_id`)} and r.is_default and ${a(k`r.owner`)}`)} as runners,
-        (select coalesce(jsonb_agg(${t.value}), '[]'::jsonb) from ${t}
-          where ${t.key} like ${`${is(_s(this.organizationId,`connection`))}%`} and ${this.live(t.expiresAt)} and ${a(k`${t.value}->>'owner'`)}) as connections,
-        ${i(`workspace`)} as workspace,
-        (select coalesce(jsonb_agg(row), '[]'::jsonb) from linked) as linked,
-        (select coalesce(jsonb_object_agg(${t.key}, ${t.value}), '{}'::jsonb) from ${t}
-          where ${this.live(t.expiresAt)} and ${t.key} like any(${k.param(u)}::text[])) as files,
-        ${Rs(this.organizationId,[e.installation.id,...c],[e.installation.app],k`select ${l}::text || 'token-drop:' || app_key from linked`)} as tokens`);if(!d?.claimed)return{claimed:!1};let f=d.record?cs(J(L,d.record)):void 0,p=d.version&&f?ls(J(F,d.version),f.id):void 0;return{claimed:!0,loaded:{...f?{record:f}:{},...p?{version:p}:{},conversation:{...d.conversation?{record:d.conversation}:{},...d.unseen?{unseen:d.unseen}:{},...d.batch?{batch:d.batch}:{},...d.task?{status:fs(J(I,d.task))}:{}},...d.requester?{requester:d.requester}:{},credentials:d.credentials.map(Fs),runners:d.runners.map(Is),connections:d.connections,...d.workspace?{workspace:d.workspace}:{},linked:d.linked.map(Ls),files:Object.fromEntries(Object.entries(d.files).map(([e,t])=>[e.slice(l.length),t])),tokens:zs(this.organizationId,d.tokens)}}}async markConversation(e,t,n,r,i){await this.db.update(M).set({value:k`${M.value} || ${JSON.stringify({at:r,seen:n})}::jsonb`,expiresAt:q(this.now()+i)}).where(N(D(M.key,Y(this.organizationId,`delivery`,e)),k`${M.value}->>'taskId' = ${t}`,this.live(M.expiresAt)))}async appendUnseen(e,t,n){let r=k`coalesce((${M.value}->>'version')::bigint, jsonb_array_length(${M.value}->'messages') + (${M.value}->>'more')::bigint)`,i={messages:[{...t,sequence:1}],more:0,version:1,epoch:Tr()};await this.db.execute(k`
-      insert into ${M} (key, value, expires_at)
-      select ${Y(this.organizationId,`delivery`,`since:${e}`)}, ${JSON.stringify(i)}::jsonb, ${q(this.now()+n).toISOString()}::timestamptz
-      where exists (select 1 from ${M} where key = ${Y(this.organizationId,`delivery`,e)} and ${this.live(M.expiresAt)})
-      on conflict (key) do update set value = case when ${M.expiresAt} <= ${this.at().toISOString()}::timestamptz then excluded.value else
-        ${M.value} || jsonb_build_object('version', ${r} + 1,
-          'messages', case when jsonb_array_length(${M.value}->'messages') < ${50} then
-            (${M.value}->'messages') || jsonb_build_array(${JSON.stringify(t)}::jsonb || jsonb_build_object('sequence', ${r} + 1)) else ${M.value}->'messages' end,
-          'more', (${M.value}->>'more')::int + case when jsonb_array_length(${M.value}->'messages') < ${50} then 0 else 1 end) end,
-        expires_at = excluded.expires_at
-    `)}async acknowledgeUnseen(e,t,n){await this.db.update(M).set({value:Bs(t)}).where(N(D(M.key,Y(this.organizationId,`delivery`,`since:${e}`)),k`${M.value}->>'epoch' is not distinct from ${n??null}::text`,this.live(M.expiresAt)))}async appendBatch(e,t,n,r,i){let a=Pn(void 0,t,n,r),o=q(this.now()+i);await this.db.insert(M).values({key:Y(this.organizationId,`delivery`,e),value:a,expiresAt:o}).onConflictDoUpdate({target:M.key,set:{value:k`case when ${M.expiresAt} <= ${this.at().toISOString()}::timestamptz then excluded.value else
-          (select ${M.value} || excluded.value || jsonb_build_object(
-            'items', prefix || coalesce((select jsonb_agg(item order by n) from jsonb_array_elements(pending) with ordinality e(item,n) where n > greatest(jsonb_array_length(pending) - 50, 0)), '[]'::jsonb),
-            'more', coalesce((${M.value}->>'more')::int, 0) + coalesce((excluded.value->>'more')::int, 0) + greatest(jsonb_array_length(pending) - 50, 0),
-            'mustReply', coalesce((${M.value}->>'mustReply')::boolean, false) or coalesce((excluded.value->>'mustReply')::boolean, false) or exists(select 1 from jsonb_array_elements(pending) with ordinality e(item,n) where n <= greatest(jsonb_array_length(pending) - 50, 0) and item->'event'->>'mustReply' = 'true'))
-            from (select coalesce(jsonb_agg(item order by n) filter (where n <= coalesce((${M.value}->'sending'->>'count')::int, 0)), '[]'::jsonb) as prefix,
-              coalesce(jsonb_agg(item order by n) filter (where n > coalesce((${M.value}->'sending'->>'count')::int, 0)), '[]'::jsonb) || (excluded.value->'items') as pending
-              from jsonb_array_elements(${M.value}->'items') with ordinality e(item,n)) queued) end`,expiresAt:o}})}async claimBatch(e,t){let n=Y(this.organizationId,`delivery`,e),r=(await vs(this.db,k`
-      with held as materialized (
-        select key as batch_key, value as previous from ${M}
-        where key = ${n} and value->>'owner' = ${t} and ${this.live(M.expiresAt)} for update
-      ), claimed as (
-        update ${M} set value = (
-          select ready || jsonb_build_object('more', 0, 'mustReply', false, 'sending', jsonb_build_object(
-            'owner', ${t}::text, 'until', ${this.now()+In}::bigint,
-            'count', jsonb_array_length(ready->'items'), 'more', ready->'more', 'mustReply', ready->'mustReply'))
-          from (select (value - 'sending') || jsonb_build_object(
-            'items', coalesce((select jsonb_agg(item order by n) from jsonb_array_elements(value->'items') with ordinality e(item,n)
-              where n > greatest(jsonb_array_length(value->'items') - 50, 0)), '[]'::jsonb),
-            'more', coalesce((value->>'more')::int, 0) + coalesce((value->'sending'->>'more')::int, 0) + greatest(jsonb_array_length(value->'items') - 50, 0),
-            'mustReply', coalesce((value->>'mustReply')::boolean, false) or coalesce((value->'sending'->>'mustReply')::boolean, false) or exists(
-              select 1 from jsonb_array_elements(value->'items') with ordinality e(item,n)
-              where n <= greatest(jsonb_array_length(value->'items') - 50, 0) and item->'event'->>'mustReply' = 'true')) as ready) as available)
-        from held where key = held.batch_key and coalesce((value->'sending'->>'until')::bigint, 0) <= ${this.now()}
-          and jsonb_array_length(value->'items') > 0
-        returning value
-      ) select value, true as claimed from claimed
-      union all select previous, false from held where not exists (select 1 from claimed)
-    `))[0];return r?.claimed?{...r.value,more:r.value.sending?.more,mustReply:r.value.sending?.mustReply}:r?.value.sending?null:void 0}async finishBatch(e,t,n,r){let i=k`(${M.value}->'sending'->>'count')::int`,a=r===void 0?i:k`coalesce((select n from jsonb_array_elements(${M.value}->'items') with ordinality e(item,n)
-          where n <= ${i} and item->>'admission' = ${r} limit 1), 0)`;return(await this.db.update(M).set({value:k`case when ${n} and ${i} > ${a} then
-          ${M.value} || jsonb_build_object('items',
-            coalesce((select jsonb_agg(item order by n) from jsonb_array_elements(${M.value}->'items') with ordinality e(item,n)
-              where n > ${a}), '[]'::jsonb),
-            'sending', (${M.value}->'sending') || jsonb_build_object(
-              'count', ${i} - ${a},
-              'until', ${this.now()+In}::bigint))
-        else (${M.value} - 'sending') || jsonb_build_object('items',
-        case when ${n} then coalesce((select jsonb_agg(item order by n) from jsonb_array_elements(${M.value}->'items') with ordinality as entries(item, n)
-          where n > ${i}), '[]'::jsonb) else
-          coalesce((select jsonb_agg(item order by n) from jsonb_array_elements(${M.value}->'items') with ordinality e(item,n)
-            where n > greatest(jsonb_array_length(${M.value}->'items') - 50, 0)), '[]'::jsonb) end,
-        'more', coalesce((${M.value}->>'more')::int, 0) + case when ${n} then 0 else coalesce((${M.value}->'sending'->>'more')::int, 0) + greatest(jsonb_array_length(${M.value}->'items') - 50, 0) end,
-        'mustReply', coalesce((${M.value}->>'mustReply')::boolean, false) or (not ${n} and (coalesce((${M.value}->'sending'->>'mustReply')::boolean, false) or exists(select 1 from jsonb_array_elements(${M.value}->'items') with ordinality e(item,n)
-          where n <= greatest(jsonb_array_length(${M.value}->'items') - 50, 0) and item->'event'->>'mustReply' = 'true')))) end`}).where(N(D(M.key,Y(this.organizationId,`delivery`,e)),k`${M.value}->'sending'->>'owner' = ${t}`,this.live(M.expiresAt))).returning({key:M.key})).length>0}async take(e,t,n){if(e===`delivery`||e===`snapshot`){let[r]=await this.db.delete(M).where(N(D(M.key,Y(this.organizationId,e,t)),this.live(M.expiresAt),n?k`${M.value} @> ${JSON.stringify(n)}::jsonb`:void 0)).returning({value:M.value});return r?.value}let r=await this.get(e,t);if(!(r===void 0||Object.entries(n??{}).some(([e,t])=>r[e]!==t)))return await this.delete(e,t),r}async usageSummary(e,t){let n=k`case groups.kind when 'agent' then ${lr.agent} when 'engine' then coalesce(${lr.engine}, 'unknown') else coalesce(${G.key}, 'none') end`,r=t?n:k`groups.kind || ':' || (${n})`,i=(await R(this.db,()=>vs(this.db,k`
-      with recursive records as (
-        select ${r} as key, ${lr.runnerMs} as runner_ms, ${lr.tokens} as tokens,
-          row_number() over (partition by ${r} order by ${I.publicId}) as n
-        from ${lr} inner join ${I} on ${I.id} = ${lr.taskId}
-        left join ${G} on ${G.id} = ${lr.installationId}
-        cross join unnest(${k.param(t?[t]:[`agent`,`installation`,`engine`])}::text[]) groups(kind)
-        where ${this.mine(lr.organizationId)} and ${lr.at} >= ${new Date(e).toISOString()}::timestamptz
-      ), nodes(key, path, n, value) as (
-        select key, '{}'::text[], n, tokens from records where tokens is not null
-        union all
-        select nodes.key, nodes.path || child.key, nodes.n, child.value from nodes
-        cross join lateral jsonb_each(case when jsonb_typeof(nodes.value) = 'object' then nodes.value else '{}'::jsonb end) child
-      ), resolved(key, path, kind, cutoff) as (
-        select keys.key, '{}'::text[], latest.kind, coalesce((
-          select max(n) from nodes where nodes.key = keys.key and path = '{}'::text[]
-            and jsonb_typeof(value) in ('number', 'object') and jsonb_typeof(value) <> latest.kind
-        ), 0) from (select distinct key from records) keys
-        cross join lateral (
-          select jsonb_typeof(value) as kind from nodes where nodes.key = keys.key and path = '{}'::text[]
-            and jsonb_typeof(value) in ('number', 'object') order by n desc limit 1
-        ) latest
-        union all
-        select parent.key, child.path, latest.kind, greatest(parent.cutoff, coalesce((
-          select max(n) from nodes where nodes.key = parent.key and nodes.path = child.path
-            and n > parent.cutoff and jsonb_typeof(value) in ('number', 'object') and jsonb_typeof(value) <> latest.kind
-        ), 0)) from resolved parent
-        cross join lateral (
-          select distinct path[1:cardinality(parent.path) + 1] as path from nodes
-          where nodes.key = parent.key and n > parent.cutoff and cardinality(path) > cardinality(parent.path)
-            and path[1:cardinality(parent.path)] = parent.path
-        ) child
-        cross join lateral (
-          select jsonb_typeof(value) as kind from nodes where nodes.key = parent.key and nodes.path = child.path
-            and n > parent.cutoff and jsonb_typeof(value) in ('number', 'object') order by n desc limit 1
-        ) latest where parent.kind = 'object'
-      ), sums as (
-        select key, path, case when kind = 'object' then '{}'::jsonb else to_jsonb((
-          select sum(case when jsonb_typeof(value) = 'number' then (value #>> '{}')::numeric end)::float8
-          from nodes where nodes.key = resolved.key and nodes.path = resolved.path and n > cutoff
-        )) end as value from resolved
-      ) select key, count(*)::int as tasks, sum(runner_ms)::float8 as runner_ms,
-        (select jsonb_agg(jsonb_build_object('path', path, 'value', value) order by path) from sums where sums.key = records.key) as tokens
-        from records group by key order by key
-    `))).map(e=>{let t;for(let n of e.tokens??[]){if(!n.path.length){t=typeof n.value==`number`?n.value:Object.create(null);continue}let e=t&&typeof t==`object`?t:Object.create(null);t=e;let r=e;for(let e of n.path.slice(0,-1))r=r[e]??=Object.create(null);Object.defineProperty(r,n.path.at(-1),{value:typeof n.value==`number`?n.value:Object.create(null),enumerable:!0,configurable:!0,writable:!0})}return{key:e.key,tasks:e.tasks,runnerMs:e.runner_ms,...t===void 0?{}:{tokens:t}}});if(t)return i;let a={agent:[],installation:[],engine:[]};for(let e of i){let t=e.key.indexOf(`:`);a[e.key.slice(0,t)].push({...e,key:e.key.slice(t+1)})}return a}async usageTotals(e){let t=lr,n=e.by===`agent`?k`${t.agent}`:e.by===`engine`?k`coalesce(${t.engine}, 'unknown')`:e.by===`installation`?k`coalesce(${G.key}, 'none')`:k`to_char(${t.at} at time zone ${Vo(e.tz)}, 'YYYY-MM-DD')`,r=N(this.mine(t.organizationId),Yn(t.at,q(e.since)),e.until===void 0?void 0:Un(t.at,q(e.until)),e.agent?D(t.agent,e.agent):void 0),i=k`coalesce(
-      case when jsonb_typeof(${t.tokens} -> 'total') = 'number' then (${t.tokens} ->> 'total')::numeric end,
-      (select sum((v #>> '{}')::numeric)
-        from jsonb_path_query(coalesce(${t.tokens}, 'null'::jsonb), 'strict $.**') v
-        where jsonb_typeof(v) = 'number')
-    )`,a={tasks:k`count(*)`,runnerMs:k`coalesce(sum(${t.runnerMs}), 0)`,tokenCount:k`coalesce(sum(${i}), 0)`},o=e.top?k`case when ${t.agent} in (
-          select ${t.agent} from ${t} where ${r} group by ${t.agent}
-          order by ${a[e.top.by]} desc, ${t.agent} limit ${e.top.count}
-        ) then ${t.agent} end`:e.parts?.length?k`case when ${E(t.agent,e.parts)} then ${t.agent} end`:k`null::text`,s=e.by===`installation`?k`left join ${G} on ${G.id} = ${t.installationId}`:k``,c=await R(this.db,()=>vs(this.db,k`
-      select ${n} as key, ${o} as part, ${a.tasks}::int as tasks,
-        ${a.runnerMs}::float8 as runner_ms,
-        ${a.tokenCount}::float8 as token_count
-      from ${t} ${s}
-      where ${r}
-      group by 1, 2
-    `)),l=new Map;for(let e of c){let t={tasks:Number(e.tasks),runnerMs:Number(e.runner_ms),tokenCount:Number(e.token_count)},n=l.get(e.key)??{key:e.key,tasks:0,runnerMs:0,tokenCount:0};Ho(n,t),e.part&&((n.parts??={})[e.part]=t),l.set(e.key,n)}return[...l.values()].sort((e,t)=>e.key.localeCompare(t.key))}async sweep(e=1e3){if(!Number.isInteger(e)||e<1)throw Error(`Sweep batch must be positive`);let t=this.at().toISOString();await this.db.execute(k`
-      with tombstones as (
-        delete from ${er} where (organization_id, public_id) in (
-          select organization_id, public_id from ${er}
-          where deleted_at < ${new Date(this.now()-6e5).toISOString()}::timestamptz
-          order by deleted_at limit ${e}
-        )
-      ), expired_state as (
-        delete from ${M} where expires_at <= clock_timestamp() and key in (
-          select key from ${M} where expires_at <= clock_timestamp() order by expires_at limit ${e}
-        )
-      ), lists as (
-        select expired.key from ${or} as expired
-        where expired.key like 'k:%' and expired.expires_at <= ${t}::timestamptz
-          and not exists (select 1 from ${or} as newer where newer.key = expired.key and newer.seq > expired.seq)
-        order by expired.expires_at limit ${e}
-      ), expired_items as (
-        select key, seq from ${or} where key in (select key from lists) order by seq limit ${e}
-      ), expired_queue as (
-        select key, seq from ${or} where key like 'q:%' and expires_at <= ${t}::timestamptz order by expires_at limit ${e}
-      )
-      delete from ${or} where (key, seq) in (
-        select key, seq from expired_items union all select key, seq from expired_queue
-      )`)}};const $s=Ct;function ec(e,t,n,r=wr(32).toString(`base64url`)){let i=`${sn({task:e,organization:t,attempt:n})}.${r}`;return{token:i,hash:$s(i)}}function tc(e){try{return on(e.slice(0,e.indexOf(`.`)))}catch{return{}}}var nc=r({DrizzleQueue:()=>pc});const rc=(e,t)=>k`('[' || to_json(${e})::text || ',' || to_json(${t}::text)::text || ']:')`,ic=e=>k`(select ${Ps(k`c`,k`s`)} from ${ar} c join ${A} s on s.id = c.secret_id
-    where c.organization_id = ${e}.organization_id and coalesce(c.owner || '/', '') || c.label = ${e}.credential)`,ac=e=>k`(select ${M.value} from ${M} where ${M.key} = 'o:' || ${rc(e,`config`)} || 'workspace')`,oc=e=>k`(select ${Ps(k`r`,k`s`)} from ${cr} r join ${A} s on s.id = r.secret_id
-    where r.organization_id = ${e}.organization_id and r.public_id = ${e}.runner_id)`;function sc(e,t){if(typeof t==`number`)return k`to_jsonb(coalesce(case when jsonb_typeof(${e}) = 'number' then (${e} #>> '{}')::numeric end, 0) + ${t}::numeric)`;if(!t||typeof t!=`object`||Array.isArray(t))return e;let n=Object.entries(t).map(([t,n])=>k`${t}::text, ${sc(k`(${e} -> ${t}::text)`,n)}`);return k`(case when jsonb_typeof(${e}) = 'object' then ${e} else '{}'::jsonb end || jsonb_build_object(${k.join(n,k`, `)}))`}const cc=e=>k`(case ${e} ${k.join([...Q,...De].map(e=>k`when ${e} then ${k.raw(String(he(e)))}`),k` `)} end)`,lc=e=>k`date_trunc('milliseconds', ${e})`,uc=e=>k`${e} collate "C"`,dc=e=>[P(cc(e.status)),Hn(lc(e.createdAt)),Hn(uc(e.publicId))],fc=e=>[P(e.updatedAt),P(uc(e.publicId))];var pc=class{db;constructor(e){this.db=e}async metrics(e,t){let n=await this.db.select({status:I.status,total:k`count(*)::int`,recent:k`count(*) filter (where ${I.createdAt} >= ${new Date(t).toISOString()}::timestamptz)::int`}).from(I).where(D(I.organizationId,e)).groupBy(I.status),r={tasks:{queued:0,running:0,waiting:0,completed:0,failed:0,cancelled:0},queueDepth:0};for(let e of n)r.tasks[e.status]=e.recent,e.status===`queued`&&(r.queueDepth=e.total);return r}where(e,t){return N(D(I.organizationId,e),D(I.publicId,t))}fence(e,t,n={}){return N(this.where(e,t),n.generation===void 0?void 0:D(I.generation,n.generation),n.attempts===void 0?void 0:D(I.attempts,n.attempts),n.tokenHash===void 0?void 0:n.tokenHash===null?O(I.tokenHash):D(I.tokenHash,n.tokenHash),n.handle===void 0?void 0:n.handle===null?O(I.handle):D(I.handle,n.handle),n.lastSeenAt===void 0?void 0:n.lastSeenAt===null?O(I.lastSeenAt):D(I.lastSeenAt,new Date(n.lastSeenAt)),n.updatedAt===void 0?void 0:D(I.updatedAt,new Date(n.updatedAt)),n.statuses?E(I.status,n.statuses):void 0)}async enqueue(e,t,n,r,i,a){let o=this.insertion(e,t,n,r,i,void 0,a),[s]=await ur(this.db,i===void 0?[]:[k`select pg_advisory_xact_lock(1, hashtext(${e}))`],o);if(!s?.allowed)throw Error(`Organization task queue is full`);return!!s.inserted}insertion(e,t,n,r,i,a,o){let s=t.event,c=new Date(n).toISOString(),l=e=>k`${e===void 0?null:JSON.stringify(e)}::jsonb`,u=t=>Y(e,`delivery`,t),d=r?k`
-      receipt as (
-        insert into ${M} (key, value, expires_at)
-        select ${u(r.key)}, ${l({at:n})}, ${new Date(n+r.ttlMs).toISOString()}::timestamptz
-        from capacity where allowed ${a?k`and (${a.create} or exists (select 1 from target))`:k``}
-        on conflict (key) do update set value = excluded.value, expires_at = excluded.expires_at
-          where ${M.expiresAt} <= ${c}::timestamptz or ${M.value}->>'owner' = ${r.owner??null}::text
-        returning key
-      ),`:k``,f=k`exists (select 1 from inserted)`,p=k`on conflict (key) do update set value = excluded.value, expires_at = excluded.expires_at`,{conversation:m,unseen:h,secrets:g}=o??{},_=k`${m?k`, remembered as (insert into ${M} (key, value, expires_at)
-        select key, value, ${new Date(n+m.ttlMs).toISOString()}::timestamptz from (values
-          (${u(m.key)}, ${l(m.record)}), (${u(m.root)}, ${l({at:m.record.at})})) as row(key, value)
-        where ${f} ${p})`:k``}${h?k`, acknowledged as (update ${M} set value = ${Bs(h.version)}
-        where key = ${u(`since:${h.key}`)} and ${M.value}->>'epoch' is not distinct from ${h.epoch??null}::text
-          and (expires_at is null or expires_at > ${c}::timestamptz) and ${f})`:k``}${g?.length?k`, secrets as (insert into ${M} (key, value, expires_at)
-        select key, value, expires_at from (values ${k.join(g.map(t=>k`(${Y(e,`snapshot`,t.id)}, ${l({secret:t.value,expiresAt:t.expiresAt})}, ${new Date(t.expiresAt).toISOString()}::timestamptz)`),k`, `)}) as row(key, value, expires_at) where ${f} on conflict (key) do nothing)`:k``}`;return k`
-      with ${a?k`target as materialized (${a.target}),`:k``} capacity as (
-        select ${i===void 0?k`true`:k`(select count(*) from ${I} where organization_id = ${e} and status = 'queued') < ${i} ${r?k`or exists (select 1 from ${M} where key = ${u(r.key)} and expires_at > ${c}::timestamptz and value->>'owner' is distinct from ${r.owner??null}::text)`:k``}`} ${a?k`or exists (select 1 from target) or not ${a.create}`:k``} as allowed
-      ), ${d} ${a?k`advanced as (
-        update ${I} set inbox_seq = inbox_seq + 1, updated_at = ${c}::timestamptz where id in (select id from target) and exists (select 1 from receipt)
-        returning id, inbox_seq, generation
-      ), forwarded as (
-        insert into ${j} (organization_id, task_id, seq, generation, at, kind, value)
-        select ${e}, id, inbox_seq, generation, ${c}::timestamptz, 'steer', ${l({text:a.steer})} from advanced returning seq
-      ),`:k``} inserted as (
-        insert into ${I} (organization_id, public_id, source, status, agent, flow, review_key, runner, permissions,
-          app_id, installation_id, event, prompt, args, mcp, author, definition, credential, requester,
-          runner_id, usage, tools, tool_scopes, context, files, attempts, created_at, updated_at)
-        select ${e}, ${t.id}, ${t.source}, 'queued', ${t.agent}, ${t.flow}, ${Cp(t)??null}, ${t.runner}, ${t.permissions??null},
-          ${s?k`coalesce((select id from ${sr} where key = ${s.appId} and organization_id in (${e}, '')), 0)`:k`null`},
-          ${s?k`coalesce((select id from ${tr} where key = ${`${s.appId}:${s.installationId}`} and organization_id = ${e}), 0)`:k`null`},
-          ${l(s)}, ${t.prompt??null}, ${l(t.args)}, ${l(t.mcp)}, ${t.author??null}, ${l(t.definition)},
-          ${t.credential??null}, ${t.requester??null}, ${t.runnerId??null}, ${l(t.usage)}, ${l(t.tools)},
-          ${l(t.toolScopes)}, ${l(ts(t))}, ${l(t.files)}, 0, ${c}::timestamptz, ${c}::timestamptz
-        from capacity where allowed ${a?k`and ${a.create} and not exists (select 1 from target)`:k``} ${r?k`and exists (select 1 from receipt)`:k``}
-        returning id
-      )${_} select allowed, exists (select 1 from inserted) as inserted ${a?k`, exists (select 1 from forwarded) as steered`:k``} from capacity`}async deliver(e,t,n,r,i,a,o=!0,s){if(i===void 0)return o&&await this.enqueue(e,t,n,r,a,s)?{taskId:t.id}:{};let c=t.event,l=k`select id from ${I} where organization_id = ${e} and status in ('queued', 'running', 'waiting')
-      and agent = ${t.agent} and source = ${t.source} and flow = 'default'
-      and event->>'appId' is not distinct from ${c?.appId??null}
-      and event->>'installationId' is not distinct from ${c?.installationId??null}
-      and event->'chat'->'thread'->>'id' = ${c?.chat?.thread.id||null}
-      order by created_at desc, public_id desc limit 1 for update`,u=this.insertion(e,t,n,r,a,{target:l,create:o,steer:i},s),d=[k`select pg_advisory_xact_lock(3, hashtext(${JSON.stringify([e,xp(t)])}))`];a!==void 0&&o&&d.push(k`select pg_advisory_xact_lock(1, hashtext(${e}))`);let[f]=await ur(this.db,d,u);if(!f?.allowed)throw Error(`Organization task queue is full`);return f.inserted?{taskId:t.id}:f.steered?{steered:!0}:{}}async claim(e,t,n=!1,r){let i=k`not exists (select 1 from ${I} reviewing
-      where reviewing.organization_id = ${I.organizationId} and reviewing.status in ('running', 'waiting')
-        and reviewing.review_key = ${I.reviewKey})`,a=r===void 0?k`true`:k`(select count(*) from ${I} active where active.organization_id = ${I.organizationId} and active.status in ('running', 'waiting')) < ${r}`;if(!n){let[e]=await R(this.db,()=>vs(this.db,k`select exists (select 1 from ${I} where status = 'queued' and ${a} and ${i})
-        and ${t===void 0?k`true`:k`(select count(*) from ${I} where status in ('running', 'waiting')) < ${t}`} as ready`));if(!e?.ready)return}let o=wr(32).toString(`base64url`),s=k`translate(rtrim(replace(encode(convert_to(format('{"task":%s,"organization":%s,"attempt":%s}',
-      to_json(public_id), to_json(organization_id), attempts + 1), 'UTF8'), 'base64'), E'\\n', ''), '='), '+/', '-_') || '.' || ${o}`,c=k`with stamp as materialized (select date_trunc('milliseconds', clock_timestamp()) as at), picked as materialized (
-      select id, ${s} as bearer from ${I} where status = 'queued'
-        and ${a} and ${i}
-        ${t===void 0?k``:k`and (select count(*) from ${I} where status in ('running', 'waiting')) < ${t}`}
-        order by created_at, id limit 1 for update
-      ), claimed as (
-        update ${I} set status = 'running', attempts = attempts + 1, locked_at = (select at from stamp),
-          started_at = (select at from stamp), updated_at = (select at from stamp), last_seen_at = (select at from stamp),
-          token_hash = translate(rtrim(encode(sha256(convert_to(picked.bearer, 'UTF8')), 'base64'), '='), '+/', '-_')
-        from picked where ${I.id} = picked.id returning ${I}.*
-      ) select to_jsonb(claimed) as record, exists (select 1 from ${I} where status = 'queued' and id <> claimed.id
-        and ${i} and (${I.organizationId} <> claimed.organization_id or ${I.reviewKey} is null or ${I.reviewKey} is distinct from claimed.review_key)
-        and ${r===void 0?k`true`:k`(select count(*) from ${I} active where active.organization_id = ${I.organizationId} and active.status in ('running', 'waiting')) + case when ${I.organizationId} = claimed.organization_id then 1 else 0 end < ${r}`})
-        and ${t===void 0?k`true`:k`(select count(*) from ${I} where status in ('running', 'waiting')) + 1 < ${t}`} as more,
-        ${ic(k`claimed`)} as credential, ${ac(k`claimed.organization_id`)} as config, ${oc(k`claimed`)} as runner
-        from claimed`,[l]=await ur(this.db,[k`select pg_advisory_xact_lock(2, 0)`],c);if(!l)return;let u=J(I,l.record);return{organizationId:u.organizationId,status:fs(u),token:ec(u.publicId,u.organizationId,u.attempts,o).token,more:l.more,loaded:{credential:l.credential?Fs(l.credential).value:void 0,config:l.config??void 0,runner:l.runner?Is(l.runner).value:void 0}}}async authorize(e,t,n,r,i,a={}){let o=E(I.status,[`running`,`waiting`]),s=new Date(i).toISOString(),c=this.db.update(I).set({lastSeenAt:k`case when ${o} then ${s}::timestamptz else ${I.lastSeenAt} end`,updatedAt:k`case when ${o} then ${s}::timestamptz else ${I.updatedAt} end`}).where(this.fence(r,e,{tokenHash:t,attempts:n,statuses:a.allowCompleted?[`running`,`waiting`,`completed`,`failed`,`cancelled`]:[`running`,`waiting`]})).returning(),l=a.include===`context`,u=!!a.include,d=M,f=k`touched.organization_id`,p=e=>k`('o:' || ${rc(f,`snapshot`)} || ${e})`,m=e=>k`replace(replace(replace(${e}, '\\', '\\\\'), '%', '\\%'), '_', '\\_')`,h=k`(${d.expiresAt} is null or ${d.expiresAt} > ${s}::timestamptz)`,[g]=await vs(this.db,k`with touched as (${c.getSQL()}), target as (
-        select i.key, a.key as app from touched, ${tr} i join ${sr} a on a.id = i.app_id
-        where i.key = touched.event->>'appId' || ':' || (touched.event->>'installationId') and i.organization_id = touched.organization_id and ${l}
-      )
-      select to_jsonb(touched) as status,
-        case when ${l} then (select ${Ps(k`a`,k`s`)} from ${sr} a join ${A} s on s.id = a.credentials_secret_id
-          where a.key = touched.event->>'appId' and a.organization_id in (touched.organization_id, '')) end as app,
-        case when ${u} then (select ${Ps(k`i`,k`s`)} || jsonb_build_object('app', to_jsonb(a), 'credentials', to_jsonb(c))
-          from ${tr} i join ${sr} a on a.id = i.app_id join ${A} c on c.id = a.credentials_secret_id left join ${A} s on s.id = i.token_secret_id
-          where i.key = touched.event->>'appId' || ':' || (touched.event->>'installationId') and i.organization_id = touched.organization_id and i.deleted_at is null) end as installation,
-        case when ${u} then ${ic(k`touched`)} end as credential,
-        case when ${u} and touched.credential is null then (select coalesce(jsonb_agg(${Ps(k`c`,k`s`)}), '[]'::jsonb)
-          from ${ar} c join ${A} s on s.id = c.secret_id where c.organization_id = touched.organization_id
-          and (c.owner is null or c.owner = touched.requester)) end as credentials,
-        case when ${l} then ${ac(f)} end as config,
-        case when ${l} then ${oc(k`touched`)} end as runner,
-        case when ${u} then jsonb_build_object('rows', coalesce((select jsonb_agg(${d.value}->>'secret') from ${d}
-          where ${d.key} like ${m(p(k`'connection-secrets:' || touched.public_id || ':'`))} || '%' and ${h}), '[]'::jsonb),
-          'old', (select ${d.value} from ${d} where ${d.key} = ${p(k`'connection-secrets:' || touched.public_id`)} and ${h})) end as secrets,
-        case when ${l} then (select jsonb_build_object('key', ${d.key}, 'value', ${d.value}) from ${d}
-          where ${d.key} like ${m(p(k`'connections:' || touched.public_id || ':' || touched.generation || ':' || touched.attempts || ':'`))} || '%' and ${h} limit 1) end as resolved,
-        case when ${l} then (select coalesce(jsonb_object_agg(${d.key}, ${d.value}), '{}'::jsonb) from ${d} where ${h} and (
-          ${d.key} like any (select ${m(p(k`'token:' || key || ':'`))} || '%' from target)
-          or ${d.key} in (select ${p(k`'token-drop:' || key`)} from target union all select ${p(k`'token-drop:' || app`)} from target))) end as tokens
-      from touched`);if(!g)return;let _=J(I,g.status),v=_s(_.organizationId,`snapshot`),y=(e,t)=>e?t(e):void 0;return{organizationId:_.organizationId,status:fs(_),...u?{loaded:{installation:y(g.installation,e=>Ls(e).installation),credential:y(g.credential,e=>Fs(e).value),...g.credentials?{credentials:g.credentials.map(Fs)}:{},secrets:y(g.secrets,e=>({rows:e.rows,...e.old?{old:e.old}:{}})),...l?{app:y(g.app,e=>Cs(J(sr,e.row),J(A,e.sealed))),config:g.config??void 0,runner:y(g.runner,e=>Is(e).value),resolved:y(g.resolved,e=>({id:e.key.slice(v.length),value:e.value})),tokens:zs(_.organizationId,g.tokens??{})}:{}}}:{}}}async touch(e,t,n,r,i,a=!1){return(await this.authorize(t,n,r,e,i,{allowCompleted:a}))?.status}async patchTask(e,t,n,r,i={}){let{answer:a,archivedAt:o,autoArchived:s,lastSeenAt:c,logsComplete:l,...u}=n,[d]=await this.db.update(I).set({...Object.fromEntries(Object.entries(u).map(([e,t])=>[e,t??null])),...l===void 0?{}:{context:k`jsonb_set(coalesce(${I.context}, '{}'::jsonb), '{runnerLogs}', coalesce(${I.context}->'runnerLogs', '{}'::jsonb) || jsonb_strip_nulls(jsonb_build_object('complete', ${l??null}::boolean, 'handle', ${I.handle}, 'attempts', ${I.attempts}, 'generation', ${I.generation})))`},...a===void 0?{}:{answer:k`coalesce(${I.answer}, '[]'::jsonb) || ${JSON.stringify([a])}::jsonb`},...Object.hasOwn(n,`archivedAt`)?{archivedAt:o===void 0?null:new Date(o)}:{},...Object.hasOwn(n,`lastSeenAt`)?{lastSeenAt:c===void 0?null:new Date(c)}:{},updatedAt:new Date(r)}).where(this.fence(e,t,i)).returning({id:I.id});return!!d}async archiveStopped(e,t,n){await this.db.update(I).set({archivedAt:new Date(t),updatedAt:new Date(t)}).where(N(e===void 0?void 0:D(I.organizationId,e),n?E(I.publicId,n):void 0,O(I.archivedAt),E(I.status,[...De]),Un(k`coalesce(${I.finishedAt}, ${I.updatedAt})`,k`${new Date(t-$e).toISOString()}::timestamptz`)))}async requeue(e,t,n,r={}){let[i]=await this.db.update(I).set({status:`queued`,lockedAt:null,handle:null,tokenHash:null,lastSeenAt:null,updatedAt:new Date(n)}).where(this.fence(e,t,{...r,statuses:[`running`,`waiting`]})).returning({id:I.id});return!!i}connectionLock(e,t){return k`select pg_advisory_xact_lock(3, hashtext(${`app:${e}:connections:${t}`}))`}async deleteTask(e,t,n){let[r]=await ur(this.db,[this.connectionLock(e,t)],k`
-      with gone as (
-        delete from ${I} where ${this.fence(e,t,n)}
-        returning organization_id, public_id
-      ), marked as (
-        insert into ${er} (organization_id, public_id, deleted_at)
-        select organization_id, public_id, clock_timestamp() from gone
-      ), connections as (delete from ${M} where ${Ws(e,t)} and exists (select 1 from gone))
-      select count(*)::int as deleted from gone`);return!!r?.deleted}async finish(e,t,n,r,i={}){let a=new Date(r),o=this.db.update(I).set({status:n.status,result:n.result??null,error:n.error??null,tokens:n.tokens??null,lastSeenAt:a,lockedAt:null,finishedAt:a,updatedAt:a}).where(this.fence(e,t,{...i,statuses:[`queued`,`running`,`waiting`]})).returning({id:I.id}),[s]=await ur(this.db,[this.connectionLock(e,t)],k`
-      with finished as (${o.getSQL()}), purged as (
-        delete from ${M} where ${Ws(e,t)} and exists (select 1 from finished)
-      ) select id from finished`);return!!s}async continueTask(e,t,n,r,i){let a=k`(${JSON.stringify(n.context??{})}::jsonb - 'connections' - 'engineChain' - 'engineCredentials') || jsonb_strip_nulls(jsonb_build_object('connections', ${I.context}->'connections', 'engineChain', ${I.context}->'engineChain', 'engineCredentials', ${I.context}->'engineCredentials'))`,[o]=await this.db.update(I).set({prompt:n.prompt??null,context:a,status:`queued`,attempts:0,generation:k`${I.generation} + 1`,inboxAck:-1,result:null,error:null,tokens:null,handle:null,tokenHash:null,lastSeenAt:null,logCursor:null,lockedAt:null,startedAt:null,finishedAt:null,cancelRequestedAt:null,approval:null,answer:null,archivedAt:null,updatedAt:new Date(r)}).where(this.fence(e,t,{...i,statuses:[`completed`,`failed`,`cancelled`]})).returning({context:I.context});return o&&(n.context=ns(o.context).context),!!o}async completeTask(e,t,n,r){let{outcome:i,usage:a}=n,o=new Date(r).toISOString(),s=n.logsComplete?k`, context = jsonb_set(coalesce(${I.context}, '{}'::jsonb), '{runnerLogs}', jsonb_strip_nulls(jsonb_build_object('complete', true, 'handle', ${I.handle}, 'attempts', ${I.attempts}, 'generation', ${I.generation})))`:k``,c=n.known?.length?k`, posts as (insert into ${M} (key, value, expires_at)
-      select key, ${JSON.stringify({at:r})}::jsonb, expires_at from (values ${k.join(n.known.map(t=>k`(${Y(e,`delivery`,t.id)}, ${new Date(r+t.ttlMs).toISOString()}::timestamptz)`),k`, `)}) as row(key, expires_at) where exists (select 1 from finished)
-      on conflict (key) do update set value = excluded.value, expires_at = excluded.expires_at)`:k``,[l]=await ur(this.db,[this.connectionLock(e,t)],k`
-    with finished as (
-      update ${I} set status = ${i.status}, result = ${JSON.stringify(i.result??null)}::jsonb,
-        error = ${i.error??null}, tokens = ${JSON.stringify(i.tokens??null)}::jsonb,
-        last_seen_at = ${o}::timestamptz, locked_at = null, finished_at = ${o}::timestamptz, updated_at = ${o}::timestamptz${s}
-      where ${this.fence(e,t,{attempts:n.attempts,tokenHash:n.tokenHash,statuses:[`running`,`waiting`]})}
-      returning id, installation_id, generation
-    ), connections as (delete from ${M} where ${Ws(e,t)} and exists (select 1 from finished)), inbox as (delete from ${j} where (task_id, generation) in (select id, generation from finished))${c}, recorded as (
-      insert into ${lr} (organization_id, task_id, installation_id, agent, target, engine, model, credential, runner_ms, tokens, at, updated_at)
-      select ${e}, id, installation_id, ${a.agent}, ${a.target}, ${a.engine??null}, ${a.model??null},
-        ${a.credential}, ${a.runnerElapsedMs}, ${JSON.stringify(a.tokens??null)}::jsonb, ${new Date(a.at).toISOString()}::timestamptz, ${o}::timestamptz from finished
-      on conflict (task_id) do update set installation_id = excluded.installation_id, agent = excluded.agent, target = excluded.target,
-        engine = excluded.engine, model = excluded.model, credential = excluded.credential, runner_ms = ${lr.runnerMs} + excluded.runner_ms,
-        tokens = ${sc(k`${lr.tokens}`,a.tokens)}, at = excluded.at, updated_at = excluded.updated_at
-    )
-    select exists (select 1 from finished) as completed`);return!!l?.completed}async cancel(e,t,n,r={}){let i=new Date(n).toISOString(),[a]=await ur(this.db,[this.connectionLock(e,t)],k`
-    with cancelled as (
-      update ${I} set status = case when status = 'queued' then 'cancelled' else status end,
-        finished_at = case when status = 'queued' then ${i}::timestamptz else finished_at end,
-        inbox_seq = case when status = 'queued' then inbox_seq else inbox_seq + 1 end,
-        cancel_requested_at = ${i}::timestamptz, updated_at = ${i}::timestamptz
-      where ${this.fence(e,t,{...r,statuses:Q})} returning id, generation, inbox_seq, status
-    ), connections as (delete from ${M} where ${Ws(e,t)} and exists (select 1 from cancelled where status = 'cancelled')), message as (
-      insert into ${j} (organization_id, task_id, seq, generation, kind, value, at)
-      select ${e}, id, inbox_seq, generation, 'cancel', 'null'::jsonb, ${i}::timestamptz from cancelled where status in ('running', 'waiting')
-    ) select exists(select 1 from cancelled) as accepted`);return!!a?.accepted}async cancelRequested(e,t){let[n]=await R(this.db,()=>this.db.select({at:I.cancelRequestedAt}).from(I).where(this.where(e,t)));return!!n?.at}filter(e,t){let n=t.status?[t.status]:t.statuses,r=t.q?.trim(),i=r&&`%${r.replace(/[\\%_]/g,`\\$&`)}%`;return N(D(I.organizationId,e),n?E(I.status,n):void 0,t.agent?D(I.agent,t.agent):void 0,t.source?D(I.source,t.source):void 0,t.reviewKey?D(I.reviewKey,t.reviewKey):void 0,t.archived===void 0?void 0:t.archived?qn(I.archivedAt):O(I.archivedAt),i?Zn(Gn(k`${I.event}->>'text'`,i),Gn(I.prompt,i),Gn(I.agent,i),Gn(I.publicId,i)):void 0)}pageQuery(e,t){let{before:n}=t,r=t.summary?{publicId:I.publicId,source:I.source,agent:I.agent,flow:I.flow,prompt:I.prompt,event:k`case when ${I.event} is not null then jsonb_build_object('integration', ${I.event}->>'integration', 'type', ${I.event}->>'type', 'text', ${I.event}->>'text') end`.as(`event`),status:I.status,attempts:I.attempts,approval:I.approval,archivedAt:I.archivedAt,createdAt:I.createdAt,startedAt:I.startedAt,finishedAt:I.finishedAt,updatedAt:I.updatedAt}:$n(I),i=this.db.select(r).from(I).where(N(this.filter(e,t),t.since===void 0?void 0:Zn(Jn(I.updatedAt,new Date(t.since)),t.sinceId?N(D(I.updatedAt,new Date(t.since)),Jn(uc(I.publicId),t.sinceId)):void 0),n?this.after(n):void 0)).orderBy(...t.since===void 0?dc(I):fc(I));return t.limit===void 0?i:i.limit(t.limit)}after(e){if(`updatedAt`in e)return Zn(Jn(I.updatedAt,new Date(e.updatedAt)),N(D(I.updatedAt,new Date(e.updatedAt)),Jn(uc(I.publicId),e.id)));let t=k`(${lc(I.createdAt)}, ${uc(I.publicId)}) < (${new Date(e.createdAt).toISOString()}::timestamptz, ${e.id})`;return Zn(Jn(cc(I.status),e.rank),N(D(cc(I.status),e.rank),t))}record(e,t){return t?as({task:as({id:e.publicId,source:e.source,agent:e.agent,flow:e.flow,prompt:e.prompt,event:e.event}),status:e.status,attempts:e.attempts,approval:e.approval,archivedAt:e.archivedAt?K(e.archivedAt):void 0,createdAt:K(e.createdAt),startedAt:e.startedAt?K(e.startedAt):void 0,finishedAt:e.finishedAt?K(e.finishedAt):void 0,updatedAt:K(e.updatedAt)}):fs(e)}async list(e,t={}){return(await R(this.db,()=>this.pageQuery(e,t))).map(e=>this.record(e,t.summary))}async changes(e,t){if(!e.length)return{rows:[],deleted:[]};let n=e.map(e=>e.organizationId),r=e.flatMap(e=>e.ids.map(()=>e.organizationId)),i=e.flatMap(e=>e.ids),a=i.length?k`(${I.organizationId}, ${I.publicId}) in (select * from unnest(${k.param(r)}::text[], ${k.param(i)}::text[]))`:k`false`,[o,s]=await Promise.all([R(this.db,()=>this.db.select({organizationId:I.organizationId,publicId:I.publicId,source:I.source,agent:I.agent,flow:I.flow,status:I.status,approval:I.approval,answer:k`case when ${a} then ${I.answer} end`,result:k`case when ${a} then ${I.result} end`,error:k`case when ${a} then ${I.error} end`,attempts:I.attempts,archivedAt:I.archivedAt,createdAt:I.createdAt,startedAt:I.startedAt,finishedAt:I.finishedAt,updatedAt:I.updatedAt}).from(I).where(Zn(N(E(I.organizationId,n),Jn(I.updatedAt,new Date(t))),i.length?a:void 0))),R(this.db,()=>this.db.select().from(er).where(N(E(er.organizationId,n),Jn(er.deletedAt,new Date(t)))))]);return{rows:o.map(e=>({organizationId:e.organizationId,status:as({task:{id:e.publicId,source:e.source,agent:e.agent,flow:e.flow},status:e.status,approval:e.approval,answer:Array.isArray(e.answer)?e.answer:void 0,result:e.result,error:e.error,attempts:e.attempts,archivedAt:e.archivedAt&&K(e.archivedAt),createdAt:K(e.createdAt),startedAt:e.startedAt&&K(e.startedAt),finishedAt:e.finishedAt&&K(e.finishedAt),updatedAt:K(e.updatedAt)})})),deleted:s.map(e=>({organizationId:e.organizationId,id:e.publicId,at:K(e.deletedAt)}))}}countQuery(e,t){return this.db.select({all:k`count(*)::int`.as(`all`),active:k`(count(*) filter (where ${E(I.status,Q)}))::int`.as(`active`),waiting:k`(count(*) filter (where ${D(I.status,`waiting`)}))::int`.as(`waiting`)}).from(I).where(this.filter(e,t))}async counts(e,t={}){let[n]=await R(this.db,()=>this.countQuery(e,t));return n??{all:0,active:0,waiting:0}}async listWithCounts(e,t){let n=this.db.$with(`totals`).as(this.countQuery(e,t)),r=this.db.$with(`page`).as(this.pageQuery(e,{...t,limit:t.limit??20})),i=Object.fromEntries(Object.keys(r._.selectedFields).map(e=>[e,r[e]])),a=await R(this.db,()=>this.db.with(n,r).select({...i,all:n.all,active:n.active,waiting:n.waiting}).from(n).leftJoin(r,k`true`).orderBy(...t.since===void 0?dc({status:i.status,createdAt:i.createdAt,publicId:i.publicId}):fc({updatedAt:i.updatedAt,publicId:i.publicId}))),{all:o=0,active:s=0,waiting:c=0}=a[0]??{};return{items:a.filter(e=>e.publicId!==null&&e.publicId!==void 0).map(e=>this.record(e,t.summary)),counts:{all:o,active:s,waiting:c}}}async runningCount(){let[e]=await R(this.db,()=>this.db.select({value:k`count(*)::int`}).from(I).where(E(I.status,[`running`,`waiting`])));return e?.value??0}async running(){return(await R(this.db,()=>this.db.select().from(I).where(E(I.status,[`running`,`waiting`])))).map(e=>({organizationId:e.organizationId,status:fs(e)}))}async appendLogs(e,t,n,r,i,a,o){let s=n.length?k`, inserted as (
-      insert into ${nr} (organization_id, task_id, seq, at, level, line)
-      select ${e}, accepted.id, entry.seq, to_timestamp(entry.at / 1000.0), entry.level, entry.line
-      from accepted cross join jsonb_to_recordset(${JSON.stringify(n)}::jsonb) as entry(seq int, at bigint, level text, line text)
-    )`:k``,[c]=await vs(this.db,k`
-      with accepted as (
-        update ${I} set log_cursor = ${i.cursor}, log_seq = ${i.seq}, log_bytes = ${i.bytes}, updated_at = ${new Date(a).toISOString()}::timestamptz
-        where ${this.fence(e,t,o)} and coalesce(log_seq, 0) = ${r.seq} and coalesce(log_cursor, -1) = ${r.cursor}
-        returning id
-      ) ${s} select exists (select 1 from accepted) as accepted`);return!!c?.accepted}async readInbox(e,t,n,r){return(await R(this.db,()=>this.db.select({seq:j.seq,generation:j.generation,at:j.at,kind:j.kind,value:j.value}).from(j).innerJoin(I,D(I.id,j.taskId)).where(N(this.where(e,t),D(I.generation,n),E(I.status,Q),D(j.generation,n),k`${j.seq} > ${r}`)).orderBy(P(j.seq)).limit(100))).map(e=>({...e,at:K(e.at)}))}async appendInbox(e,t,n,r,i,a,o){let s=o?k`select key, value from ${M}
-          where key = ${Y(e,`delivery`,o.key)}
-            and value->'sending'->>'owner' = ${o.owner}
-            and (expires_at is null or expires_at > ${new Date(i).toISOString()}::timestamptz) for update`:k`select null`,c=o&&pp(o),l=c?k`, context = coalesce(${I.context}, '{}'::jsonb) || jsonb_build_object('admissions',
-          coalesce(${I.context}->'admissions', '{}'::jsonb) || ${JSON.stringify(c)}::jsonb)`:k``,u=k`(${M.value}->'sending'->>'count')::int`,d=k`coalesce((select n from jsonb_array_elements(${M.value}->'items') with ordinality e(item,n)
-          where n <= ${u} and item->>'admission' = ${o?.through??null}::text limit 1), 0)`,[f]=await vs(this.db,k`
-      with held as materialized (${s}), next as (
-        update ${I} set inbox_seq = inbox_seq + 1, updated_at = ${new Date(i).toISOString()}::timestamptz${l}
-        where ${this.fence(e,t,{generation:a,statuses:Q})}
-          and exists(select 1 from held) returning id, inbox_seq, generation
-      ), admitted as (
-        insert into ${j} (organization_id, task_id, seq, generation, kind, value, at)
-        select ${e}, id, inbox_seq, generation, ${n}, ${JSON.stringify(c?{...r,admissions:c}:r??null)}::jsonb, ${new Date(i).toISOString()}::timestamptz from next returning seq
-      ) ${o?k`, acknowledged as (
-        update ${M} set value = (${M.value} - 'sending') || jsonb_build_object(
-          'items', coalesce((select jsonb_agg(item order by n) from jsonb_array_elements(${M.value}->'items') with ordinality e(item,n) where n > ${d}), '[]'::jsonb)) ||
-          case when ${u} > ${d} then jsonb_build_object('sending',
-            (${M.value}->'sending') || jsonb_build_object('count', ${u} - ${d}, 'until', ${i+In}::bigint)) else '{}'::jsonb end
-        where key in (select key from held) and exists(select 1 from admitted)
-      )`:k``}
-      select (select seq from admitted) as seq, exists(select 1 from held) as held`);if(o&&!f?.held)throw new mp;return f?.seq==null?void 0:{seq:f.seq,generation:a,at:i,kind:n,value:r}}async fetchInbox(e,t,n,r,i){let[a]=await R(this.db,()=>vs(this.db,k`
-      select coalesce(jsonb_agg(jsonb_build_object('seq', i.seq, 'generation', i.generation, 'at', extract(epoch from i.at) * 1000, 'kind', i.kind, 'value', i.value) order by i.seq) filter (where i.seq is not null), '[]'::jsonb) as entries
-      from ${I} left join ${j} i on i.task_id = ${I.id} and i.generation = ${I.generation} and i.seq > ${i}
-      where ${this.fence(e,t,{tokenHash:n,attempts:r,statuses:[`running`,`waiting`]})} group by ${I.id}`));return a?.entries}async ackInbox(e,t,n,r){if(r.generation!==void 0&&r.generation!==n.generation)return;let[i]=await ur(this.db,[this.connectionLock(e,t)],k`
-    with current as (
-      select id from ${I} where ${this.fence(e,t,{...r,generation:n.generation,statuses:void 0})}
-        and inbox_seq >= ${n.seq} and (status in ('running', 'waiting') or (status in ('completed', 'failed', 'cancelled') and inbox_ack >= ${n.seq})) for update
-    ), applied as (
-      delete from ${j} where task_id in (select id from current) and generation = ${n.generation} and seq <= ${n.seq} returning seq, kind, value
-    ), answers as (
-      select jsonb_agg(a.value order by a.seq) as value from jsonb_to_recordset(${JSON.stringify(n.answers??[])}::jsonb) a(seq int, value jsonb)
-      where exists (select 1 from applied where applied.seq = a.seq and applied.kind = 'ask')
-    ), updated as (
-      update ${I} set inbox_ack = greatest(inbox_ack, ${n.seq}), answer = coalesce(answer, '[]'::jsonb) || coalesce(answers.value, '[]'::jsonb),
-        status = case when exists(select 1 from applied where kind = 'cancel') then 'cancelled'
-          when exists(select 1 from applied where kind = 'approve' and value->>'approvalId' = ${I.approval}->>'id') then 'running' else status end,
-        approval = case when exists(select 1 from applied where kind = 'approve' and value->>'approvalId' = ${I.approval}->>'id') then null else approval end,
-        finished_at = case when exists(select 1 from applied where kind = 'cancel') then now() else finished_at end,
-        updated_at = now()
-      from answers where id in (select id from current) returning status
-    ), connections as (delete from ${M} where ${Ws(e,t)} and exists (select 1 from updated where status = 'cancelled'))
-    select exists (select 1 from current) as accepted, (select status from updated) as status`);return i?.accepted?i.status??void 0:void 0}async pendingInbox(e){return(await R(this.db,()=>this.db.select().from(I).where(N(e===void 0?void 0:D(I.organizationId,e),E(I.status,[`running`,`waiting`]),k`exists (select 1 from ${j} where ${j.taskId} = ${I.id} and ${j.generation} = ${I.generation})`)))).map(e=>({organizationId:e.organizationId,status:fs(e)}))}};const mc=(e,t)=>`${e}:${String(t).padStart(6,`0`)}`;async function hc(e,t,n){n.length&&await e.store.withAppLock(`connection-warnings:${t}`,async r=>{let i=r instanceof Qs?new pc(r.db):e.queue,a=[];for(let e of new Set(n))await r.get(`delivery`,`connection-warning:${t}:${e}`)||a.push(e);if(a.length)for(let n=0;n<3;n++){let n=await r.get(`task`,t);if(!n)return;let o=n.logSeq??0,s=n.logCursor??-1,c=(e.now??Date.now)();if(await i.appendLogs(e.organizationId,t,a.map((e,t)=>({seq:o+t,at:c,level:`sys`,line:e})),{seq:o,cursor:s},{seq:o+a.length,cursor:s,bytes:(n.logBytes??0)+a.reduce((e,t)=>e+Buffer.byteLength(t),0)},c,{attempts:n.attempts,tokenHash:n.tokenHash??null,handle:n.handle,generation:n.generation??0})){for(let e of a)await r.put(`delivery`,`connection-warning:${t}:${e}`,{at:c});return}}})}async function gc(e,t,n,r,i,a=0){let o=_c(n,r,i,a);return await e.putMany(`tasklog`,o.lines.map(({seq:e,...n})=>({id:mc(t,e),value:n}))),{seq:o.seq,bytes:o.bytes}}function _c(e,t,n,r){let i=t,a=r,o=[];for(let t of e){let e=Buffer.byteLength(t.line);if(a+e>2097152)break;o.push({seq:i,at:t.at??n,level:t.level,line:t.line}),a+=e,i+=1}return{lines:o,seq:i,bytes:a}}async function vc(e,t,n=-1,r){return(await e.list(`tasklog`,{prefix:`${t}:`,...n>=0?{after:mc(t,n)}:{},...r?{limit:r}:{}})).map(e=>{let t=Rt(e.value.line);return{seq:Number(e.id.slice(e.id.lastIndexOf(`:`)+1)),...e.value,...t?{entry:t}:{}}})}async function yc(e,t,n=!1){let r=e.settings??={},i=r.taskLogSecrets??=new Map,a=JSON.stringify([e.organizationId,t.task.id,t.attempts,t.generation,t.tokenHash]);n&&i.delete(a);let o=i.get(a);return o||(o=dd(e,t).then(e=>{let t=e.sort((e,t)=>t.length-e.length);return e=>t.reduce((e,t)=>t?e.replaceAll(t,`[REDACTED]`):e,e)}).catch(e=>{throw i.delete(a),e}),i.set(a,o),setTimeout(()=>{i.get(a)===o&&i.delete(a)},(e.config.taskTimeoutMs??18e5)+6e4).unref?.()),o}async function bc(e,t,n){let r=await yc(e,t),i=e=>typeof e==`string`?r(e):Array.isArray(e)?e.map(i):e&&typeof e==`object`?Object.fromEntries(Object.entries(e).map(([e,t])=>[r(e),i(t)])):e,a=e=>{try{return JSON.stringify(i(JSON.parse(e)))}catch{return r(e)}};for(let r=0;r<5;r++){let i=r===0&&e.callbackTask===t?t:await e.store.get(`task`,t.task.id);if(!i||i.attempts!==t.attempts||i.tokenHash!==t.tokenHash||i.generation!==t.generation)return`stale`;let o=i.logCursor??-1,s=n.filter(e=>e.seq>o);if(!s.length)return`ok`;if(i.logsComplete||s[0].seq!==o+1)return`gap`;let c=(e.now??Date.now)(),l=_c(s.map(e=>({...e,line:a(e.line)})),i.logSeq??0,c,i.logBytes??0);if(await e.queue.appendLogs(e.organizationId,t.task.id,l.lines,{seq:i.logSeq??0,cursor:o},{seq:l.seq,cursor:s.at(-1).seq,bytes:l.bytes},c,{attempts:t.attempts,tokenHash:t.tokenHash,generation:t.generation??0}))return`ok`}return`stale`}function xc(e,t){return zr(e,`link-start`,`*`,JSON.stringify(t),3e5)}function Sc(e,t,n){return`thread:${e}:${t}:${n}`}async function Cc(e,t,n,r,i,a,o){let s={},c=Tt(e.integrations),l=n.settings?.configRepo,u=c&&l?await i(c.id).then(t=>t?Da(e,c,t,l,`.coder/${a.id}.md`):void 0).catch(()=>void 0):void 0;if(u?.trim()&&(s.instructions=u.trim(),s.repository=l),o)s.user={name:o.name,email:o.email};else if(o===void 0&&e.auth&&r.actor.id){let n=await e.auth.linkedUser(t.id,r.actor.id).catch(()=>void 0);n&&(s.user={name:n.name,email:n.email})}return s}const wc=2592e6,Tc=36e5;async function Ec(e,t){if(!t.chat)return{};let n=Dc(t);return e.store.conversationState(n)}const Dc=e=>Sc(e.appId,e.installationId,e.chat.thread.id),Oc=e=>e.slice(0,e.indexOf(`:`)),kc=e=>e.channelId?.slice((e.adapterName?.length??-1)+1)??``;function Ac(e,t,n,r){return`known:${e}:${t}:${n}:${r}`}async function jc(e,t){return t.chat?(await e.store.conversationState(Dc(t))).status:void 0}function Mc(e,t,n){let r=e.chat?.thread;if(!r)return;let i=r.id.slice((r.channelId?.length??-1)+1);return{key:Dc(e),record:{at:n,taskId:t,...e.chat?.message?{seen:e.chat.message.id}:{}},root:Ac(e.appId,e.installationId,kc(r),i),ttlMs:wc}}async function Nc(e,t,n,r){let i=Mc(t,n,r);i&&await e.store.putMany(`delivery`,[{id:i.key,value:i.record},{id:i.root,value:{at:r}}],{ttlMs:wc})}function Pc(e,t){let n=e.chat?.thread;return n?[...new Set([t].flat().filter(Boolean))].map(t=>Ac(e.appId,e.installationId,kc(n),t)):[]}async function Fc(e,t,n,r){await e.store.putMany(`delivery`,Pc(t,n).map(e=>({id:e,value:{at:r}})),{ttlMs:wc})}async function Ic(e,t,n,r){if(t.chat?.message)return e.store.markConversation(Dc(t),n,t.chat.message.id,r,wc)}function Lc(e){let t=e.conversation?.unseen;return e.chat&&t!==void 0?{key:Dc(e),version:t.version,...t.epoch?{epoch:t.epoch}:{}}:void 0}async function Rc(e,t,n){await e.store.appendUnseen(Dc(t),n,wc)}async function zc(e,t){let n=Lc(t);n&&await e.store.acknowledgeUnseen(n.key,n.version,n.epoch)}function Bc(e,t,n){let r=xt(n.definition.integrations[e.id]);return!t.builtin&&Object.entries(e.events).some(([e,t])=>t.noisy&&r.includes(e))}async function Vc(e,t,n,r){let i=n.chat?.thread;if(!i)return n;let a=i.isDM===!0,o=t.events[n.type]?.on===`mention`||n.chat?.message?.isMention===!0,s=a||o||t.answersEveryPrompt===!0,[c,l]=await Promise.all([r.loaded?r.unseen??{messages:[],more:0}:e.store.get(`delivery`,`since:${Dc(n)}`).then(e=>e??{messages:[],more:0}),t.conversation?t.conversation(n,{token:r.token,fetch:e.fetch??fetch,delivered:r.delivered,...r.existing?.seen?{after:r.existing.seen}:{}}).catch(e=>(console.error(`coder server: ${t.id} conversation facts failed`,e),{})):{}]),u=new Set(c.messages.flatMap(e=>e.id??[])),d=new Map(l.since?.flatMap(e=>e.id?[[e.id,e]]:[])),f=[...c.messages.map(({sequence:e,...t})=>t.id&&d.get(t.id)||t),...(l.since??[]).filter(e=>!e.id||!u.has(e.id))],p=f.slice(0,50),m=(l.since?0:c.more)+f.length-p.length,h=r.existing||a?void 0:l.index??n.conversation?.index;return{...n,mustReply:s,conversation:{...h===void 0?{}:{index:h},...c.messages.length||c.more?{unseen:{version:c.version??c.messages.length+c.more,epoch:c.epoch}}:{},...p.length?{since:p}:{},...m?{more:m}:{}}}}async function Hc(e,t,n){for(;;){let r=await e.store.claimBatch(t,n);if(r!==null)return r;await new Promise(e=>setTimeout(e,500))}}async function Uc(e,t,n,r,i){return e.store.finishBatch(t,n,r,i)}async function Wc(e,t,n,r){let i=await e.store.get(`task`,t.task.id)??t,a=Oc(n),o=await Op(e,t.task.id,-1,i.generation??0),s=new Set([i.task.context?.admissions?.[a],...o.map(e=>e.value?.admissions?.[a])]);return{fresh:i,through:r.reduce((e,t,n)=>s.has(t.admission)?n+1:e,0)}}async function Gc(e,t,n,r){if(!Q.includes(t.status))return!1;let i=t.status!==`queued`&&Kc(e,t.task)?kd(e.local.cwd,t.task.id,!1):void 0;return i&&!Q.includes(i.status)?!1:!!await Dp(e,t,`steer`,{text:n},r)}const Kc=(e,t)=>!!e.local&&!t.event?.repo&&t.runner===`local`&&!t.runnerId;async function qc(e,t,n,r,i){let{task:a}=t,o={mustReply:r,admissions:{...a.context?.admissions,...i}};if(Kc(e,a))return Ad(e,e.local.cwd,a.id,n,void 0,{},o);try{await vo(e,{...t,task:{...a,context:{...a.context,...o}}},n)}catch(e){if(e instanceof U&&e.status===409)return!1;throw e}return!0}function Jc(e,t){let n=t.catch(e=>console.error(`coder server: conversation batch failed`,e));e.waitUntil&&e.waitUntil(n)}function Yc(e){let t=t=>_e(e.slice(0,t).map(e=>e.event),e[t-1].user),n=t(1);if(n.length>65536){let t=e[0].event,n=n=>_e([{...t,text:t.text.slice(0,n)+`
-[message truncated]`}],e[0].user);n(0).length>65536&&(t={...t,conversation:{...t.conversation,since:void 0,more:(t.conversation?.more??0)+(t.conversation?.since?.length??0)},promptContext:void 0,chat:t.chat?{thread:t.chat.thread,message:t.chat.message?{...t.chat.message,attachments:[],links:[]}:void 0}:void 0});let r=0,i=t.text.length;for(;r<i;){let e=Math.ceil((r+i)/2);n(e).length<=65536?r=e:i=e-1}return{text:n(r),count:1}}let r=1;for(;r<e.length;){let e=t(r+1);if(e.length>65536)break;n=e,r++}return{text:n,count:r}}async function Xc(e,t,n,r,i,a){let o=`batch:${Dc(n)}`;if(!(a?a.batch:await e.store.get(`delivery`,o))?.items.length&&await Gc(e,t,_e([n],r))){await zc(e,n),await Ic(e,n,t.task.id,i());return}let s=Tr(),c=n.chat?.message,l=c?{...n,chat:{thread:n.chat.thread,message:{...c,formatted:{type:`root`,children:[]},raw:null,attachments:c.attachments.map(({type:e,url:t,name:n})=>({type:e,...t?{url:t}:{},...n?{name:n}:{}}))}}}:n;await e.store.appendBatch(o,s,[{admission:s,event:l,user:r}],i(),Tc),await zc(e,n),Jc(e,(async()=>{await new Promise(t=>setTimeout(t,e.config.steerBatchMs??5e3));let n=await Hc(e,o,s);if(!n)return;let r=n.items.map((e,t)=>t===n.items.length-1?{...e,event:{...e.event,mustReply:e.event.mustReply||n.mustReply,conversation:{...e.event.conversation,more:(e.event.conversation?.more??0)+(n.more??0)}}}:e),a=!1,c=!1,l=!1;try{for(let n=0;n<r.length;){let{fresh:a,through:u}=await Wc(e,t,o,r);if(u>n){if(c=!0,!await Uc(e,o,s,!0,r[u-1].admission))return;n=u;continue}let{text:d,count:f}=Yc(r.slice(n)),p=r.slice(n,n+f),m=p.at(-1).admission,h=await Gc(e,a,d,{key:o,owner:s,through:m}),g=h||await qc(e,a,d,p.some(e=>e.event.mustReply===!0),{[Oc(o)]:m});if(!g&&!l){l=!0;continue}if(!g)throw Error(`Conversation task did not accept the batch`);if(c=!0,!h&&!await Uc(e,o,s,!0,m))return;await Ic(e,p.at(-1).event,t.task.id,i()),n+=f}a=!0}catch(e){if(!(e instanceof mp))throw e}finally{a||await Uc(e,o,s,!1),c&&await Lo(e,!0,!1,!0)}})())}async function Zc(e,t,n,r){let i=await jc(e,t);if(!i||!Q.includes(i.status))return;let a=`reactions:${Dc(t)}`,o=Tr();await e.store.appendBatch(a,o,[{...n,admission:o}],r(),Tc),Jc(e,(async()=>{await new Promise(t=>setTimeout(t,e.config.reactionBatchMs??3e4));let n=await Hc(e,a,o);if(!n)return;let r=!1;try{let{fresh:s,through:c}=await Wc(e,i,a,n.items),l=n.items.slice(c);if(c&&!await Uc(e,a,o,!0,n.items[c-1].admission))return;if(!l.length){r=!0;return}let u=new Map;for(let{emoji:e,by:t,on:n}of l){let r=u.get(`${e}\n${n}`)??{emoji:e,by:[],on:n};r.by.includes(t)||r.by.push(t),u.set(`${e}\n${n}`,r)}r=await Gc(e,s,Se({...t,conversation:{...t.conversation,more:n.more}},[...u.values()]),{key:a,owner:o,through:l.at(-1).admission})}catch(e){if(!(e instanceof mp))throw e}finally{r||await Uc(e,a,o,!1)}})())}const Qc=6e4,$c=864e5,el=262144,tl=[`model`,`engine`,`effort`],nl=[`Usage:`,"• `/setup model <name>`. Sets the engine model. Also accepts `engine` and `effort`.","• `/setup show`. Shows the current settings."].join(`
-`);function rl(e){return e.type===`command`}function il(e){let t=Object.entries(e??{}).filter(([,e])=>e);return t.length?`Current settings:\n${t.map(([e,t])=>`• ${e}: \`${t}\``).join(`
-`)}`:`No settings yet. A workspace admin can configure this agent in the dashboard.`}function al(e){let[t=``,...n]=e.text.trim().split(/\s+/);return tl.includes(t)&&n.join(` `).trim()!==``}async function ol(e,t,n){let[r=``,...i]=e.text.trim().split(/\s+/),a=i.join(` `).trim(),o={...t.settings},s;return r?r===`show`?s=il(t.settings):tl.includes(r)?a?(o[r]=a,s=`${r} set to \`${a}\`.`):s=`Give a value: \`/setup ${r} <name>\`.`:s=`Unknown setting \`${r}\`.\n${nl}`:s=nl,JSON.stringify(o)!==JSON.stringify(t.settings??{})&&await Ga(n,`installation`,t.id,{settings:o}),s}async function sl(e,t,n){let r=`${t.id}:${n.installationId}`,i=e.boundInstallation?.installation.id===r?e.boundInstallation.installation:await e.store.get(`installation`,r);return i&&!i.deletedAt?i:void 0}async function cl(e,t,n){let r=await e.auth.linkedUser(t.id,n.actor.id).catch(()=>void 0);return r?.organizations?.includes(e.organizationId)?r:void 0}async function ll(e,t,n,r){if(!t.auth.canWrite)return;let i=await(await r(n.integration)).token();return t.auth.canWrite(n,i,e.fetch).catch(e=>(console.error(`coder server: ${t.id} write check failed for ${n.appId} event ${n.deliveryId}`,e),null))}async function ul(e,t,n,r,i){let a=e.config.publicUrl?.replace(/\/$/,``);if(!a)return;let o=e=>`Link your Coder account so I can work for you here: ${e}`;if(t.auth.user){await i.post(o(`${a}/connect/${t.id}?installation=${encodeURIComponent(n.id)}`));return}let s=await xc(e,{platform:t.id,platformUserId:r.actor.id});await i.whisper(o(`${a}/connect?token=${encodeURIComponent(s)}`))}async function dl(e,t){let n=Object.keys(t.definition.integrations),r=await Promise.all(n.map(t=>e(t)));return new Set(n.filter((e,t)=>r[t]))}async function fl(e,t,n){let r={};t.repo?r[t.integration]={repo:{owner:t.repo.owner,name:t.repo.name}}:t.chat&&(r[t.integration]={thread:t.chat.thread.id,...t.within?{within:t.within}:{}});for(let[t,i]of Object.entries(e.connections??{})){if(i.kind!==`installation`)continue;let e=((await n(t))?.record)?.settings?.configRepo,a=e&&/^([^/]+)\/([^/]+)$/.exec(e);a&&(r[t]={repo:{owner:a[1],name:a[2]}})}return r}async function pl(e,t,n){return`No model is configured yet. If you have access to it, [add one here](${await vf(e,t,n)}).`}async function ml(e,t,n){return`There was a problem with your connected model. If you have access to it, [check it here](${await vf(e,t,n)}).`}async function hl(e,t,n){let r=e.config.publicUrl?.replace(/\/$/,``);return r?`${r}${mh(n,`/tasks/${t}`)}`:void 0}async function gl(e,t,n){let r=t.chat?.thread.id;if(!e.local||t.repo||!r)return;let i=(await e.store.list(`delivery`,{prefix:`delivery:`})).find(({value:e})=>{let i=e.pending?.task;return i?.flow==="default"&&i.agent===n&&i.event?.appId===t.appId&&i.event.installationId===t.installationId&&i.event.chat?.thread.id===r&&e.pending?.taskId})?.value.pending;if(!i?.task)return;let a=await Ed(e,i.task,i.taskId);return await Nc(e,i.task.event,a.task.id,(e.now??Date.now)()),await e.store.get(`task`,a.task.id)??a}async function _l(e,t,n,r,i,a,o){let s=`delivery:${t.id}:${n.id}:${i.installationId}:${i.chat?.thread.id??``}:${i.deliveryId}`,c=await sl(e,n,i);if(!c)return{};if(e.local&&await(e.syncAgent?.(n.agent)??kn(e.store,e.local.cwd,e.integrations,n.agent)).catch(e=>console.error(`coder server: local agent sync failed`,e)),!e.local){let l=Tr(),u={delivery:{key:s,owner:l,at:a(),ttlMs:Qc},agent:n.agent,...i.chat?{conversation:Sc(i.appId,i.installationId,i.chat.thread.id)}:{},...i.actor.id?{actor:{platform:t.id,id:i.actor.id}}:{},installation:c,files:Ta(e.integrations,c,i)},{claimed:d,loaded:f}=await e.store.dispatchState(u);if(!d)return{};let p=f?{...e,store:Oo(e.store,f,u)}:e;if((await p.store.get(`agent`,n.agent))?.settings?.disabled)return await e.store.updateDelivery(s,l,void 0),{};try{let u=await yl(p,t,n,r,i,c,a,o,s,{owner:l,loaded:f&&{...f,store:p.store}});return!u.work&&!u.taskId&&!u.steered&&await e.store.updateDelivery(s,l,{at:a()},{ttlMs:$c}),await u.work,u.taskId?{taskId:u.taskId}:{}}catch(t){let n=await e.store.get(`delivery`,s).catch(()=>void 0),r=n?.pending?.task?n.pending:void 0;throw await e.store.updateDelivery(s,l,r?{at:a(),pending:r}:void 0).catch(()=>{}),t}}if((await e.store.get(`agent`,n.agent))?.settings?.disabled||await e.store.get(`delivery`,s).then(e=>e&&!e.pending))return{};let l=JSON.stringify([i.appId,i.installationId,i.chat?.thread.id]),u=e.store.handoffs??=new Map,d=(u.get(l)??Promise.resolve()).catch(()=>{}).then(async()=>{let l=await yl(e,t,n,r,i,c,a,o,s);return await l.work,l});u.set(l,d);try{return await d}finally{u.get(l)===d&&u.delete(l)}}async function vl(e,t,n,r,i,a,o,s){let c=s??Tr(),l=a&&(a.flow==="default"?te():It()),u=l&&a?.taskUrl?await hl(e,l,await(o?.()??ph(e))):void 0,d={event:n,...a?{task:{...a,...u?{taskUrl:u}:{}},taskId:l}:{}};if(e.local&&!n.repo){let n=await e.store.get(`delivery`,t);if(n&&!n.pending)return{};if(d=n?.pending??d,d.task&&!d.taskId)throw Error(`Local delivery has no task binding`);await e.store.put(`delivery`,t,{at:r(),owner:c,pending:d})}else if(!s&&!await e.store.create(`delivery`,t,{at:r(),owner:c,pending:d},{ttlMs:Qc}))return{};return{work:(async()=>{let n=Promise.resolve(),a=e.local?void 0:setInterval(()=>{n=n.then(async()=>{await e.store.updateDelivery(t,c,{at:r(),owner:c,pending:d},{ttlMs:Qc})}).catch(()=>{})},Qc/3);try{await i(d),a&&clearInterval(a),await n,await e.store.updateDelivery(t,c,{at:r()},{ttlMs:$c})}catch(r){throw a&&clearInterval(a),await n,(!e.local||!d.task)&&await e.store.updateDelivery(t,c,void 0).catch(()=>{}),r}})()}}async function yl(e,t,n,r,i,a,o,s,c,l){let u,d=()=>u??=ph(e,l?.loaded?.workspace),f=t=>vl(e,c,i,o,t,void 0,d,l?.owner);if(rl(i))return e.auth&&al(i)&&!await cl(e,t,i)?f(()=>ul(e,t,a,i,s)):f(()=>ol(i,a,e.store).then(e=>s.whisper(e)).then(()=>{}));let p=ed(e,t,a,i,r),[m,h]=await Promise.all([e.loadAgent(n,a,i,p,l?.loaded),e.auth&&i.actor.id?cl(e,t,i):void 0]),g=Yt(i,m);if(!g){let t=i.chat?.message;return t&&await Rc(e,i,{id:t.id,author:t.author.userName||t.author.userId,text:i.text,sentAt:t.metadata.dateSent}),{}}let _=await ll(e,t,i,p);if(_===null)return f(async()=>{await s.problem(`Coder could not check your access to this conversation.`)});if(_===!1)return{};let v=(t,n,r)=>vl(e,c,i,o,async t=>{let i=t.task,a=await Ed(e,i,t.taskId);await Promise.all([Nc(e,i.event,a.task.id,o()),zc(e,i.event)]),await cp(e,a.task.id,[...p.minted,...r?[r]:[]]),n&&Xe(e.local.cwd,a.task.id,{kind:`status`,message:n})},t,d);if(e.local&&!i.repo){let t=await e.store.get(`delivery`,c);if(t?.pending?.task){let e=t.pending.task;return e.agent!==m.id||e.flow!==g.flow?{}:v(e)}}let y=!!i.chat&&g.flow==="default",b=y?await Ec(e,i):void 0,ee=b?.record,te=y?await Vc(e,t,i,{token:async()=>(await p(i.integration))?.token(),delivered:Bc(t,n,m),unseen:b?.unseen,loaded:!0,...ee?{existing:ee}:{}}):i,ne=h?{name:h.name,email:h.email}:void 0,re=y?b?.status??await gl(e,te,m.id):void 0;if(re)return f(()=>Xc(e,re,te,ne,o,b));let ie=!y||te.chat?.thread.isDM===!0,ae=ie?h?.id:void 0,oe=ie?g.actAs:void 0,se=pt(m),x=await dl(p,m),[ce,le,ue,de,fe,pe]=await Promise.all([yn(e,{requester:ae,agent:m.definition.runner}),of(e,se,ae),fl(a,i,p),Cc(e,t,a,i,async e=>x.has(e)?p(e):void 0,m,h??null),ua(e,ae,m.usage?.connections),oe===`requester`?Ju(e,t,i,r).catch(()=>void 0):void 0]),{engine:me,credential:he,usable:ge,chain:ve,credentials:ye}=le;if(!ge&&ce.runner!==`http`)return te.mustReply??t.events[i.type]?.on===`mention`?f(async()=>{let r=`setup:${n.id}:${i.chat?.thread.id??i.deliveryId}`,a=i.deliveryId;if(!(!(t.answersEveryPrompt||await e.store.create(`delivery`,r,{at:o(),owner:a},{ttlMs:6048e5}))&&(await e.store.get(`delivery`,r))?.owner!==a))try{await s.problem(await pl(e,me,await d()))}catch(n){throw t.answersEveryPrompt||await e.store.updateDelivery(r,a,void 0),n}}):{};let be=e.auth&&oe===`requester`&&!pe?`Acting as the app because the requester's account has no usable ${t.name} token. [Connect your account](${e.config.publicUrl?.replace(/\/$/,``)??``}${mh(await d(),`/settings/connections`)}).`:void 0;be&&(de.instructions=[de.instructions,be,`Include the account connection link in your reply.`].filter(Boolean).join(`
-
-`));let xe=Object.fromEntries(Object.entries(g.tools).filter(([e])=>x.has(e)).map(([t,n])=>{if(ue[t])return[t,n];if(t!==i.integration)return[t,[]];let r=new Set(e.integrations[t]?.tools.presets.read??[]);return[t,n.filter(e=>r.has(e))]}).filter(([,e])=>e.length));if(Buffer.byteLength(JSON.stringify(i))>el)throw Error(`Event exceeds 256 KB`);if(Buffer.byteLength(JSON.stringify(de))>el)throw Error(`Task context exceeds 256 KB`);let Se=`${i.deliveryId}-${m.id}`,Ce=await hl(e,Se,await d()),we={id:Se,source:i.integration,agent:m.id,flow:g.flow,...ce,permissions:g.permissions??se.permissions,event:te,failureReply:await ml(e,me,await d()),...Ce?{taskUrl:Ce}:{},author:t.author?.(n.name)??n.name,definition:m.definition,engineChain:ve,engineCredentials:ye,...he?{credential:he}:{},...ae?{requester:ae}:{},...m.files?{files:m.files}:{},usage:{...m.usage,engine:me},tools:xe,connections:fe,...Object.keys(ue).length?{toolScopes:ue}:{},...Object.keys(de).length?{context:de}:{}};if(e.local&&!i.repo&&ce.runner===`local`&&!ce.runnerId)return v(we,be,pe);let Te=o(),Ee=await e.queue.deliver(e.organizationId,we,Te,{key:c,ttlMs:$c,...l?{owner:l.owner}:{}},y?_e([te],ne):void 0,e.config.maxQueued??1e3,!0,{conversation:Mc(te,Se,Te),unseen:Lc(te),secrets:sp(e,Se,[...p.minted,...pe?[pe]:[]])});return be&&Ee.taskId&&await hc(e,Ee.taskId,[be]),Ee}var bl=r({failedDeliveries:()=>Sl,recordFailure:()=>xl});async function xl(e,t,n,r,i,a){let o=e.integrations[t.integration],s=i?.repo&&`${i.repo.owner}/${i.repo.name}`,c=i&&(o?.link?.(i)??(s&&o?.repos?.url(s))),l=!1;try{let a=r&&await Fi(e,`${t.id}:${r}`)||e,o={at:(e.now??Date.now)(),organization:a.organizationId,integration:t.integration,app:t.id,agent:t.agent,error:(n instanceof Error?n.message:String(n)).split(`
-`)[0].slice(0,500),...i?{type:i.type,delivery:i.deliveryId}:{},...i?.chat?{thread:i.chat.thread.id}:{},...s?{repo:s}:{},...c?{url:c}:{}},u=`failed:${t.agent}:${i?.deliveryId??Tr()}`;l=await a.store.create(`delivery`,u,o,{ttlMs:$c})}catch(e){console.error(`coder server: could not record a failed delivery for ${t.id}`,e)}if(!(!l||!a))try{await(await a()).problem(n instanceof bt?n.message:`Coder could not handle this message. If you run this server, check its logs. Otherwise report it at ${e.config.issuesUrl}.`)}catch(e){console.error(`coder server: could not tell ${t.id}'s thread about a failed delivery`,e)}}async function Sl(e,t){let n=(await e.list(`delivery`,{prefix:`failed:${t}:`})).map(e=>e.value).sort((e,t)=>t.at-e.at);return{failed:n.length,recent:n.slice(0,50)}}var Cl=r({adapterContext:()=>Ul,addressedTo:()=>Ml,chatFor:()=>Wl,dashUrl:()=>Hl,deliver:()=>Fl,eventReplies:()=>Ll,later:()=>Pl,threadReplies:()=>Il});async function wl(e,t,n){let r=`${t.id}:${n}`,i=await Fi(e,r),a=i?.boundInstallation?.installation.id===r?i.boundInstallation.installation:await i?.store.get(`installation`,r);return{tenant:i,installation:a?.deletedAt?void 0:a}}async function Tl(e,t,n,r,i){let{tenant:a,installation:o}=await wl(e,t,r);if(!a||!o)throw Error(`${t.integration} installation ${r} is not bound to this server`);return qu(a,e.integrations[t.integration],o,n,i)}function El(e){if(e._type===`chat:Thread`)return{...e,currentMessage:void 0};let{raw:t,replyTo:n,...r}=e;return{...r,raw:null,id:r.id.startsWith(`ephemeral:`)?``:r.id}}const Dl=e=>e.replace(/[.*+?^${}()|[\]\\]/g,`\\$&`),Ol=(e,t)=>Object.keys(e.events).find(n=>e.events[n].on===t),kl=`(?![\\w-]|\\.\\w)`,Al=e=>e.replace(/[ \t]{2,}/g,` `).trim();function jl(e,t){let n=t.reduce((e,t)=>e.replace(RegExp(`(^|[^\\w-])@${Dl(t)}${kl}`,`gi`),`$1`),e);return n===e?void 0:Al(n)}function Ml(e,t){let n=jl(e,[t]);if(n!==void 0)return n;let r=RegExp(`^\\s*${Dl(t)}${kl}[\\s,:;!.?-]*`,`i`);return r.test(e)?Al(e.replace(r,``)):void 0}async function Nl(e,t,n,r,i,a){if(n.builtin)return Ml(a,n.agent)!==void 0;let o=await Fi(e,`${n.id}:${r.id}`);if(t.events[i]?.on!==`message`||!o)return!1;o.local&&await(o.syncAgent?.(n.agent)??kn(o.store,o.local.cwd,o.integrations,n.agent)).catch(e=>console.error(`coder server: local agent sync failed`,e));let{record:s,version:c}=await Nn(o.store,n.agent);return!s||!c||!s.settings?.disabled&&mt(c.definition.integrations[t.id],i)!==void 0}function Pl(e,t,n,r,i){let a=r.catch(r=>(console.error(`coder server: dispatch failed for ${t.id} event ${n.deliveryId}`,r),xl(e,t,r,n.installationId,n,()=>i??Ll(e,t,n))));e.waitUntil&&e.waitUntil(a)}async function Fl(e,t,n,r,i,a,o){if(n.builtin&&t.app.builtin!==`shared`)return;let s=`${n.id}:${i.installationId}`,c=await Fi(e,s);if(!c||!n.builtin&&c.organizationId!==e.organizationId)return;let l=c.boundInstallation?.installation.id===s?c.boundInstallation.installation:await c.store.get(`installation`,s);if(l?.covers&&!l.covers.includes(i.within??``))return;let u=await _l(c,t,n,r,i,e.now??Date.now,a);if(await u.work,u.taskId)return await o?.(),await Lo(c,!0,!1,!0),u.taskId}function Il(e,t,n,r,i){let a=async(t,a=!1)=>{let o=await Ut(e,t,r,n,a).catch(async e=>{throw await i?.(e),e});return{id:o.at(-1)?.id,ids:o.map(e=>e.id)}},o=e.adapter.postProblem;return{post:a,react:(t,r)=>Vt(e,t,r??(typeof n==`string`?n:n?.id)),problem:t=>o?o.call(e.adapter,e.id,t):a(t),whisper:n=>t?e.postEphemeral(t,n,{fallbackToDM:!1}):Promise.resolve(null)}}async function Ll(e,t,n){if(!n.chat)return{post:async()=>{},problem:async()=>{},whisper:async()=>{}};let r=await Wl(e,t,{id:n.installationId,...n.repo?{repo:n.repo}:{}});return await r.initialize(),Il(r.thread(n.chat.thread.id),n.actor.id||void 0,n.chat.message?.id||void 0,e.integrations[t.integration]?.replyLimit,r=>Rl(e,t,n.installationId,r))}async function Rl(e,t,n,r){if(!e.integrations[t.integration]?.isUninstalled?.(r))return;let i=`${t.id}:${n}`,a=await Fi(e,i);a&&await Ku(a.store,i,(e.now??Date.now)())}function zl(e,t,n,r,i,a,o=a.id){let s=r===`message`&&t.builtin?Ml(a.text,t.agent):void 0;if(r===`message`&&t.builtin&&s===void 0)return;let c=Ol(e,s===void 0?r:`mention`);if(!c||a.author.isBot===!0)return;let l=e.event?e.event(c,i,a,t):{};if(!l)return;let u=(l.type??c)===Ol(e,`mention`)?s??jl(a.text,[t.name,...n.self?[n.self]:[]])??a.text:a.text;return{integration:e.id,type:c,appId:t.id,installationId:n.id,deliveryId:Sr(`sha256`).update(`${t.id}\n${n.id}\n${i.id}\n${o}`).digest(`base64url`).slice(0,22),actor:{id:a.author.userId,...a.author.userName?{login:a.author.userName}:{}},text:u,chat:{thread:El(i.toJSON()),message:El(a.toJSON())},...n.index===void 0?{}:{conversation:{index:n.index}},...n.within?{within:n.within}:{},...n.repo?{repo:n.repo}:{},...l}}async function Bl(e,t,n,r,i){let a=await Vl(e,t,n).catch(e=>{console.error(`coder server: conversation workspace lookup failed`,e)});a&&await Rc(a,{appId:t.id,installationId:n.id,chat:{thread:El(r.toJSON())}},{author:i.author.userName||i.author.userId,text:i.text,sentAt:i.metadata.dateSent.toISOString()}).catch(e=>console.error(`coder server: could not keep a message for ${t.id}`,e))}async function Vl(e,t,n){let{tenant:r,installation:i}=await wl(e,t,n.id),a=(t.builtin||r?.organizationId===e.organizationId)&&(!i?.covers||i.covers.includes(n.within??``));return i&&a?r:void 0}async function Hl(e){let t=e.config.publicUrl?.replace(/\/$/,``);return t&&`${t}${mh(await ph(e))}`}function Ul(e,t,n,r,i,a){return{fetch:e.fetch??fetch,appId:n.id.slice(t.id.length+1),name:n.name,credentials:r,...i?{installationId:i.id,...i.self?{self:i.self}:{}}:{},token:(t,a)=>Tl(e,n,r,t,{...i?.repo?{repo:{owner:i.repo.owner,name:i.repo.name}}:{},...a}),installedSelf:async t=>(await wl(e,n,t)).installation?.self,saveSelf:async(t,r)=>{let{tenant:i,installation:a}=await wl(e,n,t);!i||!a||a.self||await Ga(i.store,`installation`,a.id,{self:r}).catch(e=>console.error(`coder server: could not save ${a.id}'s app user`,e))},...i?{hears:(r,a)=>Nl(e,t,n,i,r,a).catch(e=>(console.error(`coder server: could not read ${n.id}'s agent for a message`,e),!0)),active:async t=>{let r=await Fi(e,`${n.id}:${i.id}`),a=Sc(n.id,i.id,t);return!!await r?.store.get(`delivery`,a)},knows:async(t,r)=>{let a=await Fi(e,`${n.id}:${i.id}`),o=Ac(n.id,i.id,t,r);return!!await a?.store.get(`delivery`,o)},agent:async t=>{let r=await Vl(e,n,i),{record:a,version:o}=r?await Nn(r.store,t??n.agent):{};if(!a||!o)return;let{definition:s}=o,c=a.description??s.description;return{slug:a.id,name:a.name,...c?{description:c}:{},listens:Object.entries(s.integrations).flatMap(([t,n])=>{let r=xt(n),i=e.integrations[t];return i&&r.length?[{integration:t,name:i.name,events:r}]:[]})}},task:async t=>{let r=await Vl(e,n,i),a=r&&await r.store.get(`task`,t);if(!a)return;let{task:o}=a,s=o.event?.integration;return{id:o.id,title:o.name?.trim()||o.prompt?.trim()||o.event?.text?.trim()||`${o.event?.type??`task`} on ${o.agent}`,agent:o.agent,status:a.status,from:s&&e.integrations[s]?.name||o.source,startedAt:a.startedAt??a.createdAt}}}:{},privateState:()=>new Vn,...e.config.publicUrl?{publicUrl:e.config.publicUrl}:{},...a?{dashUrl:a}:{}}}async function Wl(e,t,n){let r=e.integrations[t.integration];if(!r)throw Error(`Unknown integration "${t.integration}"`);let i=new Map;e={...e,fetch:r.requestFetch?.(e.fetch??fetch,n?.within??n?.id)??e.fetch,syncAgent:t=>(i.has(t)||i.set(t,kn(e.store,e.local.cwd,e.integrations,t)),i.get(t))};let a=T(e.config,t.credentials),o=await r.adapter(Ul(e,r,t,a,n)),s=Bn(e.chatState??new Vn,t.id),c=new Ot({userName:t.name,adapters:{[r.id]:o},state:{...s,isSubscribed:async()=>!1},concurrency:`concurrent`,dedupeTtlMs:$c,logger:`error`});if(!n)return c;let l=async(i,o,s,c)=>{let l=zl(r,t,n,i,o,s,c);if(!l){s.author.isBot!==!0&&await Bl(e,t,n,o,s);return}let u=Il(o,s.author,s,r.replyLimit,r=>Rl(e,t,n.id,r));Pl(e,t,l,Fl(e,r,t,a,l,u),u)};return c.onNewMention((e,t)=>l(`mention`,e,t)),c.onNewMessage(/[\s\S]*/,(e,t)=>l(`message`,e,t)),c.onMessageUpdated((e,t)=>l(t.isMention?`mention`:`message`,e,t,`edit\n${t.id}\n${t.metadata.editedAt?.toISOString()??``}`)),c.onReaction(async i=>{if(!i.added||i.user.isBot===!0)return;let a=i.thread,o=await Vl(e,t,n);if(!o)return;let s={integration:r.id,type:`reactions`,appId:t.id,installationId:n.id,deliveryId:`reaction-${i.messageId}-${i.user.userId}-${i.rawEmoji}`,actor:{id:i.user.userId,login:i.user.userName},text:``,chat:{thread:El(a.toJSON())},...n.within?{within:n.within}:{}},c=Zc(o,s,{emoji:`:${i.emoji.name}:`,by:i.user.userName||i.user.userId,on:i.message?.text??i.messageId},e.now??Date.now);Pl(e,t,s,c)}),c.onSlashCommand(`/setup`,async i=>{let o=Ol(r,`command`);if(!o)return;let s=e=>i.channel.postEphemeral(i.user,e,{fallbackToDM:!1}),c={integration:r.id,type:o,appId:t.id,installationId:n.id,deliveryId:Sr(`sha256`).update(`${t.id}\n${n.id}\n${i.channel.id}\n${i.triggerId??i.text}`).digest(`base64url`).slice(0,22),actor:{id:i.user.userId,...i.user.userName?{login:i.user.userName}:{}},text:i.text.trim(),...n.within?{within:n.within}:{}},l={post:s,problem:s,whisper:s};Pl(e,t,c,Fl(e,r,t,a,c,l),l)}),c}function Gl(e,t,n,r){return e.withAppLock(`installation:${t}`,async e=>{let i=n(await e.get(`installation`,t));if(!i)return;let a=await e.list(`installation`),o=a.filter(e=>e.id!==t&&e.value.app===i.app&&!e.value.deletedAt&&i.covers?.includes(e.id.slice(i.app.length+1))),s=new Set(o.map(e=>e.id));En(a.map(e=>[e.id,s.has(e.id)?{...e.value,deletedAt:r}:e.value]),t,i);for(let t of o)await e.put(`installation`,t.id,{...t.value,deletedAt:r});return await e.put(`installation`,t,i),i})}async function Kl(e,t,n,r){let i=n.id,a=t.operatorApp??!1?`*`:t.session?.user.id??`anonymous`,o=rn(r.searchParams.get(`state`)),s=vh(o?.back),c=t.integrations[i];if(!c)return $(t,`unknown-integration`,{platform:i},s);let l=t.config.publicUrl;if(!l)return $(t,`no-public-url`,{},s);let u=r.searchParams.get(`app`),d=o?.tx?await qr(t,o.tx,`install`,a):void 0;if(!d||u&&u!==d)return $(t,`install-expired`,{platform:i,appId:u??void 0},s);let f=await t.store.get(`app`,u??d);if(!f)return $(t,`unknown-app`,{platform:i},s);let p=T(t.config,f.credentials);return C(c.app.installUrl(f,p,{publicUrl:l,state:r.searchParams.get(`state`)??sn({})}))}async function ql(e,t,n,r){let i=n.id,a=t.apps?await t.apps(i):(await t.store.list(`app`,{prefix:`${i}:`})).map(e=>({organizationId:t.organizationId,app:e.value})),o=await n.app.installedApp(e,{apps:a.map(({app:e})=>({app:e,credentials:T(t.config,e.credentials)})),fetch:r}).catch(e=>(console.error(`coder server: finding the ${i} app of an install failed`,e),e instanceof Error?e:Error(String(e))));if(o instanceof Error)return $(t,`failed`,{platform:i});if(!o)return $(t,`unknown-app`,{platform:i});let{app:s,installation:c}=o,l=a.find(e=>e.app.id===s.id).organizationId,u=s.builtin||!t.session?t:Ii(t,t.session,l);if(!u)return $(t,`other-workspace`,{platform:i});let d=await zr(u,`install`,t.session?.user.id??`anonymous`,s.id);return C(n.app.installUrl(s,T(t.config,s.credentials),{publicUrl:t.config.publicUrl,state:sn({tx:d,installation:c}),installation:c}))}async function Jl(e,t,n,r){let i=n.id,a=t.operatorApp??!1,o=a?`*`:t.session?.user.id??`anonymous`,s=rn(r.searchParams.get(`state`)),c=s?.tx&&t.session?Ii(t,t.session,Hr(t,s.tx)):void 0,l=c?{...t,...c}:t,u=vh(s?.back),d=l.integrations[i];if(!d)return $(l,`unknown-integration`,{platform:i},u);if(!l.config.publicUrl)return $(l,`no-public-url`,{},u);let f=l.fetch??fetch,p=r.searchParams.get(`app`),m=s?.tx?await qr(l,s.tx,`install`,o):void 0,h={platform:i,appId:p??m},g=r.searchParams.get(`error`);if(g)return g===`access_denied`?$(l,`cancelled`,h,u):$(l,`platform-error`,{...h,error:g},u);if(!r.searchParams.has(`state`)&&d.app.installedApp&&!a)return ql(e,l,d,f);if(!m||p&&p!==m||!await Gr(l,s.tx,`install`,o,m))return $(l,`install-expired`,h,u);let _=await l.store.get(`app`,p??m),v=s?.link?await l.store.get(`installation`,s.link):void 0,y=_??(v&&await Ch(l,v,i));return y?Yl(e,l,d,y,v,u,s?.installation):s&&!s.link?$(l,`connected`,{platform:i},u):$(l,`unknown-app`,{platform:i},u)}async function Yl(e,t,n,r,i,a,o){let s=n.id,c=t.fetch??fetch,l=t.now?.()??Date.now(),u=t.config.publicUrl;if(r.builtin&&n.app.builtin!==`shared`)return $(t,`unknown-app`,{platform:s},a);let d=a??(r.builtin?void 0:gh(t,r.agent)),f=T(t.config,r.credentials),p=await n.app.installCallback(e,{app:r,credentials:f,publicUrl:u,fetch:c,tokens:ba(t,n.id),...o?{installation:o}:{}}).catch(e=>e instanceof St?$(t,e.code,{platform:s,appId:r.id,error:e.error},d):(console.error(`coder server: installing ${r.id} failed`,e),$(t,`failed`,{platform:s,appId:r.id},d)));if(p instanceof Response)return p;let m=`${r.id}:${p.platformInstallId}`,h=t.session;p.user&&h&&t.auth&&await t.auth.link(h.user,s,p.user.id,{organizations:h.organizations.map(e=>e.id),...p.user.token?{token:w(t.config,p.user.token)}:{}});let g=await t.store.get(`installation`,m),_={...g,id:m,app:r.id,integration:s,account:p.account??g?.account??i?.account??{login:`unknown`},...p.token?{token:w(t.config,p.token)}:{},...p.installer?{installer:p.installer}:{},...p.self?{self:p.self}:{},...p.covers?{covers:p.covers}:{},createdAt:g?.createdAt??l};if(delete _.deletedAt,delete _.uninstalled,n.repos){let e=await n.auth.token(p.token?{..._,token:p.token}:_,f,void 0,{fetch:c});_.repos=await n.repos.list(_,e,c)}let v=i&&!i.deletedAt?i:void 0;v&&(_=Sh(_,v.integration,v.id));try{_=await Gl(t.store,m,e=>p.covers===null?{..._,covers:e?.covers??[]}:_,l)}catch(e){return e instanceof Dn?$(t,`installation-bound`,{platform:s,account:_.account.login},d):$(t,`installation-taken`,{platform:s},d)}return v&&await t.store.put(`installation`,v.id,Sh(v,s,m)),_.installer&&n.welcome&&await Xl(t,n,r,f,p.platformInstallId,_.installer),$(t,`connected`,{platform:s,account:_.account.login},d)}async function Xl(e,t,n,r,i,a){try{let[{adapterContext:o,dashUrl:s},{record:c,version:l}]=await Promise.all([Promise.resolve().then(()=>Cl),Nn(e.store,n.agent)]),{engine:u,usable:d}=await of(e,{engine:c?.settings?.engine??l?.definition.engine,model:c?.settings?.model??l?.definition.model},e.session?.user.id),f=o(e,t,n,r,{id:i},await s(e)),p=`${e.config.publicUrl.replace(/\/$/,``)}${gh(e,n.agent)}`;await t.welcome(f,a,{open:p,...d?{}:{setup:await vf(e,u)}})}catch(e){console.error(`coder server: could not greet the installer of ${n.id}`,e)}}const Zl=/^[a-z0-9][a-z0-9_-]*$/i;async function Ql(e,t){let n=Ze(Je(),`builtin`).map(({name:e})=>({name:e,scope:`builtin`}));if(!t)return S(n);try{let{integration:r,token:i}=await mo(e,t),a=(r.repos?await r.repos.listDir(t,`.coder/flows`,i):[]).map(e=>e.replace(/\.(ts|mjs|js)$/,``)).filter(e=>Zl.test(e));return S([...a.map(e=>({name:e,scope:`workspace`})),...n.filter(e=>!a.includes(e.name))])}catch(e){return uu(e)}}async function $l(e,t){if(!t)throw new U(`repo is required`);let{integration:n,token:r}=await mo(e,t);return S(await n.repos?.pullRequests(t,r)??[])}async function eu(e,t){try{return S(fu(await go(e,`dashboard`,t)),201)}catch(e){return uu(e)}}async function tu(e,t,n,r){return Ql(t,r.searchParams.get(`repo`)).catch(uu)}async function nu(e,t,n,r){return $l(t,r.searchParams.get(`repo`)).catch(uu)}async function ru(e,t,n,r){return zu(e).then(e=>eu(t,{...e,flow:n.name})).catch(uu)}async function iu(e,t,n,r){return zu(e).then(({post:e,...n})=>{if(!n.repo||!n.pr)throw new U(`repo and pr are required`);return eu(t,{...n,flow:`review`,args:{post:e===!0}})}).catch(uu)}function au(e,t,n){return(e.waitUntil??(e=>void e.catch(()=>{})))(t),Promise.resolve(S({tasks:n},202))}async function ou(e,t,n){let r=t.repos?.pullRequest(n)===void 0?void 0:await Fi(e,`${n.appId}:${n.installationId}`);if(!r)return;let i=Cp({flow:`review`,event:n});if(!i)return;let a=await r.queue.list(r.organizationId,{status:`queued`,reviewKey:i}),o=(e.now??Date.now)(),s=JSON.stringify({kind:`status`,message:`Replaced by a newer review of this pull request.`});for(let e of a.filter(e=>e.task.event?.type===n.type&&e.task.event.deliveryId!==n.deliveryId))await r.queue.cancel(r.organizationId,e.task.id,o,{statuses:[`queued`]})&&await gc(r.store,e.task.id,[{level:`sys`,line:s}],e.logSeq??0,o,e.logBytes??0)}async function su(e,t,n,r,i,a,o){if(`ack`in i)return new Response(null,{status:200});if(`uninstalled`in i){let t=await Fi(e,i.uninstalled);return t&&await Ku(t.store,i.uninstalled,a),S({ok:!0})}if(`unhandled`in i)return console.warn(`coder server: ${n.id} sent ${i.unhandled}, which Coder does not handle yet`),new Response(null,{status:200});if(`work`in i){if(o){let a=Hl(e).then(a=>i.work(Ul(e,t,n,r,o,a))).catch(t=>(console.error(`coder server: webhook work failed for ${n.id}`,t),xl(e,n,t,o.id)));(e.waitUntil??(()=>{}))(a)}return S({ok:!0})}if(`installation`in i){let t=await Fi(e,i.installation.installation.id),n=await t?.store.get(`installation`,i.installation.installation.id);return!t||!n?S({ok:!0}):(await t.store.withAppLock(`repositories:${n.id}`,async e=>{let t=await e.get(`installation`,n.id);if(!t||i.installation.repos&&t.deletedAt)return;let r=i.installation.repos,o=r?r.refresh||t.repos==null?void 0:[...new Set([...t.repos,...r.add])].filter(e=>!r.remove.includes(e)):i.installation.installation.repos;await Ga(e,`installation`,n.id,{account:i.installation.op===`delete`?t.account:i.installation.installation.account,...r||o?{repos:o}:{},deletedAt:i.installation.op===`delete`?a:void 0,uninstalled:i.installation.installation.uninstalled})}),await Gu(t.store,n.id),S({ok:!0}))}if(`covers`in i){let{installation:t,add:n=[],remove:r=[]}=i.covers,o=await Fi(e,t),s=!1;try{o&&await Gl(o.store,t,e=>{if(s=!!e,!e||e.deletedAt)return;let t=[...new Set([...e.covers??[],...n])];return{...e,covers:t.filter(e=>!r.includes(e))}},a)}catch(e){if(!(e instanceof Dn))throw e;console.error(`coder server: ${t} covers an account bound elsewhere; grant ignored`)}return s?S({ok:!0}):new Response(`Installation not stored yet`,{status:503})}if(`pushed`in i&&i.pushed){let t=await Fi(e,i.pushed.installation);t&&await ka(t.store,i.pushed)}if(!(`changes`in i)&&`pushed`in i)return S({ok:!0});if(`changes`in i){let r=i.changes;try{n.branch||await Ga(e.store,`app`,n.id,{branch:r.branch});let i=await Va(e,r.repo,r.ref,{...Ba(),integration:t.id,appId:n.id},r.branch);return i?S({imported:i.map(e=>e.agent)}):S({error:`No installed app can read ${r.repo}`},400)}catch(e){return S({error:e instanceof Error?e.message:String(e)},400)}}for(let a of i.events)Pl(e,n,a,Ll(e,n,a).then(i=>Fl(e,t,n,r,a,i,()=>ou(e,t,a))));return S({accepted:i.events.length},202)}async function cu(e,t,n){let r=t.integrations[n],i=await e.text(),a=r.target(e,i);if(a instanceof Response)return a;if(!a)return new Response(`Not addressed to an app`,{status:400});let o=`${r.id}:${a.app}`,s=t.webhookTarget?await t.webhookTarget(o,a.installation?`${o}:${a.installation}`:void 0):void 0,c=t.webhookTarget?s&&{ctx:{...V(t,s.organizationId),...s.bound?{boundInstallation:s.bound}:{}},app:s.app}:await Pi(t,o);if(!c)return new Response(`Unknown app`,{status:404});let{ctx:l,app:u}=c,d=T(l.config,u.credentials),f=a.installation?{...a,id:a.installation}:void 0,p=r.ownEvents?.(e,i,u,d);if(p&&`invalid`in p)return new Response(`Invalid signature`,{status:401});if(p)return su(l,r,u,d,p,(l.now??Date.now)(),f);let m=(await Wl(l,u,f)).webhooks[r.id];return m(new Request(e.url,{method:`POST`,headers:e.headers,body:i}),{deduplicate:!1,propagateHandlerErrors:!0,waitUntil:e=>{let t=e.catch(e=>(console.error(`coder server: webhook work failed for ${u.id}`,e),xl(l,u,e,a.installation)));l.waitUntil&&l.waitUntil(t)}})}const lu=new Set([`completed`,`failed`,`cancelled`]);function uu(e){if(e instanceof Ou)return S({error:e.message},400);if(e instanceof U)return S({error:e.message,...e.fix?{fix:e.fix}:{}},e.status);throw e}function du(e){let{id:t,name:n,source:r,agent:i,flow:a,event:o,prompt:s,cwd:c}=e.task;return{task:{id:t,...n?{name:n}:{},source:r,agent:i,flow:a,...c?{cwd:c}:{},...s?{prompt:s}:{},...o?{event:{integration:o.integration,type:o.type,text:o.text}}:{}},status:e.status,...e.status===`queued`?{statusReason:`Waiting for a task slot`}:{},attempts:e.attempts,...e.approval===void 0?{}:{approval:e.approval},...e.archivedAt===void 0?{}:{archivedAt:e.archivedAt},createdAt:e.createdAt,startedAt:e.startedAt,finishedAt:e.finishedAt,updatedAt:e.updatedAt,...fp(e)}}function fu(e){let{tokenHash:t,handle:n,...r}=e;return{...r,...fp(e),...e.status===`queued`?{statusReason:`Waiting for a task slot`}:{},turns:_o(e),...e.task.credential?{credential:Zd(e.task.credential).name}:{}}}async function pu(e,t){let n=await e.store.get(`task`,t);if(n&&!(e.local&&n.handle?.startsWith(`cli:`)&&n.task.flow==="default"))return{status:n};let r=n?.task.cwd??e.local?.cwd;return r?{cwd:r,answer:n?.answer}:S({error:`No task "${t}"`},404)}async function mu(e,t,n,r){let i=n.id,a=Number(r.searchParams.get(`after`)??-1),o=Number.isFinite(a)?a:-1,s=r.searchParams.has(`limit`)?Zt(r,500,2e3):void 0,c=vc(t.store,i,o,s??500);c?.catch(()=>{});let l=await pu(t,i);if(l instanceof Response)return l;let{status:u,cwd:d}=l;if(!u){let e=kd(d,i,!0);return e?S({...e,...l.answer?{answer:l.answer}:{},logs:Od(d,i,-1,s??500)}):S({error:`No task "${i}"`},404)}return S({...fu(await No(t,u)),logs:await c})}async function hu(e,t,n,r){let i=n.id,a=await pu(t,i);if(a instanceof Response)return a;let{status:o,cwd:s}=a;if(!o){let n=await jd(e,s,i,void 0,t);return n.ok&&t.queue instanceof Ap&&t.queue.tombstone(i),n}if(t.local&&o.handle?.startsWith(`cli:`)){let e=(t.now??Date.now)();await t.queue.cancel(t.organizationId,i,e,{attempts:o.attempts,tokenHash:o.tokenHash,generation:o.generation??0});let n=await t.store.get(`task`,i);if(n&&Q.includes(n.status)){await bd(t,n,e);let r=await t.store.get(`task`,i);if(r&&Q.includes(r.status))return S({error:`Task is still stopping. Try again.`},409)}}else if([`running`,`waiting`].includes(o.status)&&o.handle)try{let e=await pn(t,o.task);if(!e)return S({error:`Task runner is unavailable. Try again.`},409);await e.stop(o.handle)}catch{return S({error:`Task is still stopping. Try again.`},409)}return await Tp(t,o)?(t.local&&(await t.store.delete(`snapshot`,`local-start:${i}`),await t.store.delete(`snapshot`,`completion:${i}`)),Ro(t,!0),S({ok:!0})):S({error:`Task changed while deleting. Try again.`},409)}async function gu(e,t,n,r){let i=n.id,a=Number(r.searchParams.get(`after`)??-1),o=Number.isFinite(a)?a:-1,s=r.searchParams.has(`limit`)?Zt(r,500,2e3):void 0,c=vc(t.store,i,o,s??void 0);c?.catch(()=>{});let l=await pu(t,i);if(l instanceof Response)return l;let{status:u,cwd:d}=l;return u?(await No(t,u),S(await c)):kd(d,i,!1)?S(Od(d,i,o,s)):S({error:`No task "${i}"`},404)}async function _u(e,t,n,r){let i=n.id,a=await pu(t,i);if(a instanceof Response)return a;let{status:o,cwd:s}=a;if(!o)return jd(e,s,i,`steer`,t);if(o.task.flow!=="default")return S({error:`steer is available only for default-flow tasks`},409);let c=await e.json().catch(()=>void 0);if(lu.has(o.status)){let{text:e,outputSchema:n,model:r,effort:i,permissions:a}=c??{};try{let s=await vo(t,o,String(e??``),n,{model:r,effort:i,permissions:a});return Ro(t,!0),S(fu(s))}catch(e){return uu(e)}}let l=await Dp(t,o,`steer`,c);return l?S(l):S({error:`Task "${i}" is no longer active`},409)}function vu(e){return async(t,n,r)=>{let i=r.id,a=await pu(n,i);if(a instanceof Response)return a;let{status:o,cwd:s}=a;if(!o)return jd(t,s,i,e,n);if(o.task.flow!=="default")return S({error:`${e} is available only for default-flow tasks`},409);if(!Q.includes(o.status))return S({error:`Task "${i}" is not active`},409);if(e===`approve`&&!o.approval)return S({error:`Task "${i}" has no pending approval`},409);let c=await Dp(n,o,e,await t.json().catch(()=>void 0));return c?S(c):S({error:`Task "${i}" is no longer active`},409)}}const yu=vu(`ask`),bu=vu(`approve`);async function xu(e,t,n,r){let i=n.id,a=await pu(t,i);if(a instanceof Response)return a;let{status:o,cwd:s}=a;if(!o)return jd(e,s,i,`cancel`,t);let c=await t.queue.cancel(t.organizationId,i,(t.now??Date.now)(),{attempts:o.attempts,tokenHash:o.tokenHash??null,generation:o.generation??0});if(c&&o.status!==`queued`){await Mp(t,i);let e=await t.store.get(`task`,i);e&&!lu.has(e.status)&&Fo(t,o)}return c?S({ok:!0}):S({error:`No running or queued task "${i}"`},404)}async function Su(e,t,n,r){let i=n.id,a=await pu(t,i);if(a instanceof Response)return a;let{status:o,cwd:s}=a;if(!o)return jd(e,s,i,`archive`,t);let c=(t.now??Date.now)();return await t.queue.patchTask(t.organizationId,i,{archivedAt:c,autoArchived:void 0},c),S({ok:!0})}async function Cu(e,t){if(!e.agent||!e.event?.integration)return S({error:`agent and event are required`},400);let n=t.integrations[e.event.integration];if(!n)return S({error:`Unknown integration "${e.event.integration}"`},400);let r=e.event.actor?.id;if(t.auth&&r){let e=await t.auth.linkedUser(n.id,r);if(e&&e.id!==t.session?.user.id)return S({error:`The event's actor is linked to another member`},403)}let i=(await t.store.list(`app`)).map(e=>e.value).find(t=>t.agent===e.agent&&t.integration===n.id);if(!i)return S({error:`No ${n.id} app for agent "${e.agent}" on this server.`},404);let a=(await t.store.list(`installation`)).map(e=>e.value).filter(e=>e.app===i.id&&!e.deletedAt),o=a.find(t=>t.id===`${i.id}:${e.event.installationId}`)??a[0];if(!o)return S({error:`The ${n.id} app for "${e.agent}" is not installed anywhere yet`},404);let s=t.now??Date.now,c={...e.event,appId:i.id,installationId:o.id.slice(i.id.length+1),deliveryId:`admin-${s()}-${Tr()}`},l=await _l(t,n,i,T(t.config,i.credentials),c,s,await Ll(t,i,c));return au(t,l.work??Promise.resolve(),l.taskId?[l.taskId]:[])}const wu=new Set([`queued`,`running`,`waiting`,`completed`,`failed`,`cancelled`]);async function Tu(e,t,n,r){let i=await e.json().catch(()=>void 0);if(!i||typeof i!=`object`)return S({error:`A JSON body is required`},400);try{if(co(t,i),i.event)return Cu(i,t);let e=(i.source===`cli`?void 0:await _d(t,i))??await go(t,i.source===`cli`?`cli`:`dashboard`,i);return S(fu(e),201)}catch(e){return uu(e)}}function Eu(e,t,n){let r=new Map(t.map(e=>[e.task.id,e]));for(let t of n)y(e,t,r.has(t.task.id))&&r.set(t.task.id,t);return[...r.values()]}async function Du(e,t,n,r){let i=r.searchParams.get(`status`);if(i&&i!==`active`&&!wu.has(i))return S({error:`Unknown status "${i}"`},400);let a=r.searchParams.get(`source`);if(a&&![`dashboard`,`cli`,`schedule`,...Object.keys(t.integrations)].includes(a))return S({error:`Unknown source "${a}"`},400);let o=r.searchParams.has(`since`)?Number(r.searchParams.get(`since`)):void 0;if(o!==void 0&&(!Number.isFinite(o)||o<0))return S({error:`Invalid since`},400);let s=r.searchParams.get(`agent`),c=r.searchParams.get(`q`)?.trim(),l={...s?{agent:s}:{},...a?{source:a}:{},...c?{q:c}:{},archived:o===void 0?r.searchParams.get(`archived`)===`1`:void 0,...o===void 0?{}:{since:o,...r.searchParams.get(`sinceId`)?{sinceId:r.searchParams.get(`sinceId`)}:{}}},u=i===`active`?{statuses:Q}:i?{status:i}:{},d=r.searchParams.get(`summary`)===`1`||o!==void 0&&!r.searchParams.has(`summary`),f=e=>d?e.map(du):e.map(fu);if(t.local){let e=o===void 0?hd(t.local.cwd,l.archived):[...hd(t.local.cwd,!0).map(e=>({...e,updatedAt:Math.max(e.updatedAt,e.archivedAt)})),...hd(t.local.cwd,!1)],n=Eu(t.local.cwd,e,await t.queue.list(t.organizationId)).filter(e=>hp(e,{...l,...u})).sort(o===void 0?yp:vp),i=Zt(r,Qt(r)?void 0:20);if(!Qt(r))return S(f(n.slice(0,i)));let a=nn(r),s=n.filter(e=>bp(e,a)),c=an(s.slice(0,i+1),i,o===void 0?gp:_p);return S({...c,items:f(c.items),...r.searchParams.get(`counts`)===`1`?{counts:{all:n.length,active:n.filter(e=>Q.includes(e.status)).length,waiting:n.filter(e=>e.status===`waiting`).length}}:{}})}if(!Qt(r)){let e=Zt(r,20),n=await t.queue.list(t.organizationId,{...l,...u,limit:e,summary:d});return S(f(n))}let p=Zt(r),m=nn(r),h=r.searchParams.get(`counts`)===`1`&&!i&&!m&&t.queue.listWithCounts?await t.queue.listWithCounts(t.organizationId,{...l,limit:p+1,summary:d}):void 0,[g,_]=await Promise.all([h?h.items:t.queue.list(t.organizationId,{...l,...u,summary:d,...m?{before:m}:{},limit:p+1}),h?h.counts:r.searchParams.get(`counts`)===`1`?t.queue.counts(t.organizationId,{...l,...u}):void 0]),v=an(g,p,o===void 0?gp:_p);return S({...v,items:f(v.items),..._?{counts:_}:{}})}var Ou=class extends Error{};const ku=async e=>await e.get(`config`,`workspace`)??{};function Au(){let e=i();if(!B.existsSync(e))return{};try{return JSON.parse(B.readFileSync(e,`utf8`))}catch(t){throw new Ou(`Invalid JSON in ${e}: ${t.message}`)}}function ju(e){let{mcp:t,...n}=e;return n}async function Mu(e){return e.local?ju(Au()):ku(e.store)}const Nu=(e,t)=>e.local?ju(ce(e.local.cwd)):Le(t);async function Pu(e,t){let n=e.settings??={},r=(n.configUpdate??Promise.resolve()).catch(()=>{}).then(()=>e.local?t(e):e.store.withConfigLock(n=>t({...e,store:n})));n.configUpdate=r;try{return await r}finally{n.configUpdate===r&&delete n.configUpdate}}function Fu(e){let t=Ge(e);if(t.length)throw new Ou(t.join(`; `))}async function Iu(e,t){if(Fu(t),t.mcp)throw new Ou(`Add a connection in Settings to attach an MCP server`);if(e.local){let{mcp:n}=Au();return Me({...t,...n?{mcp:n}:{}}),Mu(e)}return await e.store.put(`config`,`workspace`,t),ju(t)}async function Lu(e,t){return Pu(e,async e=>{let n=structuredClone(await Mu(e));return t(n),Iu(e,n)})}function Ru(e,t){return Pu(e,async e=>Iu(e,Ye(await Mu(e),t)))}async function zu(e){let t=await e.json().catch(()=>void 0);if(!t||typeof t!=`object`)throw new Ou(`A JSON body is required`);return t}async function Bu(e,t){return Lu(e,t).then(S).catch(uu)}async function Vu(e,t,n,r){return Mu(t).then(e=>S({config:e,effective:Nu(t,e)})).catch(uu)}async function Hu(e,t,n,r){return e.json().catch(()=>{throw new Ou(`A JSON body is required`)}).then(e=>Ru(t,e)).then(S).catch(uu)}function Uu(e,t){return t.token?{...t,token:T(e.config,t.token)}:t}const Wu=3e5;async function Gu(e,t){await e.put(`snapshot`,wn(t),{drop:Tr()},{ttlMs:36e5});for(let n of await e.list(`snapshot`,{prefix:Rn(t)}))await e.delete(`snapshot`,n.id)}async function Ku(e,t,n){await e.withAppLock(`installation:${t}`,async e=>{let r=await e.get(`installation`,t);!r||r.deletedAt||(await Ga(e,`installation`,t,{deletedAt:n,uninstalled:!0}),await Gu(e,t))})}async function qu(e,t,n,r,i,a=0){let o=n.token,s=Uu(e,n);return t.auth.token(s,r,i,{fetch:e.fetch,async hold(t,r){let i=Rn(n.id,t),o=await e.store.heldTokens([n.id],[n.app]),s=o.held.get(i),c=(e.now??Date.now)(),l=s?s.expiresAt-s.mintedAt:0,u=a+(a+Wu<=l?Wu:0);if(s&&s.expiresAt-c>Math.max(u,Wu))try{return T(e.config,s.token)}catch(e){console.error(`coder server: held token unreadable, minting again`,e)}let d=await r();return await e.store.holdToken({key:i,value:{token:w(e.config,d.token),expiresAt:d.expiresAt,mintedAt:c},ttlMs:Math.max(d.expiresAt-c-Wu,0),drops:[n.id,n.app].map(e=>({key:wn(e),drop:o.drops.get(wn(e))}))}),d.token},async save(t){let r=w(e.config,t),i;return await e.store.withCredential(`installation`,n.id,async t=>{if(t){if(!(t.token===o||t.token&&T(e.config,t.token)===s.token)){i=t.token;return}return[{id:n.id,value:{...t,token:r}}]}}),n.token=i??r,i&&T(e.config,i)}})}async function Ju(e,t,n,r){if(!t.auth.user||!e.auth)return;let i=await e.auth.linkedUser(t.id,n.actor.id);if(!i?.token||!i.organizations?.includes(e.organizationId))return;let a=Nf(e.config,i.token),o=a.app&&a.app!==n.appId,s=o?await Bf(e,t.id,a.app):void 0;if(o&&!s)return;let c=await t.auth.user.access(a.token,s?T(e.config,s.credentials):r,{fetch:e.fetch??fetch,now:(e.now??Date.now)()});return c.refreshed&&await e.auth.link(i,t.id,n.actor.id,{token:w(e.config,a.app?{app:a.app,token:c.refreshed}:c.refreshed)}),c.accessToken}function Yu(e,t){return{...e?{repo:{owner:e.owner,name:e.name}}:{},tools:t}}async function Xu(e,t,n,r,i,a,o){return(o===`requester`?await Ju(e,t,r,i).catch(()=>void 0):void 0)??qu(e,t,n,i,a,e.config.taskTimeoutMs)}const Zu=e=>{let t=e&&/^([^/]+)\/([^/]+)$/.exec(e);return t?{owner:t[1],name:t[2]}:void 0};async function Qu(e,t,n,r){let i=await e.store.installationApp(n.id);if(!i)return;let{installation:a,app:o}=i,s=e.integrations[t];if(!o||!s)return;let c=r?r.toolScopes?.[t]?.repo:Zu(a.settings?.configRepo);if(c)return{installation:a.id,record:a,repo:c,mint:async(n=c)=>qu(e,s,a,T(e.config,o.credentials),Yu(n,r?r.tools[t]??[]:s.tools.presets.read),r&&e.config.taskTimeoutMs)}}const $u=e=>t=>{console.error(`coder server: could not mint a connected ${e} token`,t)};function ed(e,t,n,r,i){let a=[],o=(e,t)=>{let n=new Map;return r=>{let i=r?Zu(r):e;if(r&&!i)return Promise.resolve(void 0);let o=i?`${i.owner}/${i.name}`:``,s=n.get(o);return s||(s=t(i).then(e=>(e&&a.push(e),e)),n.set(o,s)),s}},s=async a=>{let s=e.fetch??fetch;if(a===r.integration)return{installation:n.id,record:n,fetch:s,token:o(r.repo,r=>qu(e,t,n,i,Yu(r,t.tools.presets.read)))};let c=n.connections?.[a],l=c&&await Qu(e,a,c);return l&&{installation:l.installation,record:l.record,fetch:s,token:o(l.repo,e=>l.mint(e).catch($u(a)))}},c=new Map;return Object.assign(e=>(c.has(e)||c.set(e,s(e)),c.get(e)),{minted:a})}async function td(e,t){let n=t.event,r=e.integrations[n.integration];if(!r)throw Error(`Unknown integration "${n.integration}"`);let[i,a]=await Promise.all([e.store.get(`app`,n.appId),e.store.get(`installation`,`${n.appId}:${n.installationId}`)]);if(!i)throw Error(`Unknown app "${n.appId}"`);if(!a||a.deletedAt)throw Error(`Installation is gone`);let o=t.flow===`review`&&t.args?.post===!0,s=await Xu(e,r,a,n,T(e.config,i.credentials),Yu(t.toolScopes?.[n.integration]?.repo??n.repo,t.tools[n.integration]??(o?r.tools.presets.read:[])),nd(t)),c={[n.integration]:s};return await Promise.all(Object.entries(a.connections??{}).map(async([r,i])=>{if(r===n.integration||!(r in t.tools))return;let a=await(await Qu(e,r,i,t))?.mint().catch($u(r));a&&(c[r]=a)})),c}function nd(e){let t=e.event;return t.chat&&!t.chat.thread.isDM?void 0:mt(e.definition.integrations[t.integration],t.type)?.actAs}async function rd(e,t){let n=t.task,[r,i,a]=await Promise.all([n.event?td(e,t.task):{},e.local?{}:ku(e.store),id(e,n)]),o,s=n.event;if(n.flow==="default"&&s?.chat&&n.source===s.integration){let t=e.integrations[s.integration],i=t.tools.presets.read,a=n.tools[s.integration]??[];if(!nd(n)&&a.length===i.length&&i.every(e=>a.includes(e)))o=r[s.integration];else{let[r,a]=await Promise.all([e.store.get(`app`,s.appId),e.store.get(`installation`,`${s.appId}:${s.installationId}`)]);if(!r||!a||a.deletedAt)throw Error(`Conversation installation is gone`);o=await qu(e,t,a,T(e.config,r.credentials),Yu(n.toolScopes?.[s.integration]?.repo??s.repo,i),e.config.taskTimeoutMs)}}let c=await op(e,t,r),l=n.engineChain?.length?await ad(e,n):void 0,u={...c.env},d=[...c.warnings];for(let e of Object.keys(u))a.env[e]===void 0&&!l?.some(t=>t.credential.env[e]!==void 0)||(delete u[e],d.push(`${e} is temporarily unavailable; skipped for this task.`));let f=await lp(e,n),p={...n,tools:c.tools,toolScopes:c.toolScopes},m=await cp(e,n.id,[...c.secrets,...f,...Object.values(c.tokens),...Object.values(r),...o?[o]:[],...ld(a.env),...l?.flatMap(e=>ld(e.credential.env))??[]]);await hc(e,n.id,d);let h={task:p,tokens:{...c.tokens,...r},nativeTokens:c.nativeTokens,...o?{postToken:o}:{},credential:a,...l?{engineCredentials:l}:{},config:i,connections:c.mcp,connectionEnv:u,connectionSecrets:m};if(n.runner!==`vercel-sandbox`)return h;let g=e=>{let t=new Set(sd(i,n,e).map(e=>e.name));return{...e,env:Object.fromEntries(Object.entries(e.env).map(([e,n])=>[e,t.has(e)?vn:n]))}};return{...h,credential:g(a),...l?{engineCredentials:l.map(e=>({...e,credential:g(e.credential)}))}:{}}}async function id(e,t){let n=t.usage?.engine??t.definition.engine??`claude`,r=t.credential?await e.store.get(`credential`,t.credential):(await af(e,n,t.requester,{model:t.usage?.model}))?.value;if(r)return{engine:n,...fn(e.config,r)};if(!t.runnerId&&!e.local)throw Error(`no-credential`);return{engine:n,env:{}}}async function ad(e,t){let n=t.usage?.engine??t.definition.engine,r=t.engineChain??[],i=r.slice(Math.max(0,r.indexOf(n??``))+1),a=await Promise.all(i.map(async n=>{let r=t.engineCredentials?.[n],i=r?await e.store.get(`credential`,r):void 0;return i&&(!i.owner||i.owner===t.requester)?{id:r,credential:{engine:n,...fn(e.config,i)}}:void 0}));return[...t.credential?[{id:t.credential,credential:await id(e,t)}]:[],...a.flatMap(e=>e?[e]:[])]}const od=e=>e&&URL.canParse(e)?[new URL(e).hostname]:[];function sd(e,t,n){if(n.engine!==`custom`)return hn;let r=e.models??{},i=t.usage?.model?r[t.usage.model]:void 0,a=(i&&`baseUrl`in i?[i]:Object.values(r)).flatMap(e=>`baseUrl`in e&&e.envKey&&URL.canParse(e.baseUrl)?[{name:e.envKey,host:new URL(e.baseUrl).hostname,header:`authorization`,prefix:`Bearer `}]:[]);return[...hn,...a]}async function cd(e,t,n){if(t.permissions===`auto`)return;let r=e.local?{}:await ku(e.store),i=new Set([...t.event?[t.event.integration]:[],...Object.keys(t.tools)]),a=gn(n.engine,n.env);if(n.engine===`custom`)for(let e of Object.values(r.models??{}))`baseUrl`in e&&a.push(...od(e.baseUrl));for(let n of t.connections??[]){let r=await If(e,n,t.requester);r?.provider===`mcp`?a.push(...od(r.endpoint?.url)):r&&i.add(r.provider)}for(let t of i)a.push(...e.integrations[t]?.hosts??[]);for(let e of Object.values(t.definition.mcp??{}))a.push(...od(e.url));for(let e of t.mcp??[])a.push(...od(r.mcp?.[e]?.url));for(let e of r.approvals?.allowedNetworkHosts??[]){let t=e.replace(/^\[(.*)\](?::\d+)?$/,`$1`).replace(/^([^:]+):\d+$/,`$1`);a.push(t,...Dr.isIP(t)?[]:[`*.${t}`])}return[...new Set(a)]}function ld(e){let t=[];for(let[n,r]of Object.entries(e))if(!(!/(?:KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL|AUTH)/i.test(n)&&!ye(r))&&(t.push(r),n.endsWith(`_AUTH_JSON`))){let e=JSON.parse(r);t.push(...[e.OPENAI_API_KEY,...Object.entries(e.tokens??{}).filter(([e])=>/TOKEN|KEY|SECRET/i.test(e)).map(([,e])=>e)].filter(e=>typeof e==`string`))}return t}async function ud(e,t){if(!t.event)return[];let n=await e.store.get(`installation`,`${t.event.appId}:${t.event.installationId}`),r=[];for(let t of[n,...await Promise.all(Object.values(n?.connections??{}).filter(e=>e.kind===`installation`).map(t=>e.store.get(`installation`,t.id)))])t?.token&&r.push(T(e.config,t.token));return r}async function dd(e,t){let[n,r,i]=await Promise.all([up(e,t.task),id(e,t.task).catch(e=>{if(e instanceof Error&&e.message===`no-credential`)return{engine:`codex`,env:{}};throw e}),ud(e,t.task)]),a=e.store instanceof Fn&&t.task.event&&!(await e.store.list(`snapshot`,{prefix:`connection-secrets:${t.task.id}:`,limit:1})).length?Object.values(await td(e,t.task)):[];return a.length&&await cp(e,t.task.id,[...n,...i,...a]),[...n,...i,...a,...ld(r.env)].filter(e=>e.length>=8)}var fd=r({LOCAL_LOGINS:()=>zd,engineSignIn:()=>Hd,engineSignOut:()=>Ud,engineStatus:()=>Gd,inspectLocalTask:()=>bd,isLoginEngine:()=>Vd,localLog:()=>Od,localTask:()=>kd,localTaskAction:()=>jd,localTasks:()=>hd,localUsage:()=>Md,machineSignedIn:()=>Kd,pushLocalInbox:()=>Dd,recoverLocalTasks:()=>Sd,resumeLocalTask:()=>Ad,runLocalTask:()=>Ed,startLocalTask:()=>_d,startQueuedLocalTask:()=>yd,stopLocalTasks:()=>Cd,sweepLocalQueue:()=>gd,syncLocalUsage:()=>Fd});const pd=e=>!e.name?.startsWith(Gt),X=e=>e?Date.parse(e):void 0;function md(e,t,n=!1){let r=X(t.createdAt)??0,i=ve(z.join(Fe(e,t.id),`answers.json`)),a=t.status===`running`?dt(Fe(e,t.id)).find(e=>!e.response):void 0,o=n&&!Re.includes(t.status)?it(e,t.id):null,s=n?v(e,t.id).filter(e=>!Re.includes(t.status)||(X(e.at)??0)<(X(t.resumedAt)??r)).map(e=>{let n=e.error&&typeof e.error==`object`?e.error.message:void 0;return{prompt:e.prompt??t.prompt??``,result:{ok:e.status===0,output:e.finalMessage??n??``},...n?{error:n}:{},finishedAt:X(e.at)}}):[];n&&(Re.includes(t.status)||!s.length||(s.at(-1)?.finishedAt??0)<(X(t.resumedAt)??r))&&s.push({prompt:t.currentPrompt??t.prompt??``,...o?{result:{ok:o.status===0,output:o.finalMessage??o.error?.message??``}}:{},...t.error?{error:t.error}:{},...Re.includes(t.status)?{}:{finishedAt:X(t.completedAt)}});let c=t.flowRunId?Lt(t.flowRunId)?.name:void 0,l={task:{id:t.id,source:t.source??`cli`,agent:t.agentId??ft()??``,flow:c??`default`,...t.name?{name:t.name}:c?{name:c===`review`?`Review`:c}:{},runner:`local`,...t.cwd?{cwd:t.cwd}:{},...t.permissions?{permissions:t.permissions}:{},...t.prompt?{prompt:Bt(t.prompt)?t.prompt:t.currentPrompt??t.prompt}:{},definition:{integrations:{}},...t.engine?{usage:{engine:t.engine,...t.model?{model:t.model}:{},...t.effort?{effort:t.effort}:{}}}:{},tools:{}},status:a?`waiting`:t.status,attempts:1,...a?{approval:a}:{},...i?{answer:i}:{},...o?{result:{ok:o.status===0,exitCode:null,output:o.finalMessage??o.error?.message??``},...o.tokens?{tokens:o.tokens}:{}}:{},...t.error?{error:t.error}:{},...t.fallbacks?.length?{fallbacks:t.fallbacks}:{},...t.archivedAt?{archivedAt:X(t.archivedAt)}:{},...t.autoArchived?{autoArchived:!0}:{},createdAt:r,startedAt:X(t.resumedAt)??r,...t.completedAt&&!Re.includes(t.status)?{finishedAt:X(t.completedAt)}:{},updatedAt:X(t.updatedAt)??r,local:!0,...n?{turns:s}:{}};return{...l,...fp(l)}}function hd(e,t){let n=jt(e);return(t?tt(e,{migrate:!1}):n).filter(pd).map(n=>{let r=md(e,n);return t?{...r,archivedAt:r.archivedAt??r.updatedAt}:r})}async function gd(e,t){let n=(e.now??Date.now)(),r=(await e.queue.list(e.organizationId,{archived:!1,statuses:[...De]})).filter(e=>ae(e.finishedAt??e.updatedAt,n)&&y(t,e)).map(e=>e.task.id);r.length&&await e.queue.archiveStopped(e.organizationId,n,r)}async function _d(e,t,n){if(!e.local||t.repo||(t.flow??`default`)!=="default"||t.runner&&t.runner!==`local`)return;let r=co(e,t)??e.local.cwd;await kn(e.store,r,e.integrations);let i=ft(),a=t.agent??i;if(!a)throw new U(`Name an agent: this server has no default agent.`);let{record:o,version:c}=await Nn(e.store,a);so(e,a,o);let l=await yn(e,{requester:e.session?.user.id,runner:t.runner,agent:c?.definition.runner}).catch(e=>{throw new U(e.message)});if(!(l.runner!==`local`||l.runnerId)){if(po(t),!n)return vd(e,{id:te(),source:`dashboard`,agent:a,flow:`default`,runner:`local`,cwd:r,prompt:t.prompt,definition:c?.definition??{integrations:{}},...o?.settings?{usage:o.settings}:{},connections:await ua(e,void 0,fe(o?.settings?.connections,t.connections)),tools:{}},{input:t,cwd:r});try{let l=n?await e.store.get(`task`,n):void 0,u=l?.task.connections??await ua(e,void 0,fe(o?.settings?.connections,t.connections)),d=await ap(e,l?.task??{connections:u,tools:{},definition:c?.definition??{integrations:{}},...o?.settings?{usage:o.settings}:{}}),f=s(d.mcp,d.env),p=zt({tools:d.tools},d.tokens),m=a===i?void 0:await Ht(r,a,t.mcp?.join(`,`),f.mcp),h=m??ot(t.mcp?.join(`,`),ce(r).mcp,{},f.mcp),g=[],_=await ct({taskId:n,prompt:t.prompt??``,outputSchema:t.outputSchema,cwd:r,engine:t.engine??m?.engine,model:t.model??(t.engine?void 0:m?.model),effort:t.effort??(t.engine?void 0:m?.effort),permissions:t.permissions??m?.permissions,...m?{agentPrompt:{developer:m.developer,access:gt({definition:c?.definition??{integrations:{}},...o?.settings?{usage:o.settings}:{}})}}:{},mcp:[...Object.values(p.mcp),...h.mcp],mcpBindings:h.mcpBindings,mcpWarnings:[...h.warnings??[],...d.warnings],connectionEnv:{...f.env,...p.env},connections:u,nativeMcp:h.nativeMcp,...m?{agentId:t.agent}:{},source:`dashboard`,onFallback:e=>g.push(e)},{waitForStartup:!1});return md(r,g.length?Ce(r,_.taskId,{fallbacks:g}):_.task)}catch(e){throw e instanceof rt?new U(e.message,409):e}}}async function vd(e,t,n){let r=(e.now??Date.now)();await e.store.put(`snapshot`,`local-start:${t.id}`,n),await e.queue.enqueue(e.organizationId,t,r,void 0,e.config.maxQueued??1e3),await Lo(e,!1,!0,!0);let i=await e.store.get(`task`,t.id);return i?.status===`queued`?i:kd(n.cwd,t.id)??i}async function yd(e,t,n){if(!e.local||t.task.runner!==`local`||t.task.runnerId||t.task.event?.repo)return!1;let r=await e.store.get(`snapshot`,`local-start:${t.task.id}`);if(!r)return!1;try{let i=t.task.id,a,o=r.resume?v(r.cwd,t.task.id).length:0,s=t.task.flow==="default"?x(r.cwd,t.task.id):void 0,c=n?wd(e,t.task.id,n):void 0;if(s&&!r.resume)i=s.id;else if(r.resume){let n=x(r.cwd,t.task.id);if(!n)throw Error(`Local task is missing`);await Mt(r.cwd,n,t.task.prompt??``,{onWorker:e=>{a=e},outputSchema:t.task.context?.outputSchema,...r.overrides,resolveConnections:n=>Td(e,t.task,n,c)})}else r.input?await _d(e,{...r.input,prompt:t.task.prompt,outputSchema:t.task.context?.outputSchema??r.input.outputSchema},t.task.id):i=(await Ed(e,t.task,t.task.id,!0,c)).task.id;await e.store.put(`snapshot`,`local-start:${t.task.id}`,{...r,startedId:i});let l={attempts:t.attempts,tokenHash:t.tokenHash,generation:t.generation??0,statuses:[`running`,`waiting`]};if(!await e.queue.patchTask(e.organizationId,t.task.id,{handle:`cli:${i}`},(e.now??Date.now)(),l)){let e=x(r.cwd,i);return e&&await kt(r.cwd,e),!0}if(t.task.flow==="default"){let n={task:t.task,cwd:r.cwd,fence:l,turns:o};await e.store.put(`snapshot`,`completion:${i}`,n),xd(e,i,n,a);let s=Mp(e,t.task.id);e.waitUntil&&e.waitUntil(s)}}catch(n){await e.queue.finish(e.organizationId,t.task.id,{status:`failed`,error:n instanceof Error?n.message:String(n)},(e.now??Date.now)(),{attempts:t.attempts,tokenHash:t.tokenHash})}return!0}async function bd(e,t,n){if(t.status!==`running`&&t.status!==`waiting`||t.task.flow==="default"&&e.store.localFlows?.has(t.task.id)&&t.cancelRequestedAt===void 0&&(t.startedAt===void 0||n-t.startedAt<e.config.taskTimeoutMs))return!1;let r=await e.store.get(`snapshot`,`local-start:${t.task.id}`);if(!r)return!1;let i={attempts:t.attempts,tokenHash:t.tokenHash,generation:t.generation??0,statuses:[`running`,`waiting`]};if(t.task.flow!=="default"){let r=Lt(t.task.id);if(r?.status===`running`&&(t.cancelRequestedAt!==void 0||t.startedAt!==void 0&&n-t.startedAt>=e.config.taskTimeoutMs)){let n=e.store.localFlows?.get(t.task.id);n?(await n.stop(),await n.work.catch(()=>{})):r.pid!==process.pid&&await Pt(t.task.id),r=Lt(t.task.id)}return!r||r.status===`running`?!1:e.queue.finish(e.organizationId,t.task.id,{status:t.cancelRequestedAt===void 0?r.status===`completed`?`completed`:`failed`:`cancelled`,error:r.error},n,i)}let a=kd(r.cwd,r.startedId??t.task.id);if(!a)return!1;if([`queued`,`running`,`waiting`].includes(a.status))if(t.cancelRequestedAt!==void 0||t.startedAt!==void 0&&n-t.startedAt>=e.config.taskTimeoutMs){let e=x(r.cwd,r.startedId??t.task.id);e&&await kt(r.cwd,e),a=kd(r.cwd,t.task.id)}else return!1;let o=a.status;return o!==`completed`&&o!==`failed`&&o!==`cancelled`?!1:e.queue.finish(e.organizationId,t.task.id,{status:o,result:a.result,error:a.error},n,i)}function xd(e,t,n,r){let i=e.store.completionWatches??=new Map;if(i.has(t))return;let a={stopped:!1,work:Promise.resolve()};i.set(t,a),a.work=(async()=>{let i=`completion:${t}:${n.fence?.generation??0}`,o=await e.store.get(`delivery`,i);if(o&&!o.owner)return;if(o?.posting!==void 0){console.error(`coder server: local completion ${t} has an interrupted post for turn ${o.posting+1}; retained for reconciliation`);return}if(o?.pid)try{process.kill(o.pid,0);return}catch(e){if(e.code!==`ESRCH`)return}let s=Tr(),c={owner:s,pid:process.pid,pending:!0,turns:o?.turns??n.turns??0};if(o?.owner){if(!await e.store.updateDelivery(i,o.owner,c))return}else if(!await e.store.create(`delivery`,i,c))return;let l=async(t=!1)=>{if(!n.fence)return!0;let r=await e.store.get(`task`,n.task.id);return r&&(r.generation??0)===n.fence.generation&&r.attempts===n.fence.attempts&&r.tokenHash===n.fence.tokenHash&&r.status!==`queued`&&(!t||[`running`,`waiting`].includes(r.status))},d,f=async t=>{let r=n.task.event;if(!r||n.task.source!==r.integration)throw Error(`The task has no conversation`);if(!await l(t))throw Error(`The conversation task is no longer running`);if(!d){let t=await e.store.get(`app`,r.appId);if(!t)throw Error(`Local completion has no app`);let{eventReplies:n}=await Promise.resolve().then(()=>Cl);d=await n(e,t,r)}return d},p=async(t,r=!1,i=!1)=>{let a=await f(i),o=await(r?a.problem(t):a.post(t,i));!i&&c.posting!==void 0&&(c={...c,turns:c.posting+1,posting:void 0}),o&&await Fc(e,n.task.event,o.ids??(o.id?[o.id]:[]),Date.now())},m=ue(),h=Ke(n.cwd,t,r),_=100;try{for(let r=0;r<5;r++)try{let r=async(e,r,i)=>{if(n.task.source!==n.task.event?.integration)return;u(`completion.reply`,{id:t});let a=Kt(n.task,e,r,i);a.skipped&&Xe(n.cwd,t,{kind:`status`,message:Pe}),a.text&&!a.duplicate&&await p(a.text,a.problem)};for(;;){if(a.stopped||!await l())return;let o=x(n.cwd,t);if(!o)return;let u=v(n.cwd,t);for(let t of u.slice(c.turns)){t.status!==0&&e.local&&(e.local.engineChecks=void 0);let a={finalMessage:t.finalMessage,error:t.error},o=Kt(n.task,a,!1,t),l=n.task.source===n.task.event?.integration&&o.text&&!o.duplicate;l&&await f(!1);let u=c.turns+1;if(c={...c,posting:l?c.turns:void 0},!await e.store.updateDelivery(i,s,c)||(await r(a,!1,t),c={...c,turns:u,posting:void 0},!await e.store.updateDelivery(i,s,c)))return}let d=de(n.cwd,o,m);if(!Re.includes(d.status)&&!(d.pid&&g(d.pid,d,m))&&(d.status!==`completed`||u.length>(n.turns??0))){let t=await e.store.get(`task`,n.task.id);n.fence&&t&&(t.generation??0)===n.fence.generation&&t.attempts===n.fence.attempts&&t.tokenHash===n.fence.tokenHash&&await bd(e,t,(e.now??Date.now)())&&Ro(e,!0);let a=d.status===`cancelled`;if((a||d.error)&&u.at(-1)?.prompt!==(d.currentPrompt??d.prompt??null)){if(!await e.store.updateDelivery(i,s,c))return;await r({error:{message:d.error??`Task cancelled`}},a)}break}await h.wait(_),_=Math.min(1e3,_*2)}await e.store.updateDelivery(i,s,{posted:!0,turns:c.turns,at:Date.now()})&&(await e.store.get(`snapshot`,`completion:${t}`))?.fence?.generation===n.fence?.generation&&await e.store.delete(`snapshot`,`completion:${t}`);return}catch(n){if(r===4)throw n;console.error(`coder server: local completion ${t} attempt ${r+1} failed, retrying`,n);let i=e.now??Date.now,o=i()+5e3*2**r;for(;!a.stopped&&i()<o;)await new Promise(e=>setTimeout(e,Math.min(100,o-i())))}}finally{h.close(),await e.store.updateDelivery(i,s,{...c,pid:void 0})}})().catch(e=>{console.error(`coder server: local completion ${t} failed`,e)}).finally(()=>{i.delete(t)})}async function Sd(e){if(e.local)for(let{id:t,value:n}of await e.store.list(`snapshot`,{prefix:`completion:`}))x(n.cwd,t.slice(11))&&xd(e,t.slice(11),n)}async function Cd(e){await Promise.all([...e.store.localFlows?.values()??[]].map(async e=>{await e.stop(),await e.work.catch(()=>{})}));let t=e.store.completionWatches;if(t){for(let e of t.values())e.stopped=!0;await Promise.all([...t.values()].map(e=>e.work))}}function wd(e,t,n){return{url:`http://127.0.0.1:${e.local.port}/tasks/${encodeURIComponent(t)}`,token:n}}async function Td(e,t,n,r){let i=t.event?await td(e,t):{},a=await ap(e,{...t,connections:n},i);await cp(e,t.id,[...a.secrets,...Object.values(a.tokens)]);let o=s(a.mcp,a.env),c=zt({...t,tools:a.tools,toolScopes:a.toolScopes},a.tokens,r);return{mcp:o.mcp,env:{...o.env,...c.env},warnings:a.warnings}}async function Ed(e,t,n,r=!1,i){if(t.event?.repo){let r=(e.now??Date.now)(),i=n??t.id;return await e.store.get(`task`,i)||await e.queue.enqueue(e.organizationId,{...t,id:i},r,void 0,e.config.maxQueued??1e3),await Lo(e,!1,!1,!0),await e.store.get(`task`,i)}if(!r){let r=co(e,t)??e.local.cwd;return vd(e,{...t,id:n??te(),cwd:r},{cwd:r})}let a=t.event?await td(e,t):{},o=await ap(e,t,a);await hc(e,n??t.id,o.warnings),await cp(e,n??t.id,[...o.secrets,...Object.values(o.tokens)]),t={...t,tools:o.tools,toolScopes:o.toolScopes};let l=o.tokens,u=t.event&&a[t.event.integration],d=co(e,t)??e.local.cwd,f=await e.store.get(`task`,n??t.id),p={task:t,cwd:d,...f?{fence:{generation:f.generation??0,attempts:f.attempts,tokenHash:f.tokenHash,statuses:[`running`,`waiting`]}}:{}},m=t.flow!=="default"&&n?Lt(n):void 0;if(m){let r=c(d).find(e=>e.flowRunId===n),i=(e.now??Date.now)();return r?md(d,r):{task:t,status:m.status===`running`?`running`:m.status===`completed`?`completed`:`failed`,attempts:1,createdAt:i,updatedAt:i,local:!0}}if(t.flow==="default"){n??=te();let r=`completion:${n}`,i=await e.store.get(`snapshot`,r);if(i&&xp(i.task)!==xp(t))throw Error(`Local completion belongs to another session`);i||await e.store.create(`snapshot`,r,p)}let h=t.flow==="default"&&n?x(d,n):void 0;if(h){let n;return h.status===`queued`&&!h.pid&&(n=lt(d,h.id,{...s(o.mcp,o.env).env,...zt(t,l,i).env})),xd(e,h.id,p,n),md(d,h)}let g,_=new Promise(e=>g=e),v,y;v=Wt({cwd:d,agent:t.agent,flow:t.flow,task:t,taskId:n,toolEnvironment:{tokens:l},...i?{replyEndpoint:i}:{},connections:o.mcp,connectionEnv:o.env,availability:e.local?.engineChecks&&e.local.engineChecks.expiresAt>Date.now()?e.local.engineChecks.availability:void 0,...t.engineChain?{onEngine:t=>Kd(e,t)}:{},post:t.flow!=="default"&&t.source===t.event?.integration,...u?{postToken:u}:{},source:t.source,onStart:n=>{(e.store.localFlows??=new Map).set(t.id,{stop:async()=>{n.requestStop(),await Ft(n.runId,n.runningIds())},work:v}),g(t.id)},onWorker:(e,t)=>{y=t},onTask:e=>{g(e)}}).then(async n=>(t.flow==="default"&&n.taskId&&(p.turns=n.turn??p.turns,await e.store.put(`snapshot`,`completion:${n.taskId}`,p),xd(e,n.taskId,p,y)),n)).finally(async()=>{if(e.store.localFlows?.delete(t.id),t.flow!=="default"){let n=await e.store.get(`task`,t.id);n&&n.attempts===p.fence?.attempts&&n.tokenHash===p.fence?.tokenHash&&(n.generation??0)===p.fence?.generation&&await bd(e,n,(e.now??Date.now)()),Ro(e,!0)}}),t.flow==="default"&&(e.store.localFlows??=new Map).set(t.id,{stop:async()=>{let e=x(d,n??t.id);e&&await kt(d,e)},work:v}),v.catch(()=>{e.local&&(e.local.engineChecks=void 0)});let b=await Promise.race([_,v.then(()=>void 0)]),ee=b?x(d,b):void 0,ne=(e.now??Date.now)();return ee&&md(d,ee)||{task:t,status:t.flow!=="default"&&Lt(t.id)?.status===`running`?`running`:`completed`,attempts:1,createdAt:ne,updatedAt:ne,local:!0}}async function Dd(e,t,n){let r=t.handle.slice(4),i=await e.store.get(`snapshot`,`local-start:${t.task.id}`);if(!i)throw Error(`Local task launch is missing`);let a={generation:t.generation??0,seq:-1,answers:[]};for(let o of n){let n=await e.store.get(`task`,t.task.id);if(!n||n.attempts!==t.attempts||n.tokenHash!==t.tokenHash||(n.generation??0)!==o.generation||![`running`,`waiting`].includes(n.status))break;let s=x(i.cwd,r);if(!s)throw Error(`Local task is missing`);let c=o.kind===`cancel`?await kt(i.cwd,s):await Jt(i.cwd,{...s,name:void 0},o,n=>Td(e,t.task,n));o.kind===`ask`&&a.answers.push({seq:o.seq,value:c}),a.seq=o.seq}return a}function Od(e,t,n=-1,r){let i=``;try{i=B.readFileSync(z.join(Fe(e,t),`log.jsonl`),`utf8`)}catch{}let a=i.split(`
-`).flatMap((e,t)=>{if(!e||t<=n)return[];let r=Rt(e);if(!r)return[{seq:t,at:0,level:`out`,line:e}];let i=r.kind===`error`?`err`:[`status`,`info`,`steer`].includes(r.kind??``)?`sys`:`out`;return[{seq:t,at:X(r.at)??0,level:i,line:r.message??``,entry:r}]});return r===void 0?a:a.slice(0,r)}function kd(e,t,n=!0){let r=x(e,t);return r&&pd(r)?md(e,de(e,r),n):void 0}async function Ad(e,t,n,r,i,a={},o={}){let s=e.store.completionWatches?.get(n);s&&await s.work;let c=(e.now??Date.now)(),l=await e.store.get(`task`,n);l&&[`running`,`waiting`].includes(l.status)&&(await bd(e,l,c),l=await e.store.get(`task`,n));let u={prompt:r,context:{...l?.task.context,...o,...i?{outputSchema:i}:{}}};if(await e.store.put(`snapshot`,`local-start:${n}`,{cwd:t,resume:!0,...Object.keys(a).length?{overrides:a}:{}}),l){if(!await e.queue.continueTask(e.organizationId,n,u,c,{attempts:l.attempts,generation:l.generation??0}))return!1}else{let r=x(t,n);if(!r)throw Error(`No task "${n}"`);await e.queue.enqueue(e.organizationId,{...md(t,r).task,...u},c,void 0,e.config.maxQueued??1e3)}return await Lo(e,!1,!0,!0),!0}async function jd(e,t,n,r,i){let a=x(t,n);if(!a||!pd(a))return Response.json({error:`No task "${n}"`},{status:404});let o=de(t,a),s=Re.includes(o.status),c=e.method===`POST`?await e.json().catch(()=>({})):{},l=(e,t=409)=>Response.json({error:e},{status:t});if(e.method===`DELETE`&&!r){if(s&&await kt(t,o),At(t,o),i){let e=i.store.completionWatches?.get(n);e&&(e.stopped=!0,await e.work),await i.store.delete(`task`,n),await i.store.delete(`snapshot`,`local-start:${n}`),await i.store.delete(`snapshot`,`completion:${n}`),Ro(i,!0)}return Response.json({ok:!0})}if(e.method!==`POST`)return new Response(`Method not allowed`,{status:405});if(r===`cancel`)return s?(await kt(t,o),Response.json({ok:!0})):l(`No running or queued task "${n}"`,404);if(r===`archive`)return f(t,o),i&&await i.queue.patchTask(i.organizationId,n,{archivedAt:(i.now??Date.now)(),autoArchived:void 0},(i.now??Date.now)()),Response.json({ok:!0});if(r===`steer`){let e=String(c.text??``);if(!e.trim())return l(`text is required`,400);let r=s?void 0:c.outputSchema,a=Object.fromEntries([`model`,`effort`,`permissions`].flatMap(e=>typeof c[e]==`string`&&c[e]?[[e,c[e]]]:[]));if(r!==void 0&&(!r||typeof r!=`object`||Array.isArray(r)))return l(`outputSchema must be an object`,400);try{if(!s&&i){if(!await Ad(i,t,n,e,r,a))return l(`Task is already active`);let o=await i.store.get(`task`,n);return Response.json(o?.status===`queued`?{...o,statusReason:`Waiting for a task slot`}:kd(t,n))}let c=await Mt(t,o,e,{...typeof r==`object`&&r?{outputSchema:r}:{},...a});return Response.json(s?c:kd(t,n))}catch(e){return l(e.message)}}if(r===`ask`){let e=String(c.question??c.text??``);if(!e.trim())return l(`question is required`,400);let r=await Nt(t,o,e),i=r.finalMessage??r.error?.message??``,a=z.join(Fe(t,n),`answers.json`);return we(a,[...ve(a)??[],i]),Response.json({ok:!0,answer:i})}if(r===`approve`){let e=dt(Fe(t,n)).filter(e=>!e.response),r=String(c.approvalId??c.id??e[0]?.id??``);return e.some(e=>e.id===r)?(st(Fe(t,n),r,c.decision===`deny`||c.decision===`decline`?`decline`:`accept`),Response.json({ok:!0})):l(`Task "${n}" has no pending approval`)}return new Response(`Not found`,{status:404})}function Md(e,t=new Set,n=!0){let r=Nd(t);return[...c(e),...n?tt(e,{migrate:!1}):[]].filter(pd).flatMap(e=>Pd(e,r))}function Nd(e){let t=new Map;for(let n of e){let e=n.lastIndexOf(`:`),r=n.slice(4,e),i=t.get(r)??[];i.push(Number(n.slice(e+1))),t.set(r,i)}return t}function Pd(e,t){let n=e.turnUsage??[],r=t.get(e.id)??[];t.set(e.id,r);let i=X(e.createdAt)??0;return n.flatMap(t=>{let n=X(t.at);if(n===void 0||!Number.isFinite(n))return[];let a=X(e.resumedAt),o=a!==void 0&&a>=i&&a<=n?a:i,s=r.includes(n);return i=n,s?[]:(r.push(n),[[`cli:${e.id}:${n}`,{taskId:e.id,agent:e.agentId??ft()??``,target:e.source??`cli`,...e.engine?{engine:e.engine}:{},...t.model??e.model?{model:t.model??e.model}:{},credential:`local`,runnerElapsedMs:Math.max(0,n-o),...t.tokens?{tokens:t.tokens}:{},at:n}]])})}function Fd(e){let t=e.local;return t.usageSync??=Rd(e).finally(()=>t.usageSync=void 0)}async function Id(e){try{return JSON.parse(await B.promises.readFile(e,`utf8`))}catch{return null}}async function Ld(e){return(await Promise.all([`job.json`,`results.jsonl`,`result.json`].map(async t=>{let n=await B.promises.stat(z.join(e,t)).catch(()=>void 0);return n?`${n.mtimeMs}:${n.ctimeMs}:${n.size}`:``}))).join(`|`)}async function Rd(e){let t=e.local;await t.cacheMaintenance;let n=Be(),r=await Id(n),i=await e.store.list(`usage`,{prefix:`cli:`}),a=new Set(i.map(e=>e.id)),o=0,s=async()=>{++o%4==0&&await new Promise(e=>setImmediate(e))};if(t.archiveScan===void 0)for(let[t,n]of Object.entries(r?.rows??{}))a.has(t)||(await e.store.put(`usage`,t,n),a.add(t)),await s();let c=Nd(a),l=(await B.promises.stat(pe(t.cwd)).catch(()=>void 0))?.mtimeMs??0,u={},d=new Set,f=!1;for await(let{id:n,dir:i,archived:a}of He(t.cwd)){if(await s(),d.has(n))continue;let t=a?await Ld(i):void 0;if(a&&r?.counted?.[n]===t){u[n]=t,d.add(n);continue}let o=await Id(z.join(i,`job.json`));if(o){if(o.agent&&(o.engine=o.agent),d.add(n),pd(o))for(let[t,n]of Pd(o,c))await e.store.put(`usage`,t,n),f=!0,await s();a&&(u[n]=t)}}if(f||r?.archive!==l||JSON.stringify(r?.counted)!==JSON.stringify(u)){let t=await e.store.list(`usage`,{prefix:`cli:`});await B.promises.mkdir(z.dirname(n),{recursive:!0});let r=Ae(n);try{await B.promises.writeFile(r,`${JSON.stringify({archive:l,counted:u,rows:Object.fromEntries(t.map(e=>[e.id,e.value]))})}\n`),await B.promises.rename(r,n)}finally{await B.promises.rm(r,{force:!0})}}t.archiveScan=l}const zd=`A local server stores no engine credentials. Tasks use this machine's own claude and codex sign-in.`,Bd={claude:{file:`claude`,args:[`auth`,`status`,`--json`],command:`claude auth login`,login:[`auth`,`login`],logout:[`auth`,`logout`],ok:e=>JSON.parse(e).loggedIn===!0},codex:{file:`codex`,args:[`login`,`status`],command:`codex login`,login:[`login`],logout:[`logout`],ok:()=>!0}},Vd=e=>e in Bd;function Hd(e){let t=Bd[e];xr(t.file,t.login,{detached:!0,stdio:`ignore`}).on(`error`,()=>{}).unref()}function Ud(e){let t=Bd[e];return new Promise(e=>br(t.file,t.logout,{timeout:15e3},()=>e()))}function Wd(e){return new Promise(t=>br(e.file,e.args,{timeout:15e3},(n,r)=>{try{t(!n&&e.ok(r))}catch{t(!1)}}))}async function Gd(e){let t=e?.local;if(t?.engineChecks&&t.engineChecks.expiresAt>Date.now())return t.engineChecks.work;let n={},r=Promise.all([Wd(Bd.claude),Wd(Bd.codex)]).then(([e,r])=>(t&&(n.claude=ut(`claude`,process.env,t.cwd),n.codex=nt(t.cwd)),{claude:{signedIn:e,command:Bd.claude.command},codex:{signedIn:r,command:Bd.codex.command}})).catch(e=>{throw t?.engineChecks?.work===r&&(t.engineChecks=void 0),e});return t&&(t.engineChecks={expiresAt:Date.now()+3e4,availability:n,work:r}),r}async function Kd(e,t,n){if(!e.local)return!1;let r=t?[t]:ce(e.local.cwd).chain,i=await Gd(e);return r.some(t=>{if(t!==`custom`)return i[t]?.signedIn===!0;let r=ce(e.local.cwd);try{let e=at({engine:`custom`,model:n},r).model,t=e&&r.models?.[e];return!!(t&&`baseUrl`in t&&process.env[t.envKey??`OPENAI_API_KEY`])}catch{return!1}})}var qd=r({CredentialCheckError:()=>$d,addCredential:()=>lf,checkCredential:()=>tf,completeLogin:()=>df,createCredential:()=>Sf,credentialEnv:()=>cf,credentialFix:()=>vf,credentialId:()=>Xd,credentialSummary:()=>pf,deleteCredential:()=>Cf,listCredentials:()=>xf,parseCredentialId:()=>Zd,removeCredential:()=>uf,reseal:()=>_f,resolveCredential:()=>af,resolveEngine:()=>of,signInEngine:()=>wf,signOutEngine:()=>Tf,visibleCredentials:()=>sf,writeBackCodexAuth:()=>hf});const Jd={claude:`ANTHROPIC_API_KEY`,codex:`OPENAI_API_KEY`},Yd={claude:`CLAUDE_CODE_OAUTH_TOKEN`,codex:`CODEX_AUTH_JSON`};function Xd(e,t){return e?`${e}/${t}`:t}function Zd(e){let t=e.lastIndexOf(`/`);return t<0?{name:e}:{owner:e.slice(0,t),name:e.slice(t+1)}}function Qd(e){let[t=``]=Object.keys(e);return Object.keys(Yd).find(e=>Yd[e]===t)??t}var $d=class extends Error{status;constructor(e,t){super(`Credential check failed: ${e}${t?` ${t}`:``}`),this.status=e}};function ef(e){if(e.OPENAI_API_KEY)return e.OPENAI_API_KEY;if(e.CODEX_AUTH_JSON)try{let t=JSON.parse(e.CODEX_AUTH_JSON);return t.OPENAI_API_KEY??t.tokens?.access_token??t.access_token}catch{throw Error(`CODEX_AUTH_JSON is not valid JSON`)}}async function tf(e,t=fetch){if(e.engine===`custom`)return;let n,r;if(e.engine===`claude`){let t=e.env.ANTHROPIC_API_KEY,i=e.env.CLAUDE_CODE_OAUTH_TOKEN;if(!t&&!i)throw Error(`Claude credentials need ANTHROPIC_API_KEY or CLAUDE_CODE_OAUTH_TOKEN`);n=`https://api.anthropic.com/v1/models`,r={"anthropic-version":`2023-06-01`,...t?{"x-api-key":t}:{authorization:`Bearer ${i}`,"anthropic-beta":`oauth-2025-04-20`}}}else{let t=ef(e.env);if(!t)throw Error(`Codex credentials need OPENAI_API_KEY or CODEX_AUTH_JSON`);n=`https://api.openai.com/v1/models`,r={authorization:`Bearer ${t}`}}let i=await t(n,{method:`GET`,headers:r});if(!i.ok)throw new $d(i.status,i.statusText)}function nf(e,t,n){if(e===`claude`||e===`codex`)return[e,Jd[e]];let r=null;try{r=at({...n,engine:e},t).model}catch{return[]}let i=r?t.models?.[r]:void 0;return[i&&oe(i)&&i.envKey||Jd.codex]}function rf(e,t,n){for(let r of n?[n,void 0]:[void 0])for(let n of t){let t=e.find(e=>e.id===Xd(r,n));if(t)return t}}async function af(e,t,n,r={}){let[i,a]=await Promise.all([Mu(e),e.store.listCredentials({owner:n})]);return rf(a,nf(t,Nu(e,i),r),n)}async function of(e,t,n){let[r,i]=await Promise.all([Mu(e),e.store.listCredentials({owner:n})]),a=Nu(e,r),o=t.engine??(t.model?at(t,a).engine:void 0),s=o?[o]:a.chain,c=Object.fromEntries(s.flatMap(e=>{let r=nf(e,a,e===o?t:{}),s=rf(i,r,n);return s?[[e,s.id]]:[]}));for(let n of s){let r=c[n];if(r)return{engine:n,credential:r,usable:!0,chain:s,credentials:c};if(await Kd(e,n,n===o?t.model:void 0))return{engine:n,usable:!0,chain:s,credentials:c}}return{engine:Object.values(a.models??{}).some(oe)||i.some(e=>![...Object.keys(Jd),...Object.values(Jd),...Object.values(Yd)].includes(Zd(e.id).name))?`custom`:s[0]??be,usable:!1,chain:s,credentials:c}}async function sf(e,t,n){return(await e.listCredentials({owner:t,limit:n})).filter(e=>!e.value.owner||e.value.owner===t)}async function cf(e,t){let n=e.session?.user.id,r=rf(await sf(e.store,n),[t],n);return(r?fn(e.config,r.value).env[t]:void 0)??(e.local?fr.env[t]:void 0)}async function lf(e,t,n,r=Date.now){let i=n.owner||void 0,a=Xd(i,Qd(n.env)),o=!1;return await e.withCredential(`credential`,a,async e=>{o=!!e;let s={...ln(t,{env:n.env}),...i?{owner:i}:{},...n.account?{account:n.account}:{},createdAt:r()};return[{id:a,value:s}]}),{id:a,replaced:o}}function uf(e,t){return e.withCredential(`credential`,t,async e=>e&&[{id:t,value:null}])}async function df(e,t,n,r){let i=await e.get(`login`,t);if(!i)return!1;let a=Xd(i.owner,i.engine);return e.withCredential(`credential`,a,async(e,o,s)=>{if(await s.patchLogin(t,{state:`done`},{state:[`starting`,`open`,`verifying`],tokenHash:n,owner:i.owner}))return[{id:a,value:{...r,owner:i.owner}}]})}function ff(e){if(e.CODEX_AUTH_JSON)return`auth.json`;let t=Object.values(e)[0]??``;return t.length>16?`${t.slice(0,7)}…${t.slice(-4)}`:`••••`}function pf(e,t,n){let{name:r}=Zd(t);return{name:r,scope:n.owner?`personal`:`workspace`,subscription:Object.hasOwn(Yd,r),createdAt:n.createdAt??0,masked:ff(fn(e,n).env),...n.account?{account:n.account}:{}}}const mf=e=>{try{return Date.parse(JSON.parse(e??``).last_refresh??``)}catch{return NaN}};function hf(e,t,n,r){return e.withCredential(`credential`,n,async e=>{if(!e)return;let{env:i}=fn(t,e);if(!(!i.CODEX_AUTH_JSON||!(mf(r)>(mf(i.CODEX_AUTH_JSON)||0))))return[{id:n,value:{...e,...ln(t,{env:{...i,CODEX_AUTH_JSON:r}})}}]})}function gf(e,t){return un(e,t.iv===`plain`?`plain.${t.ciphertext}`:`${t.iv}.${t.tag}.${t.ciphertext}`)}async function _f(e,t,n=Date.now){if(!t.encryptionKey)throw Error(`SERVER_ENCRYPTION_KEY is required to rotate keys`);let r=Cn(t.encryptionKey),i=e=>un(t,e)!==r,a=e=>i(e)?w(t,T(t,e)):e,o=e=>{let t=e.token&&a(e.token);if(t!==e.token)return{...e,token:t}},s=0;for(let{id:t}of await e.list(`app`))await e.withAppLock(t,async e=>{let n=await e.get(`app`,t);return!n||!i(n.credentials)?!1:(await e.put(`app`,t,{...n,credentials:a(n.credentials)}),!0)})&&s++;for(let{id:t}of await e.list(`installation`))await e.withCredential(`installation`,t,async e=>{let n=e&&o(e);return n&&[{id:t,value:n}]})&&s++;for(let{id:t}of await e.list(`connection`))await e.withAppLock(`connection:${t}`,async e=>{let n=await e.get(`connection`,t);return!n?.secret||!i(n.secret)?!1:(await e.put(`connection`,t,{...n,secret:a(n.secret)}),!0)})&&s++;for(let{id:t}of await e.list(`snapshot`)){let r=t.startsWith(`connection-secrets:`)?t.slice(19).replace(/:[a-f0-9]{24}$/,``):t.startsWith(`connections:`)?t.slice(12).replace(/:\d+:\d+:[a-f0-9]{12}$/,``):void 0;await e.withAppLock(r?`connections:${r}`:t,async e=>{let o=await e.get(`snapshot`,t);if(!o)return!1;let s=`resolvedConnections`in o?`resolvedConnections`:`secret`in o?`secret`:void 0;if(!s)return!1;let c=r?await e.get(`task`,r):void 0;if(!c||[`completed`,`failed`,`cancelled`].includes(c.status))return await e.delete(`snapshot`,t),!1;let l=o[s];return i(l)?(await e.put(`snapshot`,t,{...o,[s]:a(l)},{ttlMs:`expiresAt`in o&&typeof o.expiresAt==`number`?Math.max(1,o.expiresAt-n()):36e5}),!0):!1})&&s++}for(let{id:t}of await e.list(`runner`))await e.withCredential(`runner`,t,async e=>{if(!(!e||!i(e.secret)))return[{id:t,value:{...e,secret:a(e.secret)}}]})&&s++;for(let{id:n}of await e.list(`credential`))await e.withCredential(`credential`,n,async e=>{if(!(!e||gf(t,e)===r))return[{id:n,value:{...e,...ln(t,fn(t,e))}}]})&&s++;return s}async function vf(e,t,n){let r=mh(n??await ph(e),t===`custom`?`/settings/models`:`/settings/credentials`);return`${e.config.publicUrl?.replace(/\/$/,``)??``}${r}${t===`custom`?``:`?engine=${encodeURIComponent(t)}`}`}const yf=re({env:ie(b().check(n(/^[A-Z_][A-Z0-9_]*$/)),b().check(t(1))),workspace:l(me()),noCheck:l(me())}),bf=`Only an owner or admin of this workspace can change workspace credentials.`;async function xf(e,t,n,r){let i=t.session?.user.id,a=e=>`${e.scope}/${e.name}`,o=(e,t)=>e.localeCompare(t)||(e<t?-1:+(e>t)),s=r.searchParams.get(`fields`);if(s&&s!==`id`)return S({error:`Invalid fields`},400);if(s===`id`){let e=nn(r),n=Zt(r,200),a=(await t.store.list(`credential`,{visibleTo:i,...e?{after:e}:{},limit:Qt(r)?n+1:n})).map(({id:e})=>({id:e}));return S(Qt(r)?an(a,n,e=>e.id):a)}let c=(await sf(t.store,i,Qt(r)?void 0:Zt(r,200))).map(e=>pf(t.config,e.id,e.value)).sort((e,t)=>o(a(e),a(t)));if(!Qt(r))return S(c.slice(0,Zt(r,200)));let l=nn(r),u=r.searchParams.get(`q`)?.trim().toLowerCase(),d=c.filter(e=>!u||[e.name,e.account?.email??``].some(e=>e.toLowerCase().includes(u))).filter(e=>!l||o(a(e),l)>0);return S(an(d,Zt(r),a))}async function Sf(e,t,n,r){let i=t.session?.user.id,a=await e.json().catch(()=>void 0),o=yf.safeParse(a);if(!o.success||Object.keys(o.data.env).length!==1)return S({error:`Invalid credential`},400);let{env:s}=o.data,c=!!o.data.workspace||!i;if(c&&!vm(t))return S({error:bf},403);if(s.CODEX_AUTH_JSON)return S({error:`Sign in with Codex on the Credentials page instead.`},400);if(s.CLAUDE_CODE_OAUTH_TOKEN&&!t.config.subscriptions?.claude)return S({error:`Claude subscriptions are off on this server; add an API key.`},400);if(s.CLAUDE_CODE_OAUTH_TOKEN&&c&&t.auth)return S({error:`A Claude subscription is personal; add it without --workspace.`},400);let l=c?void 0:i,u=s.CLAUDE_CODE_OAUTH_TOKEN?`claude`:Object.keys(Jd).find(e=>Jd[e]in s)??`custom`;try{o.data.noCheck||await tf({engine:u,env:s},t.fetch??fetch);let{id:e,replaced:n}=await lf(t.store,t.config,{...l?{owner:l}:{},env:s},t.now??Date.now);return S({ok:!0,name:Zd(e).name,replaced:n})}catch(e){return e instanceof $d?S({error:e.message},e.status):(console.error(`coder server: could not save credential`,e),S({error:`Could not save credential. Please try again.`},500))}}async function Cf(e,t,n,r){let i=t.session?.user.id,a=r.searchParams.has(`workspace`)||!i;if(a&&!vm(t))return S({error:bf},403);let o=Xd(a?void 0:i,n.name);return await uf(t.store,o)?S({ok:!0}):S({error:`Unknown credential`},404)}async function wf(e,t,n,r){let i=n.engine;return Hd(i),t.local&&(t.local.engineChecks=void 0),S(await Gd())}async function Tf(e,t,n,r){let i=n.engine;return await Ud(i),t.local&&(t.local.engineChecks=void 0),S(await Gd())}var Ef=r({ConnectionError:()=>Hf,addConnection:()=>Jf,authorizeConnection:()=>np,changeConnection:()=>Yf,completeNativeConnection:()=>Lf,connectionAllowed:()=>Rf,connectionAuthorization:()=>Zf,connectionRow:()=>Mf,connectionRows:()=>Gf,createConnection:()=>$f,deleteConnection:()=>tp,findConnection:()=>If,listConnections:()=>Qf,nativeApp:()=>Bf,nativeConnections:()=>Pf,nativeCredential:()=>Nf,removeConnection:()=>Xf,updateConnection:()=>ep,visibleConnections:()=>Ff});const Df=b().check(n(/^[a-z0-9][a-z0-9_-]*$/i)),Of=o([d({header:b().check(n(/^[A-Za-z0-9!#$%&'*+.^_`|~-]+$/))}),d({env:b().check(n(/^[A-Za-z_][A-Za-z0-9_]*$/))})]),kf=d({name:b().check(t(1)),id:l(Df),provider:l(Df),owner:l(Qe(`me`)),access:l(Oe([`read`,`write`])),endpoint:l(p),auth:l(Oe([`none`,`key`,`oauth`])),key:l(b().check(t(1))),keyIn:l(Of),credential:l(b().check(t(1)))}),Af=d({name:l(b().check(t(1))),access:l(ge(Oe([`read`,`write`]))),key:l(b().check(t(1)))});function jf(e,t){let n=t.endpoint;if(t.provider===`env`)return!n&&t.auth===`key`&&t.access===`write`&&!!t.keyIn&&`env`in t.keyIn&&et(t.keyIn.env);if(t.provider!==`mcp`)return!n;if(!n||n.command&&t.access===`read`&&!n.tools?.length||n.tools?.some(e=>!le(e)))return!1;if(n.url){let r=URL.parse(n.url);if(!r||!m(r,!!e.local)||t.keyIn&&`env`in t.keyIn)return!1}else if(t.auth!==`none`&&(!t.keyIn||!(`env`in t.keyIn)))return!1;return t.auth===`oauth`&&!n.url?!1:![...Object.values(n.headers??{}),...Object.values(n.env??{})].some(ye)}function Mf(e,t,n){let r=!!e.secret;if(e.auth===`oauth`&&e.provider===`mcp`&&e.secret&&n)try{r=!!T(n,e.secret).accessToken}catch{r=!1}return{id:e.id,name:e.name,provider:e.provider,auth:e.auth,...e.access?{access:e.access}:{},...e.owner?{owner:e.owner,...t===e.owner?{mine:!0}:{}}:{},...e.endpoint?.url?{url:e.endpoint.url}:{},...e.endpoint?.command?{command:e.endpoint.command}:{},...e.provider===`env`&&e.keyIn&&`env`in e.keyIn?{env:e.keyIn.env}:{},...e.account?{account:e.account}:{},status:e.broken?`reconnect`:e.auth===`oauth`&&!r?`authorize`:`ok`,createdAt:e.createdAt}}function Nf(e,t){let n=T(e,t);return typeof n==`string`?{token:n,app:void 0}:n}async function Pf(e,t){return!t||!e.auth?.linkedAccounts?[]:(await e.auth.linkedAccounts(t,e.store)).filter(t=>t.token&&t.organizations?.includes(e.organizationId)&&e.integrations[t.platform]?.auth.user).map(n=>({id:`${t}:${n.platform}-${Sr(`sha256`).update(n.platformUserId).digest(`hex`).slice(0,12)}`,name:e.integrations[n.platform].name??n.platform,provider:n.platform,owner:t,auth:`oauth`,secret:n.token,account:n.platformUserId,oauthApp:Nf(e.config,n.token).app,createdAt:0}))}async function Ff(e,t,n){let r=await Pf(e,t),i=(await e.store.list(`connection`,{visibleTo:t,secrets:n})).map(e=>e.value).filter(e=>!e.owner||e.owner===t).map(e=>{if(!e.owner||e.provider===`mcp`||e.auth!==`oauth`)return e;let t=r.find(t=>t.provider===e.provider&&(!e.account||e.account===t.account));return{...e,secret:t?.secret,account:t?.account??e.account}});return[...i,...r.filter(e=>!i.some(n=>n.id===e.id||n.owner===t&&n.provider===e.provider&&n.account===e.account))]}async function If(e,t,n){let r=await e.store.get(`connection`,t);return r?!r.owner||r.owner===n?r:void 0:(await Pf(e,n)).find(e=>e.id===t)}async function Lf(e,t,n,r){for(let{id:i,value:a}of await e.store.list(`connection`))a.owner!==t||a.provider!==n||a.auth!==`oauth`||a.account&&a.account!==r||await e.store.withAppLock(`connection:${i}`,async a=>{let o=await a.get(`connection`,i);!o||o.owner!==t||o.provider!==n||o.account&&o.account!==r||await a.put(`connection`,i,{...o,account:r,broken:void 0,secret:void 0,updatedAt:(e.now??Date.now)()})})}async function Rf(e,t,n){if(e.method===`GET`)return t;if(n.id){let e=await If(t,n.id,t.session?.user.id);if(!e)return S({error:`Unknown connection`},404);if(e.owner===t.session?.user.id&&e.owner)return t}else if((await e.clone().json().catch(()=>void 0))?.owner===`me`)return t.auth&&t.session&&!t.local?t:S({error:`Personal connections need a signed-in member`},400);return ym(t,`Only workspace owners and admins can manage workspace connections`)}var zf=class extends Error{};async function Bf(e,t,n,r){let i=e.integrations[t]?.auth.user;if(i){if(!r){let[t,n]=await Promise.all([Th(e),e.store.list(`app`)]);r=[...t,...n.map(e=>e.value)]}return r.find(r=>{if(r.integration!==t||n&&r.id!==n)return!1;try{return i.authorizeUrl(T(e.config,r.credentials),{publicUrl:e.config.publicUrl??`https://coder.invalid`,state:``}),!0}catch{return!1}})}}async function Vf(e,t,n){if(t.provider===`mcp`)return ca(e,t,n);if(!await Bf(e,t.provider))throw new zf(`No OAuth client is available for ${e.integrations[t.provider]?.name??t.provider}.`);let r=new URLSearchParams({connection:t.id,organization:e.organizationId,attempt:wr(18).toString(`base64url`)});return`/connect/${encodeURIComponent(t.provider)}?${r}`}var Hf=class extends Error{status;needs;constructor(e,t,n){super(t),this.status=e,this.needs=n}};const Z=(e,t)=>new Hf(e,t);async function Uf(e,t=200){try{return S(await e(),t)}catch(e){if(e instanceof Hf)return S({error:e.message,...e.needs?{needs:e.needs}:{}},e.status);throw e}}async function Wf(e){return e.json().catch(()=>void 0)}async function Gf(e,t){let n=e.session?.user.id,r=await Ff(e,n,`oauth`),i=t?await e.store.get(`delivery`,`connection-authorized:${t}`):void 0;return r.map(r=>{let a=Mf(r,n,e.config);return t&&r.auth===`oauth`&&(!i||!(`target`in i)||i.target!==`${r.id}:${r.createdAt}`)&&(a.status=`authorize`),a})}async function Kf(e,t,n,r){if(n.key&&n.credential)throw Z(400,`Give a key or a credential, not both`);if(n.key){let{id:i,replaced:a}=await lf(e.store,e.config,{...r?{owner:r}:{},env:{[t]:n.key}},e.now??Date.now);return a?{id:i}:{id:i,created:!0}}let i=(await sf(e.store,r)).filter(n=>fn(e.config,n.value).env[t]!==void 0),a=n.credential?i.find(e=>e.id===n.credential):i.find(e=>r&&e.value.owner===r)??i.find(e=>!e.value.owner);if(!a)throw Z(400,n.credential?`Credential ${n.credential} does not hold ${t}`:`No credential holds ${t}; give its key`);return{id:a.id}}async function qf(e,t,n){let r=t.keyIn.env;return(await Kf(e,r,{key:n},t.owner)).id}async function Jf(e,t){let n=kf.safeParse(t);if(!n.success)throw Z(400,`Invalid connection`);let r=n.data,i=r.id??r.name.toLowerCase().replace(/[^a-z0-9_-]+/g,`-`).replace(/^-+|-+$/g,``);if(!Df.safeParse(i).success)throw Z(400,`Invalid connection id`);let a=r.provider??`mcp`,o=r.owner===`me`?e.session.user.id:void 0;if(a!==`mcp`&&a!==`env`&&!e.integrations[a]?.auth.user)throw Z(400,`This integration does not support user OAuth`);if(a===`env`&&r.auth&&r.auth!==`key`)throw Z(400,`Environment connections require a key`);if(a!==`env`&&r.credential)throw Z(400,`Only environment connections use a credential`);let s=a===`env`?`key`:a===`mcp`?r.auth??(r.key?`key`:`none`):`oauth`;if(s===`key`&&!r.key&&a!==`env`)throw Z(400,`A key is required`);if(r.key&&s!==`key`)throw Z(400,`A key needs key authentication`);let c={id:o?`${o}:${i}`:i,name:r.name,provider:a,...o?{owner:o}:{},...r.access||a===`env`?{access:r.access??`write`}:{},auth:s,...r.endpoint?{endpoint:r.endpoint}:{},...r.keyIn?{keyIn:r.keyIn}:{},...r.key&&a!==`env`?{secret:w(e.config,{key:r.key})}:{},createdAt:(e.now??Date.now)()};if(!jf(e,c))throw Z(400,`Invalid endpoint or read-only tools`);if(await e.store.get(`connection`,c.id))throw Z(409,`Connection already exists`);let l;if(a===`mcp`&&r.endpoint?.url&&!r.auth&&!r.key){try{if(l=await ta(e,r.endpoint.url,!0),!l)try{await h({...c,access:`write`},void 0,e.fetch)}catch(t){if(!(t instanceof _)||!t.authenticate||(l=await ta(e,r.endpoint.url,!0,t.authenticate),!l))throw t}l&&(c.auth=`oauth`)}catch(e){throw e instanceof _?new Hf(400,`${new URL(r.endpoint.url).hostname} takes a key, not a sign-in.`,`key`):(console.error(`coder server: connection discovery failed`,e),Z(502,`Could not start authorization`))}if(c.auth===`oauth`&&e.local?.port===0)throw Z(400,`Signing in needs a Coder server. Repeat with --server <url>, or add it in coder dash.`)}let u=a===`env`?await Kf(e,r.keyIn.env,r,o):void 0;if(u&&(c.credential=u.id),!await e.store.withAppLock(`connection:${c.id}`,e=>e.create(`connection`,c.id,c)))throw u?.created&&await uf(e.store,u.id),Z(409,`Connection already exists`);try{let t=c.auth===`oauth`?await Vf(e,c,l):void 0;return{...Mf(c,o,e.config),...t?{authorize:t}:{}}}catch(t){throw t instanceof zf||console.error(`coder server: connection authorization failed`,t),await e.store.withAppLock(`connection:${c.id}`,async e=>{let t=await e.get(`connection`,c.id);Or(t,c)&&await e.delete(`connection`,c.id)}),t instanceof zf?Z(400,t.message):Z(502,`Could not start authorization`)}}async function Yf(e,t,n){let r=Af.safeParse(n);if(!r.success)throw Z(400,`Invalid connection settings`);return e.store.withAppLock(`connection:${t}`,async n=>{let i=await If({...e,store:n},t,e.session?.user.id);if(!i)throw Z(404,`Unknown connection`);let{key:a,access:o,...s}=r.data;if(a&&i.auth!==`key`)throw Z(400,`This connection does not use a key`);let{access:c,...l}=i,u={...o===null?l:i,...s,...o?{access:o}:{},...a&&i.provider!==`env`?{secret:w(e.config,{key:a})}:{},...a?{broken:void 0}:{},updatedAt:(e.now??Date.now)()};if(!jf(e,u))throw Z(400,`Invalid read-only tools`);return a&&i.provider===`env`&&(u.credential=await qf({...e,store:n},i,a)),await n.put(`connection`,u.id,u),Mf(u,e.session?.user.id,e.config)})}async function Xf(e,t){await e.store.withAppLock(`connection:${t}`,async n=>{let r=await If({...e,store:n},t,e.session?.user.id);if(!r)throw Z(404,`Unknown connection`);if(r.owner&&r.provider!==`mcp`&&r.provider!==`env`){let t=await e.auth?.linkedAccounts?.(r.owner,n)??[];for(let i of t.filter(e=>e.platform===r.provider&&(!r.account||e.platformUserId===r.account)))await e.auth?.unlink?.(r.owner,i.platform,i.platformUserId,n)}await n.delete(`connection`,r.id)})}async function Zf(e,t){let n=await If(e,t,e.session?.user.id);if(!n||n.auth!==`oauth`)throw Z(404,`Unknown OAuth connection`);try{return await Vf(e,n)}catch(e){throw e instanceof zf||console.error(`coder server: connection authorization failed`,e),e instanceof zf?Z(400,e.message):Z(502,`Could not start authorization`)}}async function Qf(e,t){let n=new URL(e.url),r=n.searchParams.get(`authorization`)??void 0,i=n.searchParams.get(`wait`);if(!r||!i)return S(await Gf(t,r));let a=await t.store.watch(`delivery`,`connection-authorized:${r}`),o=Date.now()+25e3;try{for(;;){let n=await Gf(t,r),s=n.find(e=>e.id===i);if(!s||s.status===`ok`||Date.now()>=o||e.signal.aborted)return S(n);await a.wait(Math.min(1e4,o-Date.now()),e.signal)}}finally{a.close()}}async function $f(e,t){let n=await Wf(e);return Uf(()=>Jf(t,n),201)}async function ep(e,t,n){let r=await Wf(e);return Uf(()=>Yf(t,n.id,r))}async function tp(e,t,n){return Uf(async()=>(await Xf(t,n.id),{ok:!0}))}async function np(e,t,n){return Uf(async()=>({url:await Zf(t,n.id)}))}function rp(e){try{let t=JSON.parse(e);return[e,t.accessToken,t.refreshToken].filter(e=>typeof e==`string`&&!!e)}catch{return[e]}}async function ip(e,t){let n=t.credential?await e.store.get(`credential`,t.credential):void 0;if(!n||n.owner&&n.owner!==t.owner)throw Error(`Missing credential`);let r=fn(e.config,n).env[t.keyIn.env];if(!r)throw Error(`Missing key`);return r}async function ap(e,t,n={}){let r={},i={},o={...n},s={...t.tools},c=gt(t),l={},u=[],d=[],f=[...new Set(t.connections??[])],p=f.length?await e.store.list(`connection`,{ids:f,visibleTo:t.requester,secrets:`all`}):[],m=new Set(p.map(e=>e.id)),g,v=f.some(e=>!m.has(e))?await Pf(e,t.requester).catch(e=>(console.error(`coder server: native connection lookup failed`,e),g=e,[])):[],y=new Map([...v.map(e=>[e.id,e]),...p.map(({id:e,value:t})=>[e,t])]),b=await Promise.allSettled(f.map(async e=>{if(!y.has(e)&&g)throw g;return{id:e,value:y.get(e)}})),ee,te=b.sort((e,t)=>Number(t.status===`fulfilled`&&!!t.value.value?.owner)-Number(e.status===`fulfilled`&&!!e.value.value?.owner)),re=ne(te.flatMap(e=>e.status===`fulfilled`&&e.value.value?[e.value.value]:[]));for(let n of te){let f,p=``;try{if(n.status===`rejected`)throw n.reason;if({id:p,value:f}=n.value,!f||f.owner&&f.owner!==t.requester)continue;if(f.provider===`env`&&(f.auth!==`key`||f.access!==`write`||f.endpoint||!f.credential||!f.keyIn||!(`env`in f.keyIn)||!et(f.keyIn.env)||re.has(f.keyIn.env)||`local`in e&&e.local&&process.env[f.keyIn.env]!==void 0))throw Error(`Invalid environment connection`);if(f.broken){u.push(`${f.name} needs reconnecting.`);continue}let m,g;if(f.provider!==`mcp`&&f.provider!==`env`&&f.auth===`oauth`){if(l[f.provider])continue;let n=f,r=e.integrations[n.provider];if(!r?.auth.user)throw Error(`Missing user OAuth`);let i=!n.owner&&n.secret?T(e.config,n.secret):void 0,o=n.owner?(await e.auth?.linkedAccounts?.(n.owner,e.store))?.find(t=>t.platform===n.provider&&t.token&&t.organizations?.includes(e.organizationId)&&(!n.account||t.platformUserId===n.account)):void 0,s=await Bf(e,n.provider,(o?.token?Nf(e.config,o.token).app:void 0)??n.oauthApp??i?.app,await(ee??=Promise.all([Th(e),e.store.list(`app`)]).then(([e,t])=>[...e,...t.map(e=>e.value)])));if(!s)throw Error(`Missing integration credentials`);let c=n.owner?n.account??o?.platformUserId:void 0;if(n.owner&&!c)throw Error(`Missing linked account`);let u=n.owner?`native:${n.owner}:${n.provider}:${c}`:`connection:${p}`;m=await e.store.withAppLock(u,async i=>{let o=await If({...e,store:i},p,t.requester);if(!o||o.owner!==n.owner||o.provider!==n.provider||o.broken)throw Error(`Connection changed during resolution`);f=o;let l=(o.owner?await e.auth?.linkedAccounts?.(o.owner,i):[])?.find(t=>t.platform===o.provider&&t.token&&t.organizations?.includes(e.organizationId)&&t.platformUserId===c&&(!o.account||t.platformUserId===o.account)),u=o.owner?void 0:o.secret&&T(e.config,o.secret),m=l?.token?Nf(e.config,l.token):void 0,h=o.owner?m?.token:u&&u.token;if(!h)throw Error(`Missing native credential`);d.push(...rp(h));let g=m?.app??o.oauthApp??(u?u.app:void 0);if(g&&g!==s.id)throw Error(`OAuth client changed during resolution`);let _;try{_=await r.auth.user.access(h,T(e.config,s.credentials),{fetch:((t,n)=>(e.fetch??fetch)(t,{...n,redirect:`manual`,signal:AbortSignal.timeout(5e3)})),now:(e.now??Date.now)()})}catch(e){throw e instanceof St&&[`invalid_grant`,`invalid_token`,`bad_refresh_token`,`expired_token`].includes(e.error??``)?new a(`Native credential was revoked`):e}if(_.refreshed)if(d.push(...rp(_.refreshed)),o.owner){if(!l||!await e.auth?.refreshLinkedToken?.(o.owner,l.platform,l.platformUserId,l.token,w(e.config,{app:s.id,token:_.refreshed}),i))throw Error(`Linked account changed during refresh`)}else o.secret=w(e.config,{app:s.id,token:_.refreshed}),await i.put(`connection`,p,o);else if(o.owner&&!(await e.auth?.linkedAccounts?.(o.owner,i))?.some(e=>e.platform===l?.platform&&e.platformUserId===l.platformUserId&&e.token===l.token))throw Error(`Linked account changed during resolution`);return _.accessToken})}else if(f.provider===`env`)m=await ip(e,f);else if(f.auth!==`none`){if(!f.secret)throw Error(`Missing credential`);let t=T(e.config,f.secret);if(d.push(...[t.key,t.accessToken,t.refreshToken,t.clientSecret].filter(e=>!!e)),f.auth===`key`){if(!t.key)throw Error(`Missing key`);m=t.key}else{let t=f.owner;g=async(n=!1,r)=>{let i=await e.store.withAppLock(`connection:${p}`,async i=>{let a=await i.get(`connection`,p);if(!a||a.owner!==t||a.broken||a.auth!==`oauth`)throw Error(`Connection changed during resolution`);if(!a.secret)throw Error(`Missing credential`);let o=T(e.config,a.secret);d.push(...[o.accessToken,o.refreshToken,o.clientSecret].filter(e=>!!e));let s=AbortSignal.timeout(5e3);return{connection:a,token:await xe({secret:o,now:(e.now??Date.now)(),force:n&&o.accessToken===r,fetch:((t,n)=>(e.fetch??fetch)(t,{...n,redirect:`manual`,signal:s})),save:async t=>{d.push(...[t.accessToken,t.refreshToken,t.clientSecret].filter(e=>!!e)),a.secret=w(e.config,t),await i.put(`connection`,p,a)}})}});return f=i.connection,i.token},m=await g()}}if(m&&d.push(m),f.provider===`env`)i[f.keyIn.env]=m;else if(f.provider===`mcp`){let t=f.access??c,n;try{n=await h({...f,access:t},m,e.fetch??fetch)}catch(r){if(!(r instanceof _)||!g)throw r;m=await g(!0,m),d.push(m),n=await h({...f,access:t},m,e.fetch??fetch)}n&&(r[p]=n)}else if(!l[f.provider]&&m){let t=e.integrations[f.provider];if(!t)throw Error(`Unknown integration`);l[f.provider]=m,o[f.provider]=m,(f.access||!s[f.provider])&&(s[f.provider]=[...t.tools.presets[f.access??c]])}}catch(t){if(f&&se(t)){let t=f;await e.store.withAppLock(`connection:${p}`,async n=>{let r=await n.get(`connection`,p);r&&r.secret===t.secret&&await n.put(`connection`,p,{...r,broken:{at:(e.now??Date.now)(),reason:`Needs reconnecting`}})})}u.push(ze(f?.name??`A connection`,t))}}let ie={...t.toolScopes};for(let e of Object.keys(l))ie[e]={};return{mcp:r,env:i,tokens:o,nativeTokens:l,tools:s,toolScopes:ie,warnings:u,secrets:d}}async function op(e,t,n){if(!t.task.connections?.length)return{mcp:{},env:{},tokens:n,nativeTokens:{},tools:t.task.tools,toolScopes:t.task.toolScopes,warnings:[],secrets:[]};let r=Sr(`sha256`).update(JSON.stringify(t.task.connections)).digest(`hex`).slice(0,12),i=`connections:${t.task.id}:${t.generation??0}:${t.attempts}:${r}`,a=await e.store.get(`snapshot`,i);if(a&&`resolvedConnections`in a){let t=T(e.config,a.resolvedConnections);if(!t.warnings.length)return{...t,tokens:{...t.tokens,...n,...t.nativeTokens}}}let o=await e.store.get(`task`,t.task.id),s=await ap(e,t.task,n);return!s.warnings.length&&o&&await e.store.withAppLock(`connections:${t.task.id}`,async n=>{let r=await n.get(`task`,t.task.id);if(!r||[`completed`,`failed`,`cancelled`].includes(r.status)||r.attempts!==t.attempts||(r.generation??0)!==(t.generation??0))return;let a=(t.startedAt??(e.now??Date.now)())+(e.config.taskTimeoutMs??36e5);await n.put(`snapshot`,i,{resolvedConnections:w(e.config,s),expiresAt:a},{ttlMs:Math.max(1,a-(e.now??Date.now)())})}),s}function sp(e,t,n){let r=(e.now??Date.now)()+(e.config.taskTimeoutMs??36e5);return[...new Set(n)].filter(e=>e.length>=8).map(n=>({id:`connection-secrets:${t}:${Sr(`sha256`).update(n).digest(`hex`).slice(0,24)}`,value:w(e.config,n),expiresAt:r}))}async function cp(e,t,n){let r=sp(e,t,n);return r.length&&await e.store.saveTaskSecrets(t,r),[...new Set(n)].filter(e=>e.length>=8)}async function lp(e,t){let n=[],r=[...new Set(t.connections??[])],i=r.length?await e.store.list(`connection`,{ids:r,visibleTo:t.requester,secrets:`all`}):[],a=r.some(e=>!i.some(t=>t.id===e))?await Pf(e,t.requester):[],o=new Map([...a.map(e=>[e.id,e]),...i.map(({id:e,value:t})=>[e,t])]);for(let t of r){let r=o.get(t);if(r?.provider===`env`){n.push(...await ip(e,r).then(e=>[e],()=>[]));continue}if(!r?.secret)continue;let i=T(e.config,r.secret);n.push(...typeof i==`string`?[i]:[...`token`in i&&typeof i.token==`string`?rp(i.token):[],i.key,i.accessToken,i.refreshToken,i.clientSecret].filter(e=>!!e))}return n}async function up(e,t){let[n,r,i]=await Promise.all([e.store.get(`snapshot`,`connection-secrets:${t.id}`),e.store.list(`snapshot`,{prefix:`connection-secrets:${t.id}:`}),lp(e,t)]);if(n)throw Error(`Task ${t.id} keeps its secrets in the old single-row layout`);let a=r.flatMap(t=>`secret`in t.value?[T(e.config,t.value.secret)]:[]);return[...new Set([...a,...i])]}async function dp(e,t){await e.withAppLock(`connections:${t}`,async e=>{await e.delete(`snapshot`,`connection-secrets:${t}`);for(let n of[`connection-secrets:${t}:`,`connections:${t}:`])for(let t of await e.list(`snapshot`,{prefix:n}))await e.delete(`snapshot`,t.id)})}function fp(e,t=Date.now()){let n=e.status===`running`||e.status===`waiting`?t:e.finishedAt??e.updatedAt;return{lastActivityAt:e.updatedAt,lastTurnMs:e.startedAt===void 0?0:Math.max(0,n-e.startedAt)}}const pp=e=>({[e.key.slice(0,e.key.indexOf(`:`))]:e.through});var mp=class extends Error{};const Q=[`queued`,`running`,`waiting`];function hp(e,t){if(t.since!==void 0&&(e.updatedAt<t.since||e.updatedAt===t.since&&(!t.sinceId||e.task.id<=t.sinceId)))return!1;let n=t.status?[t.status]:t.statuses;if(n&&!n.includes(e.status)||t.agent&&e.task.agent!==t.agent||t.source&&e.task.source!==t.source||t.reviewKey&&Cp(e.task)!==t.reviewKey||t.archived!==void 0&&t.archived!==(e.archivedAt!==void 0))return!1;let r=t.q?.trim().toLowerCase();return!r||[e.task.prompt??e.task.event?.text,e.task.agent,e.task.id].some(e=>e?.toLowerCase().includes(r))}const gp=e=>({rank:he(e.status),createdAt:e.createdAt,id:e.task.id}),_p=e=>({updatedAt:e.updatedAt,id:e.task.id}),vp=(e,t)=>e.updatedAt-t.updatedAt||ke(e.task.id,t.task.id),yp=(e,t)=>Ee(gp(e),gp(t)),bp=(e,t)=>!t||(`updatedAt`in t?e.updatedAt>t.updatedAt||e.updatedAt===t.updatedAt&&e.task.id>t.id:Ee(gp(e),t)>0);function xp(e){let t=e.event;return JSON.stringify([t?.appId,t?.installationId,t?.chat?.thread.id,e.agent])}function Sp(e,t){return e.flow==="default"&&!!e.event?.chat&&xp(e)===xp(t)}function Cp(e){let t=e.event;if(e.flow!==`review`||!t)return;let n=Dt[t.integration]?.repos?.pullRequest(t);if(n!==void 0)return JSON.stringify([t.appId,t.installationId,t.repo?.owner,t.repo?.name,n])}const wp=6e5;async function Tp(e,t){let n=t.task.id,r={generation:t.generation??0,attempts:t.attempts,tokenHash:t.tokenHash??null,handle:t.handle??null};return e.queue.deleteTask(e.organizationId,n,r)}const Ep=(e,t)=>({...e,context:{...e.context,admissions:{...e.context?.admissions,...t}}});async function Dp(e,t,n,r,i){let a=t.task.id,o=await e.queue.appendInbox(e.organizationId,a,n,r,(e.now??Date.now)(),t.generation??0,i);return o&&await Mp(e,a,t.task,t),o}async function Op(e,t,n=-1,r){return r??=(await e.store.get(`task`,t))?.generation??0,e.queue.readInbox(e.organizationId,t,r,n)}const kp=new Set([`completed`,`failed`,`cancelled`]);var Ap=class{store;lock=Promise.resolve();tombstones=new Map;constructor(e){this.store=e}async metrics(e,t){let n=await this.list(e),r={queued:0,running:0,waiting:0,completed:0,failed:0,cancelled:0};for(let e of n)e.createdAt>=t&&r[e.status]++;return{tasks:r,queueDepth:n.filter(e=>e.status===`queued`).length}}serial(e){let t=this.lock.then(e,e);return this.lock=t.catch(()=>{}),t}async read(e){return this.store.get(`task`,e)}async enqueue(e,t,n,r,i){return this.serial(()=>this.insert(t,n,r,i))}async insert(e,t,n,r){let i=n&&await this.store.get(`delivery`,n.key);if(i&&!i.pending)return!1;e=i?.pending?.task??e;let a=await this.read(e.id);if(!a&&r!==void 0&&(await this.store.list(`task`)).filter(e=>e.value.status===`queued`).length>=r)throw Error(`Organization task queue is full`);return n&&!i?.pending?.task&&await this.store.put(`delivery`,n.key,{at:t,...n.owner?{owner:n.owner}:{},pending:{task:e}}),a||await this.store.put(`task`,e.id,{task:e,status:`queued`,attempts:0,createdAt:t,updatedAt:t}),n&&await this.store.put(`delivery`,n.key,{at:t},{ttlMs:n.ttlMs}),!0}async nextSeq(e){let t=await this.store.list(`inbox`,{prefix:`${e}:`}),n=(await this.store.list(`delivery`)).flatMap(t=>t.value.pending?.inbox?.id.startsWith(`${e}:`)?[t.value.pending.inbox.entry.seq]:[]);return Math.max((await this.read(e))?.inboxSeq??-1,...t.map(e=>e.value.seq),...n)+1}async admit(e,t,n){if(!t)return;let{conversation:r,unseen:i}=t;r&&await this.store.putMany(`delivery`,[{id:r.key,value:r.record},{id:r.root,value:{at:r.record.at}}],{ttlMs:r.ttlMs}),i&&await this.store.acknowledgeUnseen(i.key,i.version,i.epoch);for(let e of t.secrets??[])await this.store.put(`snapshot`,e.id,{secret:e.value,expiresAt:e.expiresAt},{ttlMs:Math.max(1,e.expiresAt-n)})}deliver(e,t,n,r,i,a,o=!0,s){return this.serial(async()=>{let c=await this.store.get(`delivery`,r.key);if(c&&!c.pending)return{};if(c?.pending?.inbox){let{taskId:e,id:i,entry:a}=c.pending.inbox,o=await this.read(e);if(o&&Q.includes(o.status)&&(o.generation??0)===a.generation&&Sp(o.task,t))return await this.store.put(`task`,e,{...o,inboxSeq:Math.max(o.inboxSeq??-1,a.seq),updatedAt:n}),await this.store.put(`inbox`,i,a),await this.store.put(`delivery`,r.key,{at:n},{ttlMs:r.ttlMs}),{steered:!0};await this.store.delete(`delivery`,r.key),c=void 0}let l=i!==void 0&&!c?.pending?.task?(await this.list(e,{statuses:Q,agent:t.agent,source:t.source})).find(e=>Sp(e.task,t)):void 0;if(!l)return!o||!await this.insert(t,n,r,a)?{}:(await this.admit(t,s,n),{taskId:t.id});let u=await this.nextSeq(l.task.id),d={seq:u,generation:l.generation??0,at:n,kind:`steer`,value:{text:i}},f=`${l.task.id}:${String(u).padStart(8,`0`)}`;return await this.store.put(`delivery`,r.key,{at:n,pending:{inbox:{taskId:l.task.id,id:f,entry:d}}}),await this.store.put(`task`,l.task.id,{...l,inboxSeq:u,updatedAt:n}),await this.store.put(`inbox`,f,d),await this.store.put(`delivery`,r.key,{at:n},{ttlMs:r.ttlMs}),{steered:!0}})}claim(e,t){return this.serial(async()=>{let n=(await this.store.list(`task`)).map(e=>e.value);if(t!==void 0&&n.filter(e=>[`running`,`waiting`].includes(e.status)).length>=t)return;let r=new Set(n.filter(e=>[`running`,`waiting`].includes(e.status)).map(e=>Cp(e.task)).filter(e=>e!==void 0)),i=n.filter(e=>{let t=Cp(e.task);return e.status===`queued`&&(t===void 0||!r.has(t))}).sort((e,t)=>e.createdAt-t.createdAt),a=i[0];if(!a)return;let o=ec(a.task.id,`default`,a.attempts+1),s={...a,tokenHash:o.hash,lastSeenAt:e,status:`running`,attempts:a.attempts+1,startedAt:e,updatedAt:e};await this.store.put(`task`,s.task.id,s);let c=Cp(a.task);return{organizationId:`default`,status:s,token:o.token,more:i.some(e=>e!==a&&(c===void 0||Cp(e.task)!==c))&&(t===void 0||n.filter(e=>[`running`,`waiting`].includes(e.status)).length+1<t)}})}allowed(e,t){return(t.generation===void 0||(e.generation??0)===t.generation)&&(t.attempts===void 0||e.attempts===t.attempts)&&(t.tokenHash===void 0||(e.tokenHash??null)===t.tokenHash)&&(t.handle===void 0||(e.handle??null)===t.handle)&&(t.lastSeenAt===void 0||(e.lastSeenAt??null)===t.lastSeenAt)&&(t.updatedAt===void 0||e.updatedAt===t.updatedAt)&&(!t.statuses||t.statuses.includes(e.status))}touch(e,t,n,r,i,a=!1){return this.serial(async()=>{let e=await this.read(t);if(!e||!this.allowed(e,{tokenHash:n,attempts:r})||!a&&kp.has(e.status)||e.status===`queued`)return;if(kp.has(e.status))return e;let o={...e,lastSeenAt:i,updatedAt:i};return await this.store.put(`task`,t,o),o})}async authorize(e,t,n,r,i,a={}){let o=await this.touch(r,e,t,n,i,a.allowCompleted);return o&&{organizationId:`default`,status:o}}async archiveStopped(e,t,n){let r=e=>e!==void 0&&kp.has(e.status)&&e.archivedAt===void 0&&(!n||n.includes(e.task.id))&&ae(e.finishedAt??e.updatedAt,t);for(let{value:e}of await this.store.list(`task`))r(e)&&await this.serial(async()=>{let n=await this.read(e.task.id);r(n)&&await this.store.put(`task`,n.task.id,{...n,archivedAt:t,updatedAt:t,autoArchived:!0})})}patchTask(e,t,n,r,i={}){return this.serial(async()=>{let e=await this.read(t);if(!e||!this.allowed(e,i))return!1;let{answer:a,...o}=n;return await this.store.put(`task`,t,{...e,...Object.hasOwn(n,`handle`)&&n.handle!==e.handle?{logsComplete:void 0}:{},...o,...a===void 0?{}:{answer:[...e.answer??[],a]},updatedAt:r}),!0})}deleteTask(e,t,n){return this.serial(async()=>{let e=await this.read(t);return!e||!this.allowed(e,n)?!1:(await this.store.delete(`task`,t),this.tombstone(t),await dp(this.store,t),!0)})}continueTask(e,t,n,r,i){return this.serial(async()=>{let e=await this.read(t);return!e||!kp.has(e.status)||!this.allowed(e,i)?!1:(await this.store.put(`task`,t,{task:{...e.task,...n},status:`queued`,attempts:0,logSeq:e.logSeq,logBytes:e.logBytes,generation:(e.generation??0)+1,inboxSeq:e.inboxSeq,createdAt:e.createdAt,updatedAt:r},{unarchive:!0}),!0)})}completeTask(e,t,n,r){return this.serial(async()=>{let e=await this.read(t);if(!e||!this.allowed(e,{attempts:n.attempts,tokenHash:n.tokenHash,statuses:[`running`,`waiting`]}))return!1;await this.store.put(`usage`,`${t}:${e.generation??0}`,n.usage);for(let n of await this.store.list(`inbox`,{prefix:`${t}:`}))n.value.generation===(e.generation??0)&&await this.store.delete(`inbox`,n.id);await this.store.put(`task`,t,{...e,...n.outcome,...n.logsComplete?{logsComplete:!0}:{},lastSeenAt:r,finishedAt:r,updatedAt:r});for(let e of n.known??[])await this.store.put(`delivery`,e.id,{at:r},{ttlMs:e.ttlMs});return await dp(this.store,t),!0})}requeue(e,t,n,r={}){return this.serial(async()=>{let e=await this.read(t);return!e||!this.allowed(e,{...r,statuses:[`running`,`waiting`]})?!1:(await this.store.put(`task`,t,{...e,status:`queued`,handle:void 0,tokenHash:void 0,lastSeenAt:void 0,updatedAt:n}),!0)})}finish(e,t,n,r,i={}){return this.serial(async()=>{let e=await this.read(t);return!e||!this.allowed(e,{...i,statuses:[`queued`,`running`,`waiting`]})?!1:(await this.store.put(`task`,t,{...e,...n,lastSeenAt:r,finishedAt:r,updatedAt:r}),await dp(this.store,t),!0)})}cancel(e,t,n,r={}){return this.serial(async()=>{let e=await this.read(t);if(!e||kp.has(e.status)||!this.allowed(e,r))return!1;let i=e.status===`queued`?void 0:{seq:await this.nextSeq(t),generation:e.generation??0,kind:`cancel`,value:null,at:n};return i&&await this.store.put(`inbox`,`${t}:${String(i.seq).padStart(8,`0`)}`,i),await this.store.put(`task`,t,{...e,...e.status===`queued`?{status:`cancelled`,finishedAt:n}:{},cancelRequestedAt:n,...i?{inboxSeq:i.seq}:{},updatedAt:n}),e.status===`queued`&&await dp(this.store,t),!0})}async cancelRequested(e,t){return(await this.read(t))?.cancelRequestedAt!==void 0}async list(e,t={}){let{before:n}=t;return(await this.store.list(`task`)).map(e=>e.value).filter(e=>hp(e,t)).filter(e=>bp(e,n)).sort(t.since===void 0?yp:vp).slice(0,t.limit)}tombstone(e){this.tombstones.set(e,Date.now())}async changes(e,t){let n=e[0]?.organizationId;if(!n)return{rows:[],deleted:[]};for(let[e,t]of this.tombstones)t<Date.now()-6e5&&this.tombstones.delete(e);return{rows:(await this.store.list(`task`)).map(e=>({organizationId:n,status:e.value})),deleted:[...this.tombstones].filter(([,e])=>e>t).map(([e,t])=>({organizationId:n,id:e,at:t}))}}async counts(e,t={}){let n=(await this.store.list(`task`)).map(e=>e.value).filter(e=>hp(e,t));return{all:n.length,active:n.filter(e=>Q.includes(e.status)).length,waiting:n.filter(e=>e.status===`waiting`).length}}async runningCount(){return(await this.store.list(`task`)).filter(e=>[`running`,`waiting`].includes(e.value.status)).length}async running(){return(await this.store.list(`task`)).map(e=>e.value).filter(e=>[`running`,`waiting`].includes(e.status)).map(e=>({organizationId:`default`,status:e}))}appendLogs(e,t,n,r,i,a,o){return this.serial(async()=>{let e=await this.read(t);return!e||!this.allowed(e,o)||(e.logSeq??0)!==r.seq||(e.logCursor??-1)!==r.cursor?!1:(await this.store.putMany(`tasklog`,n.map(({seq:e,...n})=>({id:`${t}:${String(e).padStart(6,`0`)}`,value:n}))),await this.store.put(`task`,t,{...e,logCursor:i.cursor,logSeq:i.seq,logBytes:i.bytes,updatedAt:a}),!0)})}readInbox(e,t,n,r){return this.serial(async()=>{let e=await this.read(t);return!e||!Q.includes(e.status)||(e.generation??0)!==n?[]:(await this.store.list(`inbox`,{prefix:`${t}:`})).map(e=>e.value).filter(e=>e.generation===n&&e.seq>r).slice(0,100)})}fetchInbox(e,t,n,r,i){return this.serial(async()=>{let e=await this.read(t);if(!(!e||!this.allowed(e,{tokenHash:n,attempts:r,statuses:[`running`,`waiting`]})))return(await this.store.list(`inbox`,{prefix:`${t}:`})).map(e=>e.value).filter(t=>t.generation===(e.generation??0)&&t.seq>i).sort((e,t)=>e.seq-t.seq)})}ackInbox(e,t,n,r){return this.serial(async()=>{if(r.generation!==void 0&&r.generation!==n.generation)return;let e=await this.read(t);if(!e||!this.allowed(e,{...r,generation:n.generation,statuses:void 0})||n.seq>(e.inboxSeq??-1))return;let i=e.inboxAck?.generation===n.generation?e.inboxAck.seq:-1;if(kp.has(e.status))return n.seq<=i?e.status:void 0;if(![`running`,`waiting`].includes(e.status))return;let a=(await this.store.list(`inbox`,{prefix:`${t}:`})).filter(e=>e.value.generation===n.generation&&e.value.seq<=n.seq),o=(n.answers??[]).filter(e=>e.seq>i&&a.some(t=>t.value.kind===`ask`&&t.value.seq===e.seq)).map(e=>e.value),s=a.some(e=>e.value.kind===`cancel`),c=e.approval?.id,l=c&&a.some(e=>e.value.kind===`approve`&&e.value.value?.approvalId===c),u=Object.assign({},...a.map(e=>e.value.value?.admissions)),d={...e,...Object.keys(u).length?{task:Ep(e.task,u)}:{},inboxAck:{generation:n.generation,seq:Math.max(i,n.seq)},...o.length?{answer:[...e.answer??[],...o]}:{},...l?{status:`running`,approval:void 0}:{},...s?{status:`cancelled`,finishedAt:Date.now()}:{},updatedAt:Date.now()};await this.store.put(`task`,t,d);for(let e of a)await this.store.delete(`inbox`,e.id);return s&&await dp(this.store,t),d.status})}async pendingInbox(e){let t=await this.store.list(`inbox`);return(await this.running()).filter(({status:e})=>t.some(t=>t.id.startsWith(`${e.task.id}:`)&&t.value.generation===(e.generation??0)))}appendInbox(e,t,n,r,i,a,o){let s=async()=>{if(o&&(await this.store.get(`delivery`,o.key))?.sending?.owner!==o.owner)throw new mp;let e=await this.read(t);if(!e||!Q.includes(e.status)||(e.generation??0)!==a)return;let s=await this.nextSeq(t),c=o&&pp(o),l={seq:s,generation:a,at:i,kind:n,value:c?{...r,admissions:c}:r};return await this.store.put(`inbox`,`${t}:${String(s).padStart(8,`0`)}`,l),await this.store.put(`task`,t,{...e,...c?{task:Ep(e.task,c)}:{},inboxSeq:s,updatedAt:i}),o&&await this.store.finishBatch(o.key,o.owner,!0,o.through),l};return this.serial(()=>o?this.store.withAppLock(`batch:${o.key}`,s):s())}};const jp=3e4;function Mp(e,t,n,r){if(n&&!e.local&&!n.runnerId&&!e.runners[n.runner]?.push)return Promise.resolve();let i=e.queue.inboxDelivery??=new Map,a=JSON.stringify([e.organizationId,t]),o=i.get(a);if(o||i.set(a,o={}),o.work)return o.again=!0,o.work;let s=o,c=async()=>{let n,i=Tr(),a=0,o=0,c,l=r,u=async()=>{for(;;){s.again=!1;let r=l??await e.store.get(`task`,t);if(l=void 0,!r?.handle||![`running`,`waiting`].includes(r.status))return;let c=await pn(e,r.task),u=!!(e.local&&r.handle.startsWith(`cli:`));if(!u&&!c?.push)return;o=r.generation??0;let d={generation:o,attempts:r.attempts,tokenHash:r.tokenHash??null,handle:r.handle},f=`inbox:${JSON.stringify([t,d])}`;if(n!==f){n&&await e.store.updateDeliveryLease(n,i),n=void 0;let t=await e.store.claimDeliveryLease(f,i,jp);if(t===void 0)return;n=f,a=t}else if(!await e.store.updateDeliveryLease(n,i,{owner:i,failures:a},{ttlMs:jp}))return;let p=(await e.queue.readInbox(e.organizationId,t,r.generation??0,-1)).slice(0,100);if(!p.length){if(s.again)continue;return}let m=u?await Dd(e,r,p):await c.push(r.handle,p);if(m.generation!==(r.generation??0)||!p.some(e=>e.seq===m.seq))throw Error(`Invalid inbox acknowledgement`);if(!await e.queue.ackInbox(e.organizationId,t,m,d)||(a=0,p.length<100&&!s.again))return}};try{await u()}catch(r){if(console.error(`coder server: inbox delivery failed for ${t}`,r),n){let t=Math.min(3e4,1e3*2**Math.min(a,5)),r={owner:i,failures:a+1,next:(e.now??Date.now)()+t};await e.store.updateDeliveryLease(n,i,r,{ttlMs:t}),n=void 0}}finally{n&&(await e.store.updateDeliveryLease(n,i),c=o)}return c};return s.work=(async()=>{for(;;){let n=await c();if(n===void 0||!(await e.queue.readInbox(e.organizationId,t,n,-1)).length&&!s.again)break}i.delete(a)})().finally(()=>{i.get(a)===s&&i.delete(a)}),s.work}async function Np(e,t){let n=await e.queue.pendingInbox(t);await Promise.allSettled(n.map(({organizationId:t,status:n})=>Mp(V(e,t),n.task.id)))}function Pp(e,t){let n=Np(e,t).catch(e=>console.error(`coder server: inbox flush failed`,e));e.waitUntil&&e.waitUntil(n)}function Fp(){return(process.env.PATH??``).split(z.delimiter).some(e=>{try{let t=z.join(e,`docker`);return hr(t,gr.X_OK),yr(t).isFile()}catch{return!1}})}function Ip(e){let t=!!e.local,n=t&&Fp();return[{kind:`local`,name:t?`Another machine`:`Your machine`,description:t?`Pair another computer; it runs tasks with its own logins.`:`Run tasks with your own machine and logins.`,connect:`pair`,fields:[],available:!0},{kind:`local-docker`,name:`Docker on the server`,description:`Run each task in a Docker container.`,connect:`fields`,help:`Each task runs in a fresh container on this server, using the Docker installed here. Leave fields empty for the defaults.`,fields:[{key:`image`,label:`Image`,placeholder:xn,hint:`Needs Bun, Node, Git, curl, tar, Claude Code, Codex and GitHub MCP server.`,optional:!0},{key:`memory`,label:`Memory limit`,placeholder:`4g`,optional:!0},{key:`cpus`,label:`CPU limit`,placeholder:`2`,optional:!0}],available:n,...n?{}:{reason:t?`Docker is not on PATH.`:`Available on a local server only.`}},{kind:`vercel-sandbox`,name:`Vercel Sandbox`,description:`Run tasks in an isolated sandbox.`,connect:`fields`,help:`Each task gets a fresh Vercel Sandbox. Create an access token at vercel.com/account/tokens with Sandbox access for the team that pays for it.`,fields:[{key:`token`,label:`Access token`,placeholder:`vcp_…`,hint:`with Sandbox access`,secret:!0},{key:`team`,label:`Team`,placeholder:`team_…`,hint:`VERCEL_TEAM_ID if empty`,optional:!0},{key:`projectId`,label:`Project`,placeholder:`prj_…`,hint:`VERCEL_PROJECT_ID if empty`,optional:!0},{key:`region`,label:`Region`,placeholder:`iad1`,hint:`nearest if empty`,optional:!0}],available:!0},{kind:`github-actions`,name:`GitHub Actions`,description:`Run tasks through a repository workflow.`,connect:`fields`,help:`Each task starts a workflow run in a repository you choose. Save coder server workflow as .github/workflows/coder-agent.yml. It runs coder agent run --task; the token needs Actions read and write on that repository.`,fields:[{key:`repo`,label:`Repository`,placeholder:`acme/runners`,hint:`owner/name`},{key:`workflow`,label:`Workflow file`,placeholder:`coder-agent.yml`,hint:`in .github/workflows`},{key:`token`,label:`Token`,placeholder:`github_pat_…`,hint:`Actions read and write`,secret:!0},{key:`ref`,label:`Branch`,placeholder:`main`,hint:`default branch if empty`,optional:!0}],available:!0},{kind:`http`,name:`HTTP runner`,description:`Connect a runner at a public HTTPS address.`,connect:`fields`,help:`A machine already running coder runner serve. Copy the address and secret it printed; pairing from the Another machine or Your machine option does this for you.`,fields:[{key:`url`,label:`Address`,placeholder:`https://runner.example.com`,hint:`its https address`},{key:`secret`,label:`Secret`,placeholder:`printed by coder runner serve`,hint:`32 characters or more`,secret:!0}],available:!0}]}const Lp=b().check(t(1),e(80)),Rp=Oe([`personal`,`workspace`]),zp=ie(b(),b()),Bp=d({kind:Oe([`local`,`local-docker`,`github-actions`,`vercel-sandbox`,`http`]),name:Lp,scope:Rp,config:zp}),Vp=d({name:l(Lp),default:l(Qe(!0)),config:l(zp)});function Hp(e,t,n,r=t.default){return{id:e,kind:t.kind,name:t.name,scope:t.scope,default:r,online:t.lastSeen!==void 0&&n-t.lastSeen<3e5,...t.lastSeen===void 0?{}:{lastSeen:t.lastSeen},config:t.config,createdAt:t.createdAt}}const Up=(e,t)=>({value:n})=>mn(n,t)&&(e.local||n.kind!==`local`&&n.kind!==`local-docker`);function Wp(e){let t=e.session?.user.id,n=(e.now??Date.now)(),r=n=>n===`workspace`?vm(e):!!t,i=async(n=e.store)=>(await n.list(`runner`)).filter(Up(e,t));return{user:t,now:n,canCreate:r,rows:i,row:async(t,r,a=e.store)=>{let o=(await i(a)).some(({value:e})=>e.scope===`personal`&&e.default);return Hp(t,r,n,r.default&&(r.scope===`personal`||!o))}}}async function Gp(e,t,n,r){return S({items:Kp(t,await t.store.list(`runner`),(t.now??Date.now)()),catalog:Ip(t)})}function Kp(e,t,n){let r=t.filter(Up(e,e.session?.user.id)),i=r.find(({value:e})=>e.scope===`personal`&&e.default)??r.find(({value:e})=>e.default);return[{id:bn(e),kind:e.config.runner,name:e.local?`This machine`:`Default runner`,scope:`workspace`,default:!i,online:!0,config:{},createdAt:0},...r.map(({id:e,value:t})=>Hp(e,t,n,e===i?.id))]}async function qp(e,t,n,r){n.id;let{user:i,now:a,canCreate:o,rows:s,row:c}=Wp(t);{let n=Bp.safeParse(await e.json().catch(()=>void 0));if(!n.success)return S({error:`Invalid runner`},400);if(!o(n.data.scope))return S({error:`This scope requires a member or workspace admin.`},403);let r=Ip(t).find(e=>e.kind===n.data.kind);if(!r.available||r.connect===`pair`)return S({error:r.reason??`Pair this runner with runner serve.`},400);try{Sn(r,n.data.config)}catch(e){return S({error:e.message},400)}let s=Zp(n.data.kind,n.data.config,t),l=`rnr_${wr(9).toString(`base64url`)}`,u={...n.data,...s,owner:n.data.scope===`personal`?i:void 0,createdBy:i,default:!1,createdAt:a,updatedAt:a};return await t.store.put(`runner`,l,u),S(await c(l,u))}}async function Jp(e,t,n,r){let i=n.id,{user:a,now:o,canCreate:s,rows:c,row:l}=Wp(t);if(i===bn(t))return S(await _n(t));let u=e=>{if(!e||!mn(e,a)||!t.local&&(e.kind===`local`||e.kind===`local-docker`))return S({error:`Unknown runner`},404);if(e.scope===`workspace`&&!vm(t))return S({error:`Only a workspace owner or admin can change this runner.`},403)},d=await t.store.get(`runner`,i),f=u(d);if(f)return f;let p=await _n(t,d);return await t.store.withAppLock(`runners:${t.organizationId}`,async e=>{let n=await e.get(`runner`,i);n&&n.secret===d.secret&&JSON.stringify(n.config)===JSON.stringify(d.config)&&await e.put(`runner`,i,{...n,lastSeen:p.ok?(t.now??Date.now)():void 0,updatedAt:(t.now??Date.now)()})}),S(p)}async function Yp(e,t,n,r){let i=n.id,{user:a,now:o,canCreate:s,rows:c,row:l}=Wp(t);if(i===bn(t)){if(vm(t)){let n=Vp.safeParse(await e.json().catch(()=>void 0));if(!n.success||!n.data.default||n.data.name||n.data.config)return S({error:`Only the default can change for the built-in runner.`},400);await t.store.withAppLock(`runners:${t.organizationId}`,async e=>{for(let{id:t,value:n}of await e.list(`runner`))n.scope===`workspace`&&n.default&&await e.put(`runner`,t,{...n,default:!1,updatedAt:o})});let r=(await c()).some(({value:e})=>e.scope===`personal`&&e.default);return S({id:i,kind:t.config.runner,name:t.local?`This machine`:`Default runner`,scope:`workspace`,default:!r,online:!0,config:{},createdAt:0})}return S({error:`The server default cannot be renamed or removed.`},403)}let u=e=>{if(!e||!mn(e,a)||!t.local&&(e.kind===`local`||e.kind===`local-docker`))return S({error:`Unknown runner`},404);if(e.scope===`workspace`&&!vm(t))return S({error:`Only a workspace owner or admin can change this runner.`},403)};return t.store.withAppLock(`runners:${t.organizationId}`,async n=>{let r=await n.get(`runner`,i),a=u(r);if(a||!r)return a;{let a=Vp.safeParse(await e.json().catch(()=>void 0));if(!a.success||!Object.keys(a.data).length)return S({error:`Invalid runner update`},400);let s={};if(a.data.config){let e={...r.config,...T(t.config,r.secret),...a.data.config};try{Sn(Ip(t).find(e=>e.kind===r.kind),e)}catch(e){return S({error:e.message},400)}s=Zp(r.kind,e,t)}if(a.data.default)for(let e of await n.list(`runner`))e.id!==i&&e.value.scope===r.scope&&e.value.owner===r.owner&&e.value.default&&await n.put(`runner`,e.id,{...e.value,default:!1,updatedAt:o});let c={...r,...a.data.name?{name:a.data.name}:{},...a.data.default?{default:!0}:{},...s,updatedAt:o};return await n.put(`runner`,i,c),S(await l(i,c,n))}})}async function Xp(e,t,n,r){let i=n.id,{user:a,now:o,canCreate:s,rows:c,row:l}=Wp(t);if(i===bn(t))return S({error:`The server default cannot be renamed or removed.`},403);let u=e=>{if(!e||!mn(e,a)||!t.local&&(e.kind===`local`||e.kind===`local-docker`))return S({error:`Unknown runner`},404);if(e.scope===`workspace`&&!vm(t))return S({error:`Only a workspace owner or admin can change this runner.`},403)};return t.store.withAppLock(`runners:${t.organizationId}`,async e=>{let n=await e.get(`runner`,i),r=u(n);if(r||!n)return r;{let n=(await e.list(`task`)).filter(({value:e})=>e.task.runnerId===i&&Q.includes(e.status)).length;return n?S({error:n===1?`1 task still runs on this runner. Stop it or wait.`:`${n} tasks still run on this runner. Stop them or wait.`},409):(await e.delete(`runner`,i),t.settings?.runnerInstances?.delete(i),S({ok:!0}))}})}function Zp(e,t,n){let r=new Set(Ip(n).find(t=>t.kind===e).fields.filter(e=>e.secret).map(e=>e.key)),i=Object.entries(t);return{config:Object.fromEntries(i.filter(([e])=>!r.has(e))),secret:w(n.config,Object.fromEntries(i.filter(([e])=>r.has(e))))}}const Qp=d({name:l(Lp),scope:Rp});async function $p(e,t,n,r){n.id;let{user:i,now:a,canCreate:o,rows:s,row:c}=Wp(t),l=Qp.safeParse(await e.json().catch(()=>void 0));if(!l.success)return S({error:`Invalid pairing`},400);if(!o(l.data.scope))return S({error:`This scope requires a member or workspace admin.`},403);let u=`${Buffer.from(t.organizationId).toString(`base64url`)}.${wr(32).toString(`base64url`)}`,d=a+9e5;await t.store.put(`snapshot`,`runner-pair:${Ct(u)}`,{...l.data,owner:l.data.scope===`personal`?i:void 0,createdBy:i,expiresAt:d},{ttlMs:9e5});let f=t.config.publicUrl??r.origin;return S({token:u,expiresAt:d,command:`coder runner serve --url ${f} --token ${u}`})}const em=d({token:l(b()),id:l(b()),organizationId:l(b()),name:l(b().check(t(1),e(80))),url:b(),secret:b().check(t(32)),offline:l(me())});async function tm(e,t,n,r){let i=em.safeParse(await e.json().catch(()=>void 0));if(!i.success)return S({error:`Invalid runner registration`},400);let a=i.data;try{new dn({url:a.url,secret:a.secret})}catch{return S({error:`A public HTTPS runner URL is required`},400)}let o=a.token?Buffer.from(a.token.split(`.`)[0],`base64url`).toString():a.organizationId;if(!o||o!==t.organizationId&&!t.scope)return S({error:`Invalid runner token`},401);t=V(t,o);let s=(t.now??Date.now)(),c=await t.store.withAppLock(`runners:${t.organizationId}`,async e=>{let n,r;if(a.token){let i=`runner-pair:${Ct(a.token)}`,o=await e.get(`snapshot`,i);if(!o||o.expiresAt<=s||!await e.take(`snapshot`,i))return S({error:`Pairing token expired or already used`},401);r=`rnr_${wr(9).toString(`base64url`)}`,n={kind:`http`,name:o.name??a.name??`Your machine`,scope:o.scope,owner:o.owner,createdBy:o.createdBy,default:!1,createdAt:s,updatedAt:s,...Zp(`http`,{url:a.url,secret:a.secret},t),lastSeen:s}}else{r=a.id??``;let i=await e.get(`runner`,r);if(!i||i.kind!==`http`||!wt(T(t.config,i.secret).secret??``,a.secret))return S({error:`Invalid runner token`},401);n={...i,config:{...i.config,url:a.url},lastSeen:a.offline?void 0:s,updatedAt:s}}return await e.put(`runner`,r,n),S({...Hp(r,n,s),organizationId:o})});return c.ok&&t.taskWatcher?.runnersChanged(t.organizationId),c}async function nm(e,t,n,r=!1,i){let a=xm(e);if(!a)return new Response(`Unauthorized`,{status:401});let o=tc(a);return o.task!==n||o.organization!==t.organizationId||!Number.isInteger(o.attempt)?new Response(`Unauthorized`,{status:401}):await t.queue.authorize(n,$s(a),o.attempt,t.organizationId,(t.now??Date.now)(),{allowCompleted:r,include:i})??new Response(`Unauthorized`,{status:401})}function rm(e){let t=e.event;return t?t.repo?`${t.repo.owner}/${t.repo.name}`:t.chat?.thread.channelId??t.integration:e.source}async function im(e,t,n,r){let i=n.id,a=xm(e),o=tc(a),s=$s(a),c=Number(r.searchParams.get(`after`)??-1);if(!Number.isInteger(c)||c<-1)return S({error:`Invalid cursor`},400);let l=await t.queue.fetchInbox(t.organizationId,i,s,o.attempt,c);return l?S(l):new Response(`Unauthorized`,{status:401})}async function am(e,t,n,r){let i=n.id,a=xm(e),o=tc(a),s=$s(a),c=await e.json().catch(()=>void 0);if(!c||!Number.isInteger(c.seq)||c.seq<-1||!Number.isInteger(c.generation)||c.generation<0||c.answers!==void 0&&(!Array.isArray(c.answers)||c.answers.some(e=>!e||!Number.isInteger(e.seq)||e.seq<0||e.seq>c.seq)))return S({error:`Invalid acknowledgement`},400);let l={tokenHash:s,attempts:o.attempt,generation:c.generation},u=await t.queue.ackInbox(t.organizationId,i,c,l);if(u===`cancelled`){let e=await t.store.get(`task`,i);e&&await Po(t,e)}return u?S({ok:!0}):new Response(`Unauthorized`,{status:401})}async function om(e,t,n){let r=(await e.json().catch(()=>void 0))?.entries;if(!Array.isArray(r)||r.length>100||r.some((e,t)=>!e||!Number.isSafeInteger(e.seq)||e.seq<0||!Number.isSafeInteger(e.at)||e.at<0||![`out`,`err`].includes(e.level)||typeof e.line!=`string`||Buffer.byteLength(e.line)>65536||t>0&&e.seq!==r[t-1].seq+1))return S({error:`Invalid task logs`},400);let i=await bc(t,t.callbackTask,r);return i===`ok`?S({ok:!0}):i===`gap`?S({error:`Task log sequence has a gap`},409):new Response(`Unauthorized`,{status:401})}async function sm(e,t,n,r){let i=n.id,a=xm(e),o=tc(a),s=$s(a);return await t.queue.touch(t.organizationId,i,s,o.attempt,(t.now??Date.now)())?S({ok:!0}):new Response(`Unauthorized`,{status:401})}async function cm(e,t,n,r){let i=n.id;xm(e);let a=t.callbackTask,o=a.handle?await pn(t,a.task):void 0;if([`completed`,`failed`,`cancelled`].includes(a.status))return await Po(t,a,!1,o),S({ok:!0});let s=await e.json().catch(()=>void 0);if(!s?.status||![`running`,`waiting`,`completed`,`failed`,`cancelled`].includes(s.status)||s.installationRevoked!==void 0&&s.installationRevoked!==!0||s.machine!==void 0&&s.machine!==!0||s.postedMessages!==void 0&&(!Array.isArray(s.postedMessages)||s.postedMessages.some(e=>typeof e!=`string`)))return S({error:`Invalid task result`},400);let c=await yc(t,a,!0);Object.assign(s,JSON.parse(JSON.stringify(s,(e,t)=>typeof t==`string`?c(t):t)));let l=(t.now??Date.now)(),u=a.task.event?Pc(a.task.event,s.postedMessages??[]):[];if(s.status===`running`||s.status===`waiting`)return u.length&&await Fc(t,a.task.event,s.postedMessages,l),await t.queue.patchTask(t.organizationId,i,{status:s.status,lastSeenAt:l,...s.approval===void 0?s.status===`running`?{approval:void 0}:{}:{approval:s.approval},...s.answer===void 0?{}:{answer:s.answer}},l,{attempts:a.attempts,tokenHash:a.tokenHash,statuses:[`running`,`waiting`]}),S({ok:!0});let d=typeof s.result==`string`?s.result:JSON.stringify(s.result??``),f={ok:s.status===`completed`,exitCode:s.status===`completed`?0:1,output:d,...typeof s.diff==`string`?{diff:s.diff}:{}},p=!o||o.kind===`vercel-sandbox`||o.kind===`local-docker`,m=await t.queue.completeTask(t.organizationId,i,{attempts:a.attempts,tokenHash:a.tokenHash,known:u.map(e=>({id:e,ttlMs:wc})),logsComplete:!!a.handle&&!p,outcome:{status:s.status,result:f,...s.error?{error:s.error}:{},...s.tokens===void 0?{}:{tokens:s.tokens}},usage:{...a.task.event?{installationId:`${a.task.event.appId}:${a.task.event.installationId}`}:{},taskId:i,agent:a.task.agent,target:rm(a.task),...a.task.usage?.engine??a.task.definition.engine?{engine:a.task.usage?.engine??a.task.definition.engine}:{},...a.task.usage?.model??a.task.definition.model?{model:a.task.usage?.model??a.task.definition.model}:{},credential:a.task.credential??`unknown`,runnerElapsedMs:Math.max(0,l-(a.startedAt??l)),...s.tokens===void 0?{}:{tokens:s.tokens},at:l}},l),h=a.task.event;if(m&&s.status===`failed`&&s.installationRevoked&&h&&t.integrations[h.integration]?.isUninstalled&&await Ku(t.store,`${h.appId}:${h.installationId}`,l),m&&s.machine&&h&&a.task.source===h.integration){let e=await t.store.get(`app`,h.appId),{recordFailure:n}=await Promise.resolve().then(()=>bl);e&&await n(t,e,s.error??`The machine failed`,h.installationId,h,async()=>(await um(t,a)).replies)}return m&&await Po(t,p?a:{...a,logsComplete:!0},!1,o),S({ok:!0})}const lm=/^[a-f0-9-]{36}$/;async function um(e,t){let n=t.task.event;if(!n||t.task.source!==n.integration)throw Error(`The task has no conversation`);let r=await e.store.get(`app`,n.appId);if(!r)throw Error(`The conversation app is gone`);let{eventReplies:i}=await Promise.resolve().then(()=>Cl);return{event:n,replies:await i(e,r,n)}}async function dm(e,t,n,r){let i=e.callbackTask,a=`${t}:${i.task.id}:${i.generation??0}:${n}`,o=(e.now??Date.now)();if(!await e.store.create(`delivery`,a,{at:o},{ttlMs:864e5}))return S({ok:!0,duplicate:!0});try{await r(await um(e,i))}catch(t){return await e.store.delete(`delivery`,a),S({error:t instanceof Error?t.message:String(t)},409)}return S({ok:!0})}async function fm(e,t){let n=await e.json().catch(()=>void 0);if(typeof n?.id!=`string`||!lm.test(n.id))return S({error:`Invalid call id`},400);if(typeof n.text!=`string`||!n.text.trim())return S({error:`Reply text is required`},400);let r=n.text.trim();return dm(t,`reply`,n.id,async({event:e,replies:n})=>{let i=await n.post(r,!0);i&&await Fc(t,e,i.ids??(i.id?[i.id]:[]),(t.now??Date.now)())})}async function pm(e,t){let n=await e.json().catch(()=>void 0);if(typeof n?.id!=`string`||!lm.test(n.id))return S({error:`Invalid call id`},400);if(typeof n.emoji!=`string`||!n.emoji.trim())return S({error:`Emoji is required`},400);if(n.message!==void 0&&(typeof n.message!=`string`||!n.message.trim()))return S({error:`Message id must be a non-empty string`},400);let{emoji:r,message:i}=n;return dm(t,`react`,n.id,async({replies:e})=>{if(!e.react)throw Error(`The conversation cannot add reactions`);await e.react(r.trim(),i)})}async function mm(e,t,n,r){n.id,xm(e);let i=t.callbackTask,a=await e.json().catch(()=>({}));if(typeof a.authJson!=`string`||!i.task.credential)return S({error:`Invalid credential update`},400);let o=typeof a.credentialId==`string`?a.credentialId:i.task.credential;return o!==i.task.credential&&o!==i.task.engineCredentials?.codex?S({error:`Invalid credential update`},400):S({kept:await hf(t.store,t.config,o,a.authJson)})}async function hm(e,t,n,r){n.id,xm(e);let i=t.callbackTask;try{let{connectionSecrets:e,...n}=await rd(t,i);return S({...n,generation:i.generation??0,logCursor:i.logCursor??-1,timeoutMs:Math.max(1,t.config.taskTimeoutMs-((t.now??Date.now)()-(i.startedAt??(t.now??Date.now)())))})}catch(e){return S({error:e instanceof Error?e.message:String(e)},409)}}async function gm(e,t){if(!t.auth)return t;let n=await t.auth.session(e.headers);if(!(!n?.organizationId||n.organizationDenied))return{...V(t,n.organizationId),session:n}}const _m=new Set([`owner`,`admin`]);function vm(e){return!e.auth||_m.has(e.session?.role??``)}function ym(e,t){return vm(e)?e:S({error:t},403)}function bm(e,t){return!!(e&&t&&wt(e,t))}function xm(e){let t=e.headers.get(`authorization`);return t?.startsWith(`Bearer `)?t.slice(7):null}const Sm=new Set([`localhost`,`127.0.0.1`,`::1`,`[::1]`]);function Cm(e){if(e.headers.has(`x-forwarded-for`)||e.headers.has(`x-forwarded-host`))return!1;let t=e.headers.get(`host`)??new URL(e.url).host;try{return Sm.has(new URL(`http://${t}`).hostname)}catch{return!1}}const wm=e=>e.local?`local`:e.config.store===`postgres`?`cloud`:`memory`,Tm=e=>e.startsWith(`/tasks/`)||e.startsWith(`/logins/`)||e===`/runners/register`,Em=[`/hooks/`,`/create/`,`/install/`,`/connect/`];function Dm(e,t){let n=e?.replace(/^::ffff:/,``)??``;if(Sm.has(n)||n.startsWith(`127.`))return!0;let r=URL.parse(`http://localhost${t}`)?.pathname??``;return r===`/connections/oauth/client.json`||Tm(r)||Em.some(e=>r.startsWith(e))}function Om(e,t){if(!t.local)return!0;let n=new URL(e.url),r=e.headers.get(`host`)??n.host,i=URL.parse(`http://${r}`)?.port||`80`;if(Cm(e)&&i===String(t.local.port))return!0;let a=t.config.publicUrl?new URL(t.config.publicUrl).host:void 0;return(e.headers.get(`x-forwarded-host`)?.split(`,`,1)[0]?.trim()??r)===a&&!Cm(e)&&(n.pathname===`/connections/oauth/client.json`||Tm(n.pathname)||Em.some(e=>n.pathname.startsWith(e)))}function km(e,t){let n=e.headers.get(`origin`)??e.headers.get(`referer`);if(!n)return!1;try{return new URL(n).origin===new URL(t??e.url).origin}catch{return!1}}function Am(e){let t=e.headers.get(`cookie`)?.split(`;`).map(e=>e.trim()).find(e=>e.startsWith(`coder_admin=`))?.slice(12);if(!t)return null;try{return decodeURIComponent(t)}catch{return null}}async function jm(e,t){if(!t.auth){let n=()=>new Response(`Unauthorized`,{status:401,headers:{"www-authenticate":`Bearer`}});if(t.config.store!==`memory`||!Cm(e))return n();let r=Am(e),i=bm(xm(e),t.config.adminToken),a=bm(r,t.config.adminToken);return i?{...t,authorizedRequest:e}:a?e.method===`GET`||km(e)?{...t,authorizedRequest:e}:$t():n()}let n=await t.auth.session(e.headers,e.method!==`GET`);if(n?.stale)return S({error:`Token too old for this action.`},401,{"www-authenticate":`Bearer error="invalid_token", error_description="Token too old for this action"`});if(n?.organizationDenied)return S({error:`You are not a member of that workspace.`},403);let r=n?.role;return!n?.organizationId||!r?S({error:`Sign in first.`,hint:`coder auth login`},401,xm(e)?{"www-authenticate":`Bearer error="invalid_token"`}:{}):e.method!==`GET`&&e.headers.has(`cookie`)&&!km(e,t.config.publicUrl)?$t():{...V(t,n.organizationId),auth:t.auth,session:n,authorizedRequest:e}}async function Mm(e,t){if(!t.auth)return t;let n=new Headers(e.headers),r=new URL(e.url).searchParams.get(`organization`);r&&n.set(`x-coder-organization`,r);let i=await t.auth.session(n,!0);if(i?.organizationDenied)return new Response(`You are not a member of that workspace.`,{status:403});let a=i?.role;return!i?.organizationId||!a?tn(new URL(e.url)):{...V(t,i.organizationId),session:i}}async function Nm(e,t){if(e.method!==`POST`)return;let n=em.safeParse(await e.clone().json().catch(()=>void 0));if(!n.success||n.data.token)return;let{id:r,organizationId:i,secret:a}=n.data;if(!r||!i||i!==t.organizationId&&!t.scope)return;let o=V(t,i),s=await o.store.get(`runner`,r);if(s?.kind===`http`&&wt(T(o.config,s.secret).secret??``,a))return`runner:${i}:${r}`}async function Pm(e,t,n,r){let i=n.id,a=xm(e);if(!a)return new Response(`Unauthorized`,{status:401});let o=tc(a);return o.task!==i||typeof o.organization!=`string`||!o.organization||!Number.isInteger(o.attempt)||(t.scope&&(t=V(t,o.organization)),t.organizationId!==o.organization)?new Response(`Unauthorized`,{status:401}):t}async function Fm(e,t,n,r,i=!1,a){let o=n.id,s=xm(e),c=s&&Bm(s);c&&t.scope&&(t=V(t,c));let l=await nm(e,t,o,i,a);if(l instanceof Response)return l;let{status:u,loaded:d}=l;return{...t,...d?{store:Do(t.store,u,d)}:{},callbackTask:u}}const Im=(e,t)=>(n,r,i,a)=>Fm(n,r,i,a,t(n),e),Lm=Im(`secrets`,e=>e.method===`POST`),Rm=Im(`secrets`,()=>!0),zm=Im(`context`,()=>!1);function Bm(e){let{organization:t}=tc(e);return typeof t==`string`?t:void 0}async function Vm(e,t,n){let r=xm(e);if(!r)return new Response(`Unauthorized`,{status:401});let i=Bm(r),a=i&&t.scope&&i!==t.organizationId?V(t,i):t,o=n.id,s=await a.store.get(`login`,o);return!s||!wt($s(r),s.tokenHash)?new Response(`Unauthorized`,{status:401}):{...a,callbackLogin:s}}async function Hm(e,t){let n=e.method===`POST`?new URLSearchParams(await e.clone().text()):void 0;return t.searchParams.get(`tx`)??rn(t.searchParams.get(`state`))?.tx??n?.get(`tx`)??void 0}async function Um(e,t,n,r){if(!/^[a-z0-9_-]+$/.test(n.integration??n.id??``))return Mi(e,t);let i=await Hm(e,r),a=t.serverOrganizationId??t.organizationId;return i&&Ur(t,i)===`*`&&Hr(t,i)===a?{...V(t,a),operatorApp:!0}:Mm(e,t)}function Wm(e,t,n,r){return/^[a-z0-9_-]+$/.test(n.integration??n.id??``)?Mm(e,t):Mi(e,t)}async function Gm(e,t,n,r){if(!/^[a-z0-9_-]+$/.test(n.integration??``))return Mi(e,t);if(!t.integrations[n.integration]?.auth.user||!t.auth||!t.config.publicUrl)return en();if(e.method!==`GET`)return t;let i=await gm(e,t);return i?.session?i:tn(r)}async function Km(e,t,n,r){if(t.local&&!t.auth)return Zm(e,t);if(!t.auth)return en();let i=await gm(e,t);return i?.session?i:tn(r)}function qm(e,t){return ym(t,`Workspace admin access is required.`)}const Jm=(e,t=e.session)=>!e.auth||!!(t&&e.config.operators?.includes(t.user.id));async function Ym(e,t){return Jm(t)?t.auth&&await t.auth.operator(e.headers)!==t.session.user.id?S({error:`Operator mode ended. Sign in again to continue.`},401):t:en()}async function Xm(e,t,n,r){let i=await oh(e,t,n,r);return i instanceof Response||!t.auth?i:Jm(t,await t.auth.session(e.headers))?(await t.auth.operator(e.headers),i):en()}function Zm(e,t){return t.local?t:en()}function Qm(e,t){return t.local?S({error:zd},400):t.session?.user.id?t:S({error:`Sign in to use a subscription.`},403)}function $m(e){return async(t,n,r,i)=>{let a=n.authorizedRequest===t?n:await jm(t,n);return a instanceof Response?a:e?e(t,a,r,i):a}}function eh(e,t,n,r){return e.method===(n.engine?`POST`:`GET`)&&(!t.local||n.engine&&!Vd(n.engine))?S({error:n.engine?`Engine sign-in is available on a local server only`:`Engine status is available on a local server only`},404):t}async function th(e,t,n,r){return t.config.publicUrl&&t.auth?t:Mi(e,t)}async function nh(e,t,n,r){if(!t.auth)return jm(e,t);if(![`GET`,`POST`,`PUT`,`PATCH`,`DELETE`].includes(e.method))return t;let i=await t.auth.session(e.headers);return i?.organizationDenied?S({error:`You are not a member of that workspace.`},403):i?{...t,session:i}:S({error:`Sign in first.`,hint:`coder auth login`},401)}function rh(e,t,n,r){return e.method===`POST`?t.auth||t.config.store!==`memory`||!Cm(e)?en():km(e)?t:$t():t}async function ih(e,t,n,r){return e.method===`GET`?{...t,session:(await gm(e,t))?.session}:t}async function ah(e,t,n,r){return[`GET`,`POST`,`PUT`,`PATCH`,`DELETE`].includes(e.method)&&t.auth&&(await gm(e,t))?.session?C(`/dash`):t}async function oh(e,t,n,r){if(![`GET`,`POST`,`PUT`,`PATCH`,`DELETE`].includes(e.method))return t;let i=r.pathname.split(`/`)[2]??``,a=new Headers(e.headers);a.delete(`x-coder-organization`),i&&a.set(`x-coder-organization`,i);let o=await t.auth?.session(a);if(o&&!o.organizations.length)return t.auth.handler(new Request(r.origin+`/api/auth/sign-in?return=`+encodeURIComponent(r.pathname+r.search)));if(t.auth&&!o)return Ei(e,t,r,r.pathname+r.search);let s=o?.organizations??[{id:t.organizationId,slug:`local`,name:``,role:`owner`}],c=s.find(e=>encodeURIComponent(e.slug)===i);if(!c){let n=s.find(e=>encodeURIComponent(e.id)===i),a=(await t.auth?.session(e.headers))?.organizationId,o=n??s.find(e=>e.id===a)??s[0],c=`/dash/${encodeURIComponent(o.slug)}`,l=r.pathname.slice(`/dash/${i}`.length);if(n)return C(`${c}${l}${r.search}`);let u=`${c}${r.pathname.slice(5)}`;return await di(u,t.dashboardHosts)?C(`${u}${r.search}`):t.auth&&e.method===`GET`&&await di(`${c}${l}`,t.dashboardHosts)?C(`${c}/agents?${new URLSearchParams({link:r.pathname+r.search})}`):en()}return t.auth?(await t.auth.setOrganization(e.headers,c.slug),{...V(t,c.id),session:o}):t}function sh(e,t,n,r){return e.method===`POST`&&t.local?S({error:zd},400):t}async function ch(e,t,n,r){if(![`GET`,`POST`].includes(e.method))return t;if(!t.auth)return en();if(e.headers.get(`authorization`)?.startsWith(`Bearer `))return S({error:`Link your account from the browser.`},403);let i=await gm(e,t);return i?.session?i:e.method===`GET`?tn(r):S({error:`Sign in first.`},401)}function lh(e,t,n,r){return![`GET`,`POST`,`PUT`,`PATCH`,`DELETE`].includes(e.method)||t.auth?t:en()}async function uh(e,t,n,r){if(!t.auth)return S({mode:wm(t),organization:{id:t.organizationId,slug:`local`},server:dh(t),operator:Jm(t)});let i=t.session;return S({mode:wm(t),user:i.user,organization:i.organizations.find(e=>e.id===i.organizationId)??null,organizations:i.organizations,manageMembersUrl:`${t.auth.issuer}/auth/onboarding`,server:dh(t),operator:Jm(t,i)})}function dh(e){return{name:e.config.name??`Coder`,store:e.config.store,...e.config.publicUrl?{url:e.config.publicUrl}:{},issuesUrl:e.config.issuesUrl,subscriptions:{claude:!!e.config.subscriptions?.claude,codex:!!e.config.subscriptions?.codex}}}function fh(e){let t=e.session?.organizations??[];return(t.find(t=>t.id===e.organizationId)??t.find(t=>t.id===e.session?.organizationId))?.slug??(e.auth?e.organizationId:`local`)}async function ph(e,t){let n=e.session?.organizations.find(t=>t.id===e.organizationId)?.slug??t?.slug;return n||!e.auth?n??`local`:(await e.auth.organization?.(e.organizationId))?.slug??e.organizationId}const mh=(e,t=``)=>e?`/dash/${encodeURIComponent(e)}${t}`:`/dash${t}`;function $(e,t,n={},r){let i=new URLSearchParams({status:t});for(let[e,t]of Object.entries(n))t?.length&&i.set(e,Array.isArray(t)?t.join(`,`):t);/^[\w.-]{1,64}$/.test(i.get(`error`)??``)||i.delete(`error`);let a=r??mh(fh(e),`/setup`);return C(`${hh(e)}${a.replace(/[?#].*$/,``)}?${i}`)}const hh=e=>e.local?`http://localhost:${e.local.port}`:``,gh=(e,t)=>mh(fh(e),`/agents/${encodeURIComponent(t)}/platforms`);function _h(e){let t=e.get(`agent`),n=e.get(`def`),r=rn(n);if(!(!t||!n||!r?.integrations))return{state:{agent:t,repo:e.get(`repo`)??void 0,branch:e.get(`branch`)??void 0,def:n,tx:e.get(`tx`)??void 0,owner:e.get(`owner`)||void 0,...[`1`,`true`].includes(e.get(`public`)??``)?{public:!0}:{}},definition:r}}const vh=e=>typeof e==`string`&&/^\/dash(?:[/?#]|$)/.test(e)?e:void 0,yh=(e,t)=>JSON.stringify({integration:e,agent:t.agent,repo:t.repo??null,branch:t.branch??null,def:t.def,owner:t.owner??null,public:t.public??!1});async function bh(e,t,n,r){let i=await qr(e,t,`create`,r),a=i?JSON.parse(i):void 0,o=rn(a?.def??null);if(!(a?.integration!==n||!o?.integrations||!await Gr(e,t,`create`,r,i)))return{state:{agent:a.agent,repo:a.repo??void 0,branch:a.branch??void 0,def:a.def,tx:t,owner:a.owner??void 0,...a.public?{public:!0}:{}},definition:o}}async function xh(e,t,n){return(await e.store.list(`app`,{prefix:`${n}:`})).find(e=>e.value.integration===n&&e.value.agent===t.agent)?.value}function Sh(e,t,n){let r={kind:`installation`,id:n};return{...e,connections:{...e.connections,[t]:r}}}async function Ch(e,t,n){let r=await e.store.get(`app`,t.app);return r&&xh(e,r,n)}var wh=r({serverAppLink:()=>Eh,serverAppUrl:()=>Dh,sharedApps:()=>Th});async function Th(e,t){let n=e.serverOrganizationId&&e.serverOrganizationId!==e.organizationId?e.scope?.(e.serverOrganizationId).store??e.store:e.store;return(await(n===e.store&&t?t:n.list(`app`))).map(({value:e})=>e).filter(t=>t.builtin&&e.integrations[t.integration]?.app.builtin===`shared`)}async function Eh(e,t={}){let n=cn(t.env??fr.env),r=Et(n.integrations);if(!r[e])throw new rt(`invalid-option`,`Unknown integration "${e}".`,{hint:`Pick one of ${Object.keys(r).join(`, `)}.`});if(r[e].app.builtin!==`shared`)throw new rt(`invalid-option`,`Create ${e} apps in your workspace from the agent's Platforms tab.`);if(!n.databaseUrl||!n.publicUrl)throw new rt(`invalid-option`,`Built-in apps need the server database and address.`,{hint:`Set DATABASE_URL and PUBLIC_URL as the server has them.`});let i=await Wa(n);try{let a=i.defaultOrganizationId;return{url:await Dh({config:n,integrations:r,organizationId:a,store:i.store(a)},e,t)}}finally{await i.close()}}async function Dh(e,t,n){if(e.integrations[t]?.app.builtin!==`shared`)throw new rt(`invalid-option`,`Create ${t} apps in your workspace from the agent's Platforms tab.`);let r=ft();if(!r)throw new rt(`invalid-option`,`This server ships no default agent.`);let i={...ht()[r].json,...n.name?{name:n.name}:{}},a={agent:r,def:sn(i),...n.owner?{owner:n.owner}:{},public:!0},o=await zr(e,`create`,`*`,yh(t,a)),s=new URLSearchParams({agent:a.agent,def:a.def,...a.owner?{owner:a.owner}:{},public:`1`,tx:o});return`${hh(e)||e.config.publicUrl.replace(/\/$/,``)}/create/${t}?${s}`}export{cm as $,Hi as $n,Su as $t,Zm as A,qa as An,Tf as At,km as B,Ka as Bn,qu as Bt,sh as C,$o as Cn,zr as Cr,cf as Ct,Pm as D,Ro as Dn,_f as Dt,eh as E,Lo as En,xf as Et,Gm as F,no as Fn,fd as Ft,Fm as G,Pa as Gn,Nu as Gt,wm as H,Na as Hn,Ou as Ht,Ym as I,eo as In,Sd as It,sm as J,ya as Jn,Mu as Jt,ch as K,za as Kn,Hu as Kt,Xm as L,Qa as Ln,Cd as Lt,Vm as M,Ja as Mn,Od as Mt,Rm as N,ro as Nn,kd as Nt,Wm as O,bo as On,of as Ot,th as P,Za as Pn,hd as Pt,om as Q,ha as Qn,bu as Qt,ih as R,to as Rn,gd as Rt,Um as S,Qo as Sn,qr as Sr,Sf as St,rh as T,No as Tn,Cf as Tt,ah as U,Ma as Un,zu as Ut,Lm as V,xa as Vn,Uu as Vt,Dm as W,Ra as Wn,Bu as Wt,im as X,_a as Xn,lu as Xt,hm as Y,da as Yn,Lu as Yt,mm as Z,fa as Zn,Tu as Zt,$m as _,yc as _n,ti as _r,$f as _t,vh as a,hu as an,Ri as ar,Gp as at,Km as b,vs as bn,Zr as br,Ef as bt,$ as c,cu as cn,ci as cr,Kp as ct,bh as d,iu as dn,Ti as dr,wp as dt,yu as en,la as er,pm as et,mh as f,ru as fn,ji as fr,Np as ft,nh as g,vc as gn,ei as gr,Rf as gt,Sm as h,Sl as hn,Di as hr,np as ht,Th as i,mu as in,Bi as ir,Xp as it,Qm as j,oo as jn,Gd as jt,Om as k,So as kn,wf as kt,gh as l,tu as ln,Mi as lr,Yp as lt,fh as m,Kl as mn,xi as mr,fp as mt,Eh as n,Du as nn,Vi as nr,Jp as nt,yh as o,_u as on,Ni as or,$p as ot,uh as p,Jl as pn,ki as pr,Pp as pt,am as q,ba as qn,Vu as qt,Dh as r,Eu as rn,zi as rr,qp as rt,hh as s,gu as sn,V as sr,tm as st,wh as t,xu as tn,ia as tr,fm as tt,_h as u,nu as un,wi as ur,Ap as ut,qm as v,ec as vn,$r as vr,tp as vt,oh as w,zo as wn,qd as wt,zm as x,Y as xn,Yr as xr,ep as xt,lh as y,Qs as yn,Xr as yr,Qf as yt,ym as z,Wa as zn,Fd as zt};